Tempo v3.1.1-CE-ubuntu24.04-r5 build trail

How ReadyStack built readystack/tempo:v3.1.1-CE-ubuntu24.04-r5 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/tempo:v3.1.1-CE-ubuntu24.04-r5
  • Index digestsha256:78f4c086ad000bab021d62f12780948cddf18b5a89d269008accc6a2fc4d4c73
  • linux/amd64 digestsha256:986baa6144b48fd2eff3715e2ee194f7a6dd196defe7c67f1ce5639d0259c2d6
  • ArchiveReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.tar.gz
  • Archive SHA-256 nowd999ae0935ceb4f5968099c3bd66f00545bd0e25263cadf7ec5901d2d38c3055
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-11T05:02:11Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.trail.json.sigstore ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.trail.json
ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.trail.jsonReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.trail.json.sigstoreReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.trail.mdTempo product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductTempo (tempo) [MANIFEST.json]
  • Release tagv3.1.1-CE-ubuntu24.04-r5 [MANIFEST.json]
  • Imagereadystack/tempo:v3.1.1-CE-ubuntu24.04-r5 [MANIFEST.json]
  • Image index digestsha256:78f4c086ad000bab021d62f12780948cddf18b5a89d269008accc6a2fc4d4c73 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:986baa6144b48fd2eff3715e2ee194f7a6dd196defe7c67f1ce5639d0259c2d6 [ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.tar.gz (bytes 524725960) [MANIFEST.json]
  • Archive sha256 at publishf8b06d106fe94aab8d9b4bd12b198ce43e37c45465150d1db1094e75fa482b88 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/grafana/tempo [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv3.1.1 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit9db7df79d2af105a90d96484e6403e1fda0d011e [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashb564f0e22361849b102298712e20b1b23f7c5efe890d4c83d6b4c7f97b0ca113 (files 15740) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:3d45ec027994948d7fe650d4142ed9c561af386208429837676c915decbec91a [ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1792596276 (utc 2026-10-21T15:24:36Z) [ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.rebuild.json, engine]
  • Engine commit(s)
    • commit 762b14205276731d25047ecbc7e53d9425b5b471 · dirty yes · first drive 4066
    • commit af2b965a4592cf93f865060c2ed1124a061bab44 · dirty yes · first drive 4122
    • commit 589a5a5d2a8f3f57fa5368385501ae1bd7143530 · dirty yes · first drive 4131
    • commit d4d740342d57534a5be731311b519ab879795663 · dirty yes · first drive 4139
    • commit 8f330f31aa066ed1381d543d473df5415ecba80a · dirty yes · first drive 4174
    • commit d53b685426c75d2ba6e44854aa04462d4677700c · dirty yes · first drive 4206
    • commit 467eb57e7940ba12684129fd11ece63592f7796d · dirty yes · first drive 4246
    • commit 620d8889fece1a9434ea5c2489f45fdd40dc2b3d · dirty yes · first drive 4255
    • commit a4836e07f81f6892f34edb7d7205df35fc7ac7b0 · dirty yes · first drive 4258
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain930 (created 2026-11-09T16:05:44Z · trigger customer_request · upstream version v3.1.1) [chains, chains #930]
  • Requestbuild request #605 (rebuild) (requested at 2026-11-09T07:47:31Z · requested by kitforge-agent · version v3.1.1) [build_requests, build_requests #605]
  • Reasonrevision v3.1.1-CE-ubuntu24.04-r5: same upstream version rebuilt on a chiselled Ubuntu 24.04 runtime (retarget.py --rev-bump; PR #292) [build_requests, build_requests #605 request_reason]
  • Supersedesreadystack/tempo:v3.1.1-CE-ubuntu24.04-r4 (chain 824) [chains, chains #824]

The path through the harness

Fully recorded

1 chain · 9 drives · 18 stages · 5 rewinds

Chain 930 release · ready_to_ship

Created 2026-11-09T16:05:44Z, upstream v3.1.1, build request 605 [chains, chains #930]

