完善原生检查、WASM快检与逐语言生产验收

.github/workflows/ci.yml

@@ -36,33 +36,59 @@ jobs:
         run: |
           git clone --quiet https://github.com/full-stack-plugins/codeguard-plugin.git ../codeguard-plugin
           git -C ../codeguard-plugin checkout --quiet 9e4adb1
+          # 语料仍绑定历史9e4adb1；源码审计另绑定最新插件提交，两者不能混用。
+          # 固定提交尚未在插件远端可达时先明确失败，避免构建之后才发现缺源码。
+          git -C ../codeguard-plugin cat-file -e 'dec5f9d1361eefff493e120b4278939a243814a9^{commit}' || {
+            echo 'Pinned plugin audit source dec5f9d is unavailable; publish its reviewed Git branch before source audit.' >&2
+            exit 1
+          }
 
       - name: Verify crate layering debt does not grow
         run: python3 scripts/check_layering.py
 
       - name: Build workspace
         run: cargo build --workspace --all-targets
 
+      - name: Verify canonical legacy identities and archived migration audit
+        run: |
+          cargo test --locked -p codeguard-adapters --test legacy_registry_identity
+          cargo test --locked -p codeguard-cli --example audit_legacy_registry
+          cargo run --locked -p codeguard-cli --example audit_legacy_registry -- --check tests/acceptance/evidence/legacy-registry-audit-2026-10-06.json
+          cargo test --locked -p codeguard-cli --example audit_legacy_source -- --include-ignored
+          cargo run --locked -p codeguard-cli --example audit_legacy_source -- --check-source ../codeguard-plugin
+
       - name: Preserve the binary without WASM for package rejection
         run: cp target/debug/codeguard "$RUNNER_TEMP/codeguard-no-wasm"
 
+      - name: Verify grammar inventory before parser and package checks
+        run: |
+          # 清单文案及来源投影错误先报告，避免到完整 suite 末段才失败。
+          # 两种构建均须保留零资格、未执行和真实方言限制；不放宽资格或原生义务。
+          cargo test --locked -p codeguard-cli --test grammar_status_cli
+          cargo test --locked -p codeguard-cli --features wasm-precheck --test grammar_status_cli
+
       - name: Verify Linux WASM worker resource boundary
         run: |
           # 帮助目录须保留当前构建特性；默认 suite 无法证明 WASM 入口状态。
-          cargo test --locked -p codeguard-cli --features wasm-precheck --test help_command_contract --test rules_list_cli --test version_cli --test rust_lint_cli --test ruby_lint_cli --test check_all_ruby --test ruby_native_hook --test ruby_project_version --test shell_lint_cli
+          cargo test --locked -p codeguard-cli --features wasm-precheck --test help_command_contract --test rules_list_cli --test version_cli --test rust_lint_cli --test rust_lint_input_stability --test check_all_rust_native --test rust_project_syntax --test rust_native_hook --test ruby_lint_cli --test check_all_ruby --test ruby_native_hook --test ruby_project_version --test shell_lint_cli --test shell_workbench --test check_all_shell --test shell_native_hook --test hook_failed_write_options --test go_native_hook --test cfquery_postgres_dialect --test cfquery_structure
           cargo test --locked -p codeguard-cli --features wasm-precheck --test workspace_msrv --test crate_boundaries
           cargo test -p codeguard-runtime --features wasm-precheck --test process_contract
           cargo test -p codeguard-runtime --features wasm-precheck --test wasm_grammar_load --test wasm_recovery_scan --test wasm_empty_block_scan --test wasm_root_child_scan --test dart_upstream_corpus
-          cargo test -p codeguard-cli --features wasm-precheck --test syntax_worker_candidate --test check_python_structure --test check_go_package_structure --test go_syntax_fallback_candidate --test python_structural_syntax --test python_syntax_fallback_candidate --test grammar_probe_cli --test grammar_route --test zig_lint_cli --test typescript_syntax_fallback_candidate --test java_syntax_fallback_candidate --test java_native_differential --test kotlin_native_differential --test kotlin_lint_cli --test kotlin_syntax_task_verify --test kotlin_native_first --test erlang_native_differential --test erlang_lint_cli --test erlang_native_discovery --test check_all_erlang --test erlang_syntax_task_verify --test erlang_native_workbench --test swift_native_differential --test swift_lint_cli --test check_all_swift --test swift_native_hook --test swift_native_workbench --test swift_syntax_task_verify --test check_all_eslint --test hook_execute_cli --test claude_hook_cli --test hook_syntax_tasks --test syntax_task_verify --test zig_native_cli --test zig_native_discovery --test check_all_zig --test zig_native_hook --test zig_native_workbench --test zig_native_first_resolution --test task_resolution_service
+          cargo test -p codeguard-cli --features wasm-precheck --test syntax_worker_candidate --test grammar_probe_cli --test check_python_structure --test check_go_package_structure --test go_syntax_fallback_candidate --test python_structural_syntax --test python_syntax_fallback_candidate --test grammar_probe_cli --test grammar_route --test zig_lint_cli --test typescript_syntax_fallback_candidate --test java_syntax_fallback_candidate --test java_native_differential --test kotlin_native_differential --test kotlin_lint_cli --test kotlin_syntax_task_verify --test kotlin_native_first --test erlang_native_differential --test erlang_lint_cli --test erlang_native_discovery --test check_all_erlang --test erlang_syntax_task_verify --test erlang_native_workbench --test swift_native_differential --test swift_lint_cli --test check_all_swift --test swift_native_hook --test swift_native_workbench --test swift_syntax_task_verify --test check_all_eslint --test hook_execute_cli --test claude_hook_cli --test hook_syntax_tasks --test syntax_task_verify --test zig_native_cli --test zig_native_discovery --test check_all_zig --test zig_native_hook --test zig_native_workbench --test zig_native_first_resolution --test task_resolution_service
           # 原生限定关闭服务在 WASM 构建下也须实际运行，默认 suite 不涵盖所有历史来源。
-          cargo test --locked -p codeguard-cli --features wasm-precheck --test erlang_task_resolution_service --test swift_task_resolution_service --test kotlin_task_resolution_service --test go_task_resolution_service --test check_language_selection
+          cargo test --locked -p codeguard-cli --features wasm-precheck --test erlang_task_resolution_service --test swift_task_resolution_service --test kotlin_task_resolution_service --test go_task_resolution_service --test rust_task_resolution_service --test ruby_task_resolution_service --test shell_task_resolution_service --test check_language_selection
           cargo test --locked -p codeguard-cli --lib --features wasm-precheck selected_compiler_does_not_hide_unobserved_files_with_wasm
           # 32 份 WASM 的批次和单项目回归各自独占候选阶段预算，避免测试进程互相争抢内存与 CPU。
           cargo test -p codeguard-cli --features wasm-precheck --test check_all_grammar_candidates -- --test-threads=1
 
