test(ci): run full test suite on WSL2 (Ubuntu 24.04)

.github/workflows/ci.yml

@@ -71,12 +71,11 @@ jobs:
     # (needs systemd=true in wsl.conf), and even with it, `Linger=no` makes
     # systemd tear down /run/user/<uid> — including the session-bus socket —
     # when the login session ends, while DBUS_SESSION_BUS_ADDRESS still points
-    # at the now-dead socket. Real WSL2 isn't worth running on CI (hosted
-    # windows runners only give WSL1; WSL2 needs nested virtualization), but
-    # the failure mode reproduces deterministically here: point the bus address
-    # at a socket that doesn't exist and confirm omac's keychain/Secret Service
-    # reads degrade gracefully (keychain.IsUnavailable) instead of surfacing
-    # raw dial errors.
+    # at the now-dead socket. This job reproduces that failure mode
+    # deterministically on a plain Ubuntu runner: point the bus address at a
+    # socket that doesn't exist and confirm omac's keychain/Secret Service reads
+    # degrade gracefully (keychain.IsUnavailable) instead of surfacing raw dial
+    # errors. For a full WSL2 run see the wsl2 job below.
     name: WSL2-style session (dead bus)
     runs-on: ubuntu-latest
     steps:
@@ -114,6 +113,56 @@ jobs:
           XDG_RUNTIME_DIR: ${{ runner.temp }}/nonexistent-run-user
         run: go test -race -count=1 -timeout=5m ./...
 
+  wsl2:
+    # Full test suite on real WSL2: catches WSL-specific osinfo detection,
+    # sandbox-under-Microsoft-kernel, and keychain degraded-session paths.
+    # Ubuntu 24.04 needs no AppArmor userns fix (WSL2's kernel doesn't
+    # enforce it). continue-on-error during rollout, remove after
+    # consistently successful
+    name: Test (WSL2 - Ubuntu 24.04)
+    runs-on: windows-latest
+    continue-on-error: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Strip CRLF from shell and TypeScript files
+        # actions/checkout defaults to core.autocrlf=true on Windows, which
+        # converts LF->CRLF. CRLF breaks bash scripts inside WSL (e.g.
+        # `set -euo pipefail\r` → exit 2) and can cause issues with TypeScript
+        # tooling. Strip \r from .sh and .ts files so WSL sees clean LF.
+        shell: bash
+        run: find . \( -name '*.sh' -o -name '*.ts' \) -not -path './.git/*' -exec sed -i 's/\r$//' {} +
+
+      - name: Set up WSL2 (Ubuntu 24.04)
+        uses: Vampire/setup-wsl@v7
+        with:
+          distribution: Ubuntu-24.04
+          additional-packages: bubblewrap gcc libc6-dev
+          # update: 'true'  # makes it very slow
+
+      - name: Set up Go in WSL2
+        shell: wsl-bash {0}
+        run: |
+          GO_VERSION=$(grep '^go ' go.mod | tr -d '\r' | awk '{print $2}')
+          curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" | sudo tar -C /usr/local -xz
+
+      - name: Verify module tidy
+        shell: wsl-bash {0}
+        run: /usr/local/go/bin/go mod download && /usr/local/go/bin/go mod verify
+
+      - name: go vet
+        shell: wsl-bash {0}
+        run: /usr/local/go/bin/go vet ./...
+
+      - name: Build
+        shell: wsl-bash {0}
+        run: /usr/local/go/bin/go build -v ./...
+
+      - name: Test
+        shell: wsl-bash {0}
+        run: /usr/local/go/bin/go test -race -count=1 -timeout=10m ./...
+
   lint:
     name: Lint
     runs-on: ubuntu-latest
@@ -148,6 +197,9 @@ jobs:
       - name: Workflow shell syntax
         run: python3 scripts/check-workflow-shell.py
 
+      - name: WSL2 coverage
+        run: python3 scripts/check-wsl2-coverage.py
+
       - name: Release notification policy
         run: python3 scripts/release-workflow_test.py
 