DriveStartedMinutesBuild hostHow it stopped
40662026-11-09T16:06:14Z37.2build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #4066]
41222026-11-09T22:31:53Z9.3build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4122]
41312026-11-09T23:11:10Z4.2build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4131]
41392026-11-09T23:37:31Z0.3build host 3 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4139]
41742026-11-10T09:07:48Z0.7build host 3 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4174]
42062026-11-10T22:53:41Z4.3build host 3 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4206]
42462026-11-11T03:12:28Z29.4build host 3 withhold-publish ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #4246]
42552026-11-11T04:28:10Z4build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4255]
42582026-11-11T04:56:28Z—build host 3 publish-held not recorded [drive_runs, drive_runs #4258]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-09T16:06:24Z2026-11-09T16:06:25Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json a2ad96713d20…
acquire 2026-11-09T16:06:33Z2026-11-09T16:06:35Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree bad9747f4984…
license_file 0d96a4ff68ad…
custody_inputs f1b2c2a9dd5f…
source_tree_hash b9ffa483bfb9…
source_file_manifest 05deabc29605…
plan 2026-11-09T16:07:09Z2026-11-09T16:07:10Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 1f2c771d716d…
input_pin_plan 4905080d9a24…
toolchain_lock 6130b8b189e9…
assemble_kit 2026-11-09T16:13:35Z2026-11-11T03:19:23Z2
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 92d245dedcf8…
build_recipe baf5456b6f53…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 0fde23309d58…
verify_offline_sh 3e8184ea230c…
base_image_digests 13eb87731026…
dockerfile_offline 92d245dedcf8…
first_build_digest cdf40999df13…
remediate 2026-11-09T16:14:07Z2026-11-11T03:19:29Z2
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 9280a1cd7358…
security_report 33e7e1a75a76…
build_kit 2026-11-09T16:24:13Z2026-11-11T03:29:24Z2
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp a3d00bf27728…
locked_digest 35a3a9424ed6…
freeze_manifest f4ebd613d17c…
offline_rebuild_transcript 5bab6f912215…
verdict 2026-11-09T16:25:01Z2026-11-11T03:30:15Z2
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 384c038c3eef…
publish_image 2026-11-09T16:25:39Z2026-11-11T03:30:50Z2
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme e1eae75c919b…
promotion_record 82437ebcb164…
boot_instance 2026-11-09T16:25:46Z2026-11-11T03:31:02Z4
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 45aa84072b2f…
sbom 2026-11-09T16:26:04Z2026-11-11T03:31:16Z2
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 044ade7a68a5…
sbom_json 2d612334fa76…
schema_discovery 2026-11-09T16:26:08Z2026-11-11T03:31:20Z2
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash ac4cb87c1e83…
dependency_tree 811d02f25a95…
table_classification ed78e2356a6b…
admin_handbook 2026-11-09T16:31:52Z2026-11-11T03:31:29Z2
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map e79492036221…
admin_handbook 5af4e5c20eb1…
db_handbook 2026-11-09T16:36:24Z2026-11-11T03:31:41Z2
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook a26534846990…
seed_isolation be18e57db332…
seed_data 2026-11-09T16:36:37Z2026-11-11T03:31:57Z2
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 0298abb13516…
seed_cases_json 54e5618e8bfc…
seed_validate 2026-11-09T16:36:40Z2026-11-11T03:32:01Z2
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 510aa899870a…
usecase_validate 2026-11-09T16:37:02Z2026-11-11T03:32:18Z2
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 4abcc5ec5ccd…
test_results 68e82651e72c…
usecase_contract 4a140c5a595d…
finalize_docs 2026-11-09T16:41:07Z2026-11-11T03:32:24Z2
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 07e8e588d2f7…
release_notes 36366310a516…
api_integration_guide 9ffedb4e866a…
package_archive invalidated 2026-11-11T04:56:02Z 2026-11-09T16:43:26Z2026-11-11T04:32:07Z8
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 420fa82d11f0…
checksums 27553d4d765b…
verify_md d93c80fd9a1b…
rebuild_md 0f8d873aaca0…
manifest_txt 045efe8dae92…
actions_jsonl 5b509dfecf7b…
provenance_md 1b7bff6a70b1…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json ee607ef42c32…

[stage_runs]

Rewinds

  • 2026-11-09T23:09:58Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29953]
  • 2026-11-09T23:34:32Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29978]
  • 2026-11-11T03:12:32Z: package_archive to assemble_kit on strategy_changed (strategy changed (c8abe91c2bcb -> dc0a5910d1ec)) [stage_events, stage_events #31057]
  • 2026-11-11T04:26:38Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #31148]
  • 2026-11-11T04:56:02Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #31202]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-11T04:32:07Z.

