OpenTelemetry Collector v0.165.0-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/otelcol:v0.165.0-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/otelcol:v0.165.0-CE-ubuntu24.04-r1
  • Index digestsha256:a614e826fd75c1f0518b6f766053c2d643694d2e131c89908425f32902d2ea70
  • linux/amd64 digestsha256:8894fe0b55ccfe536182cd330b019dfd9093ab3f57e1909900fc60e6a5d03ab8
  • ArchiveReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 nowe41b6e6ba80f3f154b008454a1c02d6da53e9eb52691b9e5330fe94346b36150
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T05:02:50Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.trail.json
ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.trail.jsonReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.trail.mdOpenTelemetry Collector product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductOpenTelemetry Collector (otelcol) [MANIFEST.json]
  • Release tagv0.165.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/otelcol:v0.165.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:a614e826fd75c1f0518b6f766053c2d643694d2e131c89908425f32902d2ea70 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:8894fe0b55ccfe536182cd330b019dfd9093ab3f57e1909900fc60e6a5d03ab8 [ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.tar.gz (bytes 479601744) [MANIFEST.json]
  • Archive sha256 at publishe41b6e6ba80f3f154b008454a1c02d6da53e9eb52691b9e5330fe94346b36150 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/open-telemetry/opentelemetry-collector-releases [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv0.165.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitb9425f263115f328bc3bd4e65b825101b499f144 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashb557a9d720177cf7dddb0127a892960b854e2363a6898f4213f1e2f61f20e0b8 (files 181) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:aceff1d8c5f06628f1673cda8c0534fb8916c6823782b575d4256d970a0139f0 [ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794025959 (utc 2026-11-07T04:32:39Z) [ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit 70e6bdff7c0e7d3ec863993e8fb01b616e6715cb · dirty yes · first drive 3835
    • commit c5e7dd5f5102b6513cc8599f893f62b82c80530d · dirty yes · first drive 3876
    • commit 58e9240297aa7166e0dec2e18a9c5ae2e84212bf · dirty yes · first drive 3879
    • commit f5a5de65751a9a2ee38814f31162a0654a970dee · dirty yes · first drive 3885
    • commit 893ddf91074580cc5f11ded7558920733b65fc43 · dirty yes · first drive 3944
    • commit 33cc96c2cc3645c7bfbc3866df5a3c028834af3e · dirty yes · first drive 3954
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain893 (created 2026-11-08T16:36:58Z · trigger customer_request · upstream version v0.165.0) [chains, chains #893]
  • Requestbuild request #589 (rebuild) (requested at 2026-11-08T15:08:56Z · requested by kitforge-agent · version v0.165.0) [build_requests, build_requests #589]
  • Reasonretarget to v0.165.0: a newer upstream release (rule 1) [build_requests, build_requests #589 request_reason]
  • Supersedesreadystack/otelcol:v0.164.0-CE-ubuntu24.04-r1 (chain 708) [chains, chains #708]

The path through the harness

Fully recorded

2 chains · 10 drives · 18 stages · 4 rewinds

Chain 745 behind it · abandoned

Created 2026-10-28T02:04:47Z, upstream v0.164.0, build request 442 [chains, chains #745]

Abandoned: chain 745 abandoned: stale (it targets 'v0.164.0', the strategy 'v0.165.0') [watch_queue, watch_queue #12272 resolution]

DriveStartedMinutesBuild hostHow it stopped
9932026-10-28T02:05:09Z56.2build host 5 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #993] rebuilt from a build line's log
34802026-11-03T06:12:38Z0.8build host 5 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3480]
35352026-11-07T01:41:07Z24.4build host 5 withhold-publish stage_failed at verdict; first failed check scout_verdict:release_check_passed; 4 ticks [drive_runs, drive_runs #3535]
37582026-11-08T10:11:46Z28.4build host 5 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 15 ticks [drive_runs, drive_runs #3758]

Chain 893 release · ready_to_ship

Created 2026-11-08T16:36:58Z, upstream v0.165.0, build request 589 [chains, chains #893]

