[WP02 · SubStep 02.04] Stamp version axes and compiled build identity

.github/workflows/package-validation.yml

@@ -62,7 +62,7 @@ jobs:
           PACKAGE_VERSION: ${{ steps.version.outputs.value }}
         shell: pwsh
         run: |
-          dotnet build DesktopPlatform.slnx -c Release --no-restore "-p:PackageVersion=$env:PACKAGE_VERSION"
+          dotnet build DesktopPlatform.slnx -c Release --no-restore "-p:PackageVersion=$env:PACKAGE_VERSION" "-p:Version=$env:PACKAGE_VERSION"
           if ($LASTEXITCODE) { throw 'Platform build failed.' }
           dotnet test --project tests/ArchitectureTests/ArcForges.Tests.ArchitectureTests.csproj -c Release --no-build
           if ($LASTEXITCODE) { throw 'Platform ownership tests failed.' }

.github/workflows/pr-gate.yml

@@ -93,6 +93,8 @@ jobs:
           python-version-file: .python-version
       - name: Reject source, export, citation and dependency drift
         run: python -m unittest discover -s eng -p test_design_policy.py -v
+      - name: Reject aliased version axes and invalid build identities
+        run: python -m unittest discover -s eng -p test_build_identity.py -v
       - name: Verify exports against an isolated immutable Design checkout
         run: python eng/design_policy.py
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

README.md

@@ -120,3 +120,6 @@ historical dispositions and planned directory owners to exact source and candida
 Python-running CI jobs select `.python-version`. Install the reviewed hook tooling with `python -m pip install --require-hashes -r eng/requirements-ci.txt`; all transitive tools are exact and hash-verified. After downloading that closure to a wheel directory, `pip install --no-index --find-links <directory> --require-hashes -r eng/requirements-ci.txt` verifies an offline repeat. Dependency updates review the complete closure and hashes.
 
 For ordinary local native compilation, reuse the already installed vcpkg and suitable installed dependencies. Pass the existing installed-root to the build or use ignored local configuration; do not reinstall vcpkg or rebuild working dependencies just for a patch-version difference. The admitted CI candidate still uses the committed producer baseline and provenance. Local compatibility results record the actual tools and do not attest arbitrary local binaries as the publishable candidate.
+
+[Build identity and independent version axes](docs/build-identity.md) documents package reports, compiled
+metadata, runtime retrieval and the distinction between current ABI probes and future product schemas.

docs/build-identity.md

@@ -0,0 +1,32 @@
+# Independent versions and build identity
+
+WP02.04 follows the accepted [nine-owner profile](https://github.com/ArcForges/ArcForges-Design/blob/main/docs/assurance/wp02-04-version-identity-profile.md).
+`eng/version-sources.json` declares all nine axes. NativeAbiVersion reads the actual C header constants;
+PackageVersion reads committed NuGet locks and the audited native SBOM dependency closure. AppVersion
+and business contracts are not applicable to these library foundations. Future capability descriptors,
+portable formats, migrations, product policy and extensions remain explicitly not produced, with their
+future producer named. Neither a package release nor the ABI probes imply those features exist.
+
+Each NuGet contains `build-identity.json` (`arcforges.build-identity.v1`): artifact coordinates, all nine
+axes with source digests, and source/run identity. Verification independently resolves the axes from
+the verifier checkout and sealed native SBOMs, compares the original candidate build record, and rejects
+modified inner reports even after an archive's outer checksum is updated. Publication checks the real
+GitHub source/run; consumer reruns may read the original producer attempt and never relabel its bytes.
+
+Build.Policy stamps every owned managed assembly, including tools. Packing passes the allocated version
+to both Version and PackageVersion. The ArchitectureTests read actual PE metadata for every solution
+assembly, comparing source and timestamp against Git and run identity against the CI execution.
+CMake and the independent Visual Studio native path generate the same build-info suffix before compiling
+owned code. The existing native exports, ABI1.0, exact buffer sizing and error behavior remain unchanged.
+No third-party library is rewritten or rebuilt to add ArcForges identity.
+
+The source timestamp is commit time, not wall-clock compilation time. Native and managed jobs have
+their own preserved build/run records; a later consumer retry does not manufacture a new identity.
+The ordinary and Native AOT package-only C# consumers retrieve managed assembly and native export
+metadata. The independent C17 caller checks the same native suffix using packaged headers/libraries.
+
+Run `python -m unittest discover -s eng -p test_build_identity.py -v` for synthetic nine-source mutation,
+invalid/absent axes, duplicate subjects, aliases and real Git identity rejection tests. These mechanism
+fixtures do not assert production implementations for absent axes. Run the README build/architecture
+suite and the packaging guide for actual binary and package evidence. Build-local results and CI/public
+package evidence remain distinct.

docs/reconciliation-inventory.md

@@ -13,3 +13,7 @@ Run `python -m unittest discover -s eng -p test_reconciliation.py -v`, then `pyt
 The WP00 receipt supplies the already verified public NuGet/npm/Maven/native/desktop/Web/Android/Cloud/AI evidence. The checker validates its exact hash and source identities, not current registry availability or new runtime behavior. Changes to the inventory require review against actual Git trees and the producing step; do not edit a count to hide a missing entry. The existing runtime, licence and provenance checks remain required. Full contract assignment, shared content review, native surface work, test-family mapping and physical moves remain WP01.01 through WP01.05.
 
 Reviewed implementation changes to an existing DesktopPlatform project use `project-updates.json`: retain the original snapshot blob, record the exact reviewed replacement blob, producing step and merged Design authority. The checker still verifies every original snapshot and rejects other project content drift, new/missing projects and source escapes. WP01.03 records only the NativeAbiTests oracle relocation.
+
+WP02.04 records the reviewed native CMake changes for build-identity generation and explicit target
+dependencies, under Design commit `257f77ce8d476a4efd8746fc0b7e4e6358c32a67`. Original snapshots and
+all unrelated project blobs remain checked.