Promote main → release

.env.example

@@ -336,6 +336,25 @@ OPENHUMAN_SKILLS_WORKING_MEMORY_ENABLED=true
 # [optional] Reserved cache directory for future managed CPython installs.
 # OPENHUMAN_RUNTIME_PYTHON_CACHE_DIR=
 
+# ---------------------------------------------------------------------------
+# Shared language-runtime pool (#5106)
+# ---------------------------------------------------------------------------
+# Reuse a small, bounded set of warm node/python worker processes across skill
+# runs and node_exec instead of forking one interpreter child per run. Full
+# tuning lives in config.toml `[runtime_pool]`; these are the operator knobs.
+# Node pooling is ON by default (each job runs in an isolated worker_thread).
+# Python pooling is OFF by default (jobs share one interpreter, so reuse can
+# leak globals across runs); opt in with `[runtime_pool.python] enabled = true`.
+# [optional] Master kill switch. Default: true. `false` reverts every caller to
+# the legacy per-call spawn (no behavioural change, just no reuse).
+# OPENHUMAN_RUNTIME_POOL_ENABLED=true
+# [optional] Max concurrently-resident node workers (default 2). Work beyond
+# this queues rather than forking a new interpreter.
+# OPENHUMAN_RUNTIME_POOL_NODE_MAX_WORKERS=2
+# [optional] Max concurrently-resident python workers (default 2). Only takes
+# effect when python pooling is explicitly enabled (see above).
+# OPENHUMAN_RUNTIME_POOL_PYTHON_MAX_WORKERS=2
+
 # ---------------------------------------------------------------------------
 # TokenJuice — content-aware tool-output compaction (the content router)
 # ---------------------------------------------------------------------------

.github/tauri-cef-expected-sha

@@ -1 +1 @@
-11ef51edbeadcca4517b18a037fff858a5dfae0f
+455b47debb9d1f5d0f1527266e48af1670ad4bc5

.github/workflows/build-desktop.yml

@@ -172,6 +172,8 @@ jobs:
           rustup target add aarch64-apple-darwin x86_64-apple-darwin
       - name: Install Tauri dependencies (ubuntu only)
         if: startsWith(matrix.settings.platform, 'ubuntu-')
+        env:
+          MATRIX_TARGET: ${{ matrix.settings.target }}
         run: |
           sudo apt-get update
           sudo apt-get install -y \
@@ -180,7 +182,12 @@ jobs:
             libevdev-dev libssl-dev libclang-dev desktop-file-utils \
             libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 \
             libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 \
-            libgbm1 libpango-1.0-0 libcairo2 libatspi2.0-0 libxshmfence1 libu2f-udev
+            libgbm1 libpango-1.0-0 libcairo2 libatspi2.0-0 libxshmfence1 libu2f-udev \
+            xvfb
+          if [ "$MATRIX_TARGET" = "x86_64-unknown-linux-gnu" ] \
+            && ! command -v apparmor_parser >/dev/null 2>&1; then
+            sudo apt-get install -y apparmor
+          fi
       # NOTE: The post-build dump lives further down (after `cargo tauri build`)
       # so the binary actually exists when ldd runs. Running it here pre-build
       # silently no-op'd and gave us no signal during the
@@ -528,19 +535,19 @@ jobs:
           done
 
       # Strip host graphics libraries (Mesa/libdrm/libva/libgbm) that lib4bin
-      # ldd-walks into the AppImage. Those drivers must come from the user's
-      # host system — even on a current Ubuntu runner the bundled Mesa can
-      # fail to initialize newer GPUs (RDNA3, Intel Arc, Lovelace) and
-      # crashes CEF on launch because the bundled libs shadow the host's
-      # working ones on LD_LIBRARY_PATH. CEF's own SwiftShader subdir is
-      # untouched. Re-signs the AppImage + updater tarball when signing
-      # is enabled.
-      - name: Strip host graphics libs from AppImage
+      # ldd-walks into the AppImage. Final-artifact validation runs before
+      # re-signing: amd64 also gets a bounded Xvfb launch from a foreign CWD,
+      # while arm64 receives static validation in this change. CEF's own
+      # SwiftShader subdir is untouched, and updater archives are rebuilt only
+      # after the validated image is final.
+      - name: Strip host graphics libs and validate final AppImage
         if: startsWith(matrix.settings.platform, 'ubuntu-')
         shell: bash
         env:
           MATRIX_TARGET: ${{ matrix.settings.target }}
           PROFILE: ${{ inputs.build_profile }}
+          APPIMAGE_RUNTIME_SMOKE: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' && '1' || '0' }}
+          APPIMAGE_RUNTIME_APPARMOR_USERNS: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' && '1' || '0' }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY || secrets.UPDATER_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD || secrets.UPDATER_PRIVATE_KEY_PASSWORD }}
         run: |

.github/workflows/ci-full.yml

@@ -287,13 +287,21 @@ jobs:
           mkdir -p "$OPENHUMAN_WORKSPACE"
           bash scripts/ci-cancel-aware.sh bash app/scripts/e2e-web-session.sh
 
+      - name: Pack Playwright E2E failure artifacts
+        if: failure()
+        run: |
+          mkdir -p .ci/artifacts
+          tar -czf .ci/artifacts/openhuman-playwright-failure-logs.tar.gz \
+            -C "$OPENHUMAN_WORKSPACE" .
+        env:
+          OPENHUMAN_WORKSPACE: ${{ runner.temp }}/openhuman-playwright-workspace
+
       - name: Upload Playwright E2E failure artifacts
         if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: e2e-playwright-failure-logs-${{ github.run_id }}
-          path: |
-            ${{ runner.temp }}/openhuman-playwright-workspace/**
+          path: .ci/artifacts/openhuman-playwright-failure-logs.tar.gz
           retention-days: 7
           if-no-files-found: ignore
 

.github/workflows/ci-lite.yml

@@ -430,7 +430,7 @@ jobs:
         run: |
           bash scripts/ci-cancel-aware.sh cargo test --manifest-path Cargo.toml \
             --no-default-features --features tokenjuice-treesitter --lib -- \
-            core::all:: core::cli:: core::jsonrpc:: core::legacy_aliases:: agent_registry::agents::loader::
+            core::all:: core::cli:: core::jsonrpc:: core::legacy_aliases:: core::runtime:: agent_registry::agents::loader::
 
       - name: Guard — new feature-gated test modules must be acknowledged
         # Self-maintaining coverage: the set of source files that #[cfg]-gate a test on
@@ -446,6 +446,7 @@ jobs:
           core/cli_tests.rs
           core/jsonrpc_tests.rs
           core/legacy_aliases.rs
+          core/runtime/services.rs
           openhuman/agent/harness/builtin_definitions.rs
           openhuman/agent/harness/definition_tests.rs
           openhuman/agent/harness/session/tests.rs
@@ -462,14 +463,62 @@ jobs:
           openhuman/x402/stub.rs
           EOF
           )
-          ACTUAL=$(grep -rlE '#\[cfg\((not\()?feature = "(voice|media|web3|meet|mcp|skills|flows)"' src --include='*.rs' \
+          ACTUAL=$(grep -rlE '#\[cfg\((not\()?feature = "(voice|media|web3|meet|mcp|skills|flows|channels)"' src --include='*.rs' \
             | xargs grep -lE '#\[test\]|#\[tokio::test\]|fn .*_test' 2>/dev/null | sed 's|^src/||' | sort -u)
           if ! diff <(echo "$EXPECTED" | sed 's/^ *//' | sort -u) <(echo "$ACTUAL"); then
             echo "::error::Gated-test file set changed. Update the EXPECTED allowlist in the rust-feature-gate-smoke lane, and extend the scoped 'cargo test' filter if the new module can carry an ungated-assert regression (see #5022)."
             exit 1
           fi
           echo "gate-contract test coverage allowlist is current"
 
+  # Report-only (#5046). Measures steady-state RSS of an embedded openhuman_core
+  # agent roster and uploads the raw samples + a human summary. Deliberately NOT
+  # in `pr-ci-gate.needs`, so it can never fail a PR — it exists to accrue a
+  # baseline and its runner variance before the 30 MiB gate is flipped to
+  # blocking in a follow-up (add this job to pr-ci-gate + a threshold step then).
+  rust-rss-bench:
+    name: Rust RSS Benchmark (report-only)
+    needs: [changes]
+    if: needs.changes.outputs['rust-core'] == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 40
+    container:
+      image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
+    env:
+      CARGO_INCREMENTAL: "0"
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+          submodules: recursive
+
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: |
+            . -> target
+          cache-on-failure: true
+          shared-key: pr-rust-rss-bench
+
+      # Fixture-contract signal: the gated bin's unit tests (build_roster,
+      # warm-up turn) never enter the default coverage lane, so run them here.
+      - name: Run rss-bench fixture tests
+        run: bash scripts/ci-cancel-aware.sh cargo test --features rss-bench --bin rss-bench
+
+      - name: Build stripped-release rss-bench
+        run: bash scripts/ci-cancel-aware.sh cargo build --release --features rss-bench --bin rss-bench
+
+      - name: Measure embedded RSS (5 fresh procs x {1,8} agents)
+        run: ./target/release/rss-bench --out bench-rss.json | tee -a "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload raw RSS samples
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: rss-bench-report
+          path: bench-rss.json
+
   rust-core-coverage:
     name: Rust Core Coverage (cargo-llvm-cov)
     needs: [changes, rust-quality]
@@ -806,7 +855,7 @@ jobs:
           key: tinycortex
 
