Require document helper in Linux headless packages and verify Unix worker

tools/package_linux.py

@@ -17,6 +17,7 @@ import subprocess
 import tarfile
 import tempfile
 from embeddinggemma2.runtime_provenance import verify as verify_provenance
+from stage_extraction_worker import verify as verify_extraction
 
 ROOT = Path(__file__).resolve().parents[1]
 MAX_FILE = 256 * 1024 * 1024
@@ -179,6 +180,16 @@ def package(root, executable, runtime, media, output, llama_license=None, compre
     regular(executable, executable.parent)
     elf_x64(executable)
     expected = runtime_files(runtime, root)
+    extraction = verify_extraction(runtime, root, "linux", "x86_64")
+    helper = runtime / "searchi-extract-worker"
+    regular(helper, runtime)
+    regular(runtime / "extraction-worker.json", runtime)
+    elf_x64(helper)
+    helper_metadata = dynamic(helper)
+    if (helper_metadata.get("RPATH") or helper_metadata.get("RUNPATH")
+            or set(helper_metadata.get("NEEDED", [])) - SYSTEM):
+        raise ValueError("Extraction helper has unexpected native dependency or search path")
+    expected.update(extraction)
     cli_metadata = dynamic(executable)
     if (cli_metadata.get("RPATH") or cli_metadata.get("RUNPATH")
             or set(cli_metadata.get("NEEDED", [])) - SYSTEM):
@@ -214,7 +225,7 @@ def package(root, executable, runtime, media, output, llama_license=None, compre
                 checksum = hashlib.sha256(data).hexdigest()
                 if len(data) != expected_record["bytes"] or checksum != expected_record["sha256"]:
                     raise ValueError(f"Source changed during packaging: {name}")
-                mode = 0o755 if name in {"searchi", "searchi-gemma-worker", "media-runtime/bin/ffmpeg", "media-runtime/bin/ffprobe"} or ".so" in name else 0o644
+                mode = 0o755 if name in {"searchi", "searchi-gemma-worker", "searchi-extract-worker", "media-runtime/bin/ffmpeg", "media-runtime/bin/ffprobe"} or ".so" in name else 0o644
                 add(archive, name, data, mode)
                 records.append({"path": name, "bytes": len(data), "sha256": checksum, "mode": oct(mode)})
             instructions = ("searchi — Find what matters. Locally.\n\n"