DriveStartedMinutesBuild hostHow it stopped
38352026-11-08T16:37:21Z77.6build host 5 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #3835]
38762026-11-08T20:35:31Z3.9build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3876]
38792026-11-08T21:05:17Z3.6build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3879]
38852026-11-08T21:32:00Z2.7build host 5 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3885]
39442026-11-09T04:02:36Z4.8build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3944]
39542026-11-09T04:57:08Z—build host 5 publish-held not recorded [drive_runs, drive_runs #3954]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-08T16:37:32Z2026-11-08T16:37:33Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 4ff7de6f5504…
acquire 2026-11-08T16:37:37Z2026-11-08T16:37:37Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 09a04087ecfa…
license_file c71d239df917…
custody_inputs f3cc856d3827…
source_tree_hash e570adfdf814…
source_file_manifest 7bb1c802cf5e…
plan 2026-11-08T16:38:19Z2026-11-08T16:38:19Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 5cd9ee27502c…
input_pin_plan 3c2fefa69c60…
toolchain_lock c5cd3e445151…
assemble_kit 2026-11-08T16:52:30Z2026-11-08T16:52:31Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 2a09b7898383…
build_recipe 5ae12a9b33c4…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 648162097e9b…
verify_offline_sh 3e8184ea230c…
base_image_digests 44d085428168…
dockerfile_offline 2a09b7898383…
first_build_digest b7a62eb51cf2…
remediate 2026-11-08T16:53:17Z2026-11-08T16:53:18Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 04ef091d9d41…
security_report 43fcca922fb8…
build_kit 2026-11-08T17:12:22Z2026-11-08T17:12:22Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 79e0f47f7584…
locked_digest 917a8187ef7e…
freeze_manifest 9323599ce287…
offline_rebuild_transcript d6d58ef5b5c1…
verdict 2026-11-08T17:13:22Z2026-11-08T17:13:23Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict c719cbe1bd70…
publish_image 2026-11-08T17:14:08Z2026-11-08T17:14:09Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme a39c14d1ae47…
promotion_record da0f0357a2c0…
boot_instance 2026-11-08T17:14:16Z2026-11-08T17:14:22Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 5cd5b4623305…
sbom 2026-11-08T17:14:38Z2026-11-08T17:14:38Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md d57bfb368684…
sbom_json 0ca671f51212…
schema_discovery 2026-11-08T17:14:41Z2026-11-08T17:14:42Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 97e0f0b4a028…
dependency_tree 748a54ec92bc…
table_classification 06a641bd6fda…
admin_handbook 2026-11-08T17:28:00Z2026-11-08T17:28:01Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 2730214e68eb…
admin_handbook 1c87421a12f3…
db_handbook 2026-11-08T17:41:30Z2026-11-08T17:41:31Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 26d3ebf1ab9f…
seed_isolation 4c787a2c463e…
seed_data 2026-11-08T17:41:39Z2026-11-08T17:41:40Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql a2a1b6dea45d…
seed_cases_json cb4189180bec…
seed_validate 2026-11-08T17:41:42Z2026-11-08T17:41:43Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract b97d79547b9d…
usecase_validate 2026-11-08T17:42:10Z2026-11-08T17:42:11Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests 776074411b34…
passed_tests 4ee9ccc58813…
test_results 648103e40e6b…
usecase_contract 42c508040d17…
finalize_docs 2026-11-08T17:42:18Z2026-11-08T17:42:19Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 4610ba2889b5…
release_notes 2418cda94792…
api_integration_guide 392666939e7b…
package_archive invalidated 2026-11-09T04:56:37Z 2026-11-08T17:54:52Z2026-11-09T04:07:23Z5
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar e93620d9e2fc…
checksums 21d216ad35fb…
verify_md 005b2f4a2b87…
rebuild_md 1e57167469cb…
manifest_txt 22d679d8a98a…
actions_jsonl 8d355154ea7f…
provenance_md 5c09bbe85e6e…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json f734f5e67409…

[stage_runs]

Rewinds

  • 2026-11-08T18:24:39Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27027]
  • 2026-11-08T21:04:36Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27390]
  • 2026-11-08T21:30:44Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27420]
  • 2026-11-09T04:56:37Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27995]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T04:07:23Z.

