Temporal v1.32.2-CE-ubuntu24.04-r3 build trail

How ReadyStack built readystack/temporal:v1.32.2-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/temporal:v1.32.2-CE-ubuntu24.04-r3
  • Index digestsha256:cef95c57f32b00da6b5e37ee4cba989573785f98c60b5998195cee04b40efcc7
  • linux/amd64 digestsha256:c61d529702d8e7ee9bb61d417c71f35963b44ce1a673007bcbb079d19d0417e0
  • ArchiveReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.tar.gz
  • Archive SHA-256 now60717b6815ef3f8085e3bd2484ad8848e51cd3d5e3bafae3a663a1fb41c221b3
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-10T23:11:36Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.trail.json
ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.trail.jsonReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.trail.json.sigstoreReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.trail.mdTemporal product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductTemporal (temporal) [MANIFEST.json]
  • Release tagv1.32.2-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Imagereadystack/temporal:v1.32.2-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Image index digestsha256:cef95c57f32b00da6b5e37ee4cba989573785f98c60b5998195cee04b40efcc7 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:c61d529702d8e7ee9bb61d417c71f35963b44ce1a673007bcbb079d19d0417e0 [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.tar.gz (bytes 531099445) [MANIFEST.json]
  • Archive sha256 at publish60717b6815ef3f8085e3bd2484ad8848e51cd3d5e3bafae3a663a1fb41c221b3 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/temporalio/temporal [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv1.32.2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit6d085822273f4336796e6959c73ab1d14a23eb77 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash96b41e631f563f71248b899d3d4aca1d1507334e5e489c7be7a793f7bb6c39e6 (files 3792) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:5b922a315378049d0fdaa4b0dacf4da72a2dcdf85b12213ac26c0ef4289d77e9 [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794304669 (utc 2026-11-10T09:57:49Z) [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.rebuild.json, engine]
  • Engine commit(s)
    • commit e3b1d2bb71e9b79287010c12fdfe2d1fc1ea3f4e · dirty yes · first drive 4177
    • commit 7f9440173909c696b80316b684e74f8071be97cf · dirty yes · first drive 4191
    • commit 0dee9fe68efd869f4c5239279e534f05f77682af · dirty yes · first drive 4202
    • commit e05220953a8a35bb19afca75bce1637a21d4c290 · dirty yes · first drive 4211
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain957 (created 2026-11-10T09:58:49Z · trigger customer_request · upstream version v1.32.2) [chains, chains #957]
  • Requestbuild request #637 (rebuild) (requested at 2026-11-10T09:57:51Z · requested by kitforge-agent · version v1.32.2) [build_requests, build_requests #637]
  • Reasonrerelease agenda REVISION -> v1.32.2-CE-ubuntu24.04-r3 (decay loop, IMP-08) [build_requests, build_requests #637 request_reason]
  • Supersedesreadystack/temporal:v1.32.2-CE-ubuntu24.04-r2 (chain 932) [chains, chains #932]

The path through the harness

Fully recorded

1 chain · 4 drives · 18 stages · 2 rewinds

Chain 957 release · ready_to_ship

Created 2026-11-10T09:58:49Z, upstream v1.32.2, build request 637 [chains, chains #957]

DriveStartedMinutesBuild hostHow it stopped
41772026-11-10T09:59:15Z52.3build host 5 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #4177]
41912026-11-10T21:38:27Z11.5build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4191]
42022026-11-10T22:37:36Z4.2build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4202]
42112026-11-10T23:05:41Z—build host 5 publish-held not recorded [drive_runs, drive_runs #4211]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-10T09:59:26Z2026-11-10T09:59:27Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json bbf34bc80eeb…
acquire 2026-11-10T09:59:33Z2026-11-10T09:59:35Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 21c4e4d5868f…
license_file 6aab9afd99ce…
custody_inputs 74b5ae3ba12f…
source_tree_hash 2f7d9db07295…
source_file_manifest 51741d218812…
plan 2026-11-10T10:00:22Z2026-11-10T10:00:23Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 3ddd4cc80864…
input_pin_plan d67607982f50…
toolchain_lock 14b1c56bfd49…
assemble_kit 2026-11-10T10:10:20Z2026-11-10T10:10:21Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 636796919edb…
build_recipe cec3177b51cc…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health d96a8fd68f75…
verify_offline_sh 3e8184ea230c…
base_image_digests d05a93cc936d…
dockerfile_offline 636796919edb…
first_build_digest fb5a29d23047…
remediate 2026-11-10T10:11:28Z2026-11-10T10:11:28Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 817999961e4c…
security_report 93b8ba5174e3…
build_kit 2026-11-10T10:24:35Z2026-11-10T10:24:36Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 6c39a6cf39e5…
locked_digest d8ea9e08f7f3…
freeze_manifest d47381e492ab…
offline_rebuild_transcript 1410c117845b…
verdict 2026-11-10T10:25:36Z2026-11-10T10:25:37Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict d8abbd16c9e0…
publish_image 2026-11-10T10:26:23Z2026-11-10T10:26:24Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 1a03fa60cbcb…
promotion_record d37036a7bf1e…
boot_instance 2026-11-10T10:26:31Z2026-11-10T10:26:36Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 4bce5c90676e…
sbom 2026-11-10T10:26:53Z2026-11-10T10:26:54Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md e8fcfb5b259b…
sbom_json b71694160054…
schema_discovery 2026-11-10T10:27:01Z2026-11-10T10:27:02Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash e5efed833375…
dependency_tree ee706ebeee4a…
table_classification 9dc89ca8392e…
admin_handbook 2026-11-10T10:34:48Z2026-11-10T10:34:49Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 4358e7696dc9…
admin_handbook 2f88ba626aa6…
db_handbook 2026-11-10T10:42:39Z2026-11-10T10:42:39Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 41232e4ad683…
seed_isolation 2d8dc165f565…
seed_data 2026-11-10T10:42:56Z2026-11-10T10:42:57Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 89c9431f7306…
seed_cases_json 9e66998efc17…
seed_validate 2026-11-10T10:43:01Z2026-11-10T10:43:02Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract f9ffac1d6131…
usecase_validate 2026-11-10T10:43:36Z2026-11-10T10:43:37Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 2c2f15fae4db…
test_results 2a1d994b16c9…
usecase_contract 8326251d816b…
finalize_docs 2026-11-10T10:43:45Z2026-11-10T10:43:46Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 419b3a1efa1a…
release_notes 03bcc4daf287…
api_integration_guide 497d0df76666…
package_archive invalidated 2026-11-10T23:05:15Z 2026-11-10T10:51:31Z2026-11-10T22:41:49Z3
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar aefe8e41a274…
checksums f95959525695…
verify_md cacd24083a85…
rebuild_md b2380a7a5d73…
manifest_txt 018fa09b6900…
actions_jsonl 33729a45f824…
provenance_md 5ce6a08c56fe…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 643ee394f485…

[stage_runs]

Rewinds

  • 2026-11-10T22:27:30Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #30817]
  • 2026-11-10T23:05:15Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #30903]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-10T22:41:49Z.

119 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 010510 —
remediate2001 015128 L-A08, L-038, L-036, L-034, L-032
admin_handbook551603 1345240 —
db_handbook591503 0356968 —
usecase_validate1001 01886 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $2.29 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-10T21:50:33Z 0316 findings to repackage [held_rounds, held_rounds #1702] $1.42 3 rounds, $40.00 9576f92d8a22…
22026-11-10T22:42:25Z 003 clean to publish [held_rounds, held_rounds #1707] $0.87 3 rounds, $40.00 aefe8e41a274…

Defects

Fully recorded
  • Ledger entries23 [defects, defects where product_slug=temporal and this tag or chain]
  • Disclosed in the archive23 [docs/defects/defects.json, entries]

23 ledger entries: by severity high 4, low 19; by status open 1, fixed-before-release 22.

DefectSeverityStatusFound byFixed in
RSD-temporal-cf4abf23f6
With Temporal's JWT authorizer on, the internal service ports 7236/7246 still answer without a token [defects, defects #230837]		highopenbuild strategy record—
RSD-temporal-8edd09b9b0
Admin handbook: States the wrong release (r2) and the wrong predecessor (r1) in the Support section of the packaged admin handbook. [defects, defects #232704]		highfixed-before-releaseheld review (review model)—
RSD-temporal-b434368be7
Admin handbook: Key rotation/revocation commands act on ./jwks.json, not on the mounted temporal-jwks/jwks.json, so following them leaves the withdrawn key valid. [defects, defects #232705]		highfixed-before-releaseheld review (review model)—
RSD-temporal-de66e3dd13
Admin handbook: Steps 2 and 3 move the same file (already consumed) and step 1 contradicts step 2; the revocation step cannot succeed as written. [defects, defects #232706]		highfixed-before-releaseheld review (review model)—
RSD-temporal-df2529dc30
Admin handbook: The server binds all interfaces inside the container; it is the published ports that are limited to 127.0.0.1. [defects, defects #232707]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-0bc51eb704
Admin handbook: A namespace-scoped token does not list namespaces. [defects, defects #232708]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-e9e164addb
Admin handbook: Wrong path. Corrected: 'run `./VERIFY_OFFLINE.sh` from the archive root'. [defects, defects #232709]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-9c3c91495b
Admin handbook: Names the wrong file. Corrected: 'a `temporal_visibility.db` may be 4 KB while its `-wal` is 2.9 MB'. [defects, defects #232710]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-0d929238d0
Admin handbook: TEMPORAL_ADDRESS is described three different ways across the handbooks and has no effect on the server. [defects, defects #232711]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-e98403fe5d
Admin handbook: Contradicts ADMIN:464 and DB:319; nothing advertises this address. [defects, defects #232712]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-a17cf95e40
Database handbook: False: overriding it does not move the listener. [defects, defects #232713]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-c9bc13575e
Database handbook: Same variable, a different (unsupported) meaning than DB:319. [defects, defects #232714]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-9530a0f45f
Database handbook: False: overriding it does not move the listener. [defects, defects #232715]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-30a61adb29
Admin handbook: Contradicts the other descriptions. [defects, defects #232716]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-d86ce50228
Admin handbook: Corrected: '- 7236/tcp (gRPC) and 7246/tcp (HTTP) — internal frontend service'. [defects, defects #232717]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-74b9ca8fd4
Database handbook: Contradicts itself. Corrected: 'The only Temporal administration tool included is `tdbg` (plus `temporal-sql-tool`, `sqlite3` and `rs-probe`).' The same sentence recurs at DB_HANDBOOK.md:1007 and… [defects, defects #232718]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-4639f3db29
Admin handbook: The first sentence contradicts the second. [defects, defects #232719]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-988f865390
Admin handbook: Corrected: '... shown in the Quick Start section.' [defects, defects #232720]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-331f7be80a
Database handbook: Corrected: 'The `--network=none` flag ...'. [defects, defects #232721]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-dec717a850
