feat(dirty-content-fingerprint): xceadmin build-info module gains fingerprint

Threads dirty_fingerprint through as an 8th positional arg from
xceadmin/meson.build's custom_target into meson-build.sh, which adds
DIRTY_FINGERPRINT to the generated _build_info.py with an independent
empty-string fallback (not "unknown", matching this feature's convention
everywhere else). GIT_COMMIT/BUILD_TIME's existing generation and
"unknown" fallback are completely untouched.

Verified independently by review across three full real build+test+wheel
cycles: dirty tree produces a real, non-empty fingerprint present
identically in the mirrored tree, build/lib copy, an installed venv, and
the packaged wheel, cross-checked byte-for-byte against that same build's
compile_commands.json; explicit-empty fingerprint with real commit/time
resolves DIRTY_FINGERPRINT to genuinely empty; all-empty scenario confirms
the two fallback conventions ("unknown" vs empty) coexist without
interference. 261 passed/3 skipped throughout.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.kiro/specs/dirty-content-fingerprint/tasks.md

@@ -78,9 +78,9 @@
   - _Depends: 4.1_
 
 - [ ] 5. Core: xceadmin fingerprint display
-- [ ] 5.1 (P) meson-build.sh generates the fingerprint field in the build-info module
-  - `meson-build.sh`'s already-existing `_build_info.py` generation step (from the original feature) gains a third field, `DIRTY_FINGERPRINT` (empty-string fallback, independent of the other two fields' fallback), sourced from one new positional arg/env var wired through `xceadmin/meson.build`
-  - Observable confirmed live (full real build+test+wheel cycle via `/xce-build xceadmin`): on a dirty tree, the mirrored tree's `_build_info.py` and the packaged wheel both contain a real, non-empty `DIRTY_FINGERPRINT`; on a clean tree, it resolves to empty
+- [x] 5.1 (P) meson-build.sh generates the fingerprint field in the build-info module
+  - `dirty_fingerprint` threaded through as an 8th positional arg (`$8`), correctly numbered and consistent between `meson.build` and `meson-build.sh`; `_build_info.py` gains `DIRTY_FINGERPRINT` with an independent empty-string fallback (not `"unknown"`); `GIT_COMMIT`/`BUILD_TIME`'s existing generation and fallback confirmed byte-for-byte untouched
+  - Observable confirmed live (independently re-verified by review, full real build+test+wheel cycles across 3 scenarios): dirty tree -> real, non-empty `DIRTY_FINGERPRINT` present identically in the mirrored tree, the build/lib copy, an installed venv, and the packaged wheel, cross-checked byte-for-byte against that same build's `compile_commands.json`; explicit-empty fingerprint -> genuinely `""` while `GIT_COMMIT`/`BUILD_TIME` pass through real values; all-empty -> `GIT_COMMIT`/`BUILD_TIME` still fall back to `"unknown"` while `DIRTY_FINGERPRINT` stays `""`; 261 passed/3 skipped in all three scenarios
   - _Requirements: 1.1, 1.2, 1.3, 1.4, 5.1_
   - _Boundary: xceadmin/meson.build, xceadmin/meson-build.sh_
   - _Depends: 1_

src/xceadmin/meson-build.sh

@@ -26,6 +26,9 @@ GIT_COMMIT="$6"    # build-time-versioning task 5.1: get_option('commit_id'),
                     # resolved by xce-build.sh (task 2.1) -- empty if meson was
                     # invoked without -Dcommit_id= (e.g. a bare `meson setup`)
 BUILD_TIME="$7"    # build-time-versioning task 5.1: get_option('build_time'), same as above
+DIRTY_FINGERPRINT="$8"  # dirty-content-fingerprint task 5.1: get_option('dirty_fingerprint'),
+                    # resolved by xce-build.sh (task 2.1) / flake.nix (task 2.2) -- empty if
+                    # meson was invoked without -Ddirty_fingerprint= or the tree is clean
 
 # Requirement 1.4 / 4.2: never hand the mirrored tree a genuinely empty
 # value -- fall back to the literal "unknown", same empty -> "unknown"
@@ -37,6 +40,16 @@ fi
 if [ -z "$BUILD_TIME" ]; then
     BUILD_TIME=unknown
 fi
+# dirty-content-fingerprint task 5.1: DIRTY_FINGERPRINT's fallback is a
+# plain empty string, deliberately NOT "unknown" -- independent of the two
+# fallbacks above and matching this feature's convention everywhere else
+# (go_build's XCE_DIRTY_FINGERPRINT, the C daemons' dirty_fingerprint). An
+# already-empty $8 needs no action; this guard only protects against an
+# unset positional (e.g. a hand-invoked meson-build.sh missing the arg
+# entirely) under `set -u`.
+if [ -z "${DIRTY_FINGERPRINT:-}" ]; then
+    DIRTY_FINGERPRINT=""
+fi
 
 SRC_DIR="$REPO_ROOT/src"
 
@@ -77,13 +90,15 @@ cp "$SRC_DIR/configs/schema/"*.schema.json "$SCHEMA_DST/json/"
 BUILD_INFO_DST="$WORK_DIR/src/xceadmin/_build_info.py"
 echo "=== xceadmin (meson): writing generated build-info module ==="
 cat > "$BUILD_INFO_DST" <<EOF
-# Generated by meson-build.sh (build-time-versioning task 5.1) -- do not edit.
+# Generated by meson-build.sh (build-time-versioning task 5.1, extended by
+# dirty-content-fingerprint task 5.1) -- do not edit.
 # Overwritten on every meson build; never checked in. See
 # src/xceadmin/src/xceadmin/_build_info.py (task 5.2) for the committed,
-# "unknown"-only fallback stub used by \`pip install -e .\` editable installs,
-# which never run this script.
+# fallback stub used by \`pip install -e .\` editable installs, which never
+# run this script.
 GIT_COMMIT = "$GIT_COMMIT"
 BUILD_TIME = "$BUILD_TIME"
+DIRTY_FINGERPRINT = "$DIRTY_FINGERPRINT"
 EOF
 
 # Requirement 4.2: never silently proceed to pip install/pytest/wheel-build

src/xceadmin/meson.build

@@ -50,6 +50,14 @@ xceadmin_stamp = custom_target('xceadmin',
     # XCE_GIT_COMMIT/XCE_BUILD_TIME handling.
     get_option('commit_id'),
     get_option('build_time'),
+    # dirty-content-fingerprint task 5.1: third positional arg, same
+    # resolved-option-value style as commit_id/build_time above. Unlike
+    # those two, its meson-build.sh-side fallback on empty is a plain empty
+    # string, NOT "unknown" -- matching this feature's convention
+    # everywhere else (go_build's XCE_DIRTY_FINGERPRINT, the C daemons'
+    # dirty_fingerprint), not the original feature's commit_id/build_time
+    # convention.
+    get_option('dirty_fingerprint'),
   ],
   build_by_default: true,
   build_always_stale: true,