Python 3.15.2-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/python:3.15.2-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/python:3.15.2-CE-ubuntu24.04-r1
  • Index digestsha256:5f1cdb25bf4ba47d569eb78ba26f30c4b02683f7e32e76ffd39c49d5b6d612f7
  • linux/amd64 digestsha256:3b42ecdb93bf14ea67bab56d22979b410ce375f084f539277f43d69e4af38274
  • ArchiveReadyStack-python-3.15.2-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 nowcaa9ea252c9a98bce824b920ce40d8a15f489802f2d7e083dd648742edc06179
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-08T17:36:58Z by KitForge release/build_trail.py
  • Sections9 sections, 7 fully recorded; 4 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.trail.json
ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.trail.jsonReadyStack-python-3.15.2-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-python-3.15.2-CE-ubuntu24.04-r1.trail.mdPython product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductPython (python) [MANIFEST.json]
  • Release tag3.15.2-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/python:3.15.2-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:5f1cdb25bf4ba47d569eb78ba26f30c4b02683f7e32e76ffd39c49d5b6d612f7 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:3b42ecdb93bf14ea67bab56d22979b410ce375f084f539277f43d69e4af38274 [ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-python-3.15.2-CE-ubuntu24.04-r1.tar.gz (bytes 334403916) [MANIFEST.json]
  • Archive sha256 at publishcaa9ea252c9a98bce824b920ce40d8a15f489802f2d7e083dd648742edc06179 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/python/cpython [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv3.15.2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit5e58eaad7c58df58dfa8ea549c87996e01dd1077 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashc39e6ce79eef9148fe893ee08e13bf6cd2350f8549c20587afeed3c639740352 (files 5636) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:00e53b9ea2a3293b0e37b0b51d0beb2d7e914359e511ba39d8bf2db3e695045d [ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1792947471 (utc 2026-10-25T16:57:51Z) [ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit ff3112bd2cb03ee39fd394ed644a9522854803de · dirty yes · first drive 3487
    • commit c687e89f3f357d327a061c463cc19dd28a42c4a8 · dirty yes · first drive 3538
    • commit d32260ba806be765768a8470884cf7e6776a8d6c · dirty yes · first drive 3694
    • commit 2d74add6086c4e9520480af5e066eed64cf6eacd · dirty yes · first drive 3718
    • commit 14ac19f4178268c2dbfa7e7cae4be76d466ea445 · dirty yes · first drive 3794
    • commit fb3d89dbdf1a4d4d5e6b01f0cfad0b5ef4a697f2 · dirty yes · first drive 3829
    • commit c20aa19bc0ab8c9fef7ff40e1f6a18c4169b166e · dirty yes · first drive 3841
    • commit 3179e9e9e7ff3f9414b596de6e552d260c583056 · dirty yes · first drive 3844
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain757 (created 2026-10-28T06:07:38Z · trigger customer_request · upstream version 3.15.2) [chains, chains #757]
  • Requestbuild request #444 (new_product) (requested at 2026-10-28T02:46:22Z · requested by agent · version 3.15.2) [build_requests, build_requests #444]
  • Reasonce.rodeo trending #10 (tier 3: a free A image exists; the most-pulled runtime), owner 2026-10-27 'all apps queued ... this includes runtime' (docs/CATALOGUE_EXPANSION.md); second product of the runtime kind [build_requests, build_requests #444 request_reason]

The path through the harness

Fully recorded

1 chain · 9 drives · 18 stages · 3 rewinds

Chain 757 release · ready_to_ship

Created 2026-10-28T06:07:38Z, upstream 3.15.2, build request 444 [chains, chains #757]

DriveStartedMinutesBuild hostHow it stopped
2562026-10-28T06:07:51Z11.4build host 1 withhold-publish stage_failed at verdict [drive_runs, drive_runs #256] rebuilt from a build line's log
34872026-11-03T08:11:36Z1.6build host 1 withhold-publish stage_failed at verdict; first failed check scout_verdict:release_check_passed; 1 tick [drive_runs, drive_runs #3487]
35382026-11-07T01:53:44Z24.5build host 1 withhold-publish ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #3538]
36942026-11-08T04:45:58Z3.8build host 1 withhold-publish stage_failed at package_archive; first failed check g8; 7 ticks [drive_runs, drive_runs #3694]
37182026-11-08T06:18:12Z2.1build host 1 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3718]
37942026-11-08T12:22:08Z2.3build host 1 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3794]
38292026-11-08T15:41:00Z1.9build host 1 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3829]
38412026-11-08T17:12:28Z4.9build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3841]
38442026-11-08T17:31:29Z—build host 1 publish-held not recorded [drive_runs, drive_runs #3844]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-28T06:07:57Z2026-10-28T06:07:57Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-28T06:08:10Z2026-10-28T06:08:10Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-28T06:08:27Z2026-10-28T06:08:28Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-28T06:12:00Z2026-11-07T02:01:03Z2
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile dafc4630ae3b…
build_recipe ee1203024ac0…
system_pinning 01ba4719c80b…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health cf3f17a67913…
verify_offline_sh 3e8184ea230c…
base_image_digests 167b03637e3f…
dockerfile_offline dafc4630ae3b…
first_build_digest 37a5938a5b18…
remediate 2026-10-28T06:12:23Z2026-11-07T02:01:07Z2
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log b59e84468e67…
security_report af5077a11211…
build_kit 2026-10-28T06:18:16Z2026-11-07T02:07:18Z2
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 3dce0aad5ed6…
locked_digest af3a14be8902…
freeze_manifest 09ae2a2bd832…
offline_rebuild_transcript f59cae547810…
verdict 2026-10-28T06:19:15Z2026-11-07T02:08:06Z3
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict e8490368d098…
publish_image 2026-11-07T02:08:42Z2026-11-07T02:08:42Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme d7bd475fddb1…
promotion_record 448a1112def8…
boot_instance 2026-11-07T02:08:47Z2026-11-08T04:46:15Z3 — instance_handle 3a29570f3361…
sbom 2026-11-07T02:09:14Z2026-11-07T02:09:15Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md f2f22a7022d5…
sbom_json 22d8d54e6929…
schema_discovery 2026-11-07T02:09:18Z2026-11-07T02:09:19Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash b616172f431c…
dependency_tree 0537819112e0…
table_classification 3517749b1d4a…
admin_handbook 2026-11-07T02:09:36Z2026-11-08T04:46:28Z2
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map bb4583efb3eb…
admin_handbook 36525388cdb3…
db_handbook 2026-11-07T02:09:43Z2026-11-08T04:46:33Z2
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook be29622a3f28…
seed_isolation c37278da86ee…
seed_data 2026-11-07T02:10:12Z2026-11-08T04:46:53Z2
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 56fc29851acb…
seed_cases_json 64dff5091097…
seed_validate 2026-11-07T02:10:17Z2026-11-08T04:46:56Z2
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract c4e60c70e2b6…
usecase_validate 2026-11-07T02:10:57Z2026-11-08T04:47:27Z2
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 40a01c398ed3…
test_results 6767116d8974…
usecase_contract 35e2ff1d5aef…
finalize_docs 2026-11-07T02:11:07Z2026-11-08T04:47:35Z2
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 900a4d84c330…
release_notes 97a0e60ed620…
api_integration_guide 015dca75a3fd…
package_archive invalidated 2026-11-08T17:31:03Z 2026-11-07T02:18:09Z2026-11-08T17:17:21Z6
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 171636b2d119…
checksums e9d4d27c088f…
verify_md f3ab30b2c3da…
rebuild_md cbcec69ebc82…
manifest_txt bad81f9bbf2a…
actions_jsonl d5bef019dee2…
provenance_md bfdd55b7d3ae…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 004915e4469d…

[stage_runs]

Rewinds

  • 2026-11-07T01:53:50Z: verdict to assemble_kit on strategy_changed (strategy changed (f2e786786042 -> 43c9a653369f)) [stage_events, stage_events #23102]
  • 2026-11-08T03:17:21Z: package_archive to admin_handbook on docs_redo (scripts/redo-docs.py --stage admin_handbook) [stage_events, stage_events #24998]
  • 2026-11-08T17:31:03Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26890]

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-11-08T17:17:21Z.

4 calls over 2 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —

[micro_step_runs]

  • Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
  • Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $1.07 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-07T02:18:47Z 033 blocked to blocked [held_rounds, held_rounds #1416] $0.68 3 rounds, $40.00 21e72aae1be8…
22026-11-08T17:17:48Z 000 clean to publish [held_rounds, held_rounds #1526] $0.40 3 rounds, $40.00 171636b2d119…

Defects

Fully recorded
  • Ledger entries6 [defects, defects where product_slug=python and this tag or chain]
  • Disclosed in the archive6 [docs/defects/defects.json, entries]

6 ledger entries: by severity high 3, low 3; by status fixed-before-release 6.

