Home Assistant 2026.11.0-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/homeassistant:2026.11.0-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/homeassistant:2026.11.0-CE-ubuntu24.04-r1
  • Index digestsha256:8c7a176940d99abeb429a7d27bcd463f0829967a0381b79d74b07de119e74297
  • linux/amd64 digestsha256:2e1d530d1c4ee60158ca626935e19f4d94630df71344f0affd5a2a7ebf25e373
  • ArchiveReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 now83a5daa34d7d82443fca3300a208aecb17c9c77f616aa51dc51e0e5f115349c4
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T19:28:35Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.trail.json
ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.trail.jsonReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.trail.mdHome Assistant product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductHome Assistant (homeassistant) [MANIFEST.json]
  • Release tag2026.11.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/homeassistant:2026.11.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:8c7a176940d99abeb429a7d27bcd463f0829967a0381b79d74b07de119e74297 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:2e1d530d1c4ee60158ca626935e19f4d94630df71344f0affd5a2a7ebf25e373 [ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.tar.gz (bytes 724990710) [MANIFEST.json]
  • Archive sha256 at publish83a5daa34d7d82443fca3300a208aecb17c9c77f616aa51dc51e0e5f115349c4 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/home-assistant/core [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref2026.11.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit74cf5a49c63ed8d4d87717844bf14f79c28c9cea [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash158e2a30e3c7b45afcce072c53838f694d93ca420dc43be037d69bf25d034eca (files 30205) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:ad74958c2c330296353cb04b56e2da2a65ce1d38346f70e43f6549a8428c8978 [ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793813352 (utc 2026-11-04T17:29:12Z) [ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit 9297e5f1902d782e43b6ebf8fe9b54eba0e82889 · dirty yes · first drive 3860
    • commit e16f63ef90582ad5c964b8c043d546ebe17b9870 · dirty yes · first drive 3935
    • commit a751209144665e2ca5fa1d984f6504e85813005f · dirty yes · first drive 3956
    • commit f6caefbb470c05b7c5aa6841cba8ce9287ab8187 · dirty yes · first drive 3969
    • commit 5d0ff967b304c4cd787659a1843c76de2a7e8063 · dirty yes · first drive 4090
    • commit 77d96fdb2d5be3a75c2cf4d6d916a8af08c6d687 · dirty yes · first drive 4100
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain895 (created 2026-11-08T18:26:28Z · trigger customer_request · upstream version 2026.11.0) [chains, chains #895]
  • Requestbuild request #592 (rebuild) (requested at 2026-11-08T15:09:02Z · requested by kitforge-agent · version 2026.11.0) [build_requests, build_requests #592]
  • Reasonretarget to 2026.11.0: a newer upstream release (rule 1) [build_requests, build_requests #592 request_reason]
  • Supersedesreadystack/homeassistant:2026.10.4-CE-ubuntu24.04-r2 (chain 800) [chains, chains #800]

The path through the harness

Fully recorded

1 chain · 6 drives · 18 stages · 4 rewinds

Chain 895 release · ready_to_ship

Created 2026-11-08T18:26:28Z, upstream 2026.11.0, build request 592 [chains, chains #895]

DriveStartedMinutesBuild hostHow it stopped
38602026-11-08T18:27:02Z95.2build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #3860]
39352026-11-09T03:12:42Z21.3build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3935]
39562026-11-09T05:08:44Z13.3build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3956]
39692026-11-09T06:08:41Z14build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3969]
40902026-11-09T18:25:53Z13.6build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4090]
41002026-11-09T19:14:05Z—build host 3 publish-held not recorded [drive_runs, drive_runs #4100]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-08T18:27:13Z2026-11-08T18:27:13Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json d46c07ae688e…
acquire 2026-11-08T18:27:30Z2026-11-08T18:27:32Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 83f91df8ae5c…
license_file c71d239df917…
custody_inputs 0030b5d8017a…
source_tree_hash b18186483505…
source_file_manifest 8d8166593458…
plan 2026-11-08T18:28:24Z2026-11-08T18:28:25Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 6d1a45b27557…
input_pin_plan 5c860605a8b0…
toolchain_lock 4ef3549278bf…
assemble_kit 2026-11-08T18:43:22Z2026-11-08T18:43:23Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 33755763d151…
build_recipe 1793ef38b120…
system_pinning 53a8ed1eb1d1…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 722b8ba5caaf…
verify_offline_sh 3e8184ea230c…
base_image_digests c3d6a7ac1257…
dockerfile_offline 33755763d151…
first_build_digest 6497207b202d…
remediate 2026-11-08T18:44:05Z2026-11-08T18:44:06Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 213be34a47a4…
security_report d850dfb9426c…
build_kit 2026-11-08T19:03:22Z2026-11-08T19:03:23Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp a52d5a14e3e4…
locked_digest b23cb39990da…
freeze_manifest 5bdf55a1c7bb…
offline_rebuild_transcript 9662567d9ad0…
verdict 2026-11-08T19:08:06Z2026-11-08T19:08:06Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 4187818c328e…
publish_image 2026-11-08T19:10:04Z2026-11-08T19:10:04Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 8c121746ae8f…
promotion_record 0a8484e72b8d…
boot_instance 2026-11-08T19:10:21Z2026-11-08T19:10:24Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 1f9cae046fc7…
sbom 2026-11-08T19:11:19Z2026-11-08T19:11:20Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 89a175d5d92d…
sbom_json 06fc555ab638…
schema_discovery 2026-11-08T19:11:25Z2026-11-08T19:11:26Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 25fe32554aae…
dependency_tree 91f0a7ca88a5…
table_classification 86c57b25e180…
admin_handbook 2026-11-08T19:22:06Z2026-11-08T19:22:07Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 0202ca54f70c…
admin_handbook 49cd5f066b69…
db_handbook 2026-11-08T19:33:13Z2026-11-08T19:33:14Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 539885ea02e2…
seed_isolation a1bf4a1d85d9…
seed_data 2026-11-08T19:33:21Z2026-11-08T19:33:22Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql fef3315de896…
seed_cases_json 87bd9615bd0b…
seed_validate 2026-11-08T19:33:25Z2026-11-08T19:33:26Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 0edd13fdee10…
usecase_validate 2026-11-08T19:33:43Z2026-11-08T19:33:44Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 9f2095246a90…
test_results 93b2c01b6212…
usecase_contract 6ea4c52e9513…
finalize_docs 2026-11-08T19:46:34Z2026-11-08T19:46:35Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 26a168dd1720…
release_notes e26bad2c05b0…
api_integration_guide 49409f305af0…
package_archive invalidated 2026-11-09T19:13:39Z 2026-11-08T20:02:14Z2026-11-09T18:39:27Z5
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 2289f40308cb…
checksums cbc9671c79eb…
verify_md 1971b4d90e38…
rebuild_md 3ebb05b13ae8…
manifest_txt e183265830e8…
actions_jsonl 11ae454639da…
provenance_md c7e715b5b5c5…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 387cd7cdc383…

[stage_runs]

Rewinds

  • 2026-11-09T05:07:51Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28024]
  • 2026-11-09T06:05:28Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28060]
  • 2026-11-09T07:13:59Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28191]
  • 2026-11-09T19:13:39Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29663]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T18:39:27Z.

262 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 011364 —
remediate2001 012743 L-A08, L-038, L-036, L-034, L-032
admin_handbook783203 12528498 —
db_handbook893703 15607933 —
usecase_validate1001 01619 —
finalize_docs903903 16643795 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

4 rounds, 4 counted, $8.00 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T03:35:49Z 81424 findings to repackage [held_rounds, held_rounds #1579] $3.35 3 rounds, $40.00 a82d59bd913a…
22026-11-09T05:23:05Z 0113 findings to repackage [held_rounds, held_rounds #1586] $2.70 3 rounds, $40.00 3e216b611d08…
32026-11-09T06:23:31Z 006 clean to repackage [held_rounds, held_rounds #1595] $0.83 3 rounds, $40.00 370b5df4e0fb…
42026-11-09T18:39:55Z 005 clean to publish [held_rounds, held_rounds #1661] $1.12 3 rounds, $40.00 2289f40308cb…

Defects

Fully recorded
  • Ledger entries63 [defects, defects where product_slug=homeassistant and this tag or chain]
  • Disclosed in the archive63 [docs/defects/defects.json, entries]

63 ledger entries: by severity critical 6, high 15, low 42; by status fixed-before-release 61, open 2.

