Compile packages for selected targets

docs/cli.md

@@ -30,6 +30,13 @@ pass after successful tests when `validation.go.full_vet` is true. It then runs
 configured additional checks in profile order. It does not inspect remote
 availability or publish a tag.
 
+When `validation.go.compile_targets` is selected, `check` compiles all packages
+for each configured `GOOS/GOARCH` pair after tests and full vet, using static
+mode with cgo disabled. This check produces no artifacts and does not execute
+target binaries. Compilation failures use the `package-compile` identity and
+show the selected target. Any artifact build selected by the separate `build`
+setting runs after shared validation and configured checks.
+
 `check` writes errors and diagnostics to standard error. It returns status 0
 after local validation, 1 after a candidate validation failure, and 2 for usage,
 profile, or invalid-version errors. Shared validation failures identify the
@@ -59,6 +66,11 @@ bounded reconciliation determines whether the exact tag was accepted.
 Shared validation failures use the same check and finding presentation as
 `check`, alongside publication state and phase.
 
+When `validation.go.compile_targets` is selected, package compilation runs
+after tests and full vet and before configured checks. Each failure is reported
+as `package-compile` with its selected target; this does not create build
+artifacts or execute target binaries.
+
 The command returns status 0 for confirmed publication, 1 for a known
 publication failure or conflict, 2 for usage, profile, or invalid-version
 errors, and 3 when the push outcome remains unknown. Unknown status must be

docs/config.md

@@ -30,13 +30,24 @@ The optional `validation` object selects shared checks implemented by ReleaseKit
 `validation.go.race` enables the race detector for the single standard Go test
 suite. `validation.go.full_vet` runs a separate native `go vet` pass after that
 suite succeeds; ReleaseKit disables test-time vet for that suite to avoid
-running vet twice. When `full_vet` is omitted or false, the test command keeps
-its existing vet behavior. Both settings are independent. For example:
+running vet twice. `validation.go.compile_targets` is an ordered array of
+`GOOS/GOARCH` pairs. After tests and selected full vet pass, ReleaseKit compiles
+all packages for each target with cgo disabled. Each pair must include both
+components; the selected Go toolchain reports unsupported complete targets.
+This source compatibility check does not name or produce binaries, run a target
+executable, or create an artifact manifest. Omitted or empty `compile_targets`
+selects no package-compilation pass. When `full_vet` is omitted or false, the
+test command keeps its existing vet behavior. These settings are independent.
+For example:
 
 ```json
 {
   "product": "Example",
-  "validation": {"go": {"race": true, "full_vet": true}}
+  "validation": {"go": {
+    "race": true,
+    "full_vet": true,
+    "compile_targets": ["linux/amd64", "linux/arm64"]
+  }}
 }
 ```
 
@@ -52,8 +63,12 @@ The `check` and `publish` commands run one
 access disabled, adding `-race` when `validation.go.race` is true. When
 `validation.go.full_vet` is true, they add `-vet=off` to that test command and
 run native `go vet -mod=readonly ./...` after successful tests. They then run
-each configured `checks` command once, in order, as an additional product
-check. Selected-target builds run after shared validation and product checks.
+`go build -mod=readonly -o <os.DevNull> ./...` in static mode for each
+`validation.go.compile_targets` entry, in profile order. Compile failures use
+the `package-compile` identity and include the selected target. Configured
+`checks` commands run afterward, once each in order, as additional product
+checks. Artifact builds selected by the separate `build` setting run after
+shared validation and product checks.
 Do not repeat the standard suite or vet in `checks`; doing so repeats work. The
 `build` command uses the selected build settings and writes binaries to `dist` unless
 `--output` selects another path.

docs/consumers/check.md

@@ -31,9 +31,13 @@ ReleaseKit runs one `go test -mod=readonly -count=1 ./...` suite with the
 available compatible local Go toolchain. Set `Validation.Go.Race` to run that
 suite with `-race`; set `Validation.Go.FullVet` to run
 `go vet -mod=readonly ./...` after successful tests, with test-time vet disabled
-for the suite. It calls `AdditionalChecks` once after shared validation when
-supplied. Their zero values retain the ordinary native test behavior. ReleaseKit
-does not download a different toolchain automatically. If race prerequisites
+for the suite. Set `Validation.Go.CompileTargets` to compile packages for each
+complete target pair after tests and vet. Package compilation uses
+`CGO_ENABLED=0`, writes no artifact, and does not execute a target binary; its
+failures use the `package-compile` identity and include the target. The zero
+values retain the ordinary native test behavior and select no compilation.
+ReleaseKit calls `AdditionalChecks` once after shared validation when supplied.
+It does not download a different toolchain automatically. If race prerequisites
 are unavailable, the `go-test` check fails rather than being skipped; a selected
 full-vet failure is reported as `go-vet`. The suite uses the Go host target,
 disables workspace and module network access, and ignores ambient `GOFLAGS`,

docs/consumers/publish.md

@@ -36,6 +36,11 @@ If race prerequisites are unavailable, the selected suite fails as `go-test`
 instead of silently running without the race detector. Full-vet failures are
 reported as `go-vet` and stop publication before tag creation.
 
