Consolidate required CI gate (#115)

.gitea/workflows/api-surface.yml

@@ -1,81 +0,0 @@
-name: API and SemVer surface
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/api-surface.yml"
-      - "Cargo.lock"
-      - "Cargo.toml"
-      - "api/**"
-      - "ci/evidence/api-audit.json"
-      - "crates/**"
-      - "tests/api-compile/**"
-      - "tests/semver-port/**"
-      - "tools/check_api_coverage.py"
-      - "tools/generate_api_shims.py"
-      - "tools/generate_rust_mapping.py"
-      - "tools/ci-matrix/**"
-  pull_request:
-    paths:
-      - ".gitea/workflows/api-surface.yml"
-      - "Cargo.lock"
-      - "Cargo.toml"
-      - "api/**"
-      - "ci/evidence/api-audit.json"
-      - "crates/**"
-      - "tests/api-compile/**"
-      - "tests/semver-port/**"
-      - "tools/check_api_coverage.py"
-      - "tools/generate_api_shims.py"
-      - "tools/generate_rust_mapping.py"
-      - "tools/ci-matrix/**"
-
-jobs:
-  api-surface:
-    runs-on: ubuntu-latest
-    env:
-      CARGO_BUILD_JOBS: "1"
-      CARGO_INCREMENTAL: "0"
-      CARGO_PROFILE_DEV_DEBUG: "0"
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install native prerequisites
-        run: sudo apt-get update && sudo apt-get install -y libopus-dev pkg-config
-
-      - name: Install Rust 1.97
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: "1.97.0"
-          components: rustfmt, clippy
-
-      - name: Verify deterministic mapping and export coverage
-        run: |
-          python3 tools/generate_rust_mapping.py --check
-          python3 tools/generate_api_shims.py --check
-          python3 tools/check_api_coverage.py
-
-      - name: Verify reviewed API baseline
-        run: |
-          cargo run --locked -p metacrate-ci-matrix -- api-baseline-write
-          git diff --exit-code -- api/SEMVER-BASELINE.json api/SEMVER-AUDIT.md
-          cargo run --locked -p metacrate-ci-matrix -- api-audit --evidence /tmp/metacrate-api-audit.json
-          cmp /tmp/metacrate-api-audit.json ci/evidence/api-audit.json
-
-      - name: Compile downstream API consumers
-        run: |
-          cargo check --locked --manifest-path tests/api-compile/Cargo.toml
-          cargo run --locked --manifest-path tests/semver-port/Cargo.toml
-
-      - name: Check formatting and lints
-        run: |
-          cargo fmt --all -- --check
-          cargo fmt --manifest-path tests/semver-port/Cargo.toml -- --check
-          cargo clippy --locked -p metacrate-ci-matrix --all-targets -- -D warnings
-          cargo clippy --locked --manifest-path tests/semver-port/Cargo.toml --all-targets -- -D warnings
-
-      - name: Upload audit evidence
-        uses: actions/upload-artifact@v3
-        with:
-          name: api-semver-audit
-          path: ci/evidence/api-audit.json

.gitea/workflows/artifact-audit.yml

@@ -1,95 +0,0 @@
-name: Native release artifact audit
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/artifact-audit.yml"
-      - "ci/artifact-policy.json"
-      - "ci/dependency-policy.json"
-      - "ci/provenance-policy.json"
-      - "tools/ci-matrix/**"
-      - "tools/install_openjpeg_2_5_4.sh"
-      - "docs/release-artifacts.md"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/**"
-      - "programs/**"
-  pull_request:
-    paths:
-      - ".gitea/workflows/artifact-audit.yml"
-      - "ci/artifact-policy.json"
-      - "ci/dependency-policy.json"
-      - "ci/provenance-policy.json"
-      - "tools/ci-matrix/**"
-      - "tools/install_openjpeg_2_5_4.sh"
-      - "docs/release-artifacts.md"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/**"
-      - "programs/**"
-  workflow_dispatch:
-
-env:
-  CARGO_BUILD_JOBS: 1
-  CARGO_INCREMENTAL: 0
-  CARGO_PROFILE_RELEASE_OPT_LEVEL: 0
-  FORCE_SKIA_BINARIES_DOWNLOAD: 1
-  OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-artifact-audit
-  PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-artifact-audit/lib/pkgconfig
-  LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-artifact-audit/lib
-
-jobs:
-  audit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: 1.97.1
-      - name: Install documented native prerequisites
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential clang cmake curl ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev
-          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
-          pkg-config --exact-version 2.5.4 libopenjp2
-          pkg-config --modversion opus
-      - name: Record source identity without a shipped build helper
-        run: echo "METACRATE_RUST_COMMIT=$(git rev-parse --verify HEAD)" >>"$GITHUB_ENV"
-      - name: Fetch the locked dependency graph
-        run: cargo fetch --locked
-      - name: Create every release source package atomically
-        run: |
-          cargo package --locked --no-verify \
-            -p libremetaverse-types \
-            -p libremetaverse-structured-data \
-            -p libremetaverse-imaging \
-            -p libremetaverse-imaging-skia \
-            -p libremetaverse-openjpeg \
-            -p libremetaverse-opus \
-            -p libremetaverse-prim-mesher \
-            -p libremetaverse-lsl-tools \
-            -p libremetaverse \
-            -p libremetaverse-rendering-simple \
-            -p libremetaverse-rendering-mesh-foundry \
-            -p libremetaverse-rlv \
-            -p libremetaverse-utilities \
-            -p libremetaverse-voice-vivox \
-            -p libremetaverse-voice-webrtc \
-            -p libremetaverse-programs
-      - name: Build every shipped native executable
-        run: cargo build --locked --release -j 1 -p libremetaverse-programs --bins
-      - name: Inspect packages, binaries, links, and offline runtime behavior
-        run: |
-          cargo run --locked -p metacrate-ci-matrix -- artifact-audit \
-            --artifact-dir target/release \
-            --package-dir target/package \
-            --evidence artifacts/release/artifact-audit.json
-      - name: Upload immutable audit evidence and source packages
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: native-release-artifact-audit
-          path: |
-            artifacts/release/artifact-audit.json
-            target/package/*.crate
-          if-no-files-found: error

.gitea/workflows/ci.yml

@@ -0,0 +1,104 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      cold_cache:
+        description: Deliberately clear the required dependency/native cache before validation
+        required: false
+        default: false
+        type: boolean
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  required:
+    name: required
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      CARGO_BUILD_JOBS: "2"
+      CARGO_INCREMENTAL: "0"
+      CARGO_PROFILE_DEV_DEBUG: "0"
+      CARGO_PROFILE_TEST_DEBUG: "0"
+      RUSTDOCFLAGS: "-D warnings"
+      CARGO_HOME: ${{ runner.tool_cache }}/metacrate/cargo/home-rust-1.97.1-aarch64-unknown-linux-gnu
+      METACRATE_EXPECTED_HOST: aarch64-unknown-linux-gnu
+      METACRATE_PROVENANCE_DIAGNOSTICS_DIR: artifacts/ci/provenance-candidates
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Inspect the runner-persistent, architecture-keyed cache
+        run: |
+          cache_key="$(sha256sum .gitea/workflows/ci.yml Cargo.lock Cargo.toml ci/ci-coverage.json ci/dependency-policy.json deny.toml tools/install_openjpeg_2_5_4.sh crates/libremetaverse-imaging-skia/Cargo.toml | sha256sum | cut -d ' ' -f 1)"
+          cargo_target="${{ runner.tool_cache }}/metacrate/cargo/target-rust-1.97.1-aarch64-unknown-linux-gnu-$cache_key"
+          openjpeg_prefix="${{ runner.tool_cache }}/metacrate/native/openjpeg-2.5.4-${{ runner.arch }}"
+          skia_dir="${{ runner.tool_cache }}/metacrate/native/skia-0.99.0-aarch64-unknown-linux-gnu"
+          skia_archive="$skia_dir/skia-binaries-a25a0fdb7d90429aa2d1-aarch64-unknown-linux-gnu-jpegd-jpege-pdf-svg-textlayout-vulkan-webpd-webpe.tar.gz"
+          if test "${{ github.event_name }}" = workflow_dispatch && test "${{ inputs.cold_cache }}" = true; then
+            cargo clean --target-dir "$cargo_target"
+            rm -rf -- "$CARGO_HOME/registry" "$CARGO_HOME/git" "$openjpeg_prefix" "$skia_dir"
+            rm -f -- "$CARGO_HOME/bin/cargo-deny" "$CARGO_HOME/bin/cargo-machete"
+          fi
+          mkdir -p "$CARGO_HOME" "$cargo_target" "$skia_dir"
+          test -f "$cargo_target/.metacrate-ready" && cargo_hit=true || cargo_hit=false
+          test -f "$openjpeg_prefix/metacrate-openjpeg.identity" && test -f "$skia_archive" && native_hit=true || native_hit=false
+          test -x "$CARGO_HOME/bin/cargo-deny" && test -x "$CARGO_HOME/bin/cargo-machete" && tools_hit=true || tools_hit=false
+          echo "CARGO_TARGET_DIR=$cargo_target" >> "$GITHUB_ENV"
+          echo "OPENJPEG_PREFIX=$openjpeg_prefix" >> "$GITHUB_ENV"
+          echo "PKG_CONFIG_PATH=$openjpeg_prefix/lib/pkgconfig" >> "$GITHUB_ENV"
+          echo "LD_LIBRARY_PATH=$openjpeg_prefix/lib" >> "$GITHUB_ENV"
+          echo "METACRATE_SKIA_ARCHIVE=$skia_archive" >> "$GITHUB_ENV"
+          echo "METACRATE_CARGO_CACHE_HIT=$cargo_hit" >> "$GITHUB_ENV"
+          echo "METACRATE_NATIVE_CACHE_HIT=$native_hit" >> "$GITHUB_ENV"
+          echo "METACRATE_TOOLS_CACHE_HIT=$tools_hit" >> "$GITHUB_ENV"
+
+      - name: Install the single native prerequisite set
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes build-essential clang cmake curl git ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev libasound2-dev
+
+      - name: Install pinned Rust and audit tools
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.97.1
+          components: clippy,rustfmt
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny@0.20.2,cargo-machete@0.9.2
+
+      - name: Verify pinned audit tool versions
+        run: |
+          cargo deny --version | grep '0.20.2'
+          cargo machete --version | grep '0.9.2'
+
+      - name: Validate and populate the exact native cache
+        run: |
+          test "$(uname -m)" = aarch64
+          rustc -vV | grep '^host: aarch64-unknown-linux-gnu$'
+          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
+          pkg-config --exact-version 2.5.4 libopenjp2
+          mkdir -p "$(dirname "$METACRATE_SKIA_ARCHIVE")"
+          if ! echo 'dd127f458a5e67a79f3936a8aa19f822fe90a1d6a11b50b5f84df2b0519d909c  '"$METACRATE_SKIA_ARCHIVE" | sha256sum --check --status; then
+            curl --fail --location --proto '=https' --tlsv1.2 --output "$METACRATE_SKIA_ARCHIVE" \
+              https://github.com/rust-skia/skia-binaries/releases/download/0.99.0/skia-binaries-a25a0fdb7d90429aa2d1-aarch64-unknown-linux-gnu-jpegd-jpege-pdf-svg-textlayout-vulkan-webpd-webpe.tar.gz
+          fi
+          echo 'dd127f458a5e67a79f3936a8aa19f822fe90a1d6a11b50b5f84df2b0519d909c  '"$METACRATE_SKIA_ARCHIVE" | sha256sum --check
+
+      - name: Run the authoritative code-ready graph
+        run: cargo run --locked -p metacrate-ci-matrix -- required-gate --evidence artifacts/ci/required-gate.json
+
+      - name: Mark the validated cache generation ready
+        run: touch "$CARGO_TARGET_DIR/.metacrate-ready"
+
+      - name: Upload stage timing and audit evidence
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: required-ci-evidence
+          path: artifacts/ci/
+          if-no-files-found: error

.gitea/workflows/codegen.yml

@@ -1,175 +0,0 @@
-name: Native code generation
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/codegen.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "api/**"
-      - "codegen/**"
-      - "tools/codegen/**"
-      - "tools/generate_*.py"
-      - "tools/install_openjpeg_2_5_4.sh"
-      - "tools/check_api_coverage.py"
-      - "tools/check_codegen_gate.py"
-      - "tools/check_milestone_08.py"
-      - "tools/check_milestone_09_issue_59.py"
-      - "tools/check_milestone_09_issue_60.py"
-      - "tools/check_milestone_09_issue_61.py"
-      - "tools/check_milestone_09_issue_62.py"
-      - "tools/check_milestone_09_issue_63.py"
-      - "tools/check_milestone_09_issue_64.py"
-      - "tools/check_milestone_09_issue_65.py"
-      - "tools/check_milestone_09_issue_66.py"
-      - "tools/check_milestone_09.py"
-      - "tools/test_milestone_09.py"
-      - "crates/libremetaverse/src/agent_movement.rs"
-      - "crates/libremetaverse/src/inventory.rs"
-      - "crates/libremetaverse/src/inventory_manager.rs"
-      - "crates/libremetaverse/src/inventory_ais.rs"
-      - "crates/libremetaverse/src/inventory_ais_internal_semantics.rs"
-      - "docs/agent-movement.md"
-      - "docs/inventory.md"
-      - "crates/libremetaverse/Cargo.toml"
-      - "crates/libremetaverse/src/generated.rs"
-      - "crates/libremetaverse/src/packets.rs"
-      - "crates/libremetaverse/src/packet_*.rs"
-      - "crates/libremetaverse/src/*_catalog.rs"
-      - "tests/api-compile/**"
-      - "tests/compat/Cargo.toml"
-      - "tests/compat/build.rs"
-      - "tests/compat/src/**"
-      - "tests/compat/tests/wire_semantics.rs"
-      - "tests/compat/tests/appearance_visual_semantics.rs"
-      - "tests/compat/tests/inventory_store_semantics.rs"
-      - "tests/compat/tests/inventory_manager_semantics.rs"
-      - "tests/compat/tests/inventory_ais_semantics.rs"
-      - "tests/compat/tests/task_inventory_semantics.rs"
-      - "tests/compat/tests/misclassified_link_semantics.rs"
-      - "tests/upstream-tests.json"
-  pull_request:
-    paths:
-      - ".gitea/workflows/codegen.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "api/**"
-      - "codegen/**"
-      - "tools/codegen/**"
-      - "tools/generate_*.py"
-      - "tools/install_openjpeg_2_5_4.sh"
-      - "tools/check_api_coverage.py"
-      - "tools/check_codegen_gate.py"
-      - "tools/check_milestone_08.py"
-      - "tools/check_milestone_09_issue_59.py"
-      - "tools/check_milestone_09_issue_60.py"
-      - "tools/check_milestone_09_issue_61.py"
-      - "tools/check_milestone_09_issue_62.py"
-      - "tools/check_milestone_09_issue_63.py"
-      - "tools/check_milestone_09_issue_64.py"
-      - "tools/check_milestone_09_issue_65.py"
-      - "tools/check_milestone_09_issue_66.py"
-      - "tools/check_milestone_09.py"
-      - "tools/test_milestone_09.py"
-      - "crates/libremetaverse/src/agent_movement.rs"
-      - "crates/libremetaverse/src/inventory.rs"
-      - "crates/libremetaverse/src/inventory_manager.rs"
-      - "crates/libremetaverse/src/inventory_ais.rs"
-      - "crates/libremetaverse/src/inventory_ais_internal_semantics.rs"
-      - "docs/agent-movement.md"
-      - "docs/inventory.md"
-      - "crates/libremetaverse/Cargo.toml"
-      - "crates/libremetaverse/src/generated.rs"
-      - "crates/libremetaverse/src/packets.rs"
-      - "crates/libremetaverse/src/packet_*.rs"
-      - "crates/libremetaverse/src/*_catalog.rs"
-      - "tests/api-compile/**"
-      - "tests/compat/Cargo.toml"
-      - "tests/compat/build.rs"
-      - "tests/compat/src/**"
-      - "tests/compat/tests/wire_semantics.rs"
-      - "tests/compat/tests/appearance_visual_semantics.rs"
-      - "tests/compat/tests/inventory_store_semantics.rs"
-      - "tests/compat/tests/inventory_manager_semantics.rs"
-      - "tests/compat/tests/inventory_ais_semantics.rs"
-      - "tests/compat/tests/task_inventory_semantics.rs"
-      - "tests/compat/tests/misclassified_link_semantics.rs"
-      - "tests/upstream-tests.json"
-  workflow_dispatch:
-
-jobs:
-  deterministic:
-    runs-on: ubuntu-latest
-    env:
-      OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-${{ github.run_id }}
-      PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib/pkgconfig
-      LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib
-      CARGO_BUILD_JOBS: 1
-      CARGO_INCREMENTAL: 0
-      CARGO_PROFILE_DEV_DEBUG: 0
-      CARGO_PROFILE_TEST_DEBUG: 0
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy,rustfmt
-      - name: Install audited OpenJPEG 2.5.4
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential cmake pkg-config
-          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
-      - name: Test diagnostics and byte-identical generation
-        run: cargo test -p libremetaverse-codegen
-      - name: Verify vendored hashes and checked-in output
-        run: cargo run -p libremetaverse-codegen -- check
-      - name: Verify authoritative API mappings and consumer fixture
-        run: |
-          python3 tools/generate_rust_mapping.py --check
-          python3 tools/generate_api_shims.py --check
-          python3 tools/check_api_coverage.py
-          python3 tools/check_milestone_08.py
-          python3 tools/check_milestone_09_issue_59.py
-          python3 tools/check_milestone_09_issue_60.py
-          python3 tools/check_milestone_09_issue_61.py
-          python3 tools/check_milestone_09_issue_62.py
-          python3 tools/check_milestone_09_issue_63.py
-          python3 tools/check_milestone_09_issue_64.py
-          python3 tools/check_milestone_09_issue_65.py
-          python3 tools/check_milestone_09_issue_66.py
-          python3 tools/check_milestone_09.py
-          cargo check --manifest-path tests/api-compile/Cargo.toml --locked
-      - name: Test generated wire codecs and translated parity cases
-        run: |
-          cargo test -p libremetaverse --lib generated_codec_tests
-          cargo test -p libremetaverse --test packet_wire
-          cargo test -p libremetaverse --test packet_osd
-          cargo test -p libremetaverse-compat-tests --test wire_semantics
-          cargo test -p libremetaverse-compat-tests --test inventory_store_semantics
-          cargo test -p libremetaverse-compat-tests --test inventory_manager_semantics
-          cargo test -p libremetaverse-compat-tests --test inventory_ais_semantics
-          cargo test -p libremetaverse --lib inventory_ais_internal_semantics
-          cargo test -p libremetaverse-compat-tests --test task_inventory_semantics
-          cargo test -p libremetaverse-compat-tests --test misclassified_link_semantics
-      - name: Test generated visual and foliage catalogs
-        run: |
-          cargo test -p libremetaverse --test generated_catalogs
-          cargo test -p libremetaverse-compat-tests --test appearance_visual_semantics
-          cargo test -p libremetaverse-compat-tests --test appearance_semantics
-          cargo test -p libremetaverse --lib appearance_
-          cargo test -p libremetaverse --lib initial_outfit::tests
-      - name: Test generated skeleton, attention, and genepool catalogs
-        run: |
-          cargo test -p libremetaverse --test generated_avatar_catalogs
-          cargo test -p libremetaverse --lib linden_skeleton
-          cargo test -p libremetaverse --lib joint_base_support_category
-          cargo test -p libremetaverse --lib joint_get_aliases_list
-      - name: Build and audit clean Rust-only release artifacts
-        run: |
-          cargo build -p libremetaverse-codegen --release --locked -j 1
-          python3 tools/check_codegen_gate.py --release-dir target/release
-      - name: Lint native generator
-        run: |
-          cargo clippy -p libremetaverse-codegen --all-targets -- -D warnings
-          cargo clippy -p libremetaverse --lib --no-deps -- -D warnings
-      - name: Prove normal consumer build does not execute generation
-        run: cargo build -p libremetaverse --locked

