NVX Phase 1: Minimal Signed MicroVM integration by huzaifa-d · Pull Request #1528 · microsoft/mxc

Huzaifa Danish (huzaifa-d) · 2026-10-19T17:58:52Z

📖 Description

Phase 1 of the NVX integration stack.
Replace the active Nanvix integration with the minimum Windows x64 NVX captured create-and-run path, behind the existing microvm feature.

Phase 1 Image limitation: The workload image is fixed to mcr.microsoft.com/azurelinux/base/core:3.0. Requests cannot select another image. This is temporary and handled in phase two.

🔗 References

Part of #1586.

NVX release: https://github.com/microsoft/nvx/releases/tag/v0.1.0-dev.0430ce79d125
SDK integration notes: src/mxc-sdk/README.md#experimental-nvx-create-and-run
Related integration design: feat: NVX integration design doc #1448

✅ Checklist

Signed the Contributor License Agreement
Linked to an issue
Updated documentation (if applicable)
Updated Copilot instructions (if build, architecture, or conventions changed)
If this PR changes Cargo.lock, the dependency-feed-check check passes (see pull request builds)

📋 Issue Type

Bug fix
Feature
Task

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See pull request builds.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See pull request builds
for the steps.

Microsoft Reviewers: Open in CodeFlow

Add the minimal signed create-and-run NVX0430 bundle. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: aee99423-dfee-4d61-86e9-421b944c4cc0

azure-pipelines · 2026-10-19T17:59:02Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Preserve executor output bytes and propagate test failures. Correct timeout assertions and simplify review wording and documentation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Link the root README to the SDK integration notes and document host prerequisites and policy restrictions there. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Restore the Nanvix guide unchanged from the PR base and keep the README and CI notes focused on the current integration. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove unpublished Rust dependencies, retain pinned bundle verification, and validate packaging and explicit MicroVM CI execution. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Enforce the combined 64 MiB output budget with cancellation and cleanup, validate process limits before bundle discovery, and validate the mapped native request before provisioning. Cover boundaries and cleanup through runtime and signed-bundle scenarios. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

Native loading and VM teardown require human review, particularly while functional CI fails during startup and diagnostic preservation remains unresolved.

1 open issue

Preserve startup diagnostics before deprovisioning · New

3 resolved since last review

_{Review effort: Balanced}

Copilot

🔵 Needs a closer look

The native runtime replacement and cancellation guarantees need final human review backed by Windows x64 Hypervisor Platform execution and teardown results.

1 open issue

Include NVX bundle in Azure Pipelines artifact

_{Review effort: Balanced}

Restore the exact adapters and normalized models to main. Ignore legacy fallback settings consistently, with equivalent-policy and real executor/facade coverage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

Native runtime integration, console interruption, and VM cleanup require final human review backed by successful validation on a Windows x64 host with Windows Hypervisor Platform enabled.

1 open issue

Include NVX bundle in Azure Pipelines artifact

_{Review effort: Balanced}

Preserve the complete pinned runtime in release ZIPs and VPack without re-signing. Exclude the unsupported MicroVM payload from npm with a scoped package rule and cover copy, ZIP hashes, missing inputs, and actual npm tarball contents. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

Native VM execution, cancellation cleanup, and signed-bundle deployment require verified Windows x64 host results and final human review.

No open issues 🎉

1 resolved since last review

Include NVX bundle in Azure Pipelines artifact

_{Review effort: Balanced}

Keep the prebuilt suite in backend validation artifacts without publishing it as an SDK binary. Reproduce the failing CI tarball contents in the real npm pack regression and preserve the strict package allowlist. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🟡 Changes recommended

Verified merge-build compilation failure blocks approval; native VM lifecycle and packaging changes also warrant human review with Windows validation results.

1 open issue

[P1] This new fallback fails to compile after merging with main, where… · New

_{Review effort: Balanced}

Pass stdin=false from captured JSON execution, matching the run-to-completion contract while keeping explicit writable-stdin spawn operations unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

Native VM cleanup, console cancellation, and signed-bundle distribution require confirmed Windows x64/WHP validation and final human review.

No open issues 🎉

1 resolved since last review

[P1] This new fallback fails to compile after merging with main, where…

_{Review effort: Balanced}

Use the authoritative main lockfile unchanged; retain the NVX feature and all intended merge resolutions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

The native runtime replacement, console cancellation, and VM cleanup require confirmed Windows x64 Hypervisor Platform validation and final human review.

