Distribution Registry v3.1.2-CE-ubuntu24.04-r8 build trail

How ReadyStack built readystack/registry:v3.1.2-CE-ubuntu24.04-r8 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/registry:v3.1.2-CE-ubuntu24.04-r8
  • Index digestsha256:1dc516436dee4eaf397b34db1e6158f7afadd928acb6d99415c09ec47d8bce85
  • linux/amd64 digestsha256:5e343345573ae3f3fa657024845fedfab2068d8f4cf96f6e6bfe1777d5cd9b42
  • ArchiveReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.tar.gz
  • Archive SHA-256 nowbbba5dead39fbb1483d8d9e90a6d0b00164791792f3c3018f0ae1fa73d1ca7b6
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-11T20:32:31Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.trail.json.sigstore ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.trail.json
ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.trail.jsonReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.trail.json.sigstoreReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.trail.mdDistribution Registry product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductDistribution Registry (registry) [MANIFEST.json]
  • Release tagv3.1.2-CE-ubuntu24.04-r8 [MANIFEST.json]
  • Imagereadystack/registry:v3.1.2-CE-ubuntu24.04-r8 [MANIFEST.json]
  • Image index digestsha256:1dc516436dee4eaf397b34db1e6158f7afadd928acb6d99415c09ec47d8bce85 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:5e343345573ae3f3fa657024845fedfab2068d8f4cf96f6e6bfe1777d5cd9b42 [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.tar.gz (bytes 479131468) [MANIFEST.json]
  • Archive sha256 at publish028ef8cf9827e11b39591f35695568557e6361e7f63559259a08a015b3c96336 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/distribution/distribution [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv3.1.2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit3220848f15d9279c66a41aa0a257469e6aede1e9 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashb7cd43949374362404d0782d67aca2c20279b89570b5d1401291180757d4d899 (files 4599) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:8edb37b410a30843b06b833fc29d5780396021a1e815eb762d2a99e0464b6f08 [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794290165 (utc 2026-11-10T05:56:05Z) [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.rebuild.json, engine]
  • Engine commit(s)
    • commit e3eaace0a74e1a10fea82b44f3849ea9a0e2216a · dirty yes · first drive 4146
    • commit 4c9b9ae57bdaa41861e468b83c8303059b789f97 · dirty yes · first drive 4184
    • commit 15a720cb2c45d30f874d7f1a88fcd874ac9bb734 · dirty yes · first drive 4193
    • commit 8c06307911557c927272aed1342f4fd649c279f0 · dirty yes · first drive 4228
    • commit a8713fa4a6f0db84709d30e8d42a599f545b2406 · dirty yes · first drive 4234
    • commit b397b0b8f6ec65c200f61f090eeb29c5969be482 · dirty yes · first drive 4236
    • commit 467eb57e7940ba12684129fd11ece63592f7796d · dirty yes · first drive 4243
    • commit 71d02fc0c22809ef2782acabd88e5160257646ea · dirty yes · first drive 4249
    • commit 620d8889fece1a9434ea5c2489f45fdd40dc2b3d · dirty yes · first drive 4256
    • commit 4c774a01707ad40318172ca6b740daa8f9500922 · dirty yes · first drive 4279
    • commit fb3c8c212feaeb8607d5b295a821989cf0ab3e1e · dirty yes · first drive 4298
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain940 (created 2026-11-10T06:03:58Z · trigger customer_request · upstream version v3.1.2) [chains, chains #940]
  • Requestbuild request #620 (rebuild) (requested at 2026-11-10T06:02:04Z · requested by kitforge-agent · version v3.1.2) [build_requests, build_requests #620]
  • Reasonrevision v3.1.2-CE-ubuntu24.04-r8: same upstream version re-dated by its own release (owner 2026-11-10 "date images correctly") [build_requests, build_requests #620 request_reason]
  • Supersedesreadystack/registry:v3.1.2-CE-ubuntu24.04-r7 (chain 864) [chains, chains #864]

The path through the harness

Fully recorded

1 chain · 11 drives · 18 stages · 5 rewinds

Chain 940 release · ready_to_ship

Created 2026-11-10T06:03:58Z, upstream v3.1.2, build request 620 [chains, chains #940]

