Add role-specific Cloud Hypervisor enclave export layouts by Copilot · Pull Request #9341 · github/gh-aw-firewall

Copilot · 2026-10-01T22:43:10Z

Cloud Hypervisor enclave layouts must expose only role-required inputs and writable paths, without inheriting the primary agent’s /workspace. Export plans derive from trusted host run state; enclave launches remain fail-closed pending host-executor integration.

Closed layouts: Script and agent plans mount the selected seed and invocation request read-only, with only per-invocation output and runtime directories writable. Agent plans additionally expose designated session handoff and state directories. Neither role exports /workspace.
Validation: Reject mismatched run, entry, invocation, or seed state; non-canonical, overlapping, or missing host sources; and out-of-profile targets, tags, modes, or mount overrides. Read-only access is enforced on the host.
Compatibility and gate: Preserve primary-agent export behavior. Keep script- and agent-enclave VM launches fail-closed.

const plan = await resolveCloudHypervisorEnclaveExportPlan(runState, invocation);
// plan.exports contains only the fixed, role-approved exports.

Fixes Add enclave-specific Cloud Hypervisor virtio-fs export layouts #9340

Copilot

Copilot review overview

🔵 Needs a closer look

Filesystem isolation needs human security review, and the networked guest boot contract remains unresolved.

Review effort: Balanced
Findings: 1 · 1

Open (2)

Workspace-less network agents violate the guest boot argument contract · New
Tests bypass workspace validation and use an incomplete export setup · New

What changed in this PR

Adds role-specific Cloud Hypervisor enclave filesystem layouts as a foundation for future host-executor integration.

Changes:

Defines bounded script and agent exports without /workspace.
Validates trusted source paths, identities, targets, and access modes.
Preserves primary-agent behavior and keeps enclave launches gated.

File	Description
src/cloud-hypervisor/workload-profile.ts	Integrates closed export plans and launch gates.
src/cloud-hypervisor/workload-profile.test.ts	Tests role layouts and profile rejection.
src/cloud-hypervisor/vm-config-builder.ts	Supports six workspace-less exports in boot arguments.
src/cloud-hypervisor/manager.test-utils.ts	Adds role-specific export fixtures.
src/cloud-hypervisor/manager-start.ts	Adjusts workspace-less export validation.
src/cloud-hypervisor/manager-launch.test.ts	Checks rejection before launch side effects.
src/cloud-hypervisor/manager-connectivity.test.ts	Updates enclave connectivity fixtures.
src/cloud-hypervisor/exports.ts	Adds configurable export-count validation.
src/cloud-hypervisor/enclave-network.test.ts	Updates network tests with export plans.
src/cloud-hypervisor/enclave-export-plan.ts	Resolves and validates trusted role layouts.
src/cloud-hypervisor/enclave-export-plan.test.ts	Tests layouts, paths, permissions, and boot arguments.
docs/cloud-hypervisor-foundation.md	Documents layouts, trust boundaries, and execution gates.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+        entryId: options.enclaveId,
+        invocationId: options.invocationId,
+      }),
+      workspaceMount: null,


+    expect(() => createScriptEnclaveCloudHypervisorProfile({
+      enclaveId: 'script-entry',
+      invocationId: 'invocation',
+      guest: supervisor,
+      exportPlan: { ...plan, exports: [workspaceExport] },
+    })).toThrow();


lpcox · 2026-10-01T23:18:47Z

@copilot address review feedback

Copilot · 2026-10-01T23:26:50Z

@copilot address review feedback

Addressed in 12773c4: workspace-less networked enclave boot now parses, generated agent arguments are checked against the guest parser, and workspace-export tests assert the specific seed-export rejection.

github-actions · 2026-10-01T23:28:21Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-10-01T23:28:40Z

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

Download the docs-preview-pr-9341 artifact from the workflow run
Unzip and open index.html in your browser

