PostHog master-20261022-b904ac8-CE-ubuntu24.04-r4 build trail
How ReadyStack built readystack/posthog:master-20261022-b904ac8-CE-ubuntu24.04-r4 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/posthog:master-20261022-b904ac8-CE-ubuntu24.04-r4 - Index digestsha256:8e8a4b3762d49c1f48a119e47d0d17bab13b2252b548965011e1042dbfc215d2
- linux/amd64 digestsha256:e19c4dc815650fb7caf4793b8570a7bc28de2258b69e24d24799fee202795fe5
- Archive
ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.tar.gz - Archive SHA-256 now27957826341e369cf16750bc07cf1d0f3f30e4546b72804e0509300439d44b87
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-09T18:32:55Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.trail.json.sigstore ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductPostHog (posthog) [MANIFEST.json]
- Release tagmaster-20261022-b904ac8-CE-ubuntu24.04-r4 [MANIFEST.json]
- Imagereadystack/posthog:master-20261022-b904ac8-CE-ubuntu24.04-r4 [MANIFEST.json]
- Image index digestsha256:8e8a4b3762d49c1f48a119e47d0d17bab13b2252b548965011e1042dbfc215d2 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:e19c4dc815650fb7caf4793b8570a7bc28de2258b69e24d24799fee202795fe5 [ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.tar.gz (bytes 3093911275) [MANIFEST.json]
- Archive sha256 at publish27957826341e369cf16750bc07cf1d0f3f30e4546b72804e0509300439d44b87 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/PostHog/posthog [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refb904ac8008e531c8aaeaf58e523cf97cff9fba41 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commitb904ac8008e531c8aaeaf58e523cf97cff9fba41 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hashf891353fb4511d2e73ff287c2eaf25af3d55335185787f784cf4ce68a361004b (files 59938) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:fba3fcd61875ea148e1cd3ef66a94b04f4ef0587c6386d120617d59e06e24817 [ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1792630321 (utc 2026-10-22T00:52:01Z) [ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.rebuild.json, engine]
- Engine commit(s)
- commit 8d73ace4259a559ec2f1af17ab551dc3f98e9369 · dirty yes · first drive 3910
- commit f9f0982b11f73e34e6284a1c8f2e6d25caff5b1d · dirty yes · first drive 3931
- commit e16f63ef90582ad5c964b8c043d546ebe17b9870 · dirty yes · first drive 3934
- commit d5dd95cc70cbde883ad7cde173904a80a5a6a342 · dirty yes · first drive 4009
- commit 587a2d871bdeb624259b167291c9f2cf9dd6c1d4 · dirty yes · first drive 4055
- commit 5163af4d4c1993a6202ab252a3207b9300f6e3e6 · dirty yes · first drive 4078
Why this release exists
Fully recorded- Chain909 (created 2026-11-09T00:45:05Z · trigger customer_request · upstream version master-20261022-b904ac8) [chains, chains #909]
- Requestbuild request #601 (rebuild) (requested at 2026-11-09T00:28:33Z · requested by kitforge-agent · version master-20261022-b904ac8) [build_requests, build_requests #601]
- Reasonrevision master-20261022-b904ac8-CE-ubuntu24.04-r4: same-commit security revision (klauspost/compress 1.20.2, oauthlib 4.0.1, apt and libpcre2 floors), PR #264 [build_requests, build_requests #601 request_reason]
- Supersedesreadystack/posthog:master-20261022-b904ac8-CE-ubuntu24.04-r3 (chain 804) [chains, chains #804]
The path through the harness
Fully recorded1 chain · 6 drives · 18 stages · 2 rewinds
Chain 909 release · ready_to_ship
Created 2026-11-09T00:45:05Z, upstream master-20261022-b904ac8, build request 601 [chains, chains #909]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 3910 | 2026-11-09T00:46:05Z | 113.1 | build host 2 withhold-publish | stall at remediate; first failed check security_report:md_min_sections:2; 8 ticks [drive_runs, drive_runs #3910] |
| 3931 | 2026-11-09T02:58:32Z | 0.2 | build host 2 withhold-publish | repeat_gate_failure at remediate; first failed check security_report:md_min_sections:2; 1 tick [drive_runs, drive_runs #3931] |
