合并AI游戏创作目标分支最新代码

.gitea/workflows/project-ci.yml

@@ -17,46 +17,30 @@ env:
   CARGO_HTTP_MULTIPLEXING: 'false'
   CARGO_NET_RETRY: '10'
   CARGO_TERM_COLOR: always
-  RUSTUP_MAX_RETRIES: '10'
+  NPM_CONFIG_AUDIT: 'false'
+  NPM_CONFIG_FETCH_RETRIES: '10'
+  NPM_CONFIG_FETCH_RETRY_FACTOR: '2'
+  NPM_CONFIG_FETCH_RETRY_MAXTIMEOUT: '60000'
+  NPM_CONFIG_FETCH_RETRY_MINTIMEOUT: '2000'
+  NPM_CONFIG_FUND: 'false'
+  NPM_CONFIG_PREFER_OFFLINE: 'true'
+  RUSTUP_AUTO_INSTALL: '0'
   RUSTC_WRAPPER: ''
   CARGO_BUILD_RUSTC_WRAPPER: ''
 
 jobs:
   repository-checks:
     name: Repository checks
-    runs-on: ubuntu-latest
+    runs-on: genarrative-ci
     steps:
-      - name: Checkout full history
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
+      - name: Checkout full history from Gitea
+        env:
+          GENARRATIVE_GITEA_FETCH_DEPTH: '0'
+          GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
+        run: genarrative-gitea-checkout
 
-      - name: Install base tools
-        shell: bash
-        run: |
-          set -euo pipefail
-          command -v apt-get >/dev/null 2>&1 || {
-            echo 'ubuntu-latest runner must provide an Ubuntu or Debian environment.' >&2
-            exit 1
-          }
-          sudo_command=()
-          if [[ "$(id -u)" -ne 0 ]]; then
-            command -v sudo >/dev/null 2>&1 || {
-              echo 'non-root runner user requires sudo for system dependencies.' >&2
-              exit 1
-            }
-            sudo_command=(sudo -E)
-          fi
-          "${sudo_command[@]}" apt-get update
-          "${sudo_command[@]}" env DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-            ca-certificates \
-            curl
-
-      - name: Set up Node.js 22
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: '22'
+      - name: Validate preinstalled CI job image and sandbox
+        run: GENARRATIVE_GITEA_CI_CHECK_RUNTIME=1 bash scripts/check-gitea-ci-job-image.sh
 
       - name: Resolve comparison base
         shell: bash
@@ -82,42 +66,6 @@ jobs:
           fi
           echo "SPACETIME_SCHEMA_BASE_REF=${base_ref}" >> "${GITHUB_ENV}"
 
-      - name: Set up repository Rust toolchain
-        shell: bash
-        run: |
-          set -euo pipefail
-          if ! command -v rustup >/dev/null 2>&1; then
-            for attempt in $(seq 1 10); do
-              if curl --retry 3 --retry-all-errors --retry-delay 2 \
-                --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
-                | sh -s -- -y --profile minimal --default-toolchain none; then
-                break
-              fi
-              if [[ "${attempt}" -eq 10 ]]; then
-                echo 'rustup bootstrap failed after 10 attempts.' >&2
-                exit 1
-              fi
-              sleep $((attempt * 2))
-            done
-          fi
-          echo "${HOME}/.cargo/bin" >> "${GITHUB_PATH}"
-          export PATH="${HOME}/.cargo/bin:${PATH}"
-          toolchain="$(sed -n 's/^channel = "\([^"]*\)"/\1/p' rust-toolchain.toml)"
-          test -n "${toolchain}"
-          for attempt in $(seq 1 10); do
-            if rustup toolchain install "${toolchain}" --profile minimal --component rustfmt; then
-              break
-            fi
-            if [[ "${attempt}" -eq 10 ]]; then
-              echo 'Rust toolchain installation failed after 10 attempts.' >&2
-              exit 1
-            fi
-            sleep $((attempt * 2))
-          done
-          rustc --version
-          cargo --version
-          rustfmt --version
-
       - name: Install npm dependencies
         run: npm ci
 
