WireGuard 0.0.20250522-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/wireguard:0.0.20250522-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/wireguard:0.0.20250522-CE-ubuntu24.04-r1
  • Index digestsha256:fad6612d902004cca17b69de4d9fbcb2438d288ecbcd188a8d12612963e2ffaa
  • linux/amd64 digestsha256:9a7cde50fe6f16cea9aeff4714ccb5a115d3b12b37c8df39bd11035fd2afdda9
  • ArchiveReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 now12a510e56e8c5e39474a48ad480799d5f2d6d3d41c066f7537fea536a6e8b10a
  • Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
  • Sections9 sections, 4 fully recorded; 11 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.trail.json
ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.trail.jsonReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.trail.mdWireGuard product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

1 item not recorded
  • ProductWireGuard (wireguard) [MANIFEST.json]
  • Release tag0.0.20250522-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/wireguard:0.0.20250522-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:fad6612d902004cca17b69de4d9fbcb2438d288ecbcd188a8d12612963e2ffaa [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:9a7cde50fe6f16cea9aeff4714ccb5a115d3b12b37c8df39bd11035fd2afdda9 [ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.tar.gz (bytes 443918465) [MANIFEST.json]
  • Archive sha256 at publishd5834b19c1c3598e5cb7175dde33b3a2db00e1de986be75cd749b79553140bfb [MANIFEST.json, repack_history[0].previous_tarball_sha256]
  • Archive sha256 now12a510e56e8c5e39474a48ad480799d5f2d6d3d41c066f7537fea536a6e8b10a [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack history
    • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 d5834b19c1c3598e5cb7175dde33b3a2db00e1de986be75cd749b79553140bfb · sha256 12a510e56e8c5e39474a48ad480799d5f2d6d3d41c066f7537fea536a6e8b10a · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
    [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://git.zx2c4.com/wireguard-go [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref0.0.20250522 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitf333402bd9cbe0f3eeb02507bd14e23d7d639280 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash2e29cb47cf21a63d63f493a69e65e0a53adc975d58337280681e571fb728dcd3 (files 107) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:9943fc18762ee1741a27c16bc7bc64d1eeab324341111b5a1a252950fa259a7e [ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1747871102 (utc 2025-05-21T23:45:02Z) [ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded
  • Chain767 (created 2026-10-28T10:23:12Z · trigger customer_request · upstream version 0.0.20250522) [chains, chains #767]
  • Requestbuild request #445 (new_product) (requested at 2026-10-28T03:12:39Z · requested by agent · version 0.0.20250522) [build_requests, build_requests #445]
  • Reasonce.rodeo trending tier 1 (no free A/B image), owner 2026-10-27 'all apps queued' (docs/CATALOGUE_EXPANSION.md); privileged exception --cap-add NET_ADMIN --device /dev/net/tun approved by the owner 2026-10-28 [build_requests, build_requests #445 request_reason]

The path through the harness

2 items not recorded

1 chain · 5 drives · 18 stages · 4 rewinds

Chain 767 release · shipped

Created 2026-10-28T10:23:12Z, upstream 0.0.20250522, build request 445 [chains, chains #767]

DriveStartedMinutesBuild hostHow it stopped
4872026-10-28T10:23:24Z21.6build host 2 withhold-publish ready_to_ship [drive_runs, drive_runs #487] rebuilt from a build line's log
4892026-10-28T11:54:59Z3.9build host 2 withhold-publish ready_to_ship [drive_runs, drive_runs #489] rebuilt from a build line's log
4902026-10-28T12:15:20Z3.9build host 2 withhold-publish ready_to_ship [drive_runs, drive_runs #490] rebuilt from a build line's log
4912026-10-28T12:41:38Z4.1build host 2 withhold-publish ready_to_ship [drive_runs, drive_runs #491] rebuilt from a build line's log
4932026-10-29T18:28:42Z7.4build host 2 publish-held shipped [drive_runs, drive_runs #493] rebuilt from a build line's log

