Add Windows hypervisor primitives

[sjmiller609]

summary

• add direct-kernel and UEFI boot modes with raw and qcow2 disks
• support Secure Boot OVMF and per-instance swtpm lifecycle on standard QEMU
• advertise and validate UEFI/TPM requirements through runtime capabilities
• manage QEMU and swtpm through one cleanup stack while preserving required socket ordering
• expose software TPM output through the instance logs API
• document firmware, TPM ownership, restart, and cleanup semantics in the hypervisor READMEs

targeted tests

• go test ./lib/hypervisor/qemu ./lib/hypervisor ./lib/paths ./lib/instances ./cmd/api/api -run ... -count=1

Long-running KVM and full CI suites were not run for this review pass.

---

Note

Medium Risk
Touches VM boot orchestration (swtpm/QEMU ordering, process reconciliation) and shared config validation used by all hypervisor starters; mistakes could break Linux direct-kernel paths or leave orphaned TPM processes.

Overview
Adds Windows-oriented hypervisor primitives on standard amd64 QEMU: UEFI firmware boot (OVMF code/vars, optional Secure Boot with smm=on), qcow2 disks, and a per-instance software TPM 2.0 via swtpm started before QEMU on a shared cleanup stack.

VMConfig gains BootMode, Firmware, TPM, and disk Format, with shared ValidateBootConfig / ValidateDirectRawConfig so Cloud Hypervisor, Firecracker, and vz reject UEFI, TPM, and non-raw disks. QEMU profiles advertise SupportsUEFIBoot / SupportsTPM on q35 only; microvm stays direct-kernel/raw.

Observability & API: instance logs accept source=swtpm (OpenAPI + API handler); README documents hypeman logs --source swtpm.

CI installs ovmf/swtpm, exports OVMF paths, and runs TestWindowsConfigIntegration (KVM) with retries. QMP socket wait extended to 30s; fork/snapshot path rewriting covers firmware and TPM paths.

^{Reviewed by Cursor Bugbot for commit f4b75cb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

-->

✱ stlc build

✅ go code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

116 files generated at 082409a (pushed)

go get github.com/kernel/hypeman-go-staging@082409ae4447b46fd421e1e96496597e6a96d70b

✅ python code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

232 files generated at 8459dd9 (pushed)

✅ typescript code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

138 files generated at 399471d (pushed)

Diagnostics: ❗ 0 new / 1 total error, 💡 0 new / 5 total note

Level	Code	Message	Targets

Build metadata

Build	bd_76Gb2QMt-snug-boat
Timestamp	2026-09-02T13:59:49.157Z
stlc	8413509
Spec hash	5407789a4868
Config hash	659c3687c3f0

---

This comment is auto-generated by stlc and is kept up to date as you push.
If you push new commits, re-run this workflow to update this comment.
Last updated: 2026-09-02 14:00:18 UTC

[hiroTamada]

reviewed — the overall direction looks solid, but the PR currently conflicts with main; please rebase and recheck the overlapping process-liveness paths. a few findings:

Bugs

• lib/hypervisor/qemu/config.go:14,60-63 — BuildArgs remains exported but bypasses validation. BootModeUEFI with nil Firmware now panics, while other invalid combinations can emit broken arguments. consider returning an error and validating here, or making this entry point private.
• lib/hypervisor/qemu/swtpm.go:23-75 — a missing PID record is treated as proof that no prior swtpm exists. if Hypeman exits after starting the detached child but before publishing swtpm.pid, the next start can unlink its live socket and launch another process against the same TPM state. this should reconcile or fail closed on an existing socket/process before unlinking it; the socket-owner machinery now on main may help after the rebase.

Tests

• lib/hypervisor/qemu/fork_test.go:20-60 — the UEFI/TPM rewrite assertions use a MachineTypeMicroVM snapshot, which the new validation explicitly rejects. consider testing a standard q35 snapshot so this covers a configuration that can actually be restored.
• lib/hypervisor/qemu/windows_config_integration_linux_test.go:97-114 — after StartVM succeeds, a subsequent require failure leaves detached QEMU and swtpm processes alive; the outer cleanup only removes the directory. register best-effort process cleanup immediately after startup, especially because CI retries this test three times.

[hiroTamada]

this is so fucking awesome

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a8362e3. Configure here.}