[kvnloo]

Current disposition — 2026-10-16

SUPERSEDED / OWNER_COVERED

The early VM launch-signing requirement in NVIDIA#3949 is now served by shiju-nv's merged origin #4034, merge 71c3cd957abef062eb7f37010056717cd49f2ed3 (2026-10-03). Its capability-declared launch authentication and startup/admission checks differ from this fork approach; closing this superseded downstream promotion carrier does not claim byte-for-byte or test equivalence. Preserve fork head 58409dc5cff7da22b6643e6e21f28ec87b56899a, Kevin/dot staging credit and shiju-nv implementation credit. Linux VM CI in the owner PR is owner-supplied, not our run; no macOS/VM acceptance performed here.

Canonical queue: https://github.com/kvnloo/oss-factory/issues/67

---

Summary

Reject unusable VM sandbox launch signing during the existing pre-create driver validation, before the gateway persists the sandbox or the VM driver performs image preparation.

Promotion status: HOLD — OpenShell requires a maintainer vouch before first-time contributors may open upstream PRs. Keep this fork PR as downstream staging only.

Related Issue

• Upstream: Validate sandbox launch-signing configuration before image preparation NVIDIA/OpenShell#3949 (state:accepted)
• Fork staging ticket: [SUPERSEDED] upstream #3949 — validate VM launch signing before provisioning #14

Design

No new driver protocol is introduced. The gateway now builds the same launch-authentication bundle create would use and passes it through the existing opaque DriverSandboxSpec.launch_authentication field during ValidateSandboxCreate.

This keeps the contract driver-owned:

• VM validates the bundle because it requires Sandbox Protocol launch auth;
• unrelated drivers may ignore the field;
• Kubernetes is not forced into a JWT mechanism.

The VM driver independently validates again at provisioning-task entry before rootfs or container-registry work.

Tests

Focused VM tests cover:

• missing launch auth -> FailedPrecondition with actionable gateway_jwt guidance;
• malformed launch auth -> FailedPrecondition;
• the malformed-payload error does not echo a secret canary.

Docs

The MicroVM example now shows launch-signing configuration separately from listener TLS and explains the early failure boundary.

Checklist

• Accepted upstream issue
• Exact current upstream-main base
• Shared driver validation contract reused
• No JWT requirement imposed on unrelated drivers
• Missing/malformed auth tested
• No credential material in diagnostics
• DCO sign-off on every commit

[kvnloo]

Upstream promotion attempt on 2026-10-01 returned GitHub 403 (Resource not accessible by integration) for NVIDIA#3949.

Status remains READY TO POST. The fork branch/PR is the canonical promotion artifact until org-side write access is available.

[kvnloo]

Upstream PR is open: NVIDIA#4021

The earlier 403 (Resource not accessible by integration) was the integration token, not a block on the kvnloo OAuth account. This fork PR is no longer the promotion queue.

[kvnloo]

Correction: NVIDIA#4021 was created, then closed by the OpenShell first-contributor vouch bot. It is not an open upstream PR. A maintainer /vouch is required before it can stay open. Reopening without that will be closed again.

[kvnloo]

GEM1 verified-artifact reconciliation — U36

Recovery experiment: https://github.com/kvnloo/oss-factory/issues/221

Title/body duplicate search plus direct carrier inspection selected this existing home; no duplicate issue is being opened.

U36

• Evidence: Existing carrier fix(vm): validate launch signing before provisioning [HOLD: VOUCH REQUIRED] #15 is CLOSED at 58409dc.
• Reconstruction: Use this exact carrier/head and its current state/hold; compare later recovered bytes before reviving or duplicating work.
• Acceptance (NOT RUN): Satisfy this carrier's documented project/platform acceptance and attribution/review gates on its actual current base before any further publication.
• Boundary: Current state overrides historical READY wording. Closed/held items were not reopened; no upstream action, merge or new acceptance run.

This is artifact/ownership reconciliation only. No tests, builds, native UI/device runs, upstream publication or merge were performed by this promotion pass.