feat: add durable identity-validated microVM cleanup by lpcox · Pull Request #7896 · github/gh-aw-firewall

lpcox · 2026-08-31T15:14:39Z

Summary

persist atomic root-owned Cloud Hypervisor cleanup records before privileged resources become live
revalidate process, namespace, interface, cgroup, run-directory, mount, and firewall-rule identities before stale cleanup
preserve uncertain evidence, protect sibling runs, and cover normal, partial, signal, process-death, and preserve paths

Validation

npm test -- --runInBand (330 suites, 5284 tests)
npm run build
npx markdownlint-cli2 docs/cloud-hypervisor-foundation.md
bash -n scripts/ci/cloud-hypervisor-live-smoke.sh
live KVM process-death recovery coverage added to the labeled Cloud Hypervisor workflow (not runnable on this macOS host)

Persist identity-validated Cloud Hypervisor cleanup records. Safely reap stale resources after abrupt owner death. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-08-31T15:15:10Z

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit 0a9ad2b

github-actions · 2026-08-31T15:18:07Z

🚀 Security Guard has started processing this pull request

Copilot

Copilot review overview

🟡 Changes recommended

Process identity can misclassify active runs after binary replacement, and iptables deletion failures can discard recovery records.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1 · 1

New issues introduced by this change (2)

Severity	Finding
	`src/cloud-hypervisor/cleanup-registry.ts` — The executable identity is taken from the resolved pathname rather than from the running executable…
	`src/microvm/network-commands.ts` — This treats every iptables deletion failure as successful. `MicrovmNetworkManager.cleanup()` then…

What changed in this PR

Adds durable, identity-validated recovery for Cloud Hypervisor resources after abrupt termination.

Changes:

Persists and reaps per-run cleanup records.
Tracks network, process, cgroup, mount, and directory identities.
Adds unit and live-KVM recovery coverage.

File	Description
`src/microvm/network.ts`	Exports the resource observer type.
`src/microvm/network.test.ts`	Tests resource observation and tagged rules.
`src/microvm/network-types.ts`	Defines rule comments and resource observers.
`src/microvm/network-plan.ts`	Generates per-run rule comments.
`src/microvm/network-manager.ts`	Reports created resources and uses tagged rules.
`src/microvm/network-commands.ts`	Adds comments to iptables rules.
`src/cloud-hypervisor/vm-config-builder.test.ts`	Updates network-plan fixture.
`src/cloud-hypervisor/virtiofsd.ts`	Records virtiofsd process identities.
`src/cloud-hypervisor/manager.ts`	Integrates the cleanup registry.
`src/cloud-hypervisor/manager.test.ts`	Tests cleanup-record lifecycle.
`src/cloud-hypervisor/manager-types.ts`	Extends manager dependency contracts.
`src/cloud-hypervisor/manager-stop.ts`	Completes records after teardown.
`src/cloud-hypervisor/manager-start.ts`	Reaps stale records and captures resources.
`src/cloud-hypervisor/cleanup-registry.ts`	Implements durable validated cleanup.
`src/cloud-hypervisor/cleanup-registry.test.ts`	Tests registry recovery behavior.
`scripts/ci/cloud-hypervisor-live-smoke.sh`	Adds abrupt-death recovery coverage.
`docs/cloud-hypervisor-foundation.md`	Documents durable cleanup semantics.
`.github/workflows/test-cloud-hypervisor.yml`	Detects namespace and rule residue.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-08-31T15:19:34Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	93.86%	92.98%	📉 -0.88%
Statements	92.67%	91.62%	📉 -1.05%
Functions	93.24%	92.15%	📉 -1.09%
Branches	86.14%	84.87%	📉 -1.27%

📁 Per-file Coverage Changes (7 files)

File	Lines (Before → After)	Statements (Before → After)
`src/microvm/network-commands.ts`	97.8% → 96.0% (-1.77%)	97.9% → 96.2% (-1.69%)
`src/cloud-hypervisor/manager-start.ts`	98.2% → 97.0% (-1.25%)	98.3% → 95.7% (-2.65%)
`src/microvm/network-manager.ts`	98.4% → 98.5% (+0.11%)	96.9% → 97.1% (+0.22%)
`src/cloud-hypervisor/manager-stop.ts`	94.6% → 94.7% (+0.14%)	89.1% → 89.5% (+0.42%)
`src/cloud-hypervisor/manager.ts`	88.9% → 89.1% (+0.21%)	87.5% → 87.7% (+0.21%)
`src/cloud-hypervisor/virtiofsd.ts`	77.7% → 78.3% (+0.58%)	74.8% → 75.5% (+0.62%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (1 files)

src/cloud-hypervisor/cleanup-registry.ts: 65.4% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

Capture executable inode identity from the live procfs object. Verify firewall rule absence after deletion. Cover cleanup races at base coverage levels. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 92d2c346-d396-40d3-8b74-1f1447a04871

github-actions · 2026-08-31T15:45:50Z

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-08-31T15:50:16Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	92.92%	93.10%	📈 +0.18%
Statements	91.70%	91.80%	📈 +0.10%
Functions	92.12%	92.17%	📈 +0.05%
Branches	85.30%	85.56%	📈 +0.26%

