[Copilot]

Align AWF’s NVX artifact contract and workflow pins with the specified NVX and OpenVMM commits and archive digest, so old or mixed revisions are rejected. This prepares validation for live virtio-fs integration without switching production runtime behavior.

• Artifact contract: Update the manifest parser’s pinned revisions and add regression coverage for the new tuple and rejection of the previous pins.
• Workflows: Synchronize KVM, phase-0, Copilot, build-test, and release artifact pins; regenerate and post-process the affected workflow locks.
• Release verification: Require the published AWF manifest to match the pinned upstream tuple:

  {
    "releaseTag": "v0.1.0-dev.be859aa77ffa",
    "nvxCommit": "be859aa77ffa7a20f9ef50f68c5386acdfca9955",
    "openvmmCommit": "762bc1c7a203b16aee752324d6a4ab0bde1a713a"
  }

• Documentation: Update the NVX security design’s release, commit, and archive digest pins.

• Fixes Validate and pin NVX v0.1.0-dev.be859aa77ffa #9566

[Copilot]

🔵 Needs a closer look

Security-sensitive binary pins and live KVM evidence require successful CI and final human validation.

0 open findings

What changed in this PR

Pins AWF’s NVX artifact contract to the revisions required by #9566 without changing production runtime behavior.

Changes:

• Updates the NVX release, source commits, and archive digest.
• Adds rejection coverage for previous revision combinations.
• Synchronizes release, KVM, smoke, and verification workflows.

File	Description
src/​nvx/​artifact-manifest.ts	Updates trusted upstream revisions.
src/​nvx/​artifact-manifest.test.ts	Tests new pins and rejects old ones.
docs/​nvx-security-design.md	Documents the new artifact tuple.
.github/​workflows/​smoke-verify-release-nvx-assets.md	Validates published manifest revisions.
.github/​workflows/​smoke-verify-release-nvx-assets.lock.yml	Regenerates the verification workflow.
.github/​workflows/​smoke-nvx-copilot.md	Updates Copilot smoke-test pins.
.github/​workflows/​smoke-nvx-copilot.lock.yml	Regenerates the Copilot workflow.
.github/​workflows/​smoke-nvx-build-test.md	Updates build-test pins.
.github/​workflows/​smoke-nvx-build-test.lock.yml	Regenerates the build-test workflow.
.github/​workflows/​release.yml	Updates release artifact inputs and metadata.
.github/​workflows/​nvx-phase-3b-live-kvm.yml	Updates live KVM validation pins.
.github/​workflows/​nvx-phase-0-feasibility.md	Updates feasibility probes and guidance.
.github/​workflows/​nvx-phase-0-feasibility.lock.yml	Regenerates the feasibility workflow.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

[github-actions]

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

1. Download the docs-preview-pr-9568 artifact from the workflow run
2. Unzip and open index.html in your browser

Built from commit c46239e

[github-actions]

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	93.00%	93.00%	➡️ +0.00%
Statements	91.49%	91.49%	➡️ +0.00%
Functions	90.20%	90.20%	➡️ +0.00%
Branches	85.26%	85.25%	📉 -0.01%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
src/nvx/one-shot-adapter.ts	83.5% → 82.9% (-0.60%)	80.3% → 79.8% (-0.56%)
src/log-directory-setup.ts	96.8% → 100.0% (+3.18%)	96.9% → 100.0% (+3.13%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts