# network: GET {{asset}} requested #× on a, #× on b: covers its 2 differences. Name the Rule that intends it, or fix it.
  - artefact: "network"
    scope: "GET /_app/immutable/chunks/\\{\\{hash\\}\\}.js"
    rule: "????"
    reason: "GET {{asset}} requested #× on a, #× on b: 2 differences (reader; 2 pages; 1 name); likely #478, #481, #476"
  # network: new request on b: POST /api/live/activity: covers its 2 differences. Name the Rule that intends it, or fix it.
  - artefact: "network"
    scope: "POST /api/live/activity"
    rule: "????"
    reason: "new request on b: POST /api/live/activity: 2 differences (reader; 2 pages); likely #478, #481, #476"
  # persistence: RPC realtime_claim_live_publish — # row(s) on a, # on b: covers its 1 difference. Name the Rule that intends it, or fix it.
  - artefact: "persistence"
    scope: "student-signs-in/realtime_claim_live_publish"
    rule: "????"
    reason: "RPC realtime_claim_live_publish — # row(s) on a, # on b: 1 difference; likely #478, #481, #476"
  # timing: journey student-signs-in slower on b: covers its 1 difference. Name the Rule that intends it, or fix it.
  - artefact: "timing"
    scope: "student-signs-in"
    rule: "????"
    reason: "journey student-signs-in slower on b: 1 difference (1 name); likely #483, #478, #481"

Tutors release harness — release fail

2026-10-15T18:04:41.578Z · clock 2026-09-16T09:05:00.000Z · 5 run(s) per side · harness 1.37.3

• 6 unclaimed diff(s)
• 43 claim(s) matched nothing and should be removed from the changelog
• A/A consulted: clean at 2026-10-15T17:50:33.391Z
• In-run A/A (a to a2, 1 run, dom, network, console, headers, axe, focus; 6 journey(s)): clean. Reported, never gates.
• 24 of 24 claim(s) with a lifetime have expired; they still cover 0 failing difference(s), which would be unclaimed once claim lifetimes block (2.0). Informing: the verdict is unchanged.
  • dom reader:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • screenshot reader:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • axe reader:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • dom live:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • screenshot live:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • axe live:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • dom catalogue:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • screenshot catalogue:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • axe catalogue:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • dom time:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • screenshot time:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • axe time:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • logs reader:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • logs live:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • logs catalogue:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • logs time:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • metrics reader:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • metrics live:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • metrics catalogue:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • metrics time:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • asset-graph reader:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • asset-graph live:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • asset-graph catalogue:*: until 17.0.0, and production is already 17.0.0 (covers 0)
  • asset-graph time:*: until 17.0.0, and production is already 17.0.0 (covers 0)

Image artefacts

Collected from the images, not the running apps. A cell that says NOT COLLECTED was not compared.

Load (k6, 20 req/s for 30s)

Differences (42; 6 unclaimed)

locator.waitFor: Timeout 15000ms exceeded.

error: {"app":"tutors-catalogue","environment":"production","error":"Cannot read properties of undefined (reading 'from')","stack":"TypeError: Cannot read properties of undefined (reading 'from')\n    at Object.getCatalogue ({{origin}}/_app/immutable/chunks/2lYorbfj.js:69:102918)\n    at V ({{origin}}/_app/immutable/nodes/2.NAkx_ofm.js:1:484)\n    at Wn ({{origin}}/_app/immutable/chunks/XgCIYxIE.js:2:24206)","timestamp":"2026-09-16T09:05:00.000Z","level":"error","message":"Error fetching courses:"}

