[verified] fix: enforce canonical native runtime pin

packages/tracker/meshnet_tracker/recipe.py

@@ -70,6 +70,10 @@ STATUS_CERTIFIED = "certified"
 MIN_CERTIFYING_NODES = 2
 
 _HEX64 = re.compile(r"^[0-9a-f]{64}$")
+_LLAMA_CPP_RUNTIME_PIN = re.compile(
+    r"^llama\.cpp@[0-9a-f]{40}\+patchstack\.[0-9a-f]{64}$"
+)
+_LLAMA_CPP_BACKEND_IDS = frozenset({"llama.cpp", "llama-cpp"})
 _MOVING_REFS = frozenset({"main", "master", "head", "latest", "dev", "trunk"})
 
 
@@ -128,6 +132,17 @@ def _pin(value: Any, what: str) -> str:
     return text
 
 
+def _runtime_pin(value: Any, backend_id: Any) -> str:
+    text = _pin(value, "recipe.runtime_version")
+    backend = _text(backend_id, "recipe.backend_id").strip().lower()
+    if backend in _LLAMA_CPP_BACKEND_IDS and not _LLAMA_CPP_RUNTIME_PIN.fullmatch(text):
+        raise RecipeIdentityError(
+            "'recipe.runtime_version' for llama.cpp must bind a 40-hex commit "
+            "and a 64-hex ordered patch-stack digest"
+        )
+    return text
+
+
 def _mapping(value: Any, what: str) -> Mapping[str, Any]:
     if not isinstance(value, Mapping):
         raise RecipeIdentityError(f"{what!r} must be a JSON object")
@@ -333,7 +348,7 @@ def parse_identity(data: Any) -> PresentedIdentity:
         else:
             axes[axis] = _text(value, f"recipe.{axis}")
     _pin(axes["tokenizer_revision"], "recipe.tokenizer_revision")
-    _pin(axes["runtime_version"], "recipe.runtime_version")
+    _runtime_pin(axes["runtime_version"], axes["backend_id"])
 
     identity = PresentedIdentity(
         artifact_id=_text(artifact.get("artifact_id"), "artifact.artifact_id"),