       - name: Replay every fixed grammar and retain per-language evidence
         run: |
-          cargo test --locked -p codeguard-cli --features wasm-precheck --test grammar_evaluation --test grammar_native_differential --test javascript_native_differential --test ruby_native_differential --test go_native_differential --test go_package_structure
+          cargo test --locked -p codeguard-cli --features wasm-precheck --test grammar_evaluation --test grammar_native_differential --test javascript_native_differential --test ruby_native_differential --test go_native_differential --test rust_formatter_differential --test go_package_structure
+          # C/C++明确标准的原生边界与受控错版本回放必须在WASM构建下验收。
+          # Ubuntu宿主Clang不冒充固定AppleClang21；实际条件目标另需显式已有工具。
+          cargo test --locked -p codeguard-cli --features wasm-precheck --test clang_lint_cli --test c_family_comments_cli --test c_family_comments_workbench --test c_family_native_replay
+          # 固定 Rustfmt 解析器的协议反例；不把 CI 预装版本当作指定原生版本。
+          cargo test --locked -p codeguard-cli --features wasm-precheck --lib rustfmt_syntax_probe
           cargo test --locked -p codeguard-cli --features wasm-precheck --lib python_syntax_probe
           # Go双制品、整文件与取消反例使用受控SDK；真实版本需显式选择。
           cargo test --locked -p codeguard-cli --features wasm-precheck --lib go_syntax_probe
@@ -92,6 +118,12 @@ jobs:
           node --test tests/npm_pack_erlang_repair.test.mjs
           CODEGUARD_WASM_BIN="$PWD/target/debug/codeguard" \
           node --test tests/npm_pack_ruby_repair.test.mjs
+          CODEGUARD_WASM_BIN="$PWD/target/debug/codeguard" \
+          node --test tests/npm_pack_shell_repair.test.mjs
+          CODEGUARD_WASM_BIN="$PWD/target/debug/codeguard" \
+          node --test tests/npm_pack_go_syntax_repair.test.mjs
+          CODEGUARD_WASM_BIN="$PWD/target/debug/codeguard" \
+          node --test tests/npm_pack_rust_syntax_repair.test.mjs
 
       - name: Run test suite
         run: cargo test --workspace --all-targets

.gitignore

@@ -4,3 +4,10 @@
 /.ruff_cache/
 **/__pycache__/
 *.pyc
+
+# 插件运行时产物（非源码）
+.video_agent/
+
+# 未接线的孤儿模块：与已接线的 task_verify_command 不同，
+# 此文件未在 lib.rs 声明，编译不依赖它，提交会造成「已接线」错觉
+crates/codeguard-cli/src/task_verify.rs