ci: verify Tessera remotely against the separated Aster engine

.dockerignore

@@ -0,0 +1,8 @@
+.git
+**/.git
+target
+**/target
+**/AGENTS.md
+**/work
+**/ci-output
+.env

.gitea/README.md

@@ -0,0 +1,22 @@
+# Tessera GUI automation
+
+[workflows](workflows/README.md) contains repository workflows.
+
+## CI checkout prerequisites
+
+All workflows use `runs-on: ces-control`; no shared Runner configuration is changed.
+Configure repository or organization secrets `CODEX_BOT_SSH_KEY` (the dedicated
+codex-bot private SSH key) and `GITEA_SSH_KNOWN_HOSTS` (the independently verified
+known_hosts entry for `[gitea.entroia.com]:22222`). The bot needs read access to the
+repository and its Aster submodule. Workflows use an isolated SSH command with
+`-F /dev/null`, `IdentitiesOnly=yes`, an explicit key and port, strict host-key
+checking, and temporary credential files removed after checkout. Keys are never
+written into tracked files. Missing secrets fail checkout explicitly.
+
+The SSH submodule URL's repository owner is separate from the authenticated bot.
+Local Git operations must use the same dedicated bot identity; configure the
+checkout's isolated command in `GIT_SSH_COMMAND` for submodule initialization.
+
+Workflow definitions do not prove CI passed. CI/deployment state is not queried
+automatically. Local runtime checks are not performed for Aster, Lyra or Hestia;
+Tessera permits local native builds/window runs, with automated tests in CI.

.gitea/workflows/README.md

@@ -0,0 +1,5 @@
+# Tessera GUI workflows
+
+[ci.yml](ci.yml) verifies this project on main pushes, pull requests and manual dispatch. It runs on ces-control, with a 60-minute timeout. Checkout and secret requirements are in [the parent README](../README.md).
+
+There is no production service deployment in this workflow.

.gitea/workflows/ci.yml

@@ -0,0 +1,49 @@
+name: Verify Tessera GUI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  verify:
+    runs-on: ces-control
+    timeout-minutes: 60
+    env:
+      DOCKER_BUILDKIT: "0"
+    steps:
+      - name: Checkout with codex-bot
+        env:
+          CODEX_BOT_SSH_KEY: ${{ secrets.CODEX_BOT_SSH_KEY }}
+          GITEA_SSH_KNOWN_HOSTS: ${{ secrets.GITEA_SSH_KNOWN_HOSTS }}
+          SOURCE_SHA: ${{ gitea.sha }}
+          SOURCE_REPOSITORY: ${{ gitea.repository }}
+        run: |
+          set -eu
+          test -n "$CODEX_BOT_SSH_KEY"
+          test -n "$GITEA_SSH_KNOWN_HOSTS"
+          case "$SOURCE_SHA" in *[!0-9a-f]*|'') exit 1;; esac
+          test "${#SOURCE_SHA}" -eq 40
+          umask 077
+          checkout_keys=$(mktemp -d)
+          trap 'rm -rf "$checkout_keys"' EXIT
+          printf '%s\n' "$CODEX_BOT_SSH_KEY" > "$checkout_keys/key"
+          printf '%s\n' "$GITEA_SSH_KNOWN_HOSTS" > "$checkout_keys/known_hosts"
+          unset CODEX_BOT_SSH_KEY GITEA_SSH_KNOWN_HOSTS
+          export GIT_SSH_COMMAND="ssh -F /dev/null -o IdentitiesOnly=yes -i $checkout_keys/key -p 22222 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$checkout_keys/known_hosts"
+          git init .
+          source_url="ssh://git@gitea.entroia.com:22222/$SOURCE_REPOSITORY.git"
+          if git remote get-url origin >/dev/null 2>&1; then
+            git remote set-url origin "$source_url"
+          else
+            git remote add origin "$source_url"
+          fi
+          git fetch --no-tags --depth=1 origin "$SOURCE_SHA"
+          git checkout --detach --force FETCH_HEAD
+          git submodule update --init --recursive
+      - name: Verify portable GUI code
+        run: |
+          image="endorphin-tessera-gui-ci:${{ gitea.sha }}"
+          docker build -f Dockerfile.ci -t "$image" .
+          docker run --rm --init "$image"

Dockerfile.ci

@@ -0,0 +1,10 @@
+FROM rust:1.91.1-bookworm
+WORKDIR /build
+RUN apt-get update && apt-get install -y --no-install-recommends pkg-config libx11-dev libxkbcommon-dev libwayland-dev libudev-dev libegl1-mesa-dev libgbm-dev \
+    && rm -rf /var/lib/apt/lists/* \
+    && rustup component add rustfmt clippy
+ENV CARGO_BUILD_JOBS=1 CARGO_PROFILE_DEV_DEBUG=0 CARGO_PROFILE_TEST_DEBUG=0
+COPY Cargo.toml Cargo.lock ./
+COPY src ./src
+COPY vendor ./vendor
+CMD ["sh", "-eu", "-c", "cargo fmt --check && cargo test --locked && cargo clippy --all-targets --locked -- -D warnings"]

README.md

@@ -32,7 +32,7 @@ Initialize the Aster submodule first, following the SSH identity instructions in
 git submodule update --init --recursive
 ```
 
-In the designated build or validation environment:
+For local native builds and window runs (automated tests run only in CI):
 
 ```bash
 cargo run --release
@@ -102,3 +102,7 @@ The first parser intentionally supports only enough syntax to test the architect
 - `gap`, `padding`, and `.title`
 
 There are no files, HTML, CSS, JavaScript, DOM, or resource-network concepts in the runtime.
+
+## Validation
+
+Local Cargo builds and native window runs are allowed; do not run local tests or Docker. Automated tests and Clippy run in [.gitea](.gitea/README.md) on ces-control using Dockerfile.ci. The Linux CI checks portable code and software-renderer tests, not macOS window presentation. Aster dependency unit tests remain in Aster CI. CI bot SSH secrets are documented in .gitea/README.md.

vendor/README.md

@@ -56,8 +56,7 @@ git -C vendor/aster fetch origin
 git -C vendor/aster checkout --detach <aster-commit>
 ```
 
-Review the Aster changes and reconcile Tessera's dependencies and lockfile in the
-designated validation environment as needed. Commit `vendor/aster` in Tessera
+Review the Aster changes and reconcile Tessera's dependencies and lockfile as needed; local native compilation is allowed, while automated tests run in CI. Commit `vendor/aster` in Tessera
 along with any integration changes; that records the new Aster commit. Aster
 updates do not automatically advance Tessera's recorded revision.