feat(core): let embedding executables own build identity - #2082

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At crates/relay-node/src/cli.rs, line 16:

<comment>This clap attribute now calls `crate::version()`, which panics in `embedded-build-info` builds unless identity was installed. The `#[cfg(test)]` modules below call `Cli::try_parse_from` / `Cli::command()` without installing identity, so they will panic in strict embedding test runs of the lib unit tests. Install a fixed test identity in those tests, or keep the CLI unit tests out of the strict embedded configuration.</comment>

<file context>
@@ -13,7 +13,7 @@ use clap::{Parser, Subcommand};
 #[command(
     name = "agent-relay-node",
-    version = crate::VERSION,
+    version = crate::version(),
     propagate_version = true,
     about = "Connect coding sessions to Agent Relay"
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .agentworkforce/trajectories/codex-build-identity/completed/2026-11/traj_bjhvd5dhdi87/trajectory.json, line 45:

<comment>This completed trace has no commit or changed-file provenance, and `_trace` points to the same parent revision at both ends. Regenerate it after the implementation commit so `commits`, `filesChanged`, `startRef`, and `endRef` describe this work; otherwise the completed trajectory cannot be audited.

(Based on your team's feedback about completed trajectory trace metadata.) </comment>

<file context>
@@ -0,0 +1,53 @@
+    "approach": "Standard approach",
+    "confidence": 0.9
+  },
+  "commits": [],
+  "filesChanged": [],
+  "projectId": "AgentWorkforce/relay",
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At crates/relay-node/Cargo.toml, line 30:

<comment>Embedded builds still send `CARGO_PKG_VERSION` (`0.1.0`) from several client handshakes, so the installed executable identity is not propagated consistently. Replace those product-facing version fields with `crate::version()`.</comment>

<file context>
@@ -25,6 +25,11 @@ name = "relay_core_binary"
 [features]
+# Library embedders bake identity into their executable instead of this crate.
+# Install BuildInfo before calling the core. Use with default-features = false.
+embedded-build-info = []
+# Deterministic identity fixture for downstream dev-dependencies only.
+test-build-info = ["embedded-build-info"]
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At crates/relay-node/README.md, line 112:

<comment>The getters panic when identity is missing, they do not return an error. Say "panic" here so embedders know to install identity before any read.</comment>

<file context>
@@ -89,6 +89,40 @@ The internal Cargo package version is never reported as a release on its
+
+The executable's build script supplies these values at compile time. They are
+not read from the environment at startup. Getters `version()` and
+`build_revision()` fail if initialization was omitted, and a second install is
+rejected. These APIs do not configure the site, scheme, or branding.
+
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At crates/relay-node/src/relay/integrations.rs, line 105:

<comment>`crate::version()` is evaluated inside the `spawn_blocking` closure, so a missing `install_build_info` panic gets converted into "relayfile could not be reached." Read the version into a local before `spawn_blocking` so a missing identity is not reported as a network failure.</comment>

<file context>
@@ -102,7 +102,7 @@ impl Relayfile {
                 .set(
                     "User-Agent",
-                    &format!("AgentRelayDesktop/{}", crate::VERSION),
+                    &format!("AgentRelayDesktop/{}", crate::version()),
                 );
             let response = match body {
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At CHANGELOG.md, line 12:

<comment>Name the public API here: the entry should identify `install_build_info(BuildInfo)` instead of describing installation generically. Lead with the benefit that release-identity changes rebuild only the embedding executable.

(Based on your team's feedback about impact-first changelog entries that name the concrete API.) [c2e76b35-7371-486a-a7a9-01de3a8d962c]</comment>

<file context>
@@ -5,7 +5,11 @@ All notable changes to Agent Relay will be documented in this file.
+
+### Added
+
+- Applications embedding `agent-relay-node` can install their compiled version and revision at startup, so changing release identity only rebuilds their executable.
 
 ## [17.0.0] - 2026-11-05
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At packages/cli/src/cli/lib/deprecate-command.test.ts, line 97:

<comment>These `deprecateCommand(...)` calls fit within the repo's `printWidth: 110`, so Prettier collapses them to one line and `prettier --check` fails on this file. Collapse each call back to a single line, as in the unchanged `it('hides the command…')` style, for example `deprecateCommand(cloud.commands.find((c) => c.name() === 'run')!, NOTICE, { warn: () => {} });`. Apply the same change to the other five-line calls in this diff.</comment>

<file context>
@@ -94,7 +94,11 @@ describe('deprecateCommand', () => {
   it('still runs the original action', async () => {
     const { program, cloud, ran } = programWithCloud();
-    deprecateCommand(cloud.commands.find((c) => c.name() === 'run')!, NOTICE, { warn: () => {} });
+    deprecateCommand(
+      cloud.commands.find((c) => c.name() === 'run')!,
+      NOTICE,
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At packages/session/src/types.ts, line 57:

<comment>This reflow is not Prettier output: the union is 112 characters, above the 110 `printWidth`, so Prettier breaks it with leading `|` members. Restore the original multi-line layout so `format:check` passes.</comment>

<file context>
@@ -54,8 +54,7 @@ export interface Turn {
 export type ResumeMode =
-  | { mode: 'native'; nativeResumeId: string }
-  | { mode: 'inject'; contextPrompt: string };
+  { mode: 'native'; nativeResumeId: string } | { mode: 'inject'; contextPrompt: string };
 
 export interface ResumeSessionResult {
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At scripts/verify-features/escalation-status.d.mts, line 2:

<comment>This union no longer matches Prettier's output at `printWidth: 110`. The full declaration is about 119 characters, so Prettier breaks it with leading `|` per line, and `format:check` will flag this file. Restore the multi-line form.</comment>

<file context>
@@ -1,10 +1,5 @@
-  | 'draft_pr'
-  | 'slack_primary'
-  | 'slack_followup';
+  'infra' | 'posthog' | 'github_issue' | 'draft_pr' | 'slack_primary' | 'slack_followup';
 
 export type EscalationState = 'delivered' | 'failed' | 'disabled' | 'not_applicable' | 'pending';
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At packages/sdk/src/messaging/relaycast-placement.ts, line 11:

<comment>This union no longer matches Prettier output, which the repo enforces (printWidth 110). Restore the leading-pipe form, one member per line.</comment>

<file context>
@@ -8,10 +8,7 @@
-  | 'target_offline'
-  | 'unmapped_repo'
-  | 'sandbox_policy_mismatch';
+  'no_eligible_node' | 'target_offline' | 'unmapped_repo' | 'sandbox_policy_mismatch';
 
 /**
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At packages/config/src/shadow-config.ts, line 25:

<comment>This reformatting is not Prettier output. The union is 113 characters on one line, above the 110 `printWidth`, so Prettier would split it again into leading-`|` lines. Restore the original multi-line union, which matches the `pr-base` version, so `prettier --check` stays clean.</comment>

<file context>
@@ -22,11 +22,7 @@ import path from 'node:path';
-  | 'SESSION_END'
-  | 'CODE_WRITTEN'
-  | 'REVIEW_REQUEST';
+  'ALL_MESSAGES' | 'EXPLICIT_ASK' | 'SESSION_END' | 'CODE_WRITTEN' | 'REVIEW_REQUEST';
 
 /** Shadow role definition */
</file context>