@antprofuse/saddle-islands-tools 0.1.6 → 0.1.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antprofuse/saddle-islands-tools",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Independent Saddle–Islands engineering tools",
   "files": [
     "tools"

package/tools/cli/main.py

@@ -22,12 +22,12 @@ def main():
     if len(sys.argv) > 1 and sys.argv[1] == 'minifish':
         args = sys.argv[2:]
         if not args or args == ['--help']:
-            print('minifish build|package|plugin|batch|run|report <explicit options>; see tools/docs/minifish-testing.md')
+            print('minifish compile-check|build|package|plugin|batch|run|report <explicit options>; see tools/docs/minifish-testing.md')
             return 0
         command = args[0]
-        if command not in ('build', 'package', 'plugin', 'batch', 'run', 'report'):
+        if command not in ('compile-check', 'build', 'package', 'plugin', 'batch', 'run', 'report'):
             raise SystemExit('Unknown minifish command: ' + command)
-        entry = 'minifish.mjs' if command in ('build', 'package', 'plugin') else 'minifish.py'
+        entry = 'minifish.mjs' if command in ('compile-check', 'build', 'package', 'plugin') else 'minifish.py'
         return subprocess.call(['node' if entry.endswith('.mjs') else sys.executable, str(Path(__file__).with_name(entry)), *args])
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument('command', choices=['identity', 'backend', 'minifish', 'iteration'], help='semantic identities, backend tests or Minifish tests')

package/tools/cli/minifish.mjs

@@ -8,7 +8,7 @@ import {createRequire,registerHooks} from 'node:module';
 import {pathToFileURL} from 'node:url';
 const [command,...args]=process.argv.slice(2),flags={};
 for(let i=0;i<args.length;i+=2){assert(args[i]?.startsWith('--')&&args[i+1],'Expected named option and value');assert(!Object.hasOwn(flags,args[i].slice(2)),'Duplicate option');flags[args[i].slice(2)]=args[i+1];}
-assert(['build','package','plugin'].includes(command),'Usage: minifish.mjs build|package|plugin --project-root ROOT --config FILE --output DIR --definition CASE | --plan JSON [--tool-node-modules DIR]');
+assert(['compile-check','build','package','plugin'].includes(command),'Usage: minifish.mjs build|package|plugin --project-root ROOT --config FILE --output DIR --definition CASE | --plan JSON [--tool-node-modules DIR]');
 assert(flags['project-root']&&flags.config&&flags.output,'Explicit project root, config and output required');
 if(!process.execArgv.includes('--experimental-vm-modules')){const child=spawnSync(process.execPath,['--experimental-vm-modules',process.argv[1],...process.argv.slice(2)],{stdio:'inherit',env:process.env});process.exit(child.status??1);}
 const packageRoot=path.resolve(import.meta.dirname,'../..');
@@ -25,14 +25,20 @@ if(flags['tool-node-modules']){
  registerHooks({resolve(specifier,context,next){if(['typescript','@playwright/test'].includes(specifier)){let file=require.resolve(specifier);if(specifier==='@playwright/test')file=path.join(path.dirname(file),'index.mjs');return {url:pathToFileURL(file).href,shortCircuit:true};}return next(specifier,context);}});
 }
 registerHooks({resolve(specifier,context,next){const prefix='@antprofuse/saddle-islands-tools/';if(specifier.startsWith(prefix)){const file=path.resolve(packageRoot,specifier.slice(prefix.length));assert(file.startsWith(packageRoot+path.sep),'Public package import escaped');return {url:pathToFileURL(file).href,shortCircuit:true};}return next(specifier,context);}});
-const {buildCase,buildPlanPackage}=await import('../modules/minifish/compiler/build-case.mjs');
 const options={projectRoot:path.resolve(flags['project-root']),config:path.resolve(flags.config)};
 let result;
-if(command==='plugin'){
+if(command==='compile-check'){
