feat(acp): ship Codex and actor session benchmark

.github/workflows/bench.yml

@@ -31,7 +31,8 @@ jobs:
       - run: cargo build --release --target wasm32-wasip1 -p agentos-native-baseline
       - run: make -C registry/native commands
       - run: node packages/runtime-core/scripts/copy-wasm-commands.mjs --require
-      - run: pnpm --dir packages/runtime-core build
+      - run: pnpm --filter '@agentos-software/common...' --filter '@rivet-dev/agentos-runtime-core' --workspace-concurrency=4 -r run build
+      - run: pnpm --dir packages/core build
       - run: pnpm --dir packages/runtime-benchmarks bench:check
       - run: pnpm --dir packages/runtime-benchmarks bench:gate
         env:

.github/workflows/ci-nightly.yml

@@ -31,7 +31,13 @@ jobs:
       - run: pnpm test
         env:
           AGENTOS_E2E_NETWORK: '1'
+      - run: cargo build -p agentos-sidecar
+        env:
+          CARGO_TARGET_DIR: ${{ github.workspace }}/target
       - run: cargo test --workspace -- --test-threads=1
+        env:
+          CARGO_TARGET_DIR: ${{ github.workspace }}/target
+          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/debug/agentos-sidecar
       - run: cargo build --release -p agentos-native-sidecar
       - run: cargo build --release -p agentos-native-baseline
       - run: cargo build --release --target wasm32-wasip1 -p agentos-native-baseline

.github/workflows/ci.yml

@@ -42,6 +42,8 @@ jobs:
       - run: node scripts/check-agentos-client-protocol-compat.mjs
       - run: node --test scripts/verify-fixed-versions.test.mjs
       - run: node scripts/verify-fixed-versions.mjs
+      - run: node --test scripts/verify-thin-client-docs.test.mjs
+      - run: node scripts/verify-thin-client-docs.mjs
       - run: cargo fmt --check
       - run: pnpm check-types
       - run: pnpm lint
@@ -117,6 +119,17 @@ jobs:
       - name: Verify complete coreutils runtime package
         run: pnpm --filter @agentos-software/coreutils build:runtime
       - run: cargo clippy --workspace --all-targets -- -D warnings
+      - name: Build sidecar for actor persistence E2E
+        run: cargo build -p agentos-sidecar
+        env:
+          CARGO_TARGET_DIR: ${{ github.workspace }}/target
+      - name: Test actor cron cold boot
+        run: |
+          test -x "$AGENTOS_SIDECAR_BIN"
+          cargo test -p agentos-actor-plugin persistence_e2e -- --test-threads=1 --nocapture
+        env:
+          CARGO_TARGET_DIR: ${{ github.workspace }}/target
+          AGENTOS_SIDECAR_BIN: ${{ github.workspace }}/target/debug/agentos-sidecar
       - run: cargo test -p agentos-protocol -- --test-threads=1
       - run: cargo test -p agentos-sidecar -- --test-threads=1
       - run: cargo test -p agentos-client -- --test-threads=1

.gitignore

@@ -45,7 +45,7 @@ registry/native/c/vendor/
 registry/native/c/libs/
 registry/native/c/.cache/
 registry/native/c/sysroot/
-registry/software/coreutils/bin/
+registry/software/*/bin/
 registry/software/*/wasm/
 registry/software/*/agentos-package.meta.json
 registry/.last-publish-hash
@@ -59,6 +59,9 @@ scripts/ralph/.last-branch
 scripts/ralph/prd.json
 scripts/ralph/todo/prd.json
 scripts/ralph/progress.txt
+
+# Local benchmark outputs
+scripts/benchmarks/results/
 scripts/ralph/reviews/
 scripts/ralph/.codex-last-msg-*
 

