Temporal v1.32.2-CE-ubuntu24.04-r1 build trail
How ReadyStack built readystack/temporal:v1.32.2-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/temporal:v1.32.2-CE-ubuntu24.04-r1 - Index digestsha256:c71443d321ccb568cf5d0236f378d3911b5b9518936881c75079f888053d2a9b
- linux/amd64 digestsha256:deb59bdc4bf74fbd40e75841c6ba1f11470c5e9e0add8bd79ba7ff57045cd047
- Archive
ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.tar.gz - Archive SHA-256 now9fbad86812faff45e28b74394e5ada4b2d4616696085f8a5eefbe3050c343a5d
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-07T12:11:23Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductTemporal (temporal) [MANIFEST.json]
- Release tagv1.32.2-CE-ubuntu24.04-r1 [MANIFEST.json]
- Imagereadystack/temporal:v1.32.2-CE-ubuntu24.04-r1 [MANIFEST.json]
- Image index digestsha256:c71443d321ccb568cf5d0236f378d3911b5b9518936881c75079f888053d2a9b [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:deb59bdc4bf74fbd40e75841c6ba1f11470c5e9e0add8bd79ba7ff57045cd047 [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.tar.gz (bytes 521330150) [MANIFEST.json]
- Archive sha256 at publish9fbad86812faff45e28b74394e5ada4b2d4616696085f8a5eefbe3050c343a5d [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/temporalio/temporal [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv1.32.2 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit6d085822273f4336796e6959c73ab1d14a23eb77 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash96b41e631f563f71248b899d3d4aca1d1507334e5e489c7be7a793f7bb6c39e6 (files 3792) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:bd83120219a1bed3a8704eb2be98fe32b9823e36b508d63e473024433474c89c [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1793421274 (utc 2026-10-31T04:34:34Z) [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.rebuild.json, engine]
- Engine commit(s)
- commit c5b3141ed10b7ce0cea293da1be76d941c96da6f · dirty yes · first drive 3569
- commit 1965bb7c468fd301b7164e27ef82448632bd34f4 · dirty yes · first drive 3640
- commit 373d3c6436c70a6b11e2c6f6d2aa49fc56a5a5c1 · dirty yes · first drive 3659
Why this release exists
Fully recorded- Chain843 (created 2026-11-07T04:40:30Z · trigger customer_request · upstream version v1.32.2) [chains, chains #843]
- Requestbuild request #531 (rebuild) (requested at 2026-11-07T02:03:10Z · requested by kitforge-agent · version v1.32.2) [build_requests, build_requests #531]
- Reasonretarget to v1.32.2: a newer upstream release (rule 1) [build_requests, build_requests #531 request_reason]
- Supersedesreadystack/temporal:v1.32.1-CE-ubuntu24.04-r4 (chain 755) [chains, chains #755]
The path through the harness
Fully recorded1 chain · 4 drives · 18 stages · 3 rewinds
Chain 843 release · ready_to_ship
Created 2026-11-07T04:40:30Z, upstream v1.32.2, build request 531 [chains, chains #843]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 3569 | 2026-11-07T04:40:56Z | 18.1 | build host 4 withhold-publish | stage_failed at verdict; first failed check scout_verdict:release_check_passed; 7 ticks [drive_runs, drive_runs #3569] |
| 3640 | 2026-11-07T10:25:55Z | 26.8 | build host 4 withhold-publish | ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #3640] |
| 3659 | 2026-11-07T11:54:07Z | 4.2 | build host 4 withhold-publish | ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3659] |
