fix: enforce per-invocation Cloud Hypervisor enclave storage limits by Copilot · Pull Request #9397 · github/gh-aw-firewall

Copilot · 2026-10-02T23:00:33Z

Cloud Hypervisor enclaves need host-enforced writable storage limits across all exports: 1 GiB per script invocation and 512 MiB per agent invocation, without an unbounded fallback.

Bounded backing store
- Centralize invocation-private host tmpfs provisioning and unmounting.
- Require canonical paths, exact role capacity, expected ownership and mount options; reject missing, aliased, nested, or unverifiable mounts before use.
Memory accounting and lifecycle
- Add fixed storage headroom to enclave host cgroups so tmpfs writes do not exhaust the guest/VMM allowance before reaching the storage ceiling.
- Preserve journal-owned cleanup after VM/virtio-fs teardown, with ordinary unmount and fail-closed recovery.
- Leave guest limits, primary-agent budgets, closed exports, and release-attested artifacts unchanged.
Coverage and documentation
- Add sparse/concurrent aggregate ENOSPC, isolation, startup-rejection, busy-unmount, and cgroup-accounting coverage.
- Document the mechanism and failure behavior. Live guest-transport conformance remains gated on coordinated KVM/runtime wiring.

Fixes [awf] Enforce per-invocation storage limits for Cloud Hypervisor enclaves #9394

Copilot

Copilot review overview

🟡 Changes recommended

The privileged enforcement suite is not run in CI, and an existing broker fixture now inherits the real storage verifier and fails.

Review effort: Balanced
Findings: 1 · 1

Open (2)

Broker fixture must stub verifyStorage to prevent test failures · New
Acceptance tests are silently skipped in normal CI coverage · New

What changed in this PR

Adds host-enforced, per-invocation tmpfs storage limits for Cloud Hypervisor enclaves.

Changes:

Provisions and validates role-sized bounded storage.
Accounts for storage in enclave cgroups and cleanup lifecycle.
Adds unit, privileged integration, and architecture documentation coverage.

File	Description
`src/cloud-hypervisor/virtiofsd.ts`	Delegates bounded-storage verification.
`src/cloud-hypervisor/virtiofsd.test.ts`	Tests pre-launch verification.
`src/cloud-hypervisor/manager-start.ts`	Passes storage budget to cgroups.
`src/cloud-hypervisor/manager-launch.test.ts`	Verifies enclave-only accounting.
`src/cloud-hypervisor/launcher.ts`	Adds storage memory headroom.
`src/cloud-hypervisor/launcher.test.ts`	Tests cgroup limits and validation.
`src/cloud-hypervisor/host-enclave-executor.ts`	Integrates mount, verification, and unmount.
`src/cloud-hypervisor/host-enclave-executor.test.ts`	Tests startup rejection and cleanup.
`src/cloud-hypervisor/enclave-storage.ts`	Implements bounded storage lifecycle.
`src/cloud-hypervisor/enclave-storage.test.ts`	Tests storage identity validation.
`src/cloud-hypervisor/enclave-storage.integration.test.ts`	Exercises real tmpfs enforcement.
`docs/cloud-hypervisor-foundation.md`	Documents limits and failure behavior.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

    tools,
  );
  await onMounted();
+  await dependencies.verifyStorage(plan.invocationHostDir, resourceProfile.writableStorageBytes);


+
+// Exercise the host sources served by the closed guest-visible virtio-fs
+// exports. Live VM transport conformance is gated separately on KVM artifacts.
+(live ? describe : describe.skip)('host-enforced enclave storage', () => {


lpcox · 2026-10-02T23:34:56Z

@copilot address the review feedback

Copilot · 2026-10-02T23:43:29Z

@copilot address the review feedback

Addressed both points in 70fd0fe. I added a verifyStorage no-op to the broker test fixture, and the executor still uses the real verifier. I also added a step to the build-test-artifacts job in test-cloud-hypervisor.yml that runs enclave-storage.integration.test.ts as root in a private mount namespace, with sudo unshare --mount --propagation private and AWF_TEST_ENCLAVE_STORAGE=1. I ran that step's command here and all 6 tests passed.

github-actions · 2026-10-02T23:47:40Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-10-02T23:48:02Z

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

Download the docs-preview-pr-9397 artifact from the workflow run
Unzip and open index.html in your browser

Built from commit bae1655

github-actions · 2026-10-02T23:51:52Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	92.81%	92.89%	📈 +0.08%
Statements	91.29%	91.36%	📈 +0.07%
Functions	89.49%	89.49%	➡️ +0.00%
Branches	84.83%	84.93%	📈 +0.10%

📁 Per-file Coverage Changes (6 files)

File	Lines (Before → After)	Statements (Before → After)
`src/cloud-hypervisor/host-enclave-executor.ts`	95.1% → 95.1% (-0.06%)	91.6% → 91.5% (-0.11%)
`src/cloud-hypervisor/launcher.ts`	92.2% → 92.4% (+0.20%)	91.3% → 91.5% (+0.21%)
`src/cloud-hypervisor/virtiofsd.ts`	79.7% → 81.7% (+1.97%)	78.6% → 80.2% (+1.63%)
`src/log-directory-setup.ts`	96.8% → 100.0% (+3.18%)	96.9% → 100.0% (+3.13%)
`src/cloud-hypervisor/manager.test-utils.ts`	95.5% → 100.0% (+4.55%)	96.7% → 100.0% (+3.28%)
`src/cloud-hypervisor/manager-start.ts`	81.2% → 86.3% (+5.13%)	80.8% → 85.8% (+5.00%)

✨ New Files (1 files)

src/cloud-hypervisor/enclave-storage.ts: 92.7% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-10-03T00:02:45Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-10-03T00:02:46Z

✅ Smoke Claude passed

Generated by Smoke Claude for #9397

github-actions · 2026-10-03T00:02:48Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-10-03T00:02:49Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-10-03T00:02:49Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-10-03T00:02:50Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-10-03T00:02:51Z

Chroot tests failed Smoke Chroot failed - See logs for details.

Tested by Smoke Chroot

github-actions · 2026-10-03T00:02:53Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-10-03T00:02:55Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-10-03T00:02:56Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-10-03T00:02:57Z

Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor

github-actions · 2026-10-03T00:02:58Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-10-03T00:02:59Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-10-03T00:03:11Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #9397

github-actions · 2026-10-03T00:05:32Z

Smoke Test: Claude Engine Validation

API status: ✅ PASS
GitHub check: ✅ PASS
File status: ✅ PASS

Overall result: PASS

Generated by Smoke Claude for #9397 · claude · haiku45 · 49.8 AIC · ⊞ 6.2K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-10-03T00:05:38Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com → 200)
✅ Blocked domain (example.com blocked)

Overall: PASS — cc @lpcox

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-10-03T00:06:05Z

Services smoke test:

Redis PING ✅
pg_isready ✅
Postgres SELECT 1 ✅

PASS

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-10-03T00:06:09Z

OTEL smoke test results

✅ S1 Module loading: otel.js loads; exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, etc.
✅ S2 Tests: 3 OTEL suites, 68/68 passed
✅ S3 Env forwarding: trace ID/parent span ID forwarded to agent (env-passthrough.ts) and OTEL vars to api-proxy (api-proxy-env-config.ts)
✅ S4 Token tracker: onUsage hook present in token-tracker-http.js
✅ S5 Diagnostics: otel.jsonl present (1 line); no unexpected errors (post-step output not independently available)

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-10-03T00:06:15Z

Smoke Copilot: PASS

✅ GitHub MCP (last merged: "fix(ci): update Cloud Hypervisor smoke artifact bundles")
✅ github.com HTTP 200
✅ File write/read
Author: @Copilot · Assignees: @lpcox @Copilot

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-10-03T00:06:33Z

✅ Smoke Test: Copilot BYOK (Direct) Mode

Test Results:

✅ GitHub MCP: Connected (matched pre-fetched PR data)
✅ GitHub.com Connectivity: HTTP 200
✅ File Write/Read: Test file verified
✅ BYOK Inference: Running in direct mode via api-proxy → api.githubcopilot.com

Status: PASS

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) with api-proxy sidecar forwarding to api.githubcopilot.com.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-10-03T00:07:00Z

Smoke Test: Cloud Hypervisor + Copilot

PASS - list_pull_requests (merged, limit 1) returned PR [Blocked] Add live KVM conformance coverage for Cloud Hypervisor enclaves #9399 via GitHub MCP.
FAIL - curl https://github.com/ was denied at the sandbox tool level ("Permission denied and could not request permission from user"), not a firewall 200/301 response.
PASS - Wrote/read /tmp/gh-aw/agent/smoke-cloud-hypervisor-37080310331.txt successfully.
FAIL - curl (example.com/redacted) was also denied at the sandbox tool level (same permission error), so could not confirm 000/403.

Note: checks 2 and 4 could not run any outbound curl at all - the bash tool refused network commands uniformly (even curl --version-style network calls), reflecting a sandbox/tool restriction rather than the AWF firewall domain allow/deny behavior.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor
_{Add label ready-for-aw to run again}

github-actions · 2026-10-03T00:07:46Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	❌	not run	❌ FAIL
Bun	hono	❌	not run	❌ FAIL
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	❌	not run	❌ FAIL
Deno	std	❌	not run	❌ FAIL
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 6/8 ecosystems passed — FAIL

Failures

Bun and Deno: the install scripts (curl ... | bash / | sh) were blocked with "Permission denied and could not request permission from user". bun and deno are not preinstalled, so no tests ran.
Java note: with the default ~/.m2 repository Maven failed with LocalRepositoryNotAccessibleException. I reran with -Dmaven.repo.local pointed at a temp directory, and both projects passed.