       - name: Run TinyCortex engine and Composio sync tests
-        run: bash scripts/ci-cancel-aware.sh cargo test --manifest-path vendor/tinycortex/Cargo.toml --features git-diff,sync
+        run: bash scripts/ci-cancel-aware.sh cargo test --manifest-path vendor/tinycortex/Cargo.toml --features git-diff,sync,persona
 
   pr-ci-gate:
     name: PR CI Gate

.github/workflows/e2e-playwright.yml

@@ -26,7 +26,10 @@ jobs:
     runs-on: ubuntu-22.04
     container:
       image: ghcr.io/tinyhumansai/openhuman_ci:latest
-    timeout-minutes: 30
+    # The complete serial web suite currently takes about 45 minutes on the
+    # shared runner; keep the standalone diagnostic workflow aligned with the
+    # 90-minute budget used by CI Full.
+    timeout-minutes: 90
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -73,12 +76,20 @@ jobs:
           mkdir -p "$OPENHUMAN_WORKSPACE"
           bash scripts/ci-cancel-aware.sh bash app/scripts/e2e-web-session.sh
 
+      - name: Pack Playwright E2E failure artifacts
+        if: failure()
+        run: |
+          mkdir -p .ci/artifacts
+          tar -czf .ci/artifacts/openhuman-playwright-failure-logs.tar.gz \
+            -C "$OPENHUMAN_WORKSPACE" .
+        env:
+          OPENHUMAN_WORKSPACE: ${{ runner.temp }}/openhuman-playwright-workspace
+
       - name: Upload Playwright E2E failure artifacts
         if: failure()
         uses: actions/upload-artifact@v7
         with:
           name: e2e-playwright-failure-logs-${{ github.run_id }}
-          path: |
-            ${{ runner.temp }}/openhuman-playwright-workspace/**
+          path: .ci/artifacts/openhuman-playwright-failure-logs.tar.gz
           retention-days: 7
           if-no-files-found: ignore

.github/workflows/e2e-reusable.yml

@@ -291,7 +291,8 @@ jobs:
           - { name: provider-web, suites: "provider-web" }
           - { name: webhooks, suites: "webhooks" }
           - { name: connectors, suites: "connectors" }
-          - { name: commerce, suites: "payments,settings" }
+          - { name: payments, suites: "payments" }
+          - { name: settings, suites: "settings" }
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -727,6 +728,9 @@ jobs:
       - name: Build E2E app
         run: bash scripts/ci-cancel-aware.sh pnpm --filter openhuman-app test:e2e:build
 
+      - name: Clippy (macOS-gated Rust)
+        run: bash scripts/ci-cancel-aware.sh pnpm rust:clippy
+
       - name: Package build artifact
         run: |
           # Stage the same runner-visible layout Linux/Windows use. The .app is
@@ -765,7 +769,8 @@ jobs:
           - { name: provider-web, suites: "provider-web" }
           - { name: webhooks, suites: "webhooks" }
           - { name: connectors, suites: "connectors" }
-          - { name: commerce, suites: "payments,settings" }
+          - { name: payments, suites: "payments" }
+          - { name: settings, suites: "settings" }
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -976,7 +981,8 @@ jobs:
           - { name: provider-web, suites: "provider-web" }
           - { name: webhooks, suites: "webhooks" }
           - { name: connectors, suites: "connectors" }
-          - { name: commerce, suites: "payments,settings" }
+          - { name: payments, suites: "payments" }
+          - { name: settings, suites: "settings" }
     steps:
       - name: Checkout code
         uses: actions/checkout@v7

.gitignore

@@ -133,3 +133,5 @@ distribution.cer
 CHANGELOG.preview.md
 *.profraw
 *.diff
+
+.claude/worktrees/