No open issues 🎉

_{Review effort: Balanced}

Branden Bonaby (bbonaby) · 2026-10-27T00:55:32Z

@@ -0,0 +1,528 @@
+// Copyright (c) Microsoft Corporation.


note: note really sure why this had to be a .js file rather than a test file in rust. But I'll assume you had a reason.

NVX0430 phase 1: add minimal signed create-run bundle

287f763

Add the minimal signed create-and-run NVX0430 bundle. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: aee99423-dfee-4d61-86e9-421b944c4cc0

Copilot AI balanced review requested due to automatic review settings October 19, 2026 17:58

Copilot started reviewing on behalf of Huzaifa Danish (huzaifa-d) October 19, 2026 17:59

View session

This comment was marked as resolved.

Sign in to view

Address NVX phase 1 review feedback

a5ba733

Preserve executor output bytes and propagate test failures. Correct timeout assertions and simplify review wording and documentation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Huzaifa Danish (huzaifa-d) mentioned this pull request Oct 19, 2026

NVX Phase 1: Minimal Signed MicroVM integration huzaifa-d/mxc#3

Draft

3 of 8 tasks

huzaifa-msft and others added 2 commits October 19, 2026 12:52

Fix NVX documentation links after removing backend guide

6b0fcca

Link the root README to the SDK integration notes and document host prerequisites and policy restrictions there. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Preserve Nanvix guide and simplify NVX documentation

27c0abf

Restore the Nanvix guide unchanged from the PR base and keep the README and CI notes focused on the current integration. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings October 19, 2026 21:59

Copilot started reviewing on behalf of Huzaifa Danish (huzaifa-d) October 19, 2026 22:00

View session

This comment was marked as resolved.

Sign in to view

Huzaifa Danish (huzaifa-d) marked this pull request as ready for review October 20, 2026 18:07

Huzaifa Danish (huzaifa-d) requested a review from a team as a code owner October 20, 2026 18:07

Huzaifa Danish (huzaifa-d) changed the title ~~NVX phase 1: minimal signed MicroVM integration~~ NVX phase 1: Minimal Signed MicroVM integration Oct 20, 2026

Huzaifa Danish (huzaifa-d) changed the title ~~NVX phase 1: Minimal Signed MicroVM integration~~ NVX Phase 1: Minimal Signed MicroVM integration Oct 20, 2026

Huzaifa Danish (huzaifa-d) added this pull request to stack #1540 October 20, 2026 21:36

huzaifa-msft and others added 5 commits October 21, 2026 16:08

Run MicroVM host tests only in the dedicated workflow

721401a

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Consume the signed NVX bundle through its native DLL interface

6d2e7ff

Remove unpublished Rust dependencies, retain pinned bundle verification, and validate packaging and explicit MicroVM CI execution. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Merge fork main to validate the current PR merge result

2a78d43

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Refresh lockfile references after merging fork main

ffa8778

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Keep disabled MicroVM staging warning-free on all hosts

cfa4d17

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings October 22, 2026 01:49

Copilot started reviewing on behalf of Huzaifa Danish (huzaifa-d) October 22, 2026 01:49

View session

This comment was marked as resolved.

Sign in to view

Copilot AI balanced review requested due to automatic review settings October 22, 2026 21:11

Copilot started reviewing on behalf of Huzaifa Danish (huzaifa-d) October 22, 2026 21:13

View session

Copilot AI reviewed Oct 22, 2026

View reviewed changes

Comment thread src/mxc-sdk/src/backends/nvx/runner.rs

Huzaifa Danish (huzaifa-d) mentioned this pull request Oct 22, 2026

NVX Phase 2: experimental image-selectable Rust execution and policy huzaifa-d/mxc#5

Draft

4 of 8 tasks

Copilot AI balanced review requested due to automatic review settings October 26, 2026 23:45

Copilot started reviewing on behalf of Huzaifa Danish (huzaifa-d) October 26, 2026 23:46

View session

Copilot AI reviewed Oct 26, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 27, 2026 00:15

Copilot started reviewing on behalf of Huzaifa Danish (huzaifa-d) October 27, 2026 00:15

View session