Wiki.js 3.0.0-beta.685-CE-ubuntu24.04-r3 build trail

How ReadyStack built readystack/wikijs:3.0.0-beta.685-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/wikijs:3.0.0-beta.685-CE-ubuntu24.04-r3
  • Index digestsha256:c3df2212c7faed8380880981311979fef882ea084d72acef42963655f09be2d1
  • linux/amd64 digestsha256:1d70c95a3332c0432bf7584f2f5dba1d4b9bfc3d5d75f8e8e168117d470b33ec
  • ArchiveReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.tar.gz
  • Archive SHA-256 now68a72ce3bb680e3728befe0bfffd20a655af68c49b9edaab812170abd87650af
  • Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
  • Sections9 sections, 3 fully recorded; 13 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.trail.json
ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.trail.jsonReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.trail.json.sigstoreReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.trail.mdWiki.js product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

1 item not recorded
  • ProductWiki.js (wikijs) [MANIFEST.json]
  • Release tag3.0.0-beta.685-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Imagereadystack/wikijs:3.0.0-beta.685-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Image index digestsha256:c3df2212c7faed8380880981311979fef882ea084d72acef42963655f09be2d1 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:1d70c95a3332c0432bf7584f2f5dba1d4b9bfc3d5d75f8e8e168117d470b33ec [ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.tar.gz (bytes 319230618) [MANIFEST.json]
  • Archive sha256 at publishb3badce307649473adbffc9cad5216510d21cdae93bc7ce699531ff5bcb6cae0 [MANIFEST.json, repack_history[0].previous_tarball_sha256]
  • Archive sha256 now68a72ce3bb680e3728befe0bfffd20a655af68c49b9edaab812170abd87650af [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack history
    • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 b3badce307649473adbffc9cad5216510d21cdae93bc7ce699531ff5bcb6cae0 · sha256 68a72ce3bb680e3728befe0bfffd20a655af68c49b9edaab812170abd87650af · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
    [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/requarks/wiki [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref3.0.0-beta.685 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commita53dea81734a29428729b7043f4aaabf57e41de1 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash726f225b06be9b9d7dea7831dcbec2bd09d412d261b208d27ba8593bc0fdb036 (files 1345) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:25cd78c6ea115fa0a07e25af3c9bdd97307bdc45578ffc5f5e0b6a85dca91ba3 [ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1792473233 (utc 2026-10-20T05:13:53Z) [ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.rebuild.json, engine]
  • Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded
  • Chain693 (created 2026-10-27T12:12:37Z · trigger customer_request · upstream version 3.0.0-beta.685) [chains, chains #693]
  • Requestbuild request #370 (rebuild) (requested at 2026-10-27T02:37:21Z · requested by kitforge-agent · version 3.0.0-beta.685) [build_requests, build_requests #370]
  • Reasonrevision 3.0.0-beta.685-CE-ubuntu24.04-r3: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #370 request_reason]
  • Supersedesreadystack/wikijs:3.0.0-beta.685-CE-ubuntu24.04-r2 (chain 643) [chains, chains #643]

The path through the harness

2 items not recorded

1 chain · 4 drives · 18 stages · 2 rewinds

Chain 693 release · shipped

Created 2026-10-27T12:12:37Z, upstream 3.0.0-beta.685, build request 370 [chains, chains #693]

DriveStartedMinutesBuild hostHow it stopped
2062026-10-27T12:13:32Z49.8build host 1 withhold-publish ready_to_ship [drive_runs, drive_runs #206] rebuilt from a build line's log
2092026-10-27T13:49:34Z5.7build host 1 withhold-publish ready_to_ship [drive_runs, drive_runs #209] rebuilt from a build line's log
2242026-10-27T17:19:50Z6.1build host 1 withhold-publish ready_to_ship [drive_runs, drive_runs #224] rebuilt from a build line's log
2292026-10-27T18:35:43Z8.8build host 1 publish-held shipped [drive_runs, drive_runs #229] rebuilt from a build line's log

