Wiki.js 3.2.0-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/wikijs:3.2.0-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/wikijs:3.2.0-CE-ubuntu24.04-r1
  • Index digestsha256:62d9b6812fdf1fa177a9f49b39367004b4e319212e6ce2c78dc7d39cabcda5af
  • linux/amd64 digestsha256:71286f1093afac639fc334931bf003f9cbfd94244b0db34f59c876b26b415681
  • ArchiveReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 now0e042bae786abddcc5acc6a2141e57eed7403a36b4c85e134892c6c4b2e6e30f
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-08T23:31:04Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.trail.json
ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.trail.jsonReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.trail.mdWiki.js product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductWiki.js (wikijs) [MANIFEST.json]
  • Release tag3.2.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/wikijs:3.2.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:62d9b6812fdf1fa177a9f49b39367004b4e319212e6ce2c78dc7d39cabcda5af [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:71286f1093afac639fc334931bf003f9cbfd94244b0db34f59c876b26b415681 [ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.tar.gz (bytes 323213123) [MANIFEST.json]
  • Archive sha256 at publish0e042bae786abddcc5acc6a2141e57eed7403a36b4c85e134892c6c4b2e6e30f [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/requarks/wiki [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref3.2.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit013dd6e998f2a9eea80ff22483493d0326dc0eff [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash7f36e41197bba4b3714229efafc64ccbe5e55a86bc6c28573d566063e72d63f3 (files 1468) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:ceea557467f860d5e9ac13b40193fc6c30757b114ebd51b2492de8787ea2f8c9 [ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794111368 (utc 2026-11-08T04:16:08Z) [ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit debed1ff88426b9337ee3418aa295a436ca89365 · dirty yes · first drive 3779
    • commit f43702b5e009964169aee805cbca1db98779c212 · dirty yes · first drive 3815
    • commit 9297e5f1902d782e43b6ebf8fe9b54eba0e82889 · dirty yes · first drive 3861
    • commit 58e9240297aa7166e0dec2e18a9c5ae2e84212bf · dirty yes · first drive 3883
    • commit 501735316ba87dabc6c51510f9354cb12ff7477f · dirty yes · first drive 3891
    • commit 97db547c0a1cff5512f23d576ef18dfb8150db3b · dirty yes · first drive 3892
    • commit 76d81c24c43ddcadfccac6684668838e8438bf96 · dirty yes · first drive 3894
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain883 (created 2026-11-08T11:26:25Z · trigger customer_request · upstream version 3.2.0) [chains, chains #883]
  • Requestbuild request #583 (rebuild) (requested at 2026-11-08T09:32:07Z · requested by kitforge-agent · version 3.2.0) [build_requests, build_requests #583]
  • Reasonretarget to 3.2.0: a newer upstream release (rule 1); stable 3.x, 10 upstream advisories fixed, CVE-2026-109518 due 2026-11-11 (PR #228) [build_requests, build_requests #583 request_reason]
  • Supersedesreadystack/wikijs:3.0.0-beta.685-CE-ubuntu24.04-r3 (chain 693) [chains, chains #693]

The path through the harness

Fully recorded

2 chains · 8 drives · 18 stages · 4 rewinds

Chain 731 behind it · abandoned

Created 2026-10-27T22:34:48Z, upstream 3.0.0-beta.685, build request 427 [chains, chains #731]

Abandoned: chain 731 abandoned: stale (it targets '3.0.0-beta.685', the strategy '3.2.0') [watch_queue, watch_queue #11953 resolution]

DriveStartedMinutesBuild hostHow it stopped
8142026-10-27T22:35:16Z49.5build host 4 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #814] rebuilt from a build line's log

Chain 883 release · ready_to_ship

Created 2026-11-08T11:26:25Z, upstream 3.2.0, build request 583 [chains, chains #883]