+ const {compileCheck}=await import('../modules/minifish/compiler/compile-check.mjs');
+ result=await compileCheck({...options,manifest:flags.manifest,output:flags.output});
+ if(result.failed)process.exitCode=3;
+}else if(command==='plugin'){
  const {loadProject}=await import('../modules/minifish/compiler/config.mjs');
  const project=await loadProject(options.projectRoot,options.config);
  const {validatePluginEvents}=await import(pathToFileURL(await project.resolveAdapter(project.config.pluginAdapter)).href);
  const {buildPluginArtifact}=await import('../modules/minifish/harness/build-plugin-artifact.mjs');
  result=await buildPluginArtifact({planFile:flags.plan,output:flags.output,modules:flags['sdk-node-modules'],source:flags.source,repositoryRoot:path.resolve(project.root,project.config.repositoryRoot),validatePluginEvents});
-}else result=command==='build'?await buildCase(flags.definition,flags.output,options):await buildPlanPackage(JSON.parse(await readFile(flags.plan,'utf8')),flags.output,options);
+}else{
+ const {buildCase,buildPlanPackage}=await import('../modules/minifish/compiler/build-case.mjs');
+ result=command==='build'?await buildCase(flags.definition,flags.output,options):await buildPlanPackage(JSON.parse(await readFile(flags.plan,'utf8')),flags.output,options);
+}
 console.log(JSON.stringify(result));

package/tools/docs/backend-testing.md

@@ -10,8 +10,12 @@ python3 <frozen-package>/tools/cli/main.py backend --project <suite-root> --repo
 npm run selftest --prefix <frozen-package>/tools/modules/backend
 ```
 
+运行器消费已构建的可执行制品，不负责选择或安装Rust工具链。发起者为构建阶段准备框架要求的工具链及可解析的cargo/rustc入口，核版本后交接执行环境；不能依赖其他workspace的隐含PATH。
+
 所有根、适配、协议、Service、启动 app/alias 与制品均为显式输入。适配和协议预检真实路径，拒绝未声明根、符号链接逃逸、缺配置或缺制品。项目源依据与 Islands 公开生成工具仍由项目声明；本包不复制 Islands 或 Saddle 运行时。
 
+`--out`须位于业务仓外且最终目录尚不存在。工具自动创建缺失父目录，但拒绝复用已有最终目录（即使为空），避免混入历史证据；目录准备失败时不启动业务进程。
+
 ## 适配合同
 
 适配模块导出 `project(projectRoot)`，返回 `scenarios`、`proto`、`rpc`、`process`、`frozen`、`inputFiles`、`database`、`databaseLogPolicy`、`prepare` 和 `execute`。

package/tools/docs/iteration.md

@@ -61,3 +61,5 @@ python3 tools/cli/main.py iteration archive \
 `kind`为reports或records。目标在持久迭代目录下，以新内容版本命名，不覆盖原件。逐文件摘要校验复制一致，拒绝符号链接，检查静态HTML/CSS引用是否缺失或逃出归档目录；保存归档清单到records/archives。不会生成ZIP，不删除源目录。源需已停止写入；先后摘要不同则拒绝交付。
 
 不执行或解析JavaScript生成的动态URL、不下载外部HTTP资源，也不证明图片能够解码或预览服务可达。最终检查点须实际打开用户预览链接、检查截图；动态资源在浏览器中核验。服务与持久文件分别管理。结束CoTask前归档并核验，不能结束后才尝试复制已回收文件。
+
+MT（minifish-test）的stage-gate另需 `--compile-result`，指向当前候选通过公开 `minifish compile-check` 生成的全量编译收据。它与Git路径范围检查共同构成交付门禁，不启动产品；命令及清单格式见minifish-testing.md。

package/tools/docs/minifish-testing.md

@@ -42,3 +42,11 @@ Legacy component-host integrations must supply an explicit `repositoryRoot` to `
 可选 `carrier` 默认为 `semantic-root`。`source-content-group` 在语义root内对可见文字/图像取最低公共元素祖先；`owned-text-block` 在该组内要求唯一不属于其他语义目标的文字分支。选择与期待样式、class、原型HTML标签无关，候选缺失或歧义明确失败；不适用的拓扑不得借此猜测观察目标。`viewportInsets` 可声明 left/right/top/bottom 到业务frame视口的设计长度，返回采样记录包含原root盒及是否选中root。
 
 按压快照目前只支持 `semantic-root`，其他carrier在按下前拒绝，不能释放后采样冒充按住状态。这是明确能力限制，不能默默降级。内容分组不覆盖背景装饰/无文字无图像部件或Shadow DOM；相应责任另用适用的公开观察合同。
+
+### 全量定义编译门禁
+
+`minifish compile-check --tool-source TRUSTED_MANIFEST --project-root PROJECT --config PROJECT/minifish.config.json --manifest PROJECT/catalog/case-map.json --output NEW_EXTERNAL_DIR --tool-node-modules COMPILER/node_modules` 使用项目已声明的编译适配器，逐项检查当前活动定义、来源责任和准备祖先，不启动产品或模拟器，不生成独立运行包。
+
+项目配置的 `caseManifest` 指定唯一正式活动清单，命令的 `--manifest` 必须与其一致。活动清单包含 `cases`（definition、sourceCaseIds；定义路径为编译条目的唯一标识）及可选 `pending`（sourceCaseId、reason）。活动与非执行责任必须互斥、唯一且覆盖配置中的完整catalog。历史未激活定义不隐式加入；不可执行原因仍需Owner审核，不计编译通过或业务通过。输入须为干净候选提交内的文件。结果 `compile-result.json` 绑定候选提交、项目树、清单和目录摘要、已验证工具身份，并含逐case结果；有编译错误返回非零。
+
+MT使用 `iteration stage-gate` 时必须提供 `--compile-result NEW_EXTERNAL_DIR/compile-result.json`，缺失、过期、漏项、身份不匹配或编译失败均拒绝交付；其他阶段不增加此检查。

