feat: US-016 - Update all path references for native/ restructure

Author: NathanFlurry

.github/workflows/ci.yml

@@ -30,9 +30,9 @@ jobs:
         uses: actions/cache@v4
         with:
           path: |
-            wasmvm/target
-            wasmvm/vendor
-          key: wasm-${{ runner.os }}-${{ hashFiles('wasmvm/Cargo.lock', 'wasmvm/rust-toolchain.toml') }}
+            native/wasmvm/target
+            native/wasmvm/vendor
+          key: wasm-${{ runner.os }}-${{ hashFiles('native/wasmvm/Cargo.lock', 'native/wasmvm/rust-toolchain.toml') }}
 
       - name: Build WASM binary
         run: cd wasmvm && make wasm
@@ -42,28 +42,28 @@ jobs:
         id: cache-wasi-sdk
         uses: actions/cache@v4
         with:
-          path: wasmvm/c/vendor/wasi-sdk
+          path: native/wasmvm/c/vendor/wasi-sdk
           key: wasi-sdk-25-${{ runner.os }}-${{ runner.arch }}
 
       - name: Download wasi-sdk
         if: steps.cache-wasi-sdk.outputs.cache-hit != 'true'
-        run: make -C wasmvm/c wasi-sdk
+        run: make -C native/wasmvm/c wasi-sdk
 
       - name: Cache patched wasi-libc sysroot
         id: cache-sysroot
         uses: actions/cache@v4
         with:
           path: |
-            wasmvm/c/sysroot
-            wasmvm/c/vendor/wasi-libc
-          key: wasi-libc-sysroot-${{ runner.os }}-${{ hashFiles('wasmvm/patches/wasi-libc/*.patch', 'wasmvm/scripts/patch-wasi-libc.sh') }}
+            native/wasmvm/c/sysroot
+            native/wasmvm/c/vendor/wasi-libc
+          key: wasi-libc-sysroot-${{ runner.os }}-${{ hashFiles('native/wasmvm/patches/wasi-libc/*.patch', 'native/wasmvm/scripts/patch-wasi-libc.sh') }}
 
       - name: Build patched wasi-libc sysroot
         if: steps.cache-sysroot.outputs.cache-hit != 'true'
-        run: make -C wasmvm/c sysroot
+        run: make -C native/wasmvm/c sysroot
 
       - name: Build C test fixtures (WASM + native)
-        run: make -C wasmvm/c programs native
+        run: make -C native/wasmvm/c programs native
 
       # --- Node.js / TypeScript ---
       - name: Set up pnpm

.github/workflows/pkg-pr-new.yaml

@@ -50,7 +50,7 @@ jobs:
 
       - name: Build linux-x64 binary via Docker
         run: |
-          cd crates/v8-runtime
+          cd native/v8-runtime
           docker build -f docker/Dockerfile.linux-x64-gnu -o type=local,dest=npm/linux-x64-gnu .
 
       - name: Publish to pkg.pr.new

.github/workflows/release.yml

@@ -54,7 +54,7 @@ jobs:
 
       - name: Build linux-x64 binary via Docker
         run: |
-          cd crates/v8-runtime
+          cd native/v8-runtime
           docker build -f docker/Dockerfile.linux-x64-gnu -o type=local,dest=npm/linux-x64-gnu .
 
       - name: Publish to npm
@@ -80,7 +80,7 @@ jobs:
           done
 
           # Publish v8 platform packages (not in pnpm workspace)
-          for dir in crates/v8-runtime/npm/*/; do
+          for dir in native/v8-runtime/npm/*/; do
             if [ ! -f "$dir/package.json" ]; then
               continue
             fi

.github/workflows/rust.yml

@@ -5,13 +5,13 @@ on:
     branches:
       - main
     paths:
-      - "crates/v8-runtime/**"
+      - "native/v8-runtime/**"
       - ".github/workflows/rust.yml"
   pull_request:
     branches:
       - main
     paths:
-      - "crates/v8-runtime/**"
+      - "native/v8-runtime/**"
       - ".github/workflows/rust.yml"
 
 jobs:
@@ -33,17 +33,17 @@ jobs:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
-            crates/v8-runtime/target
-          key: rust-lint-${{ hashFiles('crates/v8-runtime/Cargo.lock') }}
+            native/v8-runtime/target
+          key: rust-lint-${{ hashFiles('native/v8-runtime/Cargo.lock') }}
           restore-keys: |
             rust-lint-
 
       - name: Check formatting
-        working-directory: crates/v8-runtime
+        working-directory: native/v8-runtime
         run: cargo fmt --all -- --check
 
       - name: Run clippy
-        working-directory: crates/v8-runtime
+        working-directory: native/v8-runtime
         run: cargo clippy --all-targets -- -D warnings
 
   build:
@@ -94,8 +94,8 @@ jobs:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
-            crates/v8-runtime/target
-          key: rust-${{ matrix.target }}-${{ hashFiles('crates/v8-runtime/Cargo.lock') }}
+            native/v8-runtime/target
+          key: rust-${{ matrix.target }}-${{ hashFiles('native/v8-runtime/Cargo.lock') }}
           restore-keys: |
             rust-${{ matrix.target }}-
 
@@ -108,7 +108,7 @@ jobs:
 
       - name: Configure cross-compilation linker
         if: matrix.cross
-        working-directory: crates/v8-runtime
+        working-directory: native/v8-runtime
         run: |
           mkdir -p .cargo
           cat > .cargo/config.toml <<'EOF'
@@ -117,16 +117,16 @@ jobs:
           EOF
 
       - name: Build
-        working-directory: crates/v8-runtime
+        working-directory: native/v8-runtime
         run: cargo build --release --target ${{ matrix.target }}
 
       - name: Run tests
         if: matrix.test
-        working-directory: crates/v8-runtime
+        working-directory: native/v8-runtime
         run: cargo test --release --target ${{ matrix.target }}
 
       - name: Upload binary artifact
         uses: actions/upload-artifact@v4
         with:
           name: v8-${{ matrix.npm-dir }}
-          path: crates/v8-runtime/target/${{ matrix.target }}/release/${{ matrix.binary }}
+          path: native/v8-runtime/target/${{ matrix.target }}/release/${{ matrix.binary }}

.gitignore

@@ -5,8 +5,8 @@ dist
 target/
 scratch/
 .ralph/
-wasmvm/target/
-wasmvm/vendor/
+native/wasmvm/target/
+native/wasmvm/vendor/
 packages/secure-exec/src/generated/
 packages/playground/secure-exec-worker.js
 packages/playground/vendor/

CLAUDE.md

@@ -43,9 +43,9 @@
 ## C Library Vendoring Policy
 
 - NEVER commit third-party C library source code directly into this repo
-- **unmodified upstream libraries** (sqlite3, zlib, minizip, cJSON, etc.) must be downloaded at build time from their official release URLs — add a Makefile target in `wasmvm/c/Makefile` under `fetch-libs`
+- **unmodified upstream libraries** (sqlite3, zlib, minizip, cJSON, etc.) must be downloaded at build time from their official release URLs — add a Makefile target in `native/wasmvm/c/Makefile` under `fetch-libs`
 - **modified libraries** (e.g., libcurl with WASI patches) must live in a fork under the `rivet-dev` GitHub org (e.g., `rivet-dev/secure-exec-curl`) — the Makefile downloads from the fork's archive URL
-- all downloaded library sources go in `wasmvm/c/libs/` which is gitignored — they are fetched by `make fetch-libs` and cached in `wasmvm/c/.cache/`
+- all downloaded library sources go in `native/wasmvm/c/libs/` which is gitignored — they are fetched by `make fetch-libs` and cached in `native/wasmvm/c/.cache/`
 - when adding a new C library dependency: (1) add its download URL and Makefile target to `fetch-libs`, (2) add `libs/<name>` to the appropriate `.gitignore`, (3) if WASI modifications are needed, create a `rivet-dev/secure-exec-<name>` fork first
 - existing forks: `rivet-dev/secure-exec-curl` (libcurl with `wasi_tls.c` and `wasi_stubs.c`)
 
@@ -54,21 +54,21 @@
 - the goal for WasmVM is full POSIX compliance 1:1 — every command, syscall, and shell behavior should match a real Linux system exactly
 - WasmVM and Python are experimental surfaces in this repo
 - all docs for WasmVM, Python, or other experimental runtime features must live under the `Experimental` section of the docs navigation, not the main getting-started/reference sections
-- the WasmVM runtime requires standalone WASM binaries in `wasmvm/target/wasm32-wasip1/release/commands/`
-- build them locally: `cd wasmvm && make wasm` (requires Rust nightly + wasm32-wasip1 target + rust-src component + wasm-opt/binaryen)
-- the Rust toolchain is pinned in `wasmvm/rust-toolchain.toml` — rustup will auto-install it
-- CI builds the binaries before tests; a CI-only guard test in `packages/runtime/wasmvm/test/driver.test.ts` fails if they're missing
+- the WasmVM runtime requires standalone WASM binaries in `native/wasmvm/target/wasm32-wasip1/release/commands/`
+- build them locally: `cd native/wasmvm && make wasm` (requires Rust nightly + wasm32-wasip1 target + rust-src component + wasm-opt/binaryen)
+- the Rust toolchain is pinned in `native/wasmvm/rust-toolchain.toml` — rustup will auto-install it
+- CI builds the binaries before tests; a CI-only guard test in `packages/secure-exec-wasmvm/test/driver.test.ts` fails if they're missing
 - tests gated behind `skipIf(!hasWasmBinaries)` or `skipUnlessWasmBuilt()` will skip locally if binaries aren't built
-- see `wasmvm/CLAUDE.md` for full build details and architecture
+- see `native/wasmvm/CLAUDE.md` for full build details and architecture
 
 ## WasmVM Syscall Coverage
 
-- every function in the `host_process` and `host_user` import modules (declared in `wasmvm/crates/wasi-ext/src/lib.rs`) must have at least one C parity test exercising it through libc
-- when adding a new host import, add a matching test case to `wasmvm/c/programs/syscall_coverage.c` and its parity test in `packages/runtime/wasmvm/test/c-parity.test.ts`
-- the canonical source of truth for import signatures is `wasmvm/crates/wasi-ext/src/lib.rs` — C patches and JS host implementations must match exactly
-- C patches in `wasmvm/patches/wasi-libc/` must be kept in sync with wasi-ext — ABI drift between C, Rust, and JS is a P0 bug
-- permission tier enforcement must cover ALL write/spawn/kill/pipe/dup operations — audit `packages/runtime/wasmvm/src/kernel-worker.ts` when adding new syscalls
-- `PATCHED_PROGRAMS` in `wasmvm/c/Makefile` must include all programs that use `host_process` or `host_user` imports (programs linking the patched sysroot)
+- every function in the `host_process` and `host_user` import modules (declared in `native/wasmvm/crates/wasi-ext/src/lib.rs`) must have at least one C parity test exercising it through libc
+- when adding a new host import, add a matching test case to `native/wasmvm/c/programs/syscall_coverage.c` and its parity test in `packages/secure-exec-wasmvm/test/c-parity.test.ts`
+- the canonical source of truth for import signatures is `native/wasmvm/crates/wasi-ext/src/lib.rs` — C patches and JS host implementations must match exactly
+- C patches in `native/wasmvm/patches/wasi-libc/` must be kept in sync with wasi-ext — ABI drift between C, Rust, and JS is a P0 bug
+- permission tier enforcement must cover ALL write/spawn/kill/pipe/dup operations — audit `packages/secure-exec-wasmvm/src/kernel-worker.ts` when adding new syscalls
+- `PATCHED_PROGRAMS` in `native/wasmvm/c/Makefile` must include all programs that use `host_process` or `host_user` imports (programs linking the patched sysroot)
 
 ## Terminology
 

docs-internal/arch/overview.md

@@ -132,7 +132,7 @@ Manages the Rust V8 child process and provides the session API.
 - IPC uses length-prefixed MessagePack (64 MB max); binary data uses msgpack `bin` format (no base64)
 - Bridge args/results are double-encoded: inner msgpack blobs inside outer msgpack IPC messages
 
-### Rust binary (`crates/v8-runtime/`)
+### Rust binary (`native/v8-runtime/`)
 
 The Rust V8 runtime process. One OS thread per session, each owning a `v8::Isolate`.
 
@@ -222,4 +222,4 @@ Wraps each adapter with allow/deny checks before calls reach the host.
 
 ---
 
-> **Kernel packages** (`packages/kernel/`, `packages/runtime/`, `packages/os/`) are experimental and not part of the public API. See `wasmvm/CLAUDE.md` for kernel and WasmVM architecture details.
+> **Kernel packages** (`packages/kernel/`, `packages/runtime/`, `packages/os/`) are experimental and not part of the public API. See `native/wasmvm/CLAUDE.md` for kernel and WasmVM architecture details.

docs-internal/spec-hardening.md

@@ -25,7 +25,7 @@ Addresses bugs, test quality gaps, missing coverage, and documentation debt iden
 
 ### 2. SharedArrayBuffer 1MB Truncation (WasmVM)
 
-**Location:** `packages/runtime/wasmvm/src/syscall-rpc.ts`
+**Location:** `packages/secure-exec-wasmvm/src/syscall-rpc.ts`
 
 **Problem:** The WasmVM RPC uses a 1MB SharedArrayBuffer for all response data. File reads >1MB silently truncate with no error. Large directory listings overflow.
 
@@ -207,13 +207,13 @@ Addresses bugs, test quality gaps, missing coverage, and documentation debt iden
 **Problem:** WasmVM real execution tests are gated behind `skipIf(!hasWasmBinaries)`. If CI doesn't build the Rust crates, all real execution tests silently skip. The test suite reports green despite not running critical tests.
 
 **Acceptance criteria:** (RESOLVED)
-- CI pipeline runs `make wasm` to build standalone binaries to `wasmvm/target/wasm32-wasip1/release/commands/`
+- CI pipeline runs `make wasm` to build standalone binaries to `native/wasmvm/target/wasm32-wasip1/release/commands/`
 - CI-only test asserts `hasWasmBinaries === true` so CI fails if binaries are missing
 - CLAUDE.md documents how to build locally
 
 ### 15. Error String Matching → Structured Errors (WasmVM)
 
-**Location:** `packages/runtime/wasmvm/src/kernel-worker.ts`
+**Location:** `packages/secure-exec-wasmvm/src/kernel-worker.ts`
 
 **Problem:** `mapErrorToErrno()` matches on `error.message` content (`msg.includes('EBADF')`). Brittle — if kernel error messages change, errno mapping silently breaks.
 
@@ -593,7 +593,7 @@ process.exit(code);
 
 ### 27. fdPread / fdPwrite (Positional I/O) (was 26)
 
-**Location:** `packages/kernel/src/fd-table.ts`, `packages/kernel/src/kernel.ts`, `packages/runtime/wasmvm/src/kernel-worker.ts`
+**Location:** `packages/kernel/src/fd-table.ts`, `packages/kernel/src/kernel.ts`, `packages/secure-exec-wasmvm/src/kernel-worker.ts`
 
 **Problem:** WasmVM's kernel-worker RPC defines `fdPread` and `fdPwrite` handlers but they fall back to sequential `fdRead`/`fdWrite` without respecting the offset parameter. Positional I/O reads/writes at a specific offset without changing the FD's cursor position. This is used by databases (SQLite), memory-mapped file patterns, and concurrent readers of the same file.
 

docs-internal/specs/v8-context-snapshot.md

@@ -332,15 +332,15 @@ Split `composeBridgeCode()` into:
 
 ### Phase 4: Add stub bridge context
 
-**File: `crates/v8-runtime/src/bridge.rs`**
+**File: `native/v8-runtime/src/bridge.rs`**
 
 Add `BridgeCallContext::stub()` — a no-op context that panics if `sync_call` or `async_send` is called. Used during snapshot creation.
 
 Add `register_stub_bridge_fns(scope, sync_fns, async_fns)` — registers all 38 bridge functions with stub External data.
 
 ### Phase 5: Context snapshot creation
 
-**File: `crates/v8-runtime/src/snapshot.rs`**
+**File: `native/v8-runtime/src/snapshot.rs`**
 
 Update `create_snapshot()` to:
 1. Register stub bridge functions
@@ -351,7 +351,7 @@ Update `create_snapshot()` to:
 
 ### Phase 6: Context restore in session thread
 
-**File: `crates/v8-runtime/src/session.rs`**
+**File: `native/v8-runtime/src/session.rs`**
 
 On Execute, instead of:
 ```

docs-internal/specs/v8-runtime.md

@@ -393,7 +393,7 @@ MessagePack handles binary data natively as `bin` format. No more base64 encodin
 ## Rust Crate Structure
 
 ```
-crates/v8-runtime/
+native/v8-runtime/
 ├── Cargo.toml
 ├── src/
 │   ├── main.rs              # Binary entry point, UDS listener
@@ -534,7 +534,7 @@ Expected binary size: ~40-60MB per platform (V8 is large).
 ## Migration Plan
 
 ### Phase 1: Build the Rust binary
-- Implement `crates/v8-runtime/` with IPC protocol
+- Implement `native/v8-runtime/` with IPC protocol
 - Basic isolate lifecycle: create, execute script, destroy
 - Host function injection for sync bridge calls