Temporal v1.32.2-CE-ubuntu24.04-r4 build trail

How ReadyStack built readystack/temporal:v1.32.2-CE-ubuntu24.04-r4 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/temporal:v1.32.2-CE-ubuntu24.04-r4
  • Index digestsha256:458e998a4cd6d928e67bdebd24e7bfb4ca4a0fa1fc5a06a5d32989426cb3173c
  • linux/amd64 digestsha256:d37228f6cacfa2fba29c7dccb534f62777b6ab8d366b936478fc5e81febea2ad
  • ArchiveReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.tar.gz
  • Archive SHA-256 now90ed837ac5775d34548b3fde2c6fcbdbe4cad4acf932fa53aa2939fd9102192e
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-13T02:04:21Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.trail.json.sigstore ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.trail.json
ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.trail.jsonReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.trail.json.sigstoreReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.trail.mdTemporal product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductTemporal (temporal) [MANIFEST.json]
  • Release tagv1.32.2-CE-ubuntu24.04-r4 [MANIFEST.json]
  • Imagereadystack/temporal:v1.32.2-CE-ubuntu24.04-r4 [MANIFEST.json]
  • Image index digestsha256:458e998a4cd6d928e67bdebd24e7bfb4ca4a0fa1fc5a06a5d32989426cb3173c [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:d37228f6cacfa2fba29c7dccb534f62777b6ab8d366b936478fc5e81febea2ad [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.tar.gz (bytes 531350376) [MANIFEST.json]
  • Archive sha256 at publish90ed837ac5775d34548b3fde2c6fcbdbe4cad4acf932fa53aa2939fd9102192e [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/temporalio/temporal [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv1.32.2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit6d085822273f4336796e6959c73ab1d14a23eb77 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash96b41e631f563f71248b899d3d4aca1d1507334e5e489c7be7a793f7bb6c39e6 (files 3792) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:9fe9809b1d0c425fd8e200b7dd2cb7f731032c56eb0e4a89463fead53cd2aa30 [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794451820 (utc 2026-11-12T02:50:20Z) [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.11-bookworm@sha256:dc40a13b61304647ed7e5d581d246b86413dfc29d63c6d018310feb93cd98fc0 · platform digest sha256:79ecd0a7157c7a4cf3b281ced8465350591bf54fedab540e75374a003e1fde7e
    • ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
    [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.rebuild.json, engine]
  • Engine commit(s)
    • commit f90b852f37265087900c9acdca31849ac5b61408 · dirty yes · first drive 4505
    • commit 6ed046ff1b6d5adfbedc6043b869ed0a4926d67c · dirty yes · first drive 4515
    • commit 7c94125a6f5fc584666dcc47caabc650fd3931aa · dirty yes · first drive 4516
    • commit 7d415ff1f1bd2eff83cf586201c7b05acd529095 · dirty yes · first drive 4524
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain1047 (created 2026-11-12T23:12:55Z · trigger customer_request · upstream version v1.32.2) [chains, chains #1047]
  • Requestbuild request #728 (rebuild) (requested at 2026-11-12T02:50:23Z · requested by kitforge-agent · version v1.32.2) [build_requests, build_requests #728]
  • Reasonrevision v1.32.2-CE-ubuntu24.04-r4: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #728 request_reason]
  • Supersedesreadystack/temporal:v1.32.2-CE-ubuntu24.04-r3 (chain 957) [chains, chains #957]

The path through the harness

Fully recorded

1 chain · 4 drives · 18 stages · 3 rewinds

Chain 1047 release · ready_to_ship

Created 2026-11-12T23:12:55Z, upstream v1.32.2, build request 728 [chains, chains #1047]

DriveStartedMinutesBuild hostHow it stopped
45052026-11-12T23:13:22Z42.4build host 1 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4505]
45152026-11-13T00:40:19Z3.8build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4515]
45162026-11-13T01:11:08Z4build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4516]
45242026-11-13T01:58:59Z—build host 1 publish-held not recorded [drive_runs, drive_runs #4524]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-12T23:13:33Z2026-11-12T23:13:33Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 488c52187415…
acquire 2026-11-12T23:13:40Z2026-11-12T23:13:42Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 21c4e4d5868f…
license_file 6aab9afd99ce…
custody_inputs 74b5ae3ba12f…
source_tree_hash 2f7d9db07295…
source_file_manifest 51741d218812…
plan 2026-11-12T23:15:01Z2026-11-12T23:15:01Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 9c238e046e4f…
input_pin_plan 8375476bcf40…
toolchain_lock f71ca090c30d…
assemble_kit 2026-11-12T23:21:19Z2026-11-12T23:21:19Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile f2b707572c45…
build_recipe a0d9ddc9fb9f…
system_pinning aa8db05a9a8a…
build_offline_sh 6ab4f08a6ec7…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 64262b3c7f29…
verify_offline_sh 3e8184ea230c…
base_image_digests 5773ae92c960…
dockerfile_offline f2b707572c45…
first_build_digest 7d5604f3b41e…
remediate 2026-11-12T23:22:28Z2026-11-12T23:22:28Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log f419c5ededa3…
security_report 47179d537d23…
build_kit 2026-11-12T23:31:49Z2026-11-12T23:31:49Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 69edcfd1ac01…
locked_digest 5fd629150ac4…
freeze_manifest 13243251e81c…
offline_rebuild_transcript e03da3c66ba9…
verdict 2026-11-12T23:32:36Z2026-11-12T23:32:37Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 7242f263d8fa…
publish_image 2026-11-12T23:33:14Z2026-11-12T23:33:14Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme c09434773aea…
promotion_record 4296d09edd0e…
boot_instance 2026-11-12T23:33:26Z2026-11-12T23:33:31Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle ea9e96cc04e8…
sbom 2026-11-12T23:33:44Z2026-11-12T23:33:45Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 7f5a59d53b4b…
sbom_json a9cdce6a328e…
schema_discovery 2026-11-12T23:33:51Z2026-11-12T23:33:52Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash e5efed833375…
dependency_tree ee706ebeee4a…
table_classification 9dc89ca8392e…
admin_handbook 2026-11-12T23:40:06Z2026-11-12T23:40:06Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 4358e7696dc9…
admin_handbook c5f31672244b…
db_handbook 2026-11-12T23:45:17Z2026-11-12T23:45:18Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 3d1324bccf83…
seed_isolation 2d8dc165f565…
seed_data 2026-11-12T23:45:34Z2026-11-12T23:45:35Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql fa85da0163fe…
seed_cases_json b0dfbc5048d8…
seed_validate 2026-11-12T23:45:38Z2026-11-12T23:45:39Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 979684c950ae…
usecase_validate 2026-11-12T23:46:08Z2026-11-12T23:46:09Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 65810a6e5546…
test_results ef23ce8720fa…
usecase_contract d182844fd64f…
finalize_docs 2026-11-12T23:46:15Z2026-11-12T23:46:16Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 2039987d4ea3…
release_notes 0f73d79f0f20…
api_integration_guide 040e8409b421…
package_archive invalidated 2026-11-13T01:58:37Z 2026-11-12T23:55:44Z2026-11-13T01:15:08Z3
37 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 unpack_files
  • G8 scout_grade_a
  • G8 script_copies
  • G8 upgrade_check
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 9e9d9c14f6bc…
checksums dddabd307ddd…
verify_md b818cde58e5b…
rebuild_md 1ba4f85e9450…
manifest_txt 54d602367503…
actions_jsonl 181b1a7a9b25…
provenance_md cf0201a19205…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 8cc516bfc72d…

[stage_runs]

Rewinds

  • 2026-11-13T00:39:35Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #35013]
  • 2026-11-13T01:09:42Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #35035]
  • 2026-11-13T01:58:37Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #35158]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-13T01:15:08Z.

59 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 010867 —
remediate2001 015376 L-A08, L-038, L-036, L-034, L-032
admin_handbook29403 1172452 —
db_handbook25402 0137997 —
usecase_validate1001 01866 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

3 rounds, 3 counted, $4.25 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-12T23:59:47Z 075 findings to repackage [held_rounds, held_rounds #1847] $1.42 3 rounds, $40.00 a9c8dbadf1e3…
22026-11-13T00:44:34Z 0112 findings to repackage [held_rounds, held_rounds #1848] $1.38 3 rounds, $40.00 93bfe21789a2…
32026-11-13T01:15:34Z 008 clean to publish [held_rounds, held_rounds #1850] $1.45 3 rounds, $40.00 9e9d9c14f6bc…

Defects

Fully recorded
  • Ledger entries34 [defects, defects where product_slug=temporal and this tag or chain]
  • Disclosed in the archive34 [docs/defects/defects.json, entries]

34 ledger entries: by severity high 9, low 25; by status open 1, fixed-before-release 33.

DefectSeverityStatusFound byFixed in
RSD-temporal-04e67f5cbd
With Temporal's JWT authorizer on, the internal service ports 7236/7246 still answer without a token [defects, defects #275665]		highopenbuild strategy record—
RSD-temporal-075ff9d022
Admin handbook: Example token payload puts the role in a top-level boolean claim; the default claim mapper reads only the permissions list, so a token built from the example is refused, and it contradicts the… [defects, defects #276081]		highfixed-before-releaseheld review (review model)—
RSD-temporal-f8800b1b71
Admin handbook: Namespace-scoped example payload uses a boolean claim that the claim mapper ignores. [defects, defects #276082]		highfixed-before-releaseheld review (review model)—
RSD-temporal-edf2217ca7
Admin handbook: States the minimum register request as namespace + description; that request is refused with 400, the retention period is the required field. [defects, defects #276083]		highfixed-before-releaseheld review (review model)—
RSD-temporal-7a0e4f49b1
Admin handbook: The tdbg example uses a subcommand that does not exist in the shipped tdbg 1.32.2. [defects, defects #276084]		highfixed-before-releaseheld review (review model)—
RSD-temporal-b9d3c00ec8
Admin handbook: The 'verify the database integrity' example runs in a new container with no data volume, so it can only fail. [defects, defects #276085]		highfixed-before-releaseheld review (review model)—
RSD-temporal-41a6b776e2
Admin handbook: Names the built binaries as frontend/history/matching services; those are services inside temporal-server, not binaries, and the image builds four binaries. [defects, defects #276086]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-0a494bf266
Admin handbook: States the product version as v1.32.1, contradicting the rest of the document and the binary. [defects, defects #276087]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-61a7b9effe
Database handbook: The run command for the rebuilt image passes a tar file name as the image reference. [defects, defects #276088]		highfixed-before-releaseheld review (review model)—
RSD-temporal-6ca063def2
Database handbook: The example override points the databases at /custom/path, which does not exist in the image and is outside the persisted volume; the container exits at start. [defects, defects #276089]		highfixed-before-releaseheld review (review model)—
RSD-temporal-d9cd3f5a27
Database handbook: Says the variables must not be overridden while other sections instruct overriding them. [defects, defects #276090]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-ffde40f761
Database handbook: Accepts JWT authorization alone as sufficient for public/0.0.0.0 exposure, contradicting the rule at line 342 and the Operating facts that untrusted networks need mTLS or an authorizing proxy. [defects, defects #276091]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-e571953602
Admin handbook: Offers JWT alone as an alternative to mTLS/proxy for untrusted networks, contradicting the rule stated elsewhere. [defects, defects #276092]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-d36d22ac08
Database handbook: BUILD_OFFLINE.sh:143-145: 'the docker export is the same build, emitted in the one format `docker load` accepts (it cannot read an OCI layout)'; VERIFY_OFFLINE.sh loads only rebuilt.docker.tar. [defects, defects #276339]		highfixed-before-releaseheld review (review model)—
RSD-temporal-0b8174a9b4
Database handbook: Same file line 342 and Operating facts line 182 require mTLS or an authorizing proxy for untrusted networks even with JWT; this sentence accepts 'enabling authorization' alone for 0.0.0.0 (round-1… [defects, defects #276340]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-53805f7ba1
Admin handbook: Admin line 135/145/881 and DB line 342: JWT alone is not sufficient for untrusted networks; 'any network' contradicts it. [defects, defects #276341]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-279c81b80b
Admin handbook: The docker run at admin lines 759-770 sets five -e variables (TEMPORAL_AUTH_AUTHORIZER, TEMPORAL_AUTH_CLAIM_MAPPER, TEMPORAL_JWT_KEY_SOURCE1, USE_INTERNAL_FRONTEND, TEMPORAL_SERVICES); line 773 says… [defects, defects #276342]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-7b42067ab2
Database handbook: Operating facts line 202: 'with the authorizer alone the server's built-in worker is refused'; 'Without the authorizer alone' says the opposite. [defects, defects #276343]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-5feea4d0c8
Database handbook: Admin line 726: 'The internal frontend exists only when USE_INTERNAL_FRONTEND=true and TEMPORAL_SERVICES include internal-frontend'; it is an environment setting, not a consequence of enabling JWT. [defects, defects #276344]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-a142b75fbc
Database handbook: The command that follows is `command -v sqlite3`, which prints a path, not a version (sqlite3 --version in the image prints 3.45.1). [defects, defects #276345]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-5f501a541d
Database handbook: Ran this example on a volume holding data (a namespace my-namespace): the container starts healthy but opens new empty custom.db files; only temporal-system and default exist and my-namespace is not… [defects, defects #276346]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-17a71c35f7
Admin handbook: Dockerfile.offline:3 (FROM golang:1.26.11-bookworm@sha256:dc40a13b…) and docs/PINS.md:25 (Builder image golang:1.26.11-bookworm) [defects, defects #276347]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-6b5ba27204
Admin handbook: Dockerfile.offline:3 (FROM golang:1.26.11-bookworm@sha256:dc40a13b…) and docs/PINS.md:25 (Builder image golang:1.26.11-bookworm) [defects, defects #276348]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-8a3b0979ff
Admin handbook: Dockerfile.offline:3 (FROM golang:1.26.11-bookworm@sha256:dc40a13b…) and docs/PINS.md:25 (Builder image golang:1.26.11-bookworm) [defects, defects #276349]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-ec97365152
Database handbook: Dockerfile.offline:3 (FROM golang:1.26.11-bookworm@sha256:dc40a13b…) and docs/PINS.md:25 (Builder image golang:1.26.11-bookworm) [defects, defects #276350]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-807a8b9718
Database handbook: Dockerfile.offline:3 (FROM golang:1.26.11-bookworm@sha256:dc40a13b…) and docs/PINS.md:25 (Builder image golang:1.26.11-bookworm) [defects, defects #276351]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-03b67f38b9
Admin handbook: Paraphrase of the round-2 JWT-alone finding [defects, defects #276625]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-940c5e9070
Admin handbook: Same JWT-alone paraphrase [defects, defects #276626]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-b390929826
Database handbook: Same JWT-alone paraphrase [defects, defects #276627]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-5ed8aa6243
Docker Hub README: Same JWT-alone paraphrase in the Docker Hub README [defects, defects #276628]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-f939567824
Database handbook: Cross-section contradiction: a private network interface both requires and does not require an mTLS terminator or proxy [defects, defects #276629]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-bcba9cd002
Admin handbook: False causal claim: the internal frontend skips token checks because it has no authorizer, not because it is unpublished [defects, defects #276630]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-350e1dcda0
