feat: add threaded Wasmtime execution

Author: NathanFlurry

.github/workflows/ci-nightly.yml

@@ -6,6 +6,51 @@ on:
     - cron: "41 10 * * *"
 
 jobs:
+  xfstests:
+    name: "xfstests (${{ matrix.wasm_backend }}, ${{ matrix.storage_backend }})"
+    runs-on: [self-hosted, agentos-builder]
+    timeout-minutes: 360
+    strategy:
+      fail-fast: false
+      matrix:
+        wasm_backend: [v8, wasmtime]
+        storage_backend: [chunked_local, memory, chunked_s3]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-wasip1
+      - run: pnpm install --frozen-lockfile
+      - name: Run the pinned filesystem conformance corpus
+        run: make -C tests/xfstests run
+        env:
+          XFSTESTS_WASM_BACKENDS: ${{ matrix.wasm_backend }}
+          XFSTESTS_BACKENDS: ${{ matrix.storage_backend }}
+          XFSTESTS_CONCURRENCY: '2'
+      - name: Run the 1,000-file multi-process directory stress gate
+        if: matrix.storage_backend == 'chunked_local'
+        run: |
+          cargo test --release -p agentos-native-sidecar \
+            --test xfstests_correctness \
+            xfstests_wasi_dirstress_process_matrix -- \
+            --ignored --exact --nocapture --test-threads=1
+        env:
+          AGENTOS_TEST_WASM_BACKEND: ${{ matrix.wasm_backend }}
+          XFSTESTS_ROOT: ${{ github.workspace }}/tests/xfstests/.work/xfstests
+          AGENTOS_V8_BRIDGE_PREBUILT_DIR: ${{ github.workspace }}/tests/xfstests/.cache/v8-bridge
+          CARGO_TARGET_DIR: ${{ github.workspace }}/tests/xfstests/.cache/cargo-target
+          CARGO_BUILD_JOBS: '1'
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: xfstests-${{ matrix.wasm_backend }}-${{ matrix.storage_backend }}
+          path: tests/xfstests/report
+          if-no-files-found: warn
+
   nightly:
     name: Nightly runtime validation
     runs-on: [self-hosted, agentos-builder]
@@ -43,6 +88,7 @@ jobs:
       - run: make -C toolchain commands
       - run: make -C toolchain cmd/duckdb
       - run: make -C toolchain codex
+      - run: make -C toolchain/c pthread-conformance-wasm pthread-benchmark-wasm
       - run: node packages/runtime-core/scripts/copy-wasm-commands.mjs --require
       - name: Use stable Rust for repository validation
         run: echo "RUSTUP_TOOLCHAIN=stable" >> "$GITHUB_ENV"
@@ -83,6 +129,16 @@ jobs:
       - run: cargo build --release -p agentos-native-sidecar
       - run: cargo build --release -p agentos-native-baseline
       - run: cargo build --release --target wasm32-wasip1 -p agentos-native-baseline
+      - name: Long mixed V8-JavaScript and Wasmtime leak/plateau gate
+        run: pnpm --dir packages/runtime-benchmarks test:wasm-mixed-soak
+        env:
+          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/release/agentos-native-sidecar
+          AGENTOS_WASMTIME_WORKER_PATH: ${{ github.workspace }}/target/release/agentos-native-sidecar
+      - name: Wasmtime Threads startup, throughput, memory, concurrency, and termination
+        run: pnpm --dir packages/runtime-benchmarks bench:wasm-threads
+        env:
+          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/release/agentos-native-sidecar
+          AGENTOS_WASMTIME_WORKER_PATH: ${{ github.workspace }}/target/release/agentos-native-sidecar
       - run: pnpm --dir packages/runtime-benchmarks bench:matrix
         env:
           AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/release/agentos-native-sidecar

.github/workflows/ci.yml

@@ -121,14 +121,36 @@ jobs:
           workspaces: toolchain -> target
           key: wasm-commands-${{ hashFiles('toolchain/Cargo.lock') }}
       - run: pnpm install --frozen-lockfile --filter '@rivet-dev/agentos-runtime-core...'
-      - run: make -C toolchain pr-commands
-      - run: node packages/runtime-core/scripts/copy-wasm-commands.mjs --require-coreutils
+      - run: make -C toolchain commands
+      # DuckDB and Vim are intentionally outside the default command set because
+      # they are heavy builds, but the runtime/parity suites require their real
+      # command artifacts.
+      - name: Build required heavy integration commands
+        run: make -C toolchain cmd/duckdb cmd/vim
+      - name: Build mandatory threaded-WASM conformance fixtures
+        run: make -C toolchain/c pthread-conformance-wasm pthread-benchmark-wasm
+      - name: Stage native/WASM C parity fixtures
+        run: make -C toolchain/c conformance-artifacts
+      - run: node packages/runtime-core/scripts/copy-wasm-commands.mjs --require
       - uses: actions/upload-artifact@v4
         with:
           name: wasm-commands
           path: packages/runtime-core/commands
           retention-days: 1
           if-no-files-found: error
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wasm-thread-fixtures
+          path: |
+            toolchain/c/build/pthread_conformance.wasm
+            toolchain/c/build/pthread_benchmark.wasm
+            toolchain/c/build/exec_variants
+          if-no-files-found: error
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wasm-c-parity-fixtures
+          path: toolchain/c/build/conformance
+          if-no-files-found: error
 
   rust:
     name: Rust
@@ -331,3 +353,79 @@ jobs:
               exit 1
             fi
           done
+
+  wasm-backend-matrix:
+    name: "WASM backend (${{ matrix.backend }})"
+    if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'aggregate-ci')
+    needs: [wasm-commands]
+    runs-on: [self-hosted, agentos-builder]
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      matrix:
+        backend: [v8, wasmtime]
+    env:
+      AGENTOS_TEST_WASM_BACKEND: ${{ matrix.backend }}
+      AGENTOS_E2E_NETWORK: '1'
+      AGENT_OS_CLIENT_ALLOW_E2E_SKIPS: '0'
+      AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/release/agentos-native-sidecar
+      AGENTOS_WASMTIME_WORKER_PATH: ${{ github.workspace }}/target/release/agentos-native-sidecar
+      AGENTOS_WASM_COMMANDS_DIR: ${{ github.workspace }}/packages/runtime-core/commands
+      AGENTOS_C_WASM_COMMANDS_DIR: ${{ github.workspace }}/toolchain/c/build/conformance
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: wasm-backend-${{ matrix.backend }}
+      - run: pnpm install --frozen-lockfile
+      - uses: actions/download-artifact@v4
+        with:
+          name: wasm-commands
+          path: packages/runtime-core/commands
+      - uses: actions/download-artifact@v4
+        with:
+          name: wasm-thread-fixtures
+          path: toolchain/c/build
+      - uses: actions/download-artifact@v4
+        with:
+          name: wasm-c-parity-fixtures
+          path: toolchain/c/build/conformance
+      - name: Restore and package the validated command corpus
+        run: |
+          mkdir -p toolchain/target/wasm32-wasip1/release/commands
+          cp -a packages/runtime-core/commands/. toolchain/target/wasm32-wasip1/release/commands/
+          node packages/runtime-core/scripts/copy-wasm-commands.mjs --require
+          pnpm --filter @agentos-software/coreutils build:runtime
+          pnpm --filter '@agentos-software/common...' build
+      - name: Build the release sidecar and public test clients
+        run: |
+          cargo build --release -p agentos-native-sidecar
+          pnpm --filter '@rivet-dev/agentos-runtime-core...' build
+          pnpm --filter @rivet-dev/agentos-vm-test-harness build
+          pnpm --filter @rivet-dev/agentos-core build
+          pnpm --filter @rivet-dev/agentos build
+      - name: Run all native sidecar tests through the selected VM backend
+        run: cargo test --release -p agentos-native-sidecar --tests -- --test-threads=1
+      - name: Run owned pthread libc conformance
+        if: matrix.backend == 'wasmtime'
+        run: cargo test --release -p agentos-native-sidecar --test wasmtime_safety owned_pthread_libc_mutex_cond_tls_join_detach_and_cancel_conform -- --ignored --exact --nocapture --test-threads=1
+      - name: Run native-vs-WASM C conformance through the selected VM backend
+        run: pnpm --dir packages/core exec vitest run --root ../.. toolchain/conformance/c-parity.test.ts --reporter=verbose --maxWorkers=1 --minWorkers=1
+      - name: Run runtime-core WASM and cross-runtime integration serially
+        run: pnpm --dir packages/runtime-core exec vitest run --reporter=verbose --maxWorkers=1 --minWorkers=1
+      - name: Run the public TypeScript client suite serially
+        run: pnpm --dir packages/core exec vitest run --reporter=verbose --maxWorkers=1 --minWorkers=1
+      - name: Run the public Rust client without artifact skips
+        run: cargo test -p agentos-client -- --test-threads=1
+      - name: Run every registry software suite through the selected WASM backend
+        run: pnpm exec turbo test --concurrency=1 --filter='@agentos-software/*'
+      - name: Run deterministic actor, ACP, and agent-tool conformance
+        run: pnpm --filter @rivet-dev/agentos test:e2e:run
+      - name: Run mixed V8-JavaScript and Wasmtime resource-plateau smoke
+        if: matrix.backend == 'wasmtime'
+        run: pnpm --dir packages/runtime-benchmarks test:wasm-mixed-smoke

.github/workflows/publish.yaml

@@ -73,12 +73,25 @@ jobs:
           key: wasm-commands-${{ hashFiles('toolchain/Cargo.lock') }}
       - run: pnpm install --frozen-lockfile --filter '@rivet-dev/agentos-runtime-core...'
       - run: make -C toolchain commands
+      # These real upstream commands are intentionally outside the fast default
+      # toolchain target, but are part of the published and parity-tested corpus.
+      - name: Build required heavy release commands
+        run: make -C toolchain cmd/duckdb cmd/vim
+      - run: make -C toolchain/c pthread-conformance-wasm
+      - run: make -C toolchain/c build/exec_variants
       - run: node packages/runtime-core/scripts/copy-wasm-commands.mjs --require
       - uses: actions/upload-artifact@v4
         with:
           name: wasm-commands
           path: packages/runtime-core/commands
           if-no-files-found: error
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wasm-thread-fixtures
+          path: |
+            toolchain/c/build/pthread_conformance.wasm
+            toolchain/c/build/exec_variants
+          if-no-files-found: error
 
   codex-wasm:
     name: Codex WASI
@@ -272,10 +285,63 @@ jobs:
           path: target/sidecar-artifacts/${{ matrix.platform }}
           if-no-files-found: error
 
+  smoke-sidecar-artifacts:
+    needs: [wasm-commands, build-sidecar, build-sidecar-darwin]
+    name: "Packaged WASM backends (${{ matrix.platform }})"
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux-x64-gnu
+            runner: [self-hosted, agentos-builder]
+          - platform: linux-arm64-gnu
+            runner: [self-hosted, agentos-builder-arm64]
+          - platform: darwin-x64
+            runner: macos-15-intel
+          - platform: darwin-arm64
+            runner: macos-15
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
+      - run: pnpm install --frozen-lockfile --filter '@rivet-dev/agentos-runtime-core...'
+      - uses: actions/download-artifact@v4
+        with:
+          name: wasm-commands
+          path: packages/runtime-core/commands
+      - uses: actions/download-artifact@v4
+        with:
+          name: wasm-thread-fixtures
+          path: target/wasm-thread-fixtures
+      - uses: actions/download-artifact@v4
+        with:
+          name: sidecar-${{ matrix.platform }}
+          path: target/smoke-sidecar
+      - name: Stage the actual release binary in its npm platform package
+        run: |
+          set -euo pipefail
+          package_dir="packages/runtime-sidecar/npm/${{ matrix.platform }}"
+          cp target/smoke-sidecar/agentos-native-sidecar "$package_dir/agentos-native-sidecar"
+          chmod +x "$package_dir/agentos-native-sidecar"
+      - run: pnpm --filter @rivet-dev/agentos-runtime-core build
+      - name: Install tarballs and exercise every shipped WASM selector
+        run: |
+          node scripts/ci/smoke-packed-wasm-backends.mjs \
+            --platform-package "packages/runtime-sidecar/npm/${{ matrix.platform }}" \
+            --thread-fixture target/wasm-thread-fixtures/pthread_conformance.wasm
+
   publish-npm:
-    needs: [context, wasm-commands, codex-wasm, wasmtime-darwin-smoke, build-sidecar, build-sidecar-darwin]
+    needs: [context, wasm-commands, codex-wasm, wasmtime-darwin-smoke, build-sidecar, build-sidecar-darwin, smoke-sidecar-artifacts]
     name: Publish npm
-    if: ${{ !cancelled() && needs.wasm-commands.result == 'success' && needs.codex-wasm.result == 'success' && needs.wasmtime-darwin-smoke.result == 'success' && needs.build-sidecar.result == 'success' && needs.build-sidecar-darwin.result == 'success' }}
+    if: ${{ !cancelled() && needs.wasm-commands.result == 'success' && needs.codex-wasm.result == 'success' && needs.wasmtime-darwin-smoke.result == 'success' && needs.build-sidecar.result == 'success' && needs.build-sidecar-darwin.result == 'success' && needs.smoke-sidecar-artifacts.result == 'success' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -357,9 +423,9 @@ jobs:
             ${{ needs.context.outputs.trigger == 'release' && '--release-mode' || '' }}
 
   release-assets:
-    needs: [context, wasmtime-darwin-smoke, build-sidecar, build-sidecar-darwin]
+    needs: [context, wasmtime-darwin-smoke, build-sidecar, build-sidecar-darwin, smoke-sidecar-artifacts]
     name: Release assets
-    if: ${{ !cancelled() && needs.wasmtime-darwin-smoke.result == 'success' && needs.build-sidecar.result == 'success' && needs.build-sidecar-darwin.result == 'success' }}
+    if: ${{ !cancelled() && needs.wasmtime-darwin-smoke.result == 'success' && needs.build-sidecar.result == 'success' && needs.build-sidecar-darwin.result == 'success' && needs.smoke-sidecar-artifacts.result == 'success' }}
     runs-on: ubuntu-latest
     permissions:
       contents: write

.gitignore

@@ -43,11 +43,14 @@ secrets/**/*
 # Generated WASM toolchain and software artifacts. These are rebuilt for tests
 # and releases and must never be committed.
 packages/runtime-core/commands/
+packages/runtime-sidecar/npm/*/agentos-native-sidecar
+packages/sidecar-binary/npm/*/agentos-sidecar
 toolchain/vendor/
 toolchain/c/build/
 toolchain/c/vendor/
 toolchain/c/libs/
 toolchain/c/sysroot/
+toolchain/c/sysroot-threads/
 toolchain/c/.cache/
 toolchain/std-patches/wasi-libc-overrides/*.o
 software/*/bin/
@@ -86,6 +89,7 @@ scripts/ralph/.codex-last-msg-*
 
 # Local caches and stray outputs
 .agentos/
+.cache/
 crates/execution/assets/v8-bridge.js
 crates/execution/assets/v8-bridge-zlib.js
 crates/execution/.agentos-pyodide-cache/

Cargo.lock

@@ -86,7 +86,10 @@ vbare-compiler = { package = "rivet-vbare-compiler", version = "0.0.5" }
 wasmtime = { version = "=46.0.0", default-features = false, features = [
     "async",
     "cranelift",
+    "gc",
+    "gc-drc",
     "runtime",
     "std",
+    "threads",
 ] }
 wasmparser = "=0.251.0"