test: reduce test execution time (#726)

#### Overview

Reduce normal hermetic test execution time by building dynamic-plugin fixtures once per test command and reusing them across Rust, Python, FFI, and Go tests. The updated suites keep all observed individual tests below five seconds while preserving package-build coverage outside normal test cases.

- [x] I confirm this contribution is my own work, or I have the right to submit it under this project's license.
- [x] I searched existing issues and open pull requests, and this does not duplicate existing work.

#### Details

- Add `just build-test-plugin-fixtures` and a stable, platform-specific fixture path contract under `target/test-plugin-fixtures`.
- Prepare fixtures automatically in the Rust, Python, and Go test recipes; focused raw tests now fail quickly with preparation instructions when fixtures are missing.
- Move the Python wheel/sdist/rebuild/import regression from pytest into `package-python-plugin`.
- Make every Redis integration test honor `NEMO_RELAY_RUN_REDIS_TESTS` before connecting.
- Reduce test-only real-time guards to five seconds, add pytest slow-duration reporting, and lower reusable Rust, Python, Node, and Go test-job limits from 120 to 30 minutes.
- Document the fixture workflow and five-second test design expectation in contributor guidance and affected maintainer skills.
- No public runtime, binding, ABI, or package API changes.

Validation:

- `just ci=true test-rust`: 3,850 passed in 33.1s; slowest test 3.687s.
- `just ci=true test-python`: 639 passed in 14.94s; slowest test 2.01s.
- `just test-python-plugin`: 124 passed in 2.36s; Python worker round trip passed in 1.03s.
- `just ci=true test-go`: passed; main package completed in 3.52s.
- `just test-node`: 353 passed; slowest individual test 1.115s.
- Focused native, worker, and FFI plugin suites completed in 0.95s, 1.53s, and 0.16s respectively; non-opted-in Redis tests skipped in effectively 0.00s.
- `just package-python-plugin`
- `cargo fmt --all`
- `cargo clippy --workspace --all-targets -- -D warnings`
- `uv run pre-commit run --all-files`
- `just docs`

`just ci=true test-node` could not run locally because the installed executable reports Node 26.5.0, outside the repository's supported Node 24 toolchain, and the pinned `c8`/`yargs` coverage wrapper fails before starting tests. The underlying Node suite passes as reported above.

#### Where should the reviewer start?

Start with the shared fixture preparation in `justfile`, then review the native and worker consumers in `crates/core/tests/integration/` and the package validation moved to `scripts/validate_python_plugin_package.py`.

#### Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

- Relates to: none



## Summary by CodeRabbit

- **Tests**
  - Dynamic plugin tests now use prebuilt fixtures, improving consistency and reducing test setup time.
  - Redis integration tests skip cleanly unless explicitly enabled.
  - Test and process timeouts were standardized at five seconds, helping failures surface sooner.
  - Added comprehensive validation for Python plugin packages, including wheels, source archives, rebuilding, installation, and generated bindings.

- **Documentation**
  - Updated testing guidance and validation commands for plugin fixtures and package checks.

- **Chores**
  - Reduced CI job limits from 120 minutes to 30 minutes.

Authors:
  - Will Killian (https://github.com/willkill07)

Approvers:
  - Eric Evans II (https://github.com/ericevans-nv)

URL: #726

Author: willkill07

.agents/skills/maintain-dynamic-plugins/SKILL.md

@@ -59,6 +59,7 @@ Use this skill for `plugin.kind = "rust_dynamic"`, `plugin.kind = "worker"`,
 ## Validation
 
 ```bash
+just build-test-plugin-fixtures
 cargo test -p nemo-relay-types
 cargo test -p nemo-relay-plugin
 cargo test -p nemo-relay-worker-proto
@@ -70,6 +71,11 @@ just test-python
 just docs
 ```
 
+The canonical `just test-rust`, `just test-python`, and `just test-go` recipes
+prepare plugin fixtures automatically. Run `just build-test-plugin-fixtures`
+before raw focused native or worker plugin tests; fixture compilation must not
+happen inside an individual test case.
+
 For broad runtime or public API changes, run the full `validate-change` matrix.
 
