Expanded job-key / display matching fixes canonical reusable names but cannot safely map arbitrary name: values such as hook key python versus display static / python (uv, 3.14). The authenticated claim arrives before GARM JobStarted and must not block the hook. After verification, retain only bounded correlation metadata in memory and asynchronously retry the exact runner identity until JobStarted appears; never retry cache delivery or persist the claim token.
Expanded
job-key / displaymatching fixes canonical reusable names but cannot safely map arbitraryname:values such as hook keypythonversus displaystatic / python (uv, 3.14). The authenticated claim arrives before GARM JobStarted and must not block the hook. After verification, retain only bounded correlation metadata in memory and asynchronously retry the exact runner identity until JobStarted appears; never retry cache delivery or persist the claim token.