Repository navigation
feat: correlate enclave handoff and VMM launch diagnostics - #10066
Conversation
Preserve protected invocation correlation and shared launch milestones without changing caller errors or runtime policy. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 417ff0fc-9c06-4eb0-9f53-a998f99d7fd3
Documentation PreviewDocumentation has been built for this PR. To view locally:
Built from commit bb81255 |
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (8 files)
Coverage comparison generated by |
There was a problem hiding this comment.
🟡 Changes recommended
Diagnostic records can misreport launch outcomes and lose or mix original failure details.
5 open findings
What changed in this PR
Adds protected, correlated diagnostics across AWF enclave handoffs and Cloud Hypervisor startup.
Changes:
- Correlates host-control events with invocation IDs and sequence numbers.
- Adds launch milestones and partial-start cleanup reporting.
- Expands regression coverage and documents activation requirements.
| File | Description |
|---|---|
src/enclave/host-executor-server.ts |
Attaches invocation IDs to control events. |
src/enclave/host-executor-journal.ts |
Adds validated event identity and sequencing. |
src/enclave/host-executor-invocation-diagnostics.test.ts |
Tests correlation, filtering, and bounds. |
src/enclave/host-executor-broker.test.ts |
Checks handoff and rejection correlation. |
src/enclave/cloud-hypervisor-lifecycle.test.ts |
Covers protected evidence export during failed shutdown. |
src/cloud-hypervisor/manager.ts |
Instruments boot and guest connection. |
src/cloud-hypervisor/manager-start.ts |
Records launch and cleanup milestones. |
src/cloud-hypervisor/manager-launch-evidence.test.ts |
Adds launch-evidence regression cases. |
src/cloud-hypervisor/host-preflight-schema.ts |
Defines launch checks. |
src/cloud-hypervisor/host-enclave-executor.ts |
Passes the launch reporter into managers. |
src/cloud-hypervisor/host-enclave-executor.test.ts |
Verifies reporter wiring. |
src/cloud-hypervisor/enclave-executor-types.ts |
Extends the manager factory interface. |
docs/cloud-hypervisor-foundation.md |
Explains evidence interpretation and deployment requirements. |
🧠 Review effort: Max
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| (deps.rm as jest.Mock).mockImplementation(async () => { | ||
| expect(JSON.parse(readHostExecutorInvocationDiagnostics(run)[0].contents)).toMatchObject({ | ||
| failure: { stage: 'vm-launch/vm-create', reason: 'EACCES' }, | ||
| }); | ||
| throw Object.assign(new Error('PRIVATE_CLEANUP'), { code: 'EIO' }); | ||
| }); | ||
| const manager = new CloudHypervisorManager( | ||
| config(), '/tmp/awf', deps, 'evidence', networkConfig(), undefined, undefined, false, | ||
| report.fork('vm-launch'), | ||
| ); | ||
| await expect(diagnostic.check(report, 'manager-start', () => manager.start())) | ||
| .rejects.toThrow('partial-start cleanup also failed'); |
| const child = context.launchReport | ||
| ? context.launchReport.checkSync('vmm-launch', launch) : launch(); |
| if (context.launchReport) { | ||
| await context.launchReport.fork('host-invocation-cleanup').check('manager-stop', () => context.stop()); |
| try { | ||
| await context.stop(); | ||
| if (context.launchReport) { | ||
| await context.launchReport.fork('host-invocation-cleanup').check('manager-stop', () => context.stop()); |
|
@copilot adddress review feedback |
Addressed in commit |
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅
|
|
✅ Smoke Claude passed
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed.
|
|
🚀 Security Guard has started processing this pull request |
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
✅ Build Test Suite completed successfully!
|
|
💎 Smoke Gemini is crystallizing results on this pull request... |
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
🔑 Smoke Copilot BYOK AOAI (api-key) is testing Azure OpenAI BYOK (api-key) mode on this pull request... |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟
|
|
🪪 Smoke Copilot BYOK AOAI (Entra) is testing Azure OpenAI BYOK (Entra / GitHub OIDC) mode on this pull request... |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
Smoke Test: Claude Engine Validation
Overall result: PASS
|
|
Services smoke test: ✅ Redis PONG · ✅ pg_isready accepting connections · ✅ SELECT 1 = 1. PASS
|
|
Cloud Hypervisor + Copilot smoke test
|
🟢 Smoke Test: Copilot BYOK (Direct) Mode — PASSTests:
Running in direct BYOK mode via cc/ @lpcox
|
|
EGRESS_RESULT allow=pass deny=pass
Overall: PASS — cc @lpcox
|
github-actions
Bot
added
the
smoke-copilot-network-isolation
|
OTEL smoke test
|
|
Smoke Copilot — PR: "feat: correlate enclave handoff and VMM launch diagnostics"
|
Smoke Test
|
Chroot version comparison
Not all tests passed: the Node.js versions differ, so the
|
🏗️ Build Test Suite Results
Overall: 6/8 ecosystems passed — FAIL Failures:
The
|
Summary
Validation
npm run buildandnpm run type-checkpass.git diff --checkpasses.Activation limitations
These new host checks require an AWF host binary built with this instrumentation. A main checkout SHA does not update a release-pinned binary. The existing broker exchange audit requires its corresponding updated enclave MCP image; existing script guest milestones still require a rebuilt, release-attested guest rootfs. The new host diagnostics themselves need no guest-rootfs rebuild. A run pinned to v0.28.59 cannot emit these new diagnostics, and this PR does not claim a root cause for run 38842179031 or retroactively add evidence to it.