package/tools/modules/backend/output.test.mjs

@@ -0,0 +1,36 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,writeFile,readFile,rm,access} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import {join} from 'node:path';
+import {createExternalOutput} from './index.mjs';
+test('fresh nested output is created; prior evidence and repository paths are rejected',async()=>{
+ const root=await mkdtemp(join(tmpdir(),'backend-output-'));
+ try {
+  const repo=join(root,'repo');await mkdir(repo);
+  const out=join(root,'missing','nested','run');assert.equal(await createExternalOutput(repo,out),out);
+  await assert.rejects(createExternalOutput(repo,out),{code:'EEXIST'});
+  await writeFile(join(out,'evidence.json'),'original');
+  await assert.rejects(createExternalOutput(repo,out),{code:'EEXIST'});
+  assert.equal(await readFile(join(out,'evidence.json'),'utf8'),'original');
+  const illegal=join(repo,'new','run');await assert.rejects(createExternalOutput(repo,illegal),/outside source repository/);
+  await assert.rejects(access(join(repo,'new')),{code:'ENOENT'});
+  const file=join(root,'file');await writeFile(file,'unchanged');
+  await assert.rejects(createExternalOutput(repo,join(file,'run')));
+  assert.equal(await readFile(file,'utf8'),'unchanged');
+ } finally {await rm(root,{recursive:true,force:true});}
+});
+
+test('runner rejects reused output before starting RPC or product',async()=>{
+ const {run}=await import('./run.mjs');
+ const root=await mkdtemp(join(tmpdir(),'backend-preflight-'));
+ try {
+  const repo=join(root,'repo');await mkdir(repo);
+  const proto=join(repo,'input.proto');await writeFile(proto,'intentionally invalid proto');
+  const adapter=join(repo,'adapter.mjs');
+  await writeFile(adapter,`export async function project(){return {rpc:{serviceName:'Synthetic'},proto:${JSON.stringify(proto)},process:{app:'synthetic',alias:'test'},inputFiles:[${JSON.stringify(proto)}],scenarios:[{id:'one'}],prepare(){},execute(){throw Error('business must not start')}}}`);
+  const out=join(root,'existing');await mkdir(out);
+  await assert.rejects(run({projectRoot:repo,repositoryRoot:repo,adapter,out,binary:process.execPath}),{code:'EEXIST'});
+  await assert.rejects(access(join(out,'report.json')),{code:'ENOENT'});
+ } finally {await rm(root,{recursive:true,force:true});}
+});

package/tools/modules/backend/run.mjs

@@ -8,7 +8,7 @@ import {within,preflight} from './paths.mjs';
 import {scenarioActions} from './actions.mjs';
 import {mock} from './grpc.mjs';
 import {product} from './product.mjs';
-import {externalOutput,sleep} from './util.mjs';
+import {createExternalOutput,sleep} from './util.mjs';
 import {requestLogs} from './logs.mjs';
 import {assertRouteRejection} from './rejection-logs.mjs';
 import {classifyReport} from './report.mjs';
@@ -25,8 +25,8 @@ export async function run({projectRoot,repositoryRoot,adapter,out,binary,caseId,
  const all=config.scenarios;assert(Array.isArray(all)&&all.length,'empty scenarios');assert.equal(new Set(all.map(s=>s.id)).size,all.length,'duplicate scene id');
  const selected=caseId?all.filter(s=>s.id===caseId):all;assert(selected.length,'unknown case');
  if(list){await new Promise(done=>process.stdout.write(JSON.stringify(all.map(({id,operation,basis,scope})=>({id,operation,basis,scope:scope??'business'})),null,2)+'\n',done));return;}
- assert(binary&&out,'real binary and fresh external output required');await access(resolve(binary),constants.X_OK);await access(config.proto);const destination=externalOutput(repositoryRoot,out);
- await mkdir(destination);const report={...config.frozen,tool:identity,projectInputs,scenarioSetSha256:createHash('sha256').update(JSON.stringify(all)).digest('hex'),started:new Date().toISOString(),scenarios:[],database:config.database};
