Close end-to-end testing gaps for nvx.py sandbox #229

Summary

Close the remaining deterministic test gaps for the public nvx.py sandbox interface.

Current coverage includes CLI and launch-contract unit tests, a direct one-shot Ubuntu sandbox smoke test, sandbox block/snapshot scenarios, workload-identity checks, and a lower-level managed OpenVMM lifecycle test. However, CI does not currently exercise the complete public managed lifecycle (provision -> start -> exec -> stop -> deprovision) end to end, and the one-shot smoke test checks only identity, distro selection, and a scratch-backed write.

This issue is for deterministic regression coverage. Adaptive adversarial testing remains tracked by #102.

Work items

• Add an end-to-end test that invokes the public managed sandbox commands against real kernel, initramfs, EROFS, and ext4 artifacts:
  • sandbox provision
  • sandbox start
  • multiple sandbox exec operations
  • sandbox stop
  • sandbox deprovision
• Verify state persists between managed exec requests, including arguments containing whitespace.
• Exercise workload timeout, nonzero exit, stdout/stderr forwarding, and bounded outcome-report behavior.
• Exercise fail-closed lifecycle transitions, including exec before start, duplicate start, deprovision while running, and stale runtime state.
• Extend the guest sandbox probe to verify the security invariants promised by the profile:
  • fixed non-root UID/GID and unavailable/root identities rejected;
  • empty effective/permitted/bounding capability sets and NoNewPrivs: 1;
  • private mount, PID, and UTS namespaces;
  • private device view and read-only sysfs;
  • memory.max and pids.max enforcement;
  • immutable EROFS lower layers and writable scratch-backed overlay state.
• Add scripts/test_control_session.py to the authoritative validate-nvx unit-test invocation (or switch that action to bounded test discovery that includes it).
• Preserve useful OpenVMM, guest, control-session, and outcome artifacts on failure without including workload output or credentials in bounded reports.
• Update CI/testing documentation to describe the resulting coverage.

Acceptance criteria

• CI executes the complete public managed sandbox lifecycle on KVM, MSHV, and WHP.
• At least two managed exec requests prove filesystem state survives within the warm guest.
• Timeout, nonzero exit, stdout/stderr, and outcome-report behavior are asserted through nvx.py sandbox exec.
• Invalid lifecycle transitions fail with explicit errors and leave no leaked OpenVMM process, socket/pipe, capability file, or runtime record.
• Stop and deprovision remove only NVX-owned lifecycle state; supplied EROFS and scratch artifacts remain intact.
• A deterministic guest probe covers the documented identity, namespace, capability, no_new_privs, cgroup, lower-layer, and scratch invariants.
• scripts/test_control_session.py runs in the normal Linux and Windows CLI validation jobs.
• Existing one-shot sandbox smoke coverage continues to pass on KVM, MSHV, and WHP.

Related

• Add Copilot-driven adversarial stress and security testing #102 tracks adaptive adversarial stress and security testing; this issue should provide deterministic prerequisites and regression cases for that work.
• Sandbox mode never mounts the live virtio-fs share (--mount) inside the workload container #216 has sandbox virtio-fs-specific acceptance coverage and should remain independently tracked.