feat: add NVX Phase 3e live manager evidence - #8886
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Documentation PreviewDocumentation has been built for this PR. To view locally:
Built from commit 9c7632a |
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 92.02% | 92.03% | 📈 +0.01% |
| Statements | 90.51% | 90.52% | ➡️ +0.01% |
| Functions | 89.98% | 89.96% | 📉 -0.02% |
| Branches | 83.85% | 83.87% | 📈 +0.02% |
📁 Per-file Coverage Changes (3 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/nvx/preflight.ts |
64.6% → 64.9% (+0.31%) | 63.5% → 63.8% (+0.32%) |
src/nvx/artifact-manifest.ts |
86.9% → 87.7% (+0.81%) | 86.9% → 87.7% (+0.81%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The workflow path filter omits the new evidence script, so script-only changes bypass live KVM validation.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Adds release-attested NVX artifacts and live Phase 3e manager validation while keeping NVX unavailable through the runtime registry.
Changes:
- Adds tightly allowlisted validation-workflow attestation support.
- Publishes pinned NVX release artifacts.
- Validates guest boot, timeout cleanup, confinement, and residue removal.
| File | Description |
|---|---|
src/nvx/preflight.ts |
Supports an explicitly trusted signer workflow. |
src/nvx/preflight.test.ts |
Tests signer selection and rejection. |
src/nvx/index.ts |
Exports the validation signer constant. |
src/nvx/artifact-manifest.ts |
Validates either trusted signer identity. |
scripts/ci/nvx-manager-live-evidence.ts |
Runs live boot and timeout evidence cases. |
docs/nvx-security-design.md |
Documents the Phase 3e boundary. |
.github/workflows/release.yml |
Builds and publishes attested NVX artifacts. |
.github/workflows/nvx-phase-3b-live-kvm.yml |
Adds attested live-manager validation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 92.02% | 92.03% | 📈 +0.01% |
| Statements | 90.51% | 90.52% | ➡️ +0.01% |
| Functions | 89.98% | 89.96% | 📉 -0.02% |
| Branches | 83.85% | 83.87% | 📈 +0.02% |
📁 Per-file Coverage Changes (3 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/nvx/preflight.ts |
64.6% → 64.9% (+0.31%) | 63.5% → 63.8% (+0.32%) |
src/nvx/artifact-manifest.ts |
86.9% → 87.7% (+0.81%) | 86.9% → 87.7% (+0.81%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 92.04% | 92.08% | 📈 +0.04% |
| Statements | 90.52% | 90.57% | 📈 +0.05% |
| Functions | 89.98% | 89.96% | 📉 -0.02% |
| Branches | 83.87% | 83.92% | 📈 +0.05% |
📁 Per-file Coverage Changes (7 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/nvx/one-shot-adapter.ts |
81.3% → 80.7% (-0.59%) | 78.5% → 78.0% (-0.56%) |
src/nvx/launch-executor.ts |
85.8% → 85.4% (-0.42%) | 79.7% → 79.4% (-0.33%) |
src/nvx/filesystem-builder.ts |
88.5% → 89.1% (+0.64%) | 87.6% → 88.3% (+0.68%) |
src/nvx/artifact-manifest.ts |
86.9% → 87.7% (+0.81%) | 86.9% → 87.7% (+0.81%) |
src/nvx/manager.ts |
82.1% → 82.9% (+0.81%) | 82.0% → 82.8% (+0.73%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
src/nvx/preflight.ts |
64.6% → 72.0% (+7.43%) | 63.5% → 70.8% (+7.36%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
@copilot address review feedback |
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Added |
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
… nvx-phase-3e-live-evidence
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
lpcox
changed the title
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
✅ Build Test Suite completed successfully! Warning Firewall blocked 8 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.nuget.org"
- "bun.sh"
- "dc.services.visualstudio.com"
- "deno.land"
- "dl.deno.land"
- "github.com"
- "releaseassets.githubusercontent.com"
- "repo.maven.apache.org"See Network Configuration for more information.
|
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
🚀 Security Guard has started processing this pull request |
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
smoke-copilot-byok Results✅ GitHub MCP connectivity Status: PASS CC
|
Smoke Test: Cloud Hypervisor + Copilot
Result: ALL CHECKS PASSED Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"
- "github.com"See Network Configuration for more information.
|
|
Smoke Test: Copilot Engine — @lpcox
Recent merged PRs: #8890, #8889 Overall: PASS
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com) reachable — Overall: PASS cc @lpcox Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "api.github.com"
- "example.com"See Network Configuration for more information.
|
github-actions
Bot
added
smoke-copilot-network-isolation
|
Smoke Test: Services Connectivity
Overall: PASS
|
📡 OTel Tracing Smoke Test Results
Summary: All 5 scenarios pass. No regressions detected in the api-proxy OTEL tracing integration (module init, span creation, token attributes, context propagation, and graceful degradation all behave as expected). Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "o205451.ingest.us.sentry.io"See Network Configuration for more information.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Notes:
Warning Firewall blocked 8 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.nuget.org"
- "bun.sh"
- "dc.services.visualstudio.com"
- "deno.land"
- "dl.deno.land"
- "github.com"
- "releaseassets.githubusercontent.com"
- "repo.maven.apache.org"See Network Configuration for more information.
|
Smoke Test: Claude Engine Validation
Overall result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
Refactor finite disclosure into focused modules Warning Firewall blocked 12 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"
- "accounts.google.com"
- "api.github.com"
- "clients2.google.com"
- "collector.github.com"
- "contentautofill.googleapis.com"
- "github.com"
- "github.githubassets.com"
- "msfeed25.pkgs.visualstudio.com"
- "update.googleapis.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
Re-checked the PR: the only outstanding review finding (missing |
Chroot Version Comparison Results
Overall: FAILED — Node.js version mismatch between host and chroot environments (
|
Summary
NvxManagerend to end on GitHub-hosted x86_64 KVM for a successful guest boot and a wall-clock timeout casenvxunavailable through the runtime registry and CLIValidation
npm test -- --runInBand— 380 suites passed, 6,105 tests passed, 4 skippednpm run buildnpm run type-check -- --pretty falsenpm run lint -- --quietnpx markdownlint-cli2 docs/nvx-security-design.md --no-globsgit diff --checkRemaining promotion evidence
Runtime registration remains blocked on reviewed Copilot API-proxy inference, adversarial network and filesystem denial, cancellation, stale-recovery, and concurrent-run isolation evidence.