stage3 hardened tarballs are named as follows:

stage3-amd64-hardened-20110625.tar.bz2

but cl-assemble expects to see tarballs named as follows:

stage3-amd64-20110929.tar.bz2

and so fails with a message that no stage was found. I think the code responsible is in class DistributiveRepository, def getBestStage. There

reStage = re.compile(r'^.*/stage3-%s-(\d+)\.tar\.bz2$'%march,re.S)

does not match the hardened stage because %s-(\d+)\.tar says the "amd64" cannot be followed by -hardened. Maybe change this to

reStage = re.compile(r'^./stage3-%s(hardened)(\d+)\.tar\.bz2$'%march,re.S)

I tested and it works for both.

There is also a problem in cl_fill_assemble.py, the line which reads:

elif re.match(r'.*/stage\d-[]\d.tar.(bz2|gz|lzma|7z)$',image):

This matches only without hardened because stage\d-[^]\d says that after "stage3-" but before the "-20110929", you cannot have another - but amd64-hardened does have a dash.