90 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 08425 L-A183, L-A15
remediate2001 08897 L-A183, L-A15
admin_handbook31603 0124997 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook25603 091289 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate1001 01928 L-A59
finalize_docs29603 0106412 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

4 rounds, 4 counted, $5.15 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T22:41:36Z 098 findings to repackage [held_rounds, held_rounds #1676] $1.44 3 rounds, $40.00 af09c8597160…
22026-11-09T23:15:44Z 016 findings to repackage [held_rounds, held_rounds #1682] $1.12 3 rounds, $40.00 13e36730b813…
32026-11-11T03:42:28Z 083 findings to repackage [held_rounds, held_rounds #1730] $1.31 3 rounds, $40.00 4abde90d1659…
42026-11-11T04:32:29Z 004 clean to publish [held_rounds, held_rounds #1732] $1.28 3 rounds, $40.00 420fa82d11f0…

Defects

Fully recorded
  • Ledger entries39 [defects, defects where product_slug=tempo and this tag or chain]
  • Disclosed in the archive39 [docs/defects/defects.json, entries]

39 ledger entries: by severity high 18, low 21; by status fixed-before-release 39.

DefectSeverityStatusFound byFixed in
RSD-tempo-33f3c2a83c
Admin handbook: Ran on the release image (manifest f27997df): ingested trace 5b8efff7… via POST :4318/v1/traces (200); `docker rm -f` the container, same named volume, new `docker run` -> GET /api/traces/<id> 200;… [defects, defects #226832]		highfixed-before-releaseheld review (review model)—
RSD-tempo-740507dbc7
Admin handbook: Ran on the release image (manifest f27997df): ingested trace 5b8efff7… via POST :4318/v1/traces (200); `docker rm -f` the container, same named volume, new `docker run` -> GET /api/traces/<id> 200;… [defects, defects #226833]		highfixed-before-releaseheld review (review model)—
RSD-tempo-ba880729b4
Admin handbook: Ran on the release image (manifest f27997df): ingested trace 5b8efff7… via POST :4318/v1/traces (200); `docker rm -f` the container, same named volume, new `docker run` -> GET /api/traces/<id> 200;… [defects, defects #226834]		highfixed-before-releaseheld review (review model)—
RSD-tempo-7eb2a07142
Admin handbook: Ran on the release image (manifest f27997df): ingested trace 5b8efff7… via POST :4318/v1/traces (200); `docker rm -f` the container, same named volume, new `docker run` -> GET /api/traces/<id> 200;… [defects, defects #226835]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-a44cbb431f
Database handbook: Ran on the release image (manifest f27997df): ingested trace 5b8efff7… via POST :4318/v1/traces (200); `docker rm -f` the container, same named volume, new `docker run` -> GET /api/traces/<id> 200;… [defects, defects #226836]		highfixed-before-releaseheld review (review model)—
RSD-tempo-2e9f61a60d
Database handbook: Ran with no -v: ingest 200, docker stop + docker start, GET /api/traces/<id> -> 200 (data survives stop/start without a volume; also admin line 631 says so). [defects, defects #226837]		highfixed-before-releaseheld review (review model)—
RSD-tempo-c000c6b858
Database handbook: Ran with no -v: ingest 200, docker stop + docker start, GET /api/traces/<id> -> 200 (data survives stop/start without a volume; also admin line 631 says so). [defects, defects #226838]		highfixed-before-releaseheld review (review model)—
RSD-tempo-c89bec560b
Admin handbook: Ran `docker run -v cfgNNN.yaml:/etc/tempo/config.yaml:ro` with a copy of the shipped config owned by uid 1000: mode 600 -> Exited (1); mode 640 -> Exited (1); mode 644 -> healthy. [defects, defects #226839]		highfixed-before-releaseheld review (review model)—
RSD-tempo-16d6fb9806
Admin handbook: docker logs <c> 2>/dev/null printed 3 lines (stdout: the OTel shim lines); docker logs <c> 2>&1 >/dev/null printed 73 lines (the Tempo log). [defects, defects #226840]		highfixed-before-releaseheld review (review model)—
RSD-tempo-0f8d0336c4
Admin handbook: `docker exec jt-ha930-tempo sh </dev/null` returns at once (rc=0), no prompt without -it; the document itself says so at ADMIN_HANDBOOK.md:834 and uses -it at :773 and :815. [defects, defects #226841]		highfixed-before-releaseheld review (review model)—
RSD-tempo-0c441f0b19
API guide: GET /status/services on the running image returned 16 rows: backend-scheduler, backend-worker, cache-provider, distributor, internal-server, live-store, live-store-ring, memberlist-kv,… [defects, defects #226842]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-ff9d569ccc
API guide: The same guide runs `docker run --rm -u 0 --entrypoint tar ...` (lines 216, 287, 340); `-u 0` works (ran backup, restore and chown with it). [defects, defects #226843]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-2a92fcf795
API guide: /metrics has 698 tempo_* series; none are cache hit-rate series, and the startup log shows every storage cache disabled (parquet-footer=false bloom=false parquet-offset-idx=false… [defects, defects #226844]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-0a934a9b93
Admin handbook: POST :4318/v1/traces with Content-Type application/json returned 200 {"partialSuccess":{}} and the trace was returned by GET /api/traces/<id>; API_INTEGRATION_GUIDE.md:606 says protobuf or JSON. [defects, defects #226845]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-7467b300b8
Admin handbook: validation/test-results.json lists six verified endpoints, all 200; ADMIN_HANDBOOK.md:1017 (appendix) runs /api/status/buildinfo; DB_HANDBOOK.md:361-366 and API_INTEGRATION_GUIDE.md:416-423 list all… [defects, defects #226846]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-30e2b90371
Database handbook: Shipped /etc/tempo/config.yaml has no auth settings; the same handbook says 'There is no authentication on the ingest ports' (line 584) and 'Access control is enforced through network exposure'… [defects, defects #226847]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-9a0b462914
Database handbook: Tempo keeps no index (stated at DB_HANDBOOK.md:67 and :816); the volume holds wal/, blocks/, live-store/ only. [defects, defects #226848]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-84eb71d45a
Admin handbook: The sentence introduces a restore, but the code block at lines 764-766 is the BACKUP command: it mounts the volume read-only (:ro) and runs `czf /backup/tempo-backup.tar.gz`. [defects, defects #227698]		highfixed-before-releaseheld review (review model)—
RSD-tempo-433fb98cb8
Database handbook: The example is meant to 'check service status' but without -body rs-probe prints nothing and only sets the exit status, so the customer sees no service list. [defects, defects #227699]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-892ef6245e
API guide: The command at line 519 (`/usr/local/bin/rs-probe http://127.0.0.1:3200/api/status/buildinfo`) has no -body, so it prints nothing; it is also written without `docker exec`, so it cannot be run from… [defects, defects #227700]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-15611db057
Admin handbook: Offered as the way 'to reach the HTTP API from inside the container', but without -body it prints no response, only the exit status (the same handbook uses -body at lines 482 and 728). [defects, defects #227701]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-53a6e66f75
API guide: Says tag names come from a 'span index'; the same guide (line 51) and both other handbooks state Tempo keeps no index, and the volume holds only wal/, blocks/, live-store/ (this was a round-1… [defects, defects #227702]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-4be91aabbc
Admin handbook: The quoted error text is what an EMPTY root-owned bind mount gives; on a volume whose existing wal/ directory is owned by another uid the error names a different path, so the customer will not find… [defects, defects #227703]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-f3ab519c93
API guide: Says a configuration file must be provided, but the standard command that follows mounts none and starts healthy; ADMIN_HANDBOOK.md:591 says 'No Configuration Required'. [defects, defects #227704]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-55491da272
Admin handbook: Backup procedure taken from a running container silently omits recently ingested spans; restored database lacks them. [defects, defects #244293]		highfixed-before-releaseheld review (review model)—
RSD-tempo-01f36f8cef
Admin handbook: Backup procedure taken from a running container silently omits recently ingested spans; restored database lacks them. [defects, defects #244294]		highfixed-before-releaseheld review (review model)—
RSD-tempo-592a70d400
Admin handbook: Backup procedure taken from a running container silently omits recently ingested spans; restored database lacks them. [defects, defects #244295]		highfixed-before-releaseheld review (review model)—
RSD-tempo-1cf2fe94a7
Database handbook: Backup procedure taken from a running container silently omits recently ingested spans; restored database lacks them. [defects, defects #244296]		highfixed-before-releaseheld review (review model)—
RSD-tempo-d6e50a5a2e
Database handbook: Backup procedure taken from a running container silently omits recently ingested spans; restored database lacks them. [defects, defects #244297]		highfixed-before-releaseheld review (review model)—