📁 Per-file Coverage Changes (9 files)

File	Lines (Before → After)	Statements (Before → After)
`src/cloud-hypervisor/manager-start.ts`	95.5% → 93.8% (-1.63%)	95.7% → 92.8% (-2.80%)
`src/microvm/network-commands.ts`	98.0% → 96.5% (-1.51%)	98.2% → 96.7% (-1.52%)
`src/cloud-hypervisor-runtime-backend.ts`	96.1% → 96.1% (+0.00%)	93.5% → 93.5% (+0.02%)
`src/cloud-hypervisor/virtiofsd-sandbox.ts`	100.0% → 100.0% (+0.00%)	100.0% → 99.3% (-0.74%)
`src/microvm/network-manager.ts`	98.5% → 98.6% (+0.09%)	97.2% → 97.4% (+0.18%)
`src/cloud-hypervisor/manager-stop.ts`	94.6% → 94.7% (+0.14%)	89.1% → 89.5% (+0.42%)
`src/cloud-hypervisor/manager.ts`	89.6% → 90.0% (+0.44%)	88.2% → 88.7% (+0.47%)
`src/cloud-hypervisor/virtiofsd.ts`	79.7% → 80.6% (+0.86%)	78.2% → 79.1% (+0.86%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (1 files)

src/cloud-hypervisor/cleanup-registry.ts: 98.4% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

Resolve Cloud Hypervisor lifecycle overlaps. Preserve durable cleanup and current runtime confinement. Assign the VMM cgroup before durable identity capture. This avoids a PID-reuse window. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 92d2c346-d396-40d3-8b74-1f1447a04871

Ensure VMM cgroup assignment precedes durable process identity capture. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 92d2c346-d396-40d3-8b74-1f1447a04871

github-actions · 2026-08-31T16:38:49Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-08-31T16:38:51Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-08-31T16:38:52Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-08-31T16:38:54Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-08-31T16:38:54Z

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Docker Sbx

github-actions · 2026-08-31T16:38:55Z

✅ Contribution Check completed successfully!

PR #7896 follows CONTRIBUTING.md sufficiently for this review. The description is clear, references the change and validation, the new functionality includes tests, documentation is updated, and the new files are placed in the expected src/, docs/, scripts/ci/, and workflow locations. No comment needed.

Generated by Contribution Check for #7896

github-actions · 2026-08-31T16:38:57Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-08-31T16:38:58Z

✅ Smoke Claude passed

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #7896

github-actions · 2026-08-31T16:38:59Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-08-31T16:39:02Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-08-31T16:39:04Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

msfeed25.pkgs.visualstudio.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-08-31T16:39:06Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #7896

github-actions · 2026-08-31T16:39:13Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-08-31T18:33:11Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

msfeed25.pkgs.visualstudio.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-08-31T18:33:11Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-08-31T18:33:12Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-08-31T18:33:16Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-08-31T18:33:17Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-08-31T18:33:17Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #7896

github-actions · 2026-08-31T18:33:17Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-08-31T18:33:26Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-08-31T18:33:39Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-08-31T18:33:45Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-08-31T18:33:50Z

❌ Contribution Check failed. Please review the logs for details.

Generated by Contribution Check for #7896

github-actions · 2026-08-31T18:36:50Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable: allowed=200
✅ Blocked domain (example.com) denied: proxy 403 (denied=000)

Overall: PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T18:36:59Z

Smoke Test: Claude Engine Validation

Check	Status
API	✅ PASS
GH	✅ PASS
File	✅ PASS

Overall result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #7896 · claude · haiku45 · 32.7 AIC · ⊞ 4.5K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T18:37:06Z

Smoke Test: Copilot Engine — @lpcox

✅ MCP: PR feat: isolate Cloud Hypervisor with per-run VMM identities #7894 "feat: isolate Cloud Hypervisor with per-run VMM identities"
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T18:37:24Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.19.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: Not all tests passed (Node.js version mismatch between host and chroot). The smoke-chroot label was not added.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T18:37:51Z

Smoke Test

feat: isolate Cloud Hypervisor with per-run VMM identities
feat: reserve microVM network resources atomically
GitHub queries, file write/read, bash check, build, Playwright: ✅
Discussion comment: ❌ discussions:write unavailable
Safe-input GH tools: ❌ unavailable; used gh fallback
Overall: FAIL

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

msfeed25.pkgs.visualstudio.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T18:37:52Z

Docker Sbx Smoke Test — @lpcox

MCP connectivity (list_pull_requests): ✅
github.com connectivity (HTTP 200): ✅
File write/read: ✅

Overall: PASS

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T18:38:09Z

Smoke Test: GitHub Actions Services Connectivity

Redis PING: ❌ (Temporary failure in name resolution)
PostgreSQL pg_isready: ❌ (no response)
PostgreSQL SELECT 1: ❌ (could not translate host name)

