Vaultwarden 1.37.5-CE-ubuntu24.04-r3 build trail

How ReadyStack built readystack/vaultwarden:1.37.5-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/vaultwarden:1.37.5-CE-ubuntu24.04-r3
  • Index digestsha256:f1d1bb668c07dce2fb7d97e23ad50a9eca79114b633c555ed0a86079aa4c8e58
  • linux/amd64 digestsha256:dde579501e0bea91f86102949d8a26694374caa75319ab600b6e179167258c0a
  • ArchiveReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.tar.gz
  • Archive SHA-256 nowff5e69ea9f9c6ba5e855766a49d65274388dc171c9ec7be80cb161d911511e43
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-12T11:04:55Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.trail.json
ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.trail.jsonReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.trail.json.sigstoreReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.trail.mdVaultwarden product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductVaultwarden (vaultwarden) [MANIFEST.json]
  • Release tag1.37.5-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Imagereadystack/vaultwarden:1.37.5-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Image index digestsha256:f1d1bb668c07dce2fb7d97e23ad50a9eca79114b633c555ed0a86079aa4c8e58 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:dde579501e0bea91f86102949d8a26694374caa75319ab600b6e179167258c0a [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.tar.gz (bytes 1256317914) [MANIFEST.json]
  • Archive sha256 at publishff5e69ea9f9c6ba5e855766a49d65274388dc171c9ec7be80cb161d911511e43 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/dani-garcia/vaultwarden [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref1.37.5 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit6ed6921cc2b0e03b4d74189574d2a5e71c512e97 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hasha220a57538bb53b70b9b7242a24b96f47675c6b98b8140ea821b71b0cf1b9a0d (files 575) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:b9e6e91dd697f616106f0b58105afa007c6395c6fbef5463f34586287c24c30e [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794451830 (utc 2026-11-12T02:50:30Z) [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref rust:1.99.1-bookworm@sha256:e6f2cff35d0f309acf8433b4f05878ed77092602c5065cc81801177da0bb3a9c · platform digest sha256:4715c3ad743951a3cea90e8b432f2a17e0ef5f3f3c3abf75108879e783b396f0
    • ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
    [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.rebuild.json, engine]
  • Engine commit(s)
    • commit 0d6cfe73bbf4df66989e87099ed978c9b446fd18 · dirty yes · first drive 4352
    • commit 21baf28a579dd81d9894d563ece0b5629b245fe5 · dirty yes · first drive 4379
    • commit 31c1e6418d56f0e5e2b8dcbfde0e0fff1fba715c · dirty yes · first drive 4385
    • commit c8155eab7005e164326d14c384d473b047cfc227 · dirty yes · first drive 4399
    • commit d4a7afb5b3612b0c920b8922d8aaa63e07e805eb · dirty yes · first drive 4404
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain1007 (created 2026-11-12T05:51:47Z · trigger customer_request · upstream version 1.37.5) [chains, chains #1007]
  • Requestbuild request #730 (rebuild) (requested at 2026-11-12T02:50:31Z · requested by kitforge-agent · version 1.37.5) [build_requests, build_requests #730]
  • Reasonrevision 1.37.5-CE-ubuntu24.04-r3: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #730 request_reason]
  • Supersedesreadystack/vaultwarden:1.37.5-CE-ubuntu24.04-r2 (chain 917) [chains, chains #917]

The path through the harness

Fully recorded

1 chain · 5 drives · 18 stages · 4 rewinds

Chain 1007 release · ready_to_ship

Created 2026-11-12T05:51:47Z, upstream 1.37.5, build request 730 [chains, chains #1007]