Admin handbook: The worker does not authenticate; it reaches the unauthenticated internal frontend [defects, defects #276631]		lowfixed-before-releaseheld review (review model)—
RSD-temporal-12c0a01d8f
Admin handbook: Miscount that implies six variables [defects, defects #276632]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:d37228f6cacfa2fba29c7dccb534f62777b6ab8d366b936478fc5e81febea2ad · published digest sha256:d37228f6cacfa2fba29c7dccb534f62777b6ab8d366b936478fc5e81febea2ad · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 266) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T01:59:25Z · failing Docker Scout counts 15 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T01:59:09Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3843411562 · transparency-log entry · integrated 2026-11-13T02:02:55Z) [ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:458e998a4cd6d928e67bdebd24e7bfb4ca4a0fa1fc5a06a5d32989426cb3173c · state attached · log index 3843412203 · transparency-log entry
    • kind sbom · digest sha256:458e998a4cd6d928e67bdebd24e7bfb4ca4a0fa1fc5a06a5d32989426cb3173c · state attached · log index 3843412493 · transparency-log entry
    • kind vsa · digest sha256:458e998a4cd6d928e67bdebd24e7bfb4ca4a0fa1fc5a06a5d32989426cb3173c · state attached · log index 3843412841 · transparency-log entry
    • kind provenance · digest sha256:d37228f6cacfa2fba29c7dccb534f62777b6ab8d366b936478fc5e81febea2ad · state attached · log index 3843413170 · transparency-log entry
    • kind sbom · digest sha256:d37228f6cacfa2fba29c7dccb534f62777b6ab8d366b936478fc5e81febea2ad · state attached · log index 3843413362 · transparency-log entry
    • kind vsa · digest sha256:d37228f6cacfa2fba29c7dccb534f62777b6ab8d366b936478fc5e81febea2ad · state attached · log index 3843413630 · transparency-log entry
    (at 2026-11-13T02:02:56Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/temporal/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-12T23:59:52Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:d37228f6cacfa2fba29c7dccb534f62777b6ab8d366b936478fc5e81febea2ad [clean-room rebuild ledger, runs[812]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-12T23:33:14Z [stage_runs, stage_runs chain 1047 stage publish_image]
  • Archive manifests written2026-11-13T02:01:13Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 71 · probed 2026-11-12T23:27:07Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-13T02:04:21Z generated: by KitForge release/build_trail.py · generator commit 7d415ff1f1bd2eff83cf586201c7b05acd529095
  • 2026-11-13T02:05:54Z publication: promoted at 2026-11-13T02:05:00Z · promoted digest sha256:458e998a4cd6d928e67bdebd24e7bfb4ca4a0fa1fc5a06a5d32989426cb3173c · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 528 · checklist status complete · checklist at 2026-11-13T02:05:54Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/temporal/v1.32.2-CE-ubuntu24.04-r4/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/temporal/v1.32.2-CE-ubuntu24.04-r4/), as staged for publishing—
ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.rebuild.jsonbeside the archive (prodasset /data/production/temporal/v1.32.2-CE-ubuntu24.04-r4/), as staged for publishing—
ReadyStack-temporal-v1.32.2-CE-ubuntu24.04-r4.rebuild.json.sigstorebeside the archive (prodasset /data/production/temporal/v1.32.2-CE-ubuntu24.04-r4/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/temporal/v1.32.2-CE-ubuntu24.04-r4/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)728
chainssadb, ReadyStack's engine database (not published)1047
defectssadb, ReadyStack's engine database (not published)temporal v1.32.2-CE-ubuntu24.04-r4
drive_runssadb, ReadyStack's engine database (not published)chain 1047
held_roundssadb, ReadyStack's engine database (not published)chain 1047
lesson_recallssadb, ReadyStack's engine database (not published)chain 1047
micro_step_runssadb, ReadyStack's engine database (not published)chain 1047
release_imagessadb, ReadyStack's engine database (not published)temporal v1.32.2-CE-ubuntu24.04-r4
stage_eventssadb, ReadyStack's engine database (not published)chain 1047
stage_runssadb, ReadyStack's engine database (not published)chain 1047
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—