ERPNext v16.53.0-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/erpnext:v16.53.0-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON

Imagereadystack/erpnext:v16.53.0-CE-ubuntu24.04-r1
Index digestsha256:6b7ded6b8c8451a6e0f0dccbca5fc5a995a42696fc7bae89b1d8b5f195b3fce4
linux/amd64 digestsha256:a9d4ca0313ef5394da5f0084c746f07d714da723d25c68a2190383bc00ef61ef
ArchiveReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.tar.gz
Archive SHA-256 now775ac5a8b5981edeb68adc736884e5b89bc6eddcd9c8509d45dbc53ec5506aea
Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since 2026-11-03T01:22:57Z)
Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
Sections9 sections, 4 fully recorded; 10 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.trail.json

ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.trail.json ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.trail.md ERPNext product page

Identity Why this release exists The path through the harness Model work per stage Review Defects Verification Publication Packages and CPU level

Identity

1 item not recorded

ProductERPNext (erpnext) [MANIFEST.json]
Release tagv16.53.0-CE-ubuntu24.04-r1 [MANIFEST.json]
Imagereadystack/erpnext:v16.53.0-CE-ubuntu24.04-r1 [MANIFEST.json]
Image index digestsha256:6b7ded6b8c8451a6e0f0dccbca5fc5a995a42696fc7bae89b1d8b5f195b3fce4 [docs/provenance/LOCKED_DIGEST.txt]
linux/amd64 image digestsha256:a9d4ca0313ef5394da5f0084c746f07d714da723d25c68a2190383bc00ef61ef [ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
ArchiveReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.tar.gz (bytes 786534268) [MANIFEST.json]
Archive sha256 at publish4209db3b4041f3fb94d93acce4d689b1ddf6d8eda7c5e524c941683bc54aa599 [MANIFEST.json, tarball_sha256]
Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
Upstream repositoryhttps://github.com/frappe/erpnext [docs/provenance/SOURCE_TREE_HASH.json]
Upstream refv16.53.0 [docs/provenance/SOURCE_TREE_HASH.json]
Upstream commit9cd11b19575bfc34f092a24f6c8b368c4dd69481 [docs/provenance/SOURCE_TREE_HASH.json]
Source tree hashe9e194e2af7ed58c0f42e27a67378f1df9b975c9ba880bc0f3cdd898c7896209 (files 5581) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
Kit tree hashsha256:cb85f9456672507c0e8c15f65958d8d89aab03ea760b45c707ec8d7366105c90 [ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
SOURCE_DATE_EPOCH1793220242 (utc 2026-10-28T20:44:02Z) [ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
Base images
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
[ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.rebuild.json, bases]
BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.rebuild.json, engine]

Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded

Chain811 (created 2026-11-01T09:19:28Z · trigger customer_request · upstream version v16.53.0) [chains, chains #811]
Requestbuild request #487 (rebuild) (requested at 2026-11-01T02:09:00Z · requested by kitforge-agent · version v16.53.0) [build_requests, build_requests #487]
Reasonretarget to v16.53.0-CE-ubuntu24.04-r1: CPython CVE-2026-115557 rebuild (owner 2026-10-31) [build_requests, build_requests #487 request_reason]
Supersedesreadystack/erpnext:v16.52.1-CE-ubuntu24.04-r3 (chain 797) [chains, chains #797]

The path through the harness

2 items not recorded

1 chain · 5 drives · 18 stages · 3 rewinds

Chain 811 release · shipped

Created 2026-11-01T09:19:28Z, upstream v16.53.0, build request 487 [chains, chains #811]