153 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 010073 —
remediate2001 013489 L-A08, L-038, L-036, L-034, L-032
admin_handbook723403 9514587 —
db_handbook763103 10548694 —
usecase_validate1001 02413 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

4 rounds, 4 counted, $8.34 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-08T17:56:45Z 0521 findings to repackage [held_rounds, held_rounds #1531] $2.24 3 rounds, $40.00 59252926052d…
22026-11-08T20:39:50Z 0117 findings to repackage [held_rounds, held_rounds #1540] $2.26 3 rounds, $40.00 62c83e0554bf…
32026-11-08T21:09:37Z 0010 clean to repackage [held_rounds, held_rounds #1544] $2.27 3 rounds, $40.00 ca405bc8d1c2…
42026-11-09T04:08:23Z 003 clean to publish [held_rounds, held_rounds #1576] $1.57 3 rounds, $40.00 e93620d9e2fc…

Defects

Fully recorded
  • Ledger entries56 [defects, defects where product_slug=otelcol and this tag or chain]
  • Disclosed in the archive56 [docs/defects/defects.json, entries]

56 ledger entries: by severity high 7, low 49; by status open 1, fixed-before-release 55.

DefectSeverityStatusFound byFixed in
RSD-otelcol-7ea0f5a3a0
Unauthenticated access by default [defects, defects #181707]		highopenbuild strategy record—
RSD-otelcol-fef272e3c2
Admin handbook: Claims the zpages/pprof/expvar routes are also served on the OTLP/HTTP port 4318; they are not (404), and it contradicts the Ports facts and every other section. [defects, defects #182154]		highfixed-before-releaseheld review (review model)—
RSD-otelcol-a099786416
Admin handbook: Tells the customer to run curl inside the container; the chiselled image has no curl (the Operating facts at line 167 say so). [defects, defects #182155]		highfixed-before-releaseheld review (review model)—
RSD-otelcol-94ac8285e5
Admin handbook: The command fails: the binary is not at /usr/local/bin/otelcol (only rs-probe is there). [defects, defects #182156]		highfixed-before-releaseheld review (review model)—
RSD-otelcol-b7592121b3
Admin handbook: Same wrong binary path as line 991; the command fails. [defects, defects #182157]		highfixed-before-releaseheld review (review model)—
RSD-otelcol-03400a1c3d
Database handbook: Tells the customer to install curl with apt-get inside the container; there is no apt-get, the user is non-root, and the handbook elsewhere says to use rs-probe. [defects, defects #182158]		highfixed-before-releaseheld review (review model)—
RSD-otelcol-ad187d57d2
Admin handbook: Misquotes the HEALTHCHECK command as a `docker exec rs-probe ...` line. [defects, defects #182159]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-db68068d1b
Admin handbook: Same class as the round-3 'only 4318 and 4317' finding: the run command publishes three ports, not only 13133. [defects, defects #182160]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-c4bc218167
Admin handbook: Says Content-Type can be omitted for JSON; the receiver answers 415 without it. [defects, defects #182161]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-8867254eac
Admin handbook: Unsupported generalisation about SDK defaults; an SDK pointed at 4318 with the wrong protocol fails. [defects, defects #182162]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-1956ea129a
Admin handbook: Contradicts the Health check facts: an exited collector does not answer 503. [defects, defects #182163]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-50c5e31174
Admin handbook: As written, another container on a user-defined network cannot reach the loopback-only ports; it works only after the endpoints are re-bound. [defects, defects #182164]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-1d0693863b
Admin handbook: Names the wrong endpoint (/debug/vars) for the self-metric. [defects, defects #182165]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-0a92fd5bac
Admin handbook: Log example differs from the real and other documented lines. [defects, defects #182166]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-deb9bdd777
Admin handbook: Without -body rs-probe prints nothing, so this example does not show the page it describes. [defects, defects #182167]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-45c5c7005d
Admin handbook: --online cannot be used without rebuilding first; VERIFY_OFFLINE.sh needs rebuilt.oci.tar. [defects, defects #182168]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-7bef89b373
Database handbook: The zpages root path answers 404; the pages are under /debug/. [defects, defects #182169]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-64ff86ce4a
Database handbook: Attributes receiver refused-spans counts to exporter retries; they come from memory_limiter refusals. [defects, defects #182170]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-411a59fb33
Database handbook: Contradicts the Health check facts and lines 360/1034/1787: 503 before ready, silence only after an exit. [defects, defects #182171]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-1fa647a7ce
Database handbook: 'The same command' follows the 8888/metrics example, but the HEALTHCHECK probes port 13133. [defects, defects #182172]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-68573712bf
Database handbook: The start command is `otelcol --config /etc/otelcol/config.yaml`, not just the file path. [defects, defects #182173]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-da587f0922
Database handbook: k8sattributes and tail_sampling are processors, not receivers. [defects, defects #182174]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-34285aa223
Database handbook: Contradicts line 914: the prometheus exporter serves a scrape endpoint; it does not push to a Pushgateway. [defects, defects #182175]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-c84b316d96
Database handbook: Lists a nop processor that is not compiled in; a configuration naming it fails validation (the same list at line 971). [defects, defects #182176]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-6c91c980fe
Database handbook: Same nop processor claim as line 940; the line 948 rule says a processor not listed fails validation, yet this one is listed and fails. [defects, defects #182177]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-41661181e2
Database handbook: Same contradiction as line 1729. [defects, defects #182178]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-573460c6c1
API guide: Labels the health check as the ZPages endpoint. [defects, defects #182179]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-82514c5758
Database handbook: The 'Ownership of Copied Files' procedure chowns only /t, not the files in it, so the TLS key stays unreadable by uid 999. [defects, defects #184414]		highfixed-before-releaseheld review (review model)—
RSD-otelcol-bddbeefd00
Database handbook: Self-contradictory ownership/mode statement about docker cp'd files. [defects, defects #184415]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-3ee41df5e6
Database handbook: Generalises 'mode 600' to every copied file. [defects, defects #184416]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-82e528e20e
Admin handbook: Example chown does not change the files in the volume. [defects, defects #184417]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-4318289b66
Admin handbook: Says an invalid configuration may give 503, contradicting the Health check facts. [defects, defects #184418]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-7667f785c1
Database handbook: Merges the 503-before-ready state with the exit-on-invalid-config state. [defects, defects #184419]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-92198fb8ab
Admin handbook: Attributes the self-metrics endpoint to ports 1777 and 55679. [defects, defects #184420]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-1accd8eb2a
Admin handbook: Routes listed without ports directly after the 4318 receiver routes read as served on the OTLP port. [defects, defects #184421]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-cc1feeb455
API guide: Routes table lists non-OTLP routes without ports under a 4318 base URL. [defects, defects #184422]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-d8dd866a20
Database handbook: Wrong extension count and self-contradicting binding statement. [defects, defects #184423]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-3acf17cdcd
Database handbook: Claims specific tested GC counts that the records do not show and a re-run does not reproduce. [defects, defects #184424]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-98ff72bdce
Database handbook: Cites an unrecorded test setup. [defects, defects #184425]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-d79893956c
Database handbook: Calls a component alias a 'configuration provider'. [defects, defects #184426]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-2db177c769
Database handbook: Cross-reference to sections that do not exist. [defects, defects #184427]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-83b056371f
Database handbook: Names BuildKit where the requirement is the docker buildx plugin version. [defects, defects #184428]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-62c9353631
Database handbook: Single-file bind mount plus reload silently keeps stale config after an inode-replacing edit. [defects, defects #184429]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-823abad788
Admin handbook: Endpoint-only SDK setting for the gRPC port omits the protocol. [defects, defects #184430]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-413ff0e2f7
Admin handbook: IMAGE_CONFIG.json: no OTEL_* env; OTel SDKs default OTEL_EXPORTER_OTLP_PROTOCOL to http/protobuf. [defects, defects #185523]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-1bf36eff9e
Database handbook: IMAGE_CONFIG.json: no OTEL_* env; OTel SDKs default OTEL_EXPORTER_OTLP_PROTOCOL to http/protobuf. [defects, defects #185524]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-44d5bee3d1
Database handbook: IMAGE_CONFIG.json: no OTEL_* env; OTel SDKs default OTEL_EXPORTER_OTLP_PROTOCOL to http/protobuf. [defects, defects #185525]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-347abca8b1
Admin handbook: Same defect class as the round-2 major (chown without -R changes only the top directory). [defects, defects #185526]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-ee9ed415da
Admin handbook: ADMIN_HANDBOOK.md:1341 (next paragraph) tells the reader to mount the directory with -v "$PWD/otelcol:/etc/otelcol:ro"; every other validate command in both handbooks (e.g. [defects, defects #185527]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-d9274c07b3
Admin handbook: `otelcol components` on the running image lists the receiver as file_log and the processor as resource_detection (measured; also command-transcripts.json 'otelcol components'); ADMIN_HANDBOOK.md:179, [defects, defects #185528]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-050334b9fa
Admin handbook: `otelcol components` lists resource_detection (measured); see the receiver item above. [defects, defects #185529]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-c943b4be78
Admin handbook: Measured: after one accepted OTLP/HTTP trace, GET http://127.0.0.1:8888/metrics lists otelcol_receiver_accepted_spans, otelcol_receiver_failed_spans and otelcol_receiver_refused_spans; nothing is logg [defects, defects #185530]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-e4051d535c
API guide: Round-2 finding 'routes listed without ports directly after the 4318 receiver routes' was fixed only in the /metrics row (line 33); the GET / row directly after the three 4318 POST rows still has no p [defects, defects #185531]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-fc92c834ea
Database handbook: gRPC port instruction names only the endpoint, the setting the doc gate refused in the rewritten sections. [defects, defects #193699]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-cdf3616559
Database handbook: Port 4317 instruction omits OTEL_EXPORTER_OTLP_PROTOCOL=grpc. [defects, defects #193700]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-c794a7a81c
Admin handbook: zpages described as per-signal summary pages; the extension serves only the four service/pipeline/extension/feature-gate pages. [defects, defects #193701]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:8894fe0b55ccfe536182cd330b019dfd9093ab3f57e1909900fc60e6a5d03ab8 · published digest sha256:8894fe0b55ccfe536182cd330b019dfd9093ab3f57e1909900fc60e6a5d03ab8 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 462) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T04:57:39Z · failing Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T04:57:20Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3761353705 · transparency-log entry · integrated 2026-11-09T05:01:30Z) [ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:a614e826fd75c1f0518b6f766053c2d643694d2e131c89908425f32902d2ea70 · state attached · log index 3761355364 · transparency-log entry
    • kind sbom · digest sha256:a614e826fd75c1f0518b6f766053c2d643694d2e131c89908425f32902d2ea70 · state attached · log index 3761356014 · transparency-log entry
    • kind vsa · digest sha256:a614e826fd75c1f0518b6f766053c2d643694d2e131c89908425f32902d2ea70 · state attached · log index 3761356521 · transparency-log entry
    • kind provenance · digest sha256:8894fe0b55ccfe536182cd330b019dfd9093ab3f57e1909900fc60e6a5d03ab8 · state attached · log index 3761356949 · transparency-log entry
    • kind sbom · digest sha256:8894fe0b55ccfe536182cd330b019dfd9093ab3f57e1909900fc60e6a5d03ab8 · state attached · log index 3761357327 · transparency-log entry
    • kind vsa · digest sha256:8894fe0b55ccfe536182cd330b019dfd9093ab3f57e1909900fc60e6a5d03ab8 · state attached · log index 3761357484 · transparency-log entry
    (at 2026-11-09T05:01:31Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/otelcol/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-08T17:56:50Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:8894fe0b55ccfe536182cd330b019dfd9093ab3f57e1909900fc60e6a5d03ab8 [clean-room rebuild ledger, runs[661]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-08T17:14:09Z [stage_runs, stage_runs chain 893 stage publish_image]
  • Archive manifests written2026-11-09T04:59:34Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 58 · probed 2026-11-08T17:04:22Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T05:02:50Z generated: by KitForge release/build_trail.py · generator commit 33cc96c2cc3645c7bfbc3866df5a3c028834af3e
  • 2026-11-09T05:04:18Z publication: promoted at 2026-11-09T05:03:22Z · promoted digest sha256:a614e826fd75c1f0518b6f766053c2d643694d2e131c89908425f32902d2ea70 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 406 · checklist status complete · checklist at 2026-11-09T05:04:18Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

26 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/otelcol/v0.165.0-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/otelcol/v0.165.0-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/otelcol/v0.165.0-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-otelcol-v0.165.0-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/otelcol/v0.165.0-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/otelcol/v0.165.0-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)589
chainssadb, ReadyStack's engine database (not published)745, 893
defectssadb, ReadyStack's engine database (not published)otelcol v0.165.0-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 745, chain 893
held_roundssadb, ReadyStack's engine database (not published)chain 893
lesson_recallssadb, ReadyStack's engine database (not published)chain 893
micro_step_runssadb, ReadyStack's engine database (not published)chain 893
release_imagessadb, ReadyStack's engine database (not published)otelcol v0.165.0-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 893
stage_runssadb, ReadyStack's engine database (not published)chain 893
watch_queuesadb, ReadyStack's engine database (not published)12272
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—