RSD-tempo-0ba70f778c
API guide: Backup procedure taken from a running container silently omits recently ingested spans; restored database lacks them. [defects, defects #244298]		highfixed-before-releaseheld review (review model)—
RSD-tempo-df0f374c63
API guide: Backup procedure taken from a running container silently omits recently ingested spans; restored database lacks them. [defects, defects #244299]		highfixed-before-releaseheld review (review model)—
RSD-tempo-d9723ff7f4
API guide: Backup procedure taken from a running container silently omits recently ingested spans; restored database lacks them. [defects, defects #244300]		highfixed-before-releaseheld review (review model)—
RSD-tempo-ac09f82dab
Admin handbook: Example offered for reaching the HTTP API prints no response. [defects, defects #244301]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-aac41f083f
Admin handbook: Implies a configuration file must be mounted; contradicts the standard command and ADMIN:591. [defects, defects #244302]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-7019db4cf6
Admin handbook: Says configuration comes from a mounted file; the default needs none. [defects, defects #244303]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-8a2b5fd4d0
Admin handbook: The example offered for reaching the HTTP API (under 'Probing the API') omits -body, so it prints nothing and only sets the exit status; the sentence above it says so, yet the example is meant to… [defects, defects #245318]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-42d42513f8
Admin handbook: Reads as if a configuration file must be mounted; the standard run command mounts none and the image ships /etc/tempo/config.yaml (contradicts the standard command and ADMIN 'No Configuration… [defects, defects #245319]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-a4d14d7084
Database handbook: Says spans are written to the WAL at /var/tempo/wal/; after ingesting spans and stopping the container, /var/tempo/wal/ held only an empty blocks/ directory and the span data was in… [defects, defects #245320]		lowfixed-before-releaseheld review (review model)—
RSD-tempo-6cd4c0fe31
API guide: Names /var/tempo/wal/ as a place spans are written; it stays empty, spans go to /var/tempo/live-store/traces/. [defects, defects #245321]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:986baa6144b48fd2eff3715e2ee194f7a6dd196defe7c67f1ce5639d0259c2d6 · published digest sha256:986baa6144b48fd2eff3715e2ee194f7a6dd196defe7c67f1ce5639d0259c2d6 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 281) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-11T04:56:57Z · failing Docker Scout counts 11 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-11T04:56:44Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3802587590 · transparency-log entry · integrated 2026-11-11T05:00:47Z) [ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:78f4c086ad000bab021d62f12780948cddf18b5a89d269008accc6a2fc4d4c73 · state attached · log index 3802592132 · transparency-log entry
    • kind sbom · digest sha256:78f4c086ad000bab021d62f12780948cddf18b5a89d269008accc6a2fc4d4c73 · state attached · log index 3802595092 · transparency-log entry
    • kind vsa · digest sha256:78f4c086ad000bab021d62f12780948cddf18b5a89d269008accc6a2fc4d4c73 · state attached · log index 3802598576 · transparency-log entry
    • kind provenance · digest sha256:986baa6144b48fd2eff3715e2ee194f7a6dd196defe7c67f1ce5639d0259c2d6 · state attached · log index 3802601559 · transparency-log entry
    • kind sbom · digest sha256:986baa6144b48fd2eff3715e2ee194f7a6dd196defe7c67f1ce5639d0259c2d6 · state attached · log index 3802603595 · transparency-log entry
    • kind vsa · digest sha256:986baa6144b48fd2eff3715e2ee194f7a6dd196defe7c67f1ce5639d0259c2d6 · state attached · log index 3802606127 · transparency-log entry
    (at 2026-11-11T05:00:48Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/tempo/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T22:41:41Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:f27997df146b969b4e9c01310ac5c48b48ca32c7daff88db3b6d6f0709ba8e3f [clean-room rebuild ledger, runs[715]]
  • 2026-11-11T03:42:33Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:986baa6144b48fd2eff3715e2ee194f7a6dd196defe7c67f1ce5639d0259c2d6 [clean-room rebuild ledger, runs[740]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-11T03:30:50Z [stage_runs, stage_runs chain 930 stage publish_image]
  • Archive manifests written2026-11-11T04:58:56Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 64 · probed 2026-11-09T16:18:59Z · source build_kit) [release_images, isa_level_hard]