Drive	Started	Minutes	Build host	How it stopped
12	2026-11-01T09:19:52Z	62.8	build host 3 withhold-publish	stage_failed at package_archive [drive_runs, drive_runs #12] rebuilt from a build line's log
14	2026-11-01T10:42:58Z	21.1	build host 3 withhold-publish	ready_to_ship [drive_runs, drive_runs #14] rebuilt from a build line's log
17	2026-11-01T11:49:10Z	12	build host 3 withhold-publish	ready_to_ship [drive_runs, drive_runs #17] rebuilt from a build line's log
19	2026-11-01T12:51:56Z	11.3	build host 3 withhold-publish	ready_to_ship [drive_runs, drive_runs #19] rebuilt from a build line's log
20	2026-11-01T13:58:38Z	15.2	build host 3 publish-held	shipped [drive_runs, drive_runs #20] rebuilt from a build line's log

Stages, in order

Stage	First start	Passed	Attempts	Gate checks passed	Artifacts (SHA-256)
`intake`	2026-11-01T09:19:58Z	2026-11-01T09:19:59Z	1	4 `exists:order_json` `order_json:json_parses` `order_json:no_forbidden_placeholders` `produces_paths_exist`	—
`acquire`	2026-11-01T09:20:10Z	2026-11-01T09:20:11Z	1	12 `exists:source_tree` `exists:source_tree_hash` `exists:source_file_manifest` `exists:custody_inputs` `exists:license_file` `source_tree:dir_nonempty` `source_tree_hash:json_parses` `source_file_manifest:json_parses` `custody_inputs:json_parses` `license_file:file_nonempty` `produces_paths_exist` `custody_inputs:json_true:ce_audit.ce_only`	—
`plan`	2026-11-01T09:20:50Z	2026-11-01T09:20:51Z	1	10 `exists:recon_report` `exists:input_pin_plan` `exists:toolchain_lock` `recon_report:md_min_sections:3` `recon_report:no_forbidden_placeholders` `input_pin_plan:md_min_sections:2` `input_pin_plan:no_forbidden_placeholders` `toolchain_lock:file_nonempty` `toolchain_lock:no_forbidden_placeholders` `produces_paths_exist`	—
`assemble_kit`	2026-11-01T09:38:45Z	2026-11-01T09:38:45Z	1	27 `exists:dockerfile` `exists:base_image_digests` `exists:system_pinning` `exists:build_recipe` `exists:first_build_digest` `exists:first_boot_health` `exists:dockerfile_offline` `exists:verify_offline_sh` `exists:build_offline_sh` `exists:generate_sbom_sh` `dockerfile:file_nonempty` `dockerfile:no_forbidden_placeholders` `base_image_digests:file_nonempty` `system_pinning:file_nonempty` `build_recipe:json_parses` `first_build_digest:file_nonempty` `first_boot_health:file_nonempty` `dockerfile_offline:file_nonempty` `dockerfile_offline:no_forbidden_placeholders` `verify_offline_sh:file_nonempty` `verify_offline_sh:no_forbidden_placeholders` `build_offline_sh:file_nonempty` `build_offline_sh:no_forbidden_placeholders` `generate_sbom_sh:file_nonempty` `generate_sbom_sh:no_forbidden_placeholders` `produces_paths_exist` `first_boot_health:file_contains:healthy=True`	—
`remediate`	2026-11-01T09:39:40Z	2026-11-01T09:39:41Z	1	8 `exists:vendored_apt` `exists:remediation_log` `exists:security_report` `vendored_apt:dir_exists` `remediation_log:json_parses` `security_report:md_min_sections:2` `security_report:no_forbidden_placeholders` `produces_paths_exist`	—
`build_kit`	2026-11-01T09:53:14Z	2026-11-01T09:53:15Z	1	9 `exists:freeze_manifest` `exists:locked_digest` `exists:cosign_stamp` `exists:offline_rebuild_transcript` `freeze_manifest:json_parses` `locked_digest:file_nonempty` `cosign_stamp:file_nonempty` `offline_rebuild_transcript:json_parses` `produces_paths_exist`	—
`verdict`	2026-11-01T09:57:00Z	2026-11-01T09:57:01Z	1	8 `exists:scout_verdict` `scout_verdict:json_parses` `produces_paths_exist` `scout_verdict:release_check_passed` `scout_verdict:nonroot_green` `scout_verdict:zero_fixable_crit_high` `scout_verdict:osv_clean` `scout_verdict:no_baked_secrets`	—
