searchi/docs/RUNTIME-PROVENANCE.md

Native runtime build-input provenance

Checksum-valid historical runtime caches can be incompatible with the current worker protocol. The Linux archive check detected this when an old worker encoded documents but rejected the foreground --role query option. Source release preparation now records and checks build-input identity before staging or packaging a normal Windows/Linux runtime.

runtime-libraries.json includes build_provenance, schema 1, the pinned llama.cpp commit and SHA-256 of six bounded inputs: worker.cpp, native CMakeLists.txt, build_runtime.py and the three runtime patches. Only CRLF line endings in these build inputs are canonicalized to LF, allowing the same source revision to compare across checkouts. Indexed user-file bytes and their extraction provenance are unaffected.

The builder captures provenance before CMake compilation and rejects changes observed afterward before publishing a new inventory. Staging requires it for normal distributions; Windows and Linux archive packagers require it as well. Missing or stale provenance fails with an explicit normal-runtime rebuild instruction before staged resources or an existing archive are replaced. Internal explicit CPU tooling retains its legacy optional-inventory path.

This is a stale-cache guard, not a signature, complete upstream source audit, proof that a binary implements its claimed protocol, or a hardware-parity test. Real query-role and installed-layout inference checks remain necessary. Direct Tauri commands do not replace the documented build/stage preparation. Existing published packages and user installations do not run this source-build check and were not altered retroactively.

Recorded evidence, 2026-10-13

• 69 tests passed across provenance, builder, staging, Windows packaging and Linux packaging suites; one platform-specific staging test remained skipped. The same suites passed under optimized Python. Regressions reject a valid old inventory without provenance, changed source and oversized inputs, while preserving existing archives. Build-source CRLF/LF equivalence is checked.
• Actual normal Windows auto build and transactional staging passed. Worker SHA-256 remains c01cb3ec13cfca722ee768e8350e1399a8b9a4d14a24a35adc3473a5cfc82a73; all 25 Windows DLL hashes also match the previously tested release exactly. New staged inventory SHA-256: 7fde510984b4635ce127d25ad91aab9a391300d7968ac71e4f201cc8edd052e8.
• An actual historical extracted Windows inventory was rejected by normal staging preflight for missing provenance. Its files were only read.
• Actual normal Linux auto build passed on Ubuntu 24.04 WSL. The packager verified 21 runtime inventory/files and all six source identities against the current repository, including checkout line-ending differences. Worker SHA-256 remains b52d50a1e676bd4bf64124daff1c4ce83d86a8bde01e4eaf09838cbb24a4c28f. New inventory SHA-256: de6e06c68815b35d83c6acbde468d100413f47c74536f0d4219a9edcbeb01a86.

These normal builds retain GPU modules plus CPU fallback; no GPU inference was executed. macOS inventory integration, cross-compilation and actual GPU checks remain open. Published Windows and Linux assets retain their original hashes.