DriveStartedMinutesBuild hostHow it stopped
41462026-11-10T06:04:25Z4.4build host 5 withhold-publish stage_failed at assemble_kit; first failed check exists:first_build_digest; 4 ticks [drive_runs, drive_runs #4146]
41842026-11-10T20:46:45Z9.7build host 5 withhold-publish stage_failed at assemble_kit; first failed check first_boot_health:file_contains:healthy=True; 1 tick [drive_runs, drive_runs #4184]
41932026-11-10T21:40:21Z40.9build host 2 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 15 ticks [drive_runs, drive_runs #4193]
42282026-11-11T00:22:02Z5.5build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4228]
42342026-11-11T00:53:43Z3.9build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4234]
42362026-11-11T01:21:28Z2.5build host 2 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4236]
42432026-11-11T03:12:23Z2.8build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4243]
42492026-11-11T03:38:19Z3.6build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4249]
42562026-11-11T04:51:53Z3build host 2 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4256]
42792026-11-11T09:06:42Z2.9build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4279]
42982026-11-11T20:28:22Z—build host 2 publish-held not recorded [drive_runs, drive_runs #4298]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-10T06:04:35Z2026-11-10T06:04:36Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 7e59be8fc22e…
acquire 2026-11-10T06:04:42Z2026-11-10T06:04:43Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree ddcd139d1670…
license_file cb5e8e7e5f4a…
custody_inputs 6a5c96dbb28a…
source_tree_hash ba888dab5412…
source_file_manifest c29b0fe5b8c2…
plan 2026-11-10T06:05:14Z2026-11-10T06:05:15Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 19e2c7988f93…
input_pin_plan 9c0615e46f50…
toolchain_lock b86d38a303df…
assemble_kit 2026-11-10T06:08:49Z2026-11-10T21:42:56Z3
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile de3742937d7e…
build_recipe f10c01633bde…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health c40f9a42d4a2…
verify_offline_sh 3e8184ea230c…
base_image_digests af50099de4bd…
dockerfile_offline de3742937d7e…
first_build_digest 5acd0d96a880…
remediate 2026-11-10T21:43:24Z2026-11-10T21:43:25Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log ca93f64b0e48…
security_report 06844bec0d0f…
build_kit 2026-11-10T21:46:47Z2026-11-10T21:46:47Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 068de396bb1b…
locked_digest 9d817be85d24…
freeze_manifest 7d286584ae16…
offline_rebuild_transcript c722079d192f…
verdict 2026-11-10T21:47:16Z2026-11-10T21:47:17Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 67d995aa2efc…
publish_image 2026-11-10T21:47:47Z2026-11-10T21:47:47Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 3253ed846ec2…
promotion_record e592bfdc4285…
boot_instance 2026-11-10T21:47:53Z2026-11-10T21:47:57Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle b516c72ce863…
sbom 2026-11-10T21:48:05Z2026-11-10T21:48:06Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 8ef84614cc56…
sbom_json a3c0cf703acb…
schema_discovery 2026-11-10T21:48:08Z2026-11-10T21:48:09Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 0d42df0f8948…
dependency_tree da81f263714f…
table_classification baf9701ff510…
admin_handbook 2026-11-10T22:02:27Z2026-11-10T22:02:28Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 8a112ecad2a4…
admin_handbook 23123e2e931e…
db_handbook 2026-11-10T22:16:50Z2026-11-10T22:16:51Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook a3720b2b0234…
seed_isolation 5fa93ac554b8…
seed_data 2026-11-10T22:17:00Z2026-11-10T22:17:01Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 251a88e60706…
seed_cases_json b81be054aece…
seed_validate 2026-11-10T22:17:04Z2026-11-10T22:17:04Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 573a4f64212d…
usecase_validate 2026-11-10T22:17:25Z2026-11-10T22:17:25Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests ecaafc754b89…
passed_tests ad26de0fc11a…
test_results 3e6f9b435f56…
usecase_contract b06ac66e38ac…
finalize_docs 2026-11-10T22:17:31Z2026-11-10T22:17:32Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 6eae8f067e64…
release_notes 4a54d5a0eeb4…
api_integration_guide 30f123ac094c…
package_archive invalidated 2026-11-11T20:27:58Z 2026-11-10T22:21:15Z2026-11-11T09:09:33Z8
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 9cc1e87e2d65…
checksums 0e30a3381173…
verify_md 2af85fd17ef5…
rebuild_md 21ef034dde8f…
manifest_txt 73100587f075…
actions_jsonl edf62eb7fe1e…
provenance_md 1c368361d882…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 8ff05b474ed7…

[stage_runs]

Rewinds

  • 2026-11-11T00:52:46Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #30983]
  • 2026-11-11T01:20:20Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #30992]
  • 2026-11-11T03:37:11Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #31101]
  • 2026-11-11T04:02:28Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #31132]
  • 2026-11-11T20:27:58Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #31813]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-11T09:09:33Z.

169 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 08616 L-A183, L-A15
remediate2001 08500 L-A183, L-A15
admin_handbook834003 8628593 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook813503 10658412 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate1001 01737 L-A59

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

5 rounds, 5 counted, $8.80 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-11T00:29:22Z 0020 clean to repackage [held_rounds, held_rounds #1721] $1.97 3 rounds, $40.00 05eb529daf20…
22026-11-11T00:58:13Z 0010 clean to repackage [held_rounds, held_rounds #1723] $2.15 3 rounds, $40.00 3c6877893e24…
32026-11-11T03:15:49Z 004 clean to repackage [held_rounds, held_rounds #1726] $1.35 3 rounds, $40.00 38f7a54332de…
42026-11-11T03:42:32Z 004 clean to repackage [held_rounds, held_rounds #1729] $1.34 3 rounds, $40.00 342d0372238b…
52026-11-11T09:10:01Z 005 clean to publish [held_rounds, held_rounds #1745] $1.99 3 rounds, $40.00 9cc1e87e2d65…

Defects

Fully recorded
  • Ledger entries44 [defects, defects where product_slug=registry and this tag or chain]
  • Disclosed in the archive44 [docs/defects/defects.json, entries]

44 ledger entries: by severity low 44; by status open 1, fixed-before-release 43.