@@ -141,17 +89,16 @@ jobs:
 
   frontend-tests:
     name: Frontend tests
-    runs-on: ubuntu-latest
+    runs-on: genarrative-ci
     steps:
-      - name: Checkout source
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          persist-credentials: false
+      - name: Checkout source from Gitea
+        env:
+          GENARRATIVE_GITEA_FETCH_DEPTH: '1'
+          GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
+        run: genarrative-gitea-checkout
 
-      - name: Set up Node.js 22
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: '22'
+      - name: Validate preinstalled CI job image and sandbox
+        run: GENARRATIVE_GITEA_CI_CHECK_RUNTIME=1 bash scripts/check-gitea-ci-job-image.sh
 
       - name: Install npm dependencies
         run: npm ci
@@ -164,48 +111,16 @@ jobs:
 
   backend-tests:
     name: Backend tests
-    runs-on: ubuntu-latest
+    runs-on: genarrative-ci
     steps:
-      - name: Checkout full history
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
+      - name: Checkout full history from Gitea
+        env:
+          GENARRATIVE_GITEA_FETCH_DEPTH: '0'
+          GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
+        run: genarrative-gitea-checkout
 
-      - name: Install backend build dependencies
-        shell: bash
-        run: |
-          set -euo pipefail
-          command -v apt-get >/dev/null 2>&1 || {
-            echo 'ubuntu-latest runner must provide an Ubuntu or Debian environment.' >&2
-            exit 1
-          }
-          sudo_command=()
-          if [[ "$(id -u)" -ne 0 ]]; then
-            command -v sudo >/dev/null 2>&1 || {
-              echo 'non-root runner user requires sudo for system dependencies.' >&2
-              exit 1
-            }
-            sudo_command=(sudo -E)
-          fi
-          "${sudo_command[@]}" apt-get update
-          "${sudo_command[@]}" env DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-            build-essential \
-            ca-certificates \
-            clang \
-            cmake \
-            curl \
-            ffmpeg \
-            libclang-dev \
-            libcurl4-openssl-dev \
-            libssl-dev \
-            lld \
-            pkg-config
-
-      - name: Set up Node.js 22
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: '22'
+      - name: Validate preinstalled CI job image and sandbox
+        run: GENARRATIVE_GITEA_CI_CHECK_RUNTIME=1 bash scripts/check-gitea-ci-job-image.sh
 
       - name: Resolve comparison base
         shell: bash
@@ -231,48 +146,29 @@ jobs:
           fi
           echo "SPACETIME_SCHEMA_BASE_REF=${base_ref}" >> "${GITHUB_ENV}"
 
-      - name: Set up repository Rust toolchain
-        shell: bash
-        run: |
-          set -euo pipefail
-          if ! command -v rustup >/dev/null 2>&1; then
-            for attempt in $(seq 1 10); do
-              if curl --retry 3 --retry-all-errors --retry-delay 2 \
-                --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
-                | sh -s -- -y --profile minimal --default-toolchain none; then
-                break
-              fi
-              if [[ "${attempt}" -eq 10 ]]; then
-                echo 'rustup bootstrap failed after 10 attempts.' >&2
-                exit 1
-              fi
-              sleep $((attempt * 2))
-            done
-          fi
-          echo "${HOME}/.cargo/bin" >> "${GITHUB_PATH}"
-          export PATH="${HOME}/.cargo/bin:${PATH}"
-          toolchain="$(sed -n 's/^channel = "\([^"]*\)"/\1/p' rust-toolchain.toml)"
-          test -n "${toolchain}"
-          for attempt in $(seq 1 10); do
-            if rustup toolchain install "${toolchain}" --profile minimal --component rustfmt; then
-              break
-            fi
-            if [[ "${attempt}" -eq 10 ]]; then
-              echo 'Rust toolchain installation failed after 10 attempts.' >&2
-              exit 1
-            fi
-            sleep $((attempt * 2))
-          done
-          rustc --version
-          cargo --version
-          rustfmt --version
-
       - name: Install npm dependencies
         run: npm ci
 
       - name: Check server-rs boundaries
         run: npm run check:server-rs-ddd
 
+      - name: Prepare server-rs Rust dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          for attempt in $(seq 1 5); do
+            if cargo fetch --locked \
+              --target x86_64-unknown-linux-gnu \
+              --manifest-path server-rs/Cargo.toml; then
+              break
+            fi
+            if [[ "${attempt}" -eq 5 ]]; then
+              echo 'server-rs Cargo dependency fetch failed after 5 attempts.' >&2
+              exit 1
+            fi
+            sleep $((attempt * 2))
+          done
+
       - name: Run server-rs workspace tests
         run: cargo test --locked --workspace --no-fail-fast --manifest-path server-rs/Cargo.toml
 
@@ -284,181 +180,16 @@ jobs:
 
   native-shell-tests:
     name: Native shell tests
-    runs-on: ubuntu-latest
+    runs-on: genarrative-ci
     steps:
-      - name: Checkout full history
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
+      - name: Checkout full history from Gitea
+        env:
+          GENARRATIVE_GITEA_FETCH_DEPTH: '0'
+          GENARRATIVE_GITEA_TOKEN: ${{ github.token }}
+        run: genarrative-gitea-checkout
 
-      - name: Install native shell build dependencies
-        shell: bash
-        run: |
-          set -euo pipefail
-          command -v apt-get >/dev/null 2>&1 || {
-            echo 'ubuntu-latest runner must provide an Ubuntu or Debian environment.' >&2
-            exit 1
-          }
-          sudo_command=()
-          if [[ "$(id -u)" -ne 0 ]]; then
-            command -v sudo >/dev/null 2>&1 || {
-              echo 'non-root runner user requires sudo for system dependencies.' >&2
-              exit 1
-            }
-            sudo_command=(sudo -E)
-          fi
-          "${sudo_command[@]}" apt-get update
-          "${sudo_command[@]}" env DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-            build-essential \
-            bubblewrap \
-            ca-certificates \
-            clang \
-            cmake \
-            curl \
-            file \
-            libayatana-appindicator3-dev \
-            libssl-dev \
-            libwebkit2gtk-4.1-dev \
-            libxdo-dev \
-            librsvg2-dev \
-            lld \
-            patchelf \
-            pkg-config \
-            ripgrep \
-            wget
-          google_key="$(mktemp)"
-          curl --retry 3 --retry-all-errors --retry-delay 2 \
-            --proto '=https' --tlsv1.2 -fsSL \
-            https://dl.google.com/linux/linux_signing_key.pub \
-            -o "${google_key}"
-          "${sudo_command[@]}" install -d -m 0755 /etc/apt/keyrings
-          "${sudo_command[@]}" install -m 0644 "${google_key}" \
-            /etc/apt/keyrings/google-chrome.asc
-          printf '%s\n' \
-            'deb [arch=amd64 signed-by=/etc/apt/keyrings/google-chrome.asc] https://dl.google.com/linux/chrome/deb/ stable main' \
-            | "${sudo_command[@]}" tee /etc/apt/sources.list.d/google-chrome.list >/dev/null
-          "${sudo_command[@]}" apt-get update
-          "${sudo_command[@]}" env DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-            google-chrome-stable
-          google-chrome --version
-          bwrap_args=(
-            --die-with-parent
-            --unshare-all
-            --unshare-user
-            --disable-userns
-            --assert-userns-disabled
-            --cap-drop ALL
-            --clearenv
-            --ro-bind /usr /usr
-          )
-          for merged_path in /bin /sbin /lib /lib64; do
-            if [[ -L "${merged_path}" ]]; then
-              bwrap_args+=(--symlink "$(readlink "${merged_path}")" "${merged_path}")
-            fi
-          done
-          bwrap_args+=(
-            --proc /proc
-            --dev /dev
-            --tmpfs /tmp
-            --
-            /usr/bin/true
-          )
-          bwrap "${bwrap_args[@]}"
-
-      - name: Set up Node.js 22
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: '22'
-
-      - name: Expose trusted Node.js command paths
-        shell: bash
-        run: |
-          set -euo pipefail
-          node_path="$(command -v node)"
-          npm_path="$(command -v npm)"
-          test -x "${node_path}"
-          test -x "${npm_path}"
-          node_root="$(cd "$(dirname "${node_path}")/.." && pwd -P)"
-          test -d "${node_root}/lib/node_modules/npm"
-          sudo_command=()
-          if [[ "$(id -u)" -ne 0 ]]; then
-            command -v sudo >/dev/null 2>&1 || {
-              echo 'non-root runner user requires sudo to expose trusted Node.js paths.' >&2
-              exit 1
-            }
-            sudo_command=(sudo -E)
-          fi
-          trusted_node_root='/usr/local/lib/genarrative-node'
-          "${sudo_command[@]}" install -d -m 0755 "${trusted_node_root}"
-          "${sudo_command[@]}" cp -a "${node_root}/." "${trusted_node_root}/"
-          "${sudo_command[@]}" ln -sfn "${trusted_node_root}/bin/node" /usr/local/bin/node
-          "${sudo_command[@]}" ln -sfn "${trusted_node_root}/bin/npm" /usr/local/bin/npm
-          /usr/local/bin/node --version
-          /usr/local/bin/npm --version
-
-      - name: Set up repository Rust toolchain
-        shell: bash
-        run: |
-          set -euo pipefail
-          if ! command -v rustup >/dev/null 2>&1; then
-            for attempt in $(seq 1 10); do
-              if curl --retry 3 --retry-all-errors --retry-delay 2 \
-                --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
-                | sh -s -- -y --profile minimal --default-toolchain none; then
-                break
-              fi
-              if [[ "${attempt}" -eq 10 ]]; then
-                echo 'rustup bootstrap failed after 10 attempts.' >&2
-                exit 1
-              fi
-              sleep $((attempt * 2))
-            done
-          fi
-          echo "${HOME}/.cargo/bin" >> "${GITHUB_PATH}"
-          export PATH="${HOME}/.cargo/bin:${PATH}"
-          toolchain="$(sed -n 's/^channel = "\([^"]*\)"/\1/p' rust-toolchain.toml)"
-          test -n "${toolchain}"
-          for attempt in $(seq 1 10); do
-            if rustup toolchain install "${toolchain}" --profile minimal --component rustfmt; then
-              break
-            fi
-            if [[ "${attempt}" -eq 10 ]]; then
-              echo 'Rust toolchain installation failed after 10 attempts.' >&2
-              exit 1
-            fi
-            sleep $((attempt * 2))
-          done
-          rustc --version
-          cargo --version
-          rustfmt --version
-
-      - name: Expose trusted Rust command paths
-        shell: bash
-        run: |
-          set -euo pipefail
-          rustup_path="$(command -v rustup)"
-          test -x "${rustup_path}"
-          rustup_home="$(rustup show home)"
-          test -d "${rustup_home}"
-          sudo_command=()
-          if [[ "$(id -u)" -ne 0 ]]; then
-            command -v sudo >/dev/null 2>&1 || {
-              echo 'non-root runner user requires sudo to expose trusted Rust paths.' >&2
-              exit 1
-            }
-            sudo_command=(sudo -E)
-          fi
-          if [[ "$(readlink -f "${rustup_path}")" != '/usr/local/bin/rustup' ]]; then
-            "${sudo_command[@]}" install -m 0755 "${rustup_path}" /usr/local/bin/rustup
-          fi
-          for command_name in cargo rustc rustdoc rustfmt; do
-            "${sudo_command[@]}" ln -sfn rustup "/usr/local/bin/${command_name}"
-          done
-          echo "RUSTUP_HOME=${rustup_home}" >> "${GITHUB_ENV}"
-          /usr/local/bin/cargo --version
-          /usr/local/bin/rustc --version
-          /usr/local/bin/rustfmt --version
+      - name: Validate preinstalled CI job image and sandbox
+        run: GENARRATIVE_GITEA_CI_CHECK_RUNTIME=1 bash scripts/check-gitea-ci-job-image.sh
 
       - name: Install npm dependencies
         run: npm ci
@@ -466,6 +197,27 @@ jobs:
       - name: Install AI game creator dependencies
         run: npm ci --prefix apps/ai-game-creator-shell
 
+      - name: Prepare native Rust dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          for manifest_path in \
+            apps/desktop-shell/src-tauri/Cargo.toml \
+            apps/ai-game-creator-shell/src-tauri/Cargo.toml; do
+            for attempt in $(seq 1 5); do
+              if cargo fetch --locked \
+                --target x86_64-unknown-linux-gnu \
+                --manifest-path "${manifest_path}"; then
+                break
+              fi
+              if [[ "${attempt}" -eq 5 ]]; then
+                echo "Cargo dependency fetch failed after 5 attempts: ${manifest_path}" >&2
+                exit 1
+              fi
+              sleep $((attempt * 2))
+            done
+          done
+
       - name: Run native shell gates
         run: npm run check:native-shells
 

apps/ai-game-creator-shell/src-tauri/src/tests.rs

@@ -17767,18 +17767,14 @@ async fn background_agent_runtime_marks_response_plan_step_failed_when_final_rep
     )
     .expect("start background task");
 
-    let mut runtime = read_game_creator_agent_runtime_at(&root, "design-director")
-        .expect("read runtime")
-        .state;
-    for _ in 0..750 {
-        if runtime.status == "failed" {
-            break;
-        }
-        std::thread::sleep(Duration::from_millis(20));
-        runtime = read_game_creator_agent_runtime_at(&root, "design-director")
-            .expect("read runtime")
-            .state;
-    }
+    let failed_result = wait_for_agent_runtime_terminal_and_lane_release(
+        &root,
+        "design-director",
+        "design-response-fail-run",
+        "failed",
+        "failed",
+    );
+    let runtime = &failed_result.state;
 
     assert_eq!(runtime.status, "failed");
     assert_eq!(runtime.phase, "failed");
@@ -17790,8 +17786,6 @@ async fn background_agent_runtime_marks_response_plan_step_failed_when_final_rep
         .detail
         .as_deref()
         .is_some_and(|detail| detail.contains("后台 Agent 最终回复调用 LLM 失败")));
-    let failed_result =
-        read_game_creator_agent_runtime_at(&root, "design-director").expect("read failed events");
     let event_types = failed_result
         .recent_events
         .iter()
@@ -46077,24 +46071,22 @@ async fn background_agent_runtime_tasks_can_run_in_parallel_and_persist_replies(
     assert!(combined_requests.contains("后台准备主角规范图"));
     assert!(combined_requests.contains("后台整理玩法循环"));
 
-    let mut art_runtime = read_game_creator_agent_runtime_at(&root, "art-director")
-        .expect("read art runtime")
-        .state;
-    let mut design_runtime = read_game_creator_agent_runtime_at(&root, "design-director")
-        .expect("read design runtime")
-        .state;
-    for _ in 0..250 {
-        if art_runtime.status == "idle" && design_runtime.status == "idle" {
-            break;
-        }
-        std::thread::sleep(Duration::from_millis(20));
-        art_runtime = read_game_creator_agent_runtime_at(&root, "art-director")
-            .expect("read art runtime")
-            .state;
-        design_runtime = read_game_creator_agent_runtime_at(&root, "design-director")
-            .expect("read design runtime")
-            .state;
-    }
+    let art_runtime_result = wait_for_agent_runtime_terminal_and_lane_release(
+        &root,
+        "art-director",
+        "art-background-run",
+        "idle",
+        "completed",
+    );
+    let design_runtime_result = wait_for_agent_runtime_terminal_and_lane_release(
+        &root,
+        "design-director",
+        "design-background-run",
+        "idle",
+        "completed",
+    );
+    let art_runtime = &art_runtime_result.state;
+    let design_runtime = &design_runtime_result.state;
 
     assert_eq!(art_runtime.status, "idle");
     assert_eq!(art_runtime.phase, "completed");
@@ -46108,10 +46100,6 @@ async fn background_agent_runtime_tasks_can_run_in_parallel_and_persist_replies(
         design_runtime.last_response.as_deref(),
         Some("策划后台任务完成：先收敛核心循环。")
     );
-    let art_runtime_result =
-        read_game_creator_agent_runtime_at(&root, "art-director").expect("art runtime result");
-    let design_runtime_result = read_game_creator_agent_runtime_at(&root, "design-director")
-        .expect("design runtime result");
     assert!(art_runtime_result
         .recent_tasks
         .iter()
@@ -46174,9 +46162,6 @@ async fn background_agent_runtime_tasks_can_run_in_parallel_and_persist_replies(
             "assistant conversation must persist before Runtime completes for {agent_id}"
         );
     }
-    drop(wait_to_acquire_agent_runtime_lock(&root, "art-director"));
-    drop(wait_to_acquire_agent_runtime_lock(&root, "design-director"));
-
     fs::remove_dir_all(root).ok();
 }
 