`publish_image`	2026-11-01T09:58:38Z	2026-11-01T09:58:38Z	1	7 `exists:promotion_record` `exists:hub_readme` `promotion_record:json_parses` `hub_readme:md_min_sections:2` `hub_readme:no_forbidden_placeholders` `produces_paths_exist` `promotion_record:json_true:signed`	—
`boot_instance`	2026-11-01T10:01:48Z	2026-11-01T10:01:50Z	2	3 `exists:instance_handle` `instance_handle:json_parses` `produces_paths_exist`	—
`sbom`	2026-11-01T10:02:40Z	2026-11-01T10:02:41Z	1	5 `exists:sbom_json` `exists:sbom_md` `sbom_json:json_parses` `sbom_md:md_min_sections:1` `produces_paths_exist`	—
`schema_discovery`	2026-11-01T10:02:43Z	2026-11-01T10:02:44Z	1	7 `exists:dependency_tree` `exists:table_classification` `exists:schema_hash` `dependency_tree:json_parses` `table_classification:json_parses` `schema_hash:file_nonempty` `produces_paths_exist`	—
`admin_handbook`	2026-11-01T10:11:28Z	2026-11-01T10:11:29Z	1	7 `exists:admin_handbook` `exists:api_map` `admin_handbook:md_min_sections:10` `admin_handbook:no_forbidden_placeholders` `api_map:json_parses` `produces_paths_exist` `admin_handbook:command_transcripts_clean`	—
`db_handbook`	2026-11-01T10:21:26Z	2026-11-01T10:21:27Z	1	8 `exists:db_handbook` `exists:seed_isolation` `db_handbook:md_min_sections:5` `db_handbook:no_forbidden_placeholders` `seed_isolation:md_min_sections:1` `seed_isolation:no_forbidden_placeholders` `produces_paths_exist` `db_handbook:command_transcripts_clean`	—
`seed_data`	2026-11-01T10:21:32Z	2026-11-01T10:21:33Z	1	6 `exists:seed_data_sql` `exists:seed_cases_json` `seed_data_sql:sql_parses` `seed_data_sql:no_forbidden_placeholders` `seed_cases_json:json_parses` `produces_paths_exist`	—
`seed_validate`	2026-11-01T10:21:35Z	2026-11-01T10:21:36Z	1	3 `exists:seed_data_contract` `seed_data_contract:json_parses` `produces_paths_exist`	—
`usecase_validate`	2026-11-01T10:21:52Z	2026-11-01T10:21:52Z	1	10 `exists:usecase_contract` `exists:passed_tests` `exists:failed_tests` `exists:test_results` `usecase_contract:json_parses` `passed_tests:md_min_sections:1` `failed_tests:md_min_sections:1` `test_results:json_parses` `produces_paths_exist` `test_results:usecase_thresholds:80,70`	—
`finalize_docs`	2026-11-01T10:21:58Z	2026-11-01T10:21:58Z	1	9 `exists:api_integration_guide` `exists:release_notes` `exists:defects_json` `api_integration_guide:md_min_sections:3` `api_integration_guide:no_forbidden_placeholders` `release_notes:md_min_sections:3` `release_notes:no_forbidden_placeholders` `defects_json:json_parses` `produces_paths_exist`	—
`package_archive`	2026-11-01T10:22:37Z	2026-11-01T14:13:47Z	5	33 (final gate PASS) `exists:checksums` `exists:verify_md` `exists:rebuild_md` `exists:provenance_md` `exists:manifest_txt` `exists:assetchain_log_md` `exists:assetchain_log_json` `exists:actions_jsonl` `exists:sale_tar` `checksums:file_nonempty` `verify_md:md_min_sections:2` `verify_md:no_forbidden_placeholders` `rebuild_md:md_min_sections:2` `rebuild_md:no_forbidden_placeholders` `provenance_md:md_min_sections:2` `provenance_md:no_forbidden_placeholders` `manifest_txt:file_nonempty` `assetchain_log_md:md_min_sections:1` `assetchain_log_json:json_parses` `actions_jsonl:file_nonempty` `sale_tar:file_nonempty` `produces_paths_exist` `G8 cosign` `G8 scan_grade` `G8 tag_base_os` `G8 vex_shipped` `G8 scout_grade_a` `G8 script_copies` `G8 three_way_sha` `G8 offline_rebuild` `G8 rebuild_manifest` `G8 artifact_coverage` `G8 assetchain_coverage`	—

[stage_runs]

Rewinds

2026-11-01T11:42:36Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2035]
2026-11-01T12:19:46Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2036]
2026-11-01T13:58:07Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #24]

Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-11-01T14:13:47Z.

93 calls over 5 stages

Stage	Calls	Refused	Max attempt	Forced commits	Real tokens	Lesson rules shown
`plan`	2	0	1	not recorded	not recorded	—
`remediate`	2	0	1	not recorded	not recorded	—
`admin_handbook`	41	8	3	not recorded	not recorded	—
`db_handbook`	47	9	3	not recorded	not recorded	—
`usecase_validate`	1	0	1	not recorded	not recorded	—

[micro_step_runs]

Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

2 items not recorded

Role: review model.

3 rounds, 3 counted, $8.60 recorded cost

Round	Started	Major	Minor	Verdict	Cost	Cap in force	Archive reviewed
1	2026-11-01T11:04:25Z	7	18	findings to repackage [held_rounds, held_rounds #31] rebuilt from a held-review state file	$2.45	not recorded	not recorded
2	2026-11-01T12:01:34Z	1	12	findings to repackage [held_rounds, held_rounds #32] rebuilt from a held-review state file	$2.97	not recorded	not recorded
3	2026-11-01T13:03:39Z	0	9	clean to publish [held_rounds, held_rounds #33] rebuilt from a held-review state file	$3.18	not recorded	not recorded

Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
Not recorded: the round cap in force at each round (the state files did not keep it)

Defects

Fully recorded

Ledger entries47 [defects, defects where product_slug=erpnext and this tag or chain]
Disclosed in the archive45 [docs/defects/defects.json, entries]

47 ledger entries: by severity medium 1, low 39, high 7; by status open 3, fixed-in-release 1, fixed-before-release 43.

