feat: add Wasmtime executor

.github/workflows/ci-nightly.yml

@@ -6,13 +6,138 @@ on:
     - cron: "41 10 * * *"
 
 jobs:
+  xfstests:
+    name: "xfstests (${{ matrix.wasm_backend }}, ${{ matrix.storage_backend }})"
+    runs-on: [self-hosted, agentos-builder]
+    timeout-minutes: 420
+    strategy:
+      fail-fast: false
+      matrix:
+        wasm_backend: [v8, wasmtime]
+        storage_backend: [chunked_local, memory, chunked_s3]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-wasip1
+      - name: Materialize the pinned docs theme
+        run: |
+          rm -rf /tmp/docs-theme
+          git clone https://github.com/rivet-dev/docs-theme.git /tmp/docs-theme
+          git -C /tmp/docs-theme checkout 450c498555135098c6a927adfdf13458be9be22a
+          rm -rf website/vendor/theme && mkdir -p website/vendor
+          cp -r /tmp/docs-theme/packages/theme website/vendor/theme
+      - run: pnpm install --frozen-lockfile
+      - name: Run the pinned filesystem conformance corpus
+        run: make -C tests/xfstests run
+        env:
+          XFSTESTS_WASM_BACKENDS: ${{ matrix.wasm_backend }}
+          XFSTESTS_BACKENDS: ${{ matrix.storage_backend }}
+          XFSTESTS_CONCURRENCY: '2'
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: xfstests-${{ matrix.wasm_backend }}-${{ matrix.storage_backend }}
+          path: tests/xfstests/report
+          if-no-files-found: warn
+
+  xfstests-endurance:
+    name: "xfstests endurance (${{ matrix.wasm_backend }})"
+    runs-on: [self-hosted, agentos-builder]
+    timeout-minutes: 480
+    strategy:
+      fail-fast: false
+      matrix:
+        wasm_backend: [v8, wasmtime]
+    env:
+      AGENTOS_TEST_WASM_BACKEND: ${{ matrix.wasm_backend }}
+      XFSTESTS_ROOT: ${{ github.workspace }}/tests/xfstests/.work/xfstests
+      XFSTESTS_TEST_TIMEOUT_SECONDS: '3600'
+      AGENTOS_V8_BRIDGE_PREBUILT_DIR: ${{ github.workspace }}/tests/xfstests/.cache/v8-bridge
+      CARGO_TARGET_DIR: ${{ github.workspace }}/tests/xfstests/.cache/cargo-target
+      CARGO_BUILD_JOBS: '1'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-wasip1
+      - name: Materialize the pinned docs theme
+        run: |
+          rm -rf /tmp/docs-theme
+          git clone https://github.com/rivet-dev/docs-theme.git /tmp/docs-theme
+          git -C /tmp/docs-theme checkout 450c498555135098c6a927adfdf13458be9be22a
+          rm -rf website/vendor/theme && mkdir -p website/vendor
+          cp -r /tmp/docs-theme/packages/theme website/vendor/theme
+      - run: pnpm install --frozen-lockfile
+      - name: Stage the pinned corpus and helper binaries
+        run: make -C tests/xfstests helpers
+      - name: Build the V8 bridge used by the shared harness
+        run: node packages/build-tools/scripts/build-v8-bridge.mjs --out-dir tests/xfstests/.cache/v8-bridge
+      - name: Run the 1,000-file multi-process directory stress gate
+        run: |
+          cargo test --release -p agentos-native-sidecar \
+            --test xfstests_correctness \
+            xfstests_wasi_dirstress_process_matrix -- \
+            --ignored --exact --nocapture --test-threads=1
+      - name: Run the full parallel ENOSPC race
+        run: |
+          cargo test --release -p agentos-native-sidecar \
+            --test xfstests_correctness \
+            xfstests_wasi_parallel_enospc_endurance_probe -- \
+            --ignored --exact --nocapture --test-threads=1
+      - name: Run the full insert-range reproduction workload
+        run: |
+          cargo test --release -p agentos-native-sidecar \
+            --test xfstests_correctness \
+            xfstests_wasi_insert_range_endurance_probe -- \
+            --ignored --exact --nocapture --test-threads=1
+      - name: Run the full 162,000-iteration looptest workload
+        run: |
+          cargo test --release -p agentos-native-sidecar \
+            --test xfstests_correctness \
+            xfstests_wasi_looptest_endurance_probe -- \
+            --ignored --exact --nocapture --test-threads=1
+      - name: Run the full 10,000-file rewinddir workload
+        run: |
+          cargo test --release -p agentos-native-sidecar \
+            --test xfstests_correctness \
+            xfstests_wasi_rewinddir_endurance_probe -- \
+            --ignored --exact --nocapture --test-threads=1
+      - name: Run the full 10,000-file open-unlink workload
+        run: |
+          cargo test --release -p agentos-native-sidecar \
+            --test xfstests_correctness \
+            xfstests_wasi_open_unlink_endurance_probe -- \
+            --ignored --exact --nocapture --test-threads=1
+      - name: Run the full 4,000-file seekdir/getdents workload
+        run: |
+          cargo test --release -p agentos-native-sidecar \
+            --test xfstests_correctness \
+            xfstests_wasi_seekdir_endurance_probe -- \
+            --ignored --exact --nocapture --test-threads=1
+      - name: Run the full 5,000-file readdir/rename workload
+        run: |
+          cargo test --release -p agentos-native-sidecar \
+            --test xfstests_correctness \
+            xfstests_wasi_readdir_rename_endurance_probe -- \
+            --ignored --exact --nocapture --test-threads=1
+
   nightly:
     name: Nightly runtime validation
     runs-on: [self-hosted, agentos-builder]
     env:
       # Cargo validation and the shared sidecar build are explicit below.
       # Do not let TypeScript dependency builds compile a second Rust copy.
       AGENTOS_SKIP_NATIVE_META_BUILD: '1'
+      XFSTESTS_ROOT: ${{ github.workspace }}/tests/xfstests/.work/xfstests
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
@@ -39,18 +164,39 @@ jobs:
             sudo apt-get update
             sudo apt-get install --yes cmake
           fi
+      - name: Materialize the pinned docs theme
+        run: |
+          rm -rf /tmp/docs-theme
+          git clone https://github.com/rivet-dev/docs-theme.git /tmp/docs-theme
+          git -C /tmp/docs-theme checkout 450c498555135098c6a927adfdf13458be9be22a
+          rm -rf website/vendor/theme && mkdir -p website/vendor
+          cp -r /tmp/docs-theme/packages/theme website/vendor/theme
       - run: pnpm install --frozen-lockfile
       - run: node --test scripts/generate-secure-exec-mirror.test.mjs
       - run: make -C toolchain commands
-      - run: make -C toolchain cmd/duckdb
+      - run: make -C toolchain cmd/duckdb cmd/vim
       - run: make -C toolchain codex
+      - run: make -C toolchain/c pthread-conformance-wasm pthread-benchmark-wasm
       - run: node packages/runtime-core/scripts/copy-wasm-commands.mjs --require
+      - name: Stage pinned xfstests and its WASM helper corpus
+        run: make -C tests/xfstests helpers XFSTESTS_BUILD_NATIVE_COMMANDS=0
       - name: Use stable Rust for repository validation
         run: echo "RUSTUP_TOOLCHAIN=stable" >> "$GITHUB_ENV"
       # Browser support is retained in-tree but disabled during the unified
       # native sidecar reactor migration, so it must not gate native CI.
       - run: cargo check --workspace --exclude agentos-sidecar-browser --exclude agentos-native-sidecar-browser
       - run: cargo clippy --workspace --exclude agentos-sidecar-browser --exclude agentos-native-sidecar-browser --all-targets -- -D warnings
+      - name: Build JavaScript workspace dependencies
+        run: |
+          pnpm exec turbo build \
+            --only \
+            --concurrency=4 \
+            --filter='!@rivet-dev/agentos-website' \
+            --filter='!@agentos-software/codex' \
+            --filter='!@rivet-dev/agentos-browser' \
+            --filter='!@rivet-dev/agentos-runtime-browser' \
+            --filter='!@rivet-dev/agentos-example-browser-terminal' \
+            --filter='!@rivet-dev/agentos-playground'
       - run: pnpm check-types
       - name: Build sidecars once for all TypeScript runtime suites
         run: cargo build -p agentos-sidecar -p agentos-native-sidecar
@@ -84,6 +230,16 @@ jobs:
       - run: cargo build --release -p agentos-native-sidecar
       - run: cargo build --release -p agentos-native-baseline
       - run: cargo build --release --target wasm32-wasip1 -p agentos-native-baseline
+      - name: Long mixed V8-JavaScript and Wasmtime leak/plateau gate
+        run: pnpm --dir packages/runtime-benchmarks test:wasm-mixed-soak
+        env:
+          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/release/agentos-native-sidecar
+          AGENTOS_WASMTIME_WORKER_PATH: ${{ github.workspace }}/target/release/agentos-native-sidecar
+      - name: Wasmtime Threads startup, throughput, memory, concurrency, and termination
+        run: pnpm --dir packages/runtime-benchmarks bench:wasm-threads
+        env:
+          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/release/agentos-native-sidecar
+          AGENTOS_WASMTIME_WORKER_PATH: ${{ github.workspace }}/target/release/agentos-native-sidecar
       - run: pnpm --dir packages/runtime-benchmarks bench:matrix
         env:
           AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/release/agentos-native-sidecar