[antoinetoussaint-byte]

What this fixes

runners/dockerrun.ImageExists compared RepoTags only. An image named by digest — the form a local build hands back, and the one a run then asks for — was read as absent, so getImageIfNotPresent pulled an image that was already present. With the registry absent or refused (no Docker Hub, by owner rule), that pull is the failure the user sees; it blocks the full local product run's converter agents and, by the owner's gate, Blue.

The change (head ee1ede134e39978bfcc053bc138e39449bd253ee)

ImageExists asks the daemon to resolve the exact requested reference (ImageInspect(FullName())) — the same resolution the later container create performs. Not found is an answer (false, no error); any other daemon failure is an error, so "cannot tell" never becomes "pull it". getImageIfNotPresent is unchanged: it already returns before pulling when the image exists.

Why not a digest scan (first head 721be68c, withdrawn)

Codex's review (/tmp/codex-core861-exact-reference-negative.json) showed that a digest resolves only under the repository name the image carries it as: the local LibreOffice image inspects fine as codefly-dev/documents/libreoffice@sha256:99a0d166… and as its ID, while example.invalid/review-no-such-image@sha256:<same digest> is No such image. The first head matched any RepoDigests entry or the raw ID regardless of repository, so it would have reported present a reference the create then could not find. Gone; the daemon decides.

Test

TestImageExistsResolvesTheExactReference (runners/dockerrun/image_exists_test.go, Docker-gated like the rest of the package; nothing is pulled — the image is imported from a tarball):

• present under its tag; present under its own name@sha256:<ID> (the local-build form) — fails on main, which reads the digest form as absent;
• the same digest requested under another repository name → absent, no error (Codex's negative);
• an unknown tag → absent;
• an unreachable daemon → error (cannot inspect image …), never an absence.

Docs

docs/service-image-plumbing.md gains "Image presence at run time", stating the exact-reference rule, the not-found/daemon-error distinction, and that a locally built image is present under its tag and name@sha256:<ID>.

Status

Candidate for review, not qualified: verified locally with go build ./runners/..., go vet, and the new test against the local daemon (0.6 s). CI is the gate; the converter agents build against this head for local proof. v0.19.9 carries it; do not merge from here.

🤖 Generated with Claude Code

Review fix: build constraint

image_exists_test.go now carries //go:build !skip_infra like the rest of the Docker-gated tests; go test -tags skip_infra ./runners/dockerrun -run '^$' compiles again (it failed with undefined: requireDocker at 6403dd55).