DriveStartedMinutesBuild hostHow it stopped
43522026-11-12T05:52:24Z112.3build host 2 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4352]
43792026-11-12T08:37:54Z7build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4379]
43852026-11-12T09:14:02Z6.8build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4385]
43992026-11-12T10:29:24Z7build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4399]
44042026-11-12T10:57:07Z—build host 2 publish-held not recorded [drive_runs, drive_runs #4404]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-12T05:52:35Z2026-11-12T05:52:36Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json c94d3294d4d1…
acquire 2026-11-12T05:52:40Z2026-11-12T05:52:41Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 4a10a62daa5f…
license_file 8486a10c4393…
custody_inputs fec73090bb50…
source_tree_hash 491e5549bb00…
source_file_manifest 30fceac4d794…
plan 2026-11-12T05:53:21Z2026-11-12T05:53:22Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 4c48a79748e3…
input_pin_plan a097d5fa065a…
toolchain_lock fc2c60e872b8…
assemble_kit 2026-11-12T06:08:09Z2026-11-12T06:08:10Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 69df0de87367…
build_recipe 68556c17b5f0…
system_pinning aa8db05a9a8a…
build_offline_sh 6ab4f08a6ec7…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 363e7692e1a1…
verify_offline_sh 3e8184ea230c…
base_image_digests a47a2c7a28e4…
dockerfile_offline 69df0de87367…
first_build_digest aa9fa9769ef3…
remediate 2026-11-12T06:09:06Z2026-11-12T06:09:07Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log c2c79959ac90…
security_report b7283ec99583…
build_kit 2026-11-12T06:35:15Z2026-11-12T06:35:15Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 7b0188245b5f…
locked_digest e13ca3a75d21…
freeze_manifest bb65a8d225c5…
offline_rebuild_transcript 3aeda3e25ff4…
verdict 2026-11-12T06:35:58Z2026-11-12T06:35:59Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict ef60baa39ad8…
publish_image 2026-11-12T06:36:35Z2026-11-12T06:36:36Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 933fab7b58c5…
promotion_record 816b56c49d28…
boot_instance 2026-11-12T06:36:41Z2026-11-12T06:36:46Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 78bd1e61e289…
sbom 2026-11-12T06:36:56Z2026-11-12T06:36:57Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 93d3b0e14a0f…
sbom_json 34dd82953d9a…
schema_discovery 2026-11-12T06:37:00Z2026-11-12T06:37:01Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash c177ce6bd9e8…
dependency_tree 15515b9a9d14…
table_classification a3eb20347960…
admin_handbook 2026-11-12T06:50:35Z2026-11-12T06:50:36Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map eea4ad3f270e…
admin_handbook 85561eefeef1…
db_handbook 2026-11-12T07:02:26Z2026-11-12T07:02:27Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 42334db8b425…
seed_isolation 06ee4840f97c…
seed_data 2026-11-12T07:02:38Z2026-11-12T07:02:39Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 2c31acebb75e…
seed_cases_json e8686ab35c76…
seed_validate 2026-11-12T07:02:42Z2026-11-12T07:02:43Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 012282c8e169…
usecase_validate 2026-11-12T07:03:03Z2026-11-12T07:03:04Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 6c8d237ced7b…
test_results 2e9adfad29dd…
usecase_contract f03c77d44873…
finalize_docs 2026-11-12T07:18:59Z2026-11-12T07:19:00Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json df9e75a44499…
release_notes 4b378f3c7825…
api_integration_guide 64ba2df3494a…
package_archive invalidated 2026-11-12T10:56:41Z 2026-11-12T07:44:35Z2026-11-12T10:36:26Z4
37 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 unpack_files
  • G8 scout_grade_a
  • G8 script_copies
  • G8 upgrade_check
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 6d52ac425de4…
checksums 0057acc1761b…
verify_md 9b405896da88…
rebuild_md bd50d90beb3a…
manifest_txt 7cb5ca76a6dc…
actions_jsonl a4baff7519c2…
provenance_md e09206cdeee3…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 30e3f45ffa03…

[stage_runs]

Rewinds

  • 2026-11-12T08:35:23Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33267]
  • 2026-11-12T09:11:51Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33307]
  • 2026-11-12T09:51:04Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33401]
  • 2026-11-12T10:56:41Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33494]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-12T10:36:26Z.