DriveStartedMinutesBuild hostHow it stopped
37792026-11-08T11:26:54Z15.7build host 4 withhold-publish stage_failed at verdict; first failed check scout_verdict:release_check_passed; 7 ticks [drive_runs, drive_runs #3779]
38152026-11-08T13:55:40Z53.2build host 4 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 15 ticks [drive_runs, drive_runs #3815]
38612026-11-08T18:33:51Z5build host 4 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3861]
38832026-11-08T21:22:31Z8.8build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3883]
38912026-11-08T22:11:21Z6build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3891]
38922026-11-08T22:43:23Z6.3build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3892]
38942026-11-08T23:23:30Z—build host 4 publish-held not recorded [drive_runs, drive_runs #3894]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-08T11:27:05Z2026-11-08T11:27:06Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json c3bbb67ba879…
acquire 2026-11-08T11:27:11Z2026-11-08T11:27:11Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 4a739676021b…
license_file 76a97c878c9c…
custody_inputs 21ec67ab0d84…
source_tree_hash 8cfd9c97b93a…
source_file_manifest 3eaf285990cb…
plan 2026-11-08T11:27:43Z2026-11-08T11:27:44Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 5e66218bf618…
input_pin_plan 12de4f142fe8…
toolchain_lock b3cd8ca4fe70…
assemble_kit 2026-11-08T11:34:26Z2026-11-08T14:02:26Z2
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile b6ba1cc652b3…
build_recipe d4f7d77fedc5…
system_pinning ad62bc4eb7b3…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health d490eaa74fb9…
verify_offline_sh 3e8184ea230c…
base_image_digests 0e2ffadbb66a…
dockerfile_offline b6ba1cc652b3…
first_build_digest 182005e0654c…
remediate 2026-11-08T11:35:07Z2026-11-08T14:02:32Z2
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 542e38450668…
security_report 2cac7aff8280…
build_kit 2026-11-08T11:39:51Z2026-11-08T14:08:44Z2
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp a708060a29c2…
locked_digest 4b219c931b0b…
freeze_manifest df78646241cb…
offline_rebuild_transcript 7e1eb9c56386…
verdict 2026-11-08T11:42:38Z2026-11-08T14:10:39Z2
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict bee9b98c8682…
publish_image 2026-11-08T14:11:36Z2026-11-08T14:11:37Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 016c911ff52c…
promotion_record 80a0f560bb1e…
boot_instance 2026-11-08T14:12:01Z2026-11-08T14:12:04Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle a10c3dd74a2e…
sbom 2026-11-08T14:12:30Z2026-11-08T14:12:31Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 4909f62326cb…
sbom_json 2c490d6746b0…
schema_discovery 2026-11-08T14:12:34Z2026-11-08T14:12:35Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 765cc8f15f6d…
dependency_tree 795600049b29…
table_classification dfa7ad803b78…
admin_handbook 2026-11-08T14:29:57Z2026-11-08T14:29:58Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 685c136237db…
admin_handbook 0b1a0b991be4…
db_handbook 2026-11-08T14:39:09Z2026-11-08T14:39:10Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 1678501d3a58…
seed_isolation bd4fa7bde030…
seed_data 2026-11-08T14:39:17Z2026-11-08T14:39:18Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 2b0a924b8227…
seed_cases_json 58b2afe94f46…
seed_validate 2026-11-08T14:39:21Z2026-11-08T14:39:21Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 553a72f86a31…
usecase_validate 2026-11-08T14:40:55Z2026-11-08T14:40:56Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests f1e8ba8b1390…
passed_tests eb6c8e06766f…
test_results 77f5f7ee5610…
usecase_contract 6a382228690e…
finalize_docs 2026-11-08T14:41:01Z2026-11-08T14:41:02Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 88914dc964d3…
release_notes 4244ab7acd0f…
api_integration_guide ec501908af80…
package_archive invalidated 2026-11-08T23:23:02Z 2026-11-08T14:48:50Z2026-11-08T22:49:42Z5
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 3f1c6d0fb8c1…
checksums ec370dcc828d…
verify_md ed310afd1487…
rebuild_md b788f4c8a4d0…
manifest_txt 2f857885f090…
actions_jsonl c3a1df1e89c3…
provenance_md ff199dc8de7a…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 97c6bd62e92e…

[stage_runs]

Rewinds

  • 2026-11-08T13:55:44Z: verdict to assemble_kit on strategy_changed (strategy changed (5c33494294aa -> c68edf180d16)) [stage_events, stage_events #26481]
  • 2026-11-08T21:57:41Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27440]
  • 2026-11-08T22:42:29Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27448]
  • 2026-11-08T23:23:02Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27456]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-08T22:49:42Z.

150 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 07082 —
remediate2001 010341 L-A08, L-038, L-036, L-034, L-032
admin_handbook843903 12762279 —
db_handbook562403 5598430 —
usecase_validate6001 022269 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

3 rounds, 3 counted, $8.27 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-08T21:31:51Z 0716 findings to repackage [held_rounds, held_rounds #1548] $2.30 3 rounds, $40.00 a1f3a033807f…
22026-11-08T22:17:58Z 019 findings to repackage [held_rounds, held_rounds #1549] $2.56 3 rounds, $40.00 e8a1416efd07…
32026-11-08T22:50:19Z 0015 clean to publish [held_rounds, held_rounds #1551] $3.41 3 rounds, $40.00 3f1c6d0fb8c1…

Defects

Fully recorded
  • Ledger entries48 [defects, defects where product_slug=wikijs and this tag or chain]
  • Disclosed in the archive45 [docs/defects/defects.json, entries]

48 ledger entries: by severity low 40, high 8; by status open 5, fixed-in-release 1, fixed-before-release 42.