error: {"app":"tutors-catalogue","environment":"production","error":"Cannot read properties of undefined (reading 'from')","stack":"TypeError: Cannot read properties of undefined (reading 'from')\n    at Object.getStudentCount ({{origin}}/_app/immutable/chunks/2lYorbfj.js:69:103346)\n    at {{origin}}/_app/immutable/nodes/2.NAkx_ofm.js:1:5193\n    at Cr ({{origin}}/_app/immutable/chunks/Cv2zGAZD.js:1:23871)\n    at {{origin}}/_app/immutable/chunks/Cv2zGAZD.js:2:2704\n    at mr ({{origin}}/_app/immutable/chunks/Cv2zGAZD.js:1:21611)\n    at vr ({{origin}}/_app/immutable/chunks/Cv2zGAZD.js:1:22749)\n    at Xt ({{origin}}/_app/immutable/chunks/Cv2zGAZD.js:1:12091)\n    at #_ ({{origin}}/_app/immutable/chunks/Cv2zGAZD.js:1:9277)\n    at e.flush ({{origin}}/_app/immutable/chunks/Cv2zGAZD.js:1:10794)\n    at Array.<anonymous> ({{origin}}/_app/immutable/chunks/Cv2zGAZD.js:1:11554)","timestamp":"2026-09-16T09:05:00.000Z","level":"error","message":"Error fetching course count:"}

catalogue: a — uid 1001:0, caps none, root fs ro, /tmp rw, no-new-privileges, seccomp filter
           b — uid 1001:0, caps none, root fs ro, /tmp rw, no-new-privileges, seccomp filter
live: a — uid 1001:0, caps none, root fs ro, /tmp rw, no-new-privileges, seccomp filter
      b — uid 1001:0, caps none, root fs ro, /tmp rw, no-new-privileges, seccomp filter
reader: a — uid 1001:0, caps none, root fs ro, /tmp rw, no-new-privileges, seccomp filter
        b — uid 1001:0, caps none, root fs ro, /tmp rw, no-new-privileges, seccomp filter
reader-auth: a — uid 1001:0, caps none, root fs ro, /tmp rw, no-new-privileges, seccomp filter
             b — uid 1001:0, caps none, root fs ro, /tmp rw, no-new-privileges, seccomp filter
time: a — uid 1001:0, caps none, root fs ro, /tmp rw, no-new-privileges, seccomp filter
      b — uid 1001:0, caps none, root fs ro, /tmp rw, no-new-privileges, seccomp filter

catalogue: first healthy / 396 → 390 ms, ready 2286 → 2284 ms (median, a → b, n=5/5)
live: first healthy / 394 → 400 ms, ready 2295 → 2336 ms (median, a → b, n=5/5)
reader: first healthy / 447 → 417 ms, ready 2315 → 2299 ms (median, a → b, n=5/5)
time: first healthy / 450 → 395 ms, ready 2366 → 2277 ms (median, a → b, n=5/5)

Policy: what b must be informing

Checks on the candidate alone, whatever production is: image hardening (root user, no healthcheck, a secret in the environment or the layer history), build provenance (SLSA provenance from image-build.yml) and the vulnerability ceiling (a critical or high advisory with a fix available). Informing: reported, never gates; a claim can still cover a finding. Hover a cell for what was checked.

Informing (14; 14 unclaimed) reported, never gates

19 of 27 engines are blocking; informing (reported, never gates): image-hardening (no date set to block), build-provenance (no date set to block), vuln-ceiling (no date set to block), timing-tolerance (no date set to block), asset-graph (no date set to block), replay (no date set to block), slo (no date set to block), realtime (no date set to block). An informing engine's findings are listed here and never change the verdict, the Gate or the exit code; a claim can still cover one.

Stale claims (43)

• axe reader-auth:sign-in — Rule 0216: The reader shall show the sign-in page with no critical or serious WCAG 2.1 AA violations. — sign-in button text contrast (color-contrast, serious) fixed by #313; page title added (document-title, serious)
• axe reference:course — Rule 0051: The reader shall show course pages with no critical or serious WCAG 2.1 AA violations in either appearance. — navigation dialog trigger no longer wraps a control (nested-interactive, serious) fixed by #313
• axe reference:topic — Rule 0051: The reader shall show course pages with no critical or serious WCAG 2.1 AA violations in either appearance. — navigation dialog trigger no longer wraps a control (nested-interactive, serious) fixed by #313
• axe reference:note — Rule 0036: The reader shall show a note's table of contents collapsed under "On this page" and give each code block a "Copy code" button. — code block copy buttons are named "Copy code" (button-name, critical) fixed by #313
• sbom */{@isaacs/cliui,@isaacs/fs-minipass,@isaacs/string-locale-compare,@npmcli/agent,@npmcli/arborist,@npmcli/config,@npmcli/fs,@npmcli/git,@npmcli/installed-package-contents,@npmcli/map-workspaces,@npmcli/metavuln-calculator,@npmcli/name-from-folder,@npmcli/node-gyp,@npmcli/package-json,@npmcli/promise-spawn,@npmcli/query,@npmcli/redact,@npmcli/run-script,@pkgjs/parseargs,@sigstore/bundle,@sigstore/core,@sigstore/protobuf-specs,@sigstore/sign,@sigstore/tuf,@sigstore/verify,@tufjs/canonical-json,@tufjs/models,abbrev,agent-base,ansi-regex,ansi-styles,aproba,archy,balanced-match,bin-links,binary-extensions,brace-expansion,cacache,chalk,chownr,ci-info,cidr-regex,cli-columns,cmd-shim,color-convert,color-name,common-ancestor-path,corepack,cross-spawn,cssesc,debug,diff,eastasianwidth,emoji-regex,encoding,env-paths,err-code,exponential-backoff,fastest-levenshtein,fdir,foreground-child,fs-minipass,glob,graceful-fs,hosted-git-info,http-cache-semantics,http-proxy-agent,https-proxy-agent,iconv-lite,ignore-walk,imurmurhash,ini,init-package-json,ip-address,ip-regex,is-cidr,is-fullwidth-code-point,isexe,jackspeak,json-parse-even-better-errors,json-stringify-nice,jsonparse,just-diff,just-diff-apply,libnpmaccess,libnpmdiff,libnpmexec,libnpmfund,libnpmhook,libnpmorg,libnpmpack,libnpmpublish,libnpmsearch,libnpmteam,libnpmversion,lru-cache,make-fetch-happen,minimatch,minipass,minipass-collect,minipass-fetch,minipass-flush,minipass-pipeline,minipass-sized,minizlib,ms,mute-stream,negotiator,node-gyp,nopt,normalize-package-data,npm,npm-audit-report,npm-bundled,npm-install-checks,npm-normalize-package-bin,npm-package-arg,npm-packlist,npm-pick-manifest,npm-profile,npm-registry-fetch,npm-user-validate,p-map,package-json-from-dist,pacote,parse-conflict-json,path-key,path-scurry,picomatch,postcss-selector-parser,proc-log,proggy,promise-all-reject-late,promise-call-limit,promise-retry,promzard,qrcode-terminal,read,read-cmd-shim,read-package-json-fast,retry,safer-buffer,semver,shebang-command,shebang-regex,signal-exit,sigstore,smart-buffer,socks,socks-proxy-agent,spdx-correct,spdx-exceptions,spdx-expression-parse,spdx-license-ids,ssri,string-width,strip-ansi,supports-color,text-table,tiny-relative-date,tinyglobby,treeverse,tuf-js,unique-filename,unique-slug,util-deprecate,validate-npm-package-license,validate-npm-package-name,walk-up-path,which,wrap-ansi,write-file-atomic,yallist,yarn} — Rule 0220: Tutors shall ship its runtime images with no package manager, removing npm, npx, corepack and yarn in the runtime stage. — runtime image ships no package manager: npm, npx, corepack and yarn removed by #143 (4070315), rationale in tests/bdd/features/developer/runtime-image.feature
• persistence */record_page_view — Rule 0303: When a student opens a learning object, the reader shall record the page view against the learning object and the day's calendar in one database request. — a page view is recorded against the learning object and the day's calendar in one request (#475)
• persistence */{learning_records,calendar,get_count_learning_records} — Rule 0303: When a student opens a learning object, the reader shall record the page view against the learning object and the day's calendar in one database request. — the per-table page-view requests are replaced by record_page_view (#475)
• persistence */record_heartbeat — Rule 0304: While a course page is visible, the reader shall record each 30 seconds of activity in one database request. — each 30 seconds of activity on a visible course page is one request (#475)
• persistence */increment_calendar — Rule 0304: While a course page is visible, the reader shall record each 30 seconds of activity in one database request. — the calendar's time-active increment is replaced by record_heartbeat (#475)
• dom reader:* — Rule 0019: The reader shall lay out every page without horizontal scrolling at viewport widths from 320 to 1440 pixels. — CHANGELOG 17.0.0 Reader: Tutors is rebuilt on the Paper design system (Rules 0019-0058, #313)
• screenshot reader:* — Rule 0019: The reader shall lay out every page without horizontal scrolling at viewport widths from 320 to 1440 pixels. — CHANGELOG 17.0.0 Reader: Tutors is rebuilt on the Paper design system (Rules 0019-0058, #313)
• axe reader:* — Rule 0051: The reader shall show course pages with no critical or serious WCAG 2.1 AA violations in either appearance. — CHANGELOG 17.0.0 Reader: course pages carry no critical or serious WCAG 2.1 AA violations after the Paper rebuild (#313, #338, #364, #420)
• dom live:* — Rule 0019: The reader shall lay out every page without horizontal scrolling at viewport widths from 320 to 1440 pixels. — CHANGELOG 17.0.0 Live: Live is brought onto the Paper design system and the reader's UX patterns (#313, #331)
• screenshot live:* — Rule 0019: The reader shall lay out every page without horizontal scrolling at viewport widths from 320 to 1440 pixels. — CHANGELOG 17.0.0 Live: Live is brought onto the Paper design system and the reader's UX patterns (#313, #331)
• axe live:* — Rule 0051: The reader shall show course pages with no critical or serious WCAG 2.1 AA violations in either appearance. — CHANGELOG 17.0.0 Live: Live is brought onto the Paper design system and the reader's UX patterns (#313, #331)
• dom catalogue:* — Rule 0019: The reader shall lay out every page without horizontal scrolling at viewport widths from 320 to 1440 pixels. — CHANGELOG 17.0.0 Catalogue: the catalogue is brought onto the Paper design system (#313, #331)
• screenshot catalogue:* — Rule 0019: The reader shall lay out every page without horizontal scrolling at viewport widths from 320 to 1440 pixels. — CHANGELOG 17.0.0 Catalogue: the catalogue is brought onto the Paper design system (#313, #331)
• axe catalogue:* — Rule 0173: The catalogue shall give each link in its header an accessible name that no other link in the header has. — CHANGELOG 17.0.0 Catalogue: every link in the catalogue header has an accessible name no other header link shares (#338)
• dom time:* — Rule 0019: The reader shall lay out every page without horizontal scrolling at viewport widths from 320 to 1440 pixels. — CHANGELOG 17.0.0 Time: Time is brought onto the Paper design system (#313, #331)
• screenshot time:* — Rule 0019: The reader shall lay out every page without horizontal scrolling at viewport widths from 320 to 1440 pixels. — CHANGELOG 17.0.0 Time: Time is brought onto the Paper design system (#313, #331)
• axe time:* — Rule 0019: The reader shall lay out every page without horizontal scrolling at viewport widths from 320 to 1440 pixels. — CHANGELOG 17.0.0 Time: Time is brought onto the Paper design system (#313, #331)
• network */api/auth/* — Rule 0250: When a visitor starts GitHub sign-in, the reader shall send the visitor to GitHub's authorization page for the reader's OAuth app with the scopes "read:user" and "user:email". — CHANGELOG 17.0.0 Reader: the GitHub OAuth callback URL has moved to /api/auth/callback/github (#417, #461, #463)
• network */auth/* — Rule 0250: When a visitor starts GitHub sign-in, the reader shall send the visitor to GitHub's authorization page for the reader's OAuth app with the scopes "read:user" and "user:email". — CHANGELOG 17.0.0 Reader: the Auth.js routes under /auth are gone with the move to Better Auth (#463)
• headers reader:* — Rule 0259: When the reader starts a session, the reader shall set the session cookie as HttpOnly, Secure and SameSite=Lax. — CHANGELOG 17.0.0 Reader: the session cookie is Better Auth's, set HttpOnly, Secure and SameSite=Lax (#417, #461)
• dom reader-auth:sign-in — Rule 0250: When a visitor starts GitHub sign-in, the reader shall send the visitor to GitHub's authorization page for the reader's OAuth app with the scopes "read:user" and "user:email". — CHANGELOG 17.0.0 Reader: sign-in runs on Better Auth (#417, #461, #463)
• network reader:* — Rule 0317: When a sharing student enters a course, the reader shall load the course online list from stored activity without joining a course Realtime channel. — CHANGELOG 17.0.0 Reader: readers no longer join a course Realtime channel; the online list is read from stored activity (#414, #429, #474)
• bus reader:* — Rule 0271: If a learning event is published for a course the student is not reading, then the reader shall not receive it. — CHANGELOG 17.0.0 Reader: the reader no longer subscribes to tutors-all-course-access and course activity channels (#414, #429, #474)
• bus live:* — Rule 0272: When a student opens a learning object, the reader shall report one learning event for it. — CHANGELOG 17.0.0 Live: Live's landing page is the only subscriber to tutors-all-course-access (#414, #429, #474)
• migration */idx_tutors_connect_latest_course_recent — Rule 0317: When a sharing student enters a course, the reader shall load the course online list from stored activity without joining a course Realtime channel. — CHANGELOG 17.0.0 Infrastructure: 20261013_tutors_connect_latest_recent_index.sql indexes (course_id, received_at DESC) for the online list (#474)
• migration */record_page_view — Rule 0303: When a student opens a learning object, the reader shall record the page view against the learning object and the day's calendar in one database request. — CHANGELOG 17.0.0 Infrastructure: 20261014_record_page_view_and_heartbeat.sql adds record_page_view (#475)
• migration */record_heartbeat — Rule 0304: While a course page is visible, the reader shall record each 30 seconds of activity in one database request. — CHANGELOG 17.0.0 Infrastructure: 20261014_record_page_view_and_heartbeat.sql adds record_heartbeat (#475)
• logs reader:* — CHANGELOG 17.0.0 Infrastructure: stable log and metrics shape, and variable data kept out of log messages (#283, #297)
• logs live:* — CHANGELOG 17.0.0 Infrastructure: stable log and metrics shape (#283)
• logs catalogue:* — CHANGELOG 17.0.0 Infrastructure: stable log and metrics shape (#283)
• logs time:* — CHANGELOG 17.0.0 Infrastructure: stable log and metrics shape (#283)
• metrics reader:* — CHANGELOG 17.0.0 Infrastructure: stable metrics shape for release-harness A/A runs (#283)
• metrics live:* — CHANGELOG 17.0.0 Infrastructure: stable metrics shape for release-harness A/A runs (#283)
• metrics catalogue:* — CHANGELOG 17.0.0 Infrastructure: stable metrics shape for release-harness A/A runs (#283)
• metrics time:* — CHANGELOG 17.0.0 Infrastructure: stable metrics shape for release-harness A/A runs (#283)
• asset-graph reader:* — CHANGELOG 17.0.0 Reader: the reader runs on SvelteKit 3 (#466)
• asset-graph live:* — CHANGELOG 17.0.0 Live: Live runs on SvelteKit 3 (#466)
• asset-graph catalogue:* — CHANGELOG 17.0.0 Catalogue: the catalogue runs on SvelteKit 3 (#466)
• asset-graph time:* — CHANGELOG 17.0.0 Time: Time runs on SvelteKit 3 (#466)

Claim hygiene

43 claim(s) cover 0 failing hunk(s): 0 per claim, at most 0 under one (flagged above 10).

Masks

Fired: response-date×90, request-id×90, etag×90, metrics-process×599, metrics-timing-histograms×12, third-party-requests×1509, persistence-stub-requests×140, oauth-callback-state×10, media-range-status×45, chromium-compute-pressure-policy×1, hashed-assets×4903, footer-tutors-version×330, transport-length×90, transport-connection×90, transport-keepalive×90.
Silent this run: realtime-rest-fallback-warning, transport-encoding, transport-transfer — a mask that never fires is a mask to delete.