Preserve native ownership across actor graphs, views, and checked suites

.github/workflows/native.yml

@@ -39,10 +39,73 @@ jobs:
       - name: Install tested Rust toolchain
         run: rustup toolchain install 1.97.1 --profile minimal
       - run: rustup override set 1.97.1
-      - name: Check compiler and native conformance
-        run: cargo test --locked --workspace --no-fail-fast --target ${{ matrix.target }}
       - name: Package release compiler and both runtime profiles
         run: python tools/package_native.py --output dist/package
+      - name: Check compiler and native conformance
+        env:
+          JETT_ACTOR_GRAPH_BUNDLE_MANIFEST: ${{ github.workspace }}/dist/package/lib/jett/runtime/${{ matrix.target }}/debug/launcher.json
+          JETT_ACTOR_GRAPH_EVIDENCE_DIR: ${{ github.workspace }}/target/native-actor-graph
+        run: cargo test --locked --workspace --no-fail-fast --target ${{ matrix.target }}
+      - name: Check public graph execution with the Release runtime
+        env:
+          JETT_ACTOR_GRAPH_BUNDLE_MANIFEST: ${{ github.workspace }}/dist/package/lib/jett/runtime/${{ matrix.target }}/release/launcher.json
+          JETT_ACTOR_GRAPH_EVIDENCE_DIR: ${{ github.workspace }}/target/native-actor-graph
+        run: >-
+          cargo test --locked --release -p jett_driver --test actor_graph_native
+          --target ${{ matrix.target }}
+          actor_graph_public_driver_reference_and_native_without_source
+          -- --exact
+      - name: Check protected graph hooks with the Release runtime
+        env:
+          JETT_ACTOR_GRAPH_BUNDLE_MANIFEST: ${{ github.workspace }}/dist/package/lib/jett/runtime/${{ matrix.target }}/release/launcher.json
+          JETT_ACTOR_GRAPH_EVIDENCE_DIR: ${{ github.workspace }}/target/native-actor-graph
+        run: >-
+          cargo test --locked --release -p jett_driver --lib
+          --target ${{ matrix.target }}
+          native::actor_graph_hooks_tests::actor_graph_checked_hook_original_initializer_and_capture_native
+          -- --exact
+      - name: Retain compact graph execution evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: native-actor-graph-${{ matrix.target }}-${{ github.sha }}
+          path: |
+            target/native-actor-graph/*.json
+            target/native-actor-graph/**/*.stdout
+            target/native-actor-graph/**/*.stderr
+          if-no-files-found: warn
+          retention-days: 7
+      - name: Check GNU Resource measurement controls
+        if: matrix.target == 'x86_64-unknown-linux-gnu'
+        run: python -m unittest tools.tests.test_measure_resource_native_archives
+      - name: Measure fresh GNU private Resource runtime archives
+        id: resource_archives
+        if: matrix.target == 'x86_64-unknown-linux-gnu'
+        run: >-
+          python tools/measure_resource_native_archives.py prepare
+          --output target/native-resource-gnu
+          --github-output "$GITHUB_OUTPUT"
+      - name: Execute complete GNU Resource corpus with compiled receipt pin
+        if: matrix.target == 'x86_64-unknown-linux-gnu'
+        run: >-
+          python tools/measure_resource_native_archives.py run
+          --receipt "${{ steps.resource_archives.outputs.receipt }}"
+          --expected-sha256 "${{ steps.resource_archives.outputs.sha256 }}"
+          --target-dir target/native-resource-gnu-gate
+      - name: Retain GNU Resource measurements and execution evidence
+        if: always() && matrix.target == 'x86_64-unknown-linux-gnu'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: native-resource-${{ matrix.target }}-${{ github.sha }}
+          path: |
+            target/native-resource-gnu/*.json
+            target/native-resource-gnu/*.jsonl
+            target/native-resource-gnu/*.log
+            target/native-resource-gnu/*-crt-probe
+            target/native-resource-gnu/*-crt-probe.c
+            target/native-resource-gnu/*-build/x86_64-unknown-linux-gnu/*/libjett_runtime.a
+          if-no-files-found: warn
+          retention-days: 7
       - name: Check installed compiler
         run: python tools/smoke_native_package.py dist/package
       - name: Archive package with executable permissions

README.md

@@ -196,6 +196,25 @@ cargo test -p jett_comptime
 
 Compile-fail fixtures live in `tests/compile_fail` and assert specific diagnostics. Run-pass fixtures live in `tests/run_pass` and exercise interpreter behavior.
 
+### Private Resource native gates
+
+The archive measurement helper builds fresh compiler-test runtimes and runs
+pinned Source execution gates. On Linux GNU, its default target measures the
+dynamic CRT. On Windows MSVC, use an x64 Visual Studio Developer PowerShell
+with `link.exe` on PATH and LLVM's `llvm-nm` and `llvm-readobj` installed:
+
+```powershell
+python tools/measure_resource_native_archives.py prepare --target x86_64-pc-windows-msvc --nm llvm-nm --readobj llvm-readobj --linker link.exe --output target/native/private-resource
+python tools/measure_resource_native_archives.py run --target x86_64-pc-windows-msvc --suite occupied-structs --reuse-target-dir --receipt RECEIPT_PATH --expected-sha256 MEASURED_DIGEST --target-dir target/native
+```
+
+Preparation returns the receipt path and measured digest. The MSVC path checks
+static CRT, exact runtime exports, compiler and linker identity, and the SDK LIB
+environment. The two occupied-struct gates use both fresh archive profiles;
+ordinary Runtime test counts do not establish their linked Source execution.
+Reusing the MSVC test target requires a newly compiled gate with that receipt
+pin. The default `original` suite retains the complete shared Source gate.
+
 The language intentionally enforces function complexity limits. The current checker caps functions at 100 statements, nesting depth 4, and cyclomatic complexity 10.
 
 ## License

crates/jett_codegen_cranelift/Cargo.toml

@@ -11,6 +11,7 @@ cranelift-frontend.workspace = true
 cranelift-module.workspace = true
 cranelift-object.workspace = true
 jett_common.workspace = true
+jett_comptime.workspace = true
 jett_hir.workspace = true
 jett_mir.workspace = true
 jett_types.workspace = true