Add ISO build manifest metadata

build.cfg

@@ -9,6 +9,11 @@ FREEBSD_ISO_BASE_URL="https://download.freebsd.org/releases/${FREEBSD_ARCH}/${FR
 FREEBSD_MEMSTICK_URL="${FREEBSD_ISO_BASE_URL}/FreeBSD-${FREEBSD_VERSION}-${FREEBSD_ARCH}-memstick.img"
 FREEBSD_MEMSTICK_SHA256_URL="${FREEBSD_ISO_BASE_URL}/CHECKSUM.SHA256-FreeBSD-${FREEBSD_VERSION}-${FREEBSD_ARCH}"
 
+# ISO version metadata.
+# ISO version is independent from the bundled Clawdie-AI runtime version.
+ISO_VERSION="0.1.0"
+BUILD_CHANNEL="${BUILD_CHANNEL:-dev}"  # dev | release
+
 # Output image
 # User-facing date format: DD.mmm.YYYY (per AGENTS.md convention)
 #

build.sh

@@ -55,6 +55,17 @@ while [ "$#" -gt 0 ]; do
     esac
 done
 
+if [ "${BUILD_CHANNEL}" = "release" ]; then
+    case "${CLAWDIE_REF}" in
+        v[0-9]*.[0-9]*.[0-9]*) ;;
+        *)
+            echo "ERROR: release builds must pin a Clawdie-AI tag with --clawdie-version X.Y.Z"
+            echo "       Current Clawdie ref: ${CLAWDIE_REF}"
+            exit 1
+            ;;
+    esac
+fi
+
 # Tailscale warning (recommended but optional)
 if [ "${FEATURE_TAILSCALE:-YES}" = "YES" ] && [ -z "${TAILSCALE_AUTHKEY:-}" ]; then
     echo ""
@@ -76,6 +87,7 @@ if [ "${FEATURE_TAILSCALE:-YES}" = "YES" ] && [ -z "${TAILSCALE_AUTHKEY:-}" ]; t
 fi
 
 echo "==> clawdie-iso build"
+echo "    ISO     : ${ISO_VERSION}-${BUILD_CHANNEL}"
 echo "    FreeBSD : ${FREEBSD_VERSION} ${FREEBSD_ARCH}"
 echo "    Clawdie : ${CLAWDIE_REF}"
 echo "    Desktop : ${DEFAULT_DESKTOP}"
@@ -134,6 +146,58 @@ pkg_archive_for() {
     find "${PKG_REPO_DIR}/All" -type f -name "${_pkg_name}-*.pkg" | sort | tail -1
 }
 
+json_escape() {
+    printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'
+}
+
+resolve_clawdie_commit() {
+    _ref="$1"
+    _repo="https://codeberg.org/Clawdie/Clawdie-AI.git"
+    if printf '%s' "$_ref" | grep -Eq '^[0-9a-fA-F]{40}$'; then
+        printf '%s\n' "$_ref"
+        return 0
+    fi
+    if command -v git >/dev/null 2>&1; then
+        git ls-remote "$_repo" \
+            "refs/heads/${_ref}" \
+            "refs/tags/${_ref}^{}" \
+            "refs/tags/${_ref}" 2>/dev/null \
+            | awk '
+                $2 ~ /\^\{\}$/ { print $1; found = 1; exit }
+                first == "" { first = $1 }
+                END { if (!found && first != "") print first }
+            '
+    fi
+}
+
+write_build_manifest() {
+    _manifest_path="$1"
+    _iso_repo_commit="unknown"
+    _iso_repo_dirty="null"
+    if command -v git >/dev/null 2>&1 && git -C "$SCRIPT_DIR" rev-parse --git-dir >/dev/null 2>&1; then
+        _iso_repo_commit=$(git -C "$SCRIPT_DIR" rev-parse HEAD 2>/dev/null || echo unknown)
+        if git -C "$SCRIPT_DIR" diff --quiet 2>/dev/null && git -C "$SCRIPT_DIR" diff --cached --quiet 2>/dev/null; then
+            _iso_repo_dirty="false"
+        else
+            _iso_repo_dirty="true"
+        fi
+    fi
+    mkdir -p "$(dirname "$_manifest_path")"
+    cat > "$_manifest_path" <<EOF
+{
+  "iso_version": "$(json_escape "${ISO_VERSION}")",
+  "build_channel": "$(json_escape "${BUILD_CHANNEL}")",
+  "freebsd_version": "$(json_escape "${FREEBSD_VERSION}")",
+  "freebsd_arch": "$(json_escape "${FREEBSD_ARCH}")",
+  "clawdie_ai_ref": "$(json_escape "${CLAWDIE_REF}")",
+  "clawdie_ai_commit": "$(json_escape "${CLAWDIE_AI_COMMIT:-unknown}")",
+  "iso_repo_commit": "$(json_escape "${_iso_repo_commit}")",
+  "iso_repo_dirty": ${_iso_repo_dirty},
+  "built_at": "$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
+}
+EOF
+}
+
 mount_memstick_rootfs() {
     _memstick_mount="$1"
     _memstick_slice_img="${CACHE_DIR}/memstick-freebsd-slice.img"
@@ -441,6 +505,10 @@ if [ "${CLAWDIE_REF:-${CLAWDIE_VERSION:-}}" = "latest" ] || [ -z "${CLAWDIE_REF:
     echo "    Resolved: ${CLAWDIE_REF}"
 fi
 
+CLAWDIE_AI_COMMIT=$(resolve_clawdie_commit "$CLAWDIE_REF" | head -n 1)
+CLAWDIE_AI_COMMIT="${CLAWDIE_AI_COMMIT:-unknown}"
+echo "    Clawdie commit: ${CLAWDIE_AI_COMMIT}"
+
 CLAWDIE_CACHE_KEY=$(printf '%s' "$CLAWDIE_REF" | tr -c 'A-Za-z0-9._-' '_')
 CLAWDIE_TARBALL="${CACHE_DIR}/clawdie-ai-${CLAWDIE_CACHE_KEY}.tar.gz"
 CLAWDIE_TARBALL_URL="https://codeberg.org/Clawdie/Clawdie-AI/archive/${CLAWDIE_REF}.tar.gz"
@@ -619,9 +687,15 @@ if [ -d "$NPM_GLOBALS_DIR" ]; then
 fi
 cp "${CLAWDIE_TARBALL_ISO}" "${USB_SHARE}/clawdie-ai.tar.gz"
 cp "${SCRIPT_DIR}/build.cfg" "${USB_SHARE}/"
+write_build_manifest "${USB_SHARE}/build-manifest.json"
 
 # Bake runtime vars so firstboot reads the right target config
 {
+    echo "ISO_VERSION=\"${ISO_VERSION}\""
+    echo "BUILD_CHANNEL=\"${BUILD_CHANNEL}\""
+    echo "CLAWDIE_VERSION=\"${CLAWDIE_VERSION}\""
+    echo "CLAWDIE_REF=\"${CLAWDIE_REF}\""
+    echo "CLAWDIE_AI_COMMIT=\"${CLAWDIE_AI_COMMIT}\""
     echo "TARGET=\"${TARGET:-baremetal}\""
     [ -n "${GPU_DRIVER:-}" ]            && echo "GPU_DRIVER=\"${GPU_DRIVER}\""
     [ -n "${ASSISTANT_NAME:-}" ]        && echo "ASSISTANT_NAME=\"${ASSISTANT_NAME}\""

firstboot/firstboot.sh

@@ -131,6 +131,7 @@ elif [ -f "/var/db/clawdie-installer/clawdie-handoff.sealed" ]; then
 fi
 
 log_msg "[firstboot] Starting — target: ${TARGET:-baremetal}${RESUME:+, resume mode}"
+log_msg "[firstboot] ISO ${ISO_VERSION:-unknown}-${BUILD_CHANNEL:-unknown}; Clawdie-AI ${CLAWDIE_REF:-unknown}@${CLAWDIE_AI_COMMIT:-unknown}"
 
 # ── Import setup.txt/system.env from USB config partition ───────────────────
 if [ "$SETUP_HANDOFF_LOADED" -eq 1 ]; then

installerconfig

@@ -57,6 +57,7 @@ cp -r "${USB_SHARE}/firstboot" "${HDD_SHARE}/"
 cp -r "${USB_SHARE}/packages"  "${HDD_SHARE}/"
 cp    "${USB_SHARE}/clawdie-ai.tar.gz" "${HDD_SHARE}/"
 cp    "${USB_SHARE}/build.cfg"         "${HDD_SHARE}/"
+[ -f "${USB_SHARE}/build-manifest.json" ] && cp "${USB_SHARE}/build-manifest.json" "${HDD_SHARE}/"
 
 # Make all firstboot shell modules executable
 chmod +x "${HDD_SHARE}/firstboot/firstboot.sh"