[irparent]

The matrix could not see its own answers

Dependabot #308 (better-sqlite3 12 → 13) has been held open since August on a note that says the segfault reproduces on Node 20, 22 and 24, and that it breaks the container build. Both claims are wrong, and this PR fixes the thing that made them wrong rather than the bump itself.

What actually happened. The test matrix is fail-fast. When the Node 20 cell went red, GitHub cancelled the Node 22 and Node 24 cells before they ran. The full job list for the last re-test (run 35697296879) reads:

failure    test (20)
cancelled  test (22)
cancelled  test (22, node)
cancelled  test (24, node)
success    docker-build

cancelled is not failed. Those three cells have no result at all, and docker-build — the other thing the note calls broken — passed.

What is true. Reproduced against better-sqlite3@13.0.3 on Ubuntu 24.04 / glibc 2.39 / x86_64, the same OS and C library ubuntu-latest runs, with the four-line script from WiseLibs/better-sqlite3#1514:

Node	N-API	Result
20.20.2	9	SIGSEGV inside new Database() — nothing printed, core dumped
22.23.2	10	open ok / close ok, exit 0
24.21.0	10	open ok / close ok, exit 0

Also clean on Debian bookworm with Node 25.9.0, and on node:22-alpine and node:24-alpine — musl prebuilds now ship in the package, so the "no prebuilt binary for alpine, falls through to node-gyp" half of the note is stale too.

So the real constraint is a single one: better-sqlite3 13 declares engines: node >=22, and Iris declares >=20.0.0. That is a supported-runtime decision, and it is handled separately.

Why this PR does not just drop Node 20

Because making that check green would be the wrong kind of green.

Every runs-on: line in this repository — all thirty of them — is ubuntu-latest. Upstream #1514 reports version 13 crashing on darwin-arm64 on Node 20 and Node 22, and the Linux runs above show Node 22 is fine there. That difference is real and platform-specific, and a Linux-only matrix is structurally incapable of seeing it. Drop Node 20, watch CI go green, merge the bump, and Iris crashes on startup for a developer on an Apple Silicon Mac running Node 22 — with nothing in CI to say so.

What changes

• fail-fast: false on the test matrix. One red cell no longer cancels its siblings.
• A native Node 24 cell (test (24)). The two existing Node 24 cells both run the built-in node:sqlite driver; the native addon has never been measured on 24.
• A macOS cell (test (22, macOS)), native driver, macos-latest — Apple Silicon. The first non-Linux cell Iris has ever had.

The two new cells report but are not required checks, so this PR changes nothing about what blocks a merge. Making them required is a branch-protection change, and it should follow evidence that they are green rather than precede it.

Gates

Workflow-only; no source, no version, no rendered surface. The matrix expands from four cells to six and the existing four keep their exact context names — test (20), test (22), test (22, node), test (24, node) — so the required set is untouched.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
website	Ready	Preview	Sep 22, 2026 3:26pm UTC

[github-actions]

Iris gate — 1 of 2 tripped --fail-on detector_veto

iris-eval ingest: 3 stored, 1 tripped --fail-on detector_veto (2 of 3 evaluated in dataset "release-gate")

Trace	Basis	Rules	Evidence
1d1a4a192bb32a26aec1e29fece200ae	detector_veto	no_pii	no_pii: AWS Access Key (output 45–65)

Verdict basis	Traces
detector_veto	2
clean	1

Unjudged questions: task_completed (3), tool_use_correct (3) — a trace that did not carry what a rule needs.

_{tests/fixtures/ci-gate/traces.ndjson · 3 evaluated · dataset release-gate: 2 in the gate · exit 1 · what the bases mean}

[github-actions]

Iris gate — 1 stored, nothing tripped --fail-on any

iris-eval ingest: 1 stored, 0 tripped --fail-on any

Verdict basis	Traces
clean	1

Unjudged questions: task_completed (1), tool_use_correct (1) — a trace that did not carry what a rule needs.

_{tests/fixtures/ci-gate/clean.ndjson · 1 evaluated · exit 0 · what the bases mean}