Publish the v0.9 MicroVM backend contract with NVX internally

.azure-pipelines/templates/Rust.Build.Job.yml

@@ -46,7 +46,19 @@ jobs:
         workingDirectory: $(Build.SourcesDirectory)/src
         # Explicit feature set (no --all-features): tier2_bfs must NOT ship
         # on Win 11 25H2 (bfscfg.exe risks an OS hang).
-        cargoFeatures: hyperlight isolation_session microvm wslc
+        # Keep the x64-only MicroVM feature coupled to its published NVX payload.
+        ${{ if eq(item.arch, 'x64') }}:
+          cargoFeatures: hyperlight isolation_session microvm wslc
+          microvmSignPattern: bin/openvmm.exe
+          microvmArtifactPattern: |
+            bin/openvmm.exe
+            guest/vmlinux
+            guest/initramfs.cpio.gz
+            images/**
+        ${{ else }}:
+          cargoFeatures: hyperlight isolation_session wslc
+          microvmSignPattern: ''
+          microvmArtifactPattern: ''
         signPattern: |
             wxc-exec.exe
             plm.exe
@@ -65,6 +77,8 @@ jobs:
         artifactPrefix: lxc-binaries
         workingDirectory: $(Build.SourcesDirectory)/src/core/lxc
         cargoFeatures: hyperlight
+        microvmSignPattern: ''
+        microvmArtifactPattern: ''
         signPattern: |
           lxc-exec
           unix-test-proxy
@@ -169,6 +183,7 @@ jobs:
           FolderPath: $(targetTripleDir)
           Pattern: |
             $(signPattern)
+            $(microvmSignPattern)
           UseMinimatch: true
           signConfigType: 'inlineSignParams'
           inlineOperation: >-
@@ -201,6 +216,7 @@ jobs:
           sourceFolder: $(targetTripleDir)
           contents: |
             $(signPattern)
+            $(microvmArtifactPattern)
           targetFolder: $(outputDirectory)/$(targetTriple)
 
       # Copy wslcsdk.dll

.github/copilot-instructions.md

@@ -13,10 +13,10 @@ MXC (Microsoft eXecution Container) is a cross-platform sandboxed code execution
 ## Architecture invariants
 
 - `wxc_common` is the cross-platform foundation. Do not move backend execution or enforcement into it, or add new backend implementation dependencies.
-- Backend crates generally depend on `wxc_common`; avoid cross-dependencies between backend crates. The existing optional `nanvix_common` dependency supplies shared MicroVM data/constants rather than backend dispatch.
+- Backend crates generally depend on `wxc_common`; avoid cross-dependencies between backend crates.
 - `mxc_engine` is the single execution engine. Executor binaries and `mxc-sdk` delegate backend routing to it.
 - Keep `wxc`, `lxc`, and `mxc_darwin` thin. Do not add backend-selection matches to the binaries.
-- Keep build-time staging in `mxc_build_common` or `nanvix_build_common`, not runtime crates.
+- Keep build-time staging in `mxc_build_common` or backend-specific build helpers such as `nvx_build_common`, not runtime crates.
 - Use `#[cfg(target_os = "...")]` and existing Cargo feature gates for platform-specific code.
 - Preserve the distinction between run-to-completion, streaming, and state-aware lifecycle APIs.
 - Unsupported policy must fail closed. Do not accept a field that the selected backend cannot enforce.
@@ -37,6 +37,7 @@ The Rust toolchain is pinned by `src/rust-toolchain.toml`. Run Rust commands fro
 
 ```text
 build.bat
+build.bat --with-microvm   # Include the incomplete MicroVM (NVX) foundation (Windows x64)
 
 ./build.sh
 

.github/workflows/Build.Windows.Job.yml

@@ -14,11 +14,11 @@ jobs:
             runner: windows-2025
             target: x86_64-pc-windows-msvc
             # tier2_bfs must NOT ship on Win 11 25H2 (bfscfg.exe hangs the host).
-            features: hyperlight isolation_session microvm wslc
+            features: hyperlight isolation_session wslc
           - arch: arm64
             runner: windows-11-arm
             target: aarch64-pc-windows-msvc
-            # Hyperlight and MicroVM runtimes are x64-only.
+            # Hyperlight is x64-only.
             features: isolation_session wslc
     runs-on: ${{ matrix.runner }}
     defaults:
@@ -66,6 +66,14 @@ jobs:
              --no-default-features
              --features "${{ matrix.features }}"
 
+      # Keep MicroVM (NVX) out of the uploaded release executable while its workload
+      # image bundle is unavailable, but verify its opt-in build and staging.
+      - name: Check opt-in MicroVM packaging
+        if: matrix.arch == 'x64'
+        run: cargo check --locked --target ${{ matrix.target }} -p wxc
+             --no-default-features
+             --features microvm
+
       - name: Test telemetry consent and policy in release mode
         run: |
           cargo test --locked --release --target ${{ matrix.target }} -p wxc_common telemetry::consent

.github/workflows/issue-triage.md

@@ -90,7 +90,7 @@ Assign matching owner(s) with `assign_to_user` using this map:
 | @mgudgin | AppContainer / BaseContainer / process isolation/container |
 | @bbonaby | AppContainer / BaseContainer / process isolation/container / networking / firewall / DNS / proxy / iptables |
 | @SohamDas2021 | Linux / LXC / WSLC / Bubblewrap (bwrap) / proxy on Linux / iptables |
-| @huzaifa-d | MicroVM / NanVix / Hyperlight / Windows Sandbox |
+| @huzaifa-d | MicroVM / NVX / Hyperlight / Windows Sandbox |
 | @adpa-ms | IsolationSession / session isolation |
 | @richiemsft | macOS / Seatbelt |
 | @mgudgin | SDK configuration and policy (Area-SDK-Configuration, Area-SDK-Policy) |

.gitignore

@@ -25,7 +25,6 @@ bld/
 # Test artifacts
 *.etl
 *.log
-microvm-perf-results*.json
 
 # npm pack artifacts
 *.tgz

CONTRIBUTING.md

@@ -150,7 +150,7 @@ MXC has a Rust core (under `src/`) and a TypeScript SDK (under `sdk/node/`). The
 build.bat                  :: Release build for current architecture
 build.bat --debug          :: Debug build
 build.bat --all            :: Release build for both x64 and ARM64
-build.bat --with-microvm   :: Include NanVix micro-VM binaries
+build.bat --with-microvm   :: Include the MicroVM (NVX) foundation (Windows x64)
 ```
 
