Apache Airflow 3.4.0-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/airflow:3.4.0-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/airflow:3.4.0-CE-ubuntu24.04-r1
  • Index digestsha256:102bead671874c556bc7b9d47888083780c723b5c5c1d6470e68c0367e898261
  • linux/amd64 digestsha256:ec7c766e35be352fb8f5bc318ee215eb3dba05566c2b2d28b06fa4fe3574cd4f
  • ArchiveReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 nowb878e7cf1ebc1e4d2fcde88389f2be169a8f495e4517e0f14ca21c294ae59836
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T04:27:35Z by KitForge release/build_trail.py
  • Sections9 sections, 7 fully recorded; 2 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.trail.json
ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.trail.jsonReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.trail.mdApache Airflow product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductApache Airflow (airflow) [MANIFEST.json]
  • Release tag3.4.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/airflow:3.4.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:102bead671874c556bc7b9d47888083780c723b5c5c1d6470e68c0367e898261 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:ec7c766e35be352fb8f5bc318ee215eb3dba05566c2b2d28b06fa4fe3574cd4f [ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.tar.gz (bytes 838253801) [MANIFEST.json]
  • Archive sha256 at publishb878e7cf1ebc1e4d2fcde88389f2be169a8f495e4517e0f14ca21c294ae59836 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/apache/airflow [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref3.4.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit619a787ac81e8b7c8a9102fc78e3f0b00625d04e [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashaf6efccef2378cd88978f5570674d7358af2b92421fea4d9ee348e1658d128a2 (files 14958) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:9bf838a6cf2fb7c5604c64b9f6d0d548c3d51edfe14c35917bf1257a80dceb7d [ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793861007 (utc 2026-11-05T06:43:27Z) [ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit 2d74add6086c4e9520480af5e066eed64cf6eacd · dirty yes · first drive 3717
    • commit 80f38df958422550987d342edfe69f26108fb99e · dirty yes · first drive 3798
    • commit ac8f0da7d42611ec5a3743c308666b50c690fb17 · dirty yes · first drive 3808
    • commit 21e2c6702a4d838f43dd7fa67a5efb86680ec1df · dirty yes · first drive 3818
    • commit fb3d89dbdf1a4d4d5e6b01f0cfad0b5ef4a697f2 · dirty yes · first drive 3825
    • commit 70e6bdff7c0e7d3ec863993e8fb01b616e6715cb · dirty yes · first drive 3831
    • commit 7c6b61ce76feba4df822395cea465de0973154b4 · dirty yes · first drive 3853
    • commit f3794625f7ed05ee0221ea5e00e05d3163c6f4ba · dirty yes · first drive 3855
    • commit ba66d135fc96464ab9d6f92177351d3049931108 · dirty yes · first drive 3912
    • commit d81f3241365ff9867509700aecc105bb7deefd9a · dirty yes · first drive 3938
    • commit 6ad4c3a2a3f6a3ca1a4d38e82e3ac2c3484fc7c0 · dirty yes · first drive 3950
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain868 (created 2026-11-08T06:16:53Z · trigger customer_request · upstream version 3.4.0) [chains, chains #868]
  • Requestbuild request #477 (rebuild) (requested at 2026-10-30T10:00:54Z · requested by kitforge-agent · version 3.4.0) [build_requests, build_requests #477]
  • Reasonrerelease agenda REVISION -> 3.3.2-CE-ubuntu24.04-r6 (decay loop, IMP-08) [build_requests, build_requests #477 request_reason]
  • Supersedesreadystack/airflow:3.3.2-CE-ubuntu24.04-r5 (chain 722) [chains, chains #722]

The path through the harness

1 item not recorded

2 chains · 11 drives · 18 stages · 3 rewinds

Chain 801 behind it · abandoned

Created 2026-10-30T16:53:21Z, upstream 3.3.2, build request 477 [chains, chains #801]

Abandoned: chain 801 abandoned: stale (it targets '3.3.2', the strategy '3.4.0') [watch_queue, watch_queue #9805 resolution]

Chain 868 release · ready_to_ship

Created 2026-11-08T06:16:53Z, upstream 3.4.0, build request 477 [chains, chains #868]

DriveStartedMinutesBuild hostHow it stopped
37172026-11-08T06:17:34Z80.9build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #3717]
37982026-11-08T12:28:49Z6.1build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3798]
38082026-11-08T13:17:56Z3.3build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3808]
38182026-11-08T14:15:54Z1.4build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3818]
38252026-11-08T15:15:57Z1.4build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3825]
38312026-11-08T16:25:43Z2.4build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3831]
38532026-11-08T18:03:23Z1.4build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3853]
38552026-11-08T18:13:56Z11.3build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3855]
39122026-11-09T01:05:05Z5.5build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3912]
39382026-11-09T03:37:05Z5.5build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3938]
39502026-11-09T04:20:48Z—build host 3 publish-held not recorded [drive_runs, drive_runs #3950]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-08T06:17:48Z2026-11-08T06:17:49Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 44f089db9b53…
acquire 2026-11-08T06:18:16Z2026-11-08T06:18:22Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 47ab9a54e8c7…
license_file cb0d37346e79…
custody_inputs 150210d27c9b…
source_tree_hash 27407021c0ad…
source_file_manifest 088ccd788a74…
plan 2026-11-08T06:19:11Z2026-11-08T06:19:12Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 579648d4b961…
input_pin_plan d63e5bbc3466…
toolchain_lock 9efa73513769…
assemble_kit 2026-11-08T06:28:45Z2026-11-08T06:28:47Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile daf6d4bd75a7…
build_recipe d1a2333c14af…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 36bbe92cc9ae…
verify_offline_sh 3e8184ea230c…
base_image_digests 59c0829271e8…
dockerfile_offline daf6d4bd75a7…
first_build_digest 1bf2ab927953…
remediate 2026-11-08T06:29:28Z2026-11-08T06:29:29Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log a9fac4e3c649…
security_report 04e424aa6815…
build_kit 2026-11-08T06:40:46Z2026-11-08T06:40:48Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp b577bb6ca697…
locked_digest 86d507fad9ae…
freeze_manifest 5ef3eaa6da24…
offline_rebuild_transcript 9ba030cdb16d…
verdict 2026-11-08T06:42:04Z2026-11-08T06:42:06Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict c1f3c5c2ca32…
publish_image 2026-11-08T06:43:03Z2026-11-08T06:43:05Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme f009a2259184…
promotion_record 342d01ce0e5b…
boot_instance 2026-11-08T06:43:43Z2026-11-08T06:43:49Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle e0c8a0297d07…
sbom 2026-11-08T06:44:10Z2026-11-08T06:44:12Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 612f18b7d228…
sbom_json b5d8be4594c4…
schema_discovery 2026-11-08T06:44:23Z2026-11-08T06:44:24Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 8657ac8951a0…
dependency_tree 6e79e92c2720…
table_classification e9f90e6ebfd1…
admin_handbook 2026-11-08T07:00:26Z2026-11-08T07:00:27Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 157c4fd5f6e7…
admin_handbook 28cb9cb0d649…
db_handbook 2026-11-08T07:21:13Z2026-11-08T07:21:14Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 1d6f4dce5a62…
seed_isolation 7eaf2736dd98…
seed_data 2026-11-08T07:21:25Z2026-11-08T07:21:25Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 2cc0dcfbf898…
seed_cases_json d00036e592bd…
seed_validate 2026-11-08T07:21:29Z2026-11-08T07:21:30Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract b5ef7e8ac3eb…
usecase_validate 2026-11-08T07:23:06Z2026-11-08T07:23:07Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests 0810090a33ad…
passed_tests 1aaac0958177…
test_results 3bd39fa287b1…
usecase_contract 20a7c64957cc…
finalize_docs 2026-11-08T07:23:14Z2026-11-08T07:23:15Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 95ddd4054fe5…
release_notes 44b8691288c8…
api_integration_guide 0b4077e03c21…
package_archive invalidated 2026-11-09T04:20:21Z 2026-11-08T07:38:26Z2026-11-09T03:42:32Z10
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 5cd7987db4fd…
checksums 3c0e23071dd3…
verify_md 3b32a8b97144…
rebuild_md 29983cb9b139…
manifest_txt 78432b86e496…
actions_jsonl 0c05b9e00fa7…
provenance_md 38538d0df166…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 1c080e5360fd…

[stage_runs]

Rewinds

  • 2026-11-08T23:41:11Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27505]
  • 2026-11-09T03:31:42Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27932]
  • 2026-11-09T04:20:21Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27977]
  • Not recorded: the drives of chain 801 (drive_runs holds none: drive history starts 2026-06-28, from the line logs)

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T03:42:32Z.

201 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 07977 L-A183, L-A15
remediate2001 07691 L-A183, L-A15
admin_handbook1075903 201073842 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook864203 91012654 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate4001 014857 L-A59

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

3 rounds, 3 counted, $6.73 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-08T18:25:44Z 3209 findings to tests_broken [held_rounds, held_rounds #1535] $3.15 3 rounds, $40.00 d37ce4116f95…
22026-11-09T01:10:56Z 018 findings to tests_broken [held_rounds, held_rounds #1559] $1.62 3 rounds, $40.00 9a4ea3adf8dd…
32026-11-09T03:42:53Z 009 clean to publish [held_rounds, held_rounds #1571] $1.96 3 rounds, $40.00 5cd7987db4fd…

Defects

Fully recorded
  • Ledger entries51 [defects, defects where product_slug=airflow and this tag or chain]
  • Disclosed in the archive51 [docs/defects/defects.json, entries]

51 ledger entries: by severity medium 1, critical 3, high 21, low 26; by status open 1, fixed-before-release 50.

