test: run privileged enclave storage suite in CI

Author: Copilot

.github/workflows/test-cloud-hypervisor.yml

@@ -69,6 +69,24 @@ jobs:
             "$RUNNER_TEMP/microvm-supervisor.test" \
             -test.run '^TestEnclaveGuestLimitsLive$' -test.count=1 -test.v
 
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22'
+          cache: npm
+
+      - name: Run privileged enclave host storage enforcement suite
+        # Mounts the real role-sized invocation tmpfs backing stores and
+        # host memory cgroups in a private mount namespace, then proves
+        # aggregate ENOSPC, isolation, cgroup accounting, and busy-unmount
+        # behavior. The suite is skipped without AWF_TEST_ENCLAVE_STORAGE.
+        run: |
+          npm ci
+          sudo unshare --mount --propagation private \
+            env "PATH=$PATH" AWF_TEST_ENCLAVE_STORAGE=1 \
+            npx jest --ci --runInBand \
+            src/cloud-hypervisor/enclave-storage.integration.test.ts
+
       - name: Install deterministic guest build prerequisites
         run: |
           sudo apt-get update

docs/cloud-hypervisor-foundation.md

@@ -304,6 +304,8 @@ unmount failure. It also fills storage in the production host cgroup budget whil
 holding the guest-RAM equivalent resident, with swap disabled, to check that
 storage exhaustion is not preempted by a cgroup OOM. Run it as root in a private mount namespace with
 `AWF_TEST_ENCLAVE_STORAGE=1 npm test -- --runInBand enclave-storage.integration.test.ts`.
+The `build-test-artifacts` job in `.github/workflows/test-cloud-hypervisor.yml`
+runs this suite on every matching pull request via `sudo unshare --mount --propagation private`.
 Live guest transport conformance additionally requires the release-attested role
 artifacts and KVM runtime wiring.
 

src/enclave/host-executor-broker.test.ts

@@ -119,6 +119,7 @@ describe('finite-disclosure broker → authenticated Unix host → concrete micr
       copySparseFile: noop,
       removeArtifactSnapshot: async (directory) => fs.rm(directory, { recursive: true, force: true }),
       mountTmpfs: noop,
+      verifyStorage: noop,
       unmount: async () => {
         cleaned();
         if (cleanupError) throw new Error('PRIVATE_RAW_CLEANUP_ERROR');