[Patrick-Erichsen]

Summary

Runtime publication could rebuild against a different Python base after the native smoke test. Pin both Docker base indexes so verification and export select identical base bytes.

-FROM python:3.12-slim
+FROM python:3.12-slim@sha256:12316d…
-FROM golang:1.27.3
+FROM golang:1.27.3@sha256:6f1acc…

Evidence

• Before: runtime run 40636153126 passed native adapter/smoke checks, then both exports correctly failed the config identity guard. The Python tag changed from index 12316deb… to 6b25cbe6… between builds; arm64 config changed from 4b42bd5c… to a7f948b9….
• After: immutable references select the already-tested base indexes. Real registry reads verify their SHA256 and both amd64/arm64 descriptors. Runtime Go contract checks and all 16 Python publication tests pass; independent P0–P3 review is clean (registry identity verified separately by the author).
• Native PR builds and exact post-merge publication remain the required live proof. Config equality, native smoke, SLSA provenance and complete-platform promotion checks stay intact.

Merge Danger

Door: two-way

Blast Radius: build

Future base refreshes must deliberately update the digest. This change preserves the first smoke-tested Python base instead of adopting the mid-run tag update.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.