| 3660 | 2026-11-07T12:05:56Z | — | build host 4 publish-held | not recorded [drive_runs, drive_runs #3660] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-07T04:41:07Z | 2026-11-07T04:41:08Z | 1 | 4
|
order_json ca377c47f71e… |
acquire |
2026-11-07T04:41:14Z | 2026-11-07T04:41:15Z | 1 | 12
|
source_tree 21c4e4d5868f…license_file 6aab9afd99ce…custody_inputs 74b5ae3ba12f…source_tree_hash 2f7d9db07295…source_file_manifest 51741d218812… |
plan |
2026-11-07T04:42:07Z | 2026-11-07T04:42:08Z | 1 | 10
|
recon_report 2cbc9671f425…input_pin_plan 701783cac7ef…toolchain_lock 081ce5bd8ea4… |
assemble_kit |
2026-11-07T04:48:07Z | 2026-11-07T10:32:10Z | 2 | 27
|
dockerfile 92b7cd074b51…build_recipe be8f5de920c1…system_pinning 3342957f888a…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health 040d38a8206b…verify_offline_sh 3e8184ea230c…base_image_digests d05a93cc936d…dockerfile_offline 92b7cd074b51…first_build_digest bbdbd027284f… |
remediate |
2026-11-07T04:49:12Z | 2026-11-07T10:32:15Z | 2 | 8
|
vendored_apt e3b0c44298fc…remediation_log e336b066c38b…security_report ee4f41975507… |
build_kit |
2026-11-07T04:57:49Z | 2026-11-07T10:40:39Z | 2 | 9
|
cosign_stamp 934479beb520…locked_digest 2b7ec1d1d414…freeze_manifest fcbace175e89…offline_rebuild_transcript 9082e3f15a99… |
verdict |
2026-11-07T04:59:03Z | 2026-11-07T10:41:40Z | 2 | 8
|
scout_verdict 76f7a43943a1… |
publish_image |
2026-11-07T10:42:19Z | 2026-11-07T10:42:20Z | 1 | 7
|
hub_readme bdaa02a4178d…promotion_record 8395c20eb6f7… |
boot_instance |
2026-11-07T10:42:37Z | 2026-11-07T10:42:41Z | 2 | 3
|
instance_handle e66b6574d25f… |
sbom |
2026-11-07T10:42:54Z | 2026-11-07T10:42:55Z | 1 | 5
|
sbom_md 42918b4d1bb2…sbom_json 48a0aa0c7144… |
schema_discovery |
2026-11-07T10:43:01Z | 2026-11-07T10:43:02Z | 1 | 7
|
schema_hash e5efed833375…dependency_tree ee706ebeee4a…table_classification f0e6cf9a593a… |
admin_handbook |
2026-11-07T10:43:09Z | 2026-11-07T10:43:10Z | 1 | 7
|
api_map 4358e7696dc9…admin_handbook bb09eb4b12eb… |
db_handbook |
2026-11-07T10:43:21Z | 2026-11-07T10:43:21Z | 1 | 8
|
db_handbook f66d52a0cbd4…seed_isolation 4320b6175fb6… |
seed_data |
2026-11-07T10:43:31Z | 2026-11-07T10:43:32Z | 1 | 6
|
seed_data_sql 0b6a0171fed7…seed_cases_json bfa1da07c60b… |
seed_validate |
2026-11-07T10:43:35Z | 2026-11-07T10:43:36Z | 1 | 3
|
seed_data_contract 3f592f4b6997… |
usecase_validate |
2026-11-07T10:44:02Z | 2026-11-07T10:44:03Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 56f34cd65f46…test_results f3e0b43d13f5…usecase_contract 3395a4e1e566… |
finalize_docs |
2026-11-07T10:44:09Z | 2026-11-07T10:44:10Z | 1 | 9
|
defects_json 22930535bdfc…release_notes 70b085f715fd…api_integration_guide 3ca3a1077eef… |
package_archive invalidated 2026-11-07T12:05:33Z |
2026-11-07T10:52:40Z | 2026-11-07T11:58:17Z | 2 | 34 (final gate PASS)
|
sale_tar 82ec2634817c…checksums f517b900047b…verify_md aed5cb1e983e…rebuild_md ec9878a04492…manifest_txt 8c5791cdb26d…actions_jsonl 507c0a94ca90…provenance_md 5b4d80112cea…assetchain_log_md e9eccaec0c0f…assetchain_log_json fef32d4fb493… |
[stage_runs]
Rewinds
- 2026-11-07T10:25:59Z:
verdicttoassemble_kiton strategy_changed (strategy changed (d836bdbe93a9 -> 01e53d0bcee2)) [stage_events, stage_events #24510] - 2026-11-07T11:11:01Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24658] - 2026-11-07T12:05:33Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24803]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-07T11:58:17Z.