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-28T10:23:30Z2026-10-28T10:23:31Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-28T10:23:34Z2026-10-28T10:23:34Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-28T10:23:54Z2026-10-28T10:23:54Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-28T10:25:25Z2026-10-28T10:25:26Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 —
remediate 2026-10-28T10:25:53Z2026-10-28T10:25:53Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 —
build_kit 2026-10-28T10:27:28Z2026-10-28T10:27:28Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 —
verdict 2026-10-28T10:28:04Z2026-10-28T10:28:05Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 —
publish_image 2026-10-28T10:28:44Z2026-10-28T10:28:45Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 —
boot_instance 2026-10-28T10:28:49Z2026-10-28T10:28:51Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 —
sbom 2026-10-28T10:29:00Z2026-10-28T10:29:01Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 —
schema_discovery 2026-10-28T10:29:03Z2026-10-28T10:29:04Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 —
admin_handbook 2026-10-28T10:32:18Z2026-10-28T10:32:19Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 —
db_handbook 2026-10-28T10:36:01Z2026-10-28T10:36:02Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 —
seed_data 2026-10-28T10:36:07Z2026-10-28T10:36:08Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 —
seed_validate 2026-10-28T10:36:10Z2026-10-28T10:36:11Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 —
usecase_validate 2026-10-28T10:36:26Z2026-10-28T10:36:27Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 —
finalize_docs 2026-10-28T10:40:14Z2026-10-28T10:40:15Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 —
package_archive 2026-10-28T10:44:55Z2026-10-29T18:36:03Z5
33 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 scout_grade_a
  • G8 script_copies
  • G8 three_way_sha
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 assetchain_coverage
 —

[stage_runs]

Rewinds

  • 2026-10-28T11:10:58Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2289]
  • 2026-10-28T12:10:58Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2290]
  • 2026-10-28T12:37:21Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2291]
  • 2026-10-29T18:28:16Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #573]
  • Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
  • Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-10-29T18:36:03Z.

62 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook18001 not recordednot recorded —
db_handbook19001 not recordednot recorded —
finalize_docs21001 not recordednot recorded —

[micro_step_runs]

  • Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
  • Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

3 items not recorded

Role: review model.

4 rounds, 4 counted, $7.08 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-10-28T10:46:55Z 02116 findings to repackage [held_rounds, held_rounds #217] rebuilt from a held-review state file $2.15 not recorded not recorded
22026-10-28T11:59:05Z 0117 findings to repackage [held_rounds, held_rounds #218] rebuilt from a held-review state file $1.68 not recorded not recorded
32026-10-28T12:20:56Z 0424 findings to repackage [held_rounds, held_rounds #219] rebuilt from a held-review state file $1.65 not recorded not recorded
42026-10-29T17:57:24Z 0019 clean to publish [held_rounds, held_rounds #220] rebuilt from a held-review state file $1.61 not recorded not recorded

Overrides

  • max_rounds: — to 4; by not recorded; why: not recorded predates override recording (2026-11-02): found in runstate/held-auto/wireguard.json, last written 2026-10-29T18:20Z; who set it, why, when and the value before are not known [review_overrides, review_overrides #28]
  • Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
  • Not recorded: the round cap in force at each round (the state files did not keep it)
  • Not recorded: who raised max_rounds to 4 and why (review_overrides #28 was backfilled from a state file; overrides are recorded with who and why from 2026-11-02)

Defects

Fully recorded
  • Ledger entries99 [defects, defects where product_slug=wireguard and this tag or chain]
  • Disclosed in the archive99 [docs/defects/defects.json, entries]

99 ledger entries: by severity high 24, low 75; by status fixed-before-release 99.

