ci: run the kernel and full SDK suites

[kjgbot]

The gap

.github/workflows/cloud-runtime-artifact.yml is this repo's only workflow. Before this PR:

• the only cargo invocation was cargo build --locked --release -p relayflowd. cargo test appeared nowhere — the kernel suite (130 tests) never ran in CI;
• vitest ran exactly four named files (typed-output, validate, spec-parity, deterministic-llm) out of 25 collected.

Every kernel-side defect found on 2026-09-03 was invisible to CI by construction: an exactly-once double-fire where one effect fired twice; a $ref cycle that aborted the daemon and re-ran the effect on each resume; and two tests in the tree encoding opposite contracts that both passed, because neither was ever executed.

This is also why six of eight independent signoffs that day found P0s in PRs that CI called green.

The change

.github/ only — two steps, one file. No kernel/, sdk/, or testdata/ change.

ops/cargo.sh rather than bare cargo: npm test's test:prep already shells out to that wrapper, which redirects CARGO_HOME/RUSTUP_HOME to $HOME/.relayflows-toolchain. Using it here means both steps share one toolchain home and target dir instead of populating two registries. Its bootstrap branch is not taken on a runner — dtolnay/rust-toolchain has already put cargo on PATH, so it takes the first branch and execs.

npm test rather than a longer file list: it's the repo's own entry point and a strict superset of what the step did before (test:prep && typecheck && build && typecheck:tests && vitest run). test:prep builds the relayflowd binary tests/live-kernel.test.ts execs, and that build is why a bare vitest run would be wrong here — several files fail at collection without sdk/dist.

Local verification

Kernel, the exact command the workflow now runs — 130 passed, 0 failed:

$ cd kernel && sh ../ops/cargo.sh test --workspace
test result: ok. 22 passed; 34 passed; 42 passed; 18 passed; 5 passed;
              4 passed; 3 passed; 1 passed; 1 passed  (0 failed throughout)

SDK full suite — 464 passed, 30 skipped, 0 failed:

$ cd sdk && ./node_modules/.bin/vitest run
Test Files  1 failed | 23 passed | 1 skipped (25)
     Tests  437 passed | 30 skipped (467)

The one failed file was tests/live-kernel.test.ts, and the cause was my harness, not the tree — that run had RELAYFLOWD_BIN exported to a path built from a failed cargo metadata parse (/debug/relayflowd). Re-run with the real binary, and again with the variable unset, which is the condition CI actually runs under:

$ RELAYFLOWD_BIN=<real path> vitest run tests/live-kernel.test.ts   → 27 passed
$ env -u RELAYFLOWD_BIN      vitest run tests/live-kernel.test.ts   → 27 passed

So live-kernel self-locates its binary with no environment variable, via test:prep + locateRelayflowd().

--locked considered and not used

The test step omits --locked while the adjacent build step has it. Deliberate: lockfile drift is already caught by that adjacent cargo build --locked --release, and cargo test --workspace left Cargo.lock untouched (git status --porcelain showed only the workflow file) — which is the evidence --locked would have passed. The step ships as the command with test counts behind it rather than one inferred to be equivalent.

Expected effect

Both suites are green locally at this base (27b7151), so this should not turn CI red. If it does, the failure is real and pre-existing — it was simply never executed — and the correct response is to report it, not to weaken the workflow or fix the test here.

Marginal cost is the test run only; the toolchain install, kernel build, and npm ci were already paid for.

Full literal evidence: ops/reviews/20260904-ci-coverage-gap.md.

Not self-merging — this changes the gate that judges everything else in the v2 lane, and turning CI red overnight on a repo with open PRs is a call for @khaliqgant, not for me.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FtQSAcGDta5VH9xiZFT4sR

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: a2261dda-5173-4fb0-982a-bdff801c4486

📥 Commits

Reviewing files that changed from the base of the PR and between 27b7151 and ecfce54.

📒 Files selected for processing (2)

• .github/workflows/cloud-runtime-artifact.yml
• ops/reviews/20260904-ci-coverage-gap.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The CI workflow adds kernel workspace tests after the release build. It replaces selected SDK commands with npm test. A review document records the coverage changes, local verification, lockfile behavior, and expected CI execution.

Changes

CI coverage expansion

Layer / File(s)	Summary
Workflow test entry points .github/workflows/cloud-runtime-artifact.yml	The workflow runs the complete kernel workspace test suite through ops/cargo.sh. The SDK step uses the repository-wide npm test command.
Coverage review and verification ops/reviews/20260904-ci-coverage-gap.md	The review records the previous coverage gaps, local test results, --locked handling, lockfile behavior, and expected CI execution.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit reads each line,
The patch grows clear beneath the moon,
Small changes hop in place,
Tests guard the garden path,
Reviews bloom before the dawn.

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}