Canvas LMS 2026-05-20.143-CE-ubuntu24.04-r7 build trail
How ReadyStack built readystack/canvas:2026-05-20.143-CE-ubuntu24.04-r7 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/canvas:2026-05-20.143-CE-ubuntu24.04-r7 - Index digestsha256:654beb921acdf44140de4e0725784afbc689fb19f9b5212556c30434c85d56df
- linux/amd64 digestsha256:dc35813bb8f343a64cbc8b2dfd024dec554f31debefcf231cc25bebddab02d91
- Archive
ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.tar.gz - Archive SHA-256 now0ee45a3c82926caad2524d5355dedb082f669ab4fe6d573d7ef647cf042febef
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-13T10:29:23Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.trail.json.sigstore ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductCanvas LMS (canvas) [MANIFEST.json]
- Release tag2026-05-20.143-CE-ubuntu24.04-r7 [MANIFEST.json]
- Imagereadystack/canvas:2026-05-20.143-CE-ubuntu24.04-r7 [MANIFEST.json]
- Image index digestsha256:654beb921acdf44140de4e0725784afbc689fb19f9b5212556c30434c85d56df [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:dc35813bb8f343a64cbc8b2dfd024dec554f31debefcf231cc25bebddab02d91 [ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.tar.gz (bytes 1012798319) [MANIFEST.json]
- Archive sha256 at publish0ee45a3c82926caad2524d5355dedb082f669ab4fe6d573d7ef647cf042febef [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/instructure/canvas-lms [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refrelease/2026-05-20.143 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit2e2b4a46d08e32667d4845f7b78e1214250345d3 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash222ae1df10656048500098d09530d7337d8bb8fb99e7e3676629165870c2e1af (files 22662) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:91c9c20fed6bfa9ccc57639a0095c2e13afc043389ffd304fa3a76733a9aab9a [ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794535122 (utc 2026-11-13T01:58:42Z) [ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.rebuild.json, engine]
- Engine commit(s)
- commit 7d415ff1f1bd2eff83cf586201c7b05acd529095 · dirty yes · first drive 4525
- commit 53328f4754ecefc18b308504e3b02f89c9062497 · dirty yes · first drive 4550
Why this release exists
Fully recorded- Chain1054 (created 2026-11-13T02:07:22Z · trigger customer_request · upstream version 2026-05-20.143) [chains, chains #1054]
- Requestbuild request #742 (rebuild) (requested at 2026-11-13T01:58:44Z · requested by kitforge-agent · version 2026-05-20.143) [build_requests, build_requests #742]
- Reasonrerelease agenda REVISION -> 2026-05-20.143-CE-ubuntu24.04-r7 (decay loop, IMP-08) [build_requests, build_requests #742 request_reason]
- Supersedesreadystack/canvas:2026-05-20.143-CE-ubuntu24.04-r6 (chain 1030) [chains, chains #1030]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1054 release · ready_to_ship
Created 2026-11-13T02:07:22Z, upstream 2026-05-20.143, build request 742 [chains, chains #1054]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4525 | 2026-11-13T02:08:03Z | 122.5 | build host 5 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4525] |