DefectSeverityStatusFound byFixed in
RSD-wireguard-b7c0b25ffb
Admin handbook: The quoted message is not what the container prints when either flag is missing; a customer searching logs or the docs for it will not find it (the text comes from the curated doc_facts.privileges). [defects, defects #131810]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-9ec14f558d
Admin handbook: The quoted message is not what the container prints when either flag is missing; a customer searching logs or the docs for it will not find it (the text comes from the curated doc_facts.privileges). [defects, defects #131811]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-174f56a611
Admin handbook: Troubleshooting heading names a message the container does not print for a missing flag. [defects, defects #131812]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-851b763411
Database handbook: The quoted message is not what the container prints when either flag is missing; a customer searching logs or the docs for it will not find it (the text comes from the curated doc_facts.privileges). [defects, defects #131813]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-79cfee8bcf
Database handbook: The quoted message is not what the container prints when either flag is missing; a customer searching logs or the docs for it will not find it (the text comes from the curated doc_facts.privileges). [defects, defects #131814]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-600e8d3ed4
API guide: The quoted message is not what the container prints when either flag is missing; a customer searching logs or the docs for it will not find it (the text comes from the curated doc_facts.privileges). [defects, defects #131815]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-ad07fafc67
API guide: The quoted message is not what the container prints when either flag is missing; a customer searching logs or the docs for it will not find it (the text comes from the curated doc_facts.privileges). [defects, defects #131816]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-43341f3aeb
API guide: The quoted message is not what the container prints when either flag is missing; a customer searching logs or the docs for it will not find it (the text comes from the curated doc_facts.privileges). [defects, defects #131817]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-de65743e83
API guide: The quoted message is not what the container prints when either flag is missing; a customer searching logs or the docs for it will not find it (the text comes from the curated doc_facts.privileges). [defects, defects #131818]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-492a7af611
API guide: The quoted message is not what the container prints when either flag is missing; a customer searching logs or the docs for it will not find it (the text comes from the curated doc_facts.privileges). [defects, defects #131819]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-0230aac1c1
Admin handbook: Every log line (entrypoint messages and wireguard-go output) is written to stderr, so `docker logs ... [defects, defects #131820]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-a4e4c6e41d
Admin handbook: The pipeline prints nothing: the logs are on stderr and the line says 'public key is', not 'Public key:'. [defects, defects #131821]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-0359ddb3f7
API guide: Without 2>&1 the pipeline prints nothing because the entrypoint writes to stderr; the documented command returns rc=1 and no key. [defects, defects #131822]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-4a8aa08915
Admin handbook: `docker healthcheck` is not a Docker command; the documented health-status command fails. [defects, defects #131823]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-c4b526943c
Database handbook: The pipe runs `wg pubkey` on the Docker host, where wg is normally not installed, so the procedure fails; it also moves the private key through the host. [defects, defects #131824]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-8161ca963d
Admin handbook: The example creates the directory with the invoking user's ownership and starts the container; as written it exits with Permission denied. [defects, defects #131825]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-98fe900df6
API guide: Contradicts API guide lines 641 and 646 (live changes are not persistent); a customer who relies on this loses peers at the next restart. [defects, defects #131826]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-184c9d62ef
API guide: The section says a peer reaching networks behind the container needs a route added inside the container; `ip route add <net> dev wg0` sends the container's own traffic for that network into the… [defects, defects #131827]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-556fba55b7
API guide: The backup instruction has no executable procedure and no restore, and the obvious route (copy out of the volume, mount the copy) fails with Permission denied because the copy is not owned by uid 999. [defects, defects #131828]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-abd3123144
Database handbook: No procedure is given for the backup it prescribes. [defects, defects #131829]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-15d8d5d7a3
Admin handbook: `wg show interfaces` prints interface names only; it is less detailed than `wg show`. [defects, defects #131830]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-d8f6c407eb
Admin handbook: netstat is not in the image. [defects, defects #131831]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-6071a1be2e
Admin handbook: The command lists peer keys only and takes no peer argument. [defects, defects #131832]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-f4dd4244f3
Database handbook: The command prints peer public keys only. [defects, defects #131833]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-6336c0aa37
Database handbook: latest-handshakes is not traffic statistics. [defects, defects #131834]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-c7457214ee
Database handbook: A failing health check never stops the container. [defects, defects #131835]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-190cd62794
API guide: The interval is 10 s, not 30 s. [defects, defects #131836]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-78e69897f7
API guide: The route is needed for every live-added peer, and Endpoint belongs to the side that dials out, so the condition is wrong. [defects, defects #131837]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-8bb1719acc
API guide: Contradicts itself and the guide's Endpoint description (Endpoint is needed only on the dialing side). [defects, defects #131838]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-17dc614321
API guide: Arguments are not processed. [defects, defects #131839]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-826bf8e58a
API guide: Self-contradicting sentence. [defects, defects #131840]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-f115000e3e
API guide: Exit status is 143, not 0. [defects, defects #131841]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-8ed27728e7
Database handbook: Omits that live changes are not persistent (the API guide says so). [defects, defects #131842]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-4b840f477e
Admin handbook: Address is not required by the entrypoint. [defects, defects #131843]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-3838c8b15c
API guide: 51820 is only the value written on first start, not a default for hand-written files. [defects, defects #131844]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-41b6bbb45a
API guide: The example presents an in-container route through wg0 as the way to let a peer reach a host network. [defects, defects #132586]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-af0e9a4c7c
Admin handbook: A restarted container keeps its /config (the file lives in the container's writable layer), so 'even if you restart the old one' is false, and the sentence contradicts itself (every start vs new… [defects, defects #132587]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-549e7ea1e1
Admin handbook: 'Every start' is false for docker restart/start of an existing container; it holds only for a new container. [defects, defects #132588]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-745b8b9dea
Admin handbook: 'Every start' is false for docker restart/start of an existing container; it holds only for a new container. [defects, defects #132589]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-daaac3ee32
Database handbook: 'Every start' is false for docker restart/start of an existing container; it holds only for a new container. [defects, defects #132590]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-6b988536f8
API guide: 'Every start' is false for docker restart/start of an existing container; it holds only for a new container. [defects, defects #132591]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-1ff3e3f649
Admin handbook: Endpoint on the server's [Peer] entry is used when the server initiates; a client that dials the server does not need it. [defects, defects #132592]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-db5bb6dcd8
Admin handbook: Reversed condition; contradicts ADMIN_HANDBOOK line 807 and API guide line 671. [defects, defects #132593]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-185f450d0a
Admin handbook: Reversed condition; contradicts ADMIN_HANDBOOK lines 738 and 807. [defects, defects #132594]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-086124f9f6
Database handbook: Address is not required by the entrypoint; contradicts ADMIN_HANDBOOK line 795. [defects, defects #132595]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-fb915bc103
Admin handbook: 51820 is only the value the entrypoint writes on first start, not a default for hand-written files (round-1 finding, persisted in these lines). [defects, defects #132596]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-679cefe868
Database handbook: 51820 is only the value the entrypoint writes on first start, not a default for hand-written files (round-1 finding, persisted in these lines). [defects, defects #132597]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-5c3a761a21
API guide: 51820 is only the value the entrypoint writes on first start, not a default for hand-written files (round-1 finding, persisted in these lines). [defects, defects #132598]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-e028fdd49f
API guide: Self-contradiction within the section (accepts vs ignores). [defects, defects #132599]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-f6e71a1f0c
API guide: wg reports byte counts, not packet counts. [defects, defects #132600]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-cc68a50a51
Admin handbook: The first step of the example fails for an ordinary user. [defects, defects #132601]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-c1a23d83cd
Admin handbook: Live peer addition is shown in the Quick Start, Network Configuration, Data Storage, Peer Management and Troubleshooting sections without saying the peer is gone after a restart (round-1 finding,… [defects, defects #132602]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-3e384ed77c
Database handbook: Omits that the live change is not persistent and that a changed port is no longer reached through the existing -p mapping. [defects, defects #132603]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-d76e4a0e09
Admin handbook: The documented option name does not exist; the command fails. [defects, defects #133893]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-1ee30930eb
Admin handbook: The documented command fails with 'Invalid argument: persistent-keepalive-interval'. [defects, defects #133894]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-0f32fc0bdd
Database handbook: Wrong direction: static routes on the host that forward the host's networks 'through the WireGuard interface' send traffic for those networks into the tunnel; they do not let peers reach them. [defects, defects #133895]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-e48188ea74
API guide: Wrong direction. For a peer in 10.0.50.0/24 to reach hosts in 192.168.50.0/24 the return path to 10.0.50.0/24 must lead to the container; a host route to 192.168.50.0/24 via the container would send… [defects, defects #133896]		highfixed-before-releaseheld review (review model)—
RSD-wireguard-21562dbf60
API guide: Masquerading is applied to traffic leaving toward the target network, not 'to the container'; as written the instruction cannot be followed. [defects, defects #133897]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-45634102f5
Admin handbook: `docker exec wireguard wg pubkey` without -i has no stdin; the listed command fails. [defects, defects #133898]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-199b7adf7a
API guide: Listed as an available command, but without -i and a piped key it fails. [defects, defects #133899]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-b596d09f78
Admin handbook: Routes are created only by the entrypoint at start; a peer added live gets none (the same section later tells the customer to add the route by hand). [defects, defects #133900]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-e71642811b
API guide: Routes are made only at start from the file; live additions get none (contradicts API line 719). [defects, defects #133901]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-5d75db29a8
Database handbook: /dev/net/tun is a device, not a capability; the process holds exactly one capability (contradicts DB lines 124 and 339). [defects, defects #133902]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-be754179bc
API guide: The container listens on 51820/udp inside its namespace regardless of -p; an unmapped port is unreachable from outside, not 'not listening'. [defects, defects #133903]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-0ae5040ef1
Admin handbook: AllowedIPs is not required by the entrypoint or wg: a [Peer] with only PublicKey starts normally. [defects, defects #133904]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-d87f72d488
Admin handbook: Same: a peer without AllowedIPs starts and the container stays healthy. [defects, defects #133905]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-492e5cbbe2
Database handbook: A peer without AllowedIPs is accepted. [defects, defects #133906]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-1e9b784b5c
API guide: A peer without AllowedIPs is accepted. [defects, defects #133907]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-61c0e6fb30
Admin handbook: The sentence offers live peer addition without saying the change is not persistent; a customer who follows it loses the peer at the next restart (carry-over of the round-1/round-2 finding; the… [defects, defects #133908]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-2244b1c00d
Admin handbook: The sentence offers live peer addition without saying the change is not persistent; a customer who follows it loses the peer at the next restart (carry-over of the round-1/round-2 finding; the… [defects, defects #133909]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-9d5f36fc9c
Admin handbook: The sentence offers live peer addition without saying the change is not persistent; a customer who follows it loses the peer at the next restart (carry-over of the round-1/round-2 finding; the… [defects, defects #133910]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-20ebdc1381
Admin handbook: The sentence offers live peer addition without saying the change is not persistent; a customer who follows it loses the peer at the next restart (carry-over of the round-1/round-2 finding; the… [defects, defects #133911]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-2688927104
Admin handbook: The sentence offers live peer addition without saying the change is not persistent; a customer who follows it loses the peer at the next restart (carry-over of the round-1/round-2 finding; the… [defects, defects #133912]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-937954f1a9
Database handbook: The sentence offers live peer addition without saying the change is not persistent; a customer who follows it loses the peer at the next restart (carry-over of the round-1/round-2 finding; the… [defects, defects #133913]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-7a2f6f9ded
Database handbook: The sentence offers live peer addition without saying the change is not persistent; a customer who follows it loses the peer at the next restart (carry-over of the round-1/round-2 finding; the… [defects, defects #133914]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-d785a2652d
Database handbook: The sentence offers live peer addition without saying the change is not persistent; a customer who follows it loses the peer at the next restart (carry-over of the round-1/round-2 finding; the… [defects, defects #133915]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-1151b94eb6
API guide: The sentence offers live peer addition without saying the change is not persistent; a customer who follows it loses the peer at the next restart (carry-over of the round-1/round-2 finding; the… [defects, defects #133916]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-ca785698ff
API guide: The sentence offers live peer addition without saying the change is not persistent; a customer who follows it loses the peer at the next restart (carry-over of the round-1/round-2 finding; the… [defects, defects #133917]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-dcd8bab587
