RC34: verified Cloud Run image reconciliation

RC34 corrects Control reconciliation when Cloud Run resolves an immutable OCI image index to its Linux/AMD64 manifest. RC33's native repair completed its data work, but Control rejected that resolved identity before collecting results and restoring job settings.

The adapter now verifies the exact relationship through authenticated Artifact Registry metadata. The configured job image, account, command, execution identity, and repair payload checks remain enforced; unrelated images and ambiguous metadata are rejected. Control needs artifactregistry.dockerImages.get on the existing image repository when this resolution is necessary.

This is a Control-only correction. The API contract bundle and native repair protocol are unchanged. The named worker for this integration remains the verified Linux/AMD64 RC33 runtime:

ghcr.io/harrisonoconnorhover/dander@sha256:89bd242e55d6e5ca37394ce81187f7d036e26b670c22f0ed5805a3c1df9447dc

Install the attached RC34 wheel with the required postgres, bigquery, and gcp extras for Control. The GitHub wheel is not available through PyPI; the standard public beta remains RC20. Use the named runtime base for the project's configuration image instead of the default generated Dockerfile that expects a PyPI RC34 package.

Protected source: 6964d63f4e9e8eab15ce63e4a1c65efb5268c2d0. Exact-main CI: 36874195042. The wheel/source archive passed distribution checks; the fresh installed wheel verified all 45 contract files and the Salesforce0.3.2/ServiceNow0.2.3 pair. See SHA256SUMS for exact digests. Release assets and tag are immutable.

Contract bundle SHA-256: a28316b7e5158e0520fe1c24d59885083714f47b67aa396892fa9742060fb279.

The initial native-engine observation and the corrective Control qualification are distinct records. This candidate does not promote additional providers, production identity-provider support, multiple Control replicas, or the broader Phase8 release gates. Date repair uses current retained raw data and is atomic per output, not across a whole graph.

Completed paired qualification

The distinct synthetic run run-ec3ecadaeb48d3cca4ccf537 completed through RC34 Control, the RC33 Cloud Run worker, and BigQuery. Control recorded two output rows written, four affected, and zero ingestion rows. Surrounding output rows, raw data, and the watermark were unchanged; the original Job settings were restored. Repeated submission returned the same run with exactly one native execution. Druff's real production client successfully read its status and explanation. All temporary cloud resources were cleaned before their deadlines; local proof databases/processes and task credentials were also removed.

The matched Druff 0.2.0-rc.1 image is public and anonymously verified:

ghcr.io/harrisonoconnorhover/druff@sha256:6aade12c399a67c604577e4a022af6dff22db7764626dd9a7a4f5cea1a2ceac1

See the candidate setup and bounded qualification record for exact artifact identities, hosted-mode prerequisites, and proof limits. Both connector packages passed all 116 tests against the public RC34 wheel. Existing Druff active/rollback aliases and the public PyPI RC20 beta remain unchanged.