# Require Customer ECR Digest and Pull Proof

After production account setup and before BYOC Region readiness, CP9 mirrors
the exact core-lifecycle image closure into the ECR registry derived from the
configured customer account ID and image-sync region. Activation fails unless
every required source image resolves immutably and the customer ECR contains
the same manifest digest. CP9 performs this ephemeral-target sync locally with
the customer account-setup profile and does not add the dogfood account to the
shared production `docker-image-controller` target list.

Closure discovery fails closed on an unpinned or malformed image instead of
silently omitting it, rejects two sources that would overwrite one customer
repository/tag, and gives digest-form source references a deterministic ECR
tag while retaining their exact digest reference in runtime configuration.
Image references embedded in command arguments such as
`--backup-manager-image=<reference>` are canonicalized to the reference before
closure hashing and registry operations; CLI wrapper syntax is not part of an
image source and must never reach `crane`.

Before any AWS identity read or activation mutation, preflight executes
`crane version` through the normal verbose command runner and requires the
repo-pinned `v0.20.6` used by the shipped image workflow. A missing or different
binary fails with the exact pinned `go install` remediation, before selector or
account lease acquisition, CloudFormation, or ECR writes. This is an ephemeral
operator-side tool prerequisite; it is never copied to the remote host or
customer runtime.

`cp-byoc` control-plane service images may continue to use the control-plane
account registry. Every image that runs in the customer dataplane must resolve
to the customer ECR; there is no CP-registry fallback. The later real cluster
train captures running pod image references and image IDs and proves they match
the activation digest manifest, whether the declared image uses a tag or a
digest. This follows the production order—account
setup, target image sync/verification, region deployment, cluster lifecycle—
while making the ephemeral CP9 target synchronously ready rather than waiting
for the shared two-hour image-sync schedule.