feat: [US-400] - [Set up CI test pipeline, push, and iterate until CI is fully green]

Author: NathanFlurry

.github/workflows/ci.yml

@@ -40,6 +40,11 @@ jobs:
         with:
           shared-key: ci-rust
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
       - name: Run Rust workspace tests
         run: cargo test --workspace --exclude agent-os-sidecar --no-fail-fast
 
@@ -67,6 +72,11 @@ jobs:
         with:
           shared-key: ci-rust
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
       - name: Run sidecar tests serially
         run: cargo test --package agent-os-sidecar -- --test-threads=1
 

CLAUDE.md

@@ -260,6 +260,7 @@ Each agent type needs:
 
 - **CI lives in `.github/workflows/ci.yml` and runs on every push plus PRs targeting `main`.** Keep the workflow aligned with the repo's actual prerequisites instead of treating it as a generic Node-only pipeline.
 - **CI must pull Git LFS assets before tests.** `registry/software/*/wasm/` binaries are committed through Git LFS, so workflow jobs should run `git lfs pull` after checkout or the WASM command suites will skip or fail for the wrong reason.
+- **Rust CI jobs also need a modern Node runtime on `PATH`.** `agent-os-execution` and parts of `agent-os-sidecar` spawn the host `node` binary during Rust tests; on GitHub runners the default `/usr/local/bin/node` can be too old for `--permission`, so the Rust jobs must run `actions/setup-node` with the same `NODE_VERSION` as the TypeScript job before `cargo test`.
 - **CI must build `agent-os-sidecar` before TypeScript integration tests.** `packages/core` and registry integration suites talk to the native sidecar binary; if the workflow only runs `pnpm test`, it is not exercising the same path developers use locally.
 - **CI must prebuild `@rivet-dev/agent-os-registry-types` before generic workspace builds/tests on a clean checkout.** Several registry packages import that package's emitted type surface during `tsc`, and Turbo can schedule their `build`/`check-types` tasks before the registry-types package has produced `dist/`.
 - **CI should split `agent-os-sidecar` out of the generic Rust workspace job and run it serially.** The sidecar crate's host-runtime integration tests still flake when they share the workspace-parallel `cargo test --workspace` process, so CI should run `cargo test --workspace --exclude agent-os-sidecar --no-fail-fast` plus dedicated `cargo test -p agent-os-sidecar -- --test-threads=1` and `--ignored --test-threads=1` steps.

scripts/ralph/progress.txt

@@ -11,6 +11,7 @@
 - Sidecar-owned JavaScript, Python, and WASM engines should use per-VM import-cache roots; sharing one temp cache lets stale-runner cleanup delete another VM's assets.
 - `agent-os-sidecar` should run in its own serialized CI job instead of inside the workspace-wide `cargo test --workspace` process; the full sidecar integration matrix passes with `--test-threads=1` but still hangs or times out when competing with the rest of the Rust workspace under GitHub's job budget.
 - The root Turbo workspace test should stay at `--concurrency=2`; `packages/core` already serializes its own Vitest files, and pushing Turbo to `--concurrency=3` is enough to get `@rivet-dev/agent-os#test` SIGKILLed with exit `137` while the same workload passes at concurrency 2.
+- Rust CI jobs that exercise `agent-os-execution` or `agent-os-sidecar` must also run `actions/setup-node` before `cargo test`; the stock GitHub runner `/usr/local/bin/node` can be too old for the `--permission` flag that the execution hosts require.
 - Rust execution tests that spin up JavaScript, Python, or WASM engines should call `set_import_cache_base_dir(...)` with a unique temp root per test VM; the default `/tmp` cache root is not parallel-test-safe because each engine instance sweeps stale cache directories once.
 - Rust execution tests that override `AGENT_OS_NODE_BINARY` need a shared test-process lock around the full test body; otherwise parallel tests can redirect each other into the wrong fake node shim or a deleted temp fixture.
 - Timer-driven guest Node networking can outlive top-level module evaluation, so the sync-RPC bridge must stay alive until process exit rather than being disposed when the entry module resolves.
@@ -354,3 +355,15 @@ Started: Sat Apr  5 2026
   - The decisive reproduction was `CI=1 AGENTOS_E2E_NETWORK=1 npx turbo test --concurrency=2 --ui=stream --log-order=stream`, which completed successfully in `4m33.218s` after the same workspace failed twice with `pnpm test` at `--concurrency=3`.
   - Quality checks: `cargo test --workspace --exclude agent-os-sidecar --no-fail-fast` passed, `cargo test --package agent-os-sidecar -- --test-threads=1` passed, `cargo test --package agent-os-sidecar -- --ignored --test-threads=1` passed, `CI=1 AGENTOS_E2E_NETWORK=1 npx turbo test --concurrency=2 --ui=stream --log-order=stream` passed with `90 successful, 90 total`, and `CI=1 AGENTOS_E2E_NETWORK=1 pnpm test` passed after updating the root script to the same concurrency.
 ---
+## 2026-04-06 08:41:43 PDT - US-400
+- What was implemented
+- Pulled the failed Rust workspace job logs from GitHub run `24038361260`, identified the common failure as `/usr/local/bin/node: bad option: --permission` inside `agent-os-execution` benchmark/javascript/python/wasm tests, and updated both Rust CI jobs to install the same Node.js version as the TypeScript job before running `cargo test`.
+- Files changed
+- `.github/workflows/ci.yml`
+- `CLAUDE.md`
+- `scripts/ralph/progress.txt`
+- **Learnings for future iterations:**
+  - If Rust execution tests fail broadly at `start ... execution` with `WarmupFailed { exit_code: 9, stderr: "/usr/local/bin/node: bad option: --permission" }`, the problem is the host Node on the CI runner, not the Rust crates themselves.
+  - GitHub job-log API access (`gh api repos/.../actions/jobs/<job-id>/logs`) is useful while the overall workflow is still running; `gh run view --job ... --log` waits for the whole run to complete.
+  - Quality checks: local validation was unchanged from the prior commit, and `node --permission -e "console.log(process.version)"` confirmed the local Node runtime supports the required host flag while the workflow fix targets the GitHub runner environment.
+---