+ assert(binary&&out,'real binary and fresh external output required');await access(resolve(binary),constants.X_OK);await access(config.proto);const destination=await createExternalOutput(repositoryRoot,out);
+ const report={...config.frozen,tool:identity,projectInputs,scenarioSetSha256:createHash('sha256').update(JSON.stringify(all)).digest('hex'),started:new Date().toISOString(),scenarios:[],database:config.database};
  let rpc,app,stage='startup';const abort=new AbortController();const listeners=new Map();
  for(const signal of ['SIGINT','SIGTERM']){const handler=()=>{report.interrupted=signal;abort.abort();rpc?.release();};listeners.set(signal,handler);process.once(signal,handler);}
  try{

package/tools/modules/backend/util.mjs

@@ -1,7 +1,7 @@
 import {spawn} from 'node:child_process';
 import {createServer} from 'node:net';
 import {mkdir,open} from 'node:fs/promises';
-import {resolve,relative} from 'node:path';
+import {resolve,relative,dirname} from 'node:path';
 import {setTimeout as sleep} from 'node:timers/promises';
 export {sleep};
 export async function port() {
@@ -22,3 +22,11 @@ export async function command(binary,args,dir,env={}) {
 }
 export async function until(fn,timeout=30000) { const end=Date.now()+timeout;let error;while(Date.now()<end){try{return await fn();}catch(e){error=e;await sleep(100);}}throw error ?? Error('readiness timeout'); }
 export function externalOutput(project,out) { const p=resolve(out);const rel=relative(resolve(project),p);if(rel!=='..'&&!rel.startsWith('../')) throw Error('output must be outside source repository');return p; }
+
+export async function createExternalOutput(repository,out) {
+  const destination=externalOutput(repository,out);
+  await mkdir(dirname(destination),{recursive:true});
+  // Keep the final creation exclusive: existing evidence must never be reused.
+  await mkdir(destination);
+  return destination;
+}

package/tools/modules/minifish/compiler/compile-check.mjs

@@ -0,0 +1,65 @@
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import {readFile,realpath,mkdir,writeFile} from 'node:fs/promises';
+import {execFileSync} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import {pathToFileURL} from 'node:url';
+import {performance} from 'node:perf_hooks';
+import {loadProject,checkOutput} from './config.mjs';
+import {toolIdentity} from './tool-identity.mjs';
+const sha=x=>createHash('sha256').update(x).digest('hex');
+export function activeCases(manifest,catalog){
+ assert(Array.isArray(manifest.cases)&&manifest.cases.length,'Nonempty active case manifest required');
+ const files=new Set(),covered=new Set();
+ const official=new Set(catalog.cases.map(c=>c.id));
+ assert.equal(official.size,catalog.cases.length,'Duplicate catalog responsibility');
+ for(const row of manifest.cases){
+  assert(typeof row.definition==='string'&&row.definition&&!files.has(row.definition),'Duplicate/missing definition');files.add(row.definition);
+  assert(Array.isArray(row.sourceCaseIds)&&row.sourceCaseIds.length,'Source responsibilities required');
+  for(const id of row.sourceCaseIds){assert(official.has(id)&&!covered.has(id),'Unknown/duplicate source responsibility');covered.add(id);}
+ }
+ for(const row of manifest.pending??[]){assert(typeof row.reason==='string'&&row.reason.trim(),'Nonexecutable responsibility requires reason');assert(official.has(row.sourceCaseId)&&!covered.has(row.sourceCaseId),'Unknown/duplicate pending responsibility');covered.add(row.sourceCaseId);}
+ assert.equal(covered.size,official.size,'Active manifest omits catalog responsibilities');
+ return manifest.cases;
+}
+export async function compileCheck(options){
+ const started=performance.now(),project=await loadProject(options.projectRoot,options.config),{root,config}=project;
+ const repo=await realpath(path.resolve(root,config.repositoryRoot));