Overall: FAIL — host.docker.internal could not be resolved from the AWF sandbox; no connectivity to host service containers.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T18:38:46Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A (ran successfully)	✅ PASS
.NET	json-parse	✅	N/A (ran successfully)	✅ PASS
Go	color	✅	ok	✅ PASS
Go	env	✅	ok	✅ PASS
Go	uuid	✅	ok	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Notes:

Java: the default ~/.m2 directory was root-owned in this environment (pre-existing, unrelated to the firewall) and blocked Maven's local repository creation. Worked around by pointing Maven at an alternate local repo path (-Dmaven.repo.local); the Squid proxy settings in ~/.m2/settings.xml were used as configured and all dependency downloads succeeded through the firewall.
All other ecosystems completed cleanly with no proxy/network issues.

Generated by Build Test Suite for #7896 · copilot · auto · 34 AIC · ⊞ 12K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T18:38:56Z

Smoke Test: Copilot BYOK (Direct Mode) ✅ PASS

✅ GitHub MCP connectivity verified
✅ HTTP 200 to github.com
✅ File write/read operational
✅ Direct BYOK mode via api-proxy sidecar → api.githubcopilot.com

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY forwarded to api-proxy).

@lpcox

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T18:39:04Z

PR listing via MCP: ❌
GitHub.com connectivity: ✅
File write/read test: ✅
BYOK inference path: ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra

Overall: FAIL

@lpcox

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T18:39:05Z

feat: isolate Cloud Hypervisor with per-run VMM identities: ❌
feat: reserve microVM network resources atomically: ❌
GitHub.com connectivity: ✅
File I/O test: ✅
BYOK inference test: ✅
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Overall: FAIL
@lpcox

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T18:39:07Z

OTel Tracing Smoke Test Results

✅ Scenario 1 (Module Loading): otel.js loads successfully, isEnabled(): true, exports include startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown.
✅ Scenario 2 (Test Suite): otel*.test.js suites executed via jest (--testPathPattern='otel'), no failures reported.
✅ Scenario 3 (Env Var Forwarding): env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID/GITHUB_AW_OTEL_PARENT_SPAN_ID to the agent; api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, and the trace-id/span-id vars to the api-proxy.
✅ Scenario 4 (Token Tracker Integration): token-tracker-http.js implements the onUsage callback hook used for OTEL usage attributes.
✅ Scenario 5 (OTEL Diagnostics): workflow-level OTLP export produced spans (/tmp/gh-aw/otel.jsonl, resource service.name=gh-aw.smoke-otel-tracing); api-proxy sidecar logs show 8 token-tracker-audit records and 4 token-usage records for this run (no dedicated api-proxy/otel.jsonl file present — api-proxy is configured to export via GH_AW_OTLP_ENDPOINTS, not the local NDJSON fallback, which is expected).

All scenarios passed. No regressions detected in OTEL tracing integration.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

feat: add durable microvm cleanup

72e6b27

Persist identity-validated Cloud Hypervisor cleanup records. Safely reap stale resources after abrupt owner death. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings August 31, 2026 15:14

Copilot started reviewing on behalf of lpcox August 31, 2026 15:15 View session

lpcox changed the title ~~Add durable identity-validated microVM cleanup~~ feat: add durable identity-validated microVM cleanup Aug 31, 2026

lpcox added the cloud-hypervisor-kvm Trigger the Cloud Hypervisor live-KVM smoke/security suite label Aug 31, 2026

Copilot AI reviewed Aug 31, 2026

View reviewed changes

Comment thread src/cloud-hypervisor/cleanup-registry.ts Outdated

Comment thread src/microvm/network-commands.ts Outdated

github-actions Bot mentioned this pull request Aug 31, 2026

fix: filter workflow commands from microVM output #7892

Merged

lpcox added 2 commits August 31, 2026 09:29

test: lock cgroup assignment ordering

939f0ee

Ensure VMM cgroup assignment precedes durable process identity capture. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 92d2c346-d396-40d3-8b74-1f1447a04871

lpcox added the ready-for-aw label Aug 31, 2026

lpcox had a problem deploying to aoai-model August 31, 2026 16:38 — with GitHub Actions Failure

lpcox temporarily deployed to aoai-model August 31, 2026 18:33 — with GitHub Actions Inactive

lpcox temporarily deployed to aoai-model August 31, 2026 18:38 — with GitHub Actions Inactive

lpcox temporarily deployed to aoai-model August 31, 2026 18:39 — with GitHub Actions Inactive

lpcox merged commit 1d56936 into main Aug 31, 2026
163 of 167 checks passed

lpcox deleted the lpcox-durable-microvm-cleanup branch August 31, 2026 18:45

lpcox mentioned this pull request Aug 31, 2026

fix: stabilize post-merge KVM checks #7922

Merged

github-actions Bot mentioned this pull request Aug 31, 2026

fix: preserve sparse rootfs staging #7920

Merged

Uh oh!

Conversation

lpcox commented Aug 31, 2026

Summary

Validation

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Preview

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading