Artifact identity captured at compilation, plus attribution of the serving VM.

Diagnostics never inspect Git or the caller's working directory. Unknown source facts stay explicit for archives, missing Git, or a bounded probe failure. The fingerprint hashes source names and contents, not timestamps, and exports neither. It is source provenance, not a reproducible-build or artifact-signing guarantee.