Repository navigation
feat(nvx): bind Phase 3 resources to one run identity - #8802
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6b7bb21d-a74b-4061-b1d0-ae2a18df7a8c
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Documentation PreviewDocumentation has been built for this PR. To view locally:
Built from commit cbf2e6e |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Snapshot cleanup can delete a noncanonical root path, and truncated namespace names can collide across valid run IDs.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (2)
What changed in this PR
Introduces a canonical, identity-bound NVX run layout for Phase 3 resources and validates its use across preflight, confinement, and cleanup.
Changes:
- Derives privileged resource paths from a validated 32-character run ID.
- Enforces canonical artifact snapshots and matching confinement directories.
- Aligns cleanup validation and documents the unified layout.
| File | Description |
|---|---|
src/nvx/run-layout.ts |
Defines canonical run resources and guest-path translation. |
src/nvx/run-layout.test.ts |
Tests layout derivation and translation. |
src/nvx/preflight.ts |
Creates and validates identity-bound snapshots. |
src/nvx/preflight.test.ts |
Tests canonical snapshot enforcement. |
src/nvx/paths.ts |
Adds the cleanup-root constant. |
src/nvx/index.ts |
Exports run-layout APIs. |
src/nvx/confinement.ts |
Requires artifact and writable directories to share an ID. |
src/nvx/confinement.test.ts |
Tests cross-run directory rejection. |
src/nvx/cleanup-record.ts |
Validates cleanup resources against the canonical layout. |
src/nvx/cleanup-record.test.ts |
Updates canonical namespace expectations. |
docs/nvx-security-design.md |
Documents the identity-bound layout. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| runDirectory: path.join(NVX_RUN_DIRECTORY_ROOT, runId), | ||
| cleanupRecordPath: path.join(NVX_CLEANUP_ROOT, `${runId}.json`), | ||
| cgroupPath: path.join(NVX_CGROUP_ROOT, runId), | ||
| networkNamespace: `awfnvx-${runId.slice(0, 20)}`, |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 93.28% | 93.26% | 📉 -0.02% |
| Statements | 91.95% | 91.94% | 📉 -0.01% |
| Functions | 92.16% | 91.93% | 📉 -0.23% |
| Branches | 85.78% | 85.81% | 📈 +0.03% |
📁 Per-file Coverage Changes (4 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/nvx/confinement.ts |
87.8% → 88.0% (+0.17%) | 82.9% → 83.1% (+0.21%) |
src/nvx/cleanup-record.ts |
82.9% → 83.3% (+0.41%) | 82.1% → 82.5% (+0.41%) |
src/nvx/preflight.ts |
61.0% → 64.3% (+3.28%) | 59.8% → 63.1% (+3.35%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
✨ New Files (1 files)
src/nvx/run-layout.ts: 100.0% lines
Coverage comparison generated by scripts/ci/compare-coverage.ts
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
📰 DEVELOPING STORY: Smoke Docker Sbx reports failed. Our correspondents are investigating the incident...
|
|
🚀 Security Guard has started processing this pull request |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 8 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "msfeed25.pkgs.visualstudio.com"
- "update.googleapis.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅
|
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...
|
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
✅ Build Test Suite completed successfully!
|
This comment has been minimized.
This comment has been minimized.
github-actions
Bot
added
the
smoke-copilot-network-isolation
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
✅ Build Test Suite completed successfully!
|
|
🚀 Security Guard has started processing this pull request |
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
📰 DEVELOPING STORY: Smoke Docker Sbx reports failed. Our correspondents are investigating the incident...
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...
|
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
Smoke Test: Copilot Engine
Overall: PASS cc @lpcox
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com) reachable — Overall: PASS — network isolation egress enforcement working as expected. @lpcox Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
Smoke Test: Claude Engine Validation
Overall result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
Smoke Test: Copilot BYOK (Direct) Mode✅ MCP Connectivity — GitHub API responding Status: PASS
|
|
Smoke Test: GitHub Actions Services Connectivity
Overall: PASS
|
Smoke Test: API Proxy OpenTelemetry Tracing
Overall: ✅ All scenarios passed or behaved as expected. No regressions detected in the OTEL tracing integration for the api-proxy sidecar.
|
|
feat: add NVX Phase 3a confinement foundations Warning Firewall blocked 8 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "msfeed25.pkgs.visualstudio.com"
- "update.googleapis.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
Chroot Version Comparison Results
Overall: ❌ Failed — Node.js version mismatch between host and chroot environment. The
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Notes:
|
Summary
Why
A cumulative review of NVX PRs #8718, #8724, #8731, #8763, #8779, and #8785 found that Phase 2 and Phase 3a used multiple incompatible run-layout conventions. That prevented the existing filesystem, preflight, confinement, and cleanup foundations from composing safely into a Phase 3b backend. This PR establishes one fail-closed identity contract without registering NVX in the runtime registry or exposing CLI flags.
Validation
npm run type-checknpm run lint -- --quietnpm run buildnpm test -- --runInBand src/nvx/run-layout.test.ts src/nvx/preflight.test.ts src/nvx/confinement.test.ts src/nvx/cleanup-record.test.ts(27 tests)npx --no-install markdownlint-cli2 docs/nvx-security-design.mdThe full macOS suite passes 6,038 tests and retains four pre-existing Phase 2 failures that require Linux
/procdescriptor traversal or process-group inspection. Linux CI remains authoritative for those tests.