 ## References

.agents/skills/test-python-binding/SKILL.md

@@ -57,6 +57,10 @@ docs/examples.
 # Focused test loop
 uv run pytest -k "<pattern>"
 
+# Required first for focused dynamic-plugin host tests
+just build-test-plugin-fixtures
+uv run pytest python/tests/test_dynamic_plugin_host.py
+
 # Focused Python worker plugin SDK suite
 just test-python-plugin
 

.agents/skills/test-rust-core/SKILL.md

@@ -47,6 +47,7 @@ cargo test -p nemo-relay
 cargo test -p nemo-relay-adaptive
 
 # Dynamic plugin crates when touched
+just build-test-plugin-fixtures
 cargo test -p nemo-relay-types
 cargo test -p nemo-relay-plugin
 cargo test -p nemo-relay-worker-proto

.github/workflows/ci_go.yml

@@ -24,7 +24,7 @@ jobs:
   Test:
     name: Test (${{ matrix.platform }})
     runs-on: ${{ matrix.runner }}
-    timeout-minutes: 120
+    timeout-minutes: 30
     continue-on-error: ${{ startsWith(matrix.platform, 'windows') }}
     permissions:
       contents: read

.github/workflows/ci_node.yml

@@ -43,7 +43,7 @@ jobs:
   Test:
     name: Test (${{ matrix.platform }})
     runs-on: ${{ matrix.runner }}
-    timeout-minutes: 120
+    timeout-minutes: 30
     continue-on-error: ${{ startsWith(matrix.platform, 'windows') }}
     permissions:
       contents: read

.github/workflows/ci_python.yml

@@ -43,7 +43,7 @@ jobs:
   Test:
     name: Test (${{ matrix.platform }})
     runs-on: ${{ matrix.runner }}
-    timeout-minutes: 120
+    timeout-minutes: 30
     continue-on-error: ${{ startsWith(matrix.platform, 'windows') }}
     permissions:
       contents: read

.github/workflows/ci_rust.yml

@@ -30,7 +30,7 @@ jobs:
   Test:
     name: Test (${{ matrix.platform }})
     runs-on: ${{ matrix.runner }}
-    timeout-minutes: 120
+    timeout-minutes: 30
     continue-on-error: ${{ startsWith(matrix.platform, 'windows') }}
     permissions:
       contents: read

crates/adaptive/tests/integration/redis_tests.rs

@@ -55,12 +55,7 @@ fn enable_operational_logs() {
 /// Redis tests were not explicitly enabled or Redis is unavailable.
 async fn get_test_redis() -> Option<RedisBackend> {
     enable_operational_logs();
-    let redis_test_env =
-        std::env::var_os(REDIS_TEST_ENV).map(|value| value.to_string_lossy().into_owned());
-    if !env_value_is_truthy(redis_test_env.as_deref()) {
-        eprintln!(
-            "SKIP: set {REDIS_TEST_ENV} to a truthy value (for example, {REDIS_TEST_ENV}=1) to run Redis-backed tests"
-        );
+    if !redis_tests_enabled() {
         return None;
     }
 
@@ -75,8 +70,23 @@ async fn get_test_redis() -> Option<RedisBackend> {
     }
 }
 
+fn redis_tests_enabled() -> bool {
+    let redis_test_env =
+        std::env::var_os(REDIS_TEST_ENV).map(|value| value.to_string_lossy().into_owned());
+    if !env_value_is_truthy(redis_test_env.as_deref()) {
+        eprintln!(
+            "SKIP: set {REDIS_TEST_ENV} to a truthy value (for example, {REDIS_TEST_ENV}=1) to run Redis-backed tests"
+        );
+        return false;
+    }
+    true
+}
+
 async fn get_test_redis_with_prefix() -> Option<(RedisBackend, String)> {
     enable_operational_logs();
+    if !redis_tests_enabled() {
+        return None;
+    }
     let prefix = format!("test:{}:", Uuid::now_v7());
     match RedisBackend::new("redis://127.0.0.1/", prefix.clone()).await {
         Ok(backend) => Some((backend, prefix)),

