Add fail-closed declarative NVX runtime support by Copilot · Pull Request #66990 · github/gh-aw

Copilot · 2026-10-08T19:40:43Z

Add sandbox.agent.runtime: nvx as a declarative, fail-closed preview runtime. NVX runs a workload-specific guest layer in a one-shot microVM and never falls back to another runtime.

Secure defaults: Setting runtime: nvx enables preview mode, strict network isolation, and the API proxy. Optional NVX settings can override trusted asset paths, mount policy, resource limits, and the guest working directory.
Preflight and trusted assets: Require explicit pre-agent provisioning of the guest layer and AWF release assets. Verify the artifact manifest and Sigstore bundle offline, check asset digests and host compatibility, then stage verified files root-owned and read-only; clean up staging after execution.
Compatibility and docs: Reject unsupported runner topologies and features rather than weakening isolation. Document Linux x86_64, root/KVM, cgroup v2, and seccomp requirements, plus migration guidance for firewall smoke workflows.

sandbox:
  agent:
    runtime: nvx

Fixes Add fail-closed declarative NVX runtime support #66989

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-actions · 2026-10-08T20:59:19Z

Excellent work on the fail-closed NVX runtime support! Thorough tests and docs. Looks ready for review.

Generated by ✅ Contribution Check · copilot · auto · 42.7 AIC · ⌖ 0.609 AIC · ⊞ 9.2K · ◷

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

lpcox · 2026-10-08T21:50:08Z

@copilot address the review feedback and make the configuration as simple as possible. just use default values for everything undr sandbox.agent.nvx ... it should just be sandbox.agent.runtime: nvx

Copilot

🟡 Changes recommended

The preflight always aborts on an unbound stage_dir, and staged artifacts lack cleanup on persistent runners.

3 open findings

stage_dir used before assignment under set -u · New
Preflight script lacks end-to-end execution coverage · New
Missing changeset for new runtime capability · New

What changed in this PR

Adds declarative, fail-closed NVX microVM runtime support, including configuration, validation, trusted artifact staging, host preflight, and documentation.

Changes:

Adds typed NVX settings, schemas, compatibility validation, and AWF command/config generation.
Adds artifact provenance verification and host eligibility preflight.
Documents NVX requirements, configuration, and migration guidance.

File	Description
`pkg/workflow/schemas/awf-config.schema.json`	Defines generated NVX configuration.
`pkg/workflow/sandbox.go`	Adds NVX runtime types and settings.
`pkg/workflow/sandbox_validation.go`	Integrates NVX validation.
`pkg/workflow/sandbox_runtime_profile.go`	Registers the NVX runtime profile.
`pkg/workflow/nvx.go`	Implements defaults, validation, and setup generation.
`pkg/workflow/nvx_test.go`	Tests NVX configuration and command generation.
`pkg/workflow/frontmatter_extraction_security.go`	Extracts NVX frontmatter.
`pkg/workflow/firewall.go`	Detects NVX and enables isolation.
`pkg/workflow/compiler_yaml_ai_execution.go`	Inserts NVX preflight after provisioning.
`pkg/workflow/awf_config.go`	Adds NVX AWF configuration structures.
`pkg/workflow/awf_config_build.go`	Builds fail-closed NVX configuration.
`pkg/workflow/awf_command_builder.go`	Emits NVX runtime flags and paths.
`pkg/parser/schemas/main_workflow_schema.json`	Adds frontmatter schema validation.
`pkg/parser/schema_test.go`	Tests NVX schema requirements.
`pkg/constants/version_constants.go`	Defines the minimum AWF version.
`pkg/constants/constants.go`	Adds NVX command and resource defaults.
`docs/src/content/docs/reference/sandbox.md`	Adds NVX to sandbox documentation.
`docs/src/content/docs/reference/agent-runtimes.md`	Documents NVX setup and compatibility.
`actions/setup/sh/nvx_host_preflight.sh`	Verifies the host and trusted artifacts.

🧠 Review effort: Balanced

+if ! "${trusted_tools[gh]}" attestation verify "${stage_dir}/manifest.json" \
+  --repo github/gh-aw-firewall \
+  --bundle "${stage_dir}/manifest.sigstore.jsonl" \
+  --signer-workflow "$GH_AW_NVX_SIGNER_WORKFLOW" \
+  --deny-self-hosted-runners; then


+func TestNVXSetupStepUsesConfiguredExpressionPaths(t *testing.T) {
+	data := validNVXWorkflowData()
+	steps := generateNVXRuntimeSetupSteps(data)
+	require.Len(t, steps, 1)
+


+	// AgentRuntimeNVX runs the agent inside AWF's preview one-shot NVX microVM.
+	AgentRuntimeNVX AgentRuntime = "nvx"


Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-10-08T22:29:25Z

@copilot address the review feedback and make the configuration as simple as possible. just use default values for everything undr sandbox.agent.nvx ... it should just be sandbox.agent.runtime: nvx