docs/project-memory/shared-memory/pitfalls.md

@@ -35,7 +35,7 @@
 - 现象：isolated child 已显示 idle，单次 all-join reconcile 却偶发返回空列表；或者 Runtime 已显示 completed / failed，Goal、conversation、Agent DB 审计和 per-Agent lock 仍未完成，完整 Rust suite 里出现低概率失败，单独重跑通常通过。
 - 原因：Runtime state、Goal sidecar、终态 result、conversation、审计记录、handoff 清理和执行 lane 释放不是同一个原子观测点；测试只等待 idle / failed 会在同一后台 drain 的 durable 收尾前抢先断言。
 - 处理：产品协议仍以 durable terminal result 和 join readiness 为准。测试在有界时限内等待业务目标终态；需要断言同一 drain 的后续副作用时，同时以 per-Agent runtime task lock 释放为 fence，命中后重新读取投影。join 场景继续重复调用幂等 reconcile，直到取得唯一 join 或超时；不得靠固定长 sleep，也不能因为第一次为空就把协议改成吞掉未完成 child。
-- 验证：`isolated_agents_with_same_template_run_independently_and_join_once` 最多执行 100 次、每次间隔 20ms 的 reconcile，并继续断言只有一个 all-join 和一次父唤醒；Goal、loop-budget、finalization 与 Supervisor reconciliation 测试必须在目标 status / phase 与 Agent lane 同时收束后再读取最终副作用。
+- 验证：`isolated_agents_with_same_template_run_independently_and_join_once` 最多执行 100 次、每次间隔 20ms 的 reconcile，并继续断言只有一个 all-join 和一次父唤醒；Goal、loop-budget、finalization 与 Supervisor reconciliation 测试必须在目标 status / phase 与 Agent lane 同时收束后再读取最终副作用。`background_agent_runtime_marks_response_plan_step_failed_when_final_reply_fails` 和 `background_agent_runtime_tasks_can_run_in_parallel_and_persist_replies` 同样必须经过该 fence 后再断言 `turn.failed` 或 `agent.runtime.completed` 审计。
 - 关联：`apps/ai-game-creator-shell/src-tauri/src/tests.rs`、`apps/ai-game-creator-shell/src-tauri/src/agent.rs`。
 