API guide: The sentence offers live peer addition without saying the change is not persistent; a customer who follows it loses the peer at the next restart (carry-over of the round-1/round-2 finding; the… [defects, defects #133918]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-ebfc1830c4
API guide: The sentence offers live peer addition without saying the change is not persistent; a customer who follows it loses the peer at the next restart (carry-over of the round-1/round-2 finding; the… [defects, defects #133919]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-fcd3a28eb5
API guide: The scenario described (AllowedIPs already include the network) is exactly the one in which the following `ip route add` fails: the entrypoint already created the route at start. [defects, defects #136281]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-eba56c4388
API guide: The sentence offers live peer addition without saying the change is not persistent (carry-over of the round-1..3 finding; the caveat exists only in some sections); a customer who follows it loses… [defects, defects #136282]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-b0e8e7907c
API guide: The sentence offers live peer addition without saying the change is not persistent (carry-over of the round-1..3 finding; the caveat exists only in some sections); a customer who follows it loses… [defects, defects #136283]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-b32d5da04f
API guide: The sentence offers live peer addition without saying the change is not persistent (carry-over of the round-1..3 finding; the caveat exists only in some sections); a customer who follows it loses… [defects, defects #136284]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-bdc9a6355e
API guide: The sentence offers live peer addition without saying the change is not persistent (carry-over of the round-1..3 finding; the caveat exists only in some sections); a customer who follows it loses… [defects, defects #136285]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-9d6588e656
Admin handbook: The sentence offers live peer addition without saying the change is not persistent (carry-over of the round-1..3 finding; the caveat exists only in some sections); a customer who follows it loses… [defects, defects #136286]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-9c3bc05f86
Admin handbook: The sentence offers live peer addition without saying the change is not persistent (carry-over of the round-1..3 finding; the caveat exists only in some sections); a customer who follows it loses… [defects, defects #136287]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-42c35166a8
Database handbook: The sentence offers live peer addition without saying the change is not persistent (carry-over of the round-1..3 finding; the caveat exists only in some sections); a customer who follows it loses… [defects, defects #136288]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-d0b5bb9b4f
Database handbook: The sentence offers live peer addition without saying the change is not persistent (carry-over of the round-1..3 finding; the caveat exists only in some sections); a customer who follows it loses… [defects, defects #136289]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-f64687749d
Database handbook: The sentence offers live peer addition without saying the change is not persistent (carry-over of the round-1..3 finding; the caveat exists only in some sections); a customer who follows it loses… [defects, defects #136290]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-5082923561
Database handbook: The sentence offers live peer addition without saying the change is not persistent (carry-over of the round-1..3 finding; the caveat exists only in some sections); a customer who follows it loses… [defects, defects #136291]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-e2b5ce68d2
API guide: AllowedIPs is not required by the entrypoint or wg: a [Peer] with only PublicKey starts normally and the container stays healthy (carry-over of the round-3 finding; other sections say 'without it no… [defects, defects #136292]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-2fb69b9c82
Database handbook: AllowedIPs is not required by the entrypoint or wg: a [Peer] with only PublicKey starts normally and the container stays healthy (carry-over of the round-3 finding; other sections say 'without it no… [defects, defects #136293]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-4f4b98f28a
Database handbook: AllowedIPs is not required by the entrypoint or wg: a [Peer] with only PublicKey starts normally and the container stays healthy (carry-over of the round-3 finding; other sections say 'without it no… [defects, defects #136294]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-7f7e6dd02f
API guide: /dev/net/tun is a device, not a capability; the process holds exactly one capability (same class as the round-3 finding, contradicts DB lines 124 and 339). [defects, defects #136295]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-b34b6e4ae9
Admin handbook: /dev/net/tun is a device, not a capability; the process holds exactly one capability (same class as the round-3 finding, contradicts DB lines 124 and 339). [defects, defects #136296]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-5a90be315f
Database handbook: /dev/net/tun is a device, not a capability; the process holds exactly one capability (same class as the round-3 finding, contradicts DB lines 124 and 339). [defects, defects #136297]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-530f0cebf0
Admin handbook: The sentence says routing between peers happens on the Docker host, not inside the container; measured, the container forwards peer-to-peer traffic itself (DB line 775 says the container forwards). [defects, defects #136298]		lowfixed-before-releaseheld review (review model)—
RSD-wireguard-e897c6fefe
API guide: The container does not generate a key when the file exists but lacks PrivateKey; it starts with no private key. [defects, defects #136299]		lowfixed-before-releaseheld review (review model)—

