Summary

Two builtin_conformance cases pass on the dev machines but diverged on the CI runner. They were never reached before because the clippy/toolchain step (#93) short-circuited CI; once that was fixed, the test step surfaced these pre-existing host-environment-dependent failures. Both divergences are in the host reference side (the runner's environment), not in the guest V8 runtime — confirmed by reproducing the CI conditions locally (Node 22 host + isolated child).

1. dns — host Node version difference

The test points both host Node and the guest V8 shim at the same in-process FixtureDnsServer, so every resolved value is deterministic. The only divergence: dns.resolveSrv / resolveCaa / resolve(..., "MX") records carry a type discriminator ("type":"SRV", etc.) on Node >= 24 but not on Node <= 22. CI runs on Node 22; dev machines run Node 24. The guest shim always emits the modern shape with type, so a raw guest == host comparison flapped purely on the runner's Node version.

Fix: strip the version-dependent type field from both sides before the guest-vs-host comparison (still covering every version-stable field — addresses, ttls, priorities, exchanges, ports, SOA fields, ...), and additionally assert the guest's own type discriminators directly so guest record-shape correctness is still tested, independent of host Node version. Verified the case now passes with both Node 22 and Node 24 as the host.

2. child-process-abort-signal — fragile cross-runtime /tmp file path

The test wrote a child script to a hardcoded host path /tmp/secure-exec-abort-child.cjs and spawned node <file> with cwd: "/tmp". That file is written into the guest VFS by the parent, but the spawned guest child resolved the module against the runner's filesystem and failed with Cannot find module — exiting with code 1 before ever reaching process.abort(). Whether it happened to work depended on the runner's /tmp layout. (The guest's process.abort() -> SIGABRT path itself is correct; this was never exercised because the child couldn't start.)

Fix: spawn an inline node -e "process.abort();" child (mirroring the sibling child-process-kill-numeric-signal case), exercising the exact same guest behavior — process.abort() mapping to a SIGABRT-shaped exit — with no cross-runtime filesystem dependency. The full host-vs-guest equality and the signal == "SIGABRT" / signalCodeAfterExit == "SIGABRT" assertions are retained.

Verification

• cargo test -p secure-exec-sidecar --test builtin_conformance — all 28 cases pass (Node 24).
• Reproduced the CI environment with Node 22 as host: both dns and child-process-abort-signal now pass.
• cargo clippy --workspace --all-targets -- -D warnings — clean (toolchain pinned 1.96.0).
• cargo fmt --all --check — clean.