microsoft · Elliot (theelliotm) · Jul 31, 2026 · Jul 31, 2026 · Jul 31, 2026 · Aug 1, 2026
@@ -43,6 +43,54 @@ build.bat --with-microvm   # Include NanVix micro-VM binaries
 
 Requires Xcode Command Line Tools and Rust. Produces an unsigned `mxc-exec-mac` binary (codesigning + notarization happen at release time). Schema `0.7.0-alpha` or later required for macOS/Seatbelt backend.
 
+### GitHub Actions
+
+`.github/workflows/Build.yml` is the PR/CI entry point. It fans out to the
+workflow-call-only `Build.Windows.Job.yml`, `Build.Linux.Job.yml`, and
+`Build.MacOS.Job.yml`, which build and upload the per-target artifacts in
+parallel, then to the lint / versioning / SDK jobs.
+
+**Validation (E2E) test infrastructure.** Backend E2E tests run from those same
+build artifacts — never from a fresh build — so artifact production and
+consumption stay in one workflow run:
+
+- `.github/workflows/Validation.Tests.Scheduled.yml` — scheduled entry point.
+  The `nightly` plan runs Mon–Sat; Sunday runs `nightly` *and* `weekly`.
+  `workflow_dispatch` takes a `plan` input to run one on demand.
+- `.github/workflows/Validation.Infra.Testing.yml` — push-triggered entry point
+  for iterating on the validation infrastructure itself, on a dedicated branch.
+- `.github/workflows/Validation.Tests.Matrix.Job.yml` — workflow-call-only,
+  takes a `plan` input. Its `resolve` job expands the plan into per-family
+  matrices, then the `windows` / `linux` / `macos` jobs each download the
+  artifact, prepare the host, and run the backend suite.
+
+An entry point must build the artifacts (call the three `Build.*.Job.yml`
+workflows) before calling the matrix job.
+
+**The matrix is declarative:**
+
+- `scripts/ci/validation-test-matrix.json` is the catalog: `platforms` (each
+  with per-architecture target/artifact/1ES pool and the backends that platform
+  supports), `handlers` (backend id → test-dispatcher command), and `triggers`
+  (which OS/backend pairs each plan runs).
+- `scripts/ci/resolve-validation-test-matrix.mjs` validates that catalog and
+  expands a plan (`pr`, `nightly`, `weekly`, `enabled`) into GitHub Actions
+  matrices. It rejects an invalid catalog before any specialized test runner is
+  allocated, so add a backend to a trigger only where the platform declares it.
+- A non-macOS platform architecture with an empty `pool` is never scheduled,
+  which is how a catalog entry stays declared but dormant. macOS entries use a
+  GitHub-hosted `runner` instead of a 1ES `pool`.
+
+**Host preparation** happens in the matrix job before the tests, keyed by the
+matrix `backend` id: `scripts/ci/prepare-windows-host.ps1` and
+`scripts/ci/prepare-linux-host.sh`. A backend with no prerequisites is an
+explicit no-op, so the step runs unconditionally for every entry.
+
+**Test dispatch** goes through `tests/scripts/run_ci_backend_tests.ps1`
+(Windows) and `tests/scripts/run_ci_backend_tests.sh` (Linux/macOS), which map
+the handler command to the repository's existing backend suite. A handler with
+no wired suite fails loudly rather than reporting a false success.
+
 ### Individual components
 
 ```
@@ -96,6 +144,19 @@ tests\scripts\run_bwrap_all_tests.sh          # All Bubblewrap tests (Linux, req
 # E2E test crate — Rust executor integration tests (from src/)
 cargo test -p wxc_e2e_tests                 # Invokes MXC binaries directly
 cargo test -p wxc_e2e_tests -- --ignored    # Include stress tests (run_on_repeat)
+
+# WSLC has no cargo E2E suite — it is covered by tests\scripts\run_wslc_all_tests.ps1,
+# which the validation matrix runs via tests\scripts\run_ci_backend_tests.ps1.
+
+# CI validation entry points — run a backend suite against a downloaded artifact
+# the way the validation matrix does. Take the handler command (see the
+# `handlers` map in scripts/ci/validation-test-matrix.json), not the matrix
+# backend id, except where a tier must be pinned.
+tests\scripts\run_ci_backend_tests.ps1 -Backend process-container -BinaryDirectory <dir> -Architecture x64 -ExpectedTier T1
+tests\scripts\run_ci_backend_tests.sh <bubblewrap|lxc|seatbelt> <binary-directory>
+
+# Resolve a plan locally to see exactly what CI would schedule
+node scripts/ci/resolve-validation-test-matrix.mjs --plan nightly
 ```
 
 ## Architecture

@@ -13,9 +13,11 @@ jobs:
           - arch: x64
             runner: ubuntu-latest
             target: x86_64-unknown-linux-gnu
+            features: hyperlight
           - arch: arm64
             runner: ubuntu-24.04-arm
             target: aarch64-unknown-linux-gnu
+            features: ''
     runs-on: ${{ matrix.runner }}
     defaults:
       run:
@@ -54,12 +56,30 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y --no-install-recommends gcc-aarch64-linux-gnu
 
       - name: Build lxc
-        run: cargo build --locked --release --target ${{ matrix.target }}
-             --no-default-features --features hyperlight
+        shell: bash
+        run: |
+          set -euo pipefail
+          features=()
+          if [[ -n "${{ matrix.features }}" ]]; then
+            features=(--features "${{ matrix.features }}")
+          fi
+          cargo build --locked --release --target "${{ matrix.target }}" \
+            --no-default-features "${features[@]}"
 
       - name: Test lxc
-        run: cargo test --locked --release --target ${{ matrix.target }}
-             --no-default-features --features hyperlight
+        shell: bash
+        run: |
+          set -euo pipefail
+          features=()
+          if [[ -n "${{ matrix.features }}" ]]; then
+            features=(--features "${{ matrix.features }}")
+          fi
+          cargo test --locked --release --target "${{ matrix.target }}" \
+            --no-default-features "${features[@]}"
+
+      ####################
+      # E2E Tests are being moved to the Test.Matrix.Job.yml workflow, which runs cross-platform validation
+      ###############
 
       # Bubblewrap is required to run the executor characterization tests in
       # wxc_e2e_tests (they skip via has_bwrap() when it is absent). lxc-exec
@@ -82,6 +102,9 @@ jobs:
         run: cargo test --locked --release --target ${{ matrix.target }}
              -p wxc_e2e_tests
 
+      ###############
+      ####################
+
       # PLM (Permissive Learning Mode) is functionally Windows-only, but the
       # crate builds cross-platform: the lib's helper modules compile on every
       # target, and the binary has a no-op stub `fn main()` for non-Windows so
@@ -103,6 +126,26 @@ jobs:
         run: cargo build --locked --release --target ${{ matrix.target }}
              -p unix_test_proxy
 
+      # MICROVM NOT WORKING CURRENTLY
+      # - name: Verify artifact payload
+      #   shell: bash
+      #   working-directory: ${{ github.workspace }}
+      #   run: |
+      #     set -euo pipefail
+      #     bin_dir="src/target/${{ matrix.target }}/release"
+      #     required=(lxc-exec unix-test-proxy)
+      #     if [[ "${{ matrix.arch }}" == "x64" ]]; then
+      #       required+=(nanvixd.elf nanvix_rootfs.img python3.initrd bin/kernel.elf)
+      #     fi
+      #     missing=()
+      #     for file in "${required[@]}"; do
+      #       [[ -f "$bin_dir/$file" ]] || missing+=("$file")
+      #     done
+      #     if (( ${#missing[@]} > 0 )); then
+      #       printf 'Missing artifact files: %s\n' "${missing[*]}" >&2
+      #       exit 1
+      #     fi
+
       - name: Upload binaries
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -112,3 +155,8 @@ jobs:
             src/target/${{ matrix.target }}/release/unix-test-proxy
           if-no-files-found: error
           retention-days: 1
+
+      #     src/target/${{ matrix.target }}/release/nanvixd.elf
+      #     src/target/${{ matrix.target }}/release/nanvix_rootfs.img
+      #     src/target/${{ matrix.target }}/release/python3.initrd
+      #     src/target/${{ matrix.target }}/release/bin/kernel.elf
@@ -6,8 +6,7 @@ on:
 jobs:
   build:
     name: arm64
-    # macos-14 / macos-latest are Apple Silicon (arm64); older labels are Intel.
-    runs-on: macos-14
+    runs-on: macos-26
     defaults:
       run:
         working-directory: src
@@ -55,6 +54,18 @@ jobs:
         run: cargo test --locked --release --target aarch64-apple-darwin
              -p mxc_darwin -p seatbelt_common -p wxc_common -p wxc_e2e_tests
 
+      - name: Verify artifact payload
+        shell: bash
+        run: |
+          set -euo pipefail
+          bin_dir="target/aarch64-apple-darwin/release"
+          for file in mxc-exec-mac unix-test-proxy; do
+            if [[ ! -f "$bin_dir/$file" ]]; then
+              echo "Missing artifact file: $file" >&2
+              exit 1
+            fi
+          done
+
       - name: Upload binaries
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:

@@ -18,8 +18,8 @@ jobs:
           - arch: arm64
             runner: windows-11-arm
             target: aarch64-pc-windows-msvc
-            # nanvixd.exe is x64-only, so microvm tests can't run on arm64.
-            features: hyperlight isolation_session wslc
+            # Hyperlight and MicroVM runtimes are x64-only.
+            features: isolation_session wslc
     runs-on: ${{ matrix.runner }}
     defaults:
       run:
@@ -71,6 +71,36 @@ jobs:
              --no-default-features
              --features "${{ matrix.features }}"
 
+      # MICROVM NOT WORKING CURRENTLY
+      # - name: Verify artifact payload
+      #   shell: pwsh
+      #   run: |
+      #     $binDir = "target\${{ matrix.target }}\release"
+      #     $required = @(
+      #       "wxc-exec.exe",
+      #       "wxc-host-prep.exe",
+      #       "winhttp-proxy-shim.exe",
+      #       "wxc-windows-sandbox-daemon.exe",
+      #       "wxc-windows-sandbox-guest.exe",
+      #       "wxc-test-proxy.exe",
+      #       "wxc-test-driver.exe",
+      #       "wxc-ui-probe.exe",
+      #       "mxc-diagnostic-console.exe",
+      #       "wslcsdk.dll"
+      #     )
+      #     if ("${{ matrix.arch }}" -eq "x64") {
+      #       $required += @(
+      #         "nanvixd.exe",
+      #         "nanvix_rootfs.img",
+      #         "python3.initrd",
+      #         "bin\kernel.elf"
+      #       )
+      #     }
+      #     $missing = $required | Where-Object { -not (Test-Path (Join-Path $binDir $_)) }
+      #     if ($missing) {
+      #       throw "Missing artifact files: $($missing -join ', ')"
+      #     }
+
       - name: Upload binaries
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -85,5 +115,14 @@ jobs:
             src/target/${{ matrix.target }}/release/wxc-test-proxy.exe
             src/target/${{ matrix.target }}/release/mxc-diagnostic-console.exe
             src/target/${{ matrix.target }}/release/wslcsdk.dll
-          if-no-files-found: warn
+            src/target/${{ matrix.target }}/release/wxc-ui-probe.exe
+            src/target/${{ matrix.target }}/release/wxc-test-driver.exe
+          if-no-files-found: error
           retention-days: 1
+
+            # src/target/${{ matrix.target }}/release/nanvixd.exe
+            # src/target/${{ matrix.target }}/release/nanvix_rootfs.img
+            # src/target/${{ matrix.target }}/release/python3.initrd
+            # src/target/${{ matrix.target }}/release/bin/kernel.elf
+            # src/target/${{ matrix.target }}/release/snapshots/kernel.vmem
+            # src/target/${{ matrix.target }}/release/snapshots/kernel.whp.cbor
@@ -1,13 +1,14 @@
-# Entry point for GHA PR/CI validation. Mirrors the 1ES `1ES.Build.yml`
-# split: this file orchestrates, each stage lives in its own reusable.
-
 name: Build
 
 on:
   push:
+    paths-ignore:
+      - 'docs/**'
     branches: [main]
 
   pull_request:
+    paths-ignore:
+      - 'docs/**'
     branches: [main, 'feature/*', 'user/*']
 
   workflow_call:
@@ -18,6 +19,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

@@ -24,7 +24,7 @@ jobs:
             clippy-args: --locked --all-targets --all-features --release
           - os_label: macos
             component: MAC
-            runner: macos-14
+            runner: macos-26
             target: aarch64-apple-darwin
             working-directory: src
             # Workspace has Windows-only crates, so --all-features won't build on macOS.

@@ -15,7 +15,7 @@ jobs:
           - os_label: linux
             runner: ubuntu-latest
           - os_label: macos
-            runner: macos-14
+            runner: macos-26
     runs-on: ${{ matrix.runner }}
     defaults:
       run:

@@ -0,0 +1,38 @@
+name: Validation Infrastructure Testing
+
+on:
+  push:
+    branches:
+      - user/emichlin/validation-infra-lite
+
+concurrency:
+  group: validation-infra-pr-tests-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  actions: read
+  contents: read
+
+jobs:
+  dependency-feed-check:
+    uses: ./.github/workflows/Dependency.Feed.Check.Job.yml
+
+  windows:
+    needs: dependency-feed-check
+    uses: ./.github/workflows/Build.Windows.Job.yml
+
+  linux:
+    needs: dependency-feed-check
+    uses: ./.github/workflows/Build.Linux.Job.yml
+
+  macos:
+    needs: dependency-feed-check
+    uses: ./.github/workflows/Build.MacOS.Job.yml
+
+  test:
+    needs: [windows, linux, macos]
+    uses: ./.github/workflows/Validation.Tests.Matrix.Job.yml
+    with:
+      # Exercise every combination currently rolled out, independent of its
+      # normal PR/nightly/weekly schedule.
+      plan: nightly