DefectSeverityStatusFound byFixed in
RSD-homeassistant-d2d4572787
API guide: The command has backslash-escaped quotes inside single quotes, so the file written is invalid JSON and onboarding is not marked finished. [defects, defects #194764]		criticalfixed-before-releaseheld review (review model)—
RSD-homeassistant-aed6173ac1
Admin handbook: Documented configuration makes the recorder fail instead of disabling it. [defects, defects #194765]		criticalfixed-before-releaseheld review (review model)—
RSD-homeassistant-698277411b
Admin handbook: Documented db_url makes the recorder fail with a corrupt-database error and retry forever. [defects, defects #194766]		criticalfixed-before-releaseheld review (review model)—
RSD-homeassistant-20025e235d
Database handbook: The documented backup (docker cp to the host, compress, then restore with the documented tar command) produces a backup that cannot be restored: the container then exits with PermissionError. [defects, defects #194767]		criticalfixed-before-releaseheld review (review model)—
RSD-homeassistant-c940a04d91
API guide: The command that follows is `docker exec`, which cannot run in a stopped container. [defects, defects #194768]		criticalfixed-before-releaseheld review (review model)—
RSD-homeassistant-cc71915888
API guide: The command that follows is `docker exec`, which cannot run in a stopped container. [defects, defects #194769]		criticalfixed-before-releaseheld review (review model)—
RSD-homeassistant-e1bccf0af3
Admin handbook: `docker chown` is not a Docker command. [defects, defects #194770]		highfixed-before-releaseheld review (review model)—
RSD-homeassistant-d70c2033c7
Admin handbook: mDNS (zeroconf) is shipped and loads; the list also disagrees with the same handbook's list of failing integrations (ssdp, usb, go2rtc are missing here). [defects, defects #194771]		highfixed-before-releaseheld review (review model)—
RSD-homeassistant-1e6ce2603c
Admin handbook: False behaviour claim; also contradicts the next sentences of the same section. [defects, defects #194772]		highfixed-before-releaseheld review (review model)—
RSD-homeassistant-acc381108b
Admin handbook: The documented snippet (a bare `default_config:` "without any of those integrations") cannot exclude anything: default_config has a fixed dependency list and an empty config schema. [defects, defects #194773]		highfixed-before-releaseheld review (review model)—
RSD-homeassistant-a59b115d44
Admin handbook: Licence contradiction: zeroconf and icmplib are LGPL (stated so in the same handbook, lines 270/1596/1632); zeroconf is also not a pure-Python wheel. [defects, defects #194774]		highfixed-before-releaseheld review (review model)—
RSD-homeassistant-b260d53b11
Admin handbook: Stated failure (container exits with a permission error) did not reproduce. [defects, defects #194775]		highfixed-before-releaseheld review (review model)—
RSD-homeassistant-d5010b2a54
Admin handbook: Stated failure did not reproduce: /config itself stays writable by uid 999. [defects, defects #194776]		highfixed-before-releaseheld review (review model)—
RSD-homeassistant-8759dd52ab
Database handbook: Stated failure did not reproduce. [defects, defects #194777]		highfixed-before-releaseheld review (review model)—
RSD-homeassistant-492984904f
Database handbook: Stated failure did not reproduce (and the sentence is self-contradictory: the lock file is not a copied file). [defects, defects #194778]		highfixed-before-releaseheld review (review model)—
RSD-homeassistant-f87c8e1ade
Database handbook: Stated failure did not reproduce. [defects, defects #194779]		highfixed-before-releaseheld review (review model)—
RSD-homeassistant-c78861f9e5
Database handbook: Stated failure did not reproduce. [defects, defects #194780]		highfixed-before-releaseheld review (review model)—
RSD-homeassistant-a81c9b7b16
API guide: Stated failure did not reproduce. [defects, defects #194781]		highfixed-before-releaseheld review (review model)—
RSD-homeassistant-090876a1ab
API guide: False: the password can be changed without editing configuration files. [defects, defects #194782]		highfixed-before-releaseheld review (review model)—
RSD-homeassistant-14cf3e7e65
Database handbook: Wrong location and format; the restore command that follows does not apply to Home Assistant's own backup files. [defects, defects #194783]		highfixed-before-releaseheld review (review model)—
RSD-homeassistant-f4eb757b15
Admin handbook: Listed under "accessible without authentication" while stating it needs a token. [defects, defects #194784]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-1c1660196f
Admin handbook: Listed under "Unauthenticated endpoints include" although it requires a token. [defects, defects #194785]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-fdacdbe5d2
API guide: `GET /` and `GET /onboarding.html` are listed as requiring a token, contradicting the same guide's unauthenticated lists (lines 408, 778, 1380). [defects, defects #194786]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-b906a95434
API guide: `GET /` and `GET /onboarding.html` are listed as requiring a token, contradicting the same guide's unauthenticated lists (lines 408, 778, 1380). [defects, defects #194787]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-650f3171a4
API guide: `GET /` and `GET /onboarding.html` are listed as requiring a token, contradicting the same guide's unauthenticated lists (lines 408, 778, 1380). [defects, defects #194788]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-064c4cbfdf
API guide: `GET /` and `GET /onboarding.html` are listed as requiring a token, contradicting the same guide's unauthenticated lists (lines 408, 778, 1380). [defects, defects #194789]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-06116a111d
API guide: `GET /` and `GET /onboarding.html` are listed as requiring a token, contradicting the same guide's unauthenticated lists (lines 408, 778, 1380). [defects, defects #194790]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-b62d6131ef
API guide: `GET /` and `GET /onboarding.html` are listed as requiring a token, contradicting the same guide's unauthenticated lists (lines 408, 778, 1380). [defects, defects #194791]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-215d20ce67
API guide: `GET /` and `GET /onboarding.html` are listed as requiring a token, contradicting the same guide's unauthenticated lists (lines 408, 778, 1380). [defects, defects #194792]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-bc7d7437d6
API guide: `GET /` and `GET /onboarding.html` are listed as requiring a token, contradicting the same guide's unauthenticated lists (lines 408, 778, 1380). [defects, defects #194793]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-93d4aa84b4
Admin handbook: Before the first user exists the endpoint answers 400. [defects, defects #194794]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-bbcb5b95f3
Admin handbook: The chown command is `docker run ... [defects, defects #194795]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-8c116d1ec4
Admin handbook: The release this one supersedes is 2026.10.4-CE-ubuntu24.04-r2 (non-root, uid 999 unchanged), not 2026.4.0. [defects, defects #194796]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-96f40131eb
Database handbook: Contradicts DB_HANDBOOK.md:793/1175 (the root release was Alpine-based). [defects, defects #194797]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-c838ed7636
Admin handbook: `su` is in the image. [defects, defects #194798]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-93a909c76c
Admin handbook: The first onboarding step asks for name, username and password, not an email. [defects, defects #194799]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-26eeb25b41
Admin handbook: tar run as root restores the archived owners. [defects, defects #194800]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-be0baeea12
Admin handbook: Unsupported claim that contradicts ADMIN_HANDBOOK.md:1143-1150 and API_INTEGRATION_GUIDE.md:1639 (stop first). [defects, defects #194801]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-d9d55bab3d
API guide: Contradicts ADMIN_HANDBOOK.md:1039/1393 and DB_HANDBOOK.md:1424 (backup while running). [defects, defects #194802]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-0f544b1f77
API guide: Wrong menu path; contradicts the guide's other 25 descriptions (Security tab of the user profile). [defects, defects #194803]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-28603b4e69
Admin handbook: Omits a failure a fresh install shows at every start after onboarding; the handbook mentions Google Translate only for upgrades. [defects, defects #194804]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-d5d7fa5c63
Admin handbook: The image contains 117 installed Python distributions. [defects, defects #194805]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-14088f3d8b
Docker Hub README: Contradicts bundle/MANIFEST.json (`free_release`: false, `price_cents`: 1000, chain_price_cents 1000). [defects, defects #194806]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-287f2c938b
API guide: The documented password-change command takes effect only after a restart; until then the old (possibly compromised) password stays valid and the new one is refused. [defects, defects #196868]		highfixed-before-releaseheld review (review model)—
RSD-homeassistant-d8629edc3a
API guide: False: .storage/onboarding is not created at first start and does not hold the user store. [defects, defects #196869]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-081b163485
API guide: Wrong location of the profile, contradicting the other descriptions. [defects, defects #196870]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-1e54ceec41
API guide: Unsupported instruction that contradicts the other onboarding procedures. [defects, defects #196871]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-f26b481707
API guide: Two incompatible descriptions of the short-lived token lifetime. [defects, defects #196872]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-9a87a6f642
API guide: Over-broad statement that contradicts the unauthenticated list that follows it. [defects, defects #196873]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-20f0cbeb9b
Admin handbook: The notification is not silenced by the documented change. [defects, defects #196874]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-9dd8cd4ac6
Admin handbook: Unsupported: the failing integrations cannot be disabled individually. [defects, defects #196875]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-676da7b324
Admin handbook: Instruction refers to configuration entries that do not exist. [defects, defects #196876]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-153230bf9c
Admin handbook: Names 2026.4.0 as 'the superseded release'; the release this one supersedes is 2026.10.4-r2, which already runs as uid 999. [defects, defects #196877]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-a17725370c
Admin handbook: Self-contradictory wording and the same wrong 'superseded' release. [defects, defects #196878]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-fafd03c73e
