Repository navigation
feat(driver): bound guest admission and bridge reconnect proofs - #116
Merged
jiashuoz merged 2 commits intoOct 7, 2026
Merged
Conversation
* feat: require epoch-bound guest readiness acknowledgment * Integrate authenticated guest reconnect and guarded runner recovery (#118) * Wire authenticated guest handoff and guarded recovery admission * Fence delayed RPC delivery and reject ambiguous bootstrap preambles * Require exclusive state ownership for every microVM runner * Fence cold resume placement before launch and reconcile uncertain results * Preserve cold launch ownership across crashes and terminal races * Retain fresh and interrupted VM launches until process exit is proven * Use exact pending placement capacity in API explanations * Require exact instance and original process lifetime before VM teardown * Require host authority support to negotiate guest reconnect * fix: revalidate VM lifetime before shutdown escalation * feat: compose durable standalone guest recovery * fix(sessiond): launch the command supplied by microVM boot configuration * test(controld): await asynchronous placement dispatch before asserting * fix(driver): recognize original VM exit before reaping * fix(driver): require whole process exit before teardown * fix(microvm): wait for remaining recovered VMM threads * fix(microvm): resolve recovered cold resume configuration
jiashuoz
marked this pull request as ready for review
October 7, 2026 16:44
jiashuoz
added a commit
that referenced
this pull request
Oct 7, 2026
* feat(sessiond): authenticate guest reconnect before configuration refresh * fix(sessiond): refresh exec environments before reconnect readiness * docs: clarify configuration state after reconnect expiry * feat(driver): bound guest admission and bridge reconnect proofs (#116) * feat(driver): bound guest admission and bridge reconnect proofs * Require epoch-bound guest readiness acknowledgment (#117) * feat: require epoch-bound guest readiness acknowledgment * Integrate authenticated guest reconnect and guarded runner recovery (#118) * Wire authenticated guest handoff and guarded recovery admission * Fence delayed RPC delivery and reject ambiguous bootstrap preambles * Require exclusive state ownership for every microVM runner * Fence cold resume placement before launch and reconcile uncertain results * Preserve cold launch ownership across crashes and terminal races * Retain fresh and interrupted VM launches until process exit is proven * Use exact pending placement capacity in API explanations * Require exact instance and original process lifetime before VM teardown * Require host authority support to negotiate guest reconnect * fix: revalidate VM lifetime before shutdown escalation * feat: compose durable standalone guest recovery * fix(sessiond): launch the command supplied by microVM boot configuration * test(controld): await asynchronous placement dispatch before asserting * fix(driver): recognize original VM exit before reaping * fix(driver): require whole process exit before teardown * fix(microvm): wait for remaining recovered VMM threads * fix(microvm): resolve recovered cold resume configuration
jiashuoz
added a commit
that referenced
this pull request
Oct 7, 2026
…114) * Authorize guest reconnect through one runner control connection * feat(sessiond): retain guest identity and authenticate reconnect (#115) * feat(sessiond): authenticate guest reconnect before configuration refresh * fix(sessiond): refresh exec environments before reconnect readiness * docs: clarify configuration state after reconnect expiry * feat(driver): bound guest admission and bridge reconnect proofs (#116) * feat(driver): bound guest admission and bridge reconnect proofs * Require epoch-bound guest readiness acknowledgment (#117) * feat: require epoch-bound guest readiness acknowledgment * Integrate authenticated guest reconnect and guarded runner recovery (#118) * Wire authenticated guest handoff and guarded recovery admission * Fence delayed RPC delivery and reject ambiguous bootstrap preambles * Require exclusive state ownership for every microVM runner * Fence cold resume placement before launch and reconcile uncertain results * Preserve cold launch ownership across crashes and terminal races * Retain fresh and interrupted VM launches until process exit is proven * Use exact pending placement capacity in API explanations * Require exact instance and original process lifetime before VM teardown * Require host authority support to negotiate guest reconnect * fix: revalidate VM lifetime before shutdown escalation * feat: compose durable standalone guest recovery * fix(sessiond): launch the command supplied by microVM boot configuration * test(controld): await asynchronous placement dispatch before asserting * fix(driver): recognize original VM exit before reaping * fix(driver): require whole process exit before teardown * fix(microvm): wait for remaining recovered VMM threads * fix(microvm): resolve recovered cold resume configuration
jiashuoz
added a commit
that referenced
this pull request
Oct 7, 2026
* Define bounded guest reconnect RPC messages and decoders * Bind guest reconnect authorization to the runner control connection (#114) * Authorize guest reconnect through one runner control connection * feat(sessiond): retain guest identity and authenticate reconnect (#115) * feat(sessiond): authenticate guest reconnect before configuration refresh * fix(sessiond): refresh exec environments before reconnect readiness * docs: clarify configuration state after reconnect expiry * feat(driver): bound guest admission and bridge reconnect proofs (#116) * feat(driver): bound guest admission and bridge reconnect proofs * Require epoch-bound guest readiness acknowledgment (#117) * feat: require epoch-bound guest readiness acknowledgment * Integrate authenticated guest reconnect and guarded runner recovery (#118) * Wire authenticated guest handoff and guarded recovery admission * Fence delayed RPC delivery and reject ambiguous bootstrap preambles * Require exclusive state ownership for every microVM runner * Fence cold resume placement before launch and reconcile uncertain results * Preserve cold launch ownership across crashes and terminal races * Retain fresh and interrupted VM launches until process exit is proven * Use exact pending placement capacity in API explanations * Require exact instance and original process lifetime before VM teardown * Require host authority support to negotiate guest reconnect * fix: revalidate VM lifetime before shutdown escalation * feat: compose durable standalone guest recovery * fix(sessiond): launch the command supplied by microVM boot configuration * test(controld): await asynchronous placement dispatch before asserting * fix(driver): recognize original VM exit before reaping * fix(driver): require whole process exit before teardown * fix(microvm): wait for remaining recovered VMM threads * fix(microvm): resolve recovered cold resume configuration
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The microVM accept loop now claims its one boot connection before spawning a worker, closing refused peers inline without per-peer logs. This bounds worker allocation when an untrusted guest repeatedly dials the control socket; first-boot configuration and the one-connection guard remain intact.
Adds
driver.AuthorizeGuestConnection, connecting the existing runner authorization callback to the guest challenge/proof stream: strict 4 KiB framing, shared codecs, expected session/attempt correlation, one five-second ceiling, caller/host cancellation, zero authority and closed streams on failure, fixed errors, and retained buffered bytes on success. It sends only the challenge; it does not publish acceptance/configuration or install a relay.This draft depends on #115 and is stacked on
feat/guest-reconnect-session; rebase/retarget after prerequisite merges. No shipping listener invokes the new helper and no capability is enabled. Fresh current configuration, instance/epoch-bound relay handoff, configuration redemption/readiness, cold lifecycle ordering and real VM/agent qualification remain integration gates.Validation:
make verifyused disposable PostgreSQL with Docker daemon tests explicitly disabled because the required image is absent. Its only failure was the previously observed latency cleanup timing case; that case passed in isolation. Build and vet passed separately.make verify, non-root jail ownership, CLI/client race and fleet syntax gates. The built TCP/WebSocket probe passed again after CI.Commit:
7fa5fb4.Contract, alternatives and integration limits are documented in
docs/design/2026-10-01-guest-reconnect-transport.md. This is transport groundwork, not a claim of enabled live recovery or Phase B completion.