.gitea/workflows/concurrency-audit.yml

@@ -1,71 +0,0 @@
-name: Concurrency and resource soak audit
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/concurrency-audit.yml"
-      - "ci/concurrency-thresholds.json"
-      - "tools/concurrency-audit/**"
-      - "docs/concurrency-hardening.md"
-      - "crates/libremetaverse/src/client_core.rs"
-      - "crates/libremetaverse/src/download_manager.rs"
-      - "crates/libremetaverse/src/appearance_manager.rs"
-      - "crates/libremetaverse/src/asset_manager.rs"
-      - "crates/libremetaverse/src/inventory_manager.rs"
-      - "crates/libremetaverse-voice-webrtc/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-  pull_request:
-    paths:
-      - ".gitea/workflows/concurrency-audit.yml"
-      - "ci/concurrency-thresholds.json"
-      - "tools/concurrency-audit/**"
-      - "docs/concurrency-hardening.md"
-      - "crates/libremetaverse/src/client_core.rs"
-      - "crates/libremetaverse/src/download_manager.rs"
-      - "crates/libremetaverse/src/appearance_manager.rs"
-      - "crates/libremetaverse/src/asset_manager.rs"
-      - "crates/libremetaverse/src/inventory_manager.rs"
-      - "crates/libremetaverse-voice-webrtc/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-  workflow_dispatch:
-
-env:
-  CARGO_BUILD_JOBS: 1
-  CARGO_INCREMENTAL: 0
-  CARGO_PROFILE_DEV_DEBUG: 0
-  CARGO_PROFILE_TEST_DEBUG: 0
-
-jobs:
-  soak:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt, clippy
-      - name: Install native voice prerequisite
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes libopus-dev pkg-config
-      - name: Check formatting and focused race regressions
-        run: |
-          cargo fmt --all -- --check
-          cargo test --locked -p libremetaverse --lib shutdown_does_not_hold_service_registry_lock_across_callbacks -j 1
-          cargo test --locked -p libremetaverse --lib event_registry_isolates_panics_and_releases_subscriptions -j 1
-          cargo test --locked -p libremetaverse --lib dispatch_isolates_panics_and_does_not_retain_dropped_handlers -j 1
-          cargo test --locked -p libremetaverse --test caps_http download_queue_applies_backpressure_and_cancellation_drains_every_job -j 1
-          cargo test --locked -p libremetaverse-voice-webrtc concurrent_provisioning_admits_one_session_without_leaking_the_loser -j 1
-      - name: Run bounded native soak
-        run: |
-          mkdir -p artifacts
-          cargo run --locked -p metacrate-concurrency-audit -j 1 -- \
-            --cycles 16 --evidence artifacts/concurrency-audit.json
-      - name: Upload sanitized resource evidence
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: concurrency-audit-evidence
-          path: artifacts/concurrency-audit.json
-          if-no-files-found: error

.gitea/workflows/documentation.yml

@@ -1,89 +0,0 @@
-name: Documentation
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/documentation.yml"
-      - "Cargo.lock"
-      - "Cargo.toml"
-      - "README.md"
-      - "api/**"
-      - "crates/**"
-      - "docs/**"
-      - "programs/**"
-      - "tools/ci-matrix/**"
-      - "tools/generate_api_shims.py"
-      - "tools/install_openjpeg_2_5_4.sh"
-  pull_request:
-    paths:
-      - ".gitea/workflows/documentation.yml"
-      - "Cargo.lock"
-      - "Cargo.toml"
-      - "README.md"
-      - "api/**"
-      - "crates/**"
-      - "docs/**"
-      - "programs/**"
-      - "tools/ci-matrix/**"
-      - "tools/generate_api_shims.py"
-      - "tools/install_openjpeg_2_5_4.sh"
-  workflow_dispatch:
-
-jobs:
-  documentation:
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    env:
-      OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-${{ github.run_id }}
-      PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib/pkgconfig
-      LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib
-      FORCE_SKIA_BINARIES_DOWNLOAD: "1"
-      CARGO_BUILD_JOBS: 1
-      CARGO_INCREMENTAL: 0
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install native documentation prerequisites
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential clang cmake curl ninja-build \
-            pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev
-          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
-
-      - name: Install Rust 1.97 toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: 1.97.0
-          components: rustfmt
-
-      - name: Check formatting
-        run: cargo fmt --all -- --check
-
-      - name: Verify documentation coverage report
-        run: |
-          cargo run --locked -p metacrate-ci-matrix -- documentation-report
-          git diff --exit-code -- api/DOCUMENTATION-COVERAGE.md
-          cargo run --locked -p metacrate-ci-matrix -- documentation-audit --evidence /tmp/metacrate-documentation-audit.json
-          cmp /tmp/metacrate-documentation-audit.json ci/evidence/documentation-audit.json
-
-      - name: Build warning-free workspace documentation
-        env:
-          RUSTDOCFLAGS: "-D warnings"
-        run: cargo doc --workspace --no-deps --locked -j 1
-
-      - name: Compile guide snippets and examples
-        run: |
-          cargo test --locked -p libremetaverse --doc -j 1
-          cargo test --locked -p libremetaverse --examples -j 1
-          cargo run --locked -p libremetaverse --example offline_client
-          cargo run --locked -p libremetaverse --example cancellation
-
-      - name: Verify documented program quick starts
-        run: cargo test --locked -p libremetaverse-programs --tests -j 1
-
-      - name: Upload documentation evidence
-        uses: actions/upload-artifact@v3
-        with:
-          name: documentation-evidence
-          path: ci/evidence/documentation-audit.json
-          if-no-files-found: error