Built from commit 20aca3a

github-actions · 2026-10-01T23:32:45Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	92.82%	92.78%	📉 -0.04%
Statements	91.33%	91.30%	📉 -0.03%
Functions	89.37%	89.35%	📉 -0.02%
Branches	84.57%	84.61%	📈 +0.04%

📁 Per-file Coverage Changes (5 files)

File	Lines (Before → After)	Statements (Before → After)
`src/cloud-hypervisor/manager-start.ts`	86.3% → 81.2% (-5.13%)	85.8% → 80.8% (-5.00%)
`src/cloud-hypervisor/manager.test-utils.ts`	100.0% → 95.5% (-4.55%)	100.0% → 96.7% (-3.28%)
`src/cloud-hypervisor/workload-profile.ts`	100.0% → 99.1% (-0.86%)	100.0% → 99.2% (-0.82%)
`src/cloud-hypervisor/exports.ts`	92.6% → 92.7% (+0.09%)	89.5% → 89.7% (+0.12%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (1 files)

src/cloud-hypervisor/enclave-export-plan.ts: 90.9% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-10-01T23:50:34Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-10-01T23:50:34Z

✅ Smoke Claude passed

Generated by Smoke Claude for #9341

github-actions · 2026-10-01T23:50:35Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-10-01T23:50:37Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-10-01T23:50:38Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-10-01T23:50:38Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-10-01T23:50:39Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-10-01T23:50:42Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #9341

github-actions · 2026-10-01T23:50:43Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-10-01T23:50:45Z

Smoke Cloud Hypervisor reports failed. Cloud Hypervisor + Copilot failed.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor

github-actions · 2026-10-01T23:50:46Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-10-01T23:50:48Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-10-01T23:50:49Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-10-01T23:50:52Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-10-01T23:53:37Z

Smoke Test: Claude Engine Validation

API status: ✅ PASS
GitHub check: ✅ PASS
File status: ✅ PASS

Overall result: PASS

Generated by Smoke Claude for #9341 · claude · haiku45 · 49.8 AIC · ⊞ 6.2K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-10-01T23:53:53Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com): HTTP 200
✅ Blocked domain (example.com): blocked (curl failed, cert error)

Overall: PASS — cc @lpcox

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-10-01T23:53:53Z

Smoke Test: Copilot BYOK (Direct) Mode ✅ PASS

Test	Status
GitHub MCP Connectivity	✅
GitHub.com HTTP	✅ (200)
File Write/Read	✅
BYOK Inference Path	✅

Mode: Direct BYOK (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-10-01T23:54:07Z

Smoke Copilot: PASS

✅ GitHub MCP (latest merged: "Reuse shared logger mock in branch-coverage tests")
✅ github.com HTTP 200
✅ File write/read
Author @Copilot; assignees @lpcox @Copilot

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-10-01T23:54:42Z

OTEL smoke test

✅ S1: otel.js loads; exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, and others.
✅ S2: 3 OTEL suites, 68/68 tests pass.
✅ S3: env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID/PARENT_SPAN_ID. api-proxy-env-config.ts forwards the OTEL vars to the api-proxy.
✅ S4: the onUsage hook is present in token-tracker-http.js.
✅ S5: otel.jsonl has 1 line, which I counted but did not inspect. I did not check for OTLP exports.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-10-01T23:55:01Z

Services smoke test:

Redis PING: ✅ PONG
pg_isready: ✅ accepting connections
psql SELECT 1: ✅ 1

Overall: PASS

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-10-01T23:55:14Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	❌	not run	❌ FAIL
Bun	hono	❌	not run	❌ FAIL
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	❌	not run	❌ FAIL
Deno	std	❌	not run	❌ FAIL
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	all passed	✅ PASS
Go	env	✅	all passed	✅ PASS
Go	uuid	✅	all passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS*
Java	caffeine	✅	1/1 passed	✅ PASS*
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 6/8 ecosystems passed — FAIL

Failures

Bun / Deno: The sandbox denied the install commands (curl ... | bash / | sh): "Permission denied and could not request permission from user". bun and deno are not on the PATH, so these tests were not run. I did not try to work around this.
*Java: with the default ~/.m2/repository, Maven failed with Could not create local repository at /home/runner/.m2/repository. With -Dmaven.repo.local pointed at a writable temp directory, compile and test passed for both projects.

