[verified] fix: enforce canonical native runtime pin

packages/node/meshnet_node/runtime_recipe.py

@@ -125,6 +125,10 @@ _AXIS_MISMATCH: Mapping[str, str] = {
 }
 
 _HEX64 = re.compile(r"^[0-9a-f]{64}$")
+_LLAMA_CPP_RUNTIME_PIN = re.compile(
+    r"^llama\.cpp@[0-9a-f]{40}\+patchstack\.[0-9a-f]{64}$"
+)
+_LLAMA_CPP_BACKEND_IDS = frozenset({"llama.cpp", "llama-cpp"})
 
 # A revision that can move is not a pin. DGR-017 learned this on the artifact;
 # it is just as true of a tokenizer.
@@ -194,6 +198,17 @@ def _require_pin(value: Any, what: str) -> str:
     return text
 
 
+def _require_runtime_pin(value: Any, backend_id: Any) -> str:
+    text = _require_pin(value, "recipe.runtime_version")
+    backend = _require_text(backend_id, "recipe.backend_id").strip().lower()
+    if backend in _LLAMA_CPP_BACKEND_IDS and not _LLAMA_CPP_RUNTIME_PIN.fullmatch(text):
+        raise RecipeIdentityError(
+            "'recipe.runtime_version' for llama.cpp must be "
+            "'llama.cpp@<40-hex commit>+patchstack.<64-hex digest>'"
+        )
+    return text
+
+
 def _as_mapping(value: Any, what: str) -> Mapping[str, Any]:
     if not isinstance(value, Mapping):
         raise RecipeIdentityError(
@@ -405,7 +420,7 @@ class RuntimeRecipe:
             else:
                 _require_text(value, f"recipe.{axis}")
         _require_pin(self.tokenizer_revision, "recipe.tokenizer_revision")
-        _require_pin(self.runtime_version, "recipe.runtime_version")
+        _require_runtime_pin(self.runtime_version, self.backend_id)
         _require_text(self.recipe_id, "recipe.recipe_id")
         _require_text(self.recipe_version, "recipe.recipe_version")
         _require_text(self.catalogue_version, "recipe.catalogue_version")