DL-366
The compass-agent image publishes as a multi-arch OCI image index carrying exactly linux/amd64 + linux/arm64 under the existing :git-<sha12>/:latest/:vX.Y.Z tags, each arch built NATIVELY on its own runner (ubuntu-latest + the free public-repo ubuntu-24.04-arm, never QEMU) and composed by member digest in a serialized manifest job. Consumer-facing tags stay bare, so every puller relies on engine platform negotiation and no consumer changes; the per-arch :git-<sha12>-<arch> tags are internal immutable building blocks. Every single-digest guard is carried forward at manifest-list level rather than dropped — immutability, two-tag coherence and the semver re-tag compare list digests, and the linux/amd64 platform tripwire becomes an exact platform-SET assertion plus per-member arch/os checks, a stricter contract than the one it replaces. Supersedes the linux/amd64 single-arch platform contract of the agent-image publish record; that record’s tag names, immutability posture, auth pin and build-once mechanism all stay live
Status: Active (Matt, 2026-09-12)