test: add colocated core component acceptance suite - #841

Open

kvinwang wants to merge 341 commits into

nextfrom

codex/core-components-test-infrastructure

This pull request is big! We're only showing the most recent 250 commits

Commits on Sep 25, 2026

test(tdxlab): bind dashboard preparation to case identity
kvinwang
committed
9921693
test(kms): prepare finalized Ethereum head
kvinwang
committed
d1dab6a
test(integration): follow current gateway admin contract
kvinwang
committed
4485817
test(tdxlab): preserve guest image integrity
kvinwang
committed
f505892
test(integration): bound gateway DNS fixture waits
kvinwang
committed
a5509ac
test(integration): accept compatible Exit request evolution
kvinwang
committed
ee75439
style(test): format integration matrix
kvinwang
committed
da4b2fe
test(integration): use mock DNS listener port
kvinwang
committed
9d116b4
test(fixtures): bind cleanup to prepared state root
kvinwang
committed
9205396
test(integration): pin mock DNS zone
kvinwang
committed
cd03a84
test(tdxlab): preflight Docker daemon
kvinwang
committed
51107be
test(integration): model Cloudflare zone discovery
kvinwang
committed
0e78d92
test(tdxlab): prepare user namespaces
kvinwang
committed
c6aea76
test(integration): bridge legacy Gateway contracts
kvinwang
committed
875b84b
test: fix mixed-version gateway failover harness
kvinwang
committed
6481de9
test: select live KMS for failover preparation
kvinwang
committed
b7120f8
test: prepare identity matrix alternate image
kvinwang
committed
3192f5c
test: remove unused collateral prerequisite
kvinwang
committed
9ba77f4
test: update KMS compatibility certificate config
kvinwang
committed
dfe0fb8
test: follow split VMM restart policy tests
kvinwang
committed
3048ba3
test: resolve Cargo for gateway refresh harness
kvinwang
committed
2060d82
test: align VMM QEMU platform matrix
kvinwang
committed
59e6d57
test: follow current VMM networking contract
kvinwang
committed
a81a6da
test: shorten VMM networking runtime paths
kvinwang
committed
c393664
test: start bridge VM before launch inspection
kvinwang
committed
d835b13
test: prepare VMM hugepage prerequisites
kvinwang
committed
38f08fe
test: exercise VMM hugepage lifecycle
kvinwang
committed
ed4f34e
test: explicitly start user network VM
kvinwang
committed
cba6661
test: detach networking case supervisor
kvinwang
committed
b1efaf3
test: preserve VMM placement command evidence
kvinwang
committed
46f7940
test: inspect supervised QEMU launch spec
kvinwang
committed
4b49a57
test: follow attestation suite growth
kvinwang
committed
b2dad1f
test: follow current mock attestation CLI
kvinwang
committed
263088f
test: require both cloud quote matrices
kvinwang
committed
a048495
test: replace removed verifier matrix selectors
kvinwang
committed
e33ae2e
test: align verifier coverage with current suites
kvinwang
committed
09ebd72
test: prepare isolated Docker subnet pool
kvinwang
committed
6809184
test: preserve CAA concurrency diagnostics
kvinwang
committed
5367ec3
test: follow Gateway CAA operation locking
kvinwang
committed
b603253
test: restore current Certbot and auth regressions
kvinwang
committed
c02a9ca
test: follow current Gateway unit matrices
kvinwang
committed
f65928e
test: follow current Gateway port-policy matrix
kvinwang
committed
81eefbf
test: make Gateway DNS routing fixture deterministic
kvinwang
committed
876422d
test: follow removed KMS certificate-log surface
kvinwang
committed
d639c06
test: execute current KMS binary test target
kvinwang
committed
36b5638
test: prepare seed-matched guest compatibility evidence
kvinwang
committed
9d08625
test: cover KMS signatures and injected Gateway outages
kvinwang
committed
b935b62
test: select prepared TDX simulator explicitly
kvinwang
committed
f38f3e4
test: run compatibility evidence without hardware TDX
kvinwang
committed
2294d49
test: follow verifier certificate profile ownership
kvinwang
committed
44036d2
test: prepare lease-owned attestation VMM
kvinwang
committed
af81e54
test: separate physical and simulator collateral
kvinwang
committed
ee71187
test: observe app identity during Gateway outage
kvinwang
committed
f2e4e28
test: separate Gateway boot and registration probes
kvinwang
committed
727fc03
test: exercise Gateway identity fallback
kvinwang
committed
902be68
test: decouple identity probe from Gateway cache
kvinwang
committed
7280690
test: allow clients without Gateway endpoints
kvinwang
committed
402eed1
test: run guest compatibility on physical TDX
kvinwang
committed
f480593
test: prepare physical compatibility collateral
kvinwang
committed
d5f81fb
test(verifier): avoid fixed cc-eventlog test count
kvinwang
committed
b57038e
test: prepare simulator collateral before guest boot
kvinwang
committed
f32a1f4
test: prepare simulated identity image variant
kvinwang
committed
580d4e3
test(simulator): restore SEV-SNP ABI regression coverage
kvinwang
committed
b3fc01f
test(kms): prepare nested contract dependencies
kvinwang
committed
956c0d1
test(kms): probe event audit contract fixtures
kvinwang
committed
d572dd0
test(kms): probe runtime contract fixtures
kvinwang
committed
122eff5
test(guest): wait for bind conflict cleanup
kvinwang
committed
f5b786b
test(gateway): synchronize concurrent renewal requests
kvinwang
committed
c25046e
test(guest): cancel bind conflict restart jobs
kvinwang
committed
787b6e8
test(gateway): prepare allocation wireguard fixture
kvinwang
committed
c831fe8
test(gateway): establish distributed renewal contention
kvinwang
committed
2badaec
test(gateway): isolate allocation recycle phase
kvinwang
committed
19b3704
test(integration): retry rolling KMS metadata probes
kvinwang
committed
aaf7eb4
test(platform): wait for sealing provider recovery
kvinwang
committed
aecba2e
test(harness): probe lifecycle readiness deterministically
kvinwang
committed
56cf4b7
test(gateway): align allocation and renewal invariants
kvinwang
committed
f611c47
test(integration): await bounded KMS boot failure
kvinwang
committed
23bcfeb
test(gateway): recheck distributed renewal freshness
kvinwang
committed
c6f4a1a
test(provider): retry transient sealing startup
kvinwang
committed
2edb519
test(harness): harden runtime readiness probes
kvinwang
committed
7be0448
test(vmm): probe the browser endpoint directly
kvinwang
committed
c13c928
test(plan): cover post-baseline merged regressions
kvinwang
committed
869e200
test(plan): refresh post-merge harness expectations
kvinwang
committed
e67a893
test(plan): align ACPI measurement matrix
kvinwang
committed
55655c2
test(plan): harden dependency-backed harnesses
kvinwang
committed
b9105cd
test(plan): run prepared Playwright offline
kvinwang
committed
7914f8d
test(plan): make UI browser execution deterministic
kvinwang
committed
238b5ab
test(plan): preserve expected stargz failures
kvinwang
committed
73df1de
test(plan): unmount stale stargz snapshots
kvinwang
committed
da36d19
test(plan): use persistent stargz storage
kvinwang
committed
6948c40
test(plan): wait for stargz unmounts
kvinwang
committed
dd56f6c
test(plan): preserve concurrent pull failures
kvinwang
committed
3b05307
test(plan): deterministically corrupt stargz layer
kvinwang
committed
864a808
test(plan): accept truncated stargz diagnostics
kvinwang
committed
ffee265
test(plan): assert corrupt stargz rejection by status
kvinwang
committed
f963e3d
test(plan): assert stargz outages by status
kvinwang
committed
16f7d15
test(plan): force remote stargz corruption path
kvinwang
committed
0d11659
test(plan): zero corrupt stargz layer
kvinwang
committed
b4176bb
test(plan): clear stargz cache before corruption
kvinwang
committed
aadff55
test(plan): restart registry after layer corruption
kvinwang
committed
80941ed
test(gateway): cover multi-cluster CVM registration
kvinwang
committed
5771155
test(gateway): align native multi-cluster rows
kvinwang
committed
01f1a38
test(gateway): verify multi-cluster proxy data paths
kvinwang
committed
aaf72a9
test(gateway): harden multi-cluster proxy acceptance
kvinwang
committed
4151b94
test(vmm): document macvtap connectivity acceptance
kvinwang
committed
06652b9
test(plan): gate tdxlab sweeps on preflight
kvinwang
committed
a1fbbff
refactor(test): colocate core component suite
kvinwang
committed
48cb2d3
fix(test): align image provenance with builder metadata
kvinwang
committed
21ad01c
test: harden core component coverage
kvinwang
committed
da33b9d
test: pin Bun for tdxlab runs
kvinwang
committed
e1a5331
fix(test): preserve Bun path operations
kvinwang
committed
1c085c7
refactor(test): externalize hardware host configuration
kvinwang
committed
88d7d6e
fix(test): resolve configured Docker runner lazily
kvinwang
committed
6cb0e3b
fix(test): retain guest port reservations for active leases
kvinwang
committed
4bbcb5e
fix(test): wait for guest API before Gateway startup
kvinwang
committed
155754a
fix(test): retry bounded Sysbox recovery
kvinwang
committed
a774de5
fix(test): make version cleanup independent of caller env
kvinwang
committed
3d4bc1b
fix(test): execute gated Cloudflare client tests
kvinwang
committed
e4ec281
test(plan): cover changes since PR 841 baseline
kvinwang
committed
707e72e
fix(test): align frozen guest RPC coverage
kvinwang
committed
5956864
fix(test): record removed RPC evidence schema
kvinwang
committed
30110b3
fix(test): align component matrices with next
kvinwang
committed
5efbbc7
fix(test): cover declarative OVMF selection
kvinwang
committed
99f9c95
fix(test): ignore legacy image version metadata
kvinwang
committed
77f3146
fix(test): accept explicit gateway fallback rejection
kvinwang
committed
f56f54c
fix(test): tolerate absent gateway recovery samples
kvinwang
committed
3b56100
test(gateway): cover certbot and gateway changes on next
kvinwang
committed
669870d
test(vmm): cover netd, networking, and GPU proxy changes on next
kvinwang
committed
da4ea41
test(os): cover guest kernel and image changes on next
kvinwang
committed
dfc2dac
test(verifier): cover setup-header normalization and cmdline suffix
kvinwang
committed
7956c0f
test(guest): cover GPU telemetry, discard, and v1 attestation
kvinwang
committed
0a43397
docs(testing): record next rebase coverage (2026-09-17)
kvinwang
committed
a176a70
fix(test): run vitest 4 on Node 20 and wait for the shared ACME lock
kvinwang
committed
989c9ed
fix(test): mirror certbot fixture images into the upgrade registry
kvinwang
committed
688f892
fix(test): align fixture DNS auth, vitest output, and verifier suite counts
kvinwang
committed
cb68d9d
test(verifier): cover the canonical setup-header layout
kvinwang
committed
394b995
test(vmm): let a run pin the QEMU the VMM launches
kvinwang
committed
cfc1285
test(verifier): cover the shipped canonical setup header
kvinwang
committed
25eda73
test: add the adversarial request-contract matrix
kvinwang
committed
cad868c
test: make the echo invariant about scaling
kvinwang
committed
39d6fc8
test: address the onboarding listener at the mount the fixture publishes
kvinwang
committed
e1ff09c
test: address the gateway listeners at the mount the fixture publishes
kvinwang
committed
d713907
test: promote the request-contract cases on their tdxlab run
kvinwang
committed
1dfc36e
style(test): format the request-contract matrix harness
kvinwang
committed
79d88f0
refactor(test): simplify the request-contract matrix harness
kvinwang
committed
4674ceb
docs(test): trim the request-contract case prose
kvinwang
committed
80fbe8b
test: add a guest-agent concurrency and robustness harness
kvinwang
committed
c085910
test: add the guest-agent concurrency and robustness cases
kvinwang
committed
41383de
test: tolerate an unreadable fd table
kvinwang
committed
8bfd013
test: promote the guest-agent robustness cases on their tdxlab run
kvinwang
committed
952d4e0
test: name the restart that the concurrency-002 drops actually were
kvinwang
committed
fdda440
refactor(test): trim the guest-agent robustness harness and case prose
kvinwang
committed
3c3e47d
style(test): put the robustness case docstrings in the imperative mood
kvinwang
committed
08860c3
style(test): put the request-contract harness docstrings in the imperative mood
kvinwang
committed
eef0a76
chore(test): restore files reordered by the next rebase
kvinwang
committed
73b6b06
test(vmm): gate the installer's temporary checkout cleanup
kvinwang
committed
9e81744
test(guest): expect escaped backslashes in the systemd env file
kvinwang
committed
19460e7
test(supervisor): cover clear semantics, exit codes, socket mode, and log reopening
kvinwang
committed
aa05438
test(guest-agent): refuse certificate validity bounds past year 9999
kvinwang
committed
e669d3c
test(vmm): retire the OCI registry pull cases and fixture
kvinwang
committed
a3862d8
test(vmm): cover the hotplug, event-name, and preallocation config defaults
kvinwang
committed
9e127d6
test(vmm): cover zero-resource refusal and disk preallocation on CreateVm
kvinwang
committed
81359bd
test(vmm): cover port mapping policy and no partial writes on UpdateVm
kvinwang
committed
5fd8170
test(vmm): refuse re-enabling discard on a preallocated VM update
kvinwang
committed
7134e2f
test(guest-agent): cover Info with public_tcbinfo off on both surfaces
kvinwang
committed
c55c1f8
test(dstack-util): cover include: refusal and the hardened host-share mount
kvinwang
committed
36197c3
test(vmm): cover vmm-cli TLS verification and owner-only local state
kvinwang
committed
b752ec3
test(guest): assert the storage-encrypted and os-image-hash runtime events
kvinwang
committed
149bff4
test(verifier): measure GPU topology with hotplug off and reject it on
kvinwang
committed
74941af
test(guest): cover owner-only boot secrets and env delivery by exec-with-env
kvinwang
committed
52a0fb8
test(vmm): cover the one-shot compose preview of a multi-byte compose
kvinwang
committed
d79407f
test(os): assert the boot-chain unit edges added on next
kvinwang
committed
135b059
test(verifier): follow image download retries and the removed debug path
kvinwang
committed
a31c740
test(os): check terminal presets and build-time rootfs tmpfiles on the booted image
kvinwang
committed
675f4bf
test(gateway): install the proxy certificate through Admin.ImportCert
kvinwang
committed
2f8bc15
test(os): require the NTS-only chrony policy in mkosi guests
kvinwang
committed
69a5f89
test(verifier): cover the collateral host allowlist key and download retries
kvinwang
committed
199d563
test(os): require the volatile journald budget shipped in the image
kvinwang
committed
e882f02
test(vmm): bind the resource, GPU, update, and preallocation unit rows
kvinwang
committed
336080a
test(gateway): assert the public app-info route honors public_tcbinfo
kvinwang
committed
ba64f14
test(kms): expect the eight-row authorization freshness matrix
kvinwang
committed
5c2f29e
test(kms): cover key handover on the admin listener
kvinwang
committed
fd63692
test(kms): cover image-verification visibility, auth API bounds, and the Nitro Enclave gate
kvinwang
committed
48b222e
test(kms): run the zero-value DstackApp policy test
kvinwang
committed
5badba6
test(gateway): require registration bursts to reach the applied WireGuard config
kvinwang
committed
fd0d245
test(verifier): follow the in-process image manifest check and cache bounds
kvinwang
committed
4eb3fac
test(gateway): run the routing-lock regression tests in tc-gw-cluster-ad-004
kvinwang
committed
8ad91ae
test(dstack-util): require the data disk to leave the initializing label
kvinwang
committed
0a387f6
test(guest): record the MR config and GPU event expectations from next
kvinwang
committed
3b6cec3
test(integration): run the renamed verifier manifest policy test
kvinwang
committed
ede121e
test(guest): allow the simulator collateral host in tpm-verify
kvinwang
committed
644a98a
test(kms): deny on an empty auth-simple device allowlist
kvinwang
committed
b024bce
test(kms): refuse an unknown MOCK_POLICY in auth-mock
kvinwang
committed
7253f6f
test(kms): check that both auth-eth backends read one decision from one block
kvinwang
committed
1956cb7
test(os): check early mount options, verity panic policy, and shipped runtime config
kvinwang
committed
40056ca
test(gateway): refuse own-id WaveKV envelopes and pin the peer timeout and lock tests
kvinwang
committed
d7993d5
test(gateway): send normalized-domain payloads to ForceReleaseCertLock and ListCertAttestations
kvinwang
committed
bbe74d9
test(kms): check the identity SignCert stamps into the app leaf
kvinwang
committed
ab7f6f0
test(vmm): cover the preallocation select and local-only images panel in the web UI
kvinwang
committed
0e14919
test(gateway): keep startup off ACME and release locks under any domain spelling
kvinwang
committed
3b40b9d
test(vmm): require pinned console dependencies in the web UI case
kvinwang
committed
bc74b9e
test(gateway): redact a DNS token with multi-byte characters on both cuts
kvinwang
committed
1b89bb2
test(kms): cover auto-bootstrap over existing and partial root keys
kvinwang
committed
5a87599
test(certbot): cover owner-only keys, atomic publication, key rotation and bounded hooks
kvinwang
committed
02f4dfa
test(kms): gate locked image builds, the pinned onboarding script, and ct_monitor
kvinwang
committed
a9ea500
test(vmm): require the installer to build dstackup with --locked
kvinwang
committed
1d11ec2
test(kms): record SEV-SNP and Nitro Enclave identity changes in blocked cases
kvinwang
committed
dc2349e
test(verifier): cover dstack-mr diagnose, the XLF initrd ceiling, and parser bounds
kvinwang
committed
e141d79
test(gateway): cover SNI validation, large ClientHellos and the 53-byte abort
kvinwang
committed
e11a022
test(gateway): require the PROXY header abort tests by name
kvinwang
committed
66c2d76
test(verifier): run the SEV-SNP and TPM input bound tests by name
kvinwang
committed
b4578dc
test(verifier): cover --verify-cert validity and stop pinning the ra-tls test count
kvinwang
committed
9670859
test(gateway): hold the connection limit under a simultaneous burst
kvinwang
committed
9dd2186
test(kms): expect the eight-row upgrade authority matrix
kvinwang
committed
5fb164e
test(verifier): follow the dstack-attest suite sizes
kvinwang
committed
c89fcd0
test(rpc): bound error text and forbid forged log lines in the contract matrix
kvinwang
committed
3079b90
test(kms): note the admin onboarding flow that tc-kms-onboard-005 depends on
kvinwang
committed
18b02f9
test(gateway): wait for the restarted admin listener before restoring ACME
kvinwang
committed
1c670ce
docs(test): allow the local collateral host in the simulator verifier config
kvinwang
committed
a805c71
Merge branch 'pr841-cov0924-vmm' into pr841-rebase-20260924
kvinwang
committed
20709e2
Merge branch 'pr841-cov0924-kms' into pr841-rebase-20260924
kvinwang
committed
dff44ff
Merge branch 'pr841-cov0924-gw' into pr841-rebase-20260924
kvinwang
committed
35bdd87
Merge branch 'pr841-cov0924-ver' into pr841-rebase-20260924
kvinwang
committed
99c6d1e
test(kms): drop duplicate auth-010 coverage labels from the merge
kvinwang
committed
9e076c1
test(catalog): align inventories with next at 0fb3b24bbd
kvinwang
committed
a7bebea
docs(testing): record next rebase coverage (2026-09-24)
kvinwang
committed
81b57dc
style(test): sort imports in two harnesses as the ruff hook expects
kvinwang
committed
e289a1a
docs(testing): link the rootless mkosi and WireGuard apply fixes
kvinwang
committed
b64d9dc
test(guest-agent): read the certificate notAfter on cryptography < 42
kvinwang
committed
f02b8e3
test(fixtures): wait for the whole simulator process group on stop
kvinwang
committed
1192729
test(guest-agent): keep head-of-line observations when the step fails
kvinwang
committed
b5a500d
test(kms): import os in the runtime-004 mock RPC and report its failures
kvinwang
committed
af7c332
test(os): wait for app-compose before repeating Tappd after an agent restart
kvinwang
committed
9ef34d6
test(guest-agent): ramp the head-of-line loaders past the slirp backlog
kvinwang
committed
8e5f792
test(os): settle the data pool before the telemetry disk baseline
kvinwang
committed
9182c06
test(os): keep the mount-option set from shadowing the module options
kvinwang
committed
5df321f
test(verifier): pin --hotplug-off in the shared dstack-mr matrix
kvinwang
committed
738c961
test(gateway): wait for the debug listener before reading restored sync state
kvinwang
committed
7a99895
test(os): wait for the swap lease guest to stop before starting it again
kvinwang
committed
d05e71e
test(os): give the stargz lifecycle case the budget its own steps allow
kvinwang
committed
23fef95
test(os): corrupt the stargz marker payload rather than the blob midpoint
kvinwang
committed
bda46dc
test(integration): reserve KMS matrix host ports across concurrent cases
kvinwang
committed
d48cf4b
test(integration): prove the candidate Gateway loaded legacy WaveKV rows
kvinwang
committed
4359646
style(test): format the dstack-mr matrix harness
kvinwang
committed
48cc82b
style(test): keep harness docstring summaries on one line
kvinwang
committed
8b4f869
docs(testing): record the product fixes found on hardware
kvinwang
committed
240ed49
test(gateway): promote tc-gw-admin-037 and record the hardware validation
kvinwang
committed
83bce9c

Commits on Sep 26, 2026