[LE0-Lin]

Summary

• Capture package version and an explicit, LF-normalized SHA-256 runtime-source identity at scan time; keep the version, digest, format and source manifest together in an immutable value.
• Preserve it in scan/compare/diff JSON, HTML, SARIF, new history snapshots and privacy-minimized feedback. Missing or invalid source yields an unknown digest, not a partial one or disabled linting. Legacy reports are not relabelled.
• Document coverage, compatibility and non-attestation limits in English, with synchronized Simplified/Traditional core guides and limits. No private input hashes, Git lookup, network request or runtime dependency is added.

Verification

• Full Windows Python 3.12 suite: 334 tests, 331 passed, 3 platform skips.
• 13 focused provenance tests cover line endings, serialization, manifest coverage, code changes, missing/invalid/unreadable source, privacy, captured identity, old callers, compare and score independence.
• Built sdist and wheel; installed wheel in an isolated environment and passed the complete outside-source acceptance journey, including matching report identities.
• Demo remains F 56 with the same four findings; self-scan A 100; doctor has no errors (one existing custom-workflow warning).
• git diff --check.
• Follow-up verification: WSL Python 3.12 full suite passed (334 tests, 7 host/platform skips); all GitHub Python 3.10–3.14/Linux, Windows/macOS, three-platform wheel acceptance, regression and history checks passed at 46e4fe372af6c7d40be35eb2cd51299d4ffcd7fc.

The first POSIX CI run exposed an overbroad FIFO test mock: it rejected every
Path.read_text, including legitimate package-source reads before discovery.
The follow-up scopes the guard to the actual FIFO path; opening that instruction
still raises an assertion, and analyze() must still reject it operationally.
No production safety guard or platform test has been removed or skipped.

This is an unreleased source change. Published v0.23.0 packages/tags/Action refs and frozen research evidence are unchanged. Source identity is not an accuracy estimate, executing-bytecode attestation, input snapshot or guarantee of reproducibility.