Preserve native Resource lifecycle, callback validation and actor identity

.github/workflows/native.yml

@@ -41,6 +41,37 @@ jobs:
       - run: rustup override set 1.97.1
       - name: Check compiler and native conformance
         run: cargo test --locked --workspace --no-fail-fast --target ${{ matrix.target }}
+      - name: Check GNU Resource measurement controls
+        if: matrix.target == 'x86_64-unknown-linux-gnu'
+        run: python -m unittest tools.tests.test_measure_resource_native_archives
+      - name: Measure fresh GNU private Resource runtime archives
+        id: resource_archives
+        if: matrix.target == 'x86_64-unknown-linux-gnu'
+        run: >-
+          python tools/measure_resource_native_archives.py prepare
+          --output target/native-resource-gnu
+          --github-output "$GITHUB_OUTPUT"
+      - name: Execute complete GNU Resource corpus with compiled receipt pin
+        if: matrix.target == 'x86_64-unknown-linux-gnu'
+        run: >-
+          python tools/measure_resource_native_archives.py run
+          --receipt "${{ steps.resource_archives.outputs.receipt }}"
+          --expected-sha256 "${{ steps.resource_archives.outputs.sha256 }}"
+          --target-dir target/native-resource-gnu-gate
+      - name: Retain GNU Resource measurements and execution evidence
+        if: always() && matrix.target == 'x86_64-unknown-linux-gnu'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: native-resource-${{ matrix.target }}-${{ github.sha }}
+          path: |
+            target/native-resource-gnu/*.json
+            target/native-resource-gnu/*.jsonl
+            target/native-resource-gnu/*.log
+            target/native-resource-gnu/*-crt-probe
+            target/native-resource-gnu/*-crt-probe.c
+            target/native-resource-gnu/*-build/x86_64-unknown-linux-gnu/*/libjett_runtime.a
+          if-no-files-found: warn
+          retention-days: 7
       - name: Package release compiler and both runtime profiles
         run: python tools/package_native.py --output dist/package
       - name: Check installed compiler

README.md

@@ -196,6 +196,25 @@ cargo test -p jett_comptime
 
 Compile-fail fixtures live in `tests/compile_fail` and assert specific diagnostics. Run-pass fixtures live in `tests/run_pass` and exercise interpreter behavior.
 
+### Private Resource native gates
+
+The archive measurement helper builds fresh compiler-test runtimes and runs
+pinned Source execution gates. On Linux GNU, its default target measures the
+dynamic CRT. On Windows MSVC, use an x64 Visual Studio Developer PowerShell
+with `link.exe` on PATH and LLVM's `llvm-nm` and `llvm-readobj` installed:
+
+```powershell
+python tools/measure_resource_native_archives.py prepare --target x86_64-pc-windows-msvc --nm llvm-nm --readobj llvm-readobj --linker link.exe --output target/native/private-resource
+python tools/measure_resource_native_archives.py run --target x86_64-pc-windows-msvc --suite occupied-structs --reuse-target-dir --receipt RECEIPT_PATH --expected-sha256 MEASURED_DIGEST --target-dir target/native
+```
+
+Preparation returns the receipt path and measured digest. The MSVC path checks
+static CRT, exact runtime exports, compiler and linker identity, and the SDK LIB
+environment. The two occupied-struct gates use both fresh archive profiles;
+ordinary Runtime test counts do not establish their linked Source execution.
+Reusing the MSVC test target requires a newly compiled gate with that receipt
+pin. The default `original` suite retains the complete shared Source gate.
+
 The language intentionally enforces function complexity limits. The current checker caps functions at 100 statements, nesting depth 4, and cyclomatic complexity 10.
 
 ## License

crates/jett_codegen_cranelift/Cargo.toml

@@ -19,6 +19,7 @@ sha2.workspace = true
 target-lexicon.workspace = true
 
 [dev-dependencies]
+jett_comptime.workspace = true
 jett_diagnostics.workspace = true
 jett_parser.workspace = true
 jett_resolve.workspace = true