redirector: commit stamp + shared build-identity verifier that REFUSES

The binary records only the commit it was built from -- no dirty-tree flag.
Cargo will not re-run a build script because another crate's source changed, so
a compiled-in 'clean' claim can be stale and is not a safeguard; that was
verified on the Blaze host.

scripts/verify-build-identity.sh establishes both facts at LAUNCH, where they
cannot go stale: the stamped commit equals HEAD, and the migration crates are
clean. It REFUSES rather than warns, because for a migration gate a warning on
stderr is something to scroll past.

--identity prints the stamp without valid configuration. The launcher must be
able to establish which commit a binary came from BEFORE deciding whether to
run it; requiring a correct environment first would invert the check.

redirector.sh mirrors sidecar.sh: refuses to start with an orphan present or
the port busy, matches the resolved executable rather than the command line
(pgrep -f matches any shell mentioning the name), and stop PROVES the process
is gone and the port free.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

openfut-redirector-host/src/lib.rs

@@ -51,15 +51,56 @@ fn log(msg: &str) {
     eprintln!("[{}.{:03}] {msg}", ms / 1000, ms % 1000);
 }
 
+/// The commit this binary was built from.
+///
+/// Only the commit: a compiled-in cleanliness claim can go stale (cargo will
+/// not re-run a build script for another crate's edit), so the authoritative
+/// comparison happens at launch in `scripts/verify-build-identity.sh`.
+pub const BUILD_COMMIT: &str = env!("OPENFUT_BUILD_COMMIT");
+
+/// Build identity, printable without any configuration.
+///
+/// `--identity` exists so the launcher can establish which commit a binary came
+/// from before deciding whether to run it. Machine-readable `key=value`.
+pub fn identity() -> String {
+    format!(
+        "openfut-redirector-host v{} commit={} profile={} openssl={}",
+        env!("CARGO_PKG_VERSION"),
+        BUILD_COMMIT,
+        if cfg!(debug_assertions) {
+            "debug"
+        } else {
+            "release"
+        },
+        tls::openssl_version(),
+    )
+}
+
 /// One line naming the binary, its linked TLS, and what it will advertise.
+///
+/// Machine-readable `key=value` so the launcher can extract the commit without
+/// guessing at prose.
 pub fn banner(cfg: &RedirectorConfig) -> String {
     format!(
-        "openfut-redirector-host v{} openssl={} listen={} advertise={}:{} ciphers={}",
+        "openfut-redirector-host v{} commit={} profile={} openssl={} listen={} \
+         advertise={}:{} tls_min={:?} tls_max={:?} security_level={} ciphers={}",
         env!("CARGO_PKG_VERSION"),
+        BUILD_COMMIT,
+        if cfg!(debug_assertions) {
+            "debug"
+        } else {
+            "release"
+        },
         tls::openssl_version(),
         cfg.listen_on(),
         cfg.adapter.endpoints.advertise,
         cfg.adapter.endpoints.blaze_port,
+        cfg.tls.min_version,
+        cfg.tls.max_version,
+        cfg.tls
+            .security_level
+            .map(|l| l.to_string())
+            .unwrap_or_else(|| "default".into()),
         cfg.tls.cipher_list,
     )
 }
@@ -108,15 +149,6 @@ pub fn bind(cfg: RedirectorConfig) -> std::io::Result<Server> {
     let listener = TcpListener::bind(cfg.listen_on())?;
     let local_addr = listener.local_addr()?;
     log(&banner(&cfg));
-    log(&format!(
-        "TLS min={:?} max={:?} security_level={}",
-        cfg.tls.min_version,
-        cfg.tls.max_version,
-        cfg.tls
-            .security_level
-            .map(|l| l.to_string())
-            .unwrap_or_else(|| "default (not lowered)".into())
-    ));
     Ok(Server {
         local_addr,
         listener,
@@ -218,6 +250,8 @@ mod tests {
         let cfg = RedirectorConfig::for_test("198.51.100.7");
         let b = banner(&cfg);
         assert!(b.contains("openssl="), "{b}");
+        assert!(b.contains("commit="), "{b}");
+        assert!(b.contains("tls_min="), "{b}");
         assert!(b.contains("198.51.100.7"), "{b}");
         // The cipher list is part of the identity of a compatibility host.
         assert!(b.contains("AES256-GCM-SHA384"), "{b}");

openfut-redirector-host/src/main.rs

@@ -3,6 +3,15 @@
 use openfut_redirector_host::{serve, RedirectorConfig};
 
 fn main() {
+    // Identity must be readable WITHOUT valid configuration: the launcher has
+    // to verify which commit a binary came from before deciding whether to run
+    // it at all, and refusing to reveal that until the environment is right
+    // would invert the check.
+    if std::env::args().any(|a| a == "--identity") {
+        println!("{}", openfut_redirector_host::identity());
+        return;
+    }
+
     let cfg = match RedirectorConfig::from_env() {
         Ok(c) => c,
         Err(e) => {