 **Linux** — `./build.sh`:

README.md

@@ -9,7 +9,7 @@ MXC is a **sandboxed code execution system** for running untrusted code (model o
 
 - **Cross-platform**: Windows, Linux, and macOS support with platform-appropriate containment backends
 - **JSON-based Configuration**: Define execution parameters and security policies via a versioned JSON schema
-- **Multiple Containment Backends**: ProcessContainer, Windows Sandbox, LXC, Bubblewrap, Seatbelt (macOS), MicroVM (NanVix), Hyperlight, IsolationSession, and WSLC
+- **Multiple Containment Backends**: ProcessContainer, Windows Sandbox, LXC, Bubblewrap, Seatbelt (macOS), MicroVM (NVX), Hyperlight, IsolationSession, and WSLC
 - **Policy-driven Sandboxing**:
     - **Filesystem Policy**: Read-only and read-write path lists (denied paths not yet supported on Windows)
     - **Network Policy**: Proxy support (cooperative on Linux/macOS), allow/block outbound, and backend-dependent host filtering
@@ -27,7 +27,7 @@ MXC ships a native container wrapper plus a TypeScript SDK — see the [SDK READ
 | Platform | Default backend | Other backends | Minimum build |
 | --- | --- | --- | --- |
 | Windows 11 24H2+ (verified on 25H2) | `processcontainer` | `windows_sandbox`, `wslc`, `microvm`, `hyperlight`, `isolation_session` | `processcontainer`: 26100 (24H2)<br>`isolation_session`: 26340.9212 ([Insider Preview](https://learn.microsoft.com/en-us/windows-insider/release-notes/experimental/preview-build-26340-9212)) |
-| Linux x64 / ARM64 | `bubblewrap` | `lxc`, `microvm`, `hyperlight` | — |
+| Linux x64 / ARM64 | `bubblewrap` | `lxc`, `hyperlight` | — |
 | macOS ARM64 / x64 (schema `0.7.0-alpha`+) | `seatbelt` | — | — |
 
 
@@ -70,9 +70,23 @@ layout, crate responsibilities, dependency direction, and execution surfaces.
 build.bat                  # Release build for current architecture
 build.bat --debug          # Debug build
 build.bat --all            # Release build for both x64 and ARM64
-build.bat --with-microvm   # Include NanVix micro-VM binaries
+build.bat --with-microvm   # Include the incomplete MicroVM (NVX) foundation (Windows x64)
 ```
 
+`--with-microvm` acquires the pinned NVX platform archive at build time and verifies every staged file by
+SHA-256; sandbox launches never download artifacts. Set `NVX_BIN` to a
+pre-fetched, checksum-verifiable bundle directory for an offline build. The
+current pin, `v0.1.0-dev.5c86da3dff02`, contains only `openvmm.exe`, the guest
+kernel, and the guest initramfs, not the workload-image bundle.
+
+The exact `0.9.0-alpha` contract exposes the experimental `microvm` containment
+value, implemented internally by NVX. Build with `--with-microvm`; execution
+currently returns a typed backend-unavailable error, and capability probes do
+not advertise MicroVM while the runtime is incomplete.
+Runtime work remains blocked on NVX-produced distro/runtime EROFS images
+and scratch image, a proven combined managed-sandbox/virtio-fs contract, and the
+required WHP runner.
+
 #### Linux
 
 ```bash
@@ -227,7 +241,7 @@ See the [SDK README](sdk/node/README.md) for full API documentation.
 
 ## Schema Versions
 
-Released, immutable stable schemas live in [`schemas/stable/`](schemas/stable); the in-progress dev schema (experimental backends, state-aware lifecycle) lives in [`schemas/dev/`](schemas/dev). The current stable and dev versions are tracked canonically in [`schemas/schema-version.json`](schemas/schema-version.json).
+Released, revision-locked stable schemas live in [`schemas/stable/`](schemas/stable); the in-progress dev schema (remaining development backends and fields) lives in [`schemas/dev/`](schemas/dev). The current stable and dev versions, plus auditable publication revisions, are tracked canonically in [`schemas/schema-version.json`](schemas/schema-version.json).
 
 Pick the latest stable schema for new code on any supported platform. See [docs/versioning.md](docs/versioning.md) for the full versioning design.