Fix Cloud Hypervisor regression admission still rejecting all three enclave profiles

Aperta
  • Qualcosa non va?
#11,220 0 commenti 1 reazione 2 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@lpcox ci sta già lavorando.

Dal 6/11/2026.

  • #11223 di @copilot-swe-agent — aperta

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

Source and grouped failures

Follow-up to #11218: run 42302968504, attempt 1, source and workflow revision 35b56fc3f9d298c89ad971386d001133280529ec. This was a manual run of the daily workflow on main, on GitHub-hosted Ubuntu 24.04.

Failed enclave case Job
Copilot / Cloud Hypervisor 128200400075
Codex / Cloud Hypervisor 128200400205
Claude / Cloud Hypervisor 128200400438
Confirmed failure boundary

All three startup.json artifacts now identify the same failure:

{"failureStage":"broker","phase":"pre-broker","reason":"exit","category":"configuration","exitCode":1,"earlyFailure":{"schemaVersion":1,"phase":"backend-selection","reason":"cloud-hypervisor-enclave-admission"}}

The fields above are a compact projection of the retained record. Finalization also records awf-exit/nonzero-exit and awf-cleanup/work-dir-present; gateway cleanup and diagnostic retention succeed. No enclave workload or provider request is established before rejection. All three primary Cloud Hypervisor tests pass.

This revision includes #11192, which closed #11187. Its early diagnostics work: the failure is no longer merely category=unknown. However, changing ordinary-workflow OIDC claim handling has not made the actual production admission path pass. Keep the prior issue closed and track the remaining rejection here.

Investigation boundary and PR scope

The rejection originates in assertCloudHypervisorPreSecurityCompatibility. The daily-regression predicate combines compiled source pins, runner/workflow identity, signed OIDC validation, runtime settings, and exact normalized profile defaults. The emitted reason does not identify which subcondition failed; no registry finding establishes that missing root cause.

One PR should make that rejection safely discriminating, fix the actual mismatch in the real assembled harness configuration/identity path, and handle its pre-start cleanup consequences. Do not guess that OIDC, artifacts, defaults, or KVM is the cause from the aggregate admission code alone.

Acceptance criteria
  • Retain a finite, versioned admission-check reason identifying configuration/profile, workflow/source, token acquisition, signature, or claim rejection without publishing tokens, request URLs, headers, raw stderr, or environment dumps.
  • Exercise the actual regression configuration through production assembly and admission, with realistic signed ordinary-workflow identity fixtures for all three profiles—not only a hand-built predicate input.
  • A correctly pinned hosted daily/manual-main run reaches broker/gateway readiness and performs an approved invocation; malformed/untrusted identity, mismatched source/profile, and reusable-job impersonation still fail closed.
  • Preserve artifact attestation, bounded storage, runtime matching, and no-fallback enforcement; do not broaden admission to arbitrary callers to turn the test green.
  • Clean up harness-owned pre-start state on rejected admission, or classify explicitly what must be retained for recovery; do not blindly delete unverified recovery state.

These three cases share one pre-engine admission failure and belong in one PR, separate from the Docker native-engine failures.

Lingua principale
TypeScript
Stelle
157
Fork
80
Merge medio
4h 43m
PR unite (30g)
412

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di github/gh-aw-firewall

Tutte le issue di github/gh-aw-firewall

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.