DefectSeverityStatusFound byFixed in
RSD-registry-7e9b49e19c
The comment at the top of the shipped config.yml does not mention that upload purging differs from upstream [defects, defects #239808]		lowopenheld review (review model)—
RSD-registry-ec8ad0c9a7
Admin handbook: The block order contradicts the sentence: the tar block is printed first, the touch/chmod block after it. [defects, defects #240558]		lowfixed-before-releaseheld review (review model)—
RSD-registry-1c0afd3172
Admin handbook: Same ordering contradiction in the second backup section (touch/chmod printed after the tar block). [defects, defects #240559]		lowfixed-before-releaseheld review (review model)—
RSD-registry-c94facb5c0
Admin handbook: Same ordering contradiction in Data and Backups (touch/chmod printed after the tar block). [defects, defects #240560]		lowfixed-before-releaseheld review (review model)—
RSD-registry-b50416fb3c
Database handbook: The sentence says the file is created before the backup, but the tar block is printed first; run top to bottom the archive is root-owned mode 644 and touch/chmod fails. [defects, defects #240561]		lowfixed-before-releaseheld review (review model)—
RSD-registry-e95d9c961d
Database handbook: Same ordering contradiction (backup block printed before the touch/chmod block). [defects, defects #240562]		lowfixed-before-releaseheld review (review model)—
RSD-registry-24d23576a8
Database handbook: Same ordering contradiction (backup block printed before the touch/chmod block). [defects, defects #240563]		lowfixed-before-releaseheld review (review model)—
RSD-registry-2e58ad710c
Admin handbook: Names a flag that does not exist. [defects, defects #240564]		lowfixed-before-releaseheld review (review model)—
RSD-registry-eaf896ffde
Admin handbook: Contradicts the mounted-config procedure documented elsewhere in the same file. [defects, defects #240565]		lowfixed-before-releaseheld review (review model)—
RSD-registry-c16489cf60
Admin handbook: tags/list returns tag names, not digests; a customer following this cannot obtain the digest. [defects, defects #240566]		lowfixed-before-releaseheld review (review model)—
RSD-registry-9dccac713d
Admin handbook: Says six modules 'all raised to close CVE floors' but lists three CVE raises and the list plus x/sync makes seven. [defects, defects #240567]		lowfixed-before-releaseheld review (review model)—
RSD-registry-3c20e0ca30
Admin handbook: 'Three further modules' followed by one module. [defects, defects #240568]		lowfixed-before-releaseheld review (review model)—
RSD-registry-06953252da
Admin handbook: Says three, lists four. [defects, defects #240569]		lowfixed-before-releaseheld review (review model)—
RSD-registry-eb7e92f237
Admin handbook: Contradicts line 1553 and the archive layout. [defects, defects #240570]		lowfixed-before-releaseheld review (review model)—
RSD-registry-66eeb3da54
Admin handbook: Implies a multi-component name needs the `{namespace}/{name}` form; contradicts line 529. [defects, defects #240571]		lowfixed-before-releaseheld review (review model)—
RSD-registry-11039b42f9
Admin handbook: 'repositories without a namespace' again implies the plain {name} routes are single-component only. [defects, defects #240572]		lowfixed-before-releaseheld review (review model)—
RSD-registry-9b89ca0a1c
Database handbook: Contradicts DB_HANDBOOK.md:716, which says {name} matches multi-component names. [defects, defects #240573]		lowfixed-before-releaseheld review (review model)—
RSD-registry-a7598f8c37
Database handbook: Describes the HEALTHCHECK as a `docker exec` command. [defects, defects #240574]		lowfixed-before-releaseheld review (review model)—
RSD-registry-47f20e02bc
Database handbook: There is no Ubuntu 24.04 base image. [defects, defects #240575]		lowfixed-before-releaseheld review (review model)—
RSD-registry-f9299d2b84
Database handbook: 'you own (uid 0)' is wrong for a normal user. [defects, defects #240576]		lowfixed-before-releaseheld review (review model)—
RSD-registry-7e73fc6171
Database handbook: The troubleshooting command publishes 5001 but leaves the listener bound to 127.0.0.1, so it never answers. [defects, defects #240577]		lowfixed-before-releaseheld review (review model)—
RSD-registry-b0145fbc8f
Admin handbook: False failure claim for the documented file-mount procedure (the preceding sentence 'ensure the directory ... [defects, defects #241458]		lowfixed-before-releaseheld review (review model)—
RSD-registry-5ec98737e8
Admin handbook: Claims the host directory must be searchable for a mounted config file; measured not to be. [defects, defects #241459]		lowfixed-before-releaseheld review (review model)—
RSD-registry-b01d5818f8
Database handbook: Same unnecessary/false directory-searchable requirement for a mounted config file. [defects, defects #241460]		lowfixed-before-releaseheld review (review model)—
RSD-registry-af247a415f
Admin handbook: Says the listed differences are in the file's comment; neither bullet is (the comment omits the storage.maintenance difference, as ADMIN_HANDBOOK.md:270 says), contradicting ADMIN_HANDBOOK.md:270… [defects, defects #241461]		lowfixed-before-releaseheld review (review model)—
RSD-registry-1fcc249717
Admin handbook: Listed under 'differs from the upstream distribution image' but upstream's config-dev.yml also sets no http.secret. [defects, defects #241462]		lowfixed-before-releaseheld review (review model)—
RSD-registry-66c12a464a
Admin handbook: Docker has no volume rename command. [defects, defects #241463]		lowfixed-before-releaseheld review (review model)—
RSD-registry-b68113dae7
Database handbook: Block order contradicts 'first': the backup block (line 925) is printed before the touch/chmod block (line 933); run top to bottom the archive is root-owned mode 644 and touch/chmod then fails. [defects, defects #241464]		lowfixed-before-releaseheld review (review model)—
RSD-registry-7a910ebfea
Database handbook: The following docker run (2055-2059) names the container registry without removing the existing one and without the certificate mount/TLS variables: it fails with Conflict, and under a fresh name… [defects, defects #241465]		lowfixed-before-releaseheld review (review model)—
RSD-registry-b42a4880d6
API guide: Omits POST, which the cited handler map registers and ADMIN_HANDBOOK.md:754 lists; other tables (ADMIN 520/785/790/826/830, DB 598/603/713) omit it too. [defects, defects #241466]		lowfixed-before-releaseheld review (review model)—
RSD-registry-2aa2991b2c
API guide: Same omission of POST on the namespaced upload route. [defects, defects #241467]		lowfixed-before-releaseheld review (review model)—
RSD-registry-0b27a58fe5
Admin handbook: Says the host directory of a mounted config file must be searchable and that a bad directory stops the container; measured not to be so, and contradicts ADMIN 1168/1196. [defects, defects #242076]		lowfixed-before-releaseheld review (review model)—
RSD-registry-9f3dac370c
Database handbook: Unnecessary and false directory-searchable requirement for a mounted config file (this section was rewritten by the doc gate and still carries it). [defects, defects #242077]		lowfixed-before-releaseheld review (review model)—
RSD-registry-747f35ea2c
Database handbook: Tells the reader to add -body, which the command already has; the suggested extra detail does not exist. [defects, defects #242078]		lowfixed-before-releaseheld review (review model)—
RSD-registry-3dccea3c83
Admin handbook: Re-creating run commands at 1129 and 1139 omit `docker rm -f registry`, so run top to bottom they fail with a name Conflict. [defects, defects #242079]		lowfixed-before-releaseheld review (review model)—
RSD-registry-c7ac4ad9ce
Admin handbook: False requirement that the host directory of a mounted config FILE be searchable (mode 755); contradicts ADMIN 1197 ('the mode of the host directory that holds it does not matter'). [defects, defects #244221]		lowfixed-before-releaseheld review (review model)—
RSD-registry-fd27ed19a5
Database handbook: Same false directory-searchable requirement for a mounted config file in the rewritten DB 'Configuration' section; contradicts DB 1496-1497 ('mode of the host directory ... [defects, defects #244222]		lowfixed-before-releaseheld review (review model)—
RSD-registry-64734ec19d
Admin handbook: The 'Updating the health check' re-create command (introduced as 'When recreating the container') has no `docker rm -f registry`; run after the previous block's `docker run --name registry` it fails… [defects, defects #244223]		lowfixed-before-releaseheld review (review model)—
RSD-registry-86626c2a78
Admin handbook: The documented `docker exec registry sh` is given as the way to run a shell but has no -i/-t, so the shell reads end-of-input and exits at once with no session; the next command (docker run --rm -it… [defects, defects #244224]		lowfixed-before-releaseheld review (review model)—
RSD-registry-7caf7e835b
Admin handbook: Round-3/4 finding still present: false requirement that the host directory of a mounted config FILE be searchable; contradicts ADMIN 1197. [defects, defects #250709]		lowfixed-before-releaseheld review (review model)—
RSD-registry-58c206265a
Admin handbook: Same paragraph: 'a directory it cannot search' repeats the false directory requirement for a mounted config file. [defects, defects #250710]		lowfixed-before-releaseheld review (review model)—
RSD-registry-62d4a73459
Database handbook: The volume does not hold configuration: config.yml is built into the image (DB 275, 344, 912 say edits are lost on re-create). [defects, defects #250711]		lowfixed-before-releaseheld review (review model)—
RSD-registry-eeabecdbbf
Database handbook: 'unauthenticated' is wrong: Docker's localhost exemption is about encryption; every /v2/ push and pull still needs the htpasswd login (401 without credentials, measured). [defects, defects #250712]		lowfixed-before-releaseheld review (review model)—
RSD-registry-e2b7215b2e
Database handbook: 'a failure after startup' contradicts ADMIN 1160/DB 340: the level=fatal line is written at start (unreadable TLS file). [defects, defects #250713]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:5e343345573ae3f3fa657024845fedfab2068d8f4cf96f6e6bfe1777d5cd9b42 · published digest sha256:5e343345573ae3f3fa657024845fedfab2068d8f4cf96f6e6bfe1777d5cd9b42 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 97) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-11T20:28:42Z · failing Docker Scout counts 12 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-11T20:28:32Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3817513667 · transparency-log entry · integrated 2026-11-11T20:31:14Z) [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:1dc516436dee4eaf397b34db1e6158f7afadd928acb6d99415c09ec47d8bce85 · state attached · log index 3817516578 · transparency-log entry
    • kind sbom · digest sha256:1dc516436dee4eaf397b34db1e6158f7afadd928acb6d99415c09ec47d8bce85 · state attached · log index 3817518261 · transparency-log entry
    • kind vsa · digest sha256:1dc516436dee4eaf397b34db1e6158f7afadd928acb6d99415c09ec47d8bce85 · state attached · log index 3817520650 · transparency-log entry
    • kind provenance · digest sha256:5e343345573ae3f3fa657024845fedfab2068d8f4cf96f6e6bfe1777d5cd9b42 · state attached · log index 3817523248 · transparency-log entry
    • kind sbom · digest sha256:5e343345573ae3f3fa657024845fedfab2068d8f4cf96f6e6bfe1777d5cd9b42 · state attached · log index 3817524741 · transparency-log entry
    • kind vsa · digest sha256:5e343345573ae3f3fa657024845fedfab2068d8f4cf96f6e6bfe1777d5cd9b42 · state attached · log index 3817526999 · transparency-log entry
    (at 2026-11-11T20:31:17Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/registry/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-11T00:29:26Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:5e343345573ae3f3fa657024845fedfab2068d8f4cf96f6e6bfe1777d5cd9b42 [clean-room rebuild ledger, runs[738]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-10T21:47:47Z [stage_runs, stage_runs chain 940 stage publish_image]
  • Archive manifests written2026-11-11T20:30:05Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 69 · probed 2026-11-10T21:44:54Z · source build_kit) [release_images, isa_level_hard]

History

3 events
  • 2026-11-11T20:32:31Z generated: by KitForge release/build_trail.py · generator commit fb3c8c212feaeb8607d5b295a821989cf0ab3e1e
  • 2026-11-11T20:33:46Z publication: promoted at 2026-11-11T20:33:03Z · promoted digest sha256:1dc516436dee4eaf397b34db1e6158f7afadd928acb6d99415c09ec47d8bce85 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 475 · checklist status complete · checklist at 2026-11-11T20:33:46Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
  • 2026-11-12T04:13:55Z repack: previous sha256 028ef8cf9827e11b39591f35695568557e6361e7f63559259a08a015b3c96336 · sha256 bbba5dead39fbb1483d8d9e90a6d0b00164791792f3c3018f0ae1fa73d1ca7b6 · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); README.md and FILE_MODES.tsv at the archive root (release/kit_unpack.py), BUILD_OFFLINE.sh putting back the packed file modes, REBUILD.md unpacking with -p and keeping the key and signature outside the kit, and the verifier naming what differs; not image inputs; image and every build input unchanged · label kitfix · replaced BUILD_OFFLINE.sh, docs/REBUILD.md, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, docs/rebuild-bundle/rebuild_bundle.py · added FILE_MODES.tsv, README.md · record MANIFEST.json repack_history

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/registry/v3.1.2-CE-ubuntu24.04-r8/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/registry/v3.1.2-CE-ubuntu24.04-r8/), as staged for publishing—
ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.rebuild.jsonbeside the archive (prodasset /data/production/registry/v3.1.2-CE-ubuntu24.04-r8/), as staged for publishing—
ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r8.rebuild.json.sigstorebeside the archive (prodasset /data/production/registry/v3.1.2-CE-ubuntu24.04-r8/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/registry/v3.1.2-CE-ubuntu24.04-r8/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)620
chainssadb, ReadyStack's engine database (not published)940
defectssadb, ReadyStack's engine database (not published)registry v3.1.2-CE-ubuntu24.04-r8
drive_runssadb, ReadyStack's engine database (not published)chain 940
held_roundssadb, ReadyStack's engine database (not published)chain 940
lesson_recallssadb, ReadyStack's engine database (not published)chain 940
micro_step_runssadb, ReadyStack's engine database (not published)chain 940
release_imagessadb, ReadyStack's engine database (not published)registry v3.1.2-CE-ubuntu24.04-r8
stage_eventssadb, ReadyStack's engine database (not published)chain 940
stage_runssadb, ReadyStack's engine database (not published)chain 940
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—