History

3 events
  • 2026-11-11T05:02:11Z generated: by KitForge release/build_trail.py · generator commit a4836e07f81f6892f34edb7d7205df35fc7ac7b0
  • 2026-11-11T05:03:39Z publication: promoted at 2026-11-11T05:02:46Z · promoted digest sha256:78f4c086ad000bab021d62f12780948cddf18b5a89d269008accc6a2fc4d4c73 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 463 · checklist status complete · checklist at 2026-11-11T05:03:39Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
  • 2026-11-12T04:35:47Z repack: previous sha256 f8b06d106fe94aab8d9b4bd12b198ce43e37c45465150d1db1094e75fa482b88 · sha256 d999ae0935ceb4f5968099c3bd66f00545bd0e25263cadf7ec5901d2d38c3055 · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); README.md and FILE_MODES.tsv at the archive root (release/kit_unpack.py), BUILD_OFFLINE.sh putting back the packed file modes, REBUILD.md unpacking with -p and keeping the key and signature outside the kit, and the verifier naming what differs; not image inputs; image and every build input unchanged · label kitfix · replaced BUILD_OFFLINE.sh, docs/REBUILD.md, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, docs/rebuild-bundle/rebuild_bundle.py · added FILE_MODES.tsv, README.md · record MANIFEST.json repack_history

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/tempo/v3.1.1-CE-ubuntu24.04-r5/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/tempo/v3.1.1-CE-ubuntu24.04-r5/), as staged for publishing—
ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.rebuild.jsonbeside the archive (prodasset /data/production/tempo/v3.1.1-CE-ubuntu24.04-r5/), as staged for publishing—
ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r5.rebuild.json.sigstorebeside the archive (prodasset /data/production/tempo/v3.1.1-CE-ubuntu24.04-r5/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/tempo/v3.1.1-CE-ubuntu24.04-r5/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)605
chainssadb, ReadyStack's engine database (not published)930
defectssadb, ReadyStack's engine database (not published)tempo v3.1.1-CE-ubuntu24.04-r5
drive_runssadb, ReadyStack's engine database (not published)chain 930
held_roundssadb, ReadyStack's engine database (not published)chain 930
lesson_recallssadb, ReadyStack's engine database (not published)chain 930
micro_step_runssadb, ReadyStack's engine database (not published)chain 930
release_imagessadb, ReadyStack's engine database (not published)tempo v3.1.1-CE-ubuntu24.04-r5
stage_eventssadb, ReadyStack's engine database (not published)chain 930
stage_runssadb, ReadyStack's engine database (not published)chain 930
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—