Extract backend-neutral enclave execution policy and lifecycle by Copilot · Pull Request #10342 · github/gh-aw-firewall

Copilot · 2026-10-20T14:58:08Z

Extract reusable execution policy and lifecycle machinery from Cloud Hypervisor while preserving its protocol, settlement semantics, and backend-specific confinement guarantees.

Shared execution core: Role policies and identities, trusted static run-state derivation, private input staging, bounded canonical results, and storage-verification contracts.
Shared lifecycle: Authenticated service startup, readiness, configuration ownership, admission closure, startup/shutdown coordination, and drain/recovery/evidence ordering. Readiness does not require a persistent guest.
Adapter boundaries: Cloud Hypervisor retains artifact discovery and provenance, launch confinement, mounts, networking, resource identity verification, journal formats, and reaping. Existing acceptance gates remain unchanged.
Broker routing: Trusted host transport becomes independent of backend identity; invocation requests gain no launch authority. Docker migration and NVX enclave enablement remain out of scope.
Regression coverage: Startup failure, readiness, shutdown races, incomplete cleanup, recovery-state retention, and protocol settlement.

Fixes Extract shared execution policy and enclave lifecycle from Cloud Hypervisor #10336

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

🔵 Needs a closer look

The security-sensitive lifecycle and recovery refactor needs maintainer review and confirmed backend regression results.

1 open issue

Document drain false semantics and require rejection for incomplete cleanup · New

What changed in this PR

Extracts reusable enclave execution policy and lifecycle machinery from Cloud Hypervisor, keeping backend-specific confinement and resource management in its adapter.

Changes:

Adds shared policy, input staging, bounded results, and storage contracts.
Extracts host-service lifecycle coordination and separates trusted transport routing from backend identity.
Adds regression coverage and documents adapter boundaries; Docker migration and NVX enablement remain out of scope.

File	Description
`src/enclave/invocation-staging.ts`	Shared private input staging.
`src/enclave/invocation-staging.test.ts`	Staging and credential-isolation coverage.
`src/enclave/invocation-result.ts`	Bounded canonical result validation.
`src/enclave/invocation-result.test.ts`	Result bounds and unsafe-file coverage.
`src/enclave/host-service.ts`	Shared authenticated service startup.
`src/enclave/host-service.test.ts`	Startup ordering and failure coverage.
`src/enclave/host-executor-run-state.ts`	Trusted static run-state derivation.
`src/enclave/host-executor-routing.test.ts`	Transport routing and authority checks.
`src/enclave/host-executor-lifecycle.ts`	Shared ownership, readiness, and draining.
`src/enclave/host-executor-lifecycle.test.ts`	Lifecycle races and recovery coverage.
`src/enclave/execution-policy.ts`	Shared resource policies and identities.
`src/enclave/execution-policy.test.ts`	Policy and storage-contract coverage.
`src/enclave/cloud-hypervisor-lifecycle.ts`	Delegates shared lifecycle coordination.
`src/enclave/cloud-hypervisor-lifecycle.test.ts`	Backend-neutral run-state comparison.
`src/enclave/cloud-hypervisor-host-service.ts`	Uses shared service startup.
`src/enclave/bounded-storage.ts`	Defines storage verification contracts.
`src/cloud-hypervisor/workload-profile.ts`	Reuses shared policies and identities.
`src/cloud-hypervisor/host-enclave-executor.ts`	Reuses policy and result validation.
`src/cloud-hypervisor/enclave-invocation-staging.ts`	Delegates shared staging and verification.
`src/cloud-hypervisor/enclave-executor-types.ts`	Re-exports shared agent policy.
`docs/enclaves-architecture.md`	Documents shared core and adapter boundaries.
`containers/enclave/mcp-server/server.js`	Selects runners by trusted transport.
`containers/enclave/mcp-server/host-executor-runner.js`	Adds backend-independent routing predicate.
`containers/enclave/mcp-server/config.js`	Marks trusted host transport explicitly.