.gitea/workflows/imaging-meshing.yml

@@ -1,91 +0,0 @@
-name: Imaging and meshing gate
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/imaging-meshing.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/libremetaverse/Cargo.toml"
-      - "crates/libremetaverse/src/generated.rs"
-      - "crates/libremetaverse/src/skeleton.rs"
-      - "crates/libremetaverse/src/*_catalog.rs"
-      - "crates/libremetaverse-types/**"
-      - "crates/libremetaverse-imaging/**"
-      - "crates/libremetaverse-imaging-skia/**"
-      - "crates/libremetaverse-prim-mesher/**"
-      - "crates/libremetaverse-rendering-mesh-foundry/**"
-      - "tests/compat/Cargo.toml"
-      - "tests/compat/build.rs"
-      - "tests/compat/src/**"
-      - "tests/compat/tests/imaging_meshing_semantics.rs"
-      - "tests/upstream-tests.json"
-      - "tools/check_milestone_06.py"
-      - "tools/install_openjpeg_2_5_4.sh"
-  pull_request:
-    paths:
-      - ".gitea/workflows/imaging-meshing.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/libremetaverse/Cargo.toml"
-      - "crates/libremetaverse/src/generated.rs"
-      - "crates/libremetaverse/src/skeleton.rs"
-      - "crates/libremetaverse/src/*_catalog.rs"
-      - "crates/libremetaverse-types/**"
-      - "crates/libremetaverse-imaging/**"
-      - "crates/libremetaverse-imaging-skia/**"
-      - "crates/libremetaverse-prim-mesher/**"
-      - "crates/libremetaverse-rendering-mesh-foundry/**"
-      - "tests/compat/Cargo.toml"
-      - "tests/compat/build.rs"
-      - "tests/compat/src/**"
-      - "tests/compat/tests/imaging_meshing_semantics.rs"
-      - "tests/upstream-tests.json"
-      - "tools/check_milestone_06.py"
-      - "tools/install_openjpeg_2_5_4.sh"
-  workflow_dispatch:
-
-jobs:
-  native:
-    runs-on: ubuntu-latest
-    env:
-      RUSTDOCFLAGS: -D warnings
-      OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-${{ github.run_id }}
-      PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib/pkgconfig
-      LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy,rustfmt
-      - name: Install audited OpenJPEG 2.5.4
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential cmake pkg-config
-          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
-      - name: Audit milestone ownership and feature isolation
-        run: python tools/check_milestone_06.py
-      - name: Test native imaging and meshing crates
-        run: |
-          cargo test -p libremetaverse-imaging
-          cargo test -p libremetaverse-imaging-skia --no-default-features
-          cargo test -p libremetaverse-prim-mesher
-      - name: Test reviewed milestone parity cases
-        run: |
-          cargo test -p libremetaverse-compat-tests --test imaging_meshing_semantics reviewed_managedimagetests_
-          cargo test -p libremetaverse-compat-tests --test imaging_meshing_semantics reviewed_coordtests_
-          cargo test -p libremetaverse-compat-tests --test imaging_meshing_semantics reviewed_quattests_
-          cargo test -p libremetaverse-compat-tests --test imaging_meshing_semantics reviewed_primmeshtests_
-      - name: Compile performance baselines
-        run: |
-          cargo bench -p libremetaverse-imaging --bench image_pipeline --no-run -j 1
-          cargo bench -p libremetaverse-prim-mesher --bench meshing --no-run -j 1
-      - name: Lint and document milestone crates
-        run: |
-          cargo clippy -p libremetaverse-imaging -p libremetaverse-imaging-skia -p libremetaverse-prim-mesher --all-targets -- -D warnings
-          cargo doc -p libremetaverse-imaging -p libremetaverse-imaging-skia -p libremetaverse-prim-mesher --no-deps
-      - name: Verify formatting
-        run: cargo fmt --all -- --check

.gitea/workflows/jpeg2000.yml

@@ -1,46 +0,0 @@
-name: JPEG 2000 feature
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/jpeg2000.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/libremetaverse/Cargo.toml"
-      - "crates/libremetaverse-types/**"
-      - "crates/libremetaverse-imaging/**"
-      - "crates/libremetaverse-openjpeg/**"
-      - "tools/install_openjpeg_2_5_4.sh"
-  pull_request:
-    paths:
-      - ".gitea/workflows/jpeg2000.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/libremetaverse/Cargo.toml"
-      - "crates/libremetaverse-types/**"
-      - "crates/libremetaverse-imaging/**"
-      - "crates/libremetaverse-openjpeg/**"
-      - "tools/install_openjpeg_2_5_4.sh"
-  workflow_dispatch:
-
-jobs:
-  linux:
-    runs-on: ubuntu-latest
-    env:
-      # Ubuntu also ships an older libopenjp2.so.7. Ensure both pkg-config and
-      # the runtime loader select this run's isolated, audited 2.5.4 install.
-      OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-${{ github.run_id }}
-      PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib/pkgconfig
-      LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Install OpenJPEG 2.5.4
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential cmake pkg-config
-          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
-      - name: Build and test optional feature
-        run: |
-          cargo test -p libremetaverse-imaging --features jpeg2000
-          cargo check -p libremetaverse --features jpeg2000

