Consolidate Windows lifecycle coverage

Author: sjmiller609

.github/workflows/test.yml

@@ -132,35 +132,18 @@ jobs:
           done
           exit 1
 
-      - name: Test Windows guest control
+      - name: Test Windows lifecycle
         run: |
           make build-embedded
           TEST_PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH"
           for attempt in 1 2 3; do
             if sudo env \
               "PATH=$TEST_PATH" \
               "CI=true" \
-              "HYPEMAN_RUN_WINDOWS_GUEST_CONTROL_INTEGRATION=1" \
+              "HYPEMAN_RUN_WINDOWS_LIFECYCLE_INTEGRATION=1" \
               "HYPEMAN_WINDOWS_OVMF_CODE=$HYPEMAN_WINDOWS_OVMF_CODE" \
               "HYPEMAN_WINDOWS_OVMF_VARS=$HYPEMAN_WINDOWS_OVMF_VARS" \
-              go test -count=1 -run '^TestWindowsGuestAgentIntegration$' -timeout 2m ./lib/instances; then
-              exit 0
-            fi
-            test "$attempt" = 3 || sleep 5
-          done
-          exit 1
-
-      - name: Test Windows networking
-        run: |
-          TEST_PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH"
-          for attempt in 1 2 3; do
-            if sudo env \
-              "PATH=$TEST_PATH" \
-              "CI=true" \
-              "HYPEMAN_RUN_WINDOWS_NETWORKING_INTEGRATION=1" \
-              "HYPEMAN_WINDOWS_OVMF_CODE=$HYPEMAN_WINDOWS_OVMF_CODE" \
-              "HYPEMAN_WINDOWS_OVMF_VARS=$HYPEMAN_WINDOWS_OVMF_VARS" \
-              go test -count=1 -run '^TestWindowsNetworkingIntegration$' -timeout 2m ./lib/instances; then
+              go test -count=1 -run '^TestWindowsLifecycleIntegration$' -timeout 2m ./lib/instances; then
               exit 0
             fi
             test "$attempt" = 3 || sleep 5

docs/windows-networking.md

@@ -2,17 +2,6 @@
 
 Hypeman can attach a Windows 11 QEMU guest to its normal TAP/bridge network. The public instance model remains unchanged: `NetworkEnabled` allocates the address, MAC, gateway, netmask, DNS servers, and TAP device used for Linux guests.
 
-After the Windows guest agent becomes reachable over virtio-vsock, Hypeman sends the allocation through the typed `ReconfigureNetwork` RPC. The Windows agent:
+Create and start apply the current allocation before the instance becomes ready. A configuration failure fails the lifecycle operation rather than exposing a guest with partial networking.
 
-1. finds the virtio-net adapter by its allocated MAC address;
-2. removes stale IPv4 addresses and default routes;
-3. creates the allocated IPv4 address and default route with Windows IP Helper APIs; and
-4. applies the allocated DNS servers with `SetInterfaceDnsSettings`.
-
-Windows never uses the Linux shell-command fallback. Create fails and stops the VM if the typed reconfiguration fails. Start applies the current allocation again, allowing an instance to receive a different address or MAC after it was stopped.
-
-RDP is not a Hypeman API. A prepared persona may enable RDP, and callers can reach TCP port 3389 through the instance's generic allocated IP after applying their normal ingress policy.
-
-## Integration fixture
-
-`TestWindowsNetworkingIntegration` uses the private `HYPEMAN_WINDOWS_TEST_AGENT_PERSONA` fixture (default `/ci/windows/persona-agent.qcow2`). It verifies the address from inside Windows, performs a DNS lookup, checks ICMP, and opens the RDP TCP port over the allocated TAP network. The fixture and its Windows license are not stored in this repository.
+RDP is not a Hypeman API. A prepared image may enable RDP, and callers can reach TCP port 3389 through the instance's generic allocated IP after applying their normal ingress policy.

lib/instances/README.md

@@ -30,6 +30,12 @@ The launchable Windows image already defines its virtual disk size, so instance
 
 A Windows VM remains `Initializing` until its guest agent answers over VioSock. This avoids treating firmware completion as application readiness.
 
+### Windows networking
+
+Windows uses the same host-side TAP allocation as Linux. Once the guest agent is reachable, the manager sends the complete allocation through the typed `ReconfigureNetwork` RPC. The agent selects the virtio-net adapter by MAC address, replaces stale IPv4 addresses and default routes, and applies DNS through native Windows APIs. It never invokes the Linux shell-command fallback.
+
+Create treats network configuration as part of readiness and tears down a VM if it fails. Start reapplies the current allocation because a stopped instance may receive a different address or MAC before its next boot.
+
 ### Why Config Disk? (configdisk.go)
 
 **What:** Read-only erofs disk with instance configuration

lib/instances/windows_guest_agent_integration_linux_test.go

@@ -9,6 +9,7 @@ import (
 	"net"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -22,13 +23,13 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestWindowsNetworkingIntegration(t *testing.T) {
-	if os.Getenv("HYPEMAN_RUN_WINDOWS_NETWORKING_INTEGRATION") != "1" {
+func TestWindowsLifecycleIntegration(t *testing.T) {
+	if os.Getenv("HYPEMAN_RUN_WINDOWS_LIFECYCLE_INTEGRATION") != "1" {
 		t.Skip("run by the dedicated Windows networking CI gate")
 	}
-	fixture := os.Getenv("HYPEMAN_WINDOWS_TEST_AGENT_PERSONA")
+	fixture := os.Getenv("HYPEMAN_WINDOWS_TEST_AGENT_IMAGE")
 	if fixture == "" {
-		fixture = "/ci/windows/persona-agent.qcow2"
+		fixture = "/ci/windows/image-agent.qcow2"
 	}
 	if _, err := os.Stat(fixture); err != nil {
 		if os.Getenv("CI") == "true" {
@@ -42,23 +43,23 @@ func TestWindowsNetworkingIntegration(t *testing.T) {
 	p := paths.New(dataDir)
 	const digestHex = "abababababababababababababababababababababababababababababababab"
 	image := &images.Image{
-		Name:     "registry.example/windows/persona:networking-integration",
+		Name:     "registry.example/windows/image:networking-integration",
 		Digest:   "sha256:" + digestHex,
 		Platform: "windows/amd64",
 		Status:   images.StatusReady,
 		Machine: &images.MachineImage{
-			Kind:        images.MachineImageWindowsPersona,
+			Kind:        images.MachineImageWindowsImage,
 			Base:        "registry.example/windows/base@sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
 			TPM:         "2.0",
 			SecureBoot:  "required",
 			VirtualSize: 80 << 30,
 		},
 	}
 	manager.imageManager = windowsFixtureImageManager{image: image}
-	personaPath, err := images.GetMachineDiskPath(p, image.Name, image.Digest, image.Machine)
+	imagePath, err := images.GetMachineDiskPath(p, image.Name, image.Digest, image.Machine)
 	require.NoError(t, err)
-	require.NoError(t, forkvm.CopyRegularFile(fixture, personaPath))
-	require.NoError(t, os.Chmod(personaPath, 0444))
+	require.NoError(t, forkvm.CopyRegularFile(fixture, imagePath))
+	require.NoError(t, os.Chmod(imagePath, 0444))
 
 	ctx := context.Background()
 	instance, err := manager.CreateInstance(ctx, CreateInstanceRequest{
@@ -74,17 +75,103 @@ func TestWindowsNetworkingIntegration(t *testing.T) {
 	t.Cleanup(func() { _ = deleteTestInstanceNow(context.Background(), manager, instance.Id) })
 	require.NotEmpty(t, instance.IP)
 	require.NotEmpty(t, instance.MAC)
+	require.Eventually(t, func() bool {
+		current, err := manager.GetInstance(ctx, instance.Id)
+		return err == nil && current.State == StateRunning
+	}, 4*time.Minute, time.Second)
 
+	assertWindowsGuestControl(t, ctx, manager, instance.Id)
 	assertWindowsNetworkReady(t, ctx, manager, instance.Id, instance.IP)
 }
 
-func assertWindowsNetworkReady(t *testing.T, ctx context.Context, manager *manager, instanceID, expectedIP string) {
+func assertWindowsGuestControl(t *testing.T, ctx context.Context, manager *manager, instanceID string) {
 	t.Helper()
-	require.Eventually(t, func() bool {
-		current, err := manager.GetInstance(ctx, instanceID)
-		return err == nil && current.State == StateRunning
-	}, 4*time.Minute, time.Second)
+	dialer, err := manager.GetVsockDialer(ctx, instanceID)
+	require.NoError(t, err)
+
+	var stdout, stderr bytes.Buffer
+	jobStart := time.Now()
+	exit, err := guest.ExecIntoInstance(ctx, dialer, guest.ExecOptions{
+		Command: []string{"powershell.exe", "-NoProfile", "-NonInteractive", "-Command", `Copy-Item "$env:SystemRoot\System32\ping.exe" "$env:TEMP\hypeman-job-child.exe" -Force; & "$env:TEMP\hypeman-job-child.exe" -n 60 127.0.0.1`},
+		Stdout:  &stdout,
+		Stderr:  &stderr,
+		Timeout: 2,
+	})
+	require.NoError(t, err, stderr.String())
+	assert.Less(t, time.Since(jobStart), 10*time.Second)
+
+	time.Sleep(5 * time.Second)
+	stdout.Reset()
+	stderr.Reset()
+	exit, err = guest.ExecIntoInstance(ctx, dialer, guest.ExecOptions{
+		Command: []string{"powershell.exe", "-NoProfile", "-NonInteractive", "-Command", `if (Get-Process hypeman-job-child -ErrorAction SilentlyContinue) { exit 42 }`},
+		Stdout:  &stdout,
+		Stderr:  &stderr,
+		Timeout: 15,
+	})
+	require.NoError(t, err, stderr.String())
+	require.Equal(t, 0, exit.Code, "job object left a child process running")
+
+	stdout.Reset()
+	stderr.Reset()
+	exit, err = guest.ExecIntoInstance(ctx, dialer, guest.ExecOptions{
+		Command: []string{"powershell.exe", "-NoProfile", "-NonInteractive", "-Command", "[Console]::Out.Write('HYPEMAN_SYSTEM_OK')"},
+		Stdout:  &stdout,
+		Stderr:  &stderr,
+		Timeout: 30,
+	})
+	require.NoError(t, err, stderr.String())
+	require.Equal(t, 0, exit.Code)
+	assert.Equal(t, "HYPEMAN_SYSTEM_OK", stdout.String())
+
+	stdout.Reset()
+	stderr.Reset()
+	resizes := make(chan *guest.WindowSize, 1)
+	resizes <- &guest.WindowSize{Rows: 37, Cols: 101}
+	close(resizes)
+	exit, err = guest.ExecIntoInstance(ctx, dialer, guest.ExecOptions{
+		Command:    []string{"cmd.exe", "/d", "/c", "ping -n 2 127.0.0.1 >nul & echo HYPEMAN_CONPTY_OK"},
+		Stdout:     &stdout,
+		Stderr:     &stderr,
+		TTY:        true,
+		Rows:       31,
+		Cols:       97,
+		ResizeChan: resizes,
+		Timeout:    30,
+	})
+	require.NoError(t, err, stderr.String())
+	require.Equal(t, 0, exit.Code)
+	assert.Contains(t, stdout.String(), "HYPEMAN_CONPTY_OK")
 
+	stdout.Reset()
+	exit, err = guest.ExecIntoInstance(ctx, dialer, guest.ExecOptions{
+		Command: []string{"cmd.exe", "/d", "/c", "echo", "HYPEMAN_DESKTOP_OK"},
+		Stdout:  &stdout,
+		Session: guest.ExecSession_EXEC_SESSION_DESKTOP,
+		Timeout: 30,
+	})
+	require.NoError(t, err)
+	require.Equal(t, 0, exit.Code)
+	assert.Contains(t, stdout.String(), "HYPEMAN_DESKTOP_OK")
+
+	source := filepath.Join(t.TempDir(), "roundtrip.txt")
+	require.NoError(t, os.WriteFile(source, []byte("HYPEMAN_COPY_OK"), 0644))
+	require.NoError(t, guest.CopyToInstance(ctx, dialer, guest.CopyToInstanceOptions{
+		SrcPath: source,
+		DstPath: `C:\ProgramData\Hypeman\roundtrip.txt`,
+	}))
+	destination := t.TempDir()
+	require.NoError(t, guest.CopyFromInstance(ctx, dialer, guest.CopyFromInstanceOptions{
+		SrcPath: `C:\ProgramData\Hypeman\roundtrip.txt`,
+		DstPath: destination,
+	}))
+	contents, err := os.ReadFile(filepath.Join(destination, "roundtrip.txt"))
+	require.NoError(t, err)
+	assert.Equal(t, "HYPEMAN_COPY_OK", string(contents))
+}
+
+func assertWindowsNetworkReady(t *testing.T, ctx context.Context, manager *manager, instanceID, expectedIP string) {
+	t.Helper()
 	dialer, err := manager.GetVsockDialer(ctx, instanceID)
 	require.NoError(t, err)
 	allocation, err := manager.networkManager.GetAllocation(ctx, instanceID)