DefectSeverityStatusFound byFixed in
RSD-wikijs-68e24b37d2
The image refuses to start without ADMIN_PASS, although Wiki.js uses it only on the first start against an empty database [defects, defects #185533]		lowopenruntime check—
RSD-wikijs-3195855f3b
Release notes: Known issues prints a stale ledger row: an internal review note ("Same defect as DB handbook line 1152") describing a diff that lists only the version stamp, which is no longer true of the published… [defects, defects #185534]		lowfixed-in-releaseheld review (review model)3.2.0-CE-ubuntu24.04-r1
RSD-wikijs-01d9fd25a3
Release notes: The list that follows names two of the eight enforced versions; the other six (including uuid@9 pinned to 11.1.1) are missing, so the list reads as complete. [defects, defects #185535]		lowopenheld review (review model)—
RSD-wikijs-f110ec91bc
Security report: Section lists only sanitize-html and @azure/msal-node, omitting the other six enforced overrides. [defects, defects #185536]		lowopenheld review (review model)—
RSD-wikijs-20e49da17a
Admin handbook: provenance/PINS.json + docs/PINS.md:42-73: the dependency versions ReadyStack sets are six overrides (brace-expansion@5, fast-uri@3, fast-uri@4, undici@7, yaml@2, @azure/identity); strategy… [defects, defects #186498]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-afdd15e356
Admin handbook: provenance/PINS.json + docs/PINS.md:42-73: the dependency versions ReadyStack sets are six overrides (brace-expansion@5, fast-uri@3, fast-uri@4, undici@7, yaml@2, @azure/identity); strategy… [defects, defects #186499]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-a67c03b345
Database handbook: provenance/PINS.json + docs/PINS.md:42-73: the dependency versions ReadyStack sets are six overrides (brace-expansion@5, fast-uri@3, fast-uri@4, undici@7, yaml@2, @azure/identity); strategy… [defects, defects #186500]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-5361426174
Database handbook: provenance/PINS.json + docs/PINS.md:42-73: the dependency versions ReadyStack sets are six overrides (brace-expansion@5, fast-uri@3, fast-uri@4, undici@7, yaml@2, @azure/identity); strategy… [defects, defects #186501]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-8ec75a21d9
Admin handbook: Ran on the held image: PUT /_api/sites/{siteId}/auth/login with "strategyId":"local" -> {"ok":false,"error":"Error","statusCode":400,"message":"body/strategyId must match format \"uuid\""}; with the… [defects, defects #186502]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-bfb44f1142
Admin handbook: Ran the example (host 18080 -> container 3000, -e WIKI_PORT=8080): curl http://127.0.0.1:18080/_api/system/flags -> HTTP 000 (connection reset); inside the container the server answers on… [defects, defects #186503]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-09c0b308dc
Admin handbook: Ran the documented start with --env-file on the held image: docker inspect --format '{{.Config.Env}}' -> [DB_PASS=dbpw1 ADMIN_PASS=my new pass $x! [defects, defects #186504]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-7db7a0ee08
Admin handbook: docker top on the held image: tini (PID 1, PPID = containerd-shim) -> `/usr/bin/tini -s -- /usr/local/bin/entrypoint.sh` is the process that exec'd into `node --no-experimental-webstorage backend`… [defects, defects #186505]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-d393374343
Admin handbook: docker top: tini is PID 1 and stays so, node is its child (entrypoint.sh at /home/.../entrypoint.sh ends in `exec node ...`). [defects, defects #186506]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-98c61d1a49
Admin handbook: backend/core/db.ts:98-155: DATABASE_URL only replaces host/user/password/database/port; dbUseSSL still comes from WIKI.config.db.ssl (DB_SSL) and DB_SSL_CA, and the search_path from DB_SCHEMA. [defects, defects #186507]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-5700ab88b9
Admin handbook: backend/core/db.ts:98-155 and the DATABASE_URL + DB_SSL=true run (connection retries against a non-TLS postgres): DB_SSL is read with DATABASE_URL; the sentence names only two variables that are… [defects, defects #186508]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-e4ff7e3117
Admin handbook: Listed under 'At every start, the container requires:' (line 680). [defects, defects #186509]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-3ae0b1362c
Database handbook: Listed under 'At every start, you must provide:' (line 190) although ADMIN_EMAIL has a default (backend/models/users.ts:1614) and entrypoint.sh checks only ADMIN_PASS. [defects, defects #186510]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-4679f28eb1
Admin handbook: DATABASE_URL is passed through the same env file / container environment (docker inspect run: Config.Env lists every --env-file variable), so 'because the password appears in config files and the… [defects, defects #186511]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-2c2f1ef136
Admin handbook: backend/modules/authentication/local/authentication.ts:27 `const email = username.toLowerCase()` and backend/models/users.ts:1614 `.trim().toLowerCase()` on ADMIN_EMAIL: sign-in is not case-sensitive. [defects, defects #186512]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-f68dd22c76
Database handbook: Ran `docker run --rm ... -e ADMIN_PASS=zz <image> ls` on the held image: the server started and kept running until killed by timeout (rc 143), no failure. entrypoint.sh ends in `exec node… [defects, defects #186513]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-9ec140ab22
Database handbook: entrypoint.sh (kit): `exec node --no-experimental-webstorage backend`, no "$@"; run of `<image> ls` started the server normally. [defects, defects #186514]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-d1b198b5be
Database handbook: Same measurement: entrypoint.sh does not forward arguments to node. [defects, defects #186515]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-47296ab80e
Database handbook: docker inspect jt-ha883-w --format '{{json .Mounts}}' -> [] for the documented run; IMAGE_CONFIG.json has no Volumes entry. [defects, defects #186516]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-d19c6c9299
Database handbook: admin-guide/openapi.json served by this release: 238 paths, 309 operations (API guide line 5: 309 operations). [defects, defects #186517]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-daaadb5b79
Database handbook: provenance/IMAGE_EVIDENCE.json:77: 'Docker Scout counts 111 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 109 of them operating-system packages'; no record supports 'mostly LGPL'. [defects, defects #186518]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-df9c9e73ef
Database handbook: strategy source.pre_install_cmds: `rm -rf frontend/node_modules blocks/node_modules` after the frontend and blocks builds; the image copies only assets/, blocks/compiled/, backend/ (BUILD_RECIPE… [defects, defects #186519]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-a165804263
Docker Hub README: IMAGE_CONFIG.json labels com.readystack.license.disclosure / readystack.license_disclosure: 'Six npm dependencies raised for security fixes are set as overrides in backend/package.json ... [defects, defects #186520]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-dd38d66111
Admin handbook: Cross-section contradiction on the AGPL section 13 obligation: a customer can act on this sentence and not offer source to network users, against what the rest of the documents state. [defects, defects #187006]		highfixed-before-releaseheld review (review model)—
RSD-wikijs-923b660c9a
Admin handbook: Says an administrator can set another user's password only when mail is configured; setting it needs no mail. [defects, defects #187007]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-3e6190c31c
Admin handbook: Reads as if arguments to docker run are used, while entrypoint.sh drops them. [defects, defects #187008]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-9544fb790c
Admin handbook: Unsupported Docker Engine 20.10 requirement and an irrelevant 'low-numbered ports' explanation for port 3000. [defects, defects #187009]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-d35b1ce51a
Database handbook: States docker exec runs as root by default; it runs as the image user wiki, contradicting other sections. [defects, defects #187010]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-2bce22d7f7
Database handbook: Calls a pg_dump -n wiki dump 'schema-only'; it carries the data, the failure is the missing extensions. [defects, defects #187011]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-93cd4746e7
Database handbook: States a Docker Engine 20.10 minimum for the offline rebuild; the real requirements (buildx 0.30+, jq, tar) are not named. [defects, defects #187012]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-9380d1922a
Docker Hub README: The Hub README's source-changes line names only the version stamp and omits the six overrides the label and handbooks list. [defects, defects #187013]		lowopenheld review (review model)—
RSD-wikijs-0da6aeaf58
Release notes: The list of enforced minimum versions names one of the six overrides, so it reads as complete. [defects, defects #187014]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-dd672c104e
Release notes: The minimum-dependency section lists one of the six enforced overrides, so it reads as complete. [defects, defects #187015]		lowopenheld review (review model)—
RSD-wikijs-5380c2fe4f
Admin handbook: Round-2 'low-numbered ports' explanation for port 3000 was not removed. [defects, defects #187465]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-fa42be38e1
Admin handbook: Same 'above 1023' rationale as the round-2 finding, still present, and different from the DB handbook's reason. [defects, defects #187466]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-d1d88175d5
Database handbook: Contradicts the 'above 1023' reason in the admin handbook; neither is supported by the records. [defects, defects #187467]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-009f9a8c61
Admin handbook: Says only DB_SSL is still read; DB_SCHEMA and DB_SSL_CA are read too, contradicting lines 1310 and 2445. [defects, defects #187468]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-64f90217d7
Admin handbook: Blanket 'takes precedence over DB_* values' is wrong for DB_SCHEMA/DB_SSL/DB_SSL_CA. [defects, defects #187469]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-5e08207eb8
Admin handbook: 'In addition to Wiki.js itself' is wrong: the 111 includes the AGPL wiki-backend package. [defects, defects #187470]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-0fa1a661c5
Admin handbook: Overbroad/ambiguous wording on the section 13 trigger, inconsistent with the sections that tie it to network users. [defects, defects #187471]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-924e4e184c
Admin handbook: Procedure tells the customer to put the administrator password on the docker run command line, against the secrets-in-env-file rule of the other sections. [defects, defects #187472]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-99db8b6ba7
Admin handbook: Says Git clones are always held by their remote; a target without a URL is not. [defects, defects #187473]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-fab9458c40
Database handbook: Wrong cause: -s is not what makes tini forward signals. [defects, defects #187474]		lowfixed-before-releaseheld review (review model)—
RSD-wikijs-ca9c989417
Database handbook: Calls -s the 'signal-forwarding flag'. [defects, defects #187475]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:71286f1093afac639fc334931bf003f9cbfd94244b0db34f59c876b26b415681 · published digest sha256:71286f1093afac639fc334931bf003f9cbfd94244b0db34f59c876b26b415681 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 79) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T23:24:22Z · failing Docker Scout counts 111 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 109 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: wiki-backend. · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T23:23:44Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3759534500 · transparency-log entry · integrated 2026-11-08T23:29:45Z) [ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:62d9b6812fdf1fa177a9f49b39367004b4e319212e6ce2c78dc7d39cabcda5af · state attached · log index 3759534599 · transparency-log entry
    • kind sbom · digest sha256:62d9b6812fdf1fa177a9f49b39367004b4e319212e6ce2c78dc7d39cabcda5af · state attached · log index 3759534668 · transparency-log entry
    • kind vsa · digest sha256:62d9b6812fdf1fa177a9f49b39367004b4e319212e6ce2c78dc7d39cabcda5af · state attached · log index 3759534737 · transparency-log entry
    • kind provenance · digest sha256:71286f1093afac639fc334931bf003f9cbfd94244b0db34f59c876b26b415681 · state attached · log index 3759534786 · transparency-log entry
    • kind sbom · digest sha256:71286f1093afac639fc334931bf003f9cbfd94244b0db34f59c876b26b415681 · state attached · log index 3759534833 · transparency-log entry
    • kind vsa · digest sha256:71286f1093afac639fc334931bf003f9cbfd94244b0db34f59c876b26b415681 · state attached · log index 3759534860 · transparency-log entry
    (at 2026-11-08T23:29:46Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/wikijs/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-08T21:31:55Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:71286f1093afac639fc334931bf003f9cbfd94244b0db34f59c876b26b415681 [clean-room rebuild ledger, runs[670]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-08T14:11:37Z [stage_runs, stage_runs chain 883 stage publish_image]
  • Archive manifests written2026-11-08T23:26:46Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 839 · probed 2026-11-08T14:07:10Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-08T23:31:04Z generated: by KitForge release/build_trail.py · generator commit 76d81c24c43ddcadfccac6684668838e8438bf96
  • 2026-11-08T23:32:53Z publication: promoted at 2026-11-08T23:31:33Z · promoted digest sha256:62d9b6812fdf1fa177a9f49b39367004b4e319212e6ce2c78dc7d39cabcda5af · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 395 · checklist status complete · checklist at 2026-11-08T23:32:53Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

26 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/wikijs/3.2.0-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/wikijs/3.2.0-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/wikijs/3.2.0-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-wikijs-3.2.0-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/wikijs/3.2.0-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/wikijs/3.2.0-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)583
chainssadb, ReadyStack's engine database (not published)731, 883
defectssadb, ReadyStack's engine database (not published)wikijs 3.2.0-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 731, chain 883
held_roundssadb, ReadyStack's engine database (not published)chain 883
lesson_recallssadb, ReadyStack's engine database (not published)chain 883
micro_step_runssadb, ReadyStack's engine database (not published)chain 883
release_imagessadb, ReadyStack's engine database (not published)wikijs 3.2.0-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 883
stage_runssadb, ReadyStack's engine database (not published)chain 883
watch_queuesadb, ReadyStack's engine database (not published)11953
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—