Build and test

Run the full gate

scripts/test-all

The script runs cheap contract/native checks before package, documentation, cross-compile, and Xcode work. It stops on the first failing stage and names it. Do not replace it with swift test: the app target and the guest cross-compilers are separate failure surfaces.

Run a focused stage

scripts/test-native frame
scripts/test-mirrorkit
scripts/test-docs
scripts/build-guests
scripts/test-host

Guest builds may skip when Retro68 is unavailable. State the skip. Metal suites are opt-in through their documented environment variables and fail, rather than skip, once opted in.

The guest cross-build uses Retro68's import libraries; it does not require a CarbonLib binary in this checkout. Runtime installation does: the public instructions link to CarbonLib 1.6.1 on Macintosh Repository. GitHub source and binary releases must not silently acquire or redistribute that third-party component. The owner may publish a separately hosted binaries-plus-CarbonLib convenience package after its URL, contents, and checksum are recorded.

Both host packages and the Xcode application compile in Swift 6 language mode. scripts/test-mirrorkit and scripts/test-host reject compiler warnings that originate in their project source trees; a warning is a failing gate, not an informational budget to carry forward.

The ordinary host gate compiles unsigned Debug and Release applications so a clean contributor checkout and GitHub-hosted runner need no Apple credential. That is build evidence, not distribution-signature evidence. Owner release qualification is a separate explicit mode:

NOW_HOST_SIGNING=release scripts/test-host

Release mode supplies the selected public Team ID at build time and refuses an artifact whose signature, application identifier, or Keychain access group does not match. The Team ID is public release identity; its certificate and private key are not stored in Git.

tools/product-version-gate check verifies the release identity copies in a candidate index. tools/product-version-gate main-ref-check OLD NEW is the immutable-tree check the reference-transaction hook runs before any product change reaches main. scripts/test-all mutation-tests both that refusal and the Extension's independent main/bake gate.

Verify a new guard

Mutate the exact condition the guard claims to detect, prove the mutation built, and observe that test fail. Restore the source and observe it pass. A build failure is not a test failure, and a different mutation is not evidence for the named guard.