7 calls over 4 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 10654 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 14603 | L-A08, L-038, L-036, L-034, L-032 |
admin_handbook | 2 | 0 | 0 | 1 | 0 | 12488 | — |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 1886 | — |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
2 rounds, 2 counted, $0.48 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-07T10:53:35Z | 0 | 1 | 0 | findings to repackage [held_rounds, held_rounds #1458] | $0.28 | 3 rounds, $40.00 | 19af443aca86… |
| 2 | 2026-11-07T11:58:45Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1464] | $0.20 | 3 rounds, $40.00 | 82ec2634817c… |
Defects
Fully recorded- Ledger entries2 [defects, defects where product_slug=temporal and this tag or chain]
- Disclosed in the archive2 [docs/defects/defects.json, entries]
2 ledger entries: by severity high 2; by status open 1, fixed-before-release 1.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-temporal-a731bf09b3With Temporal's JWT authorizer on, the internal service ports 7236/7246 still answer without a token [defects, defects #168000] | high | open | build strategy record | — |
RSD-temporal-8113d5420aAdmin handbook: Wrong release tag (r2) in prose contradicting the pull command and release tag [defects, defects #168195] | high | fixed-before-release | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:deb59bdc4bf74fbd40e75841c6ba1f11470c5e9e0add8bd79ba7ff57045cd047 · published digest sha256:deb59bdc4bf74fbd40e75841c6ba1f11470c5e9e0add8bd79ba7ff57045cd047 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 237) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-07T12:06:17Z · failing Docker Scout counts 100 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-07T12:06:06Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3735923628 · transparency-log entry
- log index 3735925196 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3737650019 · transparency-log entry · integrated 2026-11-07T12:10:06Z) [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:c71443d321ccb568cf5d0236f378d3911b5b9518936881c75079f888053d2a9b · state attached · log index 3737653238 · transparency-log entry
- kind sbom · digest sha256:c71443d321ccb568cf5d0236f378d3911b5b9518936881c75079f888053d2a9b · state attached · log index 3737655144 · transparency-log entry
- kind vsa · digest sha256:c71443d321ccb568cf5d0236f378d3911b5b9518936881c75079f888053d2a9b · state attached · log index 3737657989 · transparency-log entry
- kind provenance · digest sha256:deb59bdc4bf74fbd40e75841c6ba1f11470c5e9e0add8bd79ba7ff57045cd047 · state attached · log index 3737660369 · transparency-log entry
- kind sbom · digest sha256:deb59bdc4bf74fbd40e75841c6ba1f11470c5e9e0add8bd79ba7ff57045cd047 · state attached · log index 3737662499 · transparency-log entry
- kind vsa · digest sha256:deb59bdc4bf74fbd40e75841c6ba1f11470c5e9e0add8bd79ba7ff57045cd047 · state attached · log index 3737664871 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/temporal/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-07T10:53:39Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:deb59bdc4bf74fbd40e75841c6ba1f11470c5e9e0add8bd79ba7ff57045cd047 [clean-room rebuild ledger, runs[621]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-07T10:42:20Z [stage_runs, stage_runs chain 843 stage publish_image]
- Archive manifests written2026-11-07T12:08:12Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 749 · probed 2026-11-07T04:53:33Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-07T12:11:23Z generated: by KitForge release/build_trail.py · generator commit 373d3c6436c70a6b11e2c6f6d2aa49fc56a5a5c1
- 2026-11-07T12:12:46Z publication: promoted at 2026-11-07T12:11:52Z · promoted digest sha256:c71443d321ccb568cf5d0236f378d3911b5b9518936881c75079f888053d2a9b · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 351 · checklist status complete · checklist at 2026-11-07T12:12:46Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/temporal/v1.32.2-CE-ubuntu24.04-r1/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/temporal/v1.32.2-CE-ubuntu24.04-r1/), as staged for publishing | — |
ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.rebuild.json | beside the archive (prodasset /data/production/temporal/v1.32.2-CE-ubuntu24.04-r1/), as staged for publishing | — |
ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r1.rebuild.json.sigstore | beside the archive (prodasset /data/production/temporal/v1.32.2-CE-ubuntu24.04-r1/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/temporal/v1.32.2-CE-ubuntu24.04-r1/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 531 |
chains | sadb, ReadyStack's engine database (not published) | 843 |
defects | sadb, ReadyStack's engine database (not published) | temporal v1.32.2-CE-ubuntu24.04-r1 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 843 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 843 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 843 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 843 |
release_images | sadb, ReadyStack's engine database (not published) | temporal v1.32.2-CE-ubuntu24.04-r1 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 843 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 843 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |