review(3/3): embedded runtime, desktop IPC and frontend composition

.github/workflows/quality-gates.yml

@@ -44,6 +44,17 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
+          if [[ ! "$EVENT_BASE" =~ ^[0-9a-fA-F]{40}$ ]]; then
+            echo "Traceability requires the event's full base commit SHA" >&2
+            exit 1
+          fi
+          if ! git cat-file -e "${EVENT_BASE}^{commit}" 2>/dev/null; then
+            if ! git fetch --no-tags origin "$EVENT_BASE" ||
+              ! git cat-file -e "${EVENT_BASE}^{commit}" 2>/dev/null; then
+              echo "Traceability event base is unavailable; cannot compute the no-new lint range" >&2
+              exit 1
+            fi
+          fi
           base="$(git rev-parse --verify --end-of-options "${EVENT_BASE}^{commit}")"
           head="$(git rev-parse --verify --end-of-options "${EVENT_HEAD}^{commit}")"
           if [[ "$EVENT_NAME" == pull_request ]]; then
@@ -121,6 +132,12 @@ jobs:
       - name: Block high severity production vulnerabilities
         run: npm audit --omit=dev --audit-level=high
 
+      - name: Verify installed dependency tree
+        run: npm ls --all
+
+      - name: Build frontend assets
+        run: npm run build
+
   rust-check:
     name: Rust workspace check
     runs-on: ubuntu-latest
@@ -156,6 +173,9 @@ jobs:
       - name: Check workspace with all features
         run: cargo check --workspace --all-features
 
+      - name: Verify Tauri injected-state IPC contracts
+        run: bash scripts/check-tauri-command-state-tests.sh
+
   rust-tests:
     name: Rust focused tests
     runs-on: ubuntu-latest
@@ -231,6 +251,9 @@ jobs:
           cargo test -p inference --features backend-pytorch --lib pytorch_named_text_request
           cargo test -p inference --features backend-pytorch --lib test_pytorch_generate_text_
 
+      - name: Run aggregate inference tests with Python worker fixtures
+        run: cargo test -p inference --features backend-pytorch --lib
+
       - name: Run llama server startup and reuse contract tests
         run: |
           for test_filter in server::tests backend::llamacpp::tests; do
@@ -245,12 +268,29 @@ jobs:
           python3 -c 'import pathlib, sys; names = [line for line in pathlib.Path(sys.argv[1]).read_text().splitlines() if line.startswith("core_executor::tests::inference_tests::") and "rejects_contract_only_with_lifecycle" in line and line.endswith(": test")]; print("Contract-only lifecycle tests discovered:", len(names)); sys.exit(0 if names else 1)' "$RUNNER_TEMP/node-validation-lifecycle-tests.list"
           cargo test -p node-engine --features inference-nodes --lib rejects_contract_only_with_lifecycle
 
+      - name: Run typed embedding capture regressions
+        run: |
+          set -euo pipefail
+          tests=(
+            core_executor::tests::inference_tests::test_canonical_llm_embedding_uses_typed_gateway_boundary
+            core_executor::tests::inference_tests::test_canonical_llm_embedding_with_package_facts_emits_compatibility_lifecycle
+          )
+          cargo test -p node-engine --features inference-nodes --lib test_canonical_llm_embedding -- --list > "$RUNNER_TEMP/node-embedding-tests.list"
+          for test_name in "${tests[@]}"; do
+            python3 -c 'import pathlib, sys; lines = pathlib.Path(sys.argv[1]).read_text().splitlines(); sys.exit(0 if sys.argv[2] + ": test" in lines else 1)' "$RUNNER_TEMP/node-embedding-tests.list" "$test_name"
+            result_path="$RUNNER_TEMP/node-embedding-${test_name##*::}.log"
+            cargo test -p node-engine --features inference-nodes --lib "$test_name" -- --exact 2>&1 | tee "$result_path"
+            python3 -c 'import pathlib, re, sys; text = pathlib.Path(sys.argv[1]).read_text(); sys.exit(0 if re.search(r"^test result: ok\. 1 passed; 0 failed; 0 ignored;", text, re.M) else 1)' "$result_path"
+          done
+
       - name: Run node-engine tests
         run: cargo test -p node-engine --lib
 
       - name: Run workflow-nodes tests
         run: cargo test -p workflow-nodes --lib
 
+      - name: Run embedded runtime unit tests
+        run: cargo test -p pantograph-embedded-runtime --lib
       - name: Run runtime registry contract tests
         run: cargo test -p pantograph-runtime-registry
       - name: Run task summary contract tests
@@ -294,6 +334,8 @@ jobs:
           cargo test -p pantograph-workflow-service --lib scheduler::task_orchestrator::tests::
       - name: Run workflow-service contract tests
         run: cargo test -p pantograph-workflow-service --test contract
+      - name: Run artifact-store integration contracts
+        run: cargo test -p pantograph-workflow-service --test artifact_store
 
   rust-doc-tests:
     name: Rust doc tests
@@ -439,7 +481,7 @@ jobs:
       - name: Run warning-deny clippy audit
         id: run-clippy-audit
         continue-on-error: true
-        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+        run: cargo clippy --workspace --all-targets --all-features --keep-going -- -D warnings
 
       - name: Record clippy audit result
         id: report-clippy-audit

bindings/csharp/README.md

@@ -30,6 +30,16 @@ with any redistributed generator source/binary; this repository does not vendor
 or package the generator itself. Existing generated-binding/artifact licensing
 obligations remain unchanged.
 
+## Shutdown result
+
+Await `runtime.Shutdown()` and handle the generated `FfiException` if the
+owned backend cannot stop. Its message contains the standard JSON error envelope
+with `internal_error` and the original shutdown cause. A failed stop does not
+mean the runtime released its residency; callers may retry after resolving the
+cause. Existing C# await expressions remain valid, but regenerate bindings and
+ship them with the matching native library when adopting this fallible API.
+Rust callers now handle `Result<(), FfiError>` explicitly.
+
 ## Usage
 Run the repository-level smoke script:
 

crates/inference/src/backend/pytorch.rs

@@ -3103,6 +3103,12 @@ fn extract_system_prompt(request: &serde_json::Value) -> Option<String> {
         })
 }
 
+// Python fixtures replace process-global modules and production worker functions.
+// The GIL may be released during imports and worker execution, so hold this lock
+// for each complete fixture lifetime, including asynchronous lifecycle tests.
+#[cfg(test)]
+static PYTHON_TEST_LOCK: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
+
 #[cfg(test)]
 #[path = "pytorch_worker_image_contract_tests.rs"]
 mod pytorch_worker_image_contract_tests;