DefectSeverityStatusFound byFixed in
RSD-airflow-a41b75b910
Secret written in plain text or to the log by default [defects, defects #171915]		mediumopenbuild strategy record—
RSD-airflow-a28e4b272f
Database handbook: The database-only restore procedure removes and re-creates the volume (docker volume rm / create) before restoring only airflow.db. [defects, defects #182981]		criticalfixed-before-releaseheld review (review model)—
RSD-airflow-cdbc18dcb5
Database handbook: The 'Restore procedure' deletes and re-creates airflow-data and then offers a database-file-only branch 'to the original volume': after the volume was removed there is no original airflow.cfg any… [defects, defects #182982]		criticalfixed-before-releaseheld review (review model)—
RSD-airflow-66dfff6ad3
Database handbook: Step 2 of 'To restore the database from the backup file you created' destroys the volume that the text at line 871 says supplies the original airflow.cfg. [defects, defects #182983]		criticalfixed-before-releaseheld review (review model)—
RSD-airflow-920ba5ccd3
Database handbook: False statement: the .backup file contains only the database; the volume (removed in step 2) is not what brings back airflow.cfg. [defects, defects #182984]		highfixed-before-releaseheld review (review model)—
RSD-airflow-0e19b0b7a9
Database handbook: A sqlite3 .backup copy of airflow.db cannot contain DAG files (dags/), task logs (logs/) or the admin password (simple_auth_manager_passwords.json.generated); the sentence says it restores them. [defects, defects #182985]		highfixed-before-releaseheld review (review model)—
RSD-airflow-386e2fb07d
Database handbook: Password and jwt_secret are not in airflow.db, so the db-only restore cannot restore them; the sentence is false and the 'repeat that change' advice is misdirected. [defects, defects #182986]		highfixed-before-releaseheld review (review model)—
RSD-airflow-1b49d941b2
Database handbook: Paragraph after the database-only restore claims the full-volume result (DAG files, task logs, password, JWT secret). [defects, defects #182987]		highfixed-before-releaseheld review (review model)—
RSD-airflow-2f78b4826f
Admin handbook: The escaped example in Security Considerations has the single-quote escape twice (`'\'\'`), so the password that gets stored is `it''s my pass $x!`, not `it's my pass $x!`; it contradicts the… [defects, defects #182988]		highfixed-before-releaseheld review (review model)—
RSD-airflow-7ad96bc14a
Admin handbook: The 'copy a file into the container' command cannot work: it calls read() on the file it opened with 'w', fails with io.UnsupportedOperation and leaves an empty DAG file. [defects, defects #182989]		highfixed-before-releaseheld review (review model)—
RSD-airflow-8d80659a88
Admin handbook: The trigger-a-DAG-run example is refused with 422 because logical_date is required; it contradicts the Operating facts in the same document. [defects, defects #182990]		highfixed-before-releaseheld review (review model)—
RSD-airflow-7cb6999922
Database handbook: The 'simplest example' DAG uses schedule_interval, which Airflow 3.4.0 rejects: the DAG fails to import and the 'Within a few seconds ... [defects, defects #182991]		highfixed-before-releaseheld review (review model)—
RSD-airflow-91bedebb5d
Database handbook: Security-relevant false claim: eventLogs, importErrors, dag details and tasks all answer 401 without a token; the sentence says they are open and safe to query without one, and contradicts the… [defects, defects #182992]		highfixed-before-releaseheld review (review model)—
RSD-airflow-190b0ca9da
Database handbook: The password-reset block omits the `rm`, so following it restarts the container and changes nothing, while the text promises a new random password. [defects, defects #182993]		highfixed-before-releaseheld review (review model)—
RSD-airflow-ed6784c967
Admin handbook: The example for changing one of the four overridable settings sets AIRFLOW__API__PORT=9090 while publishing 8080:8080: the published port reaches nothing, the container is reported unhealthy, and it… [defects, defects #182994]		highfixed-before-releaseheld review (review model)—
RSD-airflow-64297d51de
Admin handbook: The advice to switch auth manager through airflow.cfg [webserver]/[api_auth] cannot work: the auth manager option is [core] auth_manager and `airflow standalone` overrides it, so an operator… [defects, defects #182995]		highfixed-before-releaseheld review (review model)—
RSD-airflow-cf58a5117c
Database handbook: Same false remedy as ADMIN_HANDBOOK.md:1864: airflow.cfg cannot change the auth manager under `airflow standalone`. [defects, defects #182996]		highfixed-before-releaseheld review (review model)—
RSD-airflow-8524b2141d
Admin handbook: False monitoring claim: the status code does not depend on the scheduler, DAG processor or triggerer; the handbook says so in four other places. [defects, defects #182997]		highfixed-before-releaseheld review (review model)—
RSD-airflow-137b26f7d6
Admin handbook: Wrong token lifetime (30 days instead of 86400 s) and a false 'only by rotating the JWT secret'; both contradict the Operating facts the sentence points to. [defects, defects #182998]		highfixed-before-releaseheld review (review model)—
RSD-airflow-96cffa241d
Admin handbook: The licence section says no other third-party components with separate licence obligations are bundled; Docker Scout records 33 copyleft-licensed packages in the image. [defects, defects #182999]		highfixed-before-releaseheld review (review model)—
RSD-airflow-b5d1b101c1
Admin handbook: The two named fonts are not in the image: JetBrains Mono and Plus Jakarta Sans belong to upstream's registry website sources. [defects, defects #183000]		highfixed-before-releaseheld review (review model)—
RSD-airflow-d9f908c4bf
Database handbook: Names two OFL fonts that the image does not contain. [defects, defects #183001]		highfixed-before-releaseheld review (review model)—
RSD-airflow-3a04c10e5f
Database handbook: Licensing section names two bundled fonts that are not in the image. [defects, defects #183002]		highfixed-before-releaseheld review (review model)—
RSD-airflow-d82851b8a2
Database handbook: Licensing (continued) repeats the false font claim. [defects, defects #183003]		highfixed-before-releaseheld review (review model)—
RSD-airflow-1c010c1cd4
Admin handbook: The example-DAG count (114) is not what the release image loads (119 measured). [defects, defects #183004]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-ec3a7c2b23
Admin handbook: Contradiction inside the handbook about whether logout needs authentication. [defects, defects #183005]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-be8c1efe27
Admin handbook: Run immediately after the restart as the block order suggests, the cat fails because the new password file is not written yet. [defects, defects #183006]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-8b7769179b
Admin handbook: The sqlite3 example cannot give an interactive prompt without -it. [defects, defects #183007]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-9706b8faac
Admin handbook: The sentence says the volume backup is taken while the container is running, the procedure stops it. [defects, defects #183008]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-e77d936bce
Admin handbook: Host-path write needs root and a default Docker data-root, and the same handbook recommends docker exec for writing into the volume. [defects, defects #183009]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-ecfca7bef1
Database handbook: No text editor exists in the chiselled image, and host-side editing conflicts with the guidance to keep the data in the Docker-managed volume. [defects, defects #183010]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-f368714124
Database handbook: 'remain loaded' is wrong: the examples are stale entries after the flag is removed. [defects, defects #183011]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-427419b981
Database handbook: Misplaced qualifier: the kit contains the toolchain and sources, the final image does not. [defects, defects #183012]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-ec439432a6
Database handbook: False: a new DAG is registered paused, so the scheduler does not run it until it is unpaused (contradicts the Operating facts 'New DAGs start paused'); the file also cannot simply be saved 'on the… [defects, defects #188477]		highfixed-before-releaseheld review (review model)—
RSD-airflow-894d20ef57
Database handbook: There is no `airflow-data/dags` directory on the host: a named volume lives under Docker's data-root (root-only, location varies), and the same handbook tells customers to write files with docker… [defects, defects #188478]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-9e92f3e238
Database handbook: The command that follows is a backup, not a restore, and the restore steps right after it stop and remove the container; the sentence says the restore keeps the container running. [defects, defects #188479]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-91ebb5f3bb
Database handbook: The settings are read at start-up; 'next heartbeat' is wrong and contradicts the restart the sentence asks for. [defects, defects #188480]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-9f740b0a83
Database handbook: jwt_secret signs login tokens and decrypts nothing; the database does not depend on it. [defects, defects #188481]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-b6f4160ae2
Database handbook: Contradicts the handbook's database-only restore, which restores airflow.db alone and works; a customer reading this would think the .backup restore is invalid. [defects, defects #188482]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-d24dfaf839
Admin handbook: No way to edit is given; the chiselled image has no editor, and editing the volume from the host conflicts with the guidance to keep the data in the Docker-managed volume. [defects, defects #188483]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-3793581774
Admin handbook: Same as line 1089: no editor in the image and no stated way to edit the file on the volume. [defects, defects #188484]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-0e8a12373e
Admin handbook: The Docker Engine minimum '20.10' appears in no record; REBUILD.md requires only 'linux/amd64 Docker with buildx 0.30 or later'. [defects, defects #188485]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-324c263618
Admin handbook: The restart this line asks for is not needed: DAG processor parses new files while running (contradicts the handbook's own 'within a few seconds'). [defects, defects #192161]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-130e7132ba
Admin handbook: States the documented command removes its container; it does not. [defects, defects #192162]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-347a1b998b
Admin handbook: Inverted instruction: exclude_stale=false includes stale DAGs. [defects, defects #192163]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-0c7d4a778f
Database handbook: Not paraphrase-clean: the round-2 'no way to edit' wording was fixed in four places but remains in this section. [defects, defects #192164]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-cb538b4c9d
Database handbook: Advises bind-mounting, which the handbook says breaks the instance. [defects, defects #192165]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-ec9df70df5
Database handbook: Names a component the body does not report. [defects, defects #192166]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-e5cd24bb0c
Database handbook: Wrong state list for DAG runs. [defects, defects #192167]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-73250e8082
Database handbook: Names the wrong output file. [defects, defects #192168]		lowfixed-before-releaseheld review (review model)—
RSD-airflow-cb6acf19f9
API guide: Description cut off mid-sentence in the guide. [defects, defects #192169]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:ec7c766e35be352fb8f5bc318ee215eb3dba05566c2b2d28b06fa4fe3574cd4f · published digest sha256:ec7c766e35be352fb8f5bc318ee215eb3dba05566c2b2d28b06fa4fe3574cd4f · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 283) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T04:21:19Z · failing Docker Scout counts 33 packages with copyleft licences (GPL, LGPL, MPL), 30 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T04:21:00Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3761129622 · transparency-log entry · integrated 2026-11-09T04:26:06Z) [ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:102bead671874c556bc7b9d47888083780c723b5c5c1d6470e68c0367e898261 · state attached · log index 3761130163 · transparency-log entry
    • kind sbom · digest sha256:102bead671874c556bc7b9d47888083780c723b5c5c1d6470e68c0367e898261 · state attached · log index 3761130370 · transparency-log entry
    • kind vsa · digest sha256:102bead671874c556bc7b9d47888083780c723b5c5c1d6470e68c0367e898261 · state attached · log index 3761130634 · transparency-log entry
    • kind provenance · digest sha256:ec7c766e35be352fb8f5bc318ee215eb3dba05566c2b2d28b06fa4fe3574cd4f · state attached · log index 3761130815 · transparency-log entry
    • kind sbom · digest sha256:ec7c766e35be352fb8f5bc318ee215eb3dba05566c2b2d28b06fa4fe3574cd4f · state attached · log index 3761130993 · transparency-log entry
    • kind vsa · digest sha256:ec7c766e35be352fb8f5bc318ee215eb3dba05566c2b2d28b06fa4fe3574cd4f · state attached · log index 3761131218 · transparency-log entry
    (at 2026-11-09T04:26:06Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/airflow/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-08T18:25:52Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:ec7c766e35be352fb8f5bc318ee215eb3dba05566c2b2d28b06fa4fe3574cd4f [clean-room rebuild ledger, runs[663]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-08T06:43:05Z [stage_runs, stage_runs chain 868 stage publish_image]
  • Archive manifests written2026-11-09T04:23:58Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 298 · probed 2026-11-08T06:35:34Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T04:27:35Z generated: by KitForge release/build_trail.py · generator commit 1432ad5c474910e63a4925b704dfe755a994b66f
  • 2026-11-09T04:29:07Z publication: promoted at 2026-11-09T04:28:11Z · promoted digest sha256:102bead671874c556bc7b9d47888083780c723b5c5c1d6470e68c0367e898261 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 403 · checklist status complete · checklist at 2026-11-09T04:29:07Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

26 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/airflow/3.4.0-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/airflow/3.4.0-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/airflow/3.4.0-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-airflow-3.4.0-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/airflow/3.4.0-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/airflow/3.4.0-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)477
chainssadb, ReadyStack's engine database (not published)801, 868
defectssadb, ReadyStack's engine database (not published)airflow 3.4.0-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 868
held_roundssadb, ReadyStack's engine database (not published)chain 868
lesson_recallssadb, ReadyStack's engine database (not published)chain 868
micro_step_runssadb, ReadyStack's engine database (not published)chain 868
release_imagessadb, ReadyStack's engine database (not published)airflow 3.4.0-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 868
stage_runssadb, ReadyStack's engine database (not published)chain 868
watch_queuesadb, ReadyStack's engine database (not published)9805
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—