Prometheus v3.16.0-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/prometheus:v3.16.0-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/prometheus:v3.16.0-CE-ubuntu24.04-r2
  • Index digestsha256:b11f684735f6b6a52a9ecd53d2941cb6d7272b4944e5c7ea799c0538a9497910
  • linux/amd64 digestsha256:31a617c794e90d43d5a9cd93c8b9406b1dc3dfcc59d7a73e2cda61a618af5cf7
  • ArchiveReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 now86cd5ea32cd0fd97cc9bfdf50e1d4aec9366da2d5a53cd46282f78383f588f13
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-08T13:13:53Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.trail.json
ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.trail.jsonReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.trail.mdPrometheus product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductPrometheus (prometheus) [MANIFEST.json]
  • Release tagv3.16.0-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/prometheus:v3.16.0-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:b11f684735f6b6a52a9ecd53d2941cb6d7272b4944e5c7ea799c0538a9497910 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:31a617c794e90d43d5a9cd93c8b9406b1dc3dfcc59d7a73e2cda61a618af5cf7 [ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.tar.gz (bytes 622097139) [MANIFEST.json]
  • Archive sha256 at publish86cd5ea32cd0fd97cc9bfdf50e1d4aec9366da2d5a53cd46282f78383f588f13 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/prometheus/prometheus [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv3.16.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commite2e28adeee2c5883d000fc82aca6008cfbf7e96d [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashdbee8a20cb6bdde803a797b6ba7906ee1c8a010292fce25e73721ed51e1c0980 (files 1714) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:647d6d23b3f04349b0296f8ac650428bd76690f3511a986384ef0be01d8aa416 [ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793891211 (utc 2026-11-05T15:06:51Z) [ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Engine commit(s)
    • commit de82d9f15f2f16d4019ffa4fd6872481dac1dbe0 · dirty yes · first drive 3671
    • commit 92dcb99fd5af2466b8a040e9b12f1cd9afdd07b3 · dirty yes · first drive 3690
    • commit 5ae75d77c632e784223ac58929550a23c26886b6 · dirty yes · first drive 3715
    • commit 1b6b66826eaa0cb5f2f833b5a6a84e7c72e9e068 · dirty yes · first drive 3757
    • commit 3d32cc1dd39bba72d2a0135dfa6216cfa284f64a · dirty yes · first drive 3776
    • commit 14ac19f4178268c2dbfa7e7cae4be76d466ea445 · dirty yes · first drive 3791
    • commit 84cdb58a2214910621bb9bf44c715ab9a064b838 · dirty yes · first drive 3804
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain862 (created 2026-11-08T02:56:44Z · trigger customer_request · upstream version v3.16.0) [chains, chains #862]
  • Requestbuild request #541 (rebuild) (requested at 2026-11-08T02:54:51Z · requested by kitforge-agent · version v3.16.0) [build_requests, build_requests #541]
  • Reasonrevision v3.16.0-CE-ubuntu24.04-r2: same upstream version rebuilt on the chiselled slim base (Core slim batch, PR #195; retarget.py --rev-bump) [build_requests, build_requests #541 request_reason]
  • Supersedesreadystack/prometheus:v3.16.0-CE-ubuntu24.04-r1 (chain 821) [chains, chains #821]

The path through the harness

Fully recorded

1 chain · 7 drives · 18 stages · 2 rewinds

Chain 862 release · ready_to_ship

Created 2026-11-08T02:56:44Z, upstream v3.16.0, build request 541 [chains, chains #862]