Done in aa787b65. NVX now uses secure defaults so sandbox.agent.runtime: nvx is sufficient; I also fixed staging/attestation ordering and added preflight execution coverage, cleanup, and the minor changeset.

lpcox · 2026-10-08T22:30:10Z

@copilot fix the pr summary

Copilot · 2026-10-08T22:40:32Z

@copilot fix the pr summary

I can’t directly edit the PR description with the available GitHub controls. Use this replacement summary:

Add fail-closed NVX runtime support, enabled with only sandbox.agent.runtime: nvx. NVX applies secure defaults for isolation, API proxying, workspace-only mounts, and trusted artifact paths. Preflight verifies artifact provenance and digests, checks Linux x86_64 KVM compatibility, and stages verified files root-owned and read-only. Unsupported configurations fail closed; tests and documentation cover setup and migration.

github-actions · 2026-10-09T15:49:56Z

🎉 This pull request is included in a new release.

Release: v0.91.7

Initial plan

a7c3e6f

Copilot AI assigned Copilot and lpcox Oct 8, 2026

Copilot started work on behalf of lpcox October 8, 2026 19:41 View session

Copilot AI linked an issue Oct 8, 2026 that may be closed by this pull request

Add fail-closed declarative NVX runtime support #66989

Closed

15 tasks

Add fail-closed NVX runtime support

510e919

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

github-advanced-security AI found potential problems Oct 8, 2026

View reviewed changes

Comment thread actions/setup/sh/nvx_host_preflight.sh Outdated

Copilot AI changed the title ~~[WIP] Add fail-closed declarative NVX runtime support~~ Add fail-closed declarative NVX runtime support Oct 8, 2026

Copilot AI requested a review from lpcox October 8, 2026 20:27

Copilot finished work on behalf of lpcox October 8, 2026 20:27

github-actions Bot mentioned this pull request Oct 8, 2026

[Contribution Check Report] Contribution Check — 2026-10-08 #66739

Closed

Potential fix for pull request finding

554c3d8

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

github-advanced-security AI found potential problems Oct 8, 2026

View reviewed changes

Comment thread actions/setup/sh/nvx_host_preflight.sh Outdated

lpcox marked this pull request as ready for review October 8, 2026 21:43

Copilot AI balanced review requested due to automatic review settings October 8, 2026 21:43

Potential fix for pull request finding

5db347b

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Copilot started reviewing on behalf of lpcox October 8, 2026 21:44 View session

github-advanced-security AI found potential problems Oct 8, 2026

View reviewed changes

Comment thread actions/setup/sh/nvx_host_preflight.sh

Potential fix for pull request finding

5bee5b6

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Copilot AI reviewed Oct 8, 2026

View reviewed changes

github-advanced-security AI found potential problems Oct 8, 2026

View reviewed changes

Comment thread actions/setup/sh/nvx_host_preflight.sh Outdated

Copilot started work on behalf of lpcox October 8, 2026 21:54 View session

Make NVX configuration default-secure

aa787b6

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox October 8, 2026 22:30

Copilot started work on behalf of lpcox October 8, 2026 22:35 View session

Copilot finished work on behalf of lpcox October 8, 2026 22:40

lpcox merged commit b54957e into main Oct 8, 2026
38 checks passed

lpcox deleted the copilot/add-fail-closed-nvx-support branch October 8, 2026 22:45

This was referenced Oct 9, 2026

Adopt declarative NVX runtime in smoke workflows github/gh-aw-firewall#9752

Merged

Configure /dev/kvm permissions for declarative NVX like Cloud Hypervisor #67233

Closed

Copilot AI mentioned this pull request Oct 9, 2026

Share scoped KVM permission setup between NVX and Cloud Hypervisor #67234

Merged

Navigation Menu

Repository navigation

Add fail-closed declarative NVX runtime support - #66990

Add fail-closed declarative NVX runtime support#66990
lpcox merged 6 commits into
mainfrom
copilot/add-fail-closed-nvx-support

Copilot AI commented Oct 8, 2026 •

edited by lpcox

Loading

Uh oh!

Uh oh!

github-actions Bot commented Oct 8, 2026

Uh oh!

Uh oh!

Uh oh!

lpcox commented Oct 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI commented Oct 8, 2026

Uh oh!

lpcox commented Oct 8, 2026

Uh oh!

Copilot AI commented Oct 8, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		// AgentRuntimeNVX runs the agent inside AWF's preview one-shot NVX microVM.
		AgentRuntimeNVX AgentRuntime = "nvx"

Conversation

Copilot AI commented Oct 8, 2026 • edited by lpcox Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 8, 2026

Uh oh!

Uh oh!

Uh oh!

lpcox commented Oct 8, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI commented Oct 8, 2026

Uh oh!

lpcox commented Oct 8, 2026

Uh oh!

Copilot AI commented Oct 8, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Oct 8, 2026 •

edited by lpcox

Loading