[verified] feat: harden llama.cpp provenance workspace

packages/node/native/llama/PATCH-STACK.md

@@ -15,11 +15,19 @@ loading, endpoint ownership, architecture-defined intermediate boundaries, and
 layer-filtered KV/session mapping. Meshnet routing, Tracker, gRPC, relay,
 billing, authentication, and telemetry must remain outside this directory.
 
-`scripts/llama_cpp_dependency.py` verifies the exact commit/tree and baseline
-blobs, validates every patch digest and context with `git apply --check`, then
-applies the series in `patches/series` order. It refuses a dirty source tree,
-wrong commit/tree/blob, changed patch digest, reordered series, or an existing
-destination/work directory.
+`scripts/llama_cpp_dependency.py fetch` reads the in-repo manifest and checks out
+only its exact commit as detached HEAD in `build/llama.cpp/source`, an ignored
+build workspace. It verifies the exact commit/tree and baseline blobs before use. A
+later offline `fetch` may reuse that cache only after the same clean identity
+verification; an attached branch, tag/repository override, arbitrary destination,
+symlinked workspace, dirty checkout, ignored injected file, or tracked-file
+modification hidden by Git index flags is refused. The tool
+validates every patch digest and context
+with `git apply --check`, then applies the series in `patches/series` order.
+Tracked executable modes are checked physically when Git reports
+`core.filemode=true`; on mounted filesystems without POSIX mode fidelity, the
+locked index tree remains the canonical mode record while every working-file
+blob is independently re-hashed.
 
 ## Current semantic boundary
 

packages/node/native/llama/UPSTREAM_LOCK.json

@@ -3,6 +3,13 @@
   "upstream": "https://github.com/ggml-org/llama.cpp.git",
   "commit": "e920c523e3b8a0163fe498af5bf90df35ff51d25",
   "commit_tree": "6c91a11407a3a3fb160f5dac705f9c59718f54f1",
+  "expected_source": {
+    "git_tree": "6c91a11407a3a3fb160f5dac705f9c59718f54f1"
+  },
+  "retrieval": {
+    "method": "git-clone-detached-commit",
+    "workspace": "build/llama.cpp"
+  },
   "patched_tree": "322d8b463df74a2226f0b513176643d815f54452",
   "upstream_license": "MIT",
   "patch_series": [