ci(vz-backend): Phase 1.1 polish — Linux verification + protected-paths gate

Closes the two verified gaps surfaced in the Phase 1 self-review:
  • Caveat #1: elastos-vz's Linux build path was unverified (dev work
    happened entirely on macOS). The existing ci.yml runs the full
    workspace check/clippy/test on ubuntu-latest but only on `main`,
    so Phase 1 commits on `sash/local-test` never hit it.
  • Caveat #2: scripts/check-linux-untouched.sh existed as a script
    anyone *could* run, not a gate anything *must* pass. Phase 2/3
    commits could theoretically modify a protected crate without
    anyone noticing until manual review.

Changes:
  • .github/workflows/ci.yml — extend push triggers to also include
    `sash/**` and `vz/**` so the existing check/clippy/test/build
    matrix runs on Vz-backend working branches. PR-to-main trigger
    unchanged. Modification is two new branch patterns; no job
    semantics changed.
  • .github/workflows/linux-untouched.yml — new dedicated workflow
    that runs scripts/check-linux-untouched.sh against the Phase 0
    baseline commit (a65dad3). Triggers on push to Vz branches and
    on PRs to main. Uses fetch-depth: 0 so `git merge-base` can
    resolve against the baseline.

  • Local cargo fmt fixes applied to elastos-vz/{config,lib,provider,
    vm,tests/smoke}.rs that surfaced when running the same `cargo fmt
    --all -- --check` the CI workflow uses. No semantic changes.

Verification (all green on macOS dev host):
  • cargo fmt --all -- --check               ✅
  • cargo clippy --workspace --all-targets   ✅ (with -D warnings)
  • cargo test  -p elastos-vz                ✅ 37/37
  • Linux-untouched gate vs a65dad3          ✅

Linux behaviour: still byte-equivalent to pre-Vz commit (workflow
changes don't touch source). Mac behaviour: unchanged.

Pending verifications (deferred to first CI run after push):
  • Linux build of elastos-vz + workspace
  • Linux test pass of elastos-vz + workspace
  • Linux-untouched gate run in GitHub Actions context

Caveats #3 (mac-vz-feature-check stub) and #4 (pre-existing
darwin-arm64 setup.rs failures inherited from Pre-Work 9fc4a7e) are
intentionally not addressed here: #3 will be exercised by Phase 2's
Vz API work; #4 is a separate non-blocking fix-up.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: SashaMIT

.github/workflows/ci.yml

@@ -2,7 +2,11 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    # Run on main and on Vz-backend working branches so Phase 1+ commits
+    # get verified on Linux without waiting for a PR. The `sash/**`
+    # pattern covers the current Vz development branch
+    # (`sash/local-test`) and any future Vz sub-branches.
+    branches: [main, "sash/**", "vz/**"]
   pull_request:
     branches: [main]
 

.github/workflows/linux-untouched.yml

@@ -0,0 +1,49 @@
+name: Linux-untouched gate (Vz backend)
+
+# Enforces the Linux-untouched guarantee from docs/vz-backend/PLAN.md:
+# Phase 1+ Vz-backend commits must not modify the four protected crates
+# (elastos-crosvm, elastos-runtime, elastos-common, elastos-compute).
+#
+# Runs `scripts/check-linux-untouched.sh` against the Phase 0 baseline
+# (commit a65dad3 — the last commit before Vz work began). The script
+# itself documents how to adjust the base ref locally.
+#
+# Anchors:
+#   - docs/vz-backend/PLAN.md → "Linux-untouched: explicit guarantees"
+#   - PRINCIPLES.md #10 "One Canonical Path"
+#   - scripts/check-linux-untouched.sh
+
+on:
+  push:
+    branches: ["sash/**", "vz/**"]
+  pull_request:
+    branches: [main]
+
+jobs:
+  linux-untouched:
+    name: Protected crates not modified vs Vz baseline
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Full history needed for `git merge-base` to find the
+          # divergence point against the baseline commit.
+          fetch-depth: 0
+
+      - name: Run protected-paths gate
+        env:
+          # Phase 0 baseline commit — last commit on sash/local-test
+          # before Vz-backend Phase 1 work started. Update this only
+          # if the project decides to re-baseline (e.g., after rebase
+          # onto a newer upstream main). See docs/vz-backend/PLAN.md.
+          VZ_BACKEND_BASELINE: a65dad3
+        run: |
+          set -euo pipefail
+          # Make sure the baseline commit is reachable in the checkout.
+          # Shallow clones don't always have it; `fetch-depth: 0` above
+          # asks for the full history but defend against any quirks.
+          if ! git cat-file -e "${VZ_BACKEND_BASELINE}^{commit}" 2>/dev/null; then
+            git fetch origin "${VZ_BACKEND_BASELINE}" || true
+          fi
+          chmod +x scripts/check-linux-untouched.sh
+          scripts/check-linux-untouched.sh "${VZ_BACKEND_BASELINE}"

elastos/crates/elastos-vz/src/config.rs

@@ -251,10 +251,8 @@ impl VmConfig {
         // Default boot args use the Vz console device. The supervisor
         // may pass crosvm-style args through manifest overrides; the
         // `vz_boot_args` accessor rewrites them at construction time.
-        let default_boot_args = format!(
-            "console={} reboot=k panic=1 init=/init",
-            VZ_CONSOLE_DEVICE
-        );
+        let default_boot_args =
+            format!("console={} reboot=k panic=1 init=/init", VZ_CONSOLE_DEVICE);
         let base_boot_args = microvm
             .map(|m| rewrite_console_for_vz(&m.boot_args))
             .unwrap_or(default_boot_args);
@@ -437,7 +435,9 @@ mod tests {
             std::path::Path::new("/k/vmlinux"),
         );
         // Empty boot_args triggers the default branch.
-        assert!(config.boot_args.contains("console=hvc0") || config.boot_args.contains("init=/init"));
+        assert!(
+            config.boot_args.contains("console=hvc0") || config.boot_args.contains("init=/init")
+        );
     }
 
     #[test]
@@ -450,7 +450,9 @@ mod tests {
         )
         .with_session("abc12345", "http://127.0.0.1:3000");
         assert!(config.boot_args.contains("elastos.token=abc12345"));
-        assert!(config.boot_args.contains("elastos.api=http://127.0.0.1:3000"));
+        assert!(config
+            .boot_args
+            .contains("elastos.api=http://127.0.0.1:3000"));
     }
 
     #[test]

elastos/crates/elastos-vz/src/lib.rs

@@ -128,7 +128,10 @@ mod tests {
 
         // Off-mac platforms must always return false.
         #[cfg(not(all(target_os = "macos", target_arch = "aarch64")))]
-        assert!(!supported, "is_supported() must be false outside macOS arm64");
+        assert!(
+            !supported,
+            "is_supported() must be false outside macOS arm64"
+        );
     }
 
     #[test]

elastos/crates/elastos-vz/src/provider.rs

@@ -179,11 +179,7 @@ impl VzProvider {
 
     /// Append boot arguments to a VM before start. Fails closed in
     /// Phase 1.
-    pub async fn append_boot_args_for_vm(
-        &self,
-        capsule_id: &CapsuleId,
-        _args: &str,
-    ) -> Result<()> {
+    pub async fn append_boot_args_for_vm(&self, capsule_id: &CapsuleId, _args: &str) -> Result<()> {
         Err(ElastosError::Compute(format!(
             "{} (append_boot_args_for_vm: capsule='{}')",
             PHASE_1_STUB_MESSAGE, capsule_id.0

elastos/crates/elastos-vz/src/vm.rs

@@ -122,11 +122,8 @@ mod tests {
     #[test]
     fn running_vm_new_captures_config_and_starts_stopped() {
         let m = manifest();
-        let config = VmConfig::from_manifest(
-            &m,
-            std::path::Path::new("/c"),
-            std::path::Path::new("/k"),
-        );
+        let config =
+            VmConfig::from_manifest(&m, std::path::Path::new("/c"), std::path::Path::new("/k"));
         let vm = RunningVm::new(config, m, PathBuf::from("/tmp/vm.sock"));
         assert!(matches!(vm.status, CapsuleStatus::Stopped));
         assert!(!vm.is_running());
@@ -135,11 +132,8 @@ mod tests {
     #[tokio::test]
     async fn running_vm_start_fails_closed_with_phase_1_stub() {
         let m = manifest();
-        let config = VmConfig::from_manifest(
-            &m,
-            std::path::Path::new("/c"),
-            std::path::Path::new("/k"),
-        );
+        let config =
+            VmConfig::from_manifest(&m, std::path::Path::new("/c"), std::path::Path::new("/k"));
         let mut vm = RunningVm::new(config, m, PathBuf::from("/tmp/vm.sock"));
 
         let err = vm.start().await.unwrap_err();
@@ -149,11 +143,8 @@ mod tests {
     #[tokio::test]
     async fn running_vm_stop_is_idempotent_in_phase_1() {
         let m = manifest();
-        let config = VmConfig::from_manifest(
-            &m,
-            std::path::Path::new("/c"),
-            std::path::Path::new("/k"),
-        );
+        let config =
+            VmConfig::from_manifest(&m, std::path::Path::new("/c"), std::path::Path::new("/k"));
         let mut vm = RunningVm::new(config, m, PathBuf::from("/tmp/vm.sock"));
 
         // Calling stop on a never-started VM must not error — same
@@ -165,11 +156,8 @@ mod tests {
     #[test]
     fn running_vm_http_port_passes_through_from_config() {
         let m = manifest();
-        let config = VmConfig::from_manifest(
-            &m,
-            std::path::Path::new("/c"),
-            std::path::Path::new("/k"),
-        );
+        let config =
+            VmConfig::from_manifest(&m, std::path::Path::new("/c"), std::path::Path::new("/k"));
         let vm = RunningVm::new(config, m, PathBuf::from("/tmp/vm.sock"));
         assert_eq!(vm.http_port(), Some(4100));
     }

elastos/crates/elastos-vz/tests/smoke.rs

@@ -107,7 +107,10 @@ async fn vz_provider_load_for_microvm_fails_closed_with_phase_marker() {
         .unwrap_err();
 
     let msg = err.to_string();
-    assert!(msg.contains("Phase 2"), "expected Phase-2 marker, got: {msg}");
+    assert!(
+        msg.contains("Phase 2"),
+        "expected Phase-2 marker, got: {msg}"
+    );
     assert!(msg.contains("docs/vz-backend/PLAN.md"));
 }