.gitea/workflows/performance.yml

@@ -1,55 +0,0 @@
-name: performance evidence
-
-on:
-  push:
-    paths:
-      - "benchmarks/**"
-      - "tools/performance/**"
-      - "crates/libremetaverse/src/inventory.rs"
-      - "crates/libremetaverse/src/targa.rs"
-      - ".gitea/workflows/performance.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-  pull_request:
-    paths:
-      - "benchmarks/**"
-      - "tools/performance/**"
-      - "crates/libremetaverse/src/inventory.rs"
-      - "crates/libremetaverse/src/targa.rs"
-      - ".gitea/workflows/performance.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-
-jobs:
-  audit:
-    runs-on: ubuntu-latest
-    env:
-      CARGO_PROFILE_BENCHMARK_OPT_LEVEL: 0
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: 1.97.1
-          components: rustfmt, clippy
-      - uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: |
-            8.0.x
-            10.0.x
-      - name: Check out pinned C# reference
-        run: |
-          git clone --filter=blob:none https://github.com/cinderblocks/libremetaverse.git "$RUNNER_TEMP/libremetaverse"
-          git -C "$RUNNER_TEMP/libremetaverse" checkout 2aa70bb68513b39795da5d13c88f31b86e85a3ba
-      - name: Compile separate C# reference runner
-        run: >-
-          dotnet build benchmarks/csharp-reference/MetaCrate.ReferenceBenchmarks.csproj
-          -c Release -p:ReferenceRoot="$RUNNER_TEMP/libremetaverse"
-      - name: Verify harness
-        run: cargo test -p metacrate-performance --profile benchmark --locked -j1
-      - name: Audit committed evidence
-        run: >-
-          cargo run -p metacrate-performance --profile benchmark --locked -j1 --
-          audit --fixture-root benchmarks/fixtures
-          --rust benchmarks/results/rust-linux-x86_64.json
-          --reference benchmarks/results/csharp-linux-x86_64.json
-          --comparison benchmarks/results/comparison.json

.gitea/workflows/release-candidate.yml

@@ -1,103 +0,0 @@
-name: First release candidate
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/release-candidate.yml"
-      - "ci/release-candidate-policy.json"
-      - "ci/evidence/**"
-      - "docs/release-candidate.md"
-      - "CHANGELOG.md"
-      - "release/**"
-      - "api/**"
-      - "programs/**"
-      - "tests/**"
-      - "tools/**"
-      - "crates/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-  pull_request:
-    paths:
-      - ".gitea/workflows/release-candidate.yml"
-      - "ci/release-candidate-policy.json"
-      - "ci/evidence/**"
-      - "docs/release-candidate.md"
-      - "CHANGELOG.md"
-      - "release/**"
-      - "api/**"
-      - "programs/**"
-      - "tests/**"
-      - "tools/**"
-      - "crates/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-  workflow_dispatch:
-
-env:
-  CARGO_BUILD_JOBS: 1
-  CARGO_INCREMENTAL: 0
-  CARGO_PROFILE_DEV_DEBUG: 0
-  CARGO_PROFILE_TEST_DEBUG: 0
-  FORCE_SKIA_BINARIES_DOWNLOAD: 1
-  OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-release-candidate
-  PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-release-candidate/lib/pkgconfig
-  LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-release-candidate/lib
-  RUSTDOCFLAGS: -D warnings
-
-jobs:
-  non-fuzz-release-gate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: 1.97.1
-          components: rustfmt, clippy
-      - name: Install every Linux release prerequisite
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential clang cmake curl ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev libasound2-dev
-          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
-      - name: Record source identity without a shipped helper
-        run: echo "METACRATE_RUST_COMMIT=$(git rev-parse --verify HEAD)" >>"$GITHUB_ENV"
-      - name: Verify generated surfaces, mappings, parity, and milestone inventories
-        run: |
-          python3 tools/generate_rust_mapping.py --check
-          python3 tools/generate_api_shims.py --check
-          python3 tools/check_api_coverage.py
-          python3 tools/check_test_parity.py
-          python3 tools/generate_lsl_tables.py --check
-          python3 tools/check_milestone_09.py
-          python3 tools/check_milestone_10.py
-      - name: Format, compile, test, lint, and document the complete workspace
-        run: |
-          cargo fmt --all -- --check
-          cargo check --workspace --all-targets --all-features --locked -j 1
-          cargo test --workspace --all-features --locked -j 1
-          cargo clippy --workspace --all-targets --all-features --locked -j 1 -- -D warnings
-          cargo doc --workspace --all-features --no-deps --locked -j 1
-      - name: Compile downstream and SemVer consumers
-        run: |
-          cargo check --locked --manifest-path tests/api-compile/Cargo.toml
-          cargo run --locked --manifest-path tests/semver-port/Cargo.toml
-      - name: Exercise all offline program and fake-grid behavior
-        run: |
-          cargo test --locked -p libremetaverse-programs --tests -j 1
-          cargo run --locked -p libremetaverse-programs --bin live-grid-smoke -- --audit-only
-          cargo run --locked -p libremetaverse-programs --bin live-grid-smoke -- --fake --evidence artifacts/release-candidate/fake-grid-smoke.jsonl
-      - name: Revalidate all checked-in audits and checksums
-        run: |
-          cargo run --locked -p metacrate-ci-matrix -- audit
-          cargo run --locked -p metacrate-ci-matrix -- documentation-audit --evidence artifacts/release-candidate/documentation.json
-          cargo run --locked -p metacrate-ci-matrix -- dependency-audit --evidence artifacts/release-candidate/dependency.json
-          cargo run --locked -p metacrate-ci-matrix -- provenance-audit --evidence artifacts/release-candidate/provenance.json
-          sha256sum --check release/SHA256SUMS
-      - name: Enforce the aggregate non-fuzz release-candidate decision
-        run: cargo run --locked -p metacrate-ci-matrix -- release-candidate-audit --evidence artifacts/release-candidate/status.json
-      - name: Upload release-candidate evidence, including failures
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: metacrate-0.0.1-release-candidate
-          path: artifacts/release-candidate/
-          if-no-files-found: error