.github/workflows/doc-drift.yml

@@ -1,7 +1,7 @@
 # Documentation-drift audit.
 #
 # An agent (headless opencode against the internal SKAINET gateway, same
-# GLM-5.2 as the rest of the harness suite) reads the whole checkout and
+# default model as the rest of the harness suite) reads the whole checkout and
 # reports where the documentation makes a concrete factual claim the code
 # contradicts — a removed flag, a changed default, a renamed command, a moved
 # path, a behaviour that no longer holds. Every finding is verified against the
@@ -28,9 +28,9 @@ on:
         type: string
         default: '2400'
       model:
-        description: 'Model id for the audit agent, for THIS RUN ONLY. Leave empty for the opencode pin in internal/e2e/versions.go (zai-org/GLM-5.2)'
+        description: 'Model id for the audit agent, for THIS RUN ONLY. Set empty to use each harness''s pin in internal/e2e/versions.go (opencode/codex/copilot/pi/codewhale: zai-org/GLM-5.2, claude-code: claude-sonnet-5).'
         type: string
-        default: ''
+        default: 'deepseek-ai/DeepSeek-V4-Flash'
       context_limit:
         description: 'Context window declared to the agent, in tokens. Leave empty for the 100000 default, which is safely under every pinned model'
         type: string
@@ -55,7 +55,7 @@ jobs:
       candidates: ${{ steps.probe.outputs.candidates }}
     env:
       SKAINET_TOKEN: ${{ secrets.SKAINET_TOKEN }}
-      SKAINET_INTERNAL: ${{ secrets.SKAINET_EXTERNAL }}
+      SKAINET_INTERNAL: ${{ secrets.SKAINET_INTERNAL }}
       E2E_MODEL: ${{ github.event.inputs.model }}
     steps:
       - name: Checkout
@@ -89,7 +89,7 @@ jobs:
     env:
       DRIFT_MODE: ${{ matrix.mode }}
       SKAINET_TOKEN: ${{ secrets.SKAINET_TOKEN }}
-      SKAINET_INTERNAL: ${{ secrets.SKAINET_EXTERNAL }}
+      SKAINET_INTERNAL: ${{ secrets.SKAINET_INTERNAL }}
       E2E_VERSION_OPENCODE: ${{ github.event.inputs.opencode_version }}
       DRIFT_TIMEOUT_SECS: ${{ github.event.inputs.timeout_secs }}
       # From the preflight job: the input, the gateway probe and the -TEE flip

.github/workflows/e2e-readme-onboarding.yml

@@ -24,9 +24,9 @@ on:
         type: string
         default: '1200'
       model:
-        description: 'Model id for the onboarding agent, for THIS RUN ONLY. Leave empty for the opencode pin in internal/e2e/versions.go (zai-org/GLM-5.2)'
+        description: 'Model id for the onboarding agent, for THIS RUN ONLY. Set empty to use each harness''s pin in internal/e2e/versions.go (opencode/codex/copilot/pi/codewhale: zai-org/GLM-5.2, claude-code: claude-sonnet-5).'
         type: string
-        default: ''
+        default: 'deepseek-ai/DeepSeek-V4-Flash'
       context_limit:
         description: 'Context window declared to the agent, in tokens. Leave empty for the 100000 default, which is safely under every pinned model'
         type: string
@@ -48,7 +48,7 @@ jobs:
       candidates: ${{ steps.probe.outputs.candidates }}
     env:
       SKAINET_TOKEN: ${{ secrets.SKAINET_TOKEN }}
-      SKAINET_INTERNAL: ${{ secrets.SKAINET_EXTERNAL }}
+      SKAINET_INTERNAL: ${{ secrets.SKAINET_INTERNAL }}
       E2E_MODEL: ${{ github.event.inputs.model }}
     steps:
       - name: Checkout
@@ -81,7 +81,7 @@ jobs:
       cancel-in-progress: false
     env:
       SKAINET_TOKEN: ${{ secrets.SKAINET_TOKEN }}
-      SKAINET_INTERNAL: ${{ secrets.SKAINET_EXTERNAL }}
+      SKAINET_INTERNAL: ${{ secrets.SKAINET_INTERNAL }}
       E2E_VERSION_OPENCODE: ${{ github.event.inputs.opencode_version }}
       E2E_ONBOARDING_TIMEOUT_SECS: ${{ github.event.inputs.timeout_secs }}
       # From the preflight job: the input, the gateway probe and the -TEE flip