DriveStartedMinutesBuild hostHow it stopped
36712026-11-08T02:57:32Z66.5build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #3671]
36902026-11-08T04:30:52Z2build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3690]
37152026-11-08T06:11:34Z1.6build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3715]
37572026-11-08T10:11:43Z1.7build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3757]
37762026-11-08T11:18:56Z13.6build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3776]
37912026-11-08T12:13:47Z7.6build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3791]
38042026-11-08T13:05:14Z—build host 3 publish-held not recorded [drive_runs, drive_runs #3804]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-08T02:57:43Z2026-11-08T02:57:43Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 5a1b2bc9dd4d…
acquire 2026-11-08T02:57:48Z2026-11-08T02:57:49Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 63f060102fd5…
license_file c71d239df917…
custody_inputs 3fcd27c28b76…
source_tree_hash a2d03641017a…
source_file_manifest 03180dc43fcf…
plan 2026-11-08T02:58:28Z2026-11-08T02:58:29Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report d65e092272a6…
input_pin_plan 2057124960c4…
toolchain_lock a6af3960d3f8…
assemble_kit 2026-11-08T03:10:47Z2026-11-08T03:10:48Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile be5aaa0801e1…
build_recipe 9e31c78ca9f2…
system_pinning fa091140511e…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health a6c05159a22a…
verify_offline_sh 3e8184ea230c…
base_image_digests 57c8cb73a230…
dockerfile_offline be5aaa0801e1…
first_build_digest ae4f9c91f5c1…
remediate 2026-11-08T03:11:18Z2026-11-08T03:11:19Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 6fa2aa146d2b…
security_report 00614d028674…
build_kit 2026-11-08T03:23:58Z2026-11-08T03:23:59Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp d67598a14b82…
locked_digest c1f6879d3e9d…
freeze_manifest 71c53044e146…
offline_rebuild_transcript d761ea508b5e…
verdict 2026-11-08T03:24:46Z2026-11-08T03:24:47Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 2dcfb7a0702f…
publish_image 2026-11-08T03:25:33Z2026-11-08T03:25:34Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 0836946b1aa4…
promotion_record 72be480c5a61…
boot_instance 2026-11-08T03:25:40Z2026-11-08T03:25:45Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 1b2ba2ae0c8a…
sbom 2026-11-08T03:25:59Z2026-11-08T03:26:00Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 053b0a03ff1d…
sbom_json 34bd1c2d589a…
schema_discovery 2026-11-08T03:26:05Z2026-11-08T03:26:06Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash d311e2886763…
dependency_tree 77fe7001d873…
table_classification c75fa9c5e1a8…
admin_handbook 2026-11-08T03:34:52Z2026-11-08T03:34:53Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 87a4a1a5f7f8…
admin_handbook c0cfdb01ef15…
db_handbook 2026-11-08T03:42:52Z2026-11-08T03:42:54Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 68fef8f8546d…
seed_isolation ece6e82a0623…
seed_data 2026-11-08T03:43:13Z2026-11-08T03:43:14Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 4857e7c347b3…
seed_cases_json 8f3597aea496…
seed_validate 2026-11-08T03:43:20Z2026-11-08T03:43:22Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract d097794fc51e…
usecase_validate 2026-11-08T03:44:08Z2026-11-08T03:44:10Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 9c5fbec03f3f…
test_results 9f84cf86f91d…
usecase_contract bd505fd50f79…
finalize_docs 2026-11-08T03:55:57Z2026-11-08T03:55:58Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json c6f742f46251…
release_notes b6839fdb6877…
api_integration_guide c107cf1e2b42…
package_archive invalidated 2026-11-08T13:04:47Z 2026-11-08T04:03:59Z2026-11-08T12:21:23Z6
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar d671b561904b…
checksums 7438e7585716…
verify_md a4039da337c0…
rebuild_md 8901f65ca294…
manifest_txt 020255fef2a2…
actions_jsonl 7d2e00d76a79…
provenance_md 2466bdcb2cbe…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 0a10621727d2…

[stage_runs]

Rewinds

  • 2026-11-08T12:04:13Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26117]
  • 2026-11-08T13:04:47Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26315]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-08T12:21:23Z.

206 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 08579 L-A183, L-A15
remediate2001 08256 L-A183, L-A15
admin_handbook653703 11372471 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook754103 16365269 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate1001 02277 L-A59
finalize_docs612903 7331207 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $3.20 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-08T11:33:37Z 0323 findings to repackage [held_rounds, held_rounds #1508] $1.70 3 rounds, $40.00 e3489d37fa14…
22026-11-08T12:21:57Z 007 clean to publish [held_rounds, held_rounds #1511] $1.51 3 rounds, $40.00 d671b561904b…

Defects

Fully recorded
  • Ledger entries34 [defects, defects where product_slug=prometheus and this tag or chain]
  • Disclosed in the archive34 [docs/defects/defects.json, entries]

34 ledger entries: by severity high 4, low 30; by status open 2, fixed-before-release 32.

