feat(dirty-content-fingerprint): apiserver shows fingerprint in -version

Adds DirtyFingerprint package var (default "") and a composeVersionDisplay()
helper implementing the same strip-and-append rule as the C daemons: strips
a trailing -dirty from GitCommit and appends -<fingerprint> when available,
via a genuine anchored strings.TrimSuffix, not a blind substring replace.
GitCommit's declaration and the logger.Info startup-log call site (with its
zap fields) are completely untouched.

New main_test.go covers 6 cases via table-driven tests. Verified independently
by review, including a self-constructed mutation test (distinct from the
implementer's own) proving the anchored-suffix regression test is genuinely
meaningful, a real build across all 5 ldflags scenarios, and a live daemon
startup-log capture confirming no leak into the log even on the same binary
whose -version output shows the fingerprint.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.kiro/specs/dirty-content-fingerprint/tasks.md

@@ -63,10 +63,9 @@
   - _Boundary: Makefile_
   - _Depends: 4.1_
 
-- [ ] 4.4 (P) apiserver: fingerprint in -version, startup log unaffected
-  - `DirtyFingerprint` package var (default `""`); `-version` flag's composition applies the same strip-and-append rule as the C daemons: if `DirtyFingerprint` is non-empty, strip a trailing `-dirty` from `GitCommit` and append `-DirtyFingerprint`; if empty, print `GitCommit` as-is
-  - `GitCommit`'s own computation and the existing `logger.Info("********** Initialize Logger done!")` structured-field call are left completely unchanged -- no new zap field, `GitCommit` logged exactly as before, byte-identical to the original feature's shipped format
-  - Observable confirmed live: on a dirty build, `-version` shows `<hash>-<fingerprint>` (not `<hash>-dirty-<fingerprint>`); the startup log's first line is unchanged from the original feature's already-shipped format regardless of tree state
+- [x] 4.4 (P) apiserver: fingerprint in -version, startup log unaffected
+  - `DirtyFingerprint` package var (default `""`) + `composeVersionDisplay()` helper doing the strip-and-append via a genuine anchored `strings.TrimSuffix` (not a blind substring replace, independently confirmed via a self-constructed mutation test); `GitCommit`'s declaration and the `logger.Info` startup-log call site (including its zap fields) confirmed byte-for-byte untouched
+  - Observable confirmed live (independently re-verified by review, real build across all 5 scenarios + a live daemon-start log capture): `-version` shows `<hash>-<fingerprint>` never `<hash>-dirty-<fingerprint>`; the startup log shows the raw, un-fingerprinted `GitCommit` (still `-dirty`-suffixed when applicable) on the same binary whose `-version` output differs; `go.sum`/`go.mod` untouched
   - _Requirements: 1.1, 1.2, 1.3, 1.4, 2.1, 3.1, 3.2, 4.1_
   - _Boundary: apiserver/cmd/main.go_
   - _Depends: 4.1_

src/frontend/apiserver/cmd/main.go

@@ -14,6 +14,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"strings"
 
 	"apiserver/controllers"
 
@@ -29,11 +30,40 @@ import (
 // string, matching this feature's unknown-fallback requirement (see
 // xce_version_field() in src/lib/utils.c for the equivalent C-side
 // convention).
+//
+// DirtyFingerprint is injected the same way (`-X main.DirtyFingerprint=...`,
+// see src/tools/go_build task 4.1) but its default is a deliberately EMPTY
+// string, not "unknown" -- matching dirty_fingerprint's convention
+// everywhere else in the dirty-content-fingerprint feature (empty means
+// "no fingerprint available", distinct from GitCommit/BuildTime's
+// "unknown" sentinel for "not injected at all").
 var (
-	GitCommit = "unknown"
-	BuildTime = "unknown"
+	GitCommit        = "unknown"
+	BuildTime        = "unknown"
+	DirtyFingerprint = ""
 )
 
+// composeVersionDisplay applies the dirty-content-fingerprint feature's
+// strip-and-append rule to gitCommit for --version/-version display only:
+// if dirtyFingerprint is non-empty, a trailing "-dirty" suffix on gitCommit
+// is stripped (an anchored suffix check via strings.TrimSuffix, not a blind
+// substring replace) and "-<dirtyFingerprint>" is appended in its place;
+// otherwise gitCommit is returned exactly as-is (already correctly showing
+// "-dirty" or not, per the original build-time-versioning feature). Mirrors
+// xce_compose_version_ex() in src/lib/utils.c (task 3.1), the equivalent
+// C-side implementation already approved for controller/scheduler/worker.
+//
+// Must be applied ONLY to the -version flag's printed output below -- never
+// to the logger.Info("********** Initialize Logger done!") startup log
+// call, which must keep logging the raw GitCommit var unchanged
+// (Requirement 3.2).
+func composeVersionDisplay(gitCommit, dirtyFingerprint string) string {
+	if dirtyFingerprint == "" {
+		return gitCommit
+	}
+	return strings.TrimSuffix(gitCommit, "-dirty") + "-" + dirtyFingerprint
+}
+
 func main() {
 	gin.SetMode(gin.ReleaseMode)
 	gin.DefaultWriter = io.Discard
@@ -53,7 +83,7 @@ func main() {
 	// side effects: it must only print and exit, matching controller's/
 	// scheduler's/worker's own --version contract (Requirement 2.1).
 	if *versionFlag {
-		fmt.Printf("xce-apiserver %s built %s\n", GitCommit, BuildTime)
+		fmt.Printf("xce-apiserver %s built %s\n", composeVersionDisplay(GitCommit, DirtyFingerprint), BuildTime)
 		return
 	}
 

src/frontend/apiserver/cmd/main_test.go

@@ -0,0 +1,64 @@
+package main
+
+import "testing"
+
+// dirty-content-fingerprint task 4.4: composeVersionDisplay implements the
+// --version-only strip-and-append rule mirroring xce_compose_version_ex()
+// in src/lib/utils.c (task 3.1). It must never be reachable from the
+// logger.Info("********** Initialize Logger done!") startup log call in
+// main(), which always logs the raw GitCommit var unchanged.
+func TestComposeVersionDisplay(t *testing.T) {
+	tests := []struct {
+		name             string
+		gitCommit        string
+		dirtyFingerprint string
+		want             string
+	}{
+		{
+			name:             "dirty commit with fingerprint strips -dirty and appends fingerprint",
+			gitCommit:        "abc1234-dirty",
+			dirtyFingerprint: "deadbeef",
+			want:             "abc1234-deadbeef",
+		},
+		{
+			name:             "clean commit with no fingerprint is unchanged",
+			gitCommit:        "abc1234",
+			dirtyFingerprint: "",
+			want:             "abc1234",
+		},
+		{
+			name:             "dirty commit with no fingerprint (degraded) is unchanged, -dirty preserved",
+			gitCommit:        "abc1234-dirty",
+			dirtyFingerprint: "",
+			want:             "abc1234-dirty",
+		},
+		{
+			name:             "unknown commit with no fingerprint is unchanged",
+			gitCommit:        "unknown",
+			dirtyFingerprint: "",
+			want:             "unknown",
+		},
+		{
+			name:             "clean commit with a fingerprint still appends (nothing to strip)",
+			gitCommit:        "abc1234",
+			dirtyFingerprint: "cafef00d",
+			want:             "abc1234-cafef00d",
+		},
+		{
+			name:             "suffix check is anchored, not a blind substring removal",
+			gitCommit:        "abc1234-dirty-not-at-end-dirty",
+			dirtyFingerprint: "cafef00d",
+			want:             "abc1234-dirty-not-at-end-cafef00d",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := composeVersionDisplay(tt.gitCommit, tt.dirtyFingerprint)
+			if got != tt.want {
+				t.Errorf("composeVersionDisplay(%q, %q) = %q, want %q",
+					tt.gitCommit, tt.dirtyFingerprint, got, tt.want)
+			}
+		})
+	}
+}