searchi/docs/RUNTIME-PROVENANCE.md

# Native runtime build-input provenance

Checksum-valid historical runtime caches can be incompatible with the current
worker protocol. The Linux archive check detected this when an old worker
encoded documents but rejected the foreground `--role query` option. Source
release preparation now records and checks build-input identity before staging
or packaging a normal Windows/Linux runtime.

`runtime-libraries.json` includes `build_provenance`, schema 1, the pinned
llama.cpp commit and SHA-256 of seven bounded inputs: worker.cpp, native
CMakeLists.txt, build_runtime.py, the macOS artifact inspector and the three runtime patches. Only CRLF line
endings in these build inputs are canonicalized to LF, allowing the same
source revision to compare across checkouts. Indexed user-file bytes and their
extraction provenance are unaffected.

The builder captures provenance before CMake compilation and rejects changes
observed afterward before publishing a new inventory. Staging requires it for
normal distributions; Windows and Linux archive packagers require it as well.
Missing or stale provenance fails with an explicit normal-runtime rebuild
instruction before staged resources or an existing archive are replaced.
Internal explicit CPU tooling retains its legacy optional-inventory path.

This is a stale-cache guard, not a signature, complete upstream source audit,
proof that a binary implements its claimed protocol, or a hardware-parity test.
Real query-role and installed-layout inference checks remain necessary.
Direct Tauri commands do not replace the documented build/stage preparation.
Existing published packages and user installations do not run this source-build
check and were not altered retroactively.

## Recorded evidence, 2026-10-13

- 75 tests passed across provenance, builder, macOS metadata, staging, Windows
  packaging and Linux packaging suites; one platform-specific staging test remained skipped.
  The same suites passed under optimized Python. Regressions reject a valid old
  inventory without provenance, changed source and oversized inputs, while
  preserving existing archives. Build-source CRLF/LF equivalence is checked.
- Actual normal Windows `auto` build and transactional staging passed.
  Worker SHA-256 remains
  `c01cb3ec13cfca722ee768e8350e1399a8b9a4d14a24a35adc3473a5cfc82a73`;
  all 25 Windows DLL hashes also match the previously tested release exactly.
  New staged inventory SHA-256:
`b3859169d2c21ee5d40cdca038c3494f5620fe544adb2dd404d4535c89b5076b`.
- An actual historical extracted Windows inventory was rejected by normal
  staging preflight for missing provenance. Its files were only read.
- Actual normal Linux `auto` build passed on Ubuntu 24.04 WSL. The packager
  verified 21 runtime inventory/files and all seven source identities against the
  current repository, including checkout line-ending differences.
  Worker SHA-256 remains
  `b52d50a1e676bd4bf64124daff1c4ce83d86a8bde01e4eaf09838cbb24a4c28f`.
  New inventory SHA-256:
  `6463ae8a126f8de3ca4349bbb02fd36852f30222fe30e11fb4070385ce1989e8`.

These normal builds retain GPU modules plus CPU fallback; no GPU inference was
executed. macOS inventory preparation is now implemented and fixture-tested;
[native macOS checks](MACOS-RUNTIME.md), cross-compilation and actual GPU checks
remain open. Published Windows and Linux assets retain their original hashes.