 ## CI root 环境不能用文件只读权限注入写失败

scripts/check-gitea-ci-job-image.sh

@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+expected_toolchain="$(
+  sed -n 's/^channel = "\([^"]*\)"/\1/p' "${repo_root}/rust-toolchain.toml"
+)"
+
+test -n "${expected_toolchain}"
+[[ "$(node --version)" == v22.* ]]
+rustup toolchain list | rg -q "^${expected_toolchain}(-[^ ]+)?( |$)"
+[[ "$(rustup run "${expected_toolchain}" rustc --version)" == "rustc ${expected_toolchain} "* ]]
+test "$(readlink -f "$(command -v node)")" = "/usr/local/lib/genarrative-node/bin/node"
+test "$(rustup show home)" = "/usr/local/rustup"
+for trusted_command in cargo rustc rustdoc rustfmt rustup; do
+  test "$(command -v "${trusted_command}")" = "/usr/local/bin/${trusted_command}"
+done
+test "$(command -v genarrative-gitea-checkout)" = "/usr/local/bin/genarrative-gitea-checkout"
+bash -n /usr/local/bin/genarrative-gitea-checkout
+test -d /root/.npm/_cacache
+test -d /usr/local/cargo/registry/cache
+
+verify_cache_lock() {
+  local cache_name="$1"
+  local expected_sha256="$2"
+  local lock_path="$3"
+  local actual_sha256
+
+  test -n "${expected_sha256}"
+  actual_sha256="$(sha256sum "${lock_path}")"
+  actual_sha256="${actual_sha256%% *}"
+  if [[ "${actual_sha256}" == "${expected_sha256}" ]]; then
+    printf '%s_cache_lock=hit\n' "${cache_name}"
+    return
+  fi
+  if [[ "${GENARRATIVE_GITEA_CI_CHECK_RUNTIME:-0}" == '1' ]]; then
+    printf '%s_cache_lock=partial\n' "${cache_name}"
+    return
+  fi
+  echo "${cache_name} cache lock does not match the verification checkout." >&2
+  exit 1
+}
+
+npm_lock_path="${repo_root}/package-lock.json"
+server_rust_lock_path="${repo_root}/server-rs/Cargo.lock"
+desktop_rust_lock_path="${repo_root}/apps/desktop-shell/src-tauri/Cargo.lock"
+if [[ ! -f "${npm_lock_path}" ]]; then
+  npm_lock_path='/usr/local/share/genarrative-ci/npm/package-lock.json'
+fi
+if [[ ! -f "${server_rust_lock_path}" ]]; then
+  server_rust_lock_path='/usr/local/share/genarrative-ci/locks/server-rs.Cargo.lock'
+fi
+if [[ ! -f "${desktop_rust_lock_path}" ]]; then
+  desktop_rust_lock_path='/usr/local/share/genarrative-ci/locks/desktop-shell.Cargo.lock'
+fi
+
+verify_cache_lock \
+  npm \
+  "${GENARRATIVE_GITEA_CI_NPM_LOCK_SHA256:-}" \
+  "${npm_lock_path}"
+verify_cache_lock \
+  server_rust \
+  "${GENARRATIVE_GITEA_CI_SERVER_RUST_LOCK_SHA256:-}" \
+  "${server_rust_lock_path}"
+verify_cache_lock \
+  desktop_rust \
+  "${GENARRATIVE_GITEA_CI_DESKTOP_RUST_LOCK_SHA256:-}" \
+  "${desktop_rust_lock_path}"
+
+for command_name in \
+  bwrap \
+  cargo \
+  clang \
+  cmake \
+  curl \
+  ffmpeg \
+  file \
+  google-chrome \
+  lld \
+  npm \
+  patchelf \
+  pkg-config \
+  rg \
+  rustfmt \
+  rustup \
+  wget; do
+  command -v "${command_name}" >/dev/null
+done
+
+pkg-config --exists \
+  ayatana-appindicator3-0.1 \
+  libcurl \
+  openssl \
+  webkit2gtk-4.1
+
+node --version
+npm --version
+rustup run "${expected_toolchain}" rustc --version
+rustup run "${expected_toolchain}" cargo --version
+rustup run "${expected_toolchain}" rustfmt --version
+google-chrome --version
+bwrap --version
+ffmpeg -version | head -n 1
+
+if [[ "${GENARRATIVE_GITEA_CI_CHECK_RUNTIME:-0}" == '1' ]]; then
+  bash "${repo_root}/scripts/check-gitea-ci-job-runtime.sh"
+fi

scripts/check-gitea-ci-job-runtime.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+bwrap_args=(
+  --die-with-parent
+  --unshare-all
+  --unshare-user
+  --disable-userns
+  --assert-userns-disabled
+  --cap-drop ALL
+  --clearenv
+  --ro-bind /usr /usr
+)
+for merged_path in /bin /sbin /lib /lib64; do
+  if [[ -L "${merged_path}" ]]; then
+    bwrap_args+=(--symlink "$(readlink "${merged_path}")" "${merged_path}")
+  fi
+done
+bwrap_args+=(
+  --proc /proc
+  --dev /dev
+  --tmpfs /tmp
+  --
+  /usr/bin/true
+)
+bwrap "${bwrap_args[@]}"
+
+chrome_output="$(
+  timeout 30 google-chrome \
+    --headless=new \
+    --no-sandbox \
+    --disable-dev-shm-usage \
+    --disable-gpu \
+    --dump-dom \
+    'data:text/html,<title>genarrative-ci</title>' \
+    2>/dev/null
+)"
+rg -q '<title>genarrative-ci</title>' <<< "${chrome_output}"