Repository navigation
fix: diagnose public debug preflight and hand off startup audit - #10009
Merged
Merged
Conversation
Keep public fixture verification fail-closed with bounded status and transport classes. Hand the resolved config artifact to the sudo runner before cleanup can stop to preserve private recovery state. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 04a0bb67-0f8b-4901-9f55-bf6b57c3d39b
Contributor
Documentation PreviewDocumentation has been built for this PR. To view locally:
Built from commit 33297ce |
Keep permission assertions and redaction reads and writes on the same opened file. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 04a0bb67-0f8b-4901-9f55-bf6b57c3d39b
Contributor
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (5 files)
Coverage comparison generated by |
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Privileged audit publication has unresolved ownership and path-safety risks requiring human security review.
4 open findings
What changed in this PR
Adds bounded visibility diagnostics and early resolved-config audit handoff to help diagnose AWF enclave startup failures.
Changes:
- Reports sanitized visibility failure reasons, HTTP status, and allowlisted transport codes.
- Adds audit ownership handoff, destination checks, and publication warnings.
- Expands regression coverage and documents release requirements.
| File | Description |
|---|---|
| src/enclave/public-debug.ts | Classifies and sanitizes visibility failures. |
| src/enclave/public-debug.test.ts | Tests diagnostics, disclosure limits, and request bounds. |
| src/enclave/cloud-hypervisor-lifecycle.test.ts | Updates the visibility rejection assertion. |
| src/commands/main-action.ts | Adds early audit handoff and validation. |
| src/commands/main-action.test.ts | Checks publication failure warnings. |
| src/commands/main-action-audit-handoff.test.ts | Covers failed-startup handoff and unsafe destinations. |
| docs/cloud-hypervisor-foundation.md | Documents diagnostics, handoff behavior, and deployment requirements. |
🧠 Review effort: Max
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW); | ||
| try { | ||
| if (!fs.fstatSync(directoryFd).isDirectory()) throw new Error('Unsafe audit directory'); | ||
| fs.fchownSync(directoryFd, owner.uid, owner.gid); |
Comment on lines
+131
to
+132
| const owner = process.getuid?.() === 0 && process.env.SUDO_UID | ||
| ? { uid: Number(getSafeHostUid()), gid: Number(getSafeHostGid()) } : undefined; |
Comment on lines
+136
to
+137
| const directoryFd = fs.openSync(configArtifactDir, | ||
| fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW); |
| if (!stat.isFile() || stat.nlink !== 1) throw new Error('Unsafe resolved config artifact'); | ||
| fs.writeFileSync(fd, JSON.stringify(redactedConfig, null, 2) + '\n'); | ||
| fs.fsyncSync(fd); | ||
| if (owner) fs.fchownSync(fd, owner.uid, owner.gid); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Observed evidence and certainty
Investigates smoke run 38678864556, dispatched on main
1baba937445c020ead894d60acab8a2fe5c9b0fbusing AWF v0.28.58 after #9995 and #10008.host-preflight, checkstartup/enclave-preparation, withPublic enclave debug repository visibility could not be verified.AWF_STARTUP_EXITreportscontainersStarted:false,agentStarted:false; the harness recordsnot_started.fetch, an unauthenticated GitHub repository metadata request, redirects rejected, a 5-second deadline and 64 KiB ceiling. This exact error branch establishes non-200 HTTP status or missing body, not which status or why. There is no evidence establishing rate limiting, authentication, TLS, DNS or timeout as the cause.stage=read, code=EACCESand removed an artifact source. Its log does not name the unreadable path. The downloaded agent artifact retainssandbox/firewall/logs/awf-startup-error.jsonbut no firewall audit tree. The public-debug artifact contains onlyNo public-fixture debug logs were produced for this run./tmp/gh-aw/sandbox/firewall/audit/awf-resolved-config.json: sudo AWF creates it root-owned at0600; generic cleanup normally repairs permissions, but this fail-closed cleanup path exits before that repair. This PR reproduces the missing handoff and fixes it; it does not assert this was the run's only unreadable file or prove which source the redactor removed.enclave.jsonlis not invocation evidence.Changes
0600, exclusive file creation, regular/single-link validation, and reject symlink audit destinations. Publishing failures now warn instead of being visible only at debug level.Security and scope
No credentials added to metadata requests; no redirects, retries, egress expansion, public-only gate relaxation or attestation changes. Private recovery/control state and host-only raw debug artifacts are not recursively chowned/chmodded or exposed to guests. Payload-bearing API audit permissions remain unchanged. Cleanup failure remains a failure; no fabricated successful invocation or empty enclave audit.
No workflows/generated locks, release pins, invocation limits or retry settings changed. Compiler-owned secret-redaction behavior is left fail-closed; identifying any additional unreadable source/removal scope requires more discriminating upstream redactor evidence, not a generated-lock patch or masked failure.
Validation
npm run buildandnpm run type-checkpassed.npx markdownlint docs/cloud-hypervisor-foundation.mdandgit diff --checkpassed.Remaining unknowns and deployment
The original metadata HTTP status/cause, the exact unreadable redaction source(s), and the earlier guest host-executor launch failure remain unknown. A future separately authorized run can distinguish metadata failures using these bounded diagnostics. The smoke remains pinned to v0.28.58: an AWF release containing this fix and a separate release-pin follow-up are required before it benefits. This PR does not claim end-to-end KVM validation or authorize a new run or merge.