blaze-host: make the build stamp trustworthy for evidence attribution

Committing updates refs/heads/<branch>, not the HEAD file, so watching HEAD alone left the stamp one commit behind -- observed live, the banner read a84a72e immediately after 2337431 was committed. build.rs now also watches the resolved branch ref. Belt and braces, since cargo still cannot see every source change: sidecar.sh compares the binary's stamped commit against the tree's real HEAD at launch and says so loudly on a mismatch. An evidence artefact that names the WRONG commit is worse than one that names none. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-11 02:15:11 +00:00
parent 23374312bc
commit c84fd14cac
2 changed files with 24 additions and 1 deletions
@@ -66,4 +66,13 @@ fn main() {
            println!("cargo:rerun-if-changed={p}");
        }
    }
+    // Committing updates refs/heads/<branch>, NOT the HEAD file, so watching
+    // HEAD alone leaves the stamp one commit behind. Observed: the banner read
+    // a84a72e immediately after committing 2337431.
+    if let Some(rf) = git(&["symbolic-ref", "-q", "HEAD"]) {
+        let path = format!("../.git/{rf}");
+        if std::path::Path::new(&path).exists() {
+            println!("cargo:rerun-if-changed={path}");
+        }
+    }
 }