+Set `Validation.Go.CompileTargets` to compile packages for each complete target
+pair after tests and vet. This uses `CGO_ENABLED=0`, produces no artifact, and
+does not execute target binaries. A failure is reported as `package-compile`
+with the selected target and prevents tag creation.
+
 If `Build` selects targets, ReleaseKit verifies them after the standard suite
 and additional checks, before creating the tag. The operation then rechecks the
 candidate and remote guards, creates an annotated tag for the captured commit,

docs/internal/gotool.md

@@ -41,6 +41,9 @@ baseline values. Effective `GOCACHE`, `GOCACHEPROG`, `GOMODCACHE`, `GOPATH`,
 `GOROOT`, and `GOTMPDIR` values are retained. Other process variables remain
 available to child commands.
 
-Candidate validation uses native mode for the offline `go test` suite. Builds
-use static mode for selected-target compilation and the native version-check
-build. The native version executable itself runs as a normal child process.
+Candidate validation uses native mode for the offline `go test` suite and
+selected full `go vet` pass. Package-compilation checks use static mode for each
+selected target and direct Go's output to the operating system null device, so
+they leave no binary artifact. Artifact builds also use static mode for
+selected-target compilation, then build the native version-check executable;
+that executable runs as a normal child process.

docs/internal/overview.md

@@ -46,7 +46,7 @@ these implemented packages:
 | `internal/tempdir` | Disposable system temporary storage outside source worktrees. |
 | `internal/process` | Cancellable child-process execution with per-command environment overlays and removals. |
 | `internal/preparation` | Coordination for expected-commit tag checkout and Go module dependency preparation. |
-| `internal/validation` | Shared Go validation with optional race and full-vet selections, structured check failures, and lazy committed-file access for captured candidates; `internal/candidate` retains capture, callback sequencing, and local-state rechecks. |
+| `internal/validation` | Shared Go validation with optional race, full-vet, and static package-compilation target selections, structured check failures, and lazy committed-file access for captured candidates; `internal/candidate` retains capture, callback sequencing, and local-state rechecks. |
 | `internal/publish` | Publication guards, one validation run, annotated tag creation, push, and recovery state. |
 | `internal/runtimeinfo` | Private version lookup used by the runtime facade. |
 | `internal/versioncontract` | Shared stable-version rules and linker-symbol identity. |
@@ -78,7 +78,7 @@ not a separate release matrix:
 | Capability | Implementation owner | Existing evidence |
 | --- | --- | --- |
 | Runtime version lookup and injected application version | `buildinfo`, `internal/runtimeinfo`, `internal/versioncontract`, `internal/build` | `TestVersionInConsumerExecutable`, `TestVersion` |
-| Candidate capture, shared validation, public diagnostics, additional checks, and rechecks | `releasekit.Check`, `releasekit.Publish`, `internal/candidate`, `internal/validation`, `cmd/releasekit/internal/cli` | `TestRunUsesOneSuiteWithSelectedRaceSetting`, `TestRunReportsRacePrerequisiteFailureWithoutFallback`, `TestRunExecutesRaceEnabledSuiteOnHost`, `TestCandidateRequestMapsRaceValidation`, `TestLoadSettingsReadsRaceValidation`, `TestCheckUsesSelectedRaceSuiteBeforeAdditionalChecks`, `TestCheckCapturesCandidateAndCallsAdditionalChecksOnce`, `TestCheckReturnsPublicValidationError`, `TestPublishPushesOnlyTheCapturedAnnotatedTag`, `TestPublishFailedStandardSuiteSkipsAdditionalChecksAndTagCreation`, `TestPublishAdditionalCheckFailurePreservesCauseAndPreventsTagCreation`, `TestCheckCommandBindsConfiguredChecksToCapturedCandidate`, `TestPublishCommandPublishesConfiguredCandidate`, `TestCandidateCommandsPresentValidationDiagnosticsOnce` |
+| Candidate capture, shared validation, public diagnostics, additional checks, and rechecks | `releasekit.Check`, `releasekit.Publish`, `internal/candidate`, `internal/validation`, `cmd/releasekit/internal/cli` | `TestRunUsesOneSuiteWithSelectedRaceSetting`, `TestRunReportsRacePrerequisiteFailureWithoutFallback`, `TestRunExecutesRaceEnabledSuiteOnHost`, `TestRunCompilesTargetsAfterTestAndVetInSelectionOrder`, `TestRunAttributesTargetCompileFailureAndStops`, `TestRunCompilesSourceOnlyAndExecutablePackagesWithoutArtifacts`, `TestCandidateRequestMapsGoValidation`, `TestLoadSettingsReadsGoValidation`, `TestCheckUsesSelectedRaceSuiteBeforeAdditionalChecks`, `TestCheckCapturesCandidateAndCallsAdditionalChecksOnce`, `TestCheckReturnsPublicValidationError`, `TestPublishPushesOnlyTheCapturedAnnotatedTag`, `TestPublishFailedStandardSuiteSkipsAdditionalChecksAndTagCreation`, `TestPublishAdditionalCheckFailurePreservesCauseAndPreventsTagCreation`, `TestCheckCommandBindsConfiguredChecksToCapturedCandidate`, `TestPublishCommandPublishesConfiguredCandidate`, `TestCandidateCommandsPresentValidationDiagnosticsOnce`, `TestDeliverPageOnlyCreatesAndReusesRelease` |
 | Shared Go settings for validation and builds | `internal/gotool`, `internal/process`, `internal/candidate`, `internal/build` | `TestDefaultValidationDoesNotInheritGOFLAGSRunFilter`, `TestNativeAndStaticCommandsUseOwnedBaseline`, `TestPersistentSettingsPreserveCachesAndNativeCTools`, `TestBuildIgnoresAmbientAndPersistentArchitectureTuning` |
 | Authoritative endpoint and exact annotated tag publication | `releasekit.Publish`, `internal/publish`, `internal/git` | `TestPublishPushesOnlyTheCapturedAnnotatedTag`, `TestResolveUsesPushURLAndQueriesWithoutMutation` |
 | Publication partial and uncertain recovery | `internal/publish`, `internal/git` | `TestPublishRejectedPushKeepsLocalTagAndReportsNotPublished`, `TestPublishLostAcknowledgmentConfirmsExactRemoteObject`, `TestPublishLostAcknowledgmentWithChangedEndpointRemainsUnknown`, `TestPublishUnavailableReconciliationRemainsUnknownAndPreservesPushError` |

