Repository navigation

test: add colocated core component acceptance suite - #841

Open

kvinwang wants to merge 397 commits into

nextfrom

codex/core-components-test-infrastructure

Open

test: add colocated core component acceptance suite#841
kvinwang wants to merge 397 commits into
nextfrom
codex/core-components-test-infrastructure

This pull request is big! We're only showing the most recent 250 commits

Commits on Nov 11, 2026
- test: allow clients without Gateway endpoints
  kvinwang
  committed
  8183f8c
- test: run guest compatibility on physical TDX
  kvinwang
  committed
  a6363e4
- test: prepare physical compatibility collateral
  kvinwang
  committed
  95fb4a9
- test(verifier): avoid fixed cc-eventlog test count
  kvinwang
  committed
  2d5de85
- test: prepare simulator collateral before guest boot
  kvinwang
  committed
  ab47c96
- test: prepare simulated identity image variant
  kvinwang
  committed
  9de6fa4
- test(simulator): restore SEV-SNP ABI regression coverage
  kvinwang
  committed
  75c162f
- test(kms): prepare nested contract dependencies
  kvinwang
  committed
  5755ecb
- test(kms): probe event audit contract fixtures
  kvinwang
  committed
  dca2c45
- test(kms): probe runtime contract fixtures
  kvinwang
  committed
  18bd5fa
- test(guest): wait for bind conflict cleanup
  kvinwang
  committed
  d781fbd
- test(gateway): synchronize concurrent renewal requests
  kvinwang
  committed
  139edf0
- test(guest): cancel bind conflict restart jobs
  kvinwang
  committed
  8c87bbd
- test(gateway): prepare allocation wireguard fixture
  kvinwang
  committed
  718c0ed
- test(gateway): establish distributed renewal contention
  kvinwang
  committed
  f2f1a9a
- test(gateway): isolate allocation recycle phase
  kvinwang
  committed
  49cf78b
- test(integration): retry rolling KMS metadata probes
  kvinwang
  committed
  ed3c32a
- test(platform): wait for sealing provider recovery
  kvinwang
  committed
  dd31616
- test(harness): probe lifecycle readiness deterministically
  kvinwang
  committed
  1199de6
- test(gateway): align allocation and renewal invariants
  kvinwang
  committed
  75cd301
- test(integration): await bounded KMS boot failure
  kvinwang
  committed
  e16c069
- test(gateway): recheck distributed renewal freshness
  kvinwang
  committed
  98c6f4a
- test(provider): retry transient sealing startup
  kvinwang
  committed
  3262f8f
- test(harness): harden runtime readiness probes
  kvinwang
  committed
  7f58a7a
- test(vmm): probe the browser endpoint directly
  kvinwang
  committed
  0b55688
- test(plan): cover post-baseline merged regressions
  kvinwang
  committed
  8ef3215
- test(plan): refresh post-merge harness expectations
  kvinwang
  committed
  07ce5f1
- test(plan): align ACPI measurement matrix
  kvinwang
  committed
  4314cb8
- test(plan): harden dependency-backed harnesses
  kvinwang
  committed
  27c3942
- test(plan): run prepared Playwright offline
  kvinwang
  committed
  2b3aee8
- test(plan): make UI browser execution deterministic
  kvinwang
  committed
  92feed0
- test(plan): preserve expected stargz failures
  kvinwang
  committed
  98e7342
- test(plan): unmount stale stargz snapshots
  kvinwang
  committed
  67a3549
- test(plan): use persistent stargz storage
  kvinwang
  committed
  21818c6
- test(plan): wait for stargz unmounts
  kvinwang
  committed
  ea9393b
- test(plan): preserve concurrent pull failures
  kvinwang
  committed
  60270b9
- test(plan): deterministically corrupt stargz layer
  kvinwang
  committed
  10d4a83
- test(plan): accept truncated stargz diagnostics
  kvinwang
  committed
  aac590f
- test(plan): assert corrupt stargz rejection by status
  kvinwang
  committed
  5c4a968
- test(plan): assert stargz outages by status
  kvinwang
  committed
  5cbd8ee
- test(plan): force remote stargz corruption path
  kvinwang
  committed
  35381d3
- test(plan): zero corrupt stargz layer
  kvinwang
  committed
  9da5d9e
- test(plan): clear stargz cache before corruption
  kvinwang
  committed
  4331a89
- test(plan): restart registry after layer corruption
  kvinwang
  committed
  49930fc
- test(gateway): cover multi-cluster CVM registration
  kvinwang
  committed
  70fb069
- test(gateway): align native multi-cluster rows
  kvinwang
  committed
  359e9fa
- test(gateway): verify multi-cluster proxy data paths
  kvinwang
  committed
  7899f43
- test(gateway): harden multi-cluster proxy acceptance
  kvinwang
  committed
  ba7d7f7
- test(vmm): document macvtap connectivity acceptance
  kvinwang
  committed
  08b2151
- test(plan): gate tdxlab sweeps on preflight
  kvinwang
  committed
  c818d0a
- refactor(test): colocate core component suite
  kvinwang
  committed
  634245d
- fix(test): align image provenance with builder metadata
  kvinwang
  committed
  4b5269d
- test: harden core component coverage
  kvinwang
  committed
  a9263de
- test: pin Bun for tdxlab runs
  kvinwang
  committed
  6de6057
- fix(test): preserve Bun path operations
  kvinwang
  committed
  e68ec2d
- refactor(test): externalize hardware host configuration
  kvinwang
  committed
  ef5fc80
- fix(test): resolve configured Docker runner lazily
  kvinwang
  committed
  e9f187f
- fix(test): retain guest port reservations for active leases
  kvinwang
  committed
  6b0f934
- fix(test): wait for guest API before Gateway startup
  kvinwang
  committed
  d9ca293
- fix(test): retry bounded Sysbox recovery
  kvinwang
  committed
  b5efc72
- fix(test): make version cleanup independent of caller env
  kvinwang
  committed
  b6925c1
- fix(test): execute gated Cloudflare client tests
  kvinwang
  committed
  8ace0c0
- test(plan): cover changes since PR 841 baseline
  kvinwang
  committed
  fc8e765
- fix(test): align frozen guest RPC coverage
  kvinwang
  committed
  5e78290
- fix(test): record removed RPC evidence schema
  kvinwang
  committed
  a142841
- fix(test): align component matrices with next
  kvinwang
  committed
  6d9500b
- fix(test): cover declarative OVMF selection
  kvinwang
  committed
  5f84400
- fix(test): ignore legacy image version metadata
  kvinwang
  committed
  60b06fe
- fix(test): accept explicit gateway fallback rejection
  kvinwang
  committed
  4f8187f
- fix(test): tolerate absent gateway recovery samples
  kvinwang
  committed
  e5310fe
- test(gateway): cover certbot and gateway changes on next
  kvinwang
  committed
  4744bc0
- test(vmm): cover netd, networking, and GPU proxy changes on next
  kvinwang
  committed
  ec9920e
- test(os): cover guest kernel and image changes on next
  kvinwang
  committed
  f3a87d6
- test(verifier): cover setup-header normalization and cmdline suffix
  kvinwang
  committed
  510df59
- test(guest): cover GPU telemetry, discard, and v1 attestation
  kvinwang
  committed
  6e879c2
- docs(testing): record next rebase coverage (2026-09-17)
  kvinwang
  committed
  6f69fff
- fix(test): run vitest 4 on Node 20 and wait for the shared ACME lock
  kvinwang
  committed
  ac7104a
- fix(test): mirror certbot fixture images into the upgrade registry
  kvinwang
  committed
  e2f380b
- fix(test): align fixture DNS auth, vitest output, and verifier suite counts
  kvinwang
  committed
  60a7e5b
- test(verifier): cover the canonical setup-header layout
  kvinwang
  committed
  b403a35
- test(vmm): let a run pin the QEMU the VMM launches
  kvinwang
  committed
  e0b5017
- test(verifier): cover the shipped canonical setup header
  kvinwang
  committed
  6a5b4c4
- test: add the adversarial request-contract matrix
  kvinwang
  committed
  c80c199
- test: make the echo invariant about scaling
  kvinwang
  committed
  1bd2184
- test: address the onboarding listener at the mount the fixture publishes
  kvinwang
  committed
  4ba2087
- test: address the gateway listeners at the mount the fixture publishes
  kvinwang
  committed
  08b75a8
- test: promote the request-contract cases on their tdxlab run
  kvinwang
  committed
  828ea1e
- style(test): format the request-contract matrix harness
  kvinwang
  committed
  0b9bc83
- refactor(test): simplify the request-contract matrix harness
  kvinwang
  committed
  1fc93fc
- docs(test): trim the request-contract case prose
  kvinwang
  committed
  3f09c04
- test: add a guest-agent concurrency and robustness harness
  kvinwang
  committed
  0f6cab3
- test: add the guest-agent concurrency and robustness cases
  kvinwang
  committed
  559c55a
- test: tolerate an unreadable fd table
  kvinwang
  committed
  3384cc7
- test: promote the guest-agent robustness cases on their tdxlab run
  kvinwang
  committed
  a308a23
- test: name the restart that the concurrency-002 drops actually were
  kvinwang
  committed
  5d4f0bf
- refactor(test): trim the guest-agent robustness harness and case prose
  kvinwang
  committed
  20f6342
- style(test): put the robustness case docstrings in the imperative mood
  kvinwang
  committed
  a97358b
- style(test): put the request-contract harness docstrings in the imperative mood
  kvinwang
  committed
  a466a1d
- chore(test): restore files reordered by the next rebase
  kvinwang
  committed
  e969a86
- test(guest): expect escaped backslashes in the systemd env file
  kvinwang
  committed
  e3fa69a
- test(supervisor): cover clear semantics, exit codes, socket mode, and log reopening
  kvinwang
  committed
  51c1276
- test(guest-agent): refuse certificate validity bounds past year 9999
  kvinwang
  committed
  a682efa
- test(guest-agent): cover Info with public_tcbinfo off on both surfaces
  kvinwang
  committed
  3c93977
- test(dstack-util): cover include: refusal and the hardened host-share mount
  kvinwang
  committed
  e103757
- test(guest): assert the storage-encrypted and os-image-hash runtime events
  kvinwang
  committed
  282366c
- test(guest): cover owner-only boot secrets and env delivery by exec-with-env
  kvinwang
  committed
  1b73683
- test(os): assert the boot-chain unit edges added on next
  kvinwang
  committed
  ca2ae76
- test(os): check terminal presets and build-time rootfs tmpfiles on the booted image
  kvinwang
  committed
  fd3675b
- test(os): require the NTS-only chrony policy in mkosi guests
  kvinwang
  committed
  7bd023a
- test(os): require the volatile journald budget shipped in the image
  kvinwang
  committed
  100c169
- test(dstack-util): require the data disk to leave the initializing label
  kvinwang
  committed
  9420891
- test(guest): record the MR config and GPU event expectations from next
  kvinwang
  committed
  21ff697
- test(os): check early mount options, verity panic policy, and shipped runtime config
  kvinwang
  committed
  7a12107
- test(vmm): gate the installer's temporary checkout cleanup
  kvinwang
  committed
  56ecf02
- test(vmm): retire the OCI registry pull cases and fixture
  kvinwang
  committed
  a724007
- test(vmm): cover the hotplug, event-name, and preallocation config defaults
  kvinwang
  committed
  318cf0b
- test(vmm): cover zero-resource refusal and disk preallocation on CreateVm
  kvinwang
  committed
  fd1d822
- test(vmm): cover port mapping policy and no partial writes on UpdateVm
  kvinwang
  committed
  c1c9428
- test(vmm): refuse re-enabling discard on a preallocated VM update
  kvinwang
  committed
  fce106d
- test(vmm): cover vmm-cli TLS verification and owner-only local state
  kvinwang
  committed
  50f625e
- test(verifier): measure GPU topology with hotplug off and reject it on
  kvinwang
  committed
  4b309dd
- test(vmm): cover the one-shot compose preview of a multi-byte compose
  kvinwang
  committed
  0105948
- test(vmm): bind the resource, GPU, update, and preallocation unit rows
  kvinwang
  committed
  d888dfc
- test(vmm): cover the preallocation select and local-only images panel in the web UI
  kvinwang
  committed
  59f9c1a
- test(vmm): require pinned console dependencies in the web UI case
  kvinwang
  committed
  a970422
- test(kms): expect the eight-row authorization freshness matrix
  kvinwang
  committed
  2bea3a9
- test(kms): cover key handover on the admin listener
  kvinwang
  committed
  b9a4c29
- test(kms): cover image-verification visibility, auth API bounds, and the Nitro Enclave gate
  kvinwang
  committed
  6227b2a
- test(kms): run the zero-value DstackApp policy test
  kvinwang
  committed
  af4c75e
- test(kms): deny on an empty auth-simple device allowlist
  kvinwang
  committed
  a9f8211
- test(kms): refuse an unknown MOCK_POLICY in auth-mock
  kvinwang
  committed
  46e55b7
- test(kms): check that both auth-eth backends read one decision from one block
  kvinwang
  committed
  1cafe8e
- test(kms): check the identity SignCert stamps into the app leaf
  kvinwang
  committed
  d1d6a41
- test(kms): cover auto-bootstrap over existing and partial root keys
  kvinwang
  committed
  a61bb80
- test(kms): gate locked image builds, the pinned onboarding script, and ct_monitor
  kvinwang
  committed
  67c6663
- test(vmm): require the installer to build dstackup with --locked
  kvinwang
  committed
  66ad753
- test(kms): record SEV-SNP and Nitro Enclave identity changes in blocked cases
  kvinwang
  committed
  06242ae
- test(kms): note the admin onboarding flow that tc-kms-onboard-005 depends on
  kvinwang
  committed
  2702d4c
- test(gateway): install the proxy certificate through Admin.ImportCert
  kvinwang
  committed
  b7738f2
- test(gateway): assert the public app-info route honors public_tcbinfo
  kvinwang
  committed
  e947430
- test(gateway): require registration bursts to reach the applied WireGuard config
  kvinwang
  committed
  ade3fe2
- test(gateway): run the routing-lock regression tests in tc-gw-cluster-ad-004
  kvinwang
  committed
  8d1d6e7
- test(gateway): refuse own-id WaveKV envelopes and pin the peer timeout and lock tests
  kvinwang
  committed
  75b45b3
- test(gateway): send normalized-domain payloads to ForceReleaseCertLock and ListCertAttestations
  kvinwang
  committed
  efeac5a
- test(gateway): keep startup off ACME and release locks under any domain spelling
  kvinwang
  committed
  3f76d02
- test(gateway): redact a DNS token with multi-byte characters on both cuts
  kvinwang
  committed
  955d315
- test(certbot): cover owner-only keys, atomic publication, key rotation and bounded hooks
  kvinwang
  committed
  c8605fb
- test(gateway): cover SNI validation, large ClientHellos and the 53-byte abort
  kvinwang
  committed
  ee3069d
- test(gateway): require the PROXY header abort tests by name
  kvinwang
  committed
  38c0672
- test(gateway): hold the connection limit under a simultaneous burst
  kvinwang
  committed
  fc7e4d0
- test(kms): expect the eight-row upgrade authority matrix
  kvinwang
  committed
  bd79e3c
- test(rpc): bound error text and forbid forged log lines in the contract matrix
  kvinwang
  committed
  35ac0e6
- test(gateway): wait for the restarted admin listener before restoring ACME
  kvinwang
  committed
  44c4763
- test(verifier): follow image download retries and the removed debug path
  kvinwang
  committed
  1710601
- test(verifier): cover the collateral host allowlist key and download retries
  kvinwang
  committed
  8eb1a54
- test(verifier): follow the in-process image manifest check and cache bounds
  kvinwang
  committed
  57d47e8
- test(integration): run the renamed verifier manifest policy test
  kvinwang
  committed
  d05c765
- test(guest): allow the simulator collateral host in tpm-verify
  kvinwang
  committed
  4e659b4
- test(verifier): cover dstack-mr diagnose, the XLF initrd ceiling, and parser bounds
  kvinwang
  committed
  e91e558
- test(verifier): run the SEV-SNP and TPM input bound tests by name
  kvinwang
  committed
  02b4fbb
- test(verifier): cover --verify-cert validity and stop pinning the ra-tls test count
  kvinwang
  committed
  b2de9f2
- test(verifier): follow the dstack-attest suite sizes
  kvinwang
  committed
  d7c7b7d
- docs(test): allow the local collateral host in the simulator verifier config
  kvinwang
  committed
  5b119bd
- test(kms): drop duplicate auth-010 coverage labels from the merge
  kvinwang
  committed
  ddcff0d
- test(catalog): align inventories with next at 0fb3b24bbd
  kvinwang
  committed
  c648a11
- docs(testing): record next rebase coverage (2026-09-24)
  kvinwang
  committed
  5318497
- style(test): sort imports in two harnesses as the ruff hook expects
  kvinwang
  committed
  40130ac
- docs(testing): link the rootless mkosi and WireGuard apply fixes
  kvinwang
  committed
  2197d75
- test(guest-agent): read the certificate notAfter on cryptography < 42
  kvinwang
  committed
  4efca47
- test(fixtures): wait for the whole simulator process group on stop
  kvinwang
  committed
  0dd3ca2
- test(guest-agent): keep head-of-line observations when the step fails
  kvinwang
  committed
  f67330f
- test(kms): import os in the runtime-004 mock RPC and report its failures
  kvinwang
  committed
  ebbd497
- test(os): wait for app-compose before repeating Tappd after an agent restart
  kvinwang
  committed
  1230a8b
- test(guest-agent): ramp the head-of-line loaders past the slirp backlog
  kvinwang
  committed
  a63dde8
- test(os): settle the data pool before the telemetry disk baseline
  kvinwang
  committed
  16b3051
- test(os): keep the mount-option set from shadowing the module options
  kvinwang
  committed
  f3e29c1
- test(verifier): pin --hotplug-off in the shared dstack-mr matrix
  kvinwang
  committed
  45f18f0
- test(gateway): wait for the debug listener before reading restored sync state
  kvinwang
  committed
  625be4d
- test(os): wait for the swap lease guest to stop before starting it again
  kvinwang
  committed
  aa5c549
- test(os): give the stargz lifecycle case the budget its own steps allow
  kvinwang
  committed
  467875e
- test(os): corrupt the stargz marker payload rather than the blob midpoint
  kvinwang
  committed
  31acf98
- test(integration): reserve KMS matrix host ports across concurrent cases
  kvinwang
  committed
  ff307fb
- test(integration): prove the candidate Gateway loaded legacy WaveKV rows
  kvinwang
  committed
  b49e2cc
- style(test): format the dstack-mr matrix harness
  kvinwang
  committed
  3bc39ab
- style(test): keep harness docstring summaries on one line
  kvinwang
  committed
  0211378
- docs(testing): record the product fixes found on hardware
  kvinwang
  committed
  a2e39e2
- test(gateway): promote tc-gw-admin-037 and record the hardware validation
  kvinwang
  committed
  8c7c3e3
- test(os): check the runtime keystore mode now that #1331 is reverted
  kvinwang
  committed
  8902e61
- test(kms): promote tc-kms-onboard-005 now that #1406 is merged
  kvinwang
  committed
  6acdb43
- docs(testing): record the validation of the merged product fixes
  kvinwang
  committed
  d50f647
- test(kms): cover root and app key rotation lifecycle
  kvinwang
  committed
  15668d3
- test(kms): run every rotation matrix row
  kvinwang
  committed
  77797fb
- test(tdxlab): record the key rotation matrix run
  kvinwang
  committed
  e4d3c2c
- test(kms): fix rotation matrix result parsing
  kvinwang
  committed
  8d56e14
- test(kms): cover contract and backend epoch rotation
  kvinwang
  committed
  d5a3e04
- test: cover non-rotation forward interval changes
  kvinwang
  committed
  9308afc
- test(kms): run contract rotation suites independently
  kvinwang
  committed
  4ffe080
- test(kms): parse Foundry rotation results
  kvinwang
  committed
  457fd91
- test: detect focused forward matrix rows reliably
  kvinwang
  committed
  62239ca
- test: validate forward matrix execution summaries
  kvinwang
  committed
  95bf835
- test: use Cargo exit status for forward matrix rows
  kvinwang
  committed
  db4ac14
- test(kms): run backend matrix with npm on tdxlab
  kvinwang
  committed
  ea693f0
- test(kms): clean between contract rotation suites
  kvinwang
  committed
  2fa316c
- test(tdxlab): promote forward interval regression matrices
  kvinwang
  committed
  47f07d3
- test: use matching guest images in version matrix
  kvinwang
  committed
  a7c1064
- test: select KMS encryption endpoint by guest capability
  kvinwang
  committed
  078c414
- test: pair mixed clients with matching OS and KMS versions
  kvinwang
  committed
  3ea7167
- test: fix mixed matrix image lookup
  kvinwang
  committed
  2d0eed4
- test: pin KMS signer before sealed env deployment
  kvinwang
  committed
  382188a
- test: pin KMS signer in client deployment
  kvinwang
  committed
  2fcc2b5
- test: isolate physical VMM signer pins per fixture
  kvinwang
  committed
  442bae8
- test: isolate VMM signer whitelist without changing HOME
  kvinwang
  committed
  581588d
- test: specify in-place disk migration after KMS rotation
  kvinwang
  committed
  a9ab0e8
- test: execute root rotation and in-place OS migration
  kvinwang
  committed
  b0c7c68
- test: use image-hash capable KMS for rotation migration
  kvinwang
  committed
  e7b1ec7
- test: use 0.5.11 source in rotation migration case
  kvinwang
  committed
  c7eb90c
- test: cover KMS and App contract upgrade combinations
  kvinwang
  committed
  40a84db
- test: fix physical migration observer wait
  kvinwang
  committed
  a05220a
- test: run rotation migration from the 0.6.0 source
  kvinwang
  committed
  1835da5
- test: prepare the 0.6.0 guest image for rotation cases
  kvinwang
  committed
  e547850
- test: wait for migrated VM boot before observer
  kvinwang
  committed
  48e3e13
- test: check VMM Python dependencies before hardware runs
  kvinwang
  committed
  b26ca49
- test: follow the KMS auth backend consolidation
  kvinwang
  committed
  adc7b74
- test: set public_key_handover explicitly in KMS fixtures
  kvinwang
  committed
  b32d94d
- test: match the public handover refusal changed in #1552
  kvinwang
  committed
  96a4f97
- test: give simulated KMS clients a TDX lite attestation
  kvinwang
  committed
  373b1ac
- test: encode the KMS RPC protobuf length as a varint
  kvinwang
  committed
  6f0f01a
- test: cover SealedEnv epochs across a KMS root rotation
  kvinwang
  committed
  dc46a1b
- test: adapt KMS fixtures to the handover startup check
  kvinwang
  committed
  6332786
- test: present a guest API token to the Worker listener
  kvinwang
  committed
  9e57f63
- test: let physical guests pass KMS key release
  kvinwang
  committed
  de1e602
- test: build the ECDH decrypt probe with the SealedEnv dependencies
  kvinwang
  committed
  e6ce18e
- test: render the dashboard probe with the scope-gated fields
  kvinwang
  committed
  ca1d7a8
- test: grant the sample guest API scopes and share token minting
  kvinwang
  committed
  25b7cd9
- test: expect the KMS to always verify OS images
  kvinwang
  committed
  aaa9b8c
- test: plant measurement cache entries as their JSON files
  kvinwang
  committed
  32b4d35
- test: report steps from the KMS rotation unit matrices
  kvinwang
  committed
  3fb27c2
- test: require at least the original upgrade-authority tests
  kvinwang
  committed
  0e8b418
- test: answer KMS authorization with an epoch-aware webhook
  kvinwang
  committed
  de0af00
- test: drop the removed KMS compose from the locked-build check
  kvinwang
  committed
  7eaf2ff
- test: report a step from the forward interval matrix
  kvinwang
  committed
  d557a02
- test: answer the upgrade-policy webhook in the epoch-aware shape
  kvinwang
  committed
  7fb4b88
- test: name the root epoch row in Manage.s.sol policy writes
  kvinwang
  committed
  33fb808
- test: serve every matrix guest image to the KMS verifier
  kvinwang
  committed
  1a4b554
- test: pin the KMS signer before deploying a Gateway
  kvinwang
  committed
  375935c
- test: run the auth-eth suite on Node 20 or newer
  kvinwang
  committed
  a8fe4a0
- test: publish dashboard metrics, logs and containers to lease callers
  kvinwang
  committed
  78e9b0c
- test: register webhook-backed matrix KMS nodes as root epoch 0
  kvinwang
  committed
  9196257
- test: hash the SealedEnv envelope of a matrix client
  kvinwang
  committed
  646e120
- test: answer the current app epoch from the upgrade-policy webhook
  kvinwang
  committed
  0ff5221

Commits

Commits on Nov 11, 2026