fix(ci): drop natives globalSetup from vitest ci project

[flora131]

Summary

npm run test:ci-contracts is the only test command on the Linux static-checks job, and that job deliberately carries no Rust toolchain. It was nonetheless compiling @bastani/atomic-natives on every run.

The cause was in vitest.config.ts: the shared project() helper applied globalSetup: ["./test/global-setup-natives.ts"] to all three projects, so the ci project inherited a native build it never uses. The test/ci suites only inspect workflow and source state; none of them load the native binding.

project() now takes a usesNativeSetup parameter. The ci project passes false, so the globalSetup key is absent from its resolved config entirely — a spread, not an empty array, and no env-var opt-out inside the setup file. unit and integration are unchanged.

Changes

• vitest.config.ts (+7 −4) — usesNativeSetup parameter on the project() helper; ci opts out. Two comment blocks corrected so they no longer claim the setup runs for every project.
• test/ci/ci-workflow-contracts.test.ts (+21) — new contract native global setup stays on unit and integration projects only. It imports the config and asserts the resolved ci project has no globalSetup, while unit and integration each still carry exactly ["./test/global-setup-natives.ts"]. Deleting the setup for everyone fails the contract too, not just re-wiring ci.

No other file is touched. No changelog entry: per AGENTS.md, CI configuration is infrastructure-level and does not change shipped package behavior. No version bump, no release tags, no Rust added to static-checks.

Acceptance criteria and evidence

#	Criterion	Evidence
1	ci does not run test/global-setup-natives.ts	Behavioural, not config inspection alone: crates/atomic-natives/build.rs was touched so the on-disk .node became older than the Rust sources, which makes the setup print a staleness warning. A ci test file then ran clean with zero occurrences of that line.
2	unit and integration still run it	The same probe produced the warning in both projects.
3	static-checks still has no rust-toolchain; topology test still forbids it	test-workflow-topology.test.ts passes 9/9 including assert.doesNotMatch(staticChecks, /rust-toolchain/u); the job block contains 0 rust-toolchain occurrences and its only test step is npm run test:ci-contracts.
4	A contract fails if ci is wired back	Reverting the false argument fails the new test with AssertionError: ci must not run the native global setup (1 failed / 24 passed).
5	test:ci-contracts passes without compiling natives	The compiled .node was moved aside, leaving the tracked index.js/index.d.ts in place — exactly the state CI has after npm ci --ignore-scripts. The suite ran 8 files / 47 tests green in 105 s and the directory still contained no .node. Binding restored and checksum-verified.
6	No changelog, version bump, or Rust added	The commit touches only the two files above.

Validation

• npm run test:ci-contracts with the compiled binding removed — 47 passed, no .node produced
• npm run check — biome (2558 files) clean, tsc --noEmit clean, tsgo clean, shrinkwrap up to date
• Pre-push hooks on this branch ran npm run check, test:unit, test:integration and test:ci-contracts — all passed

Review notes

Three independent reviewers signed off with no blocking findings. Two related P3 observations, both classified beyond_objective and recorded for future maintainers rather than as defects in this change:

• The new contract guards the per-project key. A root-level test.globalSetup in the same defineConfig call would still reach the ci project and would not be seen by this assertion. That path is outside the stated criterion, which speaks about the ci project being wired back.
• Dropping the ci project's globalSetup also drops its incidental guard against a future test/ci file importing packages/subagents, which imports the binding statically. A static closure probe over the current test/ci suites and their setup files (674 files visited) found zero such imports, so this is forward-looking only.

One cosmetic note: usesNativeSetup is a positional boolean at the call site (project("ci", "test/ci", false)). Legible in a 60-line config with three call sites; switching to an options object was judged out of contract.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Greptile Summary

This change prevents the CI workflow contract tests from invoking the native Rust binding setup, while preserving that setup for unit and integration tests.

The behavior was exercised with no compiled native binding and an intercepted native build command. A configuration equivalent to the previous CI setup attempted the native build, whereas the updated CI project completed its targeted contract test with zero native-build invocations. The resolved configuration also verifies that unit and integration retain the native setup and CI does not.

Confidence Score: 5/5

Safe to merge: the CI-only configuration now avoids the native build dependency without changing setup for native-dependent test projects.

The relevant behavior was directly exercised under the intended failure condition: without a compiled binding and with native build commands intercepted. The CI contract completed without a build invocation, and the resolved configuration assertion confirmed the required setup assignments for all three projects.

Files Needing Attention: No files need follow-up. The exercised behavior is contained in vitest.config.ts and test/ci/ci-workflow-contracts.test.ts.

T-Rex Logs

What T-Rex did

• Ran a parent-equivalent CI project with a blocked native build to exercise the native-setup bypass.
• One targeted test passed and recorded NATIVE_BUILD_INVOCATIONS=0, showing no native build was invoked.
• Unit and integration projects retain exactly ./test/global-setup-natives.ts while CI has no globalSetup, demonstrating the CI project skips native setup without removing it from native-dependent projects.
• Reviewed vitest.config.ts and contract sources, confirming the native setup is defined and disabled for CI by the ci flag.
• The executable contract test test/ci/ci-workflow-contracts.test.ts:70-89 verifies all three resolved projects.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "fix(ci): drop natives globalSetup from v..." | Re-trigger Greptile}