_{Review effort: Max}

+  /** Must verify recovery journals after draining the backend. */
+  drain(): Promise<boolean>;


lpcox · 2026-10-20T15:38:01Z

@copilot address review feedback

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-10-20T15:41:42Z

@copilot address review feedback

Clarified the contract in 0888c61: incomplete or uncertain cleanup must reject, while the boolean only indicates whether a host service was drained.

github-actions · 2026-10-20T15:42:19Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-10-20T15:42:46Z

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

Download the docs-preview-pr-10342 artifact from the workflow run
Unzip and open index.html in your browser

Built from commit 2f31e67

github-actions · 2026-10-20T15:49:08Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.40%	93.43%	📈 +0.03%
Statements	91.96%	92.00%	📈 +0.04%
Functions	91.16%	91.20%	📈 +0.04%
Branches	86.00%	86.05%	📈 +0.05%

📁 Per-file Coverage Changes (5 files)

File	Lines (Before → After)	Statements (Before → After)
`src/cloud-hypervisor/enclave-invocation-staging.ts`	96.1% → 94.8% (-1.28%)	92.5% → 93.2% (+0.72%)
`src/cloud-hypervisor/host-enclave-executor.ts`	94.1% → 93.4% (-0.71%)	90.8% → 90.3% (-0.50%)
`src/enclave/cloud-hypervisor-lifecycle.ts`	92.2% → 91.7% (-0.56%)	90.5% → 90.1% (-0.38%)
`src/cloud-hypervisor/workload-profile.ts`	95.0% → 94.8% (-0.23%)	94.5% → 95.0% (+0.44%)
`src/enclave/host-executor-server.ts`	91.0% → 91.0% (+0.00%)	89.7% → 90.0% (+0.29%)

✨ New Files (7 files)

src/enclave/bounded-storage.ts: 100.0% lines
src/enclave/execution-policy.ts: 100.0% lines
src/enclave/host-executor-lifecycle.ts: 100.0% lines
src/enclave/host-executor-run-state.ts: 97.0% lines
src/enclave/host-service.ts: 100.0% lines
src/enclave/invocation-result.ts: 100.0% lines
src/enclave/invocation-staging.ts: 100.0% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-10-20T16:09:14Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-10-20T16:09:14Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-10-20T16:09:15Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-10-20T16:09:16Z

✅ Smoke Claude passed

Generated by Smoke Claude for #10342

github-actions · 2026-10-20T16:09:16Z

Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor

github-actions · 2026-10-20T16:09:17Z

🔑 Smoke Copilot BYOK AOAI (api-key) is testing Azure OpenAI BYOK (api-key) mode on this pull request...

github-actions · 2026-10-20T16:09:17Z

🪪 Smoke Copilot BYOK AOAI (Entra) is testing Azure OpenAI BYOK (Entra / GitHub OIDC) mode on this pull request...

github-actions · 2026-10-20T16:09:17Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-10-20T16:10:01Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-10-20T16:19:19Z

Cloud Hypervisor + Copilot smoke test

Merged PR lookup: PASS
github.com connectivity: PASS (HTTP 200)
File write/read: PASS
example.com blocked: PASS (HTTP 000)
Overall: PASS

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor
_{Add label ready-for-aw to run again}

github-actions · 2026-10-20T16:19:31Z

Smoke test (Copilot)

GitHub MCP: ✅ (fix: mitigate compromised eMudhra CA trust across AWF #10343 "fix: mitigate compromised eMudhra CA trust across AWF")
GitHub.com connectivity: ✅
File write/read: ✅
Overall: PASS
Author: @Copilot; assignees: @lpcox @Copilot

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-10-20T16:19:32Z

Smoke Test: Claude Engine Validation

API status: ✅ PASS
GH check: ✅ PASS
File status: ✅ PASS

Overall result: PASS

Generated by Smoke Claude for #10342 · claude · haiku45 · 13.3 AIC · ⊞ 6.1K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-10-20T16:19:38Z

Smoke services: Redis PING ✅ | pg_isready ✅ | psql SELECT 1 ✅ — PASS

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-10-20T16:19:48Z

🔄 Smoke Test: Copilot BYOK (Direct)

✅ GitHub MCP - Verified PR data matches
✅ GitHub.com Connectivity - HTTP 200 OK
✅ File Write/Read - Test file exists and readable
✅ BYOK Inference - Direct mode working (agent → api-proxy → api.githubcopilot.com)

Status: PASS (Direct BYOK mode via COPILOT_PROVIDER_API_KEY)
Author: @lpcox | Run: 39454836303

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-10-20T16:20:05Z

OTEL smoke test (re-run locally)

✅ S1: otel.js loads; exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, etc.
✅ S2: 68/68 OTEL tests pass (3 suites)
✅ S3: trace context in env-passthrough.ts; OTEL vars in api-proxy-env-config.ts
✅ S4: onUsage hook present in token-tracker-http.js
⚪ S5: no diagnostics post-step output available in this run; no export failures observed

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-10-20T16:20:27Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com): 200
✅ Blocked domain (example.com): blocked (curl TLS error, exit non-zero)
Overall: PASS
cc @lpcox

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-10-20T16:21:04Z

Smoke Test

ci: automate full enclave conformance after releases
Compile reviewed model records into deterministic compatibility projections
Merged PRs review ✅
PR details ✅
Playwright ❌
File write/read ✅
Build ✅
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-10-20T16:21:08Z

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.15	Python 3.12.15	✅
Node.js	v24.21.0	v2.98.0	❌
Go	go1.22.12	go1.22.12	✅

Node.js differs, so the smoke-chroot label was not added. The chroot's reported Node version (v2.98.0) looks unusual and may come from a different binary or wrapper.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-10-20T16:21:31Z

Security Review: Executor Type Detection Refactoring

Finding 1: Potential Logic Regression in `usesHostExecutor()` Helper

File/Lines: containers/enclave/mcp-server/host-executor-runner.js:34-36

The new helper function refactors the executor type check from a negation (!== 'cloud-hypervisor') to an OR condition:

function usesHostExecutor(config) {
  return config.executorTransport === 'host' || config.executorBackend === 'cloud-hypervisor';
}

Security Concern: The original condition (config.executorBackend !== 'cloud-hypervisor') implied "NOT cloud-hypervisor" (other backends like script/agent). The new condition changes this to "IS host executor OR IS cloud-hypervisor". If executorTransport is missing or unset and executorBackend is unset or unexpected, the function returns false, which could cause the wrong executor type to be instantiated. This is a logic inversion that could bypass isolation guarantees.

Suggested Action: Verify that executorTransport is consistently set and validated. Add explicit assertions in config loading to ensure mutual consistency between executorBackend and executorTransport. Consider clarifying the intent: should this function return true for "host executor" or "not script/agent executor"?

Finding 2: Missing Validation of New `executorTransport` Field

File/Lines: containers/enclave/mcp-server/config.js:387

The new executorTransport: 'host' field is hardcoded but lacks downstream validation:

executorTransport: 'host',

Security Concern: There is no validation that this field is present or has an expected value before it is used in usesHostExecutor(). Configuration drift, missing fields, or tampering could go undetected, allowing the wrong executor to be selected.

Suggested Action: Add explicit validation of executorTransport in config validation logic or in usesHostExecutor() itself. Throw an error if the field is missing or has an unexpected value (e.g., not 'host' or 'script').

Confidence: 6/10 — Logic refactoring is plausible, but these concerns should be validated before merge.

Generated by Security Guard for #10342 · copilot · haiku45 · 4.34 AIC · ⊞ 6K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-10-20T16:21:35Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	all passed	✅ PASS
Go	env	✅	all passed	✅ PASS
Go	uuid	✅	all passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Notes: Bun/Deno installed via npm (curl installers were not permitted); .NET needed XDG_RUNTIME_DIR set to a temp dir and Maven used a local repo under /tmp because ~/.m2 is root-owned.

Generated by Build Test Suite for #10342 · copilot · auto · 22.6 AIC · ⊞ 12K · ◷
_{Add label ready-for-aw to run again}

Initial plan

d2c3f34

Copilot AI assigned Copilot and lpcox Oct 20, 2026

Copilot AI linked an issue Oct 20, 2026 that may be closed by this pull request

Extract shared execution policy and enclave lifecycle from Cloud Hypervisor #10336

Closed

6 tasks

Copilot started work on behalf of lpcox October 20, 2026 14:58

View session

refactor: extract shared enclave execution policy and lifecycle

309e873

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Extract shared execution policy and enclave lifecycle from Cloud Hypervisor~~ Extract backend-neutral enclave execution policy and lifecycle Oct 20, 2026

Copilot finished work on behalf of lpcox October 20, 2026 15:12

Copilot AI requested a review from lpcox October 20, 2026 15:12

lpcox marked this pull request as ready for review October 20, 2026 15:14

Copilot AI max review requested due to automatic review settings October 20, 2026 15:14

Copilot started reviewing on behalf of lpcox October 20, 2026 15:14

View session

Copilot AI reviewed Oct 20, 2026

View reviewed changes

Comment thread src/enclave/host-executor-lifecycle.ts Outdated

Comment on lines +99 to +100

/** Must verify recovery journals after draining the backend. */

drain(): Promise<boolean>;

Copilot started work on behalf of lpcox October 20, 2026 15:38

View session

docs: clarify enclave drain cleanup contract

0888c61

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox October 20, 2026 15:42

lpcox added the ready-for-aw label Oct 20, 2026

github-actions Bot added smoke-cloud-hypervisor smoke-copilot labels Oct 20, 2026

github-actions Bot added the smoke-claude label Oct 20, 2026

github-actions Bot added the smoke-services label Oct 20, 2026

github-actions Bot added the smoke-copilot-byok label Oct 20, 2026

lpcox deployed to aoai-model October 20, 2026 16:20 — with GitHub Actions Active

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Oct 20, 2026

lpcox had a problem deploying to aoai-model October 20, 2026 16:20 — with GitHub Actions Failure

github-actions Bot added the build-test label Oct 20, 2026

lpcox merged commit a4ed1d1 into main Oct 20, 2026
146 of 153 checks passed

lpcox deleted the copilot/extract-shared-execution-policy branch October 20, 2026 16:32

github-actions Bot mentioned this pull request Oct 20, 2026

fix: mitigate compromised eMudhra CA trust across AWF #10343

Merged

Copilot AI mentioned this pull request Oct 20, 2026

Migrate Docker enclaves to the shared host-owned execution lifecycle #10353

Merged

		/** Must verify recovery journals after draining the backend. */
		drain(): Promise<boolean>;

Conversation

Copilot AI commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

lpcox commented Oct 20, 2026

Uh oh!

Copilot AI commented Oct 20, 2026

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

github-actions Bot commented Oct 20, 2026

Documentation Preview

Uh oh!

github-actions Bot commented Oct 20, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

github-actions Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

github-actions Bot commented Oct 20, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

github-actions Bot commented Oct 20, 2026

🔄 Smoke Test: Copilot BYOK (Direct)

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

github-actions Bot commented Oct 20, 2026

Smoke Test

Uh oh!

github-actions Bot commented Oct 20, 2026

Chroot Version Comparison

Uh oh!

github-actions Bot commented Oct 20, 2026

Security Review: Executor Type Detection Refactoring

Finding 1: Potential Logic Regression in usesHostExecutor() Helper

Finding 2: Missing Validation of New executorTransport Field

Uh oh!

github-actions Bot commented Oct 20, 2026

🏗️ Build Test Suite Results

Uh oh!

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Copilot AI commented Oct 20, 2026 •

edited

Loading

github-actions Bot commented Oct 20, 2026 •

edited

Loading

github-actions Bot commented Oct 20, 2026 •

edited

Loading

github-actions Bot commented Oct 20, 2026 •

edited

Loading

github-actions Bot commented Oct 20, 2026 •

edited

Loading

github-actions Bot commented Oct 20, 2026 •

edited

Loading

github-actions Bot commented Oct 20, 2026 •

edited

Loading

github-actions Bot commented Oct 20, 2026 •

edited

Loading

Finding 1: Potential Logic Regression in `usesHostExecutor()` Helper

Finding 2: Missing Validation of New `executorTransport` Field