CLAUDE.md

@@ -62,12 +62,16 @@ the guest — over inventing a softer fallback that hides the failure.
   they do not scan `node_modules` or parse adapter manifests for discovery.
 - TypeScript and Rust clients must stay behaviorally identical. Any public
   method or wire behavior change in one client must be mirrored in the other.
-- Clients are thin transport adapters, not runtime policy owners. They may
-  validate and serialize explicit caller input, forward requests, route host
-  callbacks/events, and retain host-only state that the sidecar cannot access.
-  VM defaults, base environment, filesystem/bootstrap policy, default software,
-  permission policy, agent/session orchestration, prompt assembly, and other
-  behavior shared across clients belong in the sidecar/runtime.
+- Clients must be as small and simple as possible: thin transport adapters, not
+  runtime policy owners. They may validate and serialize explicit caller input,
+  forward requests, route host callbacks/events, and retain only host-side state
+  that the sidecar cannot access. They must preserve omitted fields instead of
+  filling in defaults. VM defaults, base environment, filesystem/bootstrap
+  policy, default software, permission policy, agent/session orchestration,
+  prompt assembly, and other behavior shared across clients belong in the
+  sidecar/runtime. The sole exception is the TypeScript package manager's
+  default package list, which may be selected client-side and forwarded as
+  ordinary package inputs.
 - Behavioral parity must come from one sidecar-owned implementation, not copied
   TypeScript/Rust/actor constants or parallel state machines. Prefer omitted
   wire fields meaning "use the sidecar default"; clients should send overrides

README.md

@@ -15,7 +15,7 @@
 
 - **Runs inside your process**: No VMs to boot, no containers to pull. Agents start in milliseconds with minimal memory overhead.
 - **Embeds in your backend**: Agents call your functions directly via [bindings](https://agentos-sdk.dev/docs/bindings). No network hops, no complex auth between services.
-- **Granular security**: Deny-by-default permissions for filesystem, network, and process access. The same isolation technology trusted by browsers worldwide.
+- **Granular security**: Sidecar-enforced permissions for filesystem, network, process, environment, and bindings. Omitted permissions allow all VM capabilities; pass explicit denies or allowlists for untrusted workloads.
 - **Deploy anywhere**: Just an npm package. Works on your laptop, Rivet Cloud, Railway, Vercel, Kubernetes, or any container platform.
 - **Open source**: Apache 2.0 licensed. Self-host or use [Rivet Cloud](https://agentos-sdk.dev/docs/deployment) for managed infrastructure.
 
@@ -107,7 +107,7 @@ All benchmarks compare agentOS against the fastest/cheapest mainstream sandbox p
 ## Features
 
 ### Agents
-- **Multi-agent support**: Run built-in Pi, Claude Code, and OpenCode agents with a unified API, plus install registry command packages such as Codex as VM software
+- **Multi-agent support**: Run built-in Pi, Claude Code, Codex, and OpenCode agents with a unified API
 - **[Sessions via ACP](https://agentos-sdk.dev/docs/sessions)**: Create, manage, and resume agent sessions over the [Agent Communication Protocol](https://agentclientprotocol.com)
 - **Universal transcript format**: One transcript format across all agents for debugging, auditing, and comparison
 - **[Automatic persistence](https://agentos-sdk.dev/docs/persistence)**: Every conversation is saved and replayable without extra code
@@ -125,7 +125,7 @@ All benchmarks compare agentOS against the fastest/cheapest mainstream sandbox p
 - **[Authentication](https://agentos-sdk.dev/docs/authentication)**: Integrate with your existing auth model (API keys, OAuth, JWTs)
 
 ### Security
-- **[Deny-by-default permissions](https://agentos-sdk.dev/docs/permissions)**: Granular control over filesystem, network, process, and environment access
+- **[Sidecar-enforced permissions](https://agentos-sdk.dev/docs/permissions)**: Omitted scopes allow access; explicit policies restrict individual scopes and resources
 - **[Programmatic network control](https://agentos-sdk.dev/docs/networking)**: Allow, deny, or proxy any outbound connection
 - **[Resource limits](https://agentos-sdk.dev/docs/resource-limits)**: Set precise CPU and memory limits per agent
 - **[VM isolation](https://agentos-sdk.dev/docs/architecture)**: Each agent runs in its own VM with no shared state