[Pedro Henrique Penna (ppenna)]

Part of #1131 (SL6.10f, "CI and the repository's automation give the right workflow"). Parent #1090, umbrella #1076.

What and why

The CI and contribution docs, the repository instructions and the one affected operational skill now give the final package's gates and test owners with their commands, the reusable packaging workflow, and what each kind of run publishes, as the workflows, actions and scripts of feature/nvx-refactor at f5cc2aacfbf define them, after every code slice of #1076. SL5.2 (#1499) had already taken the runtime adapter out of them; this PR fills the gaps that remained and fixes the claims that later changes left stale. It changes no automation.

Gates and their commands (doc/contribute.md's Quality gates, doc/ci.md's Rust crates, the instructions):

• the kernel configuration check, nvx.py check-kernel-config, which check-quality runs and the table didn't list;
• the PowerShell syntax check of the Azure Windows setup scripts in scripts/setup/azure/windows/, beside setup-windows-whp.ps1;
• the tests of the skills' scripts, which validate-nvx runs;
• the public-API check, python3 scripts/public_api.py, beside the snapshot update, --update, in both docs, the repository instructions and nvx-ci-investigation.

Test ownership (doc/contribute.md's Test ownership, doc/ci.md, the instructions):

• OpenVMM's tests: the openvmm-ci job and check-openvmm-ci, with OpenVMM's gates running on the pull requests that are ready for review and on the pushes that its CI workflow takes, not "each pull request and each push";
• the acceptance on real VMs that the guest and sandbox jobs run: the smoke tests vm-lifecycle, snapshot-core and snapshot-tiers, and the CLI's twelve cold cells, which the case matrix details;
• the tests that the nvx-rs job runs, in place of "fake-OpenVMM instance tests": the unit tests, the process tests of nvx::host::process among them since they left tests/process.rs, and the integration tests, the CLI's scenario tests, the fake OpenVMM's behavior, the guest binaries, the NVXS session, the security checklist, which now checks a VM's directory and outputs and a snapshot's directory, and the host modules' layering;
• stale claims: the copies of OpenVMM's vectors are read by the tests of nvx::protocol::nvxs and nvx::host::config, not by "template tests", which left with the template store (nvx-rs slimming 4.2.2: the old clone path, template store and sandbox store are gone #1121); the public sandbox scenarios check that exec streams output past the 1 MiB that NVXC version 1 forwarded, not "bounded output" (SL4.4c); the extended Ubuntu set on KVM no longer names the blockless snapshot (snapshot-core) that SL5.1c moved to the public sandbox scenarios; the instructions name vm-lifecycle among the scenarios that run an nvx-rs test with Cargo, and every directory of Python unit tests (scripts/, .github/specula/tests/ and .github/skills/*/scripts/), as Test layout does.

OpenVMM CI, the merge queue, packaging and publishing:

• a new Release packages section of doc/ci.md describes package-platform.yml, the reusable workflow that the package jobs call, and its package-release action: the runner labels and inputs that each job passes, the checkouts, the pin check and the downloads, package --binary-only and archive-release, and that only a dev push uploads the release-<platform> archives that Publish development release publishes, while pull requests, merge groups, full runs and pushes to feature/nvx-refactor only prove that the packages build. The job graph links it;
• dev pushes record their p50 values, which a full run of dev then appends under data/; doc/ci.md still said that the pushes append them;
• crates.io releases says that a full run publishes the crate once every job but Persist performance baselines, which runs apart, has passed; that a dev push publishes its development release instead of the crate; and that nvx is the only crate that NVX publishes, its programs being binaries of that package. The instructions say so too;
• a pin promotion's pull request runs the OpenVMM CI check of the new pin, which waits up to 300 minutes, not "both OpenVMM suites", which CI no longer runs; and OpenVMM is no longer called a "private submodule";
• nvx-ci-investigation checks a cancelled merge group's queue outcome before it treats the run as a failure, reproduces nvx-rs failures with check-nvx-rs, and classifies a failed openvmm-ci job as OpenVMM's CI result, which check-openvmm-ci checks again.

Checked and left as they were: the Superseded merge groups, Queue settings, Feature branch pushes, Change classification and Development release publication sections match ci.yml, merge_queue.py, ci.py and publish_development_release.py. Runners appear only as the workflows name them (ubuntu-latest, windows-latest, and ubuntu-24.04 for the module diagrams' drawing), with no Ubuntu release for ubuntu-latest. No instruction, skill or custom agent names the runtime adapter, test-runtime-adapter, nvx-microvm-adapter-whp or the adapter's configurations in check-nvx-rs. The other skills' gate and publishing instructions (nvx-openvmm-promote, which SL5.2 updated, nvx-openvmm-rebase, create-pr, rebase-and-validate, review-changes, address-pr-comments, nvx-run, nvx-debug, nvx-benchmark, nvx-host-connect and commit-message) still hold, so they don't change. No edit touches doc/setup.md, doc/project-structure.md or check-quality, which SL7.8c changed.

Size

	Core lines	Counted files
Estimate (#1131)	0 (docs)	none
Measured	0	0

Only Markdown changes: doc/ci.md, doc/contribute.md, .github/copilot-instructions.md and .github/skills/nvx-ci-investigation/SKILL.md.

Old tests of the area

None changes: the PR changes no test, CI step or doc test, and the case matrix keeps every row.

Test changes

python scripts\check_test_changes.py --base origin/feature/nvx-refactor: 0 change(s) to existing tests, so no tests-modified.

Validation

local_gates.py --files with the four files (from dev, since this branch has no copy) selects test-changes, markdown-links, test-layout and nvx-cli (validate-nvx). I ran them from this branch's definitions on Windows, on this head (b73e5d9f, on feature/nvx-refactor f5cc2aacfbf):

Check	Result
python scripts\nvx.py verify	passed
python scripts\check_markdown_links.py	passed
python scripts\check_test_layout.py	passed
python scripts\check_test_changes.py --base origin/feature/nvx-refactor	0 changes
SL5.2's check_matrix.py <worktree> 99d2022085f	passed
The doc tests that read these files: python -m unittest scripts/test_markdown_links.py scripts/test_tool_versions.py scripts/test_nightly_ci.py	passed: 189 tests, 1 skipped
validate-nvx's Windows commands: compileall, its unittest list, test_adversarial.py, test_hosts.py and nvx.py's --help checks	passed: 1803 tests, 71 skipped; 84, 11 skipped; 4
python scripts\public_api.py, the check that the docs now name	passed, both snapshots current
The commands and options that the docs name: public_api.py --help (--update), nvx.py check-kernel-config, check-openvmm-ci (--revision, --wait-minutes), cancel-superseded-merge-groups, package (--binary-only), archive-release, materialize-kernel-provenance-inputs, verify and test-microvm (--scenario vm-lifecycle, snapshot-core, snapshot-tiers, managed-lifecycle) --help	all exist

Code-review subagents checked every changed claim against the workflows, actions and scripts, first at #1534's head and again at f5cc2aacfbf. Their findings are fixed: the instructions named scripts/ alone for Python unit tests, the crate's publication doesn't wait for Persist performance baselines, and OpenVMM's gates skip draft pull requests and pushes that change only Guide/ and petri/logview/.

Not run: no Linux, host or microVM check, since only documentation changes; CI runs only its GitHub-hosted jobs for it.

[Copilot]

🟢 Approval recommended

No active review issues remain for this documentation-only update to contributor guidance and CI documentation.

No open issues 🎉

What changed in this PR

This documentation-only PR aligns contributor guidance and CI documentation with NVX’s one-package design and the test ownership established after removing the runtime adapter. It changes no automation or tests.

Changes:

• Documents missing quality gates, public-API check commands, and current test ownership.
• Explains reusable release packaging, publication rules, and performance-history persistence.
• Updates repository instructions and CI troubleshooting guidance for merge-group cancellations and OpenVMM CI results.

File	Description
doc/​contribute.md	Updates quality gates, test ownership, and OpenVMM pin-validation guidance.
doc/​ci.md	Documents release packaging and clarifies publishing, performance history, and Rust test coverage.
.github/​skills/​nvx-ci-investigation/​SKILL.md	Clarifies cancellation triage and reproduction of Rust and OpenVMM CI failures.
.github/​copilot-instructions.md	Updates API snapshot, test-layout, VM scenario, and single-crate publishing guidance.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are recorded for this documentation-only update to contributor and CI guidance.

No open issues 🎉

_{Review effort: Balanced}