What happened
On a linux/amd64 node, a PodSpec pinned this platform manifest digest:
sha256:8ac42c16a1ff759707b4454d466ef172b0198bd50baac1c4e2526d104f0f9fd7
The container runtime reported this OCI index digest in
status.containerStatuses[].imageID:
sha256:3f082e22e2e829c986b5d31099353510e3762a233689254483c04bb84c3c6777
The exact raw OCI index maps its linux/amd64 entry to the pinned platform
manifest. The Pods were Running and Ready, but InstanceSet ready/available
remained zero because the controller required strict digest equality.
Expected behavior
The controller should accept a proven OCI/Docker index-parent and
platform-manifest child relation for the Pod's scheduled Node platform, without
accepting arbitrary digest mismatches or requiring registry access during
reconciliation.
Direct digest equality and existing tag/registry rewrite behavior must remain
unchanged. Missing, invalid, ambiguous, or wrong-platform proof must fail
closed; transient Node reads must return a reconciliation error.
Scope
The reproduced runtime evidence is one exact OBE Stage00a sample. It does not
claim that every runtime, image, engine, or topology has this behavior. The
original scene is frozen; validation of a fix will use a fresh isolated sample.
What happened
On a linux/amd64 node, a PodSpec pinned this platform manifest digest:
sha256:8ac42c16a1ff759707b4454d466ef172b0198bd50baac1c4e2526d104f0f9fd7The container runtime reported this OCI index digest in
status.containerStatuses[].imageID:sha256:3f082e22e2e829c986b5d31099353510e3762a233689254483c04bb84c3c6777The exact raw OCI index maps its linux/amd64 entry to the pinned platform
manifest. The Pods were Running and Ready, but InstanceSet ready/available
remained zero because the controller required strict digest equality.
Expected behavior
The controller should accept a proven OCI/Docker index-parent and
platform-manifest child relation for the Pod's scheduled Node platform, without
accepting arbitrary digest mismatches or requiring registry access during
reconciliation.
Direct digest equality and existing tag/registry rewrite behavior must remain
unchanged. Missing, invalid, ambiguous, or wrong-platform proof must fail
closed; transient Node reads must return a reconciliation error.
Scope
The reproduced runtime evidence is one exact OBE Stage00a sample. It does not
claim that every runtime, image, engine, or topology has this behavior. The
original scene is frozen; validation of a fix will use a fresh isolated sample.