锁定桌面壳产物验收门禁

桌面壳配置检查反查根级 release 二进制产物验收

同步原生壳方案文档和共享决策记录

apps/desktop-shell/scripts/check-config.mjs

@@ -8,6 +8,11 @@ const rootPackagePath = new URL('../../../package.json', import.meta.url);
 const rootPackageConfig = JSON.parse(fs.readFileSync(rootPackagePath, 'utf8'));
 const rootPackageLockPath = new URL('../../../package-lock.json', import.meta.url);
 const rootPackageLock = JSON.parse(fs.readFileSync(rootPackageLockPath, 'utf8'));
+const nativeShellCheckPath = new URL(
+  '../../../scripts/check-native-shells.mjs',
+  import.meta.url,
+);
+const nativeShellCheckSource = fs.readFileSync(nativeShellCheckPath, 'utf8');
 const capabilityPath = new URL(
   '../src-tauri/capabilities/main.json',
   import.meta.url,
@@ -636,6 +641,39 @@ assertNoBlockedCargoLockPackages();
 assertNoBlockedDesktopSdkSnippets();
 assertDesktopSourceLayout();
 
+for (const snippet of [
+  'label: \'desktop-shell-release-build-smoke\'',
+  "args: ['run', 'desktop-shell:build', '--', '--no-bundle']",
+  'function assertDesktopReleaseBinaryArtifact()',
+  "'apps'",
+  "'desktop-shell'",
+  "'src-tauri'",
+  "'target'",
+  "'release'",
+  'genarrative-desktop-shell.exe',
+  'genarrative-desktop-shell',
+  'desktop release binary is missing',
+  'desktop release binary must be a real non-empty executable file',
+  'desktop Linux release binary must be an executable ELF file',
+  'desktop macOS release binary must be an executable Mach-O file',
+  'desktop Windows release binary must be a PE executable',
+  'header[0] === 0x7f',
+  'header[1] === 0x45',
+  'header[2] === 0x4c',
+  'header[3] === 0x46',
+  '(stat.mode & 0o111) === 0',
+  'header.readUInt32BE(0)',
+  'machMagic === 0xfeedfacf',
+  'header[0] !== 0x4d',
+  'header[1] !== 0x5a',
+  "console.log('[check:native-shells] desktop-release-binary-artifact')",
+  'assertDesktopReleaseBinaryArtifact();',
+]) {
+  if (!nativeShellCheckSource.includes(snippet)) {
+    throw new Error(`root native shell gate must keep desktop release artifact check ${snippet}`);
+  }
+}
+
 for (const [scriptName, expected] of Object.entries({
   dev: 'WEB_PORT=3000 tauri dev',
   build: 'tauri build',