Update NVX and adapt direct OpenVMM launches to the current boot contract by Copilot · Pull Request #11006 · github/gh-aw-firewall

Copilot · 2026-11-02T17:12:27Z

Newer NVX guests reject AWF’s unformatted layer tokens and separate configuration layer; OpenVMM also rejects repeated direct mounts. This updates to the newer verified release v0.1.0-dev.8fb0f1d64f2f and adapts AWF’s launch contract.

Immutable root
- Merge toolchain and guest configuration into one distro.erofs, preserving root/workload ownership.
- Emit the format-qualified boot token:
```
nvx_layer=distro,0xd0003000,erofs:<UUID>
```
Shares and launch safety
- Retain --mount for one directory; use aggregate children and nvx_share tokens for multiple shares or files.
- Include implicit virtio-fs bootstrap tokens in the 1024-byte command-line budget.
- Validate arguments, identities, limits, and mount policies; pass checked image descriptors through FDs 6/7.
Artifacts and workflows
- Synchronize release, source revisions, checksums, and promotion baselines; raise the bounded OpenVMM ceiling to 1 GiB.
- Replace retired Python sandbox launches with packaged nvx-rs; update the Rust-source probe, generated locks, and documentation.
Contract coverage
- Add real-release dry-run comparisons to Phase 3b.
- Pinned-release KVM smoke covers single and aggregate shares. Full attested AWF confinement/proxy, authenticated smoke, and Phase 4 canary evidence remain pending.

Fixes Update NVX to v0.1.0-dev.13504aa3497c and adapt the direct OpenVMM launch to its new boot contract #10999

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

github-actions · 2026-11-02T17:54:31Z

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

Download the docs-preview-pr-11006 artifact from the workflow run
Unzip and open index.html in your browser

Built from commit f0689bd

github-actions · 2026-11-02T18:04:27Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.58%	93.66%	📈 +0.08%
Statements	92.10%	92.19%	📈 +0.09%
Functions	91.32%	91.44%	📈 +0.12%
Branches	86.18%	86.39%	📈 +0.21%

📁 Per-file Coverage Changes (8 files)

File	Lines (Before → After)	Statements (Before → After)
`src/enclave/host-executor-server.ts`	91.2% → 91.2% (+0.00%)	89.8% → 90.1% (+0.29%)
`src/nvx/runtime-lifecycle.ts`	84.5% → 84.8% (+0.27%)	80.0% → 80.1% (+0.01%)
`src/nvx/guest-config-layer.ts`	93.8% → 94.0% (+0.30%)	91.5% → 91.9% (+0.39%)
`src/routing/bootstrap.ts`	85.4% → 85.9% (+0.52%)	80.2% → 81.1% (+0.95%)
`src/nvx/manager.ts`	82.5% → 83.3% (+0.88%)	82.4% → 83.2% (+0.80%)
`src/nvx/filesystem-builder.ts`	88.2% → 90.2% (+1.97%)	87.1% → 89.1% (+2.04%)
`src/nvx/launch-executor.ts`	88.2% → 90.3% (+2.17%)	82.3% → 84.3% (+2.04%)
`src/nvx/one-shot-adapter.ts`	83.4% → 87.3% (+3.87%)	80.7% → 85.1% (+4.42%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

🟡 Changes recommended

The live-KVM tests lack required package files, restrictive /home permissions block non-root tool-state seeding, and stale process matching can falsely report successful VMM cleanup.

3 open issues

What changed in this PR

Updates AWF’s NVX microVM backend to the current release and boot contract, addressing the compatibility changes described in #10999.

Changes:

Merges toolchain and guest configuration into one immutable distro image with a format-qualified boot token.
Adapts aggregate shares, strengthens launch validation, and passes checked image descriptors to OpenVMM.
Synchronizes release pins, workflows, promotion baselines, documentation, and contract coverage.

File	Description
`src/nvx/runtime-lifecycle.ts`	Uses shared launch validation, kernel tokens, and image descriptor paths.
`src/nvx/runtime-lifecycle.test.ts`	Checks aggregate shares, formatted root tokens, and descriptor arguments.
`src/nvx/runtime-backend.ts`	Updates comments to describe merged guest configuration.
`src/nvx/one-shot-adapter.ts`	Migrates to `nvx-rs` and implements the updated launch contract.
`src/nvx/one-shot-adapter.test.ts`	Covers share rendering, command-line budgets, and validation.
`src/nvx/manager.ts`	Clarifies that configuration is a merge source, not a guest layer.
`src/nvx/manager.test.ts`	Checks configuration-source handoff and single-image launches.
`src/nvx/live-mount-policy.ts`	Adds a file-share marker.
`src/nvx/launch-executor.ts`	Verifies image descriptors and manages their handoff and closure.
`src/nvx/launch-executor.test.ts`	Tests descriptor validation, inheritance, and failure cleanup.
`src/nvx/guest-config-layer.ts`	Documents configuration as an ownership-preserving overlay.
`src/nvx/guest-config-layer.test.ts`	Checks ownership calls and relocates temporary fixtures.
`src/nvx/filesystem-builder.ts`	Merges sources into one distro image and strengthens staging checks.
`src/nvx/filesystem-builder.test.ts`	Covers deterministic merges, ownership, conflicts, and source changes.
`src/nvx/confinement.ts`	Preserves checked image descriptors through the exec trampoline.
`src/nvx/confinement.test.ts`	Checks descriptor-preservation setup.
`src/nvx/artifact-manifest.ts`	Updates upstream pins and raises the OpenVMM ceiling to 1 GiB.
`src/nvx/artifact-manifest.test.ts`	Checks synchronized pins, launcher migration, and artifact limits.
`scripts/ci/nvx-release-contract.test.ts`	Adds comparisons against the pinned package’s real dry-run output.
`scripts/ci/nvx-phase4-provision-nvx.sh`	Updates provisioning checksums and source identities.
`docs/nvx-security-design.md`	Documents the revised contract and validation boundaries.
`docs/nvx-promotion-thresholds.json`	Updates the promotion baseline’s NVX pin.
`docs/nvx-promotion-evaluation.md`	Updates the documented NVX baseline.
`.gitignore`	Adds NVX temporary-directory exclusions.
`.github/workflows/smoke-verify-release-nvx-assets.md`	Updates expected release-manifest identities.
`.github/workflows/smoke-verify-release-nvx-assets.lock.yml`	Synchronizes generated release-verification checks.
`.github/workflows/smoke-nvx-copilot.md`	Updates Copilot smoke artifact pins and checksums.
`.github/workflows/smoke-nvx-copilot.lock.yml`	Synchronizes the generated Copilot smoke workflow.
`.github/workflows/smoke-nvx-build-test.md`	Updates build-smoke artifact pins and checksums.
`.github/workflows/smoke-nvx-build-test.lock.yml`	Synchronizes the generated build-smoke workflow.
`.github/workflows/release.yml`	Publishes artifacts using the updated upstream identity.
`.github/workflows/nvx-phase-4-canary.yml`	Updates canary provisioning and campaign metadata.
`.github/workflows/nvx-phase-4-benchmark.yml`	Updates benchmark baseline checks and campaign metadata.
`.github/workflows/nvx-phase-3b-live-kvm.yml`	Updates pins, probes Rust sources, and enables release-contract tests.
`.github/workflows/nvx-phase-0-feasibility.md`	Updates pins and migrates one-shot probes to packaged `nvx-rs`.
`.github/workflows/nvx-phase-0-feasibility.lock.yml`	Synchronizes generated feasibility probes and release metadata.

_{Review effort: Max (auto)}

      - name: Run focused NVX Phase 3d tests
+        env:
+          AWF_NVX_PACKAGE_ROOT: ${{ runner.temp }}/nvx-package/nvx-0.1.0-linux-kvm


+      await prepareDestination(destination, true);
      await fs.chmod(destination, mode);
      const ownership = await applyOwnership(destination, stat, false);


            cd "$SOURCE_DIR" &&
-            run_with_kvm_group timeout 180s python3 scripts/nvx.py \
+            run_with_kvm_group timeout 180s \
+              "$RUNNER_TEMP/nvx-release/nvx-0.1.0-linux-kvm/bin/nvx-rs" \


lpcox · 2026-11-02T18:38:26Z

@copilot address all review feedback

Copilot · 2026-11-02T18:49:08Z

@copilot address all review feedback

Addressed the NVX review feedback in e86503f. The live-KVM job now fetches and verifies the full package; /home traversal and packaged OpenVMM cleanup detection are covered, and mount delimiter rejection has regression tests.

github-actions · 2026-11-02T19:06:49Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

lpcox · 2026-11-02T21:58:04Z

@copilot fix the failing ci check https://github.com/github/gh-aw-firewall/actions/runs/41503778588/job/125488268521?pr=11006

Copilot · 2026-11-02T22:11:56Z

@copilot fix the failing ci check https://github.com/github/gh-aw-firewall/actions/runs/41503778588/job/125488268521?pr=11006

Fixed in 8e8d551. The liveness test now advances Jest fake timers deterministically; the targeted test and full unit suite pass.

github-actions · 2026-11-02T23:00:11Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-11-02T23:00:11Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-11-02T23:00:13Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-11-02T23:00:16Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-11-02T23:01:03Z

✅ Smoke Claude passed

Generated by Smoke Claude for #11006

github-actions · 2026-11-02T23:12:10Z

fix: avoid false routed-run failures after recovery or cancellation: ✅
fix: preserve Sous Chef non-comment outcomes: ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra
Overall status: PASS
@Copilot @lpcox

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-11-02T23:12:17Z

Cloud Hypervisor + Copilot smoke test

Merged PR lookup: PASS
github.com connectivity: PASS (HTTP 200)
File write/read: PASS
example.com blocked: PASS (HTTP 000)

Overall: PASS

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor
_{Add label ready-for-aw to run again}

github-actions · 2026-11-02T23:14:15Z

Copilot BYOK Smoke Test Results

✅ GitHub MCP connectivity — last 2 merged PRs verified
✅ GitHub.com connectivity — HTTP 200
✅ File write/read test — smoke-test-copilot-byok.txt exists
✅ BYOK inference test — prompt received and processed

Status: PASS

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-11-02T23:15:00Z

Services smoke test

❌ Redis PING: connection refused
❌ pg_isready: no response
❌ psql SELECT 1: connection refused

Overall: FAIL

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-11-02T23:15:09Z

Smoke Test: Claude Engine Validation

API status: ✅ PASS
GitHub check: ✅ PASS
File status: ✅ PASS

Overall result: PASS

Generated by Smoke Claude for #11006 · claude · haiku45 · ~35 AIC · ⊞ 6.1K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-11-02T23:15:19Z

Smoke Test: Gemini Engine Validation

❌ GitHub MCP Testing: tools unavailable (PR #11000: fix: preserve Sous Chef non-comment outcomes)
❌ GitHub.com Connectivity: HTTP status 000
✅ File Writing Testing: created /tmp/gh-aw/agent/smoke-test-gemini-41541810883.txt
✅ Bash Tool Testing: verified file with cat
Overall status: FAIL

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-11-02T23:15:43Z

fix: avoid false routed-run failures after recovery or cancellation
fix: preserve Sous Chef non-comment outcomes
GitHub MCP connectivity: ✅
GitHub.com connectivity: ✅
File write/read: ✅
Direct BYOK inference: ✅
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Overall: PASS
@Copilot @lpcox

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-11-02T23:16:23Z

Smoke Test

fix: avoid false routed-run failures after recovery or cancellation
fix: preserve Sous Chef non-comment outcomes
GitHub reads: ✅
Playwright: ❌
File write/read: ✅
Build (npm ci && npm run build): ✅
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-11-02T23:16:50Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	❌	0/?	❌ FAIL
Java	caffeine	❌	0/?	❌ FAIL
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 7/8 ecosystems passed — FAIL

Failure details

Java (gson, caffeine): mvn compile failed with Could not create local repository at /home/runner/.m2/repository, because ~/.m2 is root-owned and not writable by runner. Retrying with -Dmaven.repo.local in a writable dir failed to resolve plugins: InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty (empty JVM truststore). Tests were not run.

.NET note: the first dotnet restore crashed because /run/user/1001 is missing. It passed once XDG_RUNTIME_DIR was set to a writable dir.

Generated by Build Test Suite for #11006 · copilot · auto · ~25 AIC · ⊞ 5.7K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-11-02T23:17:30Z

Smoke Copilot

PRs: "fix: avoid false routed-run failures after recovery or cancellation", "fix: preserve Sous Chef non-comment outcomes"
GitHub MCP ✅
github.com connectivity ✅
File write/read ✅
Overall: PASS — @Copilot @lpcox

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-11-02T23:18:26Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com → 200)
✅ Blocked domain (example.com blocked)

Overall: PASS

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-11-02T23:19:52Z

Chroot version comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.15	Python 3.12.15	✅ YES
Node.js	v24.22.1	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Node.js differs between host and chroot, so not all tests passed and the smoke-chroot label was not added.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

Initial plan

011c835

Copilot AI assigned Copilot and lpcox Nov 2, 2026

Copilot started work on behalf of lpcox November 2, 2026 17:12

View session

Copilot AI linked an issue Nov 2, 2026 that may be closed by this pull request

Update NVX to v0.1.0-dev.13504aa3497c and adapt the direct OpenVMM launch to its new boot contract #10999

Closed

fix: update NVX pin and single-image boot contract

3d3efe6

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-advanced-security AI found potential problems Nov 2, 2026

View reviewed changes

Comment thread src/nvx/one-shot-adapter.ts Resolved

Copilot AI and others added 2 commits November 2, 2026 17:30

fix: validate current NVX release and checked image handoff

40c4a77

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

chore: remove temporary NVX validation artifacts

2f5001c

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update NVX to v0.1.0-dev.13504aa3497c and adapt OpenVMM launch~~ Update NVX and adapt direct OpenVMM launches to the current boot contract Nov 2, 2026

Copilot finished work on behalf of lpcox November 2, 2026 17:48

Copilot AI requested a review from lpcox November 2, 2026 17:48

lpcox marked this pull request as ready for review November 2, 2026 17:53

Copilot AI auto review requested due to automatic review settings November 2, 2026 17:53

Potential fix for pull request finding

c77dd06

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Copilot started reviewing on behalf of lpcox November 2, 2026 17:54

View session

Copilot AI reviewed Nov 2, 2026

View reviewed changes

Copilot started work on behalf of lpcox November 2, 2026 18:38

View session

fix: address NVX review feedback

e86503f

Copilot finished work on behalf of lpcox November 2, 2026 18:49

Copilot started work on behalf of lpcox November 2, 2026 21:58

View session

test: make host executor lease test deterministic

8e8d551

Copilot finished work on behalf of lpcox November 2, 2026 22:12

lpcox deployed to aoai-model November 2, 2026 23:00 — with GitHub Actions Active

lpcox deployed to aoai-model November 2, 2026 23:11 — with GitHub Actions Active

github-actions Bot added the smoke-copilot-byok-aoai-entra label Nov 2, 2026

lpcox deployed to aoai-model November 2, 2026 23:12 — with GitHub Actions Active

github-actions Bot added the smoke-cloud-hypervisor label Nov 2, 2026

github-actions Bot added the smoke-copilot-byok label Nov 2, 2026

github-actions Bot added the smoke-claude label Nov 2, 2026

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Nov 2, 2026

github-actions Bot added the smoke-copilot label Nov 2, 2026

github-actions Bot mentioned this pull request Nov 2, 2026

[aw] Smoke OTel Tracing: timed out #11022

Open

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Nov 2, 2026

lpcox merged commit 7609fe2 into main Nov 2, 2026
158 of 161 checks passed

lpcox deleted the copilot/update-nvx-to-v010-dev-13504aa3497c branch November 2, 2026 23:47

Conversation

Copilot AI commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Preview

Uh oh!

github-actions Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

lpcox commented Nov 2, 2026

Uh oh!

Copilot AI commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

lpcox commented Nov 2, 2026

Uh oh!

Copilot AI commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

Copilot BYOK Smoke Test Results

Uh oh!

github-actions Bot commented Nov 2, 2026

Services smoke test

Uh oh!

github-actions Bot commented Nov 2, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Nov 2, 2026

Smoke Test: Gemini Engine Validation

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

Smoke Test

Uh oh!

github-actions Bot commented Nov 2, 2026

🏗️ Build Test Suite Results

Failure details

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

Chroot version comparison

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Copilot AI commented Nov 2, 2026 •

edited

Loading

github-actions Bot commented Nov 2, 2026 •

edited

Loading

github-actions Bot commented Nov 2, 2026 •

edited

Loading

github-actions Bot commented Nov 2, 2026 •

edited

Loading

github-actions Bot commented Nov 2, 2026 •

edited

Loading

github-actions Bot commented Nov 2, 2026 •

edited

Loading

github-actions Bot commented Nov 2, 2026 •

edited

Loading