221 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 09827 —
remediate2001 014462 L-A08, L-038, L-036, L-034, L-032
admin_handbook783603 12586514 —
db_handbook561703 4395700 —
usecase_validate1001 01792 —
finalize_docs823303 9628250 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

4 rounds, 4 counted, $10.15 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-12T07:45:55Z 01034 findings to repackage [held_rounds, held_rounds #1793] $4.03 3 rounds, $40.00 a257ee139480…
22026-11-12T08:45:23Z 0224 findings to repackage [held_rounds, held_rounds #1797] $2.72 3 rounds, $40.00 bc5d9c9941e0…
32026-11-12T09:21:46Z 0013 clean to repackage [held_rounds, held_rounds #1801] $2.71 3 rounds, $40.00 591a10612fa0…
42026-11-12T10:36:59Z 002 clean to publish [held_rounds, held_rounds #1806] $0.69 3 rounds, $40.00 6d52ac425de4…

Defects

Fully recorded
  • Ledger entries88 [defects, defects where product_slug=vaultwarden and this tag or chain]
  • Disclosed in the archive88 [docs/defects/defects.json, entries]

88 ledger entries: by severity medium 1, low 75, high 12; by status open 1, fixed-before-release 87.

DefectSeverityStatusFound byFixed in
RSD-vaultwarden-e82e0ff971
Open self-registration by default [defects, defects #259818]		mediumopenbuild strategy record—
RSD-vaultwarden-195b138817
Docker Hub README: Links block repeats the 'free with an account' claim for the build kit. [defects, defects #259912]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-26848234b7
Docker Hub README: README says the build kit is free; MANIFEST prices it at 1000 cents and marks the release not free. [defects, defects #259913]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-ab7b82726b
Admin handbook: The stopped-container restore block ends with an mv of a db_YYYYMMDD_HHMMSS.sqlite3 file that does not exist in that archive; the command fails (exit 1). [defects, defects #260760]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-df14ec36d5
Admin handbook: The documented register/finish field `masterPassword` does not exist (HTTP 422); the field is masterPasswordHash and the call also needs the KDF settings and the key pair, which the 'three pieces of… [defects, defects #260761]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-0d8ea70f3b
Database handbook: The 'Restoring from an online backup' block ends with docker start of a container that the restore has already removed, so it fails; the restore needs the usual docker run command. [defects, defects #260762]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-4ccd8338ca
API guide: The generate-a-token procedure removes the container and then execs into it, which cannot work. [defects, defects #260763]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-c060a6f6db
API guide: The DOMAIN-change procedure edits a key (environment.vault) that config.json does not contain; the command silently changes nothing and the old DOMAIN stays in force. [defects, defects #260764]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-d391e8efbb
API guide: The sed pattern matches nothing in config.json (the saved key is "domain"). [defects, defects #260765]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-7d120f492a
API guide: The password-hint request is documented as header-driven; it takes a JSON body, so the documented request cannot work. [defects, defects #260766]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-420c12d7f6
API guide: Password-hint request format documented as an X-Request-Email header; the endpoint reads a JSON body. [defects, defects #260767]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-6e36041976
API guide: States that the endpoint requires SMTP and that the hint text is returned when Show password hint is disabled; the opposite is true (not-configured message when disabled, hint when enabled). [defects, defects #260768]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-9f992117b0
API guide: Says a server with Show password hint disabled displays the hint; it refuses with the not-configured message. [defects, defects #260769]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-896995e5e8
API guide: 'requires SMTP configuration' contradicts the other sections and the measured behaviour. [defects, defects #260770]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-22e411a540
API guide: 'requires SMTP to be configured and Show password hint' is self-contradictory: either one is enough. [defects, defects #260771]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-2a4ff1e19f
API guide: 'requires SMTP configuration' contradicts the rest of the sentence and the endpoint's behaviour. [defects, defects #260772]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-e0fab0233a
API guide: Says the endpoint requires SHOW_PASSWORD_HINT and, in the same sentence, that it works with SMTP regardless of it. [defects, defects #260773]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-d8c9d0bce2
Admin handbook: The Device and password hint endpoints list omits SMTP and then says SMTP is not required; with SMTP the hint is mailed, not returned. [defects, defects #260774]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-2d2c19ae78
Admin handbook: A .local domain over plain HTTP is not a secure context; the sentence contradicts the other sections. [defects, defects #260775]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-7fd9e2e730
Database handbook: The sentence names localhost as an example of plain HTTP and then says login fails unless HTTPS. [defects, defects #260776]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-55dff4a6d3
Database handbook: Tells the reader that after changing ROCKET_PORT only the host side of -p needs updating; the container side must match, and the container is unhealthy either way. [defects, defects #260777]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-24e05a1140
API guide: Says the container turns unhealthy with ROCKET_ADDRESS=127.0.0.1 and that clients can still connect; it stays healthy and the published port is unreachable. [defects, defects #260778]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-253523b628
API guide: Suggests that keeping -p in step with ROCKET_PORT avoids the unhealthy state; the probe is fixed to 8080 and fails anyway. [defects, defects #260779]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-9b4002bff7
API guide: Ties the unhealthy verdict to the 30-second database timeout; the probe gives up at 10 seconds and a missing listener also makes it unhealthy. [defects, defects #260780]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-a9e8d6ffb9
Admin handbook: Ties the unhealthy verdict to the 30 s database timeout and to the 503; the probe times out at 10 s and also fails when the server is not listening. [defects, defects #260781]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-096589bf75
Admin handbook: Ties the unhealthy state to the 503 after the 30 s database timeout. [defects, defects #260782]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-f4ebda9f21
Admin handbook: Says the health check receives the 503; the probe gives up at 10 s, before the 30 s 503. [defects, defects #260783]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-7c2415c6c1
Database handbook: Ties the unhealthy verdict to the 30 second pool timeout instead of the 10 s probe timeout. [defects, defects #260784]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-1b3b6fb5ca
API guide: The HEALTHCHECK runs every 30 seconds, not every few seconds. [defects, defects #260785]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-5c5b74e522
Database handbook: The HEALTHCHECK runs every 30 seconds, not every few seconds. [defects, defects #260786]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-ccca9caa39
API guide: Says the web vault cannot be disabled; WEB_VAULT_ENABLED=false works. [defects, defects #260787]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-a873a35072
API guide: Contradicts the Admin handbook, which says the web vault can be switched off with WEB_VAULT_ENABLED=false. [defects, defects #260788]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-43a4ee6af9
Database handbook: Says there is no graceful shutdown; the server logs a graceful shutdown on SIGTERM and exits 0. [defects, defects #260789]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-584ba29d9f
Database handbook: Says unrecognised words make the server exit silently; it starts normally. [defects, defects #260790]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-9cc59b91a1
Database handbook: The sentence says to use --entrypoint but the example does not, and no override is needed. [defects, defects #260791]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-c1eb073e9b
Database handbook: Contradicts the sections that say the response carries no token when the mail is sent. [defects, defects #260792]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-4fc5ace057
Database handbook: The verification token is returned as text/plain, not a quoted JSON string. [defects, defects #260793]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-f03e483ee7
API guide: Blanket content-type claim: the verification token is text/plain and Rocket's own 400/422 pages are HTML. [defects, defects #260794]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-1c0a1d7229
API guide: Says registration and password-hint requests are limited after three attempts per 5 minutes; only the admin login is. [defects, defects #260795]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-ea6cf3a2a7
API guide: 'Three unsuccessful attempts ... [defects, defects #260796]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-2bca3302c3
Admin handbook: Names the port mapping as the cause; the probe fails for any ROCKET_PORT other than 8080. [defects, defects #260797]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-b8ac44b94a
Database handbook: Says config.json appears on first admin-panel access; it is written only by Save. [defects, defects #260798]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-4c7a2ab4a0
Database handbook: Contradicts the Forgotten master passwords section: the waiting period approves access automatically; only the mail is skipped without SMTP. [defects, defects #260799]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-beb914078b
Database handbook: Unsupported claim that the invitation exception stops with SMTP; the invitation check does not depend on SMTP. [defects, defects #260800]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-d05d243ea6
Database handbook: Unqualified: the value is true when SMTP is configured or invitations are off. [defects, defects #260801]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-2b7d15b8c5
Database handbook: Sends the reader to 'the exact tag' of a rebuilt image that carries none. [defects, defects #260802]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-f4376e6edc
Admin handbook: The documented run command names the published tag, which pulls the Hub image rather than the rebuilt one. [defects, defects #260803]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-ee6e54f1fc
API guide: The block at line 1205 (`docker stop vaultwarden && docker rm vaultwarden`) is followed by 'Then generate the token:' and `docker exec -it vaultwarden vaultwarden hash` (line 1211): the container no… [defects, defects #262583]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-6b4c7ab7c7
Admin handbook: Ran the documented command (no -i, so tar reads an empty stdin): 'tar: This does not look like a tar archive / tar: .: Not found in archive / tar: Exiting with failure status'. [defects, defects #262584]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-9e6a8ddb0d
Admin handbook: curl /api/version -> "1.37.5"; /api/config -> "version":"2026.6.0". [defects, defects #262585]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-1e60df6ee7
Admin handbook: Reset test: after removing the admin_token line from config.json, a second start of the same volume with -e ADMIN_TOKEN='reset tok $z!' accepted that token (POST /admin 200) and rejected the old one… [defects, defects #262586]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-0ff80bf13c
Admin handbook: POST register/finish with masterPasswordHash='my new pass $x!' answered 200 {"object":"registerFinish"}; with a masterPassword field it answered 422. [defects, defects #262587]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-e06b512083
Admin handbook: Ran -e ROCKET_PORT=8081 with -p <host>:8081: served /alive but `docker inspect` health = unhealthy. [defects, defects #262588]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-62c8c1d577
API guide: Ran ROCKET_PORT=8081: health = unhealthy. [defects, defects #262589]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-869aeb883d
API guide: The block that follows (-p 9000:8081 -e ROCKET_PORT=8081) produces an unhealthy container (measured), yet the heading presents it as the way to 'keep the published port synchronized'; line 1453 of… [defects, defects #262590]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-c325dbbe0f
Admin handbook: Measured: saved config.json (with admin_token) in the volume, container removed, started again WITHOUT -e ADMIN_TOKEN: GET /admin 200 and POST /admin with the saved token 200 (admin page not… [defects, defects #262591]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-c1a6edc414
Database handbook: Same measurement as the Admin handbook line 1396: with a saved config.json the admin page answers and the saved token logs in although no -e ADMIN_TOKEN is passed. [defects, defects #262592]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-9bbb2ddba2
Database handbook: docker run IMAGE foo -> container exited, exit=0, no log output; docker run IMAGE foo --some-flag -> same; docker run IMAGE --some-flag -> 'Rocket has launched'. [defects, defects #262593]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-739df74b27
Database handbook: printf 'pw12345678\npw12345678\n' | docker run --rm -i IMAGE hash -> panic: called `Result::unwrap()` on an `Err` value: Os { code: 6, kind: Uncategorized, message: "No such device or address" };… [defects, defects #262594]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-6bd795530d
Database handbook: Measured with -i and piped stdin: Os error 6 panic (see line 1474). [defects, defects #262595]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-4cfd4c7a1e
Database handbook: The 'Restoring from an online backup' block (lines 606-610, then 614-617) starts at `docker volume create vw-data`, which does nothing for an existing volume, and ends with `docker run -d --name… [defects, defects #262596]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-3264b013f4
Database handbook: Icons are cached as files in /data/icon_cache (same handbook, line 1114; Admin handbook line 1270: 'without storing them in the database'); the icon route does not use the SQLite database. [defects, defects #262597]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-dd537514a0
Database handbook: docker logs after restart with a saved config.json: '[WARNING] The following environment variables are being overridden by the config.json file.' (full stop, no colon) / '[WARNING] Please use the… [defects, defects #262598]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-cb0a267456
API guide: The sentence is self-contradictory: without -wal/-shm files there is nothing to replay. [defects, defects #262599]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-20e0fbe071
API guide: Invite on a server with SIGNUPS_ALLOWED=false and no SMTP: POST /admin/invite answered with the user object (no link or token); the invited address then registered through… [defects, defects #262600]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-fba62d5217
API guide: curl -si /icons/<domain>/icon.png -> content-type: image/png. [defects, defects #262601]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-4a116caa06
API guide: send-verification-email -> content-type: text/plain; charset=utf-8; icons -> image/png; register/finish with a wrong field -> HTML '422 Unprocessable Entity'. [defects, defects #262602]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-05075a69a0
API guide: The sentence introduces the list that follows (send-verification-email, register/finish, connect/token, prelogin, password-hint), none of which returns that message: password-hint answers 'This… [defects, defects #262603]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-e46b90bffe
Admin handbook: No record in the release (recon, validation, defects, provenance) shows that VACUUM INTO takes an exclusive lock or causes 'database is locked'; SQLite's VACUUM INTO reads the source and does not… [defects, defects #262604]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-accf04fbe2
Admin handbook: Unsupported by the records (see line 1470); measured: backups ran while the server served registrations and logins with no 'database is locked'. [defects, defects #262605]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-7020a2a98d
Admin handbook: docs/REBUILD.md (Requirements) and BUILD_OFFLINE.sh line 9 ('linux/amd64 Docker host, docker buildx >= 0.30, jq, tar') name no minimum Docker Engine version; 'Docker 20.10' appears in no record of… [defects, defects #262606]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-6cf13888de
Database handbook: docs/REBUILD.md (Requirements) and BUILD_OFFLINE.sh line 9 ('linux/amd64 Docker host, docker buildx >= 0.30, jq, tar') name no minimum Docker Engine version; 'Docker 20.10' appears in no record of… [defects, defects #262607]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-ecff65cee9
Database handbook: docs/REBUILD.md (Requirements) and BUILD_OFFLINE.sh line 9 ('linux/amd64 Docker host, docker buildx >= 0.30, jq, tar') name no minimum Docker Engine version; 'Docker 20.10' appears in no record of… [defects, defects #262608]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-e393986f9c
Admin handbook: vaultwarden backup is a separate process (docker exec) that opens its own read-only connection and runs VACUUM INTO (strategy doc_rules[83]); no record shows a backup takes a pooled connection or a… [defects, defects #264512]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-7bc6051c97
Admin handbook: vaultwarden backup is a separate process (docker exec) that opens its own read-only connection and runs VACUUM INTO (strategy doc_rules[83]); no record shows a backup takes a pooled connection or a… [defects, defects #264513]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-99b07393d8
Admin handbook: vaultwarden backup is a separate process (docker exec) that opens its own read-only connection and runs VACUUM INTO (strategy doc_rules[83]); no record shows a backup takes a pooled connection or a… [defects, defects #264514]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-a1a9e9ff20
Admin handbook: Measured on the image: after the admin page's Save (config.json holds admin_token), docker rm + docker run -e ADMIN_TOKEN='newtoken12345' -> POST /admin with the old saved token 200, with the new… [defects, defects #264515]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-91f7ec95b0
Database handbook: Measured on the image: after the admin page's Save (config.json holds admin_token), docker rm + docker run -e ADMIN_TOKEN='newtoken12345' -> POST /admin with the old saved token 200, with the new… [defects, defects #264516]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-049eaf4f9f
Database handbook: Ran docker run --rm IMAGE foo -> rc=0, no output; docker run IMAGE --some-flag -> 'Rocket has launched' (round 2). [defects, defects #264517]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-a578fe859f
Database handbook: Ran docker run --rm -v <host dir owned by uid 1000, mode 755>:/data IMAGE -> '[ERROR] Error creating private key '/data/rsa_key.pem' ... [defects, defects #264518]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-95a2e8107b
Database handbook: docker/Dockerfile.offline.pinned: COPY --from=build_rs_probe /rs-probe /rootfs/usr/local/bin/rs-probe and ADD vendored/chisel/rootfs.tar; provenance/IMAGE_BINARIES.txt lists sh, tar, sed, mv, rm,… [defects, defects #264519]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-607dccd2d1
Admin handbook: provenance/IMAGE_CONFIG.json Labels: licenses = 'AGPL-3.0-only' (one identifier); license.disclosure is a disclosure paragraph naming both licenses. [defects, defects #264520]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-e0f51267e3
Database handbook: tar of /web-vault from the release image lists web-vault/scripts/dropin.js.LICENSE.txt, qrious.min.js.LICENSE.txt, app/vendor.*.js.LICENSE.txt, app/polyfills.*.js.LICENSE.txt: licence texts outside… [defects, defects #264521]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-0f023af7e3
Admin handbook: 'Linux 4.11' appears in no record of the release (recon, validation, provenance, strategy); binding a port above 1023 needs no particular kernel version. [defects, defects #264522]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-f53b62eb18
API guide: Measured: 14 failed POST /identity/connect/token -> 400 x10 then 429 body {"message":"Too many login requests"}; 60+ POST register/send-verification-email -> 429 body {"message":"Too many requests"}… [defects, defects #264523]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-4b38e1a538
API guide: Measured: POST send-verification-email (no SMTP) -> 200 content-type: text/plain; charset=utf-8, body the JWT. [defects, defects #264524]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-37abbd8fec
Admin handbook: 'The only user-management actions' is false: the admin Users page also has Remove all 2FA, Enable User, Resend invite and Invite User. [defects, defects #266521]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-f81c71fbcf
Admin handbook: 'only offers' omits Remove all 2FA, Enable User and Resend invite that the Users list has. [defects, defects #266522]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:dde579501e0bea91f86102949d8a26694374caa75319ab600b6e179167258c0a · published digest sha256:dde579501e0bea91f86102949d8a26694374caa75319ab600b6e179167258c0a · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 765) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-12T10:57:30Z · failing Docker Scout counts 14 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-12T10:57:18Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3830860495 · transparency-log entry · integrated 2026-11-12T11:03:00Z) [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:f1d1bb668c07dce2fb7d97e23ad50a9eca79114b633c555ed0a86079aa4c8e58 · state attached · log index 3830865185 · transparency-log entry
    • kind sbom · digest sha256:f1d1bb668c07dce2fb7d97e23ad50a9eca79114b633c555ed0a86079aa4c8e58 · state attached · log index 3830866277 · transparency-log entry
    • kind vsa · digest sha256:f1d1bb668c07dce2fb7d97e23ad50a9eca79114b633c555ed0a86079aa4c8e58 · state attached · log index 3830867336 · transparency-log entry
    • kind provenance · digest sha256:dde579501e0bea91f86102949d8a26694374caa75319ab600b6e179167258c0a · state attached · log index 3830868103 · transparency-log entry
    • kind sbom · digest sha256:dde579501e0bea91f86102949d8a26694374caa75319ab600b6e179167258c0a · state attached · log index 3830868893 · transparency-log entry
    • kind vsa · digest sha256:dde579501e0bea91f86102949d8a26694374caa75319ab600b6e179167258c0a · state attached · log index 3830869715 · transparency-log entry
    (at 2026-11-12T11:03:01Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/vaultwarden/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-12T07:46:04Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:dde579501e0bea91f86102949d8a26694374caa75319ab600b6e179167258c0a [clean-room rebuild ledger, runs[780]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-12T06:36:36Z [stage_runs, stage_runs chain 1007 stage publish_image]
  • Archive manifests written2026-11-12T11:00:38Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 70 · probed 2026-11-12T06:22:06Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-12T11:04:55Z generated: by KitForge release/build_trail.py · generator commit d4a7afb5b3612b0c920b8922d8aaa63e07e805eb
  • 2026-11-12T11:06:55Z publication: promoted at 2026-11-12T11:05:47Z · promoted digest sha256:f1d1bb668c07dce2fb7d97e23ad50a9eca79114b633c555ed0a86079aa4c8e58 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 498 · checklist status complete · checklist at 2026-11-12T11:06:55Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/vaultwarden/1.37.5-CE-ubuntu24.04-r3/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/vaultwarden/1.37.5-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.rebuild.jsonbeside the archive (prodasset /data/production/vaultwarden/1.37.5-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r3.rebuild.json.sigstorebeside the archive (prodasset /data/production/vaultwarden/1.37.5-CE-ubuntu24.04-r3/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/vaultwarden/1.37.5-CE-ubuntu24.04-r3/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)730
chainssadb, ReadyStack's engine database (not published)1007
defectssadb, ReadyStack's engine database (not published)vaultwarden 1.37.5-CE-ubuntu24.04-r3
drive_runssadb, ReadyStack's engine database (not published)chain 1007
held_roundssadb, ReadyStack's engine database (not published)chain 1007
lesson_recallssadb, ReadyStack's engine database (not published)chain 1007
micro_step_runssadb, ReadyStack's engine database (not published)chain 1007
release_imagessadb, ReadyStack's engine database (not published)vaultwarden 1.37.5-CE-ubuntu24.04-r3
stage_eventssadb, ReadyStack's engine database (not published)chain 1007
stage_runssadb, ReadyStack's engine database (not published)chain 1007
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—