Defect	Severity	Status	Found by	Fixed in
`RSD-erpnext-a2cd86c7e1` Secret written in plain text or to the log by default [defects, defects #149499]	medium	open	build strategy record	—
`RSD-erpnext-a6ceddbba3` Database handbook: Multi-site block reuses ./erpnext.env without saying the DB_ROOT_PASSWORD line removed earlier must be restored; the command fails with a clear message, so minor. [defects, defects #149502]	low	fixed-in-release	held review (review model)	v16.53.0-CE-ubuntu24.04-r1
`RSD-erpnext-8632ed6698` Admin handbook: The sentence says the logs directory has no counterpart and tells the customer to move its contents with the product's backup and restore; bench backup does not contain logs, and the directory does… [defects, defects #149503]	low	open	held review (review model)	—
`RSD-erpnext-9785c5ee15` Database handbook: The check runs in the container, where the shell variable KEY set on the host does not exist, so it always prints 1 (an empty value) even when the key was read correctly. [defects, defects #150245]	high	fixed-before-release	held review (review model)	—
`RSD-erpnext-16e615e5a9` Database handbook: The single-quoted command is evaluated by the container's shell, where KEY is unset, so it always prints 0. [defects, defects #150246]	high	fixed-before-release	held review (review model)	—
`RSD-erpnext-e9249c7a29` Admin handbook: The upgrade/rollback `docker run` uses variables the image does not read. [defects, defects #150247]	high	fixed-before-release	held review (review model)	—
`RSD-erpnext-8eba509ad4` Admin handbook: The upgrade `docker run` in the second Upgrading section sets six variables that do not exist in this image (and contradicts the first Upgrading section, which uses DB_HOST). [defects, defects #150248]	high	fixed-before-release	held review (review model)	—
`RSD-erpnext-408eb8ae90` Admin handbook: set-admin-password changes only the Administrator account's password. [defects, defects #150249]	high	fixed-before-release	held review (review model)	—
`RSD-erpnext-97b429fdb2` Database handbook: The sentence puts /home/frappe/frappe-bench/logs on the sites volume. [defects, defects #150250]	high	fixed-before-release	held review (review model)	—
`RSD-erpnext-bc6dd51421` Admin handbook: Round 2 finding still open (RSD-erpnext-bc6dd51421): the product's backup writes only the database dump, site_config_backup.json and the files tarballs, and restore reads only those, so it cannot… [defects, defects #150251]	low	open	held review (review model)	—
`RSD-erpnext-c9369598b1` Admin handbook: Contradicts the measured behaviour and the handbooks' own statement that a restore keeps the scheduler state of the site it restores over; the instruction to run enable-scheduler after any restore… [defects, defects #150252]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-75b741a40e` Database handbook: Contradicts the measured behaviour and the handbooks' own statement that a restore keeps the scheduler state of the site it restores over; the instruction to run enable-scheduler after any restore… [defects, defects #150253]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-33c75b4ed9` Database handbook: Contradicts the measured behaviour and the handbooks' own statement that a restore keeps the scheduler state of the site it restores over; the instruction to run enable-scheduler after any restore… [defects, defects #150254]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-71d6d75955` Database handbook: Contradicts the measured behaviour and the handbooks' own statement that a restore keeps the scheduler state of the site it restores over; the instruction to run enable-scheduler after any restore… [defects, defects #150255]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-bd002f0b53` Database handbook: Contradicts the measured behaviour and the handbooks' own statement that a restore keeps the scheduler state of the site it restores over; the instruction to run enable-scheduler after any restore… [defects, defects #150256]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-1a0fbeb2ac` Database handbook: Contradicts the measured behaviour and the handbooks' own statement that a restore keeps the scheduler state of the site it restores over; the instruction to run enable-scheduler after any restore… [defects, defects #150257]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-19564e7ec3` Admin handbook: States that every supervised process listens on port 8080, contradicting the handbook's own statement that only nginx does. [defects, defects #150258]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-1755c8c370` Admin handbook: States that every supervised process listens on port 8080, contradicting the handbook's own statement that only nginx does. [defects, defects #150259]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-57b581c5f4` Admin handbook: States that every supervised process listens on port 8080, contradicting the handbook's own statement that only nginx does. [defects, defects #150260]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-bf6d8ecff2` Database handbook: States that every supervised process listens on port 8080, contradicting the handbook's own statement that only nginx does. [defects, defects #150261]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-ecf8833ab8` Admin handbook: The documented default is a URL with a scheme and database number; the variable's default is host:port and the entrypoint adds the redis:// prefix itself. [defects, defects #150262]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-1103eead1e` Admin handbook: Same as the cache line: the default is host:port, not a URL. [defects, defects #150263]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-5046c7208a` Admin handbook: Says the queue instance keeps jobs 'in memory only', which contradicts the documented start command (the queue Redis has a data volume) and the handbook's advice to persist it. [defects, defects #150264]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-ad63fa8a70` Admin handbook: Describes a shared queue instance and then requires separate queue addresses; the customer cannot tell what to configure. [defects, defects #150265]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-7ffe855ba2` Database handbook: Claims a 200 from ping shows all five supervisord programs are running; it shows only that nginx and gunicorn answer (the scheduler was disabled and inactive while ping returned 200). [defects, defects #150266]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-404e434637` Admin handbook: The command is shown with an unquoted <new-password> argument, which writes the password to bench.log and, with spaces or $, is split or expanded by the shell. [defects, defects #150267]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-a9810016bd` API guide: The guide says it lists the routes declared in frappe/api/v2.py and names the new /api/v2/mcp and /api/v2/discovery routes as served, but its Routes table omits them. [defects, defects #150268]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-56e9b1962a` Database handbook: The sentence tells a customer with non-default MariaDB or Redis hosts that the new container finds them on the volume, so the upgrade run omits the variables and the container waits 120 s for the… [defects, defects #151023]	high	fixed-before-release	held review (review model)	—
`RSD-erpnext-883024208d` Database handbook: ping answers from nginx and gunicorn; it says nothing about the other supervisord programs. [defects, defects #151024]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-460b3d1ae5` Database handbook: Claims ping verifies the Socket.IO process and 'supporting services', which it does not. [defects, defects #151025]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-13174e8932` Database handbook: The paragraph first allows a shared queue instance and then requires separate queue addresses; the customer cannot tell what to configure. [defects, defects #151026]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-8e239dcde7` Database handbook: db_host and db_port are not in site_config.json; a customer who edits them there is overwritten at the next start. [defects, defects #151027]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-98e5475518` Database handbook: No Email Queue rows exist until the job runs, so there are no email records in MariaDB to remain; the sentence contradicts the handbook's own statements two sections earlier. [defects, defects #151028]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-607379022c` Admin handbook: Before the job runs the database holds nothing of the message, so it is not 'backed by the database'; it contradicts 1271 and 1604. [defects, defects #151029]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-5cd023d9d1` Admin handbook: The sentence ties a post-migrate HTTP 500 to print formats, which no record supports, and sends the customer to change formats that are unrelated to the failure. [defects, defects #151030]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-c150cb7a65` Admin handbook: The commands read from /tmp in a container that has no backup files and is not said to run the previous image; the complete steps are only in the first Upgrading section. [defects, defects #151031]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-031f6eebc0` Database handbook: The placeholder paths do not say the files must first be copied into the container. [defects, defects #151032]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-7c9927a2f5` Admin handbook: Socket.IO listens on *:9000, so 'the other processes open no external port' is false for any container on the same network. [defects, defects #151033]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-cba4a60246` Database handbook: gunicorn listens on TCP loopback, not a local socket, Socket.IO listens on all interfaces, and the worker and scheduler listen on nothing; the sentence is wrong for all four. [defects, defects #151034]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-b088bed9df` Admin handbook: 'Internal' for Socket.IO restates the round-2 error in another section: the process listens on *:9000, so it is reachable from any container on the same network. [defects, defects #151812]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-23f9c49d98` Admin handbook: Same paraphrase of the round-2 finding: Socket.IO is not internal to the container, it listens on *:9000. [defects, defects #151813]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-2257e484ad` Database handbook: Same paraphrase of the round-2 finding; DB_HANDBOOK.md:809 already states the correct fact. [defects, defects #151814]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-b0ab1cffc4` Admin handbook: 'Only … more than 100 recipients' is incomplete: EmailQueue.process also enqueues the row-writing job when queue_separately is set, so a lost Redis queue can also drop those emails. [defects, defects #151815]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-b99ae31f94` Database handbook: Same incomplete 'only' as ADMIN_HANDBOOK.md:1227. [defects, defects #151816]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-586b02267b` Admin handbook: The command below it is `wait-for-it -t 5 <db_host>:<db_port>`, a TCP check of MariaDB from inside the container; it does not show that the new container is ready. [defects, defects #151817]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-538504d23f` Database handbook: bench.log holds command lines, not the container's environment variables; only the values the entrypoint expands into the new-site arguments appear. [defects, defects #151818]	low	fixed-before-release	held review (review model)	—
`RSD-erpnext-c4de86587d` Database handbook: 'Always' contradicts DB_HANDBOOK.md:974 and 1090 ('on a new volume'): the key is needed only when the sites volume is new. [defects, defects #151819]	low	fixed-before-release	held review (review model)	—

Verification

2 items not recorded

Reproduced before publishingyes (rebuilt digest sha256:a9d4ca0313ef5394da5f0084c746f07d714da723d25c68a2190383bc00ef61ef · published digest sha256:a9d4ca0313ef5394da5f0084c746f07d714da723d25c68a2190383bc00ef61ef · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 352) [docs/provenance/REPRO_VERIFICATION.json, verified]
Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 811 package_archive gate_result.g8.result]
Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-01T13:59:39Z · failing Docker Scout counts 162 packages with copyleft licences (GPL, LGPL, MPL), 155 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
First own scan of the releaseA (at 2026-11-01T14:14:02Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-11-01T06:20:12Z) [image_scans, image_scans #1873]
Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-01T13:58:43Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
Image signature transparency-log entries
- log index 3626152615 · transparency-log entry
- log index 3626155036 · transparency-log entry
[deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3632123729 · transparency-log entry · integrated 2026-11-01T14:10:04Z) [ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
Signed attestations
- kind provenance · digest sha256:6b7ded6b8c8451a6e0f0dccbca5fc5a995a42696fc7bae89b1d8b5f195b3fce4 · state attached · log index 3632125505 · transparency-log entry
- kind sbom · digest sha256:6b7ded6b8c8451a6e0f0dccbca5fc5a995a42696fc7bae89b1d8b5f195b3fce4 · state attached · log index 3632127297 · transparency-log entry
- kind vsa · digest sha256:6b7ded6b8c8451a6e0f0dccbca5fc5a995a42696fc7bae89b1d8b5f195b3fce4 · state attached · log index 3632129859 · transparency-log entry
- kind provenance · digest sha256:a9d4ca0313ef5394da5f0084c746f07d714da723d25c68a2190383bc00ef61ef · state attached · log index 3632131875 · transparency-log entry
- kind sbom · digest sha256:a9d4ca0313ef5394da5f0084c746f07d714da723d25c68a2190383bc00ef61ef · state attached · log index 3632134153 · transparency-log entry
- kind vsa · digest sha256:a9d4ca0313ef5394da5f0084c746f07d714da723d25c68a2190383bc00ef61ef · state attached · log index 3632137170 · transparency-log entry
(at 2026-11-01T14:10:04Z) [attestations.json, results]

Offline clean-room rebuilds

2026-11-01T11:04:29Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:a9d4ca0313ef5394da5f0084c746f07d714da723d25c68a2190383bc00ef61ef [clean-room rebuild ledger, runs[576]]

Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

Fully recorded

Image pushed (internal tag), publish_image passed2026-11-01T09:58:38Z [stage_runs, stage_runs chain 811 stage publish_image]
Release tag promoted2026-11-01T14:11:59Z (method imagetools_create_retag_by_digest_no_rebuild · digest sha256:6b7ded6b8c8451a6e0f0dccbca5fc5a995a42696fc7bae89b1d8b5f195b3fce4 · tag readystack/erpnext:v16.53.0-CE-ubuntu24.04-r1) [deliverables/provenance/PROMOTION_RECORD.json, promoted_at]
Archive manifests written2026-11-01T14:05:17Z [PUBLISH_MANIFEST.json, published_at]
Archive cut over on prodasset, package_archive passed2026-11-01T14:13:47Z [stage_runs, stage_runs chain 811 stage package_archive]
Cut-over markerpresent (chain 811) [.cutover.json]
Release checklist and site event2026-11-01T14:13:46Z (status complete · site event 309 · steps grade a verified done · release tag promoted done · cosign signed done · release evidence recorded done · contract gate passed done · archive published done · hub readme live done · reproducibility recorded done · defects ledger published done · catalog available done · build request fulfilled done · seo regenerated skipped · site catalogue refreshed done · site grade recorded done · site queue synced done · customer requests charged done · owners notified done) [deliverables/provenance/RELEASE_CHECKLIST.json, run_at]

