Update AGENTS.md with performance conventions and add t.Parallel to CLI tests

2 files changed, 7 insertions, 1 deletions

diff --git a/AGENTS.md b/AGENTS.md
index 65d75ac..3cdb6bd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -32,7 +32,7 @@ No piece of code is considered "done" until it has passed the full verification
 1. **Formatting**: `go fmt ./...`
 2. **Static Analysis**: `go vet ./...`
 3. **Linting**: `golangci-lint run`
-4. **Verification**: `go test` (relevant packages)
+4. **Verification**: `go test -timeout 30s ./...`
 
 If any of these tools report an error or warning, the code must be corrected before the task is marked as complete.
 
@@ -42,6 +42,11 @@ To maintain a high-velocity development cycle without sacrificing correctness, w
 - **Code Stubs**: Any unimplemented logic path must be explicitly marked with a `// TODO` comment and return a descriptive error (e.g., `fmt.Errorf("feature X not yet implemented")`).
 - **Test Stubs**: Any test that is planned but not yet implementable must use `t.Skip("not implemented")` and include a comment describing the specific scenario the test is intended to verify.
 - **Hermetic Configuration**: Tests involving profiles, settings, or filesystem state must not touch the actual user home directory. Use the `ConfigDir` injection pattern in the `App` struct combined with `t.TempDir()` to create isolated, temporary test environments.
+- **Performance & Reliability**:
+    - **Parallelism**: Use `t.Parallel()` in integration and E2E tests. Use `t.TempDir()` to ensure resource isolation.
+    - **Granular Timeouts**: All system calls, network operations, and external command executions must be wrapped in a `context.WithTimeout` (typically 2-5 seconds) to prevent hanging tests.
+    - **Interface Mocking**: Use interfaces for "heavy" system operations (e.g., routing, namespace creation) to allow fast unit testing of logic via mocks, reserving real syscalls for the integration tier.
+    - **Shared Fixtures**: Use `sync.Once` or `TestMain` for expensive setup (e.g., Virtual Peer) to avoid redundant boot-ups across tests.
 
 ### 3. Platform Compatibility & Build Constraints
 `wg-wrap` is fundamentally a Linux system tool. To ensure the module remains compilable on other platforms while restricting Linux-specific syscalls, we use the following patterns:
diff --git a/internal/cli/cli_test.go b/internal/cli/cli_test.go
index 71ff6cb..ca0e7d4 100644
--- a/internal/cli/cli_test.go
+++ b/internal/cli/cli_test.go
@@ -5,6 +5,7 @@ import (
 )
 
 func TestAppRun_ProfileDirInjection(t *testing.T) {
+	t.Parallel()
 	// Set up a temporary directory to simulate XDG_CONFIG_HOME/wg-wrap/profiles
 	tmpDir := t.TempDir()