Python 3.15.2-CE-ubuntu24.04-r4 build trail
How ReadyStack built readystack/python:3.15.2-CE-ubuntu24.04-r4 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/python:3.15.2-CE-ubuntu24.04-r4 - Index digestsha256:51c73278b9e98c18907fe1bc79936c9e67638df1616b72faf8ac907d5b5c5649
- linux/amd64 digestsha256:f669e4236160d827afa3bc292a0c32a2e23c32406dddbbb067636644de8ecc07
- Archive
ReadyStack-python-3.15.2-CE-ubuntu24.04-r4.tar.gz - Archive SHA-256 now9f2913f91936eec93e25b8a4a80ee8fc203073ab94322ce27463488f55894902
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-13T12:20:55Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-python-3.15.2-CE-ubuntu24.04-r4.trail.json.sigstore ReadyStack-python-3.15.2-CE-ubuntu24.04-r4.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductPython (python) [MANIFEST.json]
- Release tag3.15.2-CE-ubuntu24.04-r4 [MANIFEST.json]
- Imagereadystack/python:3.15.2-CE-ubuntu24.04-r4 [MANIFEST.json]
- Image index digestsha256:51c73278b9e98c18907fe1bc79936c9e67638df1616b72faf8ac907d5b5c5649 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:f669e4236160d827afa3bc292a0c32a2e23c32406dddbbb067636644de8ecc07 [ReadyStack-python-3.15.2-CE-ubuntu24.04-r4.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-python-3.15.2-CE-ubuntu24.04-r4.tar.gz (bytes 343385877) [MANIFEST.json]
- Archive sha256 at publish9f2913f91936eec93e25b8a4a80ee8fc203073ab94322ce27463488f55894902 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/python/cpython [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv3.15.2 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit5e58eaad7c58df58dfa8ea549c87996e01dd1077 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hashc39e6ce79eef9148fe893ee08e13bf6cd2350f8549c20587afeed3c639740352 (files 5636) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:c0c1283c81a563281e40f972d525ed6f581b757ff6b2574ecd148e2808466918 [ReadyStack-python-3.15.2-CE-ubuntu24.04-r4.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794569009 (utc 2026-11-13T11:23:29Z) [ReadyStack-python-3.15.2-CE-ubuntu24.04-r4.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-python-3.15.2-CE-ubuntu24.04-r4.rebuild.json, engine]
- Engine commit(s)
- commit 22ec3083b99f4ba8ca78ae96dc5e10cca45d4f16 · dirty yes · first drive 4566
- commit af5d491e38da72dd57d28c6cf2cc7e7849a38d38 · dirty yes · first drive 4569
Why this release exists
Fully recorded- Chain1072 (created 2026-11-13T11:44:36Z · trigger customer_request · upstream version 3.15.2) [chains, chains #1072]
- Requestbuild request #749 (rebuild) (requested at 2026-11-13T11:23:32Z · requested by kitforge-agent · version 3.15.2) [build_requests, build_requests #749]
- Reasonrerelease agenda REVISION -> 3.15.2-CE-ubuntu24.04-r4 (decay loop, IMP-08) [build_requests, build_requests #749 request_reason]
- Supersedesreadystack/python:3.15.2-CE-ubuntu24.04-r3 (chain 1000) [chains, chains #1000]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1072 release · ready_to_ship
Created 2026-11-13T11:44:36Z, upstream 3.15.2, build request 749 [chains, chains #1072]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4566 | 2026-11-13T11:45:02Z | 22.3 | build host 3 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4566] |
| 4569 | 2026-11-13T12:16:16Z | — | build host 3 publish-held | not recorded [drive_runs, drive_runs #4569] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-13T11:45:13Z | 2026-11-13T11:45:14Z | 1 | 4
|
order_json 246e387296f0… |
acquire |
2026-11-13T11:45:24Z | 2026-11-13T11:45:25Z | 1 | 12
|
source_tree 97bef397fbc0…license_file b0e25a78cffb…custody_inputs e7cdd40cbf3f…source_tree_hash 4a714b9067db…source_file_manifest eb1b5ca09759… |
plan |
2026-11-13T11:45:50Z | 2026-11-13T11:45:51Z | 1 | 10
|
recon_report c65a03927fed…input_pin_plan 404c2be1fcf7…toolchain_lock 1db7af648cd4… |
assemble_kit |
2026-11-13T11:51:42Z | 2026-11-13T11:51:42Z | 1 | 27
|
dockerfile a3d9d620a38e…build_recipe 9f962e7fa46e…system_pinning 01ba4719c80b…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health 42556cde7537…verify_offline_sh 3e8184ea230c…base_image_digests 167b03637e3f…dockerfile_offline a3d9d620a38e…first_build_digest f6d1a25fb10c… |
remediate |
2026-11-13T11:52:07Z | 2026-11-13T11:52:08Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 43cb9f0e49a3…security_report c4f4f5365bc5… |
build_kit |
2026-11-13T11:58:31Z | 2026-11-13T11:58:32Z | 1 | 9
|
cosign_stamp 92899be028c9…locked_digest 9027267000c2…freeze_manifest a5ff976c13ac…offline_rebuild_transcript 2d93a1cbaf33… |
verdict |
2026-11-13T11:59:20Z | 2026-11-13T11:59:21Z | 1 | 8
|
scout_verdict 2c76b942ea1a… |
publish_image |
2026-11-13T11:59:56Z | 2026-11-13T11:59:57Z | 1 | 7
|
hub_readme 5068f43a220f…promotion_record 80018225b91f… |
boot_instance |
2026-11-13T12:00:02Z | 2026-11-13T12:00:05Z | 2 | 3
|
instance_handle e4410e5f8853… |
sbom |
2026-11-13T12:00:16Z | 2026-11-13T12:00:17Z | 1 | 5
|
sbom_md e47aaa4ca020…sbom_json 26fffb0fe4b0… |
schema_discovery |
2026-11-13T12:00:19Z | 2026-11-13T12:00:20Z | 1 | 7
|
schema_hash b616172f431c…dependency_tree 0537819112e0…table_classification 3517749b1d4a… |
admin_handbook |
2026-11-13T12:00:34Z | 2026-11-13T12:00:35Z | 1 | 7
|
api_map bb4583efb3eb…admin_handbook ce477ebcba69… |
db_handbook |
2026-11-13T12:00:40Z | 2026-11-13T12:00:40Z | 1 | 8
|
db_handbook 1fbb6ed6cb89…seed_isolation c37278da86ee… |
seed_data |
2026-11-13T12:00:59Z | 2026-11-13T12:00:59Z | 1 | 6
|
seed_data_sql 56fc29851acb…seed_cases_json 6bc3cb6d1c04… |
seed_validate |
2026-11-13T12:01:02Z | 2026-11-13T12:01:03Z | 1 | 3
|
seed_data_contract 86b650f7c42c… |
usecase_validate |
2026-11-13T12:01:33Z | 2026-11-13T12:01:34Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 40a01c398ed3…test_results 6767116d8974…usecase_contract 565ad6492ff6… |
finalize_docs |
2026-11-13T12:01:41Z | 2026-11-13T12:01:42Z | 1 | 9
|
defects_json e6d390a97c81…release_notes 70281ac739ef…api_integration_guide c903d77c462c… |
package_archive invalidated 2026-11-13T12:15:51Z |
2026-11-13T12:07:21Z | 2026-11-13T12:07:22Z | 1 | 37 (final gate PASS)
|
sale_tar a1fd5891bfc5…checksums 2480190bea1b…verify_md 2479f4fa69be…rebuild_md 8227d9107f4a…manifest_txt 8c44375cda12…actions_jsonl 2cf3dd1a66ab…provenance_md 7fb45d65fc16…assetchain_log_md e9eccaec0c0f…assetchain_log_json 170df34ab336… |
[stage_runs]
Rewinds
- 2026-11-13T12:15:51Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #35890]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-13T12:07:22Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 5559 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 5897 | L-A183, L-A15 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.16 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-13T12:07:54Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1870] | $0.16 | 3 rounds, $40.00 | a1fd5891bfc5… |
Defects
Fully recorded- Ledger entries0 [defects, defects where product_slug=python and this tag or chain]
- Disclosed in the archive0 [docs/defects/defects.json, entries]
0 ledger entries.
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:f669e4236160d827afa3bc292a0c32a2e23c32406dddbbb067636644de8ecc07 · published digest sha256:f669e4236160d827afa3bc292a0c32a2e23c32406dddbbb067636644de8ecc07 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 174) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T12:16:39Z · failing Docker Scout counts 87 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T12:16:26Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3853263104 · transparency-log entry
- log index 3853263999 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3853568258 · transparency-log entry · integrated 2026-11-13T12:19:15Z) [ReadyStack-python-3.15.2-CE-ubuntu24.04-r4.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:51c73278b9e98c18907fe1bc79936c9e67638df1616b72faf8ac907d5b5c5649 · state attached · log index 3853571619 · transparency-log entry
- kind sbom · digest sha256:51c73278b9e98c18907fe1bc79936c9e67638df1616b72faf8ac907d5b5c5649 · state attached · log index 3853574960 · transparency-log entry
- kind vsa · digest sha256:51c73278b9e98c18907fe1bc79936c9e67638df1616b72faf8ac907d5b5c5649 · state attached · log index 3853577012 · transparency-log entry
- kind provenance · digest sha256:f669e4236160d827afa3bc292a0c32a2e23c32406dddbbb067636644de8ecc07 · state attached · log index 3853579651 · transparency-log entry
- kind sbom · digest sha256:f669e4236160d827afa3bc292a0c32a2e23c32406dddbbb067636644de8ecc07 · state attached · log index 3853581801 · transparency-log entry
- kind vsa · digest sha256:f669e4236160d827afa3bc292a0c32a2e23c32406dddbbb067636644de8ecc07 · state attached · log index 3853584496 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/python/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-13T12:07:58Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:f669e4236160d827afa3bc292a0c32a2e23c32406dddbbb067636644de8ecc07 [clean-room rebuild ledger, runs[830]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-13T11:59:57Z [stage_runs, stage_runs chain 1072 stage publish_image]
- Archive manifests written2026-11-13T12:17:49Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 791 · probed 2026-11-13T11:55:23Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-13T12:20:55Z generated: by KitForge release/build_trail.py · generator commit af5d491e38da72dd57d28c6cf2cc7e7849a38d38
- 2026-11-13T12:22:27Z publication: promoted at 2026-11-13T12:21:38Z · promoted digest sha256:51c73278b9e98c18907fe1bc79936c9e67638df1616b72faf8ac907d5b5c5649 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 539 · checklist status complete · checklist at 2026-11-13T12:22:27Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r4.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/python/3.15.2-CE-ubuntu24.04-r4/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/python/3.15.2-CE-ubuntu24.04-r4/), as staged for publishing | — |
ReadyStack-python-3.15.2-CE-ubuntu24.04-r4.rebuild.json | beside the archive (prodasset /data/production/python/3.15.2-CE-ubuntu24.04-r4/), as staged for publishing | — |
ReadyStack-python-3.15.2-CE-ubuntu24.04-r4.rebuild.json.sigstore | beside the archive (prodasset /data/production/python/3.15.2-CE-ubuntu24.04-r4/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/python/3.15.2-CE-ubuntu24.04-r4/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 749 |
chains | sadb, ReadyStack's engine database (not published) | 1072 |
defects | sadb, ReadyStack's engine database (not published) | python 3.15.2-CE-ubuntu24.04-r4 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1072 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1072 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1072 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1072 |
release_images | sadb, ReadyStack's engine database (not published) | python 3.15.2-CE-ubuntu24.04-r4 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1072 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1072 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |