searchi/docs/RUNTIME-PROVENANCE.md

Native runtime build-input provenance

Checksum-valid historical runtime caches can be incompatible with the current worker protocol. The Linux archive check detected this when an old worker encoded documents but rejected the foreground --role query option. Source release preparation now records and checks build-input identity before staging or packaging a normal Windows/Linux runtime.

runtime-libraries.json includes build_provenance, schema 1, the pinned llama.cpp commit and SHA-256 of seven bounded inputs: worker.cpp, native CMakeLists.txt, build_runtime.py, the macOS artifact inspector and the three runtime patches. Only CRLF line endings in these build inputs are canonicalized to LF, allowing the same source revision to compare across checkouts. Indexed user-file bytes and their extraction provenance are unaffected.

The builder captures provenance before CMake compilation and rejects changes observed afterward before publishing a new inventory. Staging requires it for normal distributions; Windows and Linux archive packagers require it as well. Missing or stale provenance fails with an explicit normal-runtime rebuild instruction before staged resources or an existing archive are replaced. Internal explicit CPU tooling retains its legacy optional-inventory path.

This is a stale-cache guard, not a signature, complete upstream source audit, proof that a binary implements its claimed protocol, or a hardware-parity test. Real query-role and installed-layout inference checks remain necessary. Direct Tauri commands do not replace the documented build/stage preparation. Existing published packages and user installations do not run this source-build check and were not altered retroactively.

Recorded evidence, 2026-10-13

• 75 tests passed across provenance, builder, macOS metadata, staging, Windows packaging and Linux packaging suites; one platform-specific staging test remained skipped. The same suites passed under optimized Python. Regressions reject a valid old inventory without provenance, changed source and oversized inputs, while preserving existing archives. Build-source CRLF/LF equivalence is checked.
• Actual normal Windows auto build and transactional staging passed. Worker SHA-256 remains c01cb3ec13cfca722ee768e8350e1399a8b9a4d14a24a35adc3473a5cfc82a73; all 25 Windows DLL hashes also match the previously tested release exactly. New staged inventory SHA-256: b3859169d2c21ee5d40cdca038c3494f5620fe544adb2dd404d4535c89b5076b.
• An actual historical extracted Windows inventory was rejected by normal staging preflight for missing provenance. Its files were only read.
• Actual normal Linux auto build passed on Ubuntu 24.04 WSL. The packager verified 21 runtime inventory/files and all seven source identities against the current repository, including checkout line-ending differences. Worker SHA-256 remains b52d50a1e676bd4bf64124daff1c4ce83d86a8bde01e4eaf09838cbb24a4c28f. New inventory SHA-256: 6463ae8a126f8de3ca4349bbb02fd36852f30222fe30e11fb4070385ce1989e8.

These normal builds retain GPU modules plus CPU fallback; no GPU inference was executed. macOS inventory preparation is now implemented and fixture-tested; native macOS checks, cross-compilation and actual GPU checks remain open. Published Windows and Linux assets retain their original hashes.