Verification

2 items not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:9a7cde50fe6f16cea9aeff4714ccb5a115d3b12b37c8df39bd11035fd2afdda9 · published digest sha256:9a7cde50fe6f16cea9aeff4714ccb5a115d3b12b37c8df39bd11035fd2afdda9 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 47) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 767 package_archive gate_result.g8.result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-29T18:29:02Z · failing Docker Scout counts 91 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • First own scan of the releaseA (at 2026-10-29T18:36:14Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-29T06:23:34Z) [image_scans, image_scans #1558]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-29T18:28:50Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3632558449 · transparency-log entry · integrated 2026-11-01T14:29:21Z) [ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:fad6612d902004cca17b69de4d9fbcb2438d288ecbcd188a8d12612963e2ffaa · state attached · log index 3573659709 · transparency-log entry
    • kind sbom · digest sha256:fad6612d902004cca17b69de4d9fbcb2438d288ecbcd188a8d12612963e2ffaa · state attached · log index 3573661268 · transparency-log entry
    • kind vsa · digest sha256:fad6612d902004cca17b69de4d9fbcb2438d288ecbcd188a8d12612963e2ffaa · state attached · log index 3573662968 · transparency-log entry
    • kind provenance · digest sha256:9a7cde50fe6f16cea9aeff4714ccb5a115d3b12b37c8df39bd11035fd2afdda9 · state attached · log index 3573665246 · transparency-log entry
    • kind sbom · digest sha256:9a7cde50fe6f16cea9aeff4714ccb5a115d3b12b37c8df39bd11035fd2afdda9 · state attached · log index 3573667616 · transparency-log entry
    • kind vsa · digest sha256:9a7cde50fe6f16cea9aeff4714ccb5a115d3b12b37c8df39bd11035fd2afdda9 · state attached · log index 3573669236 · transparency-log entry
    (at 2026-10-29T18:33:53Z) [attestations.json, results]

Offline clean-room rebuilds

  • 2026-10-28T10:46:57Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:9a7cde50fe6f16cea9aeff4714ccb5a115d3b12b37c8df39bd11035fd2afdda9 [clean-room rebuild ledger, runs[519]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
  • Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

Fully recorded
  • Image pushed (internal tag), publish_image passed2026-10-28T10:28:45Z [stage_runs, stage_runs chain 767 stage publish_image]
  • Release tag promoted2026-10-29T18:35:28Z (method imagetools_create_retag_by_digest_no_rebuild · digest sha256:fad6612d902004cca17b69de4d9fbcb2438d288ecbcd188a8d12612963e2ffaa · tag readystack/wireguard:0.0.20250522-CE-ubuntu24.04-r1) [deliverables/provenance/PROMOTION_RECORD.json, promoted_at]
  • Archive manifests written2026-10-29T18:31:46Z [PUBLISH_MANIFEST.json, published_at]
  • Archive cut over on prodasset, package_archive passed2026-10-29T18:36:03Z [stage_runs, stage_runs chain 767 stage package_archive]
  • Cut-over markerpresent (chain 767) [.cutover.json]
  • Release checklist and site event2026-10-29T18:36:01Z (status complete · site event 282 · steps grade a verified done · release tag promoted done · cosign signed done · release evidence recorded done · contract gate passed done · archive published done · hub readme live done · reproducibility recorded done · defects ledger published done · catalog available done · build request fulfilled done · seo regenerated skipped · site catalogue refreshed done · site grade recorded done · site queue synced done · customer requests charged done · owners notified done) [deliverables/provenance/RELEASE_CHECKLIST.json, run_at]

Packages and CPU level

Fully recorded
  • Packages in the image108 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 752 · probed 2026-11-02T17:13:37Z · source backfill) [release_images, isa_level_hard]

History

1 event
  • 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records

Records

26 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.tar.gz)—
.cutover.jsonbeside the archive (prodasset /data/production/wireguard/0.0.20250522-CE-ubuntu24.04-r1/)—
MANIFEST.jsonbeside the archive (prodasset /data/production/wireguard/0.0.20250522-CE-ubuntu24.04-r1/)—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/wireguard/0.0.20250522-CE-ubuntu24.04-r1/)—
ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/wireguard/0.0.20250522-CE-ubuntu24.04-r1/)—
ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/wireguard/0.0.20250522-CE-ubuntu24.04-r1/)—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/wireguard/0.0.20250522-CE-ubuntu24.04-r1/)—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)445
chainssadb, ReadyStack's engine database (not published)767
defectssadb, ReadyStack's engine database (not published)wireguard 0.0.20250522-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 767
held_roundssadb, ReadyStack's engine database (not published)chain 767
image_scanssadb, ReadyStack's engine database (not published)1558
micro_step_runssadb, ReadyStack's engine database (not published)chain 767
release_imagessadb, ReadyStack's engine database (not published)wireguard 0.0.20250522-CE-ubuntu24.04-r1
review_overridessadb, ReadyStack's engine database (not published)28
stage_eventssadb, ReadyStack's engine database (not published)chain 767
stage_runssadb, ReadyStack's engine database (not published)chain 767
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/RELEASE_CHECKLIST.jsonthe chain's workspace on the controller (not published)—