Add resource-bounded local verification lanes

Run pinned Rust and browser toolchains in fast and full container lanes with explicit CPU and memory limits.

.dockerignore

@@ -0,0 +1,12 @@
+.git
+.local
+docs
+scratchpad
+states
+target
+web/.cache
+web/dist
+web/.vite
+**/node_modules
+web/playwright-report
+web/test-results

.gitignore

@@ -6,4 +6,16 @@ docs/journal
 
 # TLC working directories
 docs/protocol/states/
-states/
+states/
+
+# Rust
+/target/
+
+# Web
+/web/node_modules/
+/web/**/node_modules/
+/web/dist/
+/web/.cache/
+/web/.vite/
+/web/playwright-report/
+/web/test-results/

Dockerfile.test

@@ -0,0 +1,41 @@
+# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
+
+ARG RUST_IMAGE=docker.io/library/rust:1.97.0-bookworm@sha256:8fa55b2f3ddf97471ab6a767bfa3f37e6bad0986ba823e75fea57e2a2a5c3073
+ARG NODE_IMAGE=docker.io/library/node:24.18.0-bookworm@sha256:5711a0d445a1af54af9589066c646df387d1831a608226f4cd694fc59e745059
+ARG PLAYWRIGHT_IMAGE=mcr.microsoft.com/playwright:v1.61.1-noble@sha256:5b8f294aff9041b7191c34a4bab3ac270157a28774d4b0660e9743297b697e48
+
+FROM ${RUST_IMAGE} AS rust-tools
+ADD --checksum=sha256:0c593171ba53aaaf699f8fd5d8d6661abcb004cfe2ffd01e206c7992909a4d05 https://static.crates.io/crates/cargo-nextest/cargo-nextest-0.9.140.crate /tmp/cargo-nextest-0.9.140.crate
+RUN mkdir /tmp/cargo-nextest \
+    && tar --extract --gzip --file /tmp/cargo-nextest-0.9.140.crate --directory /tmp/cargo-nextest \
+    && rustup component add clippy rustfmt \
+    && cargo install --jobs 4 --locked --path /tmp/cargo-nextest/cargo-nextest-0.9.140 \
+    && rm --recursive --force /tmp/cargo-nextest /tmp/cargo-nextest-0.9.140.crate
+
+FROM rust-tools AS rust-check
+WORKDIR /workspace
+COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
+COPY .config .config
+COPY crates crates
+CMD ["sh", "-c", "cargo fmt --all --check && cargo clippy --workspace --all-targets --all-features -- -D warnings && cargo nextest run --workspace --all-features && cargo test --workspace --doc"]
+
+FROM ${NODE_IMAGE} AS node-runtime
+
+FROM ${PLAYWRIGHT_IMAGE} AS web-dependencies
+COPY --from=node-runtime /usr/local/ /usr/local/
+ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
+RUN corepack enable pnpm \
+    && corepack install --global [email protected]
+WORKDIR /workspace/web
+COPY web/package.json web/pnpm-lock.yaml web/pnpm-workspace.yaml ./
+COPY web/tools/svelte-check/package.json tools/svelte-check/package.json
+RUN pnpm install --frozen-lockfile
+
+FROM web-dependencies AS web-check
+COPY web/ ./
+
+FROM web-check AS web-fast
+CMD ["sh", "-c", "pnpm check && pnpm lint && pnpm build && pnpm test:unit && pnpm test:component && pnpm test:e2e"]
+
+FROM web-check AS web-full
+CMD ["sh", "-c", "pnpm check && pnpm lint && pnpm build && pnpm test:unit && pnpm test:component:full && pnpm test:e2e:full"]

Makefile

@@ -0,0 +1,48 @@
+.PHONY: check-fast check-full check-fast-host check-full-host rust-check web-install web-check web-test-fast web-test-full
+
+CONTAINER_ENGINE ?= docker
+CONTAINER_RUN_FLAGS ?= --memory=16g --memory-swap=24g --cpus=4
+PLAYWRIGHT_BROWSERS_PATH := $(CURDIR)/web/.cache/ms-playwright
+export PLAYWRIGHT_BROWSERS_PATH
+
+rust-check:
+	cargo fmt --all --check
+	cargo clippy --workspace --all-targets --all-features -- -D warnings
+	cargo nextest run --workspace --all-features
+	cargo test --workspace --doc
+
+web-install:
+	pnpm --dir web install --frozen-lockfile
+
+web-check: web-install
+	pnpm --dir web check
+	pnpm --dir web lint
+	pnpm --dir web build
+
+web-test-fast: web-install
+	pnpm --dir web exec playwright install chromium
+	pnpm --dir web test:unit
+	pnpm --dir web test:component
+	pnpm --dir web test:e2e
+
+web-test-full: web-install
+	pnpm --dir web exec playwright install chromium firefox webkit
+	pnpm --dir web test:unit
+	pnpm --dir web test:component:full
+	pnpm --dir web test:e2e:full
+
+check-fast:
+	$(CONTAINER_ENGINE) build --file Dockerfile.test --target rust-check --tag remora-rust-check:local .
+	$(CONTAINER_ENGINE) run --rm $(CONTAINER_RUN_FLAGS) remora-rust-check:local
+	$(CONTAINER_ENGINE) build --file Dockerfile.test --target web-fast --tag remora-web-check:local .
+	$(CONTAINER_ENGINE) run --rm $(CONTAINER_RUN_FLAGS) remora-web-check:local
+
+check-full:
+	$(CONTAINER_ENGINE) build --file Dockerfile.test --target rust-check --tag remora-rust-check:local .
+	$(CONTAINER_ENGINE) run --rm $(CONTAINER_RUN_FLAGS) remora-rust-check:local
+	$(CONTAINER_ENGINE) build --file Dockerfile.test --target web-full --tag remora-web-check:local .
+	$(CONTAINER_ENGINE) run --rm $(CONTAINER_RUN_FLAGS) remora-web-check:local
+
+check-fast-host: rust-check web-check web-test-fast
+
+check-full-host: rust-check web-check web-test-full