[NathanFlurry]

• Separate the VM kernel, driver, and executor contracts while keeping V8 as the default for JavaScript, Python, and WASM; Wasmtime and Binaryen remain opt-in.
• Rebase onto current main and preserve recent POSIX, process, networking, filesystem, memory-limit, and client fixes across the new crate boundaries.
• Fix socket backpressure, process exit/EOF races, typed transport failures, launch-file containment, and V8 cache/snapshot ownership, with regression tests and independent reviews.
• Required CI passes in 6m50s, including Rust, Core transport/runtime, and executor isolation; all four native builds pass and Pipboy completes in 10m18s; local validation also covers runtime/security suites and paired release benchmarks. See docs/design/executor-rebase-validation.md for evidence and limits.
• Measured retained-context memory is 23–25% lower and JavaScript/host-call medians are at parity or faster. Latest warm WASM measures 2.4% slower (p95 5.7% higher), and the WASM filesystem workload is 4.5% slower, so this draft does not claim zero performance regression.
• Full source packaging passes. Full footprint builds are explicit on PRs; their unchanged budget check currently includes historical published native binaries, so it does not establish the candidate release install size.

[railway-app]

🚅 Environment agentos-pr-2040 in rivet-frontend has no services deployed.

3 services not affected by this PR

• sentry-tunnel
• kitchen-sink
• mcp-hub

[github-actions]

📟 Pip-Boy · 35a675a

📦 Packages

Skipped: this PR doesn't change any published package.

🧹 Rust dependencies · cargo deny + cargo shear

check	new in this PR	fixed	existing on base
advisories	✅ 0	8	16
licenses	✅ 0	0	0
sources	✅ 0	0	0
bans	✅ 0	0	0
unused	🟡 54	13	3

new finding	via
unused dependency 'agentos-executor-contract'	crates/executor-conformance/Cargo.toml
unused dependency 'agentos-executor-node-v8'	crates/executor-conformance/Cargo.toml
unused dependency 'agentos-executor-python-v8-pyodide'	crates/executor-conformance/Cargo.toml
unused dependency 'agentos-executor-wasm-abi'	crates/executor-conformance/Cargo.toml
unused dependency 'agentos-executor-wasm-v8'	crates/executor-conformance/Cargo.toml
unused dependency 'ciborium'	crates/executor-conformance/Cargo.toml
unused dependency 'flume'	crates/executor-conformance/Cargo.toml
unused dependency 'getrandom'	crates/executor-conformance/Cargo.toml
unused dependency 'nix'	crates/executor-conformance/Cargo.toml
unused dependency 'serde_bytes'	crates/executor-conformance/Cargo.toml
unused dependency 'sha2'	crates/executor-conformance/Cargo.toml
unused dependency 'tokio'	crates/executor-conformance/Cargo.toml
unused dependency 'tracing'	crates/executor-conformance/Cargo.toml
unused optional dependency 'agentos-executor-wasm-wasmtime'	crates/executor-conformance/Cargo.toml
misplaced dependency 'base64'	crates/executor-conformance/Cargo.toml
unused dependency 'agentos-executor-contract'	crates/executor-node-v8/Cargo.toml
unused dependency 'signal-hook'	crates/executor-v8-runtime/Cargo.toml
unused dependency 'serde'	crates/rivetkit-ars-client/Cargo.toml
unused dependency 'agentos-sidecar-protocol'	crates/sidecar/Cargo.toml
unused dependency 'chrono'	crates/sidecar/Cargo.toml
… and 34 more

🦀 Binaries · publish Dockerfiles, --release

Base: main@c746292, the merge base.

artifact	npm @latest	base	this PR	Δ vs base
🟡 agentos-native-sidecar darwin-arm64	120.3 MB	120.3 MB	126.9 MB	+6.7 MB (+5.6%)
🟡 agentos-native-sidecar darwin-x64	129.7 MB	129.7 MB	133.8 MB	+4.1 MB (+3.1%)
🟡 agentos-native-sidecar linux-arm64-gnu	141.1 MB	141.1 MB	147.9 MB	+6.8 MB (+4.8%)
🟡 agentos-native-sidecar linux-x64-gnu	144.0 MB	144.0 MB	148.7 MB	+4.7 MB (+3.3%)

`agentos-native-sidecar linux-arm64-gnu` · crates that changed most (from symbol sizes, approximate)

crate	base	this PR	Δ
agentos_vm	0 B	4.4 MB	+4.4 MB (new)
agentos_native_sidecar	3.6 MB	0 B	−3.6 MB (−100.0%)
agentos_executor_v8_runtime	0 B	2.1 MB	+2.1 MB (new)
agentos_v8_runtime	1.9 MB	0 B	−1.9 MB (−100.0%)
vfs	1.0 MB	0 B	−1.0 MB (−100.0%)
agentos_vm_kernel	0 B	908.5 KB	+908.5 KB (new)
agentos_vfs_core	0 B	803.7 KB	+803.7 KB (new)
core	6.3 MB	7.0 MB	+769.9 KB (+12.0%)
agentos_driver_tokio	0 B	593.6 KB	+593.6 KB (new)
wasmparser	0 B	583.9 KB	+583.9 KB (new)

`agentos-native-sidecar linux-x64-gnu` · crates that changed most (from symbol sizes, approximate)

crate	base	this PR	Δ
agentos_vm	0 B	5.6 MB	+5.6 MB (new)
agentos_native_sidecar	4.5 MB	0 B	−4.5 MB (−100.0%)
agentos_executor_v8_runtime	0 B	2.2 MB	+2.2 MB (new)
agentos_v8_runtime	2.0 MB	0 B	−2.0 MB (−100.0%)
vfs	1.3 MB	0 B	−1.3 MB (−100.0%)
agentos_vm_kernel	0 B	1.1 MB	+1.1 MB (new)
agentos_vfs_core	0 B	1005.0 KB	+1005.0 KB (new)
agentos_driver_tokio	0 B	781.0 KB	+781.0 KB (new)
core	6.2 MB	6.9 MB	+743.8 KB (+11.7%)
agentos_kernel	648.4 KB	0 B	−648.4 KB (−100.0%)

⏱ Timing

job	wall time	slowest step
zizmor	11s	checkout · 4s
changes	27s	checkout · 23s
self-test	37s	setup-node · 10s
native · darwin-x64	3m41s	Build with the publish Dockerfile · 3m29s
native · linux-arm64-gnu	9m22s	Build with the publish Dockerfile · 9m04s
native · darwin-arm64	3m54s	Build with the publish Dockerfile · 3m39s
hygiene	46s	checkout · 21s
native · linux-x64-gnu	3m52s	Build with the publish Dockerfile · 3m38s
⏭ footprint	—	skipped
report	17s	Write the comment and run summary · 5s

🔭 Full CI trace for this commit

One OpenTelemetry trace of CI and Pip-Boy for 35a675a: every job and step, with the sizes above attached. Run after CI finishes.

pnpm install --frozen-lockfile --filter 'pipboy...'
pnpm --filter pipboy pipboy trace --sha 35a675af246fe535faa56fc604191ba6d5de2810

Add --otlp <url> to send it to any OTLP/HTTP collector.

Agent instruction: From a rivet-dev/agentos checkout, run the commands above, then read the trace file the last command prints. List the slowest jobs and steps and explain where CI time went.