+ const git=(...args)=>execFileSync('git',['-C',repo,...args],{encoding:'utf8'}).trim();
+ const head=git('rev-parse','HEAD');git('diff','--exit-code','HEAD','--');
+ const projectPath=path.relative(repo,root).split(path.sep).join('/');
+ assert(projectPath&&!projectPath.startsWith('../'),'Project must belong to Git repository');
+ const tracked=new Set(git('ls-files','-z','--',projectPath).split('\0'));
+ const readTracked=async file=>{const declared=path.resolve(file),full=await realpath(declared),relative=path.relative(repo,full).split(path.sep).join('/');assert.equal(full,declared,'Symlink input forbidden');assert(full.startsWith(root+path.sep),'Input escaped project');assert(tracked.has(relative),'Input must be committed: '+relative);return {relative,bytes:await readFile(full)};};
+ await readTracked(options.config);await readTracked(await project.resolveAdapter(config.compilerAdapter));
+ assert(typeof config.caseManifest==='string'&&config.caseManifest,'Project config caseManifest required');
+ assert.equal(path.resolve(options.manifest),path.resolve(root,config.caseManifest),'Use the configured complete case manifest');
+ const manifest=await readTracked(options.manifest),catalog=await readTracked(path.resolve(root,config.catalog));
+ const parsedManifest=JSON.parse(manifest.bytes),parsedCatalog=JSON.parse(catalog.bytes);
+ const rows=activeCases(parsedManifest,parsedCatalog);
+ const adapter=await import(pathToFileURL(await project.resolveAdapter(config.compilerAdapter)).href);
+ const definitionRoot=await realpath(path.resolve(root,config.definitions)),results=[];
+ for(const row of rows){
+  try{
+   const file=await realpath(path.resolve(root,row.definition));assert(file.startsWith(definitionRoot+path.sep),'Definition escaped definitions root');
+   const definition=JSON.parse((await readTracked(file)).bytes),fragments=[];
+   assert.deepEqual(definition.sourceCaseIds??[definition.caseId],row.sourceCaseIds,'Manifest/definition source IDs differ');
+   for(let dir=path.dirname(file);;dir=path.dirname(dir)){
+    try{fragments.unshift(JSON.parse((await readTracked(path.join(dir,'prepare.json'))).bytes));}catch(e){if(e.code!=='ENOENT')throw e;}
+    if(dir===definitionRoot)break;assert(dir.startsWith(definitionRoot+path.sep),'Preparation escaped root');
+   }
+   assert.deepEqual(definition.ancestors,fragments.map(f=>f.id),'Preparation ancestry mismatch');
+   await adapter.compile({projectRoot:root,config,catalog:parsedCatalog,definition,fragments});
+   results.push({id:row.definition,definition:row.definition,status:'passed'});
+  }catch(e){results.push({id:row.definition,definition:row.definition,status:'failed',error:e.message});}
+ }
+ git('diff','--exit-code','HEAD','--');assert.equal(git('rev-parse','HEAD'),head,'Candidate changed during compilation');
+ const result={schemaVersion:1,kind:'minifish-full-compile',head,projectPath,projectTree:git('rev-parse',head+':'+projectPath),
+  manifest:{path:manifest.relative,sha256:sha(manifest.bytes)},catalog:{path:catalog.relative,sha256:sha(catalog.bytes)},
+  toolIdentity:await toolIdentity(config.toolSource,path.resolve(root,config.toolSourceManifest)),
+  total:results.length,passed:results.filter(r=>r.status==='passed').length,failed:results.filter(r=>r.status==='failed').length,
+  nonExecutable:(parsedManifest.pending??[]).map(r=>({id:r.sourceCaseId,reason:r.reason})),
+  durationMs:performance.now()-started,productExecution:false,results};
+ const destination=await checkOutput(options.output,project);await mkdir(destination,{recursive:false});
+ await writeFile(path.join(destination,'compile-result.json'),JSON.stringify(result,null,2)+'\n');return result;
+}

package/tools/modules/workflow/compile_gate.py

@@ -0,0 +1,51 @@
+"""Bind a full MT compilation receipt to the candidate's committed active catalog."""