| 4550 | 2026-11-13T10:09:28Z | — | build host 5 publish-held | not recorded [drive_runs, drive_runs #4550] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-13T02:08:14Z | 2026-11-13T02:08:14Z | 1 | 4
|
order_json dce17291e817… |
acquire |
2026-11-13T02:08:47Z | 2026-11-13T02:08:50Z | 1 | 12
|
source_tree cab5b8b605e3…license_file 57c8ff33c9c0…custody_inputs 245070a7f8a1…source_tree_hash 642cb5fb3665…source_file_manifest c2d9b38b00e9… |
plan |
2026-11-13T02:09:33Z | 2026-11-13T02:09:34Z | 1 | 10
|
recon_report 734fe591edfc…input_pin_plan b62c35b0c2dd…toolchain_lock e3d6425b46f2… |
assemble_kit |
2026-11-13T02:58:02Z | 2026-11-13T02:58:03Z | 1 | 27
|
dockerfile 77cc44700315…build_recipe 5b42f86c3446…system_pinning 762ec5577126…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health a8bc0728d940…verify_offline_sh 3e8184ea230c…base_image_digests db1a64ed3312…dockerfile_offline 77cc44700315…first_build_digest ee1791a25036… |
remediate |
2026-11-13T02:58:38Z | 2026-11-13T02:58:38Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 9461241a3526…security_report ed6be9e584f2… |
build_kit |
2026-11-13T03:27:05Z | 2026-11-13T03:27:05Z | 1 | 9
|
cosign_stamp de89813d2e10…locked_digest ba737bd043b3…freeze_manifest 91c14a41cfff…offline_rebuild_transcript b091b0aa5408… |
verdict |
2026-11-13T03:31:57Z | 2026-11-13T03:31:58Z | 1 | 8
|
scout_verdict 96c655e591ea… |
publish_image |
2026-11-13T03:34:06Z | 2026-11-13T03:34:07Z | 1 | 7
|
hub_readme f14f68c85cb9…promotion_record 1a5fbb97bc90… |
boot_instance |
2026-11-13T03:36:42Z | 2026-11-13T03:36:46Z | 2 | 3
|
instance_handle 889e53677d88… |
sbom |
2026-11-13T03:38:00Z | 2026-11-13T03:38:01Z | 1 | 5
|
sbom_md adf640724616…sbom_json 0e6299603d3a… |
schema_discovery |
2026-11-13T03:38:03Z | 2026-11-13T03:38:04Z | 1 | 7
|
schema_hash 381015f79a1b…dependency_tree 61fe400e72b6…table_classification 59cee695e5a5… |
admin_handbook |
2026-11-13T03:38:11Z | 2026-11-13T03:38:12Z | 1 | 7
|
api_map 80bc742414c1…admin_handbook 9e54c6a99dd2… |
db_handbook |
2026-11-13T03:38:22Z | 2026-11-13T03:38:22Z | 1 | 8
|
db_handbook 7eadb8912314…seed_isolation c29b1a346a6a… |
seed_data |
2026-11-13T03:38:35Z | 2026-11-13T03:38:36Z | 1 | 6
|
seed_data_sql a0f6af47712c…seed_cases_json ece9f4c71544… |
seed_validate |
2026-11-13T03:38:39Z | 2026-11-13T03:38:40Z | 1 | 3
|
seed_data_contract 10cafbbf9238… |
usecase_validate |
2026-11-13T03:39:03Z | 2026-11-13T03:39:04Z | 1 | 10
|
failed_tests 30980792e397…passed_tests edd3f4057f18…test_results ca742a67062c…usecase_contract 2e72c5c0bb7b… |
finalize_docs |
2026-11-13T03:39:11Z | 2026-11-13T03:39:11Z | 1 | 9
|
defects_json b1c10978aa80…release_notes c29fd3a788b4…api_integration_guide ecab13eda692… |
package_archive invalidated 2026-11-13T10:09:00Z |
2026-11-13T04:10:28Z | 2026-11-13T04:10:31Z | 1 | 37 (final gate PASS)
|
sale_tar ad762d703abf…checksums abd88cd7dffc…verify_md 6d1d291a3fc4…rebuild_md e31ac95462f7…manifest_txt 889cec298e99…actions_jsonl 56f4227d0269…provenance_md bade88a99bcb…assetchain_log_md e9eccaec0c0f…assetchain_log_json 48ac1790025f… |
[stage_runs]
Rewinds
- 2026-11-13T10:09:00Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #35509]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-13T04:10:31Z.
5 calls over 3 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 11134 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 11964 | L-A183, L-A15 |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 1703 | L-A59 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
2 rounds, 1 counted, $0.29 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 not counted | 2026-11-13T04:12:57Z | — | — | — | infra to infra [held_rounds, held_rounds #1859] | $0.00 | 3 rounds, $40.00 | ad762d703abf… |
| 2 | 2026-11-13T10:01:24Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1860] | $0.29 | 3 rounds, $40.00 | ad762d703abf… |
Defects
Fully recorded- Ledger entries1 [defects, defects where product_slug=canvas and this tag or chain]
- Disclosed in the archive1 [docs/defects/defects.json, entries]
1 ledger entry: by severity low 1; by status open 1.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-canvas-5ca367efaeDocker Hub README: The Docker Hub README names only the Gemfile.d/app.rb line although the diff also changes Gemfile.lock and the build removes spec/, .github/ and the workspace package.json files. [defects, defects #278227] | low | open | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:dc35813bb8f343a64cbc8b2dfd024dec554f31debefcf231cc25bebddab02d91 · published digest sha256:dc35813bb8f343a64cbc8b2dfd024dec554f31debefcf231cc25bebddab02d91 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 766) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T10:11:05Z · failing Docker Scout counts 119 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 111 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: academic_benchmarks. · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T10:09:43Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3844993222 · transparency-log entry
- log index 3844995672 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3851962040 · transparency-log entry · integrated 2026-11-13T10:26:45Z) [ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:654beb921acdf44140de4e0725784afbc689fb19f9b5212556c30434c85d56df · state attached · log index 3851968567 · transparency-log entry
- kind sbom · digest sha256:654beb921acdf44140de4e0725784afbc689fb19f9b5212556c30434c85d56df · state attached · log index 3851971423 · transparency-log entry
- kind vsa · digest sha256:654beb921acdf44140de4e0725784afbc689fb19f9b5212556c30434c85d56df · state attached · log index 3851974481 · transparency-log entry
- kind provenance · digest sha256:dc35813bb8f343a64cbc8b2dfd024dec554f31debefcf231cc25bebddab02d91 · state attached · log index 3851979156 · transparency-log entry
- kind sbom · digest sha256:dc35813bb8f343a64cbc8b2dfd024dec554f31debefcf231cc25bebddab02d91 · state attached · log index 3851982583 · transparency-log entry
- kind vsa · digest sha256:dc35813bb8f343a64cbc8b2dfd024dec554f31debefcf231cc25bebddab02d91 · state attached · log index 3851986449 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/canvas/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-13T04:13:04Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:dc35813bb8f343a64cbc8b2dfd024dec554f31debefcf231cc25bebddab02d91 [clean-room rebuild ledger, runs[820]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-13T03:34:07Z [stage_runs, stage_runs chain 1054 stage publish_image]
- Archive manifests written2026-11-13T10:19:16Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 1044 · probed 2026-11-13T03:14:00Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-13T10:29:23Z generated: by KitForge release/build_trail.py · generator commit 53328f4754ecefc18b308504e3b02f89c9062497
- 2026-11-13T10:33:08Z publication: promoted at 2026-11-13T10:30:22Z · promoted digest sha256:654beb921acdf44140de4e0725784afbc689fb19f9b5212556c30434c85d56df · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 536 · checklist status complete · checklist at 2026-11-13T10:33:08Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/canvas/2026-05-20.143-CE-ubuntu24.04-r7/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/canvas/2026-05-20.143-CE-ubuntu24.04-r7/), as staged for publishing | — |
ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.rebuild.json | beside the archive (prodasset /data/production/canvas/2026-05-20.143-CE-ubuntu24.04-r7/), as staged for publishing | — |
ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r7.rebuild.json.sigstore | beside the archive (prodasset /data/production/canvas/2026-05-20.143-CE-ubuntu24.04-r7/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/canvas/2026-05-20.143-CE-ubuntu24.04-r7/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 742 |
chains | sadb, ReadyStack's engine database (not published) | 1054 |
defects | sadb, ReadyStack's engine database (not published) | canvas 2026-05-20.143-CE-ubuntu24.04-r7 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1054 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1054 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1054 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1054 |
release_images | sadb, ReadyStack's engine database (not published) | canvas 2026-05-20.143-CE-ubuntu24.04-r7 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1054 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1054 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |