Add NVX Phase 3d direct launch executor - #8870
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Documentation PreviewDocumentation has been built for this PR. To view locally:
Built from commit 3e0d5b8 |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 92.12% | 92.01% | 📉 -0.11% |
| Statements | 90.66% | 90.50% | 📉 -0.16% |
| Functions | 90.19% | 89.92% | 📉 -0.27% |
| Branches | 84.08% | 83.80% | 📉 -0.28% |
📁 Per-file Coverage Changes (8 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/nvx/preflight.ts |
64.9% → 64.6% (-0.31%) | 63.8% → 63.5% (-0.32%) |
src/nvx/runtime-lifecycle.ts |
84.1% → 84.0% (-0.13%) | 78.2% → 78.7% (+0.46%) |
src/nvx/manager.ts |
82.1% → 82.1% (+0.00%) | 81.5% → 82.0% (+0.54%) |
src/microvm/network-manager.ts |
98.6% → 98.7% (+0.04%) | 97.4% → 97.4% (+0.07%) |
src/nvx/confinement.ts |
88.0% → 88.2% (+0.15%) | 83.1% → 83.3% (+0.20%) |
src/microvm/network-plan.ts |
93.1% → 93.3% (+0.21%) | 92.5% → 92.7% (+0.22%) |
src/nvx/one-shot-adapter.ts |
80.4% → 80.7% (+0.29%) | 77.7% → 78.0% (+0.34%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
✨ New Files (1 files)
src/nvx/launch-executor.ts: 85.8% lines
Coverage comparison generated by scripts/ci/compare-coverage.ts
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The executor can miss an early child exit and hang indefinitely while awaiting a non-replayed process event.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
What changed in this PR
Adds the internal NVX Phase 3d direct OpenVMM launch path while keeping NVX unavailable as a selectable runtime.
Changes:
- Replaces the
nvx.pylauncher and four-artifact contract with direct OpenVMM execution and three artifacts. - Adds gated startup, confinement verification, seccomp filtering, cgroup control, and no-TAP networking.
- Updates tests, security documentation, and the opt-in KVM validation workflow.
| File | Description |
|---|---|
src/nvx/runtime-lifecycle.ts |
Builds direct OpenVMM launch plans and arguments. |
src/nvx/runtime-lifecycle.test.ts |
Tests direct launch planning. |
src/nvx/preflight.ts |
Removes Python/TUN requirements and snapshots three artifacts. |
src/nvx/preflight.test.ts |
Updates preflight coverage for schema v2. |
src/nvx/one-shot-adapter.ts |
Extracts reusable execution preparation and result handling. |
src/nvx/manager.ts |
Wires the production direct-launch executor. |
src/nvx/manager.test.ts |
Tests manager integration and launch hooks. |
src/nvx/launch-executor.ts |
Implements gated direct OpenVMM execution. |
src/nvx/launch-executor.test.ts |
Tests readiness, failure, timeout, and cancellation paths. |
src/nvx/index.ts |
Exports the new NVX APIs. |
src/nvx/confinement.ts |
Adds Bubblewrap FD controls and executable identity verification. |
src/nvx/confinement.test.ts |
Tests updated confinement behavior. |
src/nvx/artifact-manifest.ts |
Advances the artifact manifest to schema v2. |
src/nvx/artifact-manifest.test.ts |
Updates manifest validation coverage. |
src/microvm/network.test.ts |
Tests no-TAP namespace networking. |
src/microvm/network-types.ts |
Adds TAP creation controls. |
src/microvm/network-plan.ts |
Generates no-TAP output filtering rules. |
src/microvm/network-manager.ts |
Skips TAP and forwarding setup when disabled. |
docs/nvx-security-design.md |
Documents the Phase 3d security boundary. |
.github/workflows/nvx-phase-3b-live-kvm.yml |
Updates opt-in direct-launch validation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 92.13% | 92.01% | 📉 -0.12% |
| Statements | 90.67% | 90.50% | 📉 -0.17% |
| Functions | 90.19% | 89.92% | 📉 -0.27% |
| Branches | 84.09% | 83.80% | 📉 -0.29% |
📁 Per-file Coverage Changes (8 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/nvx/one-shot-adapter.ts |
81.0% → 80.7% (-0.32%) | 78.2% → 78.0% (-0.23%) |
src/nvx/preflight.ts |
64.9% → 64.6% (-0.31%) | 63.8% → 63.5% (-0.32%) |
src/nvx/runtime-lifecycle.ts |
84.1% → 84.0% (-0.13%) | 78.2% → 78.7% (+0.46%) |
src/nvx/manager.ts |
82.1% → 82.1% (+0.00%) | 81.5% → 82.0% (+0.54%) |
src/microvm/network-manager.ts |
98.6% → 98.7% (+0.04%) | 97.4% → 97.4% (+0.07%) |
src/nvx/confinement.ts |
88.0% → 88.2% (+0.15%) | 83.1% → 83.3% (+0.20%) |
src/microvm/network-plan.ts |
93.1% → 93.3% (+0.21%) | 92.5% → 92.7% (+0.22%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
✨ New Files (1 files)
src/nvx/launch-executor.ts: 85.8% lines
Coverage comparison generated by scripts/ci/compare-coverage.ts
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 8 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "msfeed25.pkgs.visualstudio.com"
- "update.googleapis.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
✅ Build Test Suite completed successfully!
|
|
Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
🚀 Security Guard has started processing this pull request |
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅
|
|
❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...
|
Smoke Test: Cloud Hypervisor + Copilot
Result: ALL CHECKS PASSED Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
github-actions
Bot
added
the
smoke-copilot-network-isolation
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com) reachable — HTTP 200 Overall status: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
Smoke Test: Copilot Engine
Overall: PASS cc @lpcox
|
Smoke Test: Claude Engine Validation
Overall result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
✅ Smoke Test: Copilot BYOK (Direct Mode)Test Results:
Mode: Direct BYOK (COPILOT_PROVIDER_API_KEY via api-proxy sidecar) Status: PASS
|
|
Smoke Test: Services Connectivity
Overall: PASS
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Note: For the Java tasks, All 18 projects across all 8 ecosystems built/installed and passed their tests successfully with the AWF firewall's proxy configuration.
|
Smoke Test: API Proxy OpenTelemetry Tracing — Results
All 5 scenarios passed. No unexpected failures detected.
|
Chroot Version Comparison Results
Overall: FAILED — Node.js version mismatch between host and chroot environments. The
|
|
Merged PRs: feat(nvx): add internal Phase 3c lifecycle manager; Correlate upstream 400s with request tool surface and negotiate MCP protocol version Warning Firewall blocked 8 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "msfeed25.pkgs.visualstudio.com"
- "update.googleapis.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
Summary
nvx.pyartifact contract with a commit-pinned, three-artifact direct OpenVMM launch pathTERM=dumbCtrl-Q/REPL-prompt resume handshakeSecurity and compatibility details
/proc/<pid>/exeexposes the in-jail path across the Bubblewrap mount namespace--network-proxyusage and the catch-all deny rule that would override endpoint allowsValidation
npm test -- --runInBand— 380 suites passed, 6,087 tests passed, 4 skippednpm run buildnpm run type-checknpm run lint -- --quietnpx markdownlint-cli2 docs/nvx-security-design.mdRemaining promotion evidence
This PR intentionally does not register an
nvxruntime. Promotion still requires a live GitHub-hosted x86_64 KVM run proving complete guest boot/exit, Copilot API-proxy inference, adversarial network and filesystem denial, timeout/cancellation cleanup, stale recovery, and concurrent-run isolation.