Packages and CPU level

Fully recorded

Packages in the image456 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 1181 · probed 2026-11-02T17:03:14Z · source backfill) [release_images, isa_level_hard]

History

2 events

2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records
2026-11-03T01:22:57Z repack: previous sha256 4209db3b4041f3fb94d93acce4d689b1ddf6d8eda7c5e524c941683bc54aa599 · sha256 775ac5a8b5981edeb68adc736884e5b89bc6eddcd9c8509d45dbc53ec5506aea · reason customer kit files brought up to the current engine: every pinned input's reason (docs/PINS.md, docs/provenance/PINS.json) and docs/PROVENANCE.md's section pointing at it, rendered by release/pin_reasons.py; docs/PROVENANCE.md's 'Build trail' section pointing at the signed build trail beside the archive (release/build_trail.py); not image inputs; image and every build input unchanged · label kitfix · replaced docs/PROVENANCE.md · added docs/PINS.md, docs/provenance/PINS.json · record MANIFEST.json repack_history

Records

25 records

Record	Where it is	Rows
`docs/defects/defects.json`	inside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.tar.gz)	—
`docs/provenance/IMAGE_EVIDENCE.json`	inside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.tar.gz)	—
`docs/provenance/LOCKED_DIGEST.txt`	inside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.tar.gz)	—
`docs/provenance/REPRO_VERIFICATION.json`	inside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.tar.gz)	—
`docs/provenance/SOURCE_TREE_HASH.json`	inside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.tar.gz)	—
`.cutover.json`	beside the archive (prodasset /data/production/erpnext/v16.53.0-CE-ubuntu24.04-r1/)	—
`MANIFEST.json`	beside the archive (prodasset /data/production/erpnext/v16.53.0-CE-ubuntu24.04-r1/)	—
`PUBLISH_MANIFEST.json`	beside the archive (prodasset /data/production/erpnext/v16.53.0-CE-ubuntu24.04-r1/)	—
`ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.rebuild.json`	beside the archive (prodasset /data/production/erpnext/v16.53.0-CE-ubuntu24.04-r1/)	—
`ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r1.rebuild.json.sigstore`	beside the archive (prodasset /data/production/erpnext/v16.53.0-CE-ubuntu24.04-r1/)	—
`SCOUT_EVIDENCE.json`	beside the archive (prodasset /data/production/erpnext/v16.53.0-CE-ubuntu24.04-r1/)	—
`clean-room rebuild ledger`	the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)	—
`build_requests`	sadb, ReadyStack's engine database (not published)	487
`chains`	sadb, ReadyStack's engine database (not published)	811
`defects`	sadb, ReadyStack's engine database (not published)	erpnext v16.53.0-CE-ubuntu24.04-r1
`drive_runs`	sadb, ReadyStack's engine database (not published)	chain 811
`held_rounds`	sadb, ReadyStack's engine database (not published)	chain 811
`image_scans`	sadb, ReadyStack's engine database (not published)	1873
`micro_step_runs`	sadb, ReadyStack's engine database (not published)	chain 811
`release_images`	sadb, ReadyStack's engine database (not published)	erpnext v16.53.0-CE-ubuntu24.04-r1
`stage_events`	sadb, ReadyStack's engine database (not published)	chain 811
`stage_runs`	sadb, ReadyStack's engine database (not published)	chain 811
`attestations.json`	the chain's workspace on the controller (not published)	—
`deliverables/provenance/PROMOTION_RECORD.json`	the chain's workspace on the controller (not published)	—
`deliverables/provenance/RELEASE_CHECKLIST.json`	the chain's workspace on the controller (not published)	—