Generated by Build Test Suite for #9397 · copilot · auto · 27.5 AIC · ⊞ 11.8K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-10-03T00:08:38Z

❌ Last 2 merged PRs
❌ PR details (2 PRs)
❌ Playwright title check
✅ Temp file write/read
❌ npm ci && npm run build
Overall status: FAIL

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

Initial plan

f5823cc

Copilot AI assigned Copilot and lpcox Oct 2, 2026

Copilot started work on behalf of lpcox October 2, 2026 23:01 View session

Copilot AI linked an issue Oct 2, 2026 that may be closed by this pull request

[awf] Enforce per-invocation storage limits for Cloud Hypervisor enclaves #9394

Closed

fix: enforce invocation-private Cloud Hypervisor enclave storage bounds

0c1c3a1

Copilot AI changed the title ~~[WIP] Update storage limits for Cloud Hypervisor enclaves~~ fix: enforce per-invocation Cloud Hypervisor enclave storage limits Oct 2, 2026

Copilot AI requested a review from lpcox October 2, 2026 23:21

Copilot finished work on behalf of lpcox October 2, 2026 23:21

lpcox marked this pull request as ready for review October 2, 2026 23:28

Copilot AI balanced review requested due to automatic review settings October 2, 2026 23:28

Copilot started reviewing on behalf of lpcox October 2, 2026 23:29 View session

Copilot AI reviewed Oct 2, 2026

View reviewed changes

Copilot started work on behalf of lpcox October 2, 2026 23:35 View session

test: run privileged enclave storage suite in CI

70fd0fe

Copilot finished work on behalf of lpcox October 2, 2026 23:43

lpcox added the ready-for-aw label Oct 3, 2026

lpcox had a problem deploying to aoai-model October 3, 2026 00:03 — with GitHub Actions Failure

github-actions Bot mentioned this pull request Oct 3, 2026

[aw] Smoke Chroot failed #9400

Open

github-actions Bot added the smoke-claude label Oct 3, 2026

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Oct 3, 2026

github-actions Bot added smoke-services smoke-otel labels Oct 3, 2026

github-actions Bot added the smoke-copilot label Oct 3, 2026

lpcox deployed to aoai-model October 3, 2026 00:06 — with GitHub Actions Active

github-actions Bot added the smoke-copilot-byok label Oct 3, 2026

lpcox deployed to aoai-model October 3, 2026 00:06 — with GitHub Actions Active

lpcox merged commit c0d221e into main Oct 3, 2026
137 of 141 checks passed

lpcox deleted the copilot/awf-enforce-per-invocation-storage-limits branch October 3, 2026 02:24

Conversation

Copilot AI commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

lpcox commented Oct 2, 2026

Uh oh!

Copilot AI commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Uh oh!

github-actions Bot commented Oct 2, 2026

Documentation Preview

Uh oh!

github-actions Bot commented Oct 2, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 3, 2026

Uh oh!

github-actions Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 3, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Oct 3, 2026

Uh oh!

github-actions Bot commented Oct 3, 2026

Uh oh!

github-actions Bot commented Oct 3, 2026

Uh oh!

github-actions Bot commented Oct 3, 2026

Uh oh!

github-actions Bot commented Oct 3, 2026

✅ Smoke Test: Copilot BYOK (Direct) Mode

Uh oh!

github-actions Bot commented Oct 3, 2026

Smoke Test: Cloud Hypervisor + Copilot

Uh oh!

Copilot AI commented Oct 2, 2026 •

edited

Loading

github-actions Bot commented Oct 3, 2026 •

edited

Loading

github-actions Bot commented Oct 3, 2026 •

edited

Loading

github-actions Bot commented Oct 3, 2026 •

edited

Loading

github-actions Bot commented Oct 3, 2026 •

edited

Loading

github-actions Bot commented Oct 3, 2026 •

edited

Loading

github-actions Bot commented Oct 3, 2026 •

edited

Loading

github-actions Bot commented Oct 3, 2026 •

edited

Loading

github-actions Bot commented Oct 3, 2026 •

edited

Loading

github-actions Bot commented Oct 3, 2026 •

edited

Loading

github-actions Bot commented Oct 3, 2026 •

edited

Loading

github-actions Bot commented Oct 3, 2026 •

edited

Loading

github-actions Bot commented Oct 3, 2026 •

edited

Loading

github-actions Bot commented Oct 3, 2026 •

edited

Loading