Reject stale native runtime build provenance before release staging

docs/BUILDING.md

@@ -162,6 +162,11 @@ full extracted archive smoke. A legacy worker lacking `--role query` can build
 document vectors while failing foreground search. The archive smoke retains
 captured CLI error output when a command exits unsuccessfully.
 
+Normal runtime inventories now include build-input provenance. Rebuild the
+normal runtime before staging historical caches; source changes invalidate
+their inventory even if the stored file checksums are valid. See
+[runtime provenance](RUNTIME-PROVENANCE.md) for scope and actual validation.
+
 The optional Linux missing-loader check requires explicit root execution and
 util-linux mount namespaces/chroot. It never escalates privileges and verifies
 a private namespace before creating an isolated filesystem:

docs/ROADMAP.md

@@ -119,6 +119,9 @@ release. Keep their evidence and unchecked production gates intact.
   modifying staged resources; corrupted/missing assets preserve existing worker.
 - [x] Transactional resource staging, verified copied bytes, process locking,
   interrupted-copy/swap recovery and backup preservation on failed rollback.
+- [x] Normal Windows/Linux source-build provenance gate before staging and
+  archive preparation; stale inventories preserve existing resources/packages.
+  Actual normal builds verified. See [runtime provenance](RUNTIME-PROVENANCE.md).
 - [ ] Verify power-loss durability and release-tool interaction with resource
   directory swaps on each OS; fault-injected process interruption is narrower.
 - [x] Shared monotonic Basic/Debug search metrics, granular bounded engine traces,

docs/RUNTIME-PROVENANCE.md

@@ -0,0 +1,55 @@
+# Native runtime build-input provenance
+
+Checksum-valid historical runtime caches can be incompatible with the current
+worker protocol. The Linux archive check detected this when an old worker
+encoded documents but rejected the foreground `--role query` option. Source
+release preparation now records and checks build-input identity before staging
+or packaging a normal Windows/Linux runtime.
+
+`runtime-libraries.json` includes `build_provenance`, schema 1, the pinned
+llama.cpp commit and SHA-256 of six bounded inputs: worker.cpp, native
+CMakeLists.txt, build_runtime.py and the three runtime patches. Only CRLF line
+endings in these build inputs are canonicalized to LF, allowing the same
+source revision to compare across checkouts. Indexed user-file bytes and their
+extraction provenance are unaffected.
+
+The builder captures provenance before CMake compilation and rejects changes
+observed afterward before publishing a new inventory. Staging requires it for
+normal distributions; Windows and Linux archive packagers require it as well.
+Missing or stale provenance fails with an explicit normal-runtime rebuild
+instruction before staged resources or an existing archive are replaced.
+Internal explicit CPU tooling retains its legacy optional-inventory path.
+
+This is a stale-cache guard, not a signature, complete upstream source audit,
+proof that a binary implements its claimed protocol, or a hardware-parity test.
+Real query-role and installed-layout inference checks remain necessary.
+Direct Tauri commands do not replace the documented build/stage preparation.
+Existing published packages and user installations do not run this source-build
+check and were not altered retroactively.
+
+## Recorded evidence, 2026-10-13
+
+- 69 tests passed across provenance, builder, staging, Windows packaging and
+  Linux packaging suites; one platform-specific staging test remained skipped.
+  The same suites passed under optimized Python. Regressions reject a valid old
+  inventory without provenance, changed source and oversized inputs, while
+  preserving existing archives. Build-source CRLF/LF equivalence is checked.
+- Actual normal Windows `auto` build and transactional staging passed.
+  Worker SHA-256 remains
+  `c01cb3ec13cfca722ee768e8350e1399a8b9a4d14a24a35adc3473a5cfc82a73`;
+  all 25 Windows DLL hashes also match the previously tested release exactly.
+  New staged inventory SHA-256:
+  `7fde510984b4635ce127d25ad91aab9a391300d7968ac71e4f201cc8edd052e8`.
+- An actual historical extracted Windows inventory was rejected by normal
+  staging preflight for missing provenance. Its files were only read.
+- Actual normal Linux `auto` build passed on Ubuntu 24.04 WSL. The packager
+  verified 21 runtime inventory/files and all six source identities against the
+  current repository, including checkout line-ending differences.
+  Worker SHA-256 remains
+  `b52d50a1e676bd4bf64124daff1c4ce83d86a8bde01e4eaf09838cbb24a4c28f`.
+  New inventory SHA-256:
+  `de6e06c68815b35d83c6acbde468d100413f47c74536f0d4219a9edcbeb01a86`.
+
+These normal builds retain GPU modules plus CPU fallback; no GPU inference was
+executed. macOS inventory integration, cross-compilation and actual GPU checks
+remain open. Published Windows and Linux assets retain their original hashes.