.gitea/workflows/release-matrix.yml

@@ -1,122 +0,0 @@
-name: Release platform and feature matrix
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/release-matrix.yml"
-      - "ci/release-matrix.json"
-      - "tools/ci-matrix/**"
-      - "tools/install_openjpeg_2_5_4.sh"
-      - "docs/release-ci-matrix.md"
-      - "README.md"
-      - "RUSTREWRITE.md"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/**"
-      - "programs/**"
-      - "tests/**"
-  pull_request:
-    paths:
-      - ".gitea/workflows/release-matrix.yml"
-      - "ci/release-matrix.json"
-      - "tools/ci-matrix/**"
-      - "tools/install_openjpeg_2_5_4.sh"
-      - "docs/release-ci-matrix.md"
-      - "README.md"
-      - "RUSTREWRITE.md"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/**"
-      - "programs/**"
-      - "tests/**"
-  workflow_dispatch:
-
-env:
-  CARGO_BUILD_JOBS: 1
-  CARGO_INCREMENTAL: 0
-  CARGO_PROFILE_DEV_DEBUG: 0
-  CARGO_PROFILE_TEST_DEBUG: 0
-  FORCE_SKIA_BINARIES_DOWNLOAD: 1
-  RUSTDOCFLAGS: -D warnings
-
-jobs:
-  audit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Validate matrix coverage and ubuntu-only policy
-        run: cargo run --locked -p metacrate-ci-matrix -- audit
-
-  matrix:
-    needs: audit
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - profile: linux-msrv-portable
-            toolchain: 1.96.0
-            target: x86_64-unknown-linux-gnu
-            native_dependencies: true
-          - profile: linux-stable-default
-            toolchain: stable
-            target: x86_64-unknown-linux-gnu
-            native_dependencies: true
-          - profile: linux-stable-minimal
-            toolchain: stable
-            target: x86_64-unknown-linux-gnu
-            native_dependencies: false
-          - profile: linux-stable-features
-            toolchain: stable
-            target: x86_64-unknown-linux-gnu
-            native_dependencies: true
-          - profile: linux-stable-release-surface
-            toolchain: stable
-            target: x86_64-unknown-linux-gnu
-            native_dependencies: true
-          - profile: windows-stable-portable
-            toolchain: stable
-            target: x86_64-pc-windows-gnu
-            native_dependencies: false
-          - profile: macos-stable-portable
-            toolchain: stable
-            target: x86_64-apple-darwin
-            native_dependencies: false
-    env:
-      OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-${{ github.run_id }}-${{ matrix.profile }}
-      PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}-${{ matrix.profile }}/lib/pkgconfig
-      LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}-${{ matrix.profile }}/lib
-    steps:
-      - uses: actions/checkout@v4
-      - name: Cache immutable Cargo downloads only
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-          key: release-downloads-${{ runner.os }}-${{ matrix.toolchain }}-${{ hashFiles('Cargo.lock') }}
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: ${{ matrix.toolchain }}
-          targets: ${{ matrix.target }}
-      - name: Install pinned native feature prerequisites
-        if: matrix.native_dependencies == true
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential clang cmake curl ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev libasound2-dev
-          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
-          pkg-config --modversion libopenjp2
-          pkg-config --modversion opus
-          pkg-config --modversion alsa
-      - name: Revalidate matrix with selected toolchain
-        run: cargo run --locked -p metacrate-ci-matrix -- audit
-      - name: Execute isolated release profile
-        run: cargo run --locked -p metacrate-ci-matrix -- run ${{ matrix.profile }} --evidence artifacts/ci-matrix/${{ matrix.profile }}.json
-      - name: Upload exact matrix evidence
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: release-matrix-${{ matrix.profile }}
-          path: artifacts/ci-matrix/${{ matrix.profile }}.json
-          if-no-files-found: error

.gitea/workflows/release.yml

@@ -0,0 +1,61 @@
+name: Non-routine release validation
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 3 * * 0"
+  push:
+    tags:
+      - "v*"
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    env:
+      CARGO_BUILD_JOBS: "2"
+      CARGO_INCREMENTAL: "0"
+      RUSTDOCFLAGS: "-D warnings"
+      OPENJPEG_PREFIX: ${{ runner.tool_cache }}/metacrate/native/openjpeg-2.5.4-${{ runner.arch }}
+      PKG_CONFIG_PATH: ${{ runner.tool_cache }}/metacrate/native/openjpeg-2.5.4-${{ runner.arch }}/lib/pkgconfig
+      LD_LIBRARY_PATH: ${{ runner.tool_cache }}/metacrate/native/openjpeg-2.5.4-${{ runner.arch }}/lib
+      METACRATE_RUST_COMMIT: ${{ github.sha }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            ${{ runner.tool_cache }}/metacrate/native
+            target/release-gate
+          key: release-rust-1.97.1-${{ runner.arch }}-${{ hashFiles('.gitea/workflows/release.yml', 'Cargo.lock', 'ci/ci-coverage.json', 'ci/release-matrix.json', 'ci/artifact-policy.json', 'tools/install_openjpeg_2_5_4.sh') }}
+      - name: Install the release prerequisite set once
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes build-essential clang cmake curl git mingw-w64 ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev libasound2-dev
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.97.1
+          components: clippy,rustfmt
+          targets: x86_64-pc-windows-gnu,x86_64-apple-darwin
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.96.0
+      - name: Validate the native release dependency
+        run: tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
+      - name: Run the Rust-owned non-routine release graph
+        run: cargo +1.97.1 run --locked -p metacrate-ci-matrix -- release-gate --evidence artifacts/release/release-gate.json
+      - name: Upload release evidence and packages
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: non-routine-release-evidence
+          path: |
+            artifacts/release/
+            target/release-gate/package/*.crate
+          if-no-files-found: error