Docker Hub README: README says the kit is free; the manifest prices it at 1000 cents. [defects, defects #196879]		lowopenheld review (review model)—
RSD-homeassistant-a3be2dc45a
Docker Hub README: Free-download claim contradicts the manifest price. [defects, defects #196880]		lowopenheld review (review model)—
RSD-homeassistant-d028ebe876
API guide: auth_provider.homeassistant (which holds the usernames and password hashes) does not exist at first start. [defects, defects #200331]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-b08da2dedc
API guide: Long-lived tokens do expire; the lifespan is a required number of days. [defects, defects #200332]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-b0e04cf272
Database handbook: Same never-expires claim; the WebSocket command requires a lifespan in days. [defects, defects #200333]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-d005e2b317
API guide: The token expires after lifespan days. [defects, defects #200334]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-4c94c9e23b
API guide: The WebSocket auth step is said to require a long-lived token, but any valid access token is accepted and the next paragraphs say a short-lived token is used to request the long-lived one. [defects, defects #222355]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-93fb8a6c16
Release notes: The exact error text is stated as always .ha_run.lock; on a root-owned 750 /config it is .HA_RESTORE. [defects, defects #222356]		lowfixed-before-releaseheld review (review model)—
RSD-homeassistant-a12ef3c61e
Admin handbook: Same single-message claim as the release notes; the file named depends on the directory mode. [defects, defects #222357]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:2e1d530d1c4ee60158ca626935e19f4d94630df71344f0affd5a2a7ebf25e373 · published digest sha256:2e1d530d1c4ee60158ca626935e19f4d94630df71344f0affd5a2a7ebf25e373 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 475) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T19:15:49Z · failing Docker Scout counts 207 packages with copyleft licences (GPL, LGPL, MPL), 203 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T19:14:16Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3768789682 · transparency-log entry · integrated 2026-11-09T19:26:44Z) [ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:8c7a176940d99abeb429a7d27bcd463f0829967a0381b79d74b07de119e74297 · state attached · log index 3768795430 · transparency-log entry
    • kind sbom · digest sha256:8c7a176940d99abeb429a7d27bcd463f0829967a0381b79d74b07de119e74297 · state attached · log index 3768796275 · transparency-log entry
    • kind vsa · digest sha256:8c7a176940d99abeb429a7d27bcd463f0829967a0381b79d74b07de119e74297 · state attached · log index 3768797849 · transparency-log entry
    • kind provenance · digest sha256:2e1d530d1c4ee60158ca626935e19f4d94630df71344f0affd5a2a7ebf25e373 · state attached · log index 3768799154 · transparency-log entry
    • kind sbom · digest sha256:2e1d530d1c4ee60158ca626935e19f4d94630df71344f0affd5a2a7ebf25e373 · state attached · log index 3768800425 · transparency-log entry
    • kind vsa · digest sha256:2e1d530d1c4ee60158ca626935e19f4d94630df71344f0affd5a2a7ebf25e373 · state attached · log index 3768802009 · transparency-log entry
    (at 2026-11-09T19:26:44Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/homeassistant/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T03:35:56Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:2e1d530d1c4ee60158ca626935e19f4d94630df71344f0affd5a2a7ebf25e373 [clean-room rebuild ledger, runs[683]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-08T19:10:04Z [stage_runs, stage_runs chain 895 stage publish_image]
  • Archive manifests written2026-11-09T19:19:28Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 1185 · probed 2026-11-09T18:38:55Z · source g8) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T19:28:35Z generated: by KitForge release/build_trail.py · generator commit 7fc9ad6b7dac22709514b511bc5b2ad1d762fb69
  • 2026-11-09T19:31:27Z publication: promoted at 2026-11-09T19:29:09Z · promoted digest sha256:8c7a176940d99abeb429a7d27bcd463f0829967a0381b79d74b07de119e74297 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 431 · checklist status complete · checklist at 2026-11-09T19:31:27Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/homeassistant/2026.11.0-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/homeassistant/2026.11.0-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/homeassistant/2026.11.0-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-homeassistant-2026.11.0-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/homeassistant/2026.11.0-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/homeassistant/2026.11.0-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)592
chainssadb, ReadyStack's engine database (not published)895
defectssadb, ReadyStack's engine database (not published)homeassistant 2026.11.0-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 895
held_roundssadb, ReadyStack's engine database (not published)chain 895
lesson_recallssadb, ReadyStack's engine database (not published)chain 895
micro_step_runssadb, ReadyStack's engine database (not published)chain 895
release_imagessadb, ReadyStack's engine database (not published)homeassistant 2026.11.0-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 895
stage_runssadb, ReadyStack's engine database (not published)chain 895
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—