Reject stale native runtime build provenance before release staging

tools/embeddinggemma2/build_runtime.py

@@ -9,10 +9,11 @@ from pathlib import Path
 import shutil
 import subprocess
 import sys
+from runtime_provenance import fingerprint, UPSTREAM_COMMIT
 
 ROOT = Path(__file__).resolve().parents[2]
 TAG = "b11461"
-COMMIT = "4d756bc72bf00a4aacf410ae15a2d315f3db400d"
+COMMIT = UPSTREAM_COMMIT
 WINDOWS_CRT_FILES = (
     "concrt140.dll", "msvcp140.dll", "msvcp140_1.dll", "msvcp140_2.dll",
     "msvcp140_atomic_wait.dll", "msvcp140_codecvt_ids.dll", "vccorlib140.dll",
@@ -40,7 +41,7 @@ def elf_dynamic(path):
     return values
 
 
-def bundle_linux_libraries(build):
+def bundle_linux_libraries(build, provenance=None):
     """Flatten approved SONAME files beside the worker and record dependency closure.
 
     System libc/C++ ABI remains a declared distro compatibility gate. Vulkan's
@@ -94,6 +95,7 @@ def bundle_linux_libraries(build):
         with path.open("rb") as stream:
             return hashlib.file_digest(stream, "sha256").hexdigest()
     inventory = {"platform": "linux", "worker_sha256": checksum(worker),
+        "build_provenance": provenance if provenance is not None else fingerprint(ROOT),
         "libraries": [{"path": path.name, "bytes": path.stat().st_size, "sha256": checksum(path)}
                       for _, path, _ in sorted(records)]}
     temporary = build / "runtime-libraries.json.partial"
@@ -188,10 +190,13 @@ def main():
         except ImportError as error:
             raise RuntimeError("Install CMake first (python -m pip install cmake)") from error
     worker_source = ROOT / "crates/searchi-semantic/native"
+    provenance = fingerprint(ROOT)
     run([cmake_exe, "-S", worker_source, "-B", build,
          "-DCMAKE_BUILD_TYPE=Release", f"-DLLAMA_CPP_DIR={source}",
          f"-DSEARCHI_ACCELERATION={args.backend}"])
     run([cmake_exe, "--build", build, "--config", "Release", "--parallel", args.jobs])
+    if fingerprint(ROOT) != provenance:
+        raise RuntimeError("Native build inputs changed during compilation; rerun the build")
     if vulkan_loader:
         for name in ["vulkan-1.dll", "VULKAN-LICENSE.txt"]:
             shutil.copy2(vulkan_loader / name, build / "Release" / name)
@@ -202,13 +207,14 @@ def main():
             with path.open("rb") as stream:
                 return hashlib.file_digest(stream, "sha256").hexdigest()
         inventory = {"worker_sha256": checksum(directory / "searchi-gemma-worker.exe"),
+            "build_provenance": provenance,
             "libraries": [{"path": path.name, "bytes": path.stat().st_size, "sha256": checksum(path)}
                 for path in sorted(directory.glob("*.dll"))]}
         temporary = directory / "runtime-libraries.json.partial"
         temporary.write_text(json.dumps(inventory, indent=2), encoding="utf-8")
         os.replace(temporary, directory / "runtime-libraries.json")
     if linux_dispatch(args.backend):
-        bundle_linux_libraries(build)
+        bundle_linux_libraries(build, provenance)
     print(f"Runtime build complete: {build}")