DefectSeverityStatusFound byFixed in
RSD-prometheus-3dfec9d776
Unauthenticated access by default [defects, defects #170135]		highopenbuild strategy record—
RSD-prometheus-70bc53b8d0
Admin handbook: Ran `docker tag sha256:31a617c7...5cf7 x` (the manifest digest BUILD_OFFLINE.sh prints as REBUILT_DIGEST, line 123 of BUILD_OFFLINE.sh) on this host: `Error response from daemon: No such image:… [defects, defects #176329]		highfixed-before-releaseheld review (review model)—
RSD-prometheus-fe32dfadc1
API guide: Same procedure as ADMIN_HANDBOOK.md:600: the `<digest>` a reader takes from BUILD_OFFLINE.sh (manifest digest sha256:31a617...) gives `Error response from daemon: No such image`; only the loaded… [defects, defects #176330]		highfixed-before-releaseheld review (review model)—
RSD-prometheus-28e28f295b
Admin handbook: Ran this override (without -code) on the image with --web.config.file and basic auth: after 20 s `docker inspect` State.Health = `unhealthy`, FailingStreak 4 (the probe gets 401 and exits non-zero). [defects, defects #176331]		highfixed-before-releaseheld review (review model)—
RSD-prometheus-d4496ba7c4
Admin handbook: Same handbook (lines 346, 495, 535) and DB_HANDBOOK.md:416 say /-/healthy is liveness only and /-/ready is the readiness endpoint (repeat of the round-3 finding class). [defects, defects #176332]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-bd66a50109
Admin handbook: Dockerfile.offline.pinned:5-12 `COPY vendored/prometheus-src/ .` then compiles prometheus and promtool in golang:1.26.10-bookworm; no binary is in MANIFEST.txt; the runtime packages are Ubuntu… [defects, defects #176333]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-07aef72b7b
Admin handbook: Port 9090 > 1024; no special kernel setting is involved (IMAGE_CONFIG.json: User nobody, no capabilities added). [defects, defects #176334]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-3b32edefbb
API guide: 9090 is not below 1024; the sentence explains a case that does not apply and states kernel/Docker version conditions no record supports. [defects, defects #176335]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-1b4a82798f
Database handbook: DB_HANDBOOK.md:416 and 417 say /-/healthy is independent of TSDB/config loading; ADMIN_HANDBOOK.md:346 says /-/ready is the readiness endpoint. [defects, defects #176336]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-8e9b9d2cc6
Database handbook: IMAGE_CONFIG.json Healthcheck probes /-/healthy only (liveness); same DB handbook line 317 'liveness'. [defects, defects #176337]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-eb27a1eb4c
Database handbook: Contradicts DB_HANDBOOK.md:416. [defects, defects #176338]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-c1af4a404e
Database handbook: DB_HANDBOOK.md:416 says /-/healthy operates independently of TSDB open/config load; ADMIN_HANDBOOK.md:346 assigns that to /-/ready. [defects, defects #176339]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-d17f7a8c00
Database handbook: `docker exec <c> cat /etc/passwd /etc/group` on the image: `nobody:*:65534:65534:nobody:/nonexistent:/usr/sbin/nologin` and `nogroup:*:65534:`; RUNTIME_IDENTITY.txt `uid=65534(nobody)… [defects, defects #176340]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-21609d8031
Database handbook: Ran the image with a prometheus.yml at mode 600 in a :ro mounted dir: `Error loading config ... [defects, defects #176341]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-8ecf970c9a
Database handbook: DB_HANDBOOK.md:103 and 492: the override sends no authentication header; rs-probe -code exits 0 on any answer. [defects, defects #176342]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-2945383468
Database handbook: `docker exec jt-ha862-p /bin/sh` without -i/-t returned rc=0 at once with no session (stdin is closed); the image has /bin/sh (IMAGE_BINARIES.txt: sh). [defects, defects #176343]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-6851f0ccce
Database handbook: The block that follows pulls ubuntu:24.04 (not the release image) and bind-mounts /path/to/backup; run here it wrote a root-owned file (`-rw-r--r-- 1 root root ... [defects, defects #176344]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-3caabcc993
Database handbook: Contradicts the same handbook (lines 115, 566-574, 996): Prometheus keeps its state in the TSDB under /prometheus. [defects, defects #176345]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-f6d84539e9
API guide: API guide lines 108, 295 and 1164 describe /-/healthy as serving-only; /-/ready (line 1166) is the readiness check. [defects, defects #176346]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-0ca1d2e9a5
API guide: Same /-/healthy liveness-vs-readiness contradiction (API guide:1164-1166). [defects, defects #176347]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-2e92356f27
API guide: Same contradiction with API guide:1164-1166. [defects, defects #176348]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-f0cabcb1b6
API guide: API guide:316-319 and 472: the override uses -code and no credentials; a probe with credentials is not what the guide shows. [defects, defects #176349]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-6d58f8b860
API guide: Ran with --web.config.file: `curl localhost:19091/-/healthy` -> 401. [defects, defects #176350]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-416c93265f
API guide: Same 401 measurement; contradicts API guide:303 and 404. [defects, defects #176351]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-770b0e2fa5
API guide: /api/v1/query evaluates an instant query (`query=up&start=0&end=1&step=1` returned HTTP 200 with resultType vector semantics, no range); range queries are served at /api/v1/query_range, which… [defects, defects #176352]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-5594863604
API guide: API guide:700 and 1079 and ADMIN_HANDBOOK.md:156 say a host directory makes Prometheus exit with `open /prometheus/queries.active: permission denied`. [defects, defects #176353]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-f837b910ce
API guide: Step 3 (line 496) then sends HUP 'without restarting'; HUP re-reads only a file the container already mounted: the container created with only prom-web reads the image's prometheus.yml and up stays… [defects, defects #176354]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-d4e4736a07
Admin handbook: Says the override must include authentication; the documented override (same handbook lines 336 and 370) passes no credentials, and rs-probe has no credential option. [defects, defects #177114]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-953f6bd6ee
API guide: Tells the reader to put credentials into the Docker health check; the image's rs-probe cannot send them and the documented fix is the -code override (guide lines 313-319, 406). [defects, defects #177115]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-873d293a58
API guide: Offers an unauthenticated endpoint that does not exist (basic auth covers /-/healthy, /-/ready, /metrics and /api/v1) and credentials the image's probe cannot send; contradicts guide:316-319 and 406. [defects, defects #177116]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-162e613307
API guide: `:ro` is not required by the image; nothing in the records says Prometheus fails without it. [defects, defects #177117]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-9f268defb4
API guide: The web-config/TLS-key failure exits with code 1, not 2. [defects, defects #177118]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-46e6f3191b
API guide: Contradicts the same guide (lines 735, 882, 1148: do not restore with docker cp); tar xf does not restore permissions of files already copied, and the sentence gives no usable procedure. [defects, defects #177119]		lowfixed-before-releaseheld review (review model)—
RSD-prometheus-ff0d4a31e6
Docker Hub README: Says the kit is free (also line 15 'free with an account'); the shipped bundle/MANIFEST.json prices it and marks the release not free. [defects, defects #177120]		lowopenheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:31a617c794e90d43d5a9cd93c8b9406b1dc3dfcc59d7a73e2cda61a618af5cf7 · published digest sha256:31a617c794e90d43d5a9cd93c8b9406b1dc3dfcc59d7a73e2cda61a618af5cf7 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 374) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T13:05:38Z · failing Docker Scout counts 11 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T13:05:25Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3755798861 · transparency-log entry · integrated 2026-11-08T13:12:07Z) [ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:b11f684735f6b6a52a9ecd53d2941cb6d7272b4944e5c7ea799c0538a9497910 · state attached · log index 3755800573 · transparency-log entry
    • kind sbom · digest sha256:b11f684735f6b6a52a9ecd53d2941cb6d7272b4944e5c7ea799c0538a9497910 · state attached · log index 3755800790 · transparency-log entry
    • kind vsa · digest sha256:b11f684735f6b6a52a9ecd53d2941cb6d7272b4944e5c7ea799c0538a9497910 · state attached · log index 3755801083 · transparency-log entry
    • kind provenance · digest sha256:31a617c794e90d43d5a9cd93c8b9406b1dc3dfcc59d7a73e2cda61a618af5cf7 · state attached · log index 3755801168 · transparency-log entry
    • kind sbom · digest sha256:31a617c794e90d43d5a9cd93c8b9406b1dc3dfcc59d7a73e2cda61a618af5cf7 · state attached · log index 3755801304 · transparency-log entry
    • kind vsa · digest sha256:31a617c794e90d43d5a9cd93c8b9406b1dc3dfcc59d7a73e2cda61a618af5cf7 · state attached · log index 3755801431 · transparency-log entry
    (at 2026-11-08T13:12:08Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/prometheus/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-08T11:33:42Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:31a617c794e90d43d5a9cd93c8b9406b1dc3dfcc59d7a73e2cda61a618af5cf7 [clean-room rebuild ledger, runs[644]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-08T03:25:34Z [stage_runs, stage_runs chain 862 stage publish_image]
  • Archive manifests written2026-11-08T13:08:54Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 63 · probed 2026-11-08T03:17:28Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-08T13:13:53Z generated: by KitForge release/build_trail.py · generator commit a4b28057068da07708eb51f7599b8594be6751f1
  • 2026-11-08T13:15:54Z publication: promoted at 2026-11-08T13:14:25Z · promoted digest sha256:b11f684735f6b6a52a9ecd53d2941cb6d7272b4944e5c7ea799c0538a9497910 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 372 · checklist status complete · checklist at 2026-11-08T13:15:54Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/prometheus/v3.16.0-CE-ubuntu24.04-r2/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/prometheus/v3.16.0-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/prometheus/v3.16.0-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-prometheus-v3.16.0-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/prometheus/v3.16.0-CE-ubuntu24.04-r2/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/prometheus/v3.16.0-CE-ubuntu24.04-r2/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)541
chainssadb, ReadyStack's engine database (not published)862
defectssadb, ReadyStack's engine database (not published)prometheus v3.16.0-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 862
held_roundssadb, ReadyStack's engine database (not published)chain 862
lesson_recallssadb, ReadyStack's engine database (not published)chain 862
micro_step_runssadb, ReadyStack's engine database (not published)chain 862
release_imagessadb, ReadyStack's engine database (not published)prometheus v3.16.0-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 862
stage_runssadb, ReadyStack's engine database (not published)chain 862
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—