[Craig Alvord (craxal)]

Summary

The production verifier rejects the existing Azure Storage package because its product map still uses azure-storage-canvas. Match the reviewed catalog's azure-storage identity and paths so Storage candidates can be checked without bypassing package integrity.

Changes

• Correct Storage's package, launcher, extension and receipt paths in the verifier.
• Keep checksum, protected-file tampering, canonical-source and immutable-tag rejection checks.
• Refresh affected fixtures and current-release assertions against the production catalog and documented identity.

Release and governance checks

• This PR changes verifier code, tests and directly related documentation only; no product payloads or marketplace entries.
• Reviewer confirmation of applicable contribution requirements.
• No credentials or internal-only payloads are included.
• No release tags, receipts or package versions are changed.

Evidence and handoff

Production base: a1f00ec91e800233fe1b5d67c0814046aceac3fb. This is a separate correction for the existing verifier failure disclosed in #33, not a Storage package release.

node scripts/verify-plugin-marketplace.mjs --candidate now accepts every current production product, including Storage 0.3.0 at its existing immutable tag. Protected runtime, launcher, notices, icon and receipt tampering remain rejection cases.

Focused test/storage-release.test.mjs and test/plugin-marketplace.test.mjs: 20/20 pass.

The first complete production test run passed 43/45. The remaining production catalog matches all installable plugins in order and SRE package has its catalog identity, official preview logo and customer connection steps failures also reproduce on the untouched production base. Their unrelated SRE documentation expectations are not changed here.

Storage source compatibility and preference-save synchronization fixes are being reviewed separately in the source repository. No generated bundle is edited by this PR.

[Craig Alvord (craxal)]

Additional qualification: checked out exact Storage candidate 1a4bf6d in an isolated worktree and overlaid only this corrected verifier as a test fixture. node scripts/verify-plugin-marketplace.mjs --candidate passes every product, including Storage 0.3.1 with its immutable tag correctly pending. Production base a1f00ec separately passes, including released Storage 0.3.0 at azure-storage-v0-3-0-9347124. No payload, historical receipt or tag was changed. Focused verifier tests pass 20/20; both broader SRE documentation failures reproduce on untouched production main. Source compatibility and synchronized preferences acceptance are in coreai-microsoft/canvases-cloud-foundation#319; this PR remains verifier-only.