| 3934 | 2026-11-09T03:09:34Z | 194.8 | build host 2 withhold-publish | stage_failed at package_archive; first failed check g8; 14 ticks [drive_runs, drive_runs #3934] |
| 4009 | 2026-11-09T11:48:34Z | 152.1 | build host 2 withhold-publish | ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4009] |
| 4055 | 2026-11-09T15:22:16Z | 82.8 | build host 2 withhold-publish | ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4055] |
| 4078 | 2026-11-09T17:06:13Z | — | build host 2 publish-held | not recorded [drive_runs, drive_runs #4078] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-09T00:46:16Z | 2026-11-09T00:46:16Z | 1 | 4
|
order_json 2754fdb07eb8… |
acquire |
2026-11-09T00:46:57Z | 2026-11-09T00:47:02Z | 1 | 12
|
source_tree ba3553bfac2b…license_file 6d82d67dba42…custody_inputs 3adba513bc2a…source_tree_hash 823655809b5f…source_file_manifest ec3c98b73a1d… |
plan |
2026-11-09T00:47:32Z | 2026-11-09T00:47:33Z | 1 | 10
|
recon_report 7dcae4f515d9…input_pin_plan facb8b796994…toolchain_lock bf5f522e47e7… |
assemble_kit |
2026-11-09T02:38:27Z | 2026-11-09T02:38:28Z | 1 | 27
|
dockerfile 3dfd78a96115…build_recipe 15d3c48edb9b…system_pinning 559dab462199…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health 08c68b4bf342…verify_offline_sh 3e8184ea230c…base_image_digests be066fe4d52a…dockerfile_offline 3dfd78a96115…first_build_digest 7079492095b3… |
remediate |
2026-11-09T02:38:56Z | 2026-11-09T03:10:08Z | 6 | 8
|
vendored_apt e3b0c44298fc…remediation_log 311389796ef0…security_report a8b476fc74a8… |
build_kit |
2026-11-09T03:51:18Z | 2026-11-09T03:51:19Z | 1 | 9
|
cosign_stamp 6a55022fbee2…locked_digest 467215251aa8…freeze_manifest 62b73227ae95…offline_rebuild_transcript fe946275cf07… |
verdict |
2026-11-09T04:06:50Z | 2026-11-09T04:06:51Z | 1 | 8
|
scout_verdict 6d79d0edbf64… |
publish_image |
2026-11-09T04:12:19Z | 2026-11-09T04:12:20Z | 1 | 7
|
hub_readme 68acc0c969ef…promotion_record ac3b7fd1744d… |
boot_instance |
2026-11-09T05:00:38Z | 2026-11-09T05:00:42Z | 2 | 3
|
instance_handle 703e5d0091e6… |
sbom |
2026-11-09T05:03:41Z | 2026-11-09T05:03:43Z | 1 | 5
|
sbom_md 1a2d6ff254f2…sbom_json 9b7ce6537eaf… |
schema_discovery |
2026-11-09T05:03:45Z | 2026-11-09T05:03:46Z | 1 | 7
|
schema_hash b32d75f9c119…dependency_tree c859b592e1b5…table_classification f911b4b61b68… |
admin_handbook |
2026-11-09T05:03:58Z | 2026-11-09T05:03:59Z | 1 | 7
|
api_map e35830daf231…admin_handbook 33424a7e5049… |
db_handbook |
2026-11-09T05:04:12Z | 2026-11-09T05:04:13Z | 1 | 8
|
db_handbook 385f3bfb3ea0…seed_isolation 7b44602693de… |
seed_data |
2026-11-09T05:05:27Z | 2026-11-09T05:05:28Z | 1 | 6
|
seed_data_sql 71091f1daab2…seed_cases_json f8f49969c5ad… |
seed_validate |
2026-11-09T05:05:30Z | 2026-11-09T05:05:31Z | 1 | 3
|
seed_data_contract a00c6924df07… |
usecase_validate |
2026-11-09T05:05:59Z | 2026-11-09T05:06:00Z | 1 | 10
|
failed_tests c5df2d9ae1d1…passed_tests bed2d75a67bc…test_results 60266857775a…usecase_contract ac1f52bab9b3… |
finalize_docs |
2026-11-09T05:06:06Z | 2026-11-09T05:06:06Z | 1 | 9
|
defects_json 0e73b5605b0e…release_notes e7e50ec30f85…api_integration_guide 6bb4453089e9… |
package_archive invalidated 2026-11-09T17:05:31Z |
2026-11-09T06:24:21Z | 2026-11-09T16:45:00Z | 3 | 35 (final gate PASS)
|
sale_tar c811c27b41dd…checksums ac5041df7a2c…verify_md 996f6f76bce0…rebuild_md 4a6564522aff…manifest_txt 7577b0500780…actions_jsonl adeacb699be0…provenance_md 82603f80a292…assetchain_log_md e9eccaec0c0f…assetchain_log_json 9cd6b9b1edfa… |
[stage_runs]
Rewinds
- 2026-11-09T15:08:23Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29245] - 2026-11-09T17:05:31Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29453]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-09T16:45:00Z.
6 calls over 3 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 6672 | — |
remediate | 3 | 0 | 0 | 1 | 0 | 14356 | L-A08, L-038, L-036, L-034, L-032 |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 1609 | — |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
2 rounds, 2 counted, $0.93 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-09T14:23:11Z | 0 | 1 | 1 | findings to repackage [held_rounds, held_rounds #1634] | $0.55 | 3 rounds, $40.00 | d2504f9dd219… |
| 2 | 2026-11-09T16:47:04Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1650] | $0.38 | 3 rounds, $40.00 | c811c27b41dd… |
Defects
Fully recorded- Ledger entries4 [defects, defects where product_slug=posthog and this tag or chain]
- Disclosed in the archive4 [docs/defects/defects.json, entries]
4 ledger entries: by severity low 3, high 1; by status wont-fix-by-design 1, fixed-before-release 3.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-posthog-b439e7a373Enterprise / non-open-source components are removed from the source before the build: ee [defects, defects #195098] | low | wont-fix-by-design | build strategy record | — |
RSD-posthog-f069e5776bThe r3 admin handbook does not state the CPU requirement its strategy declares [defects, defects #196881] | low | fixed-before-release | image scan | — |
RSD-posthog-f3745921ddDatabase handbook: Unchanged line still names the superseded r3 suffix and 'third' rebuild in a release whose tag is r4 (missed by the tag rewrite); contradicts the pull command two lines above. [defects, defects #213879] | high | fixed-before-release | held review (review model) | — |
RSD-posthog-9606a8cc72Release notes: clickhouse-config requires a <directory> argument and only copies files into it; it does not refresh the volume, and the handbooks give a different refresh procedure (remove volume, rerun the fill… [defects, defects #213880] | low | fixed-before-release | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:e19c4dc815650fb7caf4793b8570a7bc28de2258b69e24d24799fee202795fe5 · published digest sha256:e19c4dc815650fb7caf4793b8570a7bc28de2258b69e24d24799fee202795fe5 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 825) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T17:10:16Z · failing Docker Scout counts 115 packages with copyleft licences (GPL, LGPL, MPL), 103 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T17:06:25Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3761055359 · transparency-log entry
- log index 3761055946 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3767876689 · transparency-log entry · integrated 2026-11-09T18:29:32Z) [ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:8e8a4b3762d49c1f48a119e47d0d17bab13b2252b548965011e1042dbfc215d2 · state attached · log index 3767880738 · transparency-log entry
- kind sbom · digest sha256:8e8a4b3762d49c1f48a119e47d0d17bab13b2252b548965011e1042dbfc215d2 · state attached · log index 3767881840 · transparency-log entry
- kind vsa · digest sha256:8e8a4b3762d49c1f48a119e47d0d17bab13b2252b548965011e1042dbfc215d2 · state attached · log index 3767883361 · transparency-log entry
- kind provenance · digest sha256:e19c4dc815650fb7caf4793b8570a7bc28de2258b69e24d24799fee202795fe5 · state attached · log index 3767884540 · transparency-log entry
- kind sbom · digest sha256:e19c4dc815650fb7caf4793b8570a7bc28de2258b69e24d24799fee202795fe5 · state attached · log index 3767885603 · transparency-log entry
- kind vsa · digest sha256:e19c4dc815650fb7caf4793b8570a7bc28de2258b69e24d24799fee202795fe5 · state attached · log index 3767886574 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/posthog/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-09T14:24:05Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:e19c4dc815650fb7caf4793b8570a7bc28de2258b69e24d24799fee202795fe5 [clean-room rebuild ledger, runs[705]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-09T04:12:20Z [stage_runs, stage_runs chain 909 stage publish_image]
- Archive manifests written2026-11-09T18:09:25Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv3 (used v4 · baseline v2 · elf files 1460 · probed 2026-11-09T13:16:21Z · source g8) [release_images, isa_level_hard]
History
2 events- 2026-11-09T18:32:55Z generated: by KitForge release/build_trail.py · generator commit 42f7d820a085f634d876bc4b32741740f71065b2
- 2026-11-09T18:40:49Z publication: promoted at 2026-11-09T18:34:23Z · promoted digest sha256:8e8a4b3762d49c1f48a119e47d0d17bab13b2252b548965011e1042dbfc215d2 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 429 · checklist status complete · checklist at 2026-11-09T18:40:49Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/posthog/master-20261022-b904ac8-CE-ubuntu24.04-r4/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/posthog/master-20261022-b904ac8-CE-ubuntu24.04-r4/), as staged for publishing | — |
ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.rebuild.json | beside the archive (prodasset /data/production/posthog/master-20261022-b904ac8-CE-ubuntu24.04-r4/), as staged for publishing | — |
ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r4.rebuild.json.sigstore | beside the archive (prodasset /data/production/posthog/master-20261022-b904ac8-CE-ubuntu24.04-r4/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/posthog/master-20261022-b904ac8-CE-ubuntu24.04-r4/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 601 |
chains | sadb, ReadyStack's engine database (not published) | 909 |
defects | sadb, ReadyStack's engine database (not published) | posthog master-20261022-b904ac8-CE-ubuntu24.04-r4 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 909 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 909 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 909 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 909 |
release_images | sadb, ReadyStack's engine database (not published) | posthog master-20261022-b904ac8-CE-ubuntu24.04-r4 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 909 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 909 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |