test(vm): boot upgrade and recovery acceptance scenarios

[jdx]

Container tests cannot verify boot persistence. Add a QEMU harness that boots a real Arch disk, installs with a baseline binary, upgrades with the candidate, interrupts an actual pacman transaction, checks conservative recovery, rolls back, and boots again to verify package and ledger persistence.

The baseline defaults to the latest published stable release, with origin/main as the initial fallback while no releases exist. CI retains binary hashes, baseline identity, bootstrap logs, and both boot logs. KVM is used when available, with TCG fallback.

Validation: the checked-in harness passed locally and in GitHub Actions, including both boots. Fixture repositories and keys are disposable; CI does not upload their private keys.

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

---

Note

Medium Risk
New mandatory CI depends on Docker, QEMU, sudo, and GitHub API for baselines, so flakes or runner gaps could block merges without changing production runtime code.

Overview
Adds a boot acceptance harness that container tests cannot cover: Docker prepares an Arch rootfs with signed fixture repos and snapshots, exports an ext4 disk, and QEMU boots it twice with a real kernel/initramfs (KVM when available, TCG otherwise).

First boot installs with a baseline pacvamp (latest stable tag or origin/main), upgrades with the candidate, kills an in-flight update after pacman mutates packages, checks conservative recover, rolls back to a signed snapshot, and records phase-one success. Second boot asserts package version, ledger, cleared journals, and snapshot pin survived shutdown.

CI gains mandatory vm-e2e (QEMU, e2fsprogs, full workspace build, bash harness/vm/run); the final fan-in gate now requires it and uploads target/vm-results (logs and binary hashes, not fixture keys). PLAN.md and harness/ docs describe the suite as separate from snapshot promotion; hk.pkl lints the new shell scripts.

^{Reviewed by Cursor Bugbot for commit 67ffcc9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 23 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Team

Run ID: baebebda-05b4-4fd9-9cdd-48914b3f92b0

📥 Commits

Reviewing files that changed from the base of the PR and between 42b8fd8 and 67ffcc9.

⛔ Files ignored due to path filters (1)

• hk.pkl is excluded by !**/*.pkl

📒 Files selected for processing (7)

• .github/workflows/ci.yml
• PLAN.md
• harness/README.md
• harness/vm/README.md
• harness/vm/bootstrap
• harness/vm/guest
• harness/vm/run

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3e30296. Configure here.}