+import hashlib
+import json
+from pathlib import Path
+from .iteration import Invalid
+from .diff_review import git
+
+
+def verify_compile(repo, head, bizdir, receipt_file):
+    if not receipt_file:
+        raise Invalid('MT requires --compile-result from minifish compile-check')
+    r = json.loads(Path(receipt_file).read_text())
+    project = bizdir + '/code/minifish-tests'
+    def check(ok, message):
+        if not ok:
+            raise Invalid(message)
+    check(r.get('schemaVersion') == 1 and r.get('kind') == 'minifish-full-compile', 'Invalid compile receipt')
+    check(r.get('head') == head and r.get('projectPath') == project, 'Stale or wrong-project compile receipt')
+    check(r.get('projectTree') == git(repo, 'rev-parse', head + ':' + project).decode().strip(), 'Compile tree mismatch')
+    def read_bound(key):
+        entry = r[key]
+        from pathlib import PurePosixPath
+        p = PurePosixPath(entry['path'])
+        check(not p.is_absolute() and '..' not in p.parts and entry['path'].startswith(project + '/'), 'Compile input outside project')
+        raw = git(repo, 'show', head + ':' + entry['path'])
+        check(hashlib.sha256(raw).hexdigest() == entry['sha256'], 'Compile input hash mismatch')
+        return json.loads(raw)
+    manifest, catalog = read_bound('manifest'), read_bound('catalog')
+    config = json.loads(git(repo, 'show', head + ':' + project + '/minifish.config.json'))
+    check(r['manifest']['path'] == project + '/' + config['caseManifest'], 'Unexpected active manifest')
+    check(r['catalog']['path'] == project + '/' + config['catalog'], 'Unexpected source catalog')
+    identity = r.get('toolIdentity', {})
+    check(identity.get('kind') == 'verified-content', 'Missing verified compiler identity')
+    for key, value in config['toolSource'].items():
+        check(identity.get(key) == value, 'Compiler identity mismatch: ' + key)
+    lock = git(repo, 'show', head + ':' + project + '/' + config['toolSourceManifest'])
+    check(identity.get('manifestSha256') == hashlib.sha256(lock).hexdigest(), 'Compiler manifest mismatch')
+    rows, results = manifest['cases'], r.get('results', [])
+    check(bool(rows) and len(rows) == len(results), 'Incomplete compile results')
+    check(len({x['definition'] for x in rows}) == len(rows), 'Duplicate active definition')
+    check([(x['definition'], x['definition']) for x in rows] == [(x.get('id'), x.get('definition')) for x in results], 'Compile case set mismatch')
+    official = [x['id'] for x in catalog['cases']]
+    covered = [i for row in rows for i in row['sourceCaseIds']]
+    pending = manifest.get('pending', [])
+    check(all(isinstance(x.get('reason'), str) and x['reason'].strip() for x in pending), 'Missing nonexecutable reason')
+    covered += [x['sourceCaseId'] for x in pending]
+    check(len(covered) == len(set(covered)) and len(official) == len(set(official)) and set(covered) == set(official), 'Incomplete catalog coverage')
+    check(r.get('nonExecutable') == [{'id': x['sourceCaseId'], 'reason': x['reason']} for x in pending], 'Nonexecutable decisions mismatch')
+    check(r.get('productExecution') is False, 'Not a static compilation receipt')
+    check(r.get('total') == len(rows) and r.get('passed') == len(rows) and r.get('failed') == 0 and all(x.get('status') == 'passed' for x in results), 'Full compilation did not pass')
+    return f"\n\nMT全量编译：{len(rows)}/{len(rows)} 通过；非执行责任 {len(pending)} 项保留独立处置。\n"

package/tools/modules/workflow/iteration.py

@@ -196,6 +196,7 @@ def main(argv=None):
     parser.add_argument('--repository')
     parser.add_argument('--base')
     parser.add_argument('--head')
+    parser.add_argument('--compile-result', help='Full static MT compilation receipt')
     parser.add_argument('--stage-id', action='append')
     parser.add_argument('--registry', help='Initiator workspace persistent iterations directory')
     parser.add_argument('--expected-sha256')
@@ -230,6 +231,9 @@ def main(argv=None):
             require('repository','head')
             from .diff_review import review
             checked=review(args.repository,config['inputCommit'],args.head,scope_nodes(config,args.workflow))
+            if config['stage'] == 'minifish-test':
+                from .compile_gate import verify_compile
+                checked['markdown'] += verify_compile(args.repository,args.head,config['bizdir'],args.compile_result)
             target.write_text(checked['markdown']); return 0 if checked['passed'] else 3
         result=render(config,args.workflow)
         if args.action == 'scope':