Admin handbook: Corrected: '... include all these files from the same stopped-container copy of /var/lib/temporal to avoid data loss.' [defects, defects #232722]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-f7c5f3c753
Admin handbook: Describes a restore method (docker exec tar over a running server) that contradicts the documented and tested restore and that no record shows run. [defects, defects #234548]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-29f7410df7
Database handbook: Self-contradictory instruction about which replacement methods the container sees. [defects, defects #234549]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-d935e03445
Admin handbook: Recommends publishing on any interface with JWT alone, contradicting the rule that untrusted networks need mTLS or a proxy. [defects, defects #234550]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:c61d529702d8e7ee9bb61d417c71f35963b44ce1a673007bcbb079d19d0417e0 · published digest sha256:c61d529702d8e7ee9bb61d417c71f35963b44ce1a673007bcbb079d19d0417e0 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 382) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-10T23:06:12Z · failing Docker Scout counts 15 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-10T23:05:51Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3795922882 · transparency-log entry · integrated 2026-11-10T23:10:13Z) [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:cef95c57f32b00da6b5e37ee4cba989573785f98c60b5998195cee04b40efcc7 · state attached · log index 3795926749 · transparency-log entry
    • kind sbom · digest sha256:cef95c57f32b00da6b5e37ee4cba989573785f98c60b5998195cee04b40efcc7 · state attached · log index 3795929045 · transparency-log entry
    • kind vsa · digest sha256:cef95c57f32b00da6b5e37ee4cba989573785f98c60b5998195cee04b40efcc7 · state attached · log index 3795932747 · transparency-log entry
    • kind provenance · digest sha256:c61d529702d8e7ee9bb61d417c71f35963b44ce1a673007bcbb079d19d0417e0 · state attached · log index 3795937401 · transparency-log entry
    • kind sbom · digest sha256:c61d529702d8e7ee9bb61d417c71f35963b44ce1a673007bcbb079d19d0417e0 · state attached · log index 3795940520 · transparency-log entry
    • kind vsa · digest sha256:c61d529702d8e7ee9bb61d417c71f35963b44ce1a673007bcbb079d19d0417e0 · state attached · log index 3795943819 · transparency-log entry
    (at 2026-11-10T23:10:14Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/temporal/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-10T21:50:38Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:c61d529702d8e7ee9bb61d417c71f35963b44ce1a673007bcbb079d19d0417e0 [clean-room rebuild ledger, runs[730]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-10T10:26:24Z [stage_runs, stage_runs chain 957 stage publish_image]
  • Archive manifests written2026-11-10T23:08:09Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 71 · probed 2026-11-10T10:17:55Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-10T23:11:36Z generated: by KitForge release/build_trail.py · generator commit e05220953a8a35bb19afca75bce1637a21d4c290
  • 2026-11-10T23:13:04Z publication: promoted at 2026-11-10T23:12:10Z · promoted digest sha256:cef95c57f32b00da6b5e37ee4cba989573785f98c60b5998195cee04b40efcc7 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 453 · checklist status complete · checklist at 2026-11-10T23:13:04Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/temporal/v1.32.2-CE-ubuntu24.04-r3/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/temporal/v1.32.2-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.rebuild.jsonbeside the archive (prodasset /data/production/temporal/v1.32.2-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r3.rebuild.json.sigstorebeside the archive (prodasset /data/production/temporal/v1.32.2-CE-ubuntu24.04-r3/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/temporal/v1.32.2-CE-ubuntu24.04-r3/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)637
chainssadb, ReadyStack's engine database (not published)957
defectssadb, ReadyStack's engine database (not published)temporal v1.32.2-CE-ubuntu24.04-r3
drive_runssadb, ReadyStack's engine database (not published)chain 957
held_roundssadb, ReadyStack's engine database (not published)chain 957
lesson_recallssadb, ReadyStack's engine database (not published)chain 957
micro_step_runssadb, ReadyStack's engine database (not published)chain 957
release_imagessadb, ReadyStack's engine database (not published)temporal v1.32.2-CE-ubuntu24.04-r3
stage_eventssadb, ReadyStack's engine database (not published)chain 957
stage_runssadb, ReadyStack's engine database (not published)chain 957
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—