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-27T12:13:38Z2026-10-27T12:13:39Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-27T12:13:42Z2026-10-27T12:13:43Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-27T12:14:29Z2026-10-27T12:14:30Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-27T12:21:09Z2026-10-27T12:21:10Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 —
remediate 2026-10-27T12:22:05Z2026-10-27T12:22:06Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 —
build_kit 2026-10-27T12:25:52Z2026-10-27T12:25:52Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 —
verdict 2026-10-27T12:27:40Z2026-10-27T12:27:41Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 —
publish_image 2026-10-27T12:28:43Z2026-10-27T12:28:44Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 —
boot_instance 2026-10-27T12:29:03Z2026-10-27T12:29:04Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 —
sbom 2026-10-27T12:29:30Z2026-10-27T12:29:31Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 —
schema_discovery 2026-10-27T12:29:33Z2026-10-27T12:29:33Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 —
admin_handbook 2026-10-27T12:42:24Z2026-10-27T12:42:25Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 —
db_handbook 2026-10-27T12:52:06Z2026-10-27T12:52:07Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 —
seed_data 2026-10-27T12:52:14Z2026-10-27T12:52:14Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 —
seed_validate 2026-10-27T12:52:16Z2026-10-27T12:52:17Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 —
usecase_validate 2026-10-27T12:54:02Z2026-10-27T12:56:02Z2
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 —
finalize_docs 2026-10-27T12:56:07Z2026-10-27T12:56:07Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 —
package_archive 2026-10-27T13:03:14Z2026-10-27T18:44:26Z4
33 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 scout_grade_a
  • G8 script_copies
  • G8 three_way_sha
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 assetchain_coverage
 —

[stage_runs]

Rewinds

  • 2026-10-27T13:23:30Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2288]
  • 2026-10-27T18:35:11Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #262]
  • Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
  • Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-10-27T18:44:26Z.

111 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook491803 not recordednot recorded —
db_handbook481403 not recordednot recorded —
usecase_validate10001 not recordednot recorded —

[micro_step_runs]

  • Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
  • Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

2 items not recorded

Role: review model.

4 rounds, 3 counted, $9.53 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-10-27T13:04:12Z 3428 findings to repackage [held_rounds, held_rounds #213] rebuilt from a held-review state file $2.32 not recorded not recorded
22026-10-27T13:55:46Z 0614 blocked to blocked [held_rounds, held_rounds #214] rebuilt from a held-review state file $3.95 not recorded not recorded
3 not counted2026-10-27T16:17:15Z ——— blocked to blocked [held_rounds, held_rounds #215] rebuilt from a held-review state file — not recorded not recorded
42026-10-27T17:26:21Z 0015 clean to publish [held_rounds, held_rounds #216] rebuilt from a held-review state file $3.25 not recorded not recorded
  • Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
  • Not recorded: the round cap in force at each round (the state files did not keep it)

Defects

Fully recorded
  • Ledger entries71 [defects, defects where product_slug=wikijs and this tag or chain]
  • Disclosed in the archive71 [docs/defects/defects.json, entries]

71 ledger entries: by severity critical 3, low 58, high 10; by status fixed-before-release 67, open 4.

DefectSeverityStatusFound byFixed in
RSD-wikijs-3c5141c9cf
Admin handbook: docker --env-file keeps quotes as part of the value (the config parser then fails), so a customer who follows the quoting instruction cannot start the wiki. [defects, defects #93395]		criticalfixed-before-releaseheld review (review model)—
RSD-wikijs-99c9b99a8c
The image refuses to start without ADMIN_PASS, although Wiki.js uses it only on the first start against an empty database [defects, defects #108192]		lowopenruntime check—
RSD-wikijs-b8ae87d31b
Admin handbook: docker --env-file keeps quotes as part of the value (the config parser then fails), so a customer who follows the quoting instruction cannot start the wiki. [defects, defects #109261]		criticalfixed-before-releaseheld review (review model)—
RSD-wikijs-92efce0f09
Admin handbook: docker --env-file keeps quotes as part of the value (the config parser then fails), so a customer who follows the quoting instruction cannot start the wiki. [defects, defects #109262]		criticalfixed-before-releaseheld review (review model)—
RSD-wikijs-aa928d733f
Admin handbook: The documented credential-change procedure deletes the volume that holds every page, user and setting and gives no backup/restore step; a new POSTGRES_PASSWORD then initialises an empty database. [defects, defects #109263]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-2e1039888a
Admin handbook: With POSTGRES_USER=wikijs the postgres image creates no postgres role. [defects, defects #109264]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-04305b6545
Admin handbook: Same: wikijs is the superuser; there is no postgres role. [defects, defects #109265]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-eafbeae7c7
Admin handbook: The following `docker load < rebuilt.docker.tar` yields an untagged image, yet the next paragraph tells the customer to run the standard commands, whose image name is the registry tag, so the… [defects, defects #109266]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-1ef131bbcd
Admin handbook: The server is bound to 0.0.0.0, not loopback; the documented `-p 3000:3000` only works because of that. [defects, defects #109267]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-c5d643b188
Database handbook: Same: bound to all interfaces. [defects, defects #109268]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-623b21b542
Admin handbook: Docker runs probes from the start; the start period does not delay them or the healthy state. [defects, defects #109269]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-0d8fead45a
Admin handbook: Same start-period misreading; probes begin immediately. [defects, defects #109270]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-a6b4fbcab5
Admin handbook: ADMIN_EMAIL is not required at every start; this contradicts line 982 and the Operating facts ('default (address withheld)'). [defects, defects #109271]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-9767f0e12f
Admin handbook: The quoted message is not what the image prints. [defects, defects #109272]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-3937d52e60
Admin handbook: A restart reuses the container's original environment, so adding the variable to wikijs.env does not end a 64 loop. [defects, defects #109273]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-dabaebcce0
Admin handbook: `-s` is the subreaper option, it is not what forwards signals. [defects, defects #109274]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-4eda60de3f
Admin handbook: After the grace period Docker kills the container; tini does not send SIGKILL. [defects, defects #109275]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-3da3446175
Admin handbook: There is no compose file in the kit or the documents; the deployment is docker run commands. [defects, defects #109276]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-63f5f31d1c
Database handbook: No compose file exists in the deployment. [defects, defects #109277]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-ec4d9b8b59
Admin handbook: Wrongly ties a mounted volume to the container's lifetime; the mount matters only when the container is re-created (the section above says so). [defects, defects #109278]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-8693ba204f
Admin handbook: A restart keeps /wiki/data with no mount; the sentence suggests a mount is needed for restarts. [defects, defects #109279]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-7aacb61931
Admin handbook: /wiki/data/repo is inside the container (the cache under /wiki/data), not on the host. [defects, defects #109280]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-a2bfed0a78
Admin handbook: The list is presented as complete but is contradicted by line 1292 (strategies need no authentication) and other anonymous reads. [defects, defects #109281]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-4fc147e286
Admin handbook: Same incomplete public list. [defects, defects #109282]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-1bf3bbe324
Database handbook: Same incomplete public list. [defects, defects #109283]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-392a0d9f99
Admin handbook: The image has no PostgreSQL; the sentence reads as if it did. [defects, defects #109284]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-989aeac6e7
Database handbook: Contradicts lines 764 and 783 and the measurement. [defects, defects #109285]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-c452f39e41
Database handbook: With the named volume mounted, `docker rm` of the container does not lose the data; contradicts the 'Database Setup' text and the volume's purpose. [defects, defects #109286]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-4ebb4de0cd
Database handbook: Wrong actor: the extensions and schema are created by Wiki.js (so the database user needs the right to create them). [defects, defects #109287]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-115eb3b443
Database handbook: No Administration > Backup section exists; the procedure is under Backup and Restore. [defects, defects #109288]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-d410ffb11e
Database handbook: Contradicts every other section ('/wiki/data needs no backup'; Git remotes hold the clones). [defects, defects #109289]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-fd49170865
Database handbook: The directory already survives restarts without a mount (line 931 says so). [defects, defects #109290]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-b78307ee92
Database handbook: A dump of the schema alone (-n wiki) omits the extensions and fails to restore (Admin Handbook line 892). [defects, defects #109291]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-f8f4e3bb3e
Database handbook: The only documented way to change the probe is invalid: `HEALTHCHECK ... [defects, defects #109292]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-d0d41c95d2
Database handbook: Health status does not drive restarts (stated in lines 774 and 791). [defects, defects #109293]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-4263a833e9
Database handbook: A licence statement customers rely on is false: the image carries 109 Ubuntu packages under GPL/LGPL/MPL licences, Node.js and MIT/other npm dependencies. [defects, defects #109294]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-668d65290f
Admin handbook: Undocumented limit on the database password. [defects, defects #111048]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-78f5fb0380
Admin handbook: The documented credential-change command wraps the SQL in double quotes on the host. [defects, defects #111049]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-2fb0daabfa
Database handbook: The heading says no other licences apply, but the section's own body (and the image) say otherwise: Docker Scout counts 111 packages with copyleft licences (GPL, LGPL, MPL; 109 are Ubuntu packages)… [defects, defects #111050]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-aa3cf96cd9
Database handbook: A licence/source statement customers act on is not true: the shipped /wiki/backend/package.json has an `overrides` block of 8 entries that the upstream tag does not have, and the published patch… [defects, defects #111051]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-6087265c8c
Admin handbook: Same defect as DB handbook line 1152: 'complete source patch' and 'tag with that patch applied' omit the 8 `overrides` entries the image's backend/package.json carries; the patch has only the… [defects, defects #111052]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-4adff112d3
Docker Hub README: Same defect as DB handbook line 1152, in the published Docker Hub text: the diff lists only the version stamp, but the image's backend/package.json also carries 8 dependency `overrides` entries. [defects, defects #111053]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-08c2ba8d18
Admin handbook: Contradicts the next sentence and the 'Database Setup' text: with the named volume mounted, `docker rm` of the database container does not lose the data (round-1 finding repeated in new words). [defects, defects #111054]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-0e3814a839
Database handbook: ADMIN_EMAIL is not required at every start; the following bullets and the Operating facts say it is the first-start login with a default. [defects, defects #111055]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-3a91df53c4
Admin handbook: ADMIN_EMAIL is optional (default (address withheld)), as the Operating facts and line 982 say; only ADMIN_PASS is checked at every start. [defects, defects #111056]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-d9cfe3bf35
Admin handbook: Same ADMIN_EMAIL-is-required wording as the round-1 finding. [defects, defects #111057]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-208c9f4e5e
Database handbook: The list of public routes is presented as complete but is not (round-1 finding, still in this handbook): the Admin handbook lists whoami among anonymous reads. [defects, defects #111058]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-7a40d6b867
Database handbook: Same incomplete public list (whoami and others answer without a session). [defects, defects #111059]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-3024605b0a
Database handbook: Same incomplete public list. [defects, defects #111060]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-73a8af5764
Database handbook: Contradicts the curated env_file in the Docker Hub README, which has `#` comment lines that docker accepts; 'every line must be NAME=value only' is false. [defects, defects #111061]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-c15469b41b
Database handbook: 'Must be on the docker run command, not in wikijs.env' is false: an ADMIN_EMAIL line in the env file works (nothing in the image reads it differently); only the precedence is true. [defects, defects #111062]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-8f2c4563f7
Database handbook: Round-1 finding repeated in new words: `-s` is the subreaper option, it is not what forwards signals (tini forwards them without it). [defects, defects #111063]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-e9faf6671c
Admin handbook: The stated reason is irrelevant and the parenthesis misleads: port 3000 is unprivileged on any host, so `--network host` does not stop the wiki user from listening on it. [defects, defects #111064]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-00ef34e975
Admin handbook: There is no POST on /_scim/v2/Users/{id}; the create route is POST /_scim/v2/Users. [defects, defects #111065]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-b96b850418
Admin handbook: A customer who calls the listed SCIM routes on a fresh deployment gets 404; the handbook never says the endpoint must be enabled first (the API guide documents isEnabled). [defects, defects #111066]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-07b7a6cca5
Admin handbook: Contradicts line 1458 of the same section ('Never remove wikijs-pgdata: it holds the whole wiki') by telling the customer to remove the old volume before the restore is confirmed, and its premise (a… [defects, defects #111067]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-036091dd8b
Admin handbook: The parenthesis "(required at every start; ...)" follows both ADMIN_EMAIL and ADMIN_PASS, so it reads as if ADMIN_EMAIL were required at every start; it is optional and used only on the first start… [defects, defects #117222]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-0d67a455a4
Admin handbook: Says tini runs entrypoint.sh "as PID 1"; tini is PID 1 and node is its child (PID 7). [defects, defects #117223]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-11c587e7b0
Database handbook: Same PID-1 misstatement: entrypoint.sh does not run as PID 1; tini does. [defects, defects #117224]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-8868040b12
Database handbook: tini does not exec the server: it stays PID 1 and runs it as a child. [defects, defects #117225]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-d5e7112735
Database handbook: tini forks the entrypoint and remains PID 1; "execs" is false and contradicts "Tini ... [defects, defects #117226]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-2cab7c09be
Database handbook: The restart policy cannot supply the variable; it restarts with the old (missing) environment forever until the container is recreated. [defects, defects #117227]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-0d52cb4c62
Database handbook: DB_SSL is a DB_* variable and is not ignored when DATABASE_URL is set; with it, TLS is required for the URL connection. [defects, defects #117228]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-21dde90b7a
Database handbook: The published patch now carries the 8 dependency overrides and the lockfile edits; the sentence still says it holds only the version strings and that the overrides live only in the archive tree. [defects, defects #117229]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-d516f09306
Database handbook: Describes the patch as the version stamp only, with the overrides coming separately from the archive; the published patch includes them. [defects, defects #117230]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-5c7cf68d4d
Admin handbook: Says the overrides are carried only by the vendored tree; the published patch includes them. [defects, defects #117231]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-b357783bb7
Admin handbook: Presents the patch as the version stamp with the overrides as a separate item; the patch now holds both. [defects, defects #117232]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-8402d53ff1
Admin handbook: Same as line 1708: the dependency overrides are part of the published patch. [defects, defects #117233]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-09acace9cb
Release notes: Known issues prints a stale ledger row: an internal review note ("Same defect as DB handbook line 1152") describing a diff that lists only the version stamp, which is no longer true of the published… [defects, defects #117234]		lowopenheld review (review model)—
RSD-wikijs-21dcb2dfe6
Release notes: The list that follows names two of the eight enforced versions; the other six (including uuid@9 pinned to 11.1.1) are missing, so the list reads as complete. [defects, defects #117235]		lowopenheld review (review model)—
RSD-wikijs-f2b78d43b7
Security report: Section lists only sanitize-html and @azure/msal-node, omitting the other six enforced overrides. [defects, defects #117236]		lowopenheld review (review model)—

Verification

3 items not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:1d70c95a3332c0432bf7584f2f5dba1d4b9bfc3d5d75f8e8e168117d470b33ec · published digest sha256:1d70c95a3332c0432bf7584f2f5dba1d4b9bfc3d5d75f8e8e168117d470b33ec · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 77) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 693 package_archive gate_result.g8.result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-27T18:36:38Z · failing Docker Scout counts 111 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 109 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: wiki-backend.) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • First own scan of the releaseA (at 2026-10-27T18:44:37Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-27T06:30:41Z) [image_scans, image_scans #1347]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-27T18:35:49Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [docs/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3632476506 · transparency-log entry · integrated 2026-11-01T14:25:32Z) [ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]

Offline clean-room rebuilds

  • 2026-10-27T13:04:14Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:1d70c95a3332c0432bf7584f2f5dba1d4b9bfc3d5d75f8e8e168117d470b33ec [clean-room rebuild ledger, runs[457]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
  • Not recorded: the attestations' transparency-log entries (no attestation record in the release's workspace)
  • Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

2 items not recorded
  • Image pushed (internal tag), publish_image passed2026-10-27T12:28:44Z [stage_runs, stage_runs chain 693 stage publish_image]
  • Archive manifests written2026-10-27T18:38:56Z [PUBLISH_MANIFEST.json, published_at]
  • Archive cut over on prodasset, package_archive passed2026-10-27T18:44:26Z [stage_runs, stage_runs chain 693 stage package_archive]
  • Cut-over markerpresent (chain 693) [.cutover.json]
  • Not recorded: when the release tag was promoted (the promotion record in the archive was written before the promotion, and the release's workspace no longer holds this chain)
  • Not recorded: the site event's time (the release checklist is in the chain's workspace, which no longer holds this chain)

Packages and CPU level

Fully recorded
  • Packages in the image586 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 839 · probed 2026-11-02T17:07:11Z · source backfill) [release_images, isa_level_hard]

History

1 event
  • 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records

Records

23 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/PROMOTION_RECORD.jsoninside the archive (ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.tar.gz)—
.cutover.jsonbeside the archive (prodasset /data/production/wikijs/3.0.0-beta.685-CE-ubuntu24.04-r3/)—
MANIFEST.jsonbeside the archive (prodasset /data/production/wikijs/3.0.0-beta.685-CE-ubuntu24.04-r3/)—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/wikijs/3.0.0-beta.685-CE-ubuntu24.04-r3/)—
ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.rebuild.jsonbeside the archive (prodasset /data/production/wikijs/3.0.0-beta.685-CE-ubuntu24.04-r3/)—
ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.rebuild.json.sigstorebeside the archive (prodasset /data/production/wikijs/3.0.0-beta.685-CE-ubuntu24.04-r3/)—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/wikijs/3.0.0-beta.685-CE-ubuntu24.04-r3/)—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)370
chainssadb, ReadyStack's engine database (not published)693
defectssadb, ReadyStack's engine database (not published)wikijs 3.0.0-beta.685-CE-ubuntu24.04-r3
drive_runssadb, ReadyStack's engine database (not published)chain 693
held_roundssadb, ReadyStack's engine database (not published)chain 693
image_scanssadb, ReadyStack's engine database (not published)1347
micro_step_runssadb, ReadyStack's engine database (not published)chain 693
release_imagessadb, ReadyStack's engine database (not published)wikijs 3.0.0-beta.685-CE-ubuntu24.04-r3
stage_eventssadb, ReadyStack's engine database (not published)chain 693
stage_runssadb, ReadyStack's engine database (not published)chain 693