Generated by Build Test Suite for #9341 · copilot · auto · 25.1 AIC · ⊞ 11.8K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-10-01T23:55:19Z

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.21.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: Not all tests passed (Node.js version mismatch), so the smoke-chroot label was not added.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-10-01T23:55:48Z

Smoke test results

Last 2 merged PRs: ❌
2 PR details: ❌
Playwright title check: ❌
Temp file write/read: ❌
AWF build: ❌
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

Initial plan

9d129b8

Copilot AI assigned Copilot and lpcox Oct 1, 2026

Copilot started work on behalf of lpcox October 1, 2026 22:43 View session

Copilot AI linked an issue Oct 1, 2026 that may be closed by this pull request

Add enclave-specific Cloud Hypervisor virtio-fs export layouts #9340

Closed

feat: plan enclave virtio-fs export layouts

c2af7ae

Copilot AI changed the title ~~[WIP] Add enclave-specific Cloud Hypervisor virtio-fs export layouts~~ Add role-specific Cloud Hypervisor enclave export layouts Oct 1, 2026

Copilot finished work on behalf of lpcox October 1, 2026 23:00

Copilot AI requested a review from lpcox October 1, 2026 23:00

lpcox marked this pull request as ready for review October 1, 2026 23:03

Copilot AI balanced review requested due to automatic review settings October 1, 2026 23:03

Copilot started reviewing on behalf of lpcox October 1, 2026 23:04 View session

Copilot AI reviewed Oct 1, 2026

View reviewed changes

Copilot started work on behalf of lpcox October 1, 2026 23:19 View session

fix: allow workspace-less networked enclave boot

12773c4

Copilot finished work on behalf of lpcox October 1, 2026 23:27

lpcox added the ready-for-aw label Oct 1, 2026

lpcox had a problem deploying to aoai-model October 1, 2026 23:50 — with GitHub Actions Failure

github-actions Bot added smoke-claude smoke-copilot-network-isolation Copilot network-isolation egress smoke test labels Oct 1, 2026

github-actions Bot added the smoke-copilot-byok label Oct 1, 2026

lpcox deployed to aoai-model October 1, 2026 23:53 — with GitHub Actions Active

github-actions Bot added the smoke-copilot label Oct 1, 2026

lpcox deployed to aoai-model October 1, 2026 23:54 — with GitHub Actions Active

github-actions Bot added the smoke-services label Oct 1, 2026

lpcox merged commit f88e087 into main Oct 2, 2026
135 of 141 checks passed

lpcox deleted the copilot/add-virtio-fs-export-layouts branch October 2, 2026 00:05

lpcox mentioned this pull request Oct 2, 2026

Enforce enclave resource limits inside Cloud Hypervisor guests #9347

Closed

Copilot AI mentioned this pull request Oct 2, 2026

Enforce Cloud Hypervisor enclave resource limits #9349

Merged

lpcox mentioned this pull request Oct 2, 2026

Implement the host-side Cloud Hypervisor enclave executor #9375

Closed

Copilot AI mentioned this pull request Oct 2, 2026

feat: implement host-side Cloud Hypervisor enclave executor #9376

Merged

Conversation

Copilot AI commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

lpcox commented Oct 1, 2026

Uh oh!

Copilot AI commented Oct 1, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026

Documentation Preview

Uh oh!

github-actions Bot commented Oct 1, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 1, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 1, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Oct 1, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented Oct 1, 2026

Copilot AI commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading