Native WebGPU on macOS and Windows with AOT application and media support

.gitattributes

@@ -6,3 +6,8 @@
 tests/WebPlatformSubset/upstream/** text eol=lf -whitespace
 third-party/v8-patches/*.txt text eol=lf
 packaging/WebScene.NativeEngine.Runtime/patches/*.txt text eol=lf
+eng/graphics/** text eol=lf
+tests/GraphicsCompatibility/*.mjs text eol=lf
+tests/GraphicsCompatibility/fixtures/*.json text eol=lf
+tests/GraphicsCompatibility/fixtures/Kestrel-LICENSE.txt -text
+tests/GraphicsCompatibility/fixtures/Kestrel-CAD.zip -text

.github/actions/graphics-sdk/action.yml

@@ -0,0 +1,77 @@
+name: Verified graphics SDK
+description: Restore or build an exact pinned SDK and verify its sealed inventory.
+inputs:
+  rid:
+    required: true
+    description: Target runtime identifier
+  component:
+    required: true
+    description: dawn or angle
+  clean:
+    default: 'false'
+    description: Ignore the exact cache for an explicit rebuild
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.11'
+    - id: sdk-identity
+      name: Resolve graphics SDK cache identity
+      shell: bash
+      env:
+        SDK_INPUTS: ${{ hashFiles('eng/graphics/dependencies.lock.json', 'eng/graphics/windows-runtime.json', 'eng/graphics/build.py', 'eng/graphics/DawnSymbolBoundary.cmake', 'eng/graphics/dawn_exports.py', 'eng/graphics/install-windows-sdk.ps1', '.github/actions/graphics-sdk/action.yml') }}
+      run: |
+        echo "key=webscene-graphics-sdk-v1-${{ inputs.component }}-${{ inputs.rid }}-${ImageVersion:?Runner image version is required}-$SDK_INPUTS" >> "$GITHUB_OUTPUT"
+    - id: sdk-cache
+      name: Restore pinned graphics SDK
+      if: inputs.clean != 'true'
+      uses: actions/cache/restore@v4
+      with:
+        path: artifacts/graphics-sdk/${{ inputs.rid }}/${{ inputs.component }}
+        key: ${{ steps.sdk-identity.outputs.key }}
+        # No prefix fallback: a different build recipe or toolchain must rebuild.
+    - name: Install pinned Windows SDK for graphics runtime packaging
+      if: inputs.rid == 'win-x64' && steps.sdk-cache.outputs.cache-hit != 'true'
+      shell: pwsh
+      run: ./eng/graphics/install-windows-sdk.ps1
+    - name: Initialize Windows x64 compiler environment
+      if: inputs.rid == 'win-x64'
+      shell: pwsh
+      run: |
+        $ErrorActionPreference = 'Stop'
+        $before = @{}
+        Get-ChildItem Env: | ForEach-Object { $before[$_.Name] = $_.Value }
+        $vswhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio/Installer/vswhere.exe'
+        if (!(Test-Path $vswhere)) { throw 'Visual Studio Installer/vswhere is required.' }
+        $installation = & $vswhere -latest -version '[17.1,)' -products '*' -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath
+        if ($LASTEXITCODE -ne 0 -or !$installation) { throw 'An x64 Visual C++ toolchain is required.' }
+        $developerShell = Join-Path $installation 'Common7/Tools/Launch-VsDevShell.ps1'
+        & $developerShell -Arch amd64 -HostArch amd64 -SkipAutomaticLocation
+        if (!(Get-Command cl.exe -ErrorAction SilentlyContinue)) { throw 'Visual C++ initialization did not expose cl.exe.' }
+        if ($env:VSCMD_ARG_TGT_ARCH -ne 'x64') { throw 'Expected an x64 compiler target.' }
+        Get-ChildItem Env: | Where-Object { !$before.ContainsKey($_.Name) -or $before[$_.Name] -ne $_.Value } | ForEach-Object {
+          if ($_.Value.Contains("`n") -or $_.Value.Contains("`r")) { throw "Unexpected multiline environment variable: $($_.Name)" }
+          "$($_.Name)=$($_.Value)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        }
+    - name: Install Linux development prerequisites
+      if: inputs.rid == 'linux-x64'
+      shell: bash
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y ninja-build clang lld pkg-config libvulkan-dev libx11-dev libx11-xcb-dev libxcb1-dev libxext-dev libxi-dev libxrandr-dev libxinerama-dev libxcursor-dev libxcomposite-dev libxdamage-dev libxfixes-dev libdrm-dev libgbm-dev libwayland-dev libudev-dev
+    - name: Build pinned SDK
+      if: steps.sdk-cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: python eng/graphics/build.py ${{ inputs.component }} --rid ${{ inputs.rid }} --jobs 2
+    - name: Verify installed SDK
+      shell: bash
+      run: python eng/graphics/verify-sdk.py artifacts/graphics-sdk/${{ inputs.rid }}/${{ inputs.component }} --component ${{ inputs.component }} --rid ${{ inputs.rid }}
+    # Save immediately after verification: a later probe failure must not throw
+    # away a successful expensive dependency build. Hits still run all probes.
+    - name: Save verified graphics SDK
+      if: steps.sdk-cache.outputs.cache-hit != 'true'
+      uses: actions/cache/save@v4
+      with:
+        path: artifacts/graphics-sdk/${{ inputs.rid }}/${{ inputs.component }}
+        key: ${{ steps.sdk-identity.outputs.key }}

.github/workflows/CI.yml

@@ -31,6 +31,12 @@ jobs:
         node-version: 22
     - name: Restore
       run: dotnet restore WebScene.sln
+    - name: Verify immutable GPU compatibility fixture
+      run: python tests/GraphicsCompatibility/prepare-kestrel.py
+    - name: Graphics evidence boundary checks
+      run: python -m unittest discover -s eng/graphics/tests -v
+    - name: Graphics reference workload and trace checks
+      run: node --test tests/GraphicsCompatibility/reference-tests.mjs
     - name: Build Release
       run: dotnet build WebScene.sln -c Release --no-restore
     - name: Portable Core contracts
@@ -74,6 +80,64 @@ jobs:
         -B artifacts/native-engine-portability
         -DCMAKE_BUILD_TYPE=Release
         -DWEBSCENE_NATIVE_ENGINE_ENABLE_V8=OFF
+        -DWEBSCENE_NATIVE_ENGINE_ENABLE_MEDIA=ON
         -DWEBSCENE_NATIVE_ENGINE_CERTIFICATION=OFF
     - name: Compile native C++ portability target
       run: cmake --build artifacts/native-engine-portability --config Release --parallel
+
+    - name: Native media decode contracts
+      run: ctest --test-dir artifacts/native-engine-portability -C Release -R "webscene_(media_decode|audio_graph)_tests" --output-on-failure
+
+  native-aot:
+    name: NativeAOT contracts ${{ matrix.rid }} Avalonia ${{ matrix.avalonia }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - os: macos-latest
+          rid: osx-arm64
+          executable: WebScene.GpuHost.Probe
+          avalonia: 11
+          avalonia12Sample: false
+        - os: windows-latest
+          rid: win-x64
+          executable: WebScene.GpuHost.Probe.exe
+          avalonia: 11
+          avalonia12Sample: false
+        - os: macos-latest
+          rid: osx-arm64
+          executable: WebScene.GpuHost.Probe
+          avalonia: 12
+          avalonia12Sample: true
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-dotnet@v5
+      with:
+        global-json-file: global.json
+    - name: Publish NativeAOT with reflection JSON disabled
+      shell: bash
+      run: |
+        set -o pipefail
+        dotnet publish experiments/WebScene.GpuHost.Probe -c Release -r '${{ matrix.rid }}' \
+          -p:PublishAot=true -p:JsonSerializerIsReflectionEnabledByDefault=false \
+          -p:WebSceneAvalonia12Sample=${{ matrix.avalonia12Sample }} \
+          -o artifacts/aot-contracts 2>&1 | tee artifacts-aot-publish.log
+        python scripts/verify-aot-warnings.py artifacts-aot-publish.log
+    - name: Publish Aureon NativeAOT sample
+      if: matrix.avalonia == 12
+      shell: bash
+      run: |
+        set -o pipefail
+        dotnet publish experiments/WebScene.AureonStudio -c Release -r '${{ matrix.rid }}' \
+          -p:PublishAot=true -p:WebSceneAvalonia12Sample=true \
+          -o artifacts/aureon-aot 2>&1 | tee artifacts-aureon-publish.log
+        python scripts/verify-aot-warnings.py artifacts-aureon-publish.log
+    - name: Exercise checkpoint and archive contracts in native executable
+      shell: bash
+      run: ./artifacts/aot-contracts/${{ matrix.executable }} --aot-serialization-probe
+    - uses: actions/upload-artifact@v4
+      if: always()
+      with:
+        name: aot-contracts-${{ matrix.rid }}-avalonia-${{ matrix.avalonia }}
+        path: artifacts*-publish.log

.github/workflows/graphics-prerequisites.yml

@@ -0,0 +1,120 @@
+name: GPU prerequisite hardware evidence
+
+on:
+  workflow_dispatch:
+    inputs:
+      rid:
+        description: Native GPU runner profile (runner must be enrolled with these labels)
+        required: true
+        type: choice
+        options: [win-x64, osx-arm64, linux-x64]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: gpu-prerequisites-${{ inputs.rid }}
+  cancel-in-progress: false
+
+jobs:
+  prerequisites:
+    # These labels are an enrollment contract, not evidence that runners already exist.
+    # No untrusted pull_request trigger on persistent hardware machines.
+    runs-on: [self-hosted, webscene-gpu, '${{ inputs.rid }}']
+    timeout-minutes: 180
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.11'
+    - uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+    - name: Initialize Windows x64 compiler environment
+      if: inputs.rid == 'win-x64'
+      shell: pwsh
+      run: |
+        $ErrorActionPreference = 'Stop'
+        $before = @{}
+        Get-ChildItem Env: | ForEach-Object { $before[$_.Name] = $_.Value }
+        $vswhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio/Installer/vswhere.exe'
+        if (!(Test-Path $vswhere)) { throw 'Visual Studio Installer/vswhere is required.' }
+        $installation = & $vswhere -latest -version '[17.1,)' -products '*' -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath
+        if ($LASTEXITCODE -ne 0 -or !$installation) { throw 'An x64 Visual C++ toolchain is required.' }
+        $developerShell = Join-Path $installation 'Common7/Tools/Launch-VsDevShell.ps1'
+        & $developerShell -Arch amd64 -HostArch amd64 -SkipAutomaticLocation
+        if (!(Get-Command cl.exe -ErrorAction SilentlyContinue)) { throw 'Visual C++ initialization did not expose cl.exe.' }
+        if ($env:VSCMD_ARG_TGT_ARCH -ne 'x64') { throw 'Expected an x64 compiler target.' }
+        Get-ChildItem Env: | Where-Object { !$before.ContainsKey($_.Name) -or $before[$_.Name] -ne $_.Value } | ForEach-Object {
+          if ($_.Value.Contains("`n") -or $_.Value.Contains("`r")) { throw "Unexpected multiline environment variable: $($_.Name)" }
+          "$($_.Name)=$($_.Value)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        }
+    - name: Verify Kestrel input and evidence boundaries
+      id: verified-inputs
+      run: |
+        python tests/GraphicsCompatibility/prepare-kestrel.py
+        python -m unittest discover -s eng/graphics/tests -v
+        node --test tests/GraphicsCompatibility/reference-tests.mjs
+    - name: Verify enrolled Windows SDK prerequisite
+      if: inputs.rid == 'win-x64'
+      shell: pwsh
+      run: |
+        # Persistent runners are provisioned by their administrator; do not install
+        # machine-wide SDKs implicitly during a hardware qualification run.
+        $sdkRoot = Join-Path ${env:ProgramFiles(x86)} 'Windows Kits/10'
+        $sdkVersion = '10.0.28000.0'
+        foreach ($relative in @(
+          "Include/$sdkVersion/um/Windows.h",
+          "Include/$sdkVersion/shared/sdkddkver.h",
+          "Include/$sdkVersion/ucrt/stdio.h",
+          "Lib/$sdkVersion/um/x86/kernel32.lib",
+          "Lib/$sdkVersion/um/x64/kernel32.lib",
+          "Lib/$sdkVersion/ucrt/x86/ucrt.lib",
+          "Lib/$sdkVersion/ucrt/x64/ucrt.lib",
+          "bin/$sdkVersion/x64/rc.exe"
+        )) {
+          if (!(Test-Path (Join-Path $sdkRoot $relative))) {
+            throw "Missing $relative. Provision this runner using eng/graphics/install-windows-sdk.ps1 before qualification."
+          }
+        }
+    - name: Build pinned Dawn
+      run: python eng/graphics/build.py dawn --rid ${{ inputs.rid }}
+    - name: Build pinned ANGLE
+      run: python eng/graphics/build.py angle --rid ${{ inputs.rid }}
+    - name: Verify SDK relocation and mismatch rejection
+      run: python eng/graphics/check-sdk-integrity.py --sdk artifacts/graphics-sdk/${{ inputs.rid }}/dawn --rid ${{ inputs.rid }} --output artifacts/graphics-evidence/sdk-integrity.json
+    - name: Configure and build hardware probes
+      run: |
+        cmake -S eng/graphics/probes -B artifacts/graphics-probes -G Ninja -DCMAKE_BUILD_TYPE=Release -DWEBSCENE_GRAPHICS_SDK_ROOT=${{ github.workspace }}/artifacts/graphics-sdk/${{ inputs.rid }}
+        cmake --build artifacts/graphics-probes --parallel 6
+    - name: Capture real hardware results
+      # Do not use CTest's successful process exit when all hardware tests were skipped.
+      # The evidence runner exits 77 on unavailable hardware, leaving this job non-successful.
+      run: python eng/graphics/run-probes.py --rid ${{ inputs.rid }} --sdk artifacts/graphics-sdk/${{ inputs.rid }} --probes artifacts/graphics-probes --output artifacts/graphics-evidence/native-probes.json
+    - name: Capture unchanged Kestrel hardware Chrome references
+      # Independent evidence remains useful after native build/probe failure.
+      # The earlier failure still fails the job; this does not waive a GPU gate.
+      if: ${{ !cancelled() && steps.verified-inputs.outcome == 'success' }}
+      # Requires an interactive desktop and installed Chrome (or CHROME_BIN).
+      # Unknown Chrome revisions retain traces but cannot qualify presentation timing.
+      run: node tests/GraphicsCompatibility/capture-chrome-reference.mjs --output artifacts/chrome-reference
+    - uses: actions/upload-artifact@v4
+      if: always()
+      with:
+        name: graphics-prerequisites-${{ inputs.rid }}
+        path: |
+          artifacts/graphics-evidence/
+          artifacts/graphics-sdk/**/webscene-graphics-package.json
+          artifacts/graphics-sdk/**/build-info/
+        if-no-files-found: warn
+    - uses: actions/upload-artifact@v4
+      if: always()
+      with:
+        name: graphics-chrome-reference-${{ inputs.rid }}
+        path: |
+          artifacts/chrome-reference/reference.json
+          artifacts/chrome-reference/*.png
+          artifacts/chrome-reference/*.json.gz
+        compression-level: 0
+        retention-days: 90
+        if-no-files-found: warn

.github/workflows/graphics-sdk-build.yml

@@ -0,0 +1,72 @@
+name: Graphics SDK build validation
+
+on:
+  pull_request:
+    paths:
+      - 'eng/graphics/**'
+      - '.github/actions/graphics-sdk/**'
+      - '.github/workflows/graphics-sdk-build.yml'
+  workflow_dispatch:
+    inputs:
+      clean:
+        description: Rebuild SDKs without restoring the cache
+        type: boolean
+        default: false
+  push:
+    branches: [main]
+    paths:
+      - 'eng/graphics/**'
+      - '.github/actions/graphics-sdk/**'
+      - '.github/workflows/graphics-sdk-build.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: graphics-sdk-build-${{ github.event.pull_request.number || github.ref }}
+  # Preserve evidence from long clean SDK builds; the latest pending commit
+  # runs after the active build completes.
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build ${{ matrix.component }} ${{ matrix.rid }} (no hardware qualification)
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix:
+        component: [dawn, angle]
+        include:
+          - rid: win-x64
+            os: windows-2022
+          - rid: linux-x64
+            os: ubuntu-22.04
+        rid: [win-x64, linux-x64]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 120
+    steps:
+    - uses: actions/checkout@v4
+    - uses: ./.github/actions/graphics-sdk
+      with:
+        rid: ${{ matrix.rid }}
+        component: ${{ matrix.component }}
+        clean: ${{ inputs.clean || false }}
+    - name: Compile and link diagnostic probe
+      run: |
+        cmake -S eng/graphics/probes -B artifacts/graphics-probes -G Ninja -DCMAKE_BUILD_TYPE=Release -DWEBSCENE_GRAPHICS_COMPONENTS=${{ matrix.component }} -DWEBSCENE_GRAPHICS_SDK_ROOT=${{ github.workspace }}/artifacts/graphics-sdk/${{ matrix.rid }}
+        cmake --build artifacts/graphics-probes --parallel 2
+    - name: Verify shared-handle ownership (no GPU required)
+      run: ctest --test-dir artifacts/graphics-probes -R "^webscene_nt_handle_tests$" --output-on-failure
+    # Hosted compilation proves no hardware, pixels, driver support, or conformance.
+    # GPU execution belongs to the dedicated graphics-prerequisites hardware workflow.
+    - uses: actions/upload-artifact@v4
+      if: always()
+      with:
+        name: graphics-build-only-${{ matrix.component }}-${{ matrix.rid }}
+        path: |
+          artifacts/graphics-sdk/${{ matrix.rid }}/${{ matrix.component }}/
+          artifacts/graphics-probes/CMakeCache.txt
+        retention-days: 14
+        if-no-files-found: warn
+        # ANGLE installs .clang-format files covered by the sealed SDK inventory.
+        include-hidden-files: true