.gitea/workflows/rust-workspace.yml

@@ -1,119 +0,0 @@
-name: Native Rust workspace compile
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/rust-workspace.yml"
-      - "tools/install_openjpeg_2_5_4.sh"
-      - "tools/check_milestone_09.py"
-      - "tools/test_milestone_09.py"
-      - "tools/check_milestone_10_issue_76.py"
-      - "tools/check_milestone_10_issue_77.py"
-      - "tools/check_milestone_10_issue_78.py"
-      - "tools/check_milestone_10_issue_79.py"
-      - "tools/check_milestone_10_issue_80.py"
-      - "tools/check_milestone_10_issue_81.py"
-      - "tools/check_milestone_10_issue_82.py"
-      - "tools/check_milestone_10_issue_83.py"
-      - "tools/check_milestone_10.py"
-      - "tools/test_milestone_10.py"
-      - "tools/generate_lsl_tables.py"
-      - "codegen/inputs/lsl_tools_grammar.json"
-      - "docs/extension-milestone-gate.md"
-      - "docs/live-grid-smoke.md"
-      - "programs/README.md"
-      - "api/SHIM-COVERAGE.md"
-      - "**/*.rs"
-      - "**/Cargo.toml"
-      - "Cargo.lock"
-  pull_request:
-    paths:
-      - ".gitea/workflows/rust-workspace.yml"
-      - "tools/install_openjpeg_2_5_4.sh"
-      - "tools/check_milestone_09.py"
-      - "tools/test_milestone_09.py"
-      - "tools/check_milestone_10_issue_76.py"
-      - "tools/check_milestone_10_issue_77.py"
-      - "tools/check_milestone_10_issue_78.py"
-      - "tools/check_milestone_10_issue_79.py"
-      - "tools/check_milestone_10_issue_80.py"
-      - "tools/check_milestone_10_issue_81.py"
-      - "tools/check_milestone_10_issue_82.py"
-      - "tools/check_milestone_10_issue_83.py"
-      - "tools/check_milestone_10.py"
-      - "tools/test_milestone_10.py"
-      - "tools/generate_lsl_tables.py"
-      - "codegen/inputs/lsl_tools_grammar.json"
-      - "docs/extension-milestone-gate.md"
-      - "docs/live-grid-smoke.md"
-      - "programs/README.md"
-      - "api/SHIM-COVERAGE.md"
-      - "**/*.rs"
-      - "**/Cargo.toml"
-      - "Cargo.lock"
-  workflow_dispatch:
-
-jobs:
-  compile:
-    runs-on: ubuntu-latest
-    env:
-      OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-${{ github.run_id }}
-      PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib/pkgconfig
-      LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib
-      CARGO_BUILD_JOBS: 1
-      CARGO_INCREMENTAL: 0
-      CARGO_PROFILE_DEV_DEBUG: 0
-      CARGO_PROFILE_TEST_DEBUG: 0
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt, clippy
-      - name: Install audited OpenJPEG 2.5.4
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential cmake pkg-config libopus-dev libasound2-dev
-          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
-      - name: Check formatting
-        run: cargo fmt --all -- --check
-      - name: Audit native implementation boundaries
-        run: |
-          python3 tools/check_milestone_09_issue_59.py
-          python3 tools/check_milestone_09_issue_60.py
-          python3 tools/check_milestone_09_issue_61.py
-          python3 tools/check_milestone_09_issue_62.py
-          python3 tools/check_milestone_09_issue_63.py
-          python3 tools/check_milestone_09_issue_64.py
-          python3 tools/check_milestone_09_issue_65.py
-          python3 tools/check_milestone_09_issue_66.py
-          python3 tools/check_milestone_09.py
-          python3 tools/check_milestone_10_issue_76.py
-          python3 tools/check_milestone_10_issue_77.py
-          python3 tools/check_milestone_10_issue_78.py
-          python3 tools/check_milestone_10_issue_79.py
-          python3 tools/check_milestone_10_issue_80.py
-          python3 tools/check_milestone_10_issue_81.py
-          python3 tools/check_milestone_10_issue_82.py
-          python3 tools/check_milestone_10_issue_83.py
-          python3 tools/generate_lsl_tables.py --check
-          python3 tools/check_milestone_10.py
-      - name: Test the complete native world milestone
-        run: python3 tools/test_milestone_09.py
-      - name: Test the complete native extension milestone
-        run: python3 tools/test_milestone_10.py
-      - name: Compile every workspace target with bounded memory
-        run: cargo check --workspace --all-targets --locked -j 1
-      - name: Audit and fake-smoke every native program target
-        run: |
-          cargo run -p libremetaverse-programs --bin live-grid-smoke --locked -- --audit-only
-          cargo test -p libremetaverse-programs --test live_grid_smoke_cli --locked -j 1
-      - name: Check optional cross-platform real audio backend
-        run: |
-          cargo check -p libremetaverse-voice-webrtc --all-targets --features real-audio --locked -j 1
-          cargo check -p libremetaverse-programs --bin webrtc-test --features real-audio --locked -j 1
-      - name: Lint every native extension target with bounded memory
-        run: cargo clippy -p libremetaverse-rendering-simple -p libremetaverse-rendering-mesh-foundry -p libremetaverse-rlv -p libremetaverse-lsl-tools --all-targets --locked -j 1 -- -D warnings
-      - name: Document every native extension crate
-        env:
-          RUSTDOCFLAGS: -D warnings
-        run: cargo doc -p libremetaverse-rendering-simple -p libremetaverse-rendering-mesh-foundry -p libremetaverse-rlv -p libremetaverse-lsl-tools --no-deps --locked -j 1

.gitea/workflows/skia.yml

@@ -1,38 +0,0 @@
-name: Skia feature
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/skia.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/libremetaverse-types/**"
-      - "crates/libremetaverse-imaging/**"
-      - "crates/libremetaverse-imaging-skia/**"
-  pull_request:
-    paths:
-      - ".gitea/workflows/skia.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/libremetaverse-types/**"
-      - "crates/libremetaverse-imaging/**"
-      - "crates/libremetaverse-imaging-skia/**"
-  workflow_dispatch:
-
-jobs:
-  linux:
-    runs-on: ubuntu-latest
-    env:
-      FORCE_SKIA_BINARIES_DOWNLOAD: "1"
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Install native link prerequisites
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential clang curl ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev
-      - name: Test default and Skia feature builds
-        run: |
-          cargo test -p libremetaverse-imaging-skia --no-default-features
-          cargo test -p libremetaverse-imaging-skia --features skia
-          cargo package -p libremetaverse-imaging-skia --list

.gitea/workflows/supply-chain.yml

@@ -1,49 +0,0 @@
-name: Dependency and supply-chain audit
-
-on:
-  push:
-  pull_request:
-  workflow_dispatch:
-
-env:
-  CARGO_BUILD_JOBS: 1
-  CARGO_INCREMENTAL: 0
-  CARGO_PROFILE_DEV_DEBUG: 0
-
-jobs:
-  audit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Cache immutable Cargo downloads and advisory database
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            ~/.cargo/advisory-dbs
-          key: supply-chain-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'deny.toml') }}
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Fetch every immutable locked package archive
-        run: cargo fetch --locked
-      - name: Install pinned audit tools
-        run: |
-          cargo install --locked cargo-deny --version 0.20.2
-          cargo install --locked cargo-machete --version 0.9.2
-      - name: Record and validate the reviewed graph
-        run: |
-          mkdir -p artifacts
-          cargo tree --locked --workspace --all-features --target all --duplicates > artifacts/dependency-duplicates.txt
-          cargo run --locked -p metacrate-ci-matrix -- dependency-audit --evidence artifacts/dependency-audit.json
-          cargo run --locked -p metacrate-ci-matrix -- provenance-audit --evidence artifacts/provenance-audit.json
-      - name: Reject advisories, licenses, duplicates, and sources outside policy
-        run: cargo deny check advisories licenses bans sources --hide-inclusion-graph
-      - name: Reject unused direct dependencies
-        run: cargo machete --with-metadata
-      - name: Upload dependency evidence
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: supply-chain-evidence
-          path: artifacts/
-          if-no-files-found: error