crates/cli/tests/cli_tests.rs

@@ -25,7 +25,8 @@ fn gateway_bin() -> &'static str {
 
 const ACTIVE_GENERATION_TOKEN: &str = "active-generation";
 const BOOTSTRAP_PROTOCOL_VERSION: u64 = 3;
-const SIDECAR_PUBLICATION_TIMEOUT: Duration = Duration::from_secs(30);
+const CHILD_PROCESS_TIMEOUT_SECONDS: u64 = 5;
+const SIDECAR_PUBLICATION_TIMEOUT: Duration = Duration::from_secs(5);
 
 fn write_active_generation(temp: &std::path::Path) -> std::path::PathBuf {
     let generation = temp.join("plugin/.nemo-relay-generation");
@@ -1466,15 +1467,15 @@ fn find_runtime_files_matching(
 }
 
 fn wait_child(child: &mut Child) -> ExitStatus {
-    let deadline = Instant::now() + Duration::from_secs(10);
+    let deadline = Instant::now() + Duration::from_secs(CHILD_PROCESS_TIMEOUT_SECONDS);
     loop {
         if let Some(status) = child.try_wait().unwrap() {
             return status;
         }
         if Instant::now() >= deadline {
             let _ = child.kill();
             let _ = child.wait();
-            panic!("child process did not exit within 10 seconds");
+            panic!("child process did not exit within {CHILD_PROCESS_TIMEOUT_SECONDS} seconds");
         }
         thread::sleep(Duration::from_millis(20));
     }
@@ -1523,15 +1524,15 @@ fn wait_child_with_output(mut child: Child) -> Output {
 
     let stdout = read_pipe(child.stdout.take());
     let stderr = read_pipe(child.stderr.take());
-    let deadline = Instant::now() + Duration::from_secs(10);
+    let deadline = Instant::now() + Duration::from_secs(CHILD_PROCESS_TIMEOUT_SECONDS);
     let status = loop {
         if let Some(status) = child.try_wait().unwrap() {
             break status;
         }
         if Instant::now() >= deadline {
             let _ = child.kill();
             let _ = child.wait();
-            panic!("child process did not exit within 10 seconds");
+            panic!("child process did not exit within {CHILD_PROCESS_TIMEOUT_SECONDS} seconds");
         }
         thread::sleep(Duration::from_millis(20));
     };
@@ -1607,7 +1608,7 @@ fn run_persistent_hook_with_token(
 }
 
 fn wait_for_port_closed(address: SocketAddr) {
-    let deadline = Instant::now() + Duration::from_secs(10);
+    let deadline = Instant::now() + Duration::from_secs(5);
     loop {
         if TcpStream::connect_timeout(&address, Duration::from_millis(100)).is_err() {
             return;
@@ -4341,7 +4342,7 @@ fn assert_non_tty_signal_forwarding(
 
 #[cfg(unix)]
 fn wait_for_agent_pid_file(relay: &mut std::process::Child, pids: &Path, signal_name: &str) {
-    let deadline = Instant::now() + Duration::from_secs(10);
+    let deadline = Instant::now() + Duration::from_secs(5);
     while !pids.is_file() {
         if Instant::now() >= deadline {
             // SAFETY: Relay's PID is live and owned by this test; SIGTERM exercises its registered
@@ -4593,7 +4594,7 @@ fn collect_replacement_requests(
     stopped: &AtomicBool,
     requests: &Mutex<Vec<String>>,
 ) {
-    let deadline = Instant::now() + Duration::from_secs(12);
+    let deadline = Instant::now() + Duration::from_secs(5);
     while !stopped.load(Ordering::Relaxed) && Instant::now() < deadline {
         match listener.accept() {
             Ok((mut stream, _)) => {

crates/cli/tests/coverage/agents/plugin_install_tests.rs

@@ -1168,7 +1168,7 @@ fn cross_process_lock_holder() {
         return;
     }
     std::fs::write(ready, b"ready").unwrap();
-    let deadline = Instant::now() + Duration::from_secs(10);
+    let deadline = Instant::now() + Duration::from_secs(5);
     while !release.exists() {
         assert!(Instant::now() < deadline, "lock holder release timed out");
         thread::sleep(Duration::from_millis(10));