DefectSeverityStatusFound byFixed in
RSD-python-e68b7b87d7
Admin handbook: The comparison table gives this image's working directory as `/`; it is /home/python (the handbook says so itself at line 112). [defects, defects #157962]		highfixed-before-releaseheld review (review model)—
RSD-python-d58fdec27d
Admin handbook: ensurepip's bundled pip is 26.2.2, not 26.3. [defects, defects #157963]		highfixed-before-releaseheld review (review model)—
RSD-python-4bc3fcb3df
Database handbook: The example `-v app-data:/data` fails for a program running as python: the new volume is root-owned; the sentence names the requirement but not how to meet it. [defects, defects #157964]		highfixed-before-releaseheld review (review model)—
RSD-python-d4e7919c3c
Admin handbook: CPython's manual page is installed. [defects, defects #157965]		lowfixed-before-releaseheld review (review model)—
RSD-python-6c600db3e3
Admin handbook: The Environment section is an empty table (header only) although the image sets three variables. [defects, defects #157966]		lowfixed-before-releaseheld review (review model)—
RSD-python-e308e2c4b2
Admin handbook: The `python3 -m site` output cell (line 144) is cut off mid-word ("/usr/local/lib/python3.15/si"), though the transcript holds the full output. [defects, defects #157967]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:3b42ecdb93bf14ea67bab56d22979b410ce375f084f539277f43d69e4af38274 · published digest sha256:3b42ecdb93bf14ea67bab56d22979b410ce375f084f539277f43d69e4af38274 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 163) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T17:31:52Z · failing Docker Scout counts 87 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T17:31:40Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3758377839 · transparency-log entry · integrated 2026-11-08T17:35:51Z) [ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:5f1cdb25bf4ba47d569eb78ba26f30c4b02683f7e32e76ffd39c49d5b6d612f7 · state attached · log index 3758378182 · transparency-log entry
    • kind sbom · digest sha256:5f1cdb25bf4ba47d569eb78ba26f30c4b02683f7e32e76ffd39c49d5b6d612f7 · state attached · log index 3758378724 · transparency-log entry
    • kind vsa · digest sha256:5f1cdb25bf4ba47d569eb78ba26f30c4b02683f7e32e76ffd39c49d5b6d612f7 · state attached · log index 3758379318 · transparency-log entry
    • kind provenance · digest sha256:3b42ecdb93bf14ea67bab56d22979b410ce375f084f539277f43d69e4af38274 · state attached · log index 3758379525 · transparency-log entry
    • kind sbom · digest sha256:3b42ecdb93bf14ea67bab56d22979b410ce375f084f539277f43d69e4af38274 · state attached · log index 3758379603 · transparency-log entry
    • kind vsa · digest sha256:3b42ecdb93bf14ea67bab56d22979b410ce375f084f539277f43d69e4af38274 · state attached · log index 3758379684 · transparency-log entry
    (at 2026-11-08T17:35:52Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/python/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-07T02:18:51Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:3b42ecdb93bf14ea67bab56d22979b410ce375f084f539277f43d69e4af38274 [clean-room rebuild ledger, runs[593]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-07T02:08:42Z [stage_runs, stage_runs chain 757 stage publish_image]
  • Archive manifests written2026-11-08T17:34:30Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 791 · probed 2026-11-07T02:04:20Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-08T17:36:58Z generated: by KitForge release/build_trail.py · generator commit 3179e9e9e7ff3f9414b596de6e552d260c583056
  • 2026-11-08T17:38:14Z publication: promoted at 2026-11-08T17:37:29Z · promoted digest sha256:5f1cdb25bf4ba47d569eb78ba26f30c4b02683f7e32e76ffd39c49d5b6d612f7 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 380 · checklist status complete · checklist at 2026-11-08T17:38:14Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

24 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/python/3.15.2-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/python/3.15.2-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/python/3.15.2-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-python-3.15.2-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/python/3.15.2-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/python/3.15.2-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)444
chainssadb, ReadyStack's engine database (not published)757
defectssadb, ReadyStack's engine database (not published)python 3.15.2-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 757
held_roundssadb, ReadyStack's engine database (not published)chain 757
micro_step_runssadb, ReadyStack's engine database (not published)chain 757
release_imagessadb, ReadyStack's engine database (not published)python 3.15.2-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 757
stage_runssadb, ReadyStack's engine database (not published)chain 757
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—