docs/internal/validation.md

@@ -10,9 +10,13 @@ candidate path.
 
 The executor runs one offline Go suite, optionally with the race detector when
 selected. When full vet is selected, it disables test-time vet for that suite
-and runs native `go vet -mod=readonly ./...` after the suite succeeds, using the
-same discovered Go tool and native environment. Test and vet failures retain
-their separate `go-test` and `go-vet` identities and underlying causes. Its
+and runs native `go vet -mod=readonly ./...` after the suite succeeds. It then
+runs `go build -mod=readonly -o <os.DevNull> ./...` in static mode for each
+selected package-compilation target, preserving target order and stopping on
+the first failure. This compiles source without producing an artifact or
+executing a target binary. Test, vet, and package-compilation failures retain
+their `go-test`, `go-vet`, and `package-compile` identities, selected target
+where applicable, and underlying causes. Its
 request carries the captured repository directory and commit, output writer,
 and internal settings. `Request.ReadCandidateTree` lets a
 selected file check request candidate contents; the Go-only path does not
@@ -70,13 +74,14 @@ for product behavior.
 ## Go command environment reuse
 
 The current executor uses the [shared Go command environment](gotool.md) for
-its offline suite. The [roadmap coordination design](../roadmap/implementation.md#execution-and-ownership)
-owns the proposed test, vet, and package-compilation procedure.
+its offline suite, vet pass, and selected-target package compilation. The
+[implementation roadmap](../roadmap/implementation.md#execution-and-ownership)
+records the shared ordering across validation and later file checks.
 
 Reuse `internal/gotool` for native and static environments and target handling.
 Keep toolchain and module-cache discovery in `gotool`; do not reproduce its
-environment logic in a checker. Build output names, version injection, native
-smoke checks, and artifact digests remain owned by `internal/build`.
+environment logic in a checker. Artifact output names, version injection,
+native smoke checks, and artifact digests remain owned by `internal/build`.
 
 ## File-check coordination
 

docs/roadmap/implementation.md

@@ -271,6 +271,11 @@ Protect the selected command relationship without freezing incidental flag order
 
 ## Stage 3: Compile packages for selected targets
 
+**Completion:** Complete. `Go.CompileTargets` and profile
+`validation.go.compile_targets` select static package compilation after tests
+and vet. Failures use `package-compile` and include the selected target;
+artifact building remains separate.
+
 **Outcome:** Source compatibility checks work independently of artifacts.
 
 1. Add `Go.CompileTargets` and string-array profile targets. Convert to internal