[EmergentMonk]

Scope

Builds the Virtual Testbed tooling without creating or booting a VM, changing the host, installing software, enabling networking, exposing GitHub Pages, or launching Daybreak.

• Deterministic x86_64, 2-vCPU, 4-GiB, 48-GiB offline VM profile in lab/testbed.json.
• scripts/testbed.py: read-only plan; explicit approval-gated disk preparation; stored/current libvirt XML device audit; approval-gated shut-off only QCOW2 copy and SHA-256 receipt.
• Unprivileged local qemu:///session; no NIC/bridges/NAT, graphics listeners, host shares/passthrough, or implicit network configuration.
• Unit tests are mocked/pure; CI never invokes virsh or qemu-img.
• docs/VIRTUAL_TESTBED.md, docs/DAYBREAK_GATE.md, templates/baseline_receipt.json, updated README/AGENTS/setup/roadmap.
• No GitHub Pages or public dashboard/endpoints.

Verification

• Python unit and compile checks: GitHub Actions runs on PR; review results before merge.
• Tooling code committed: a07f1c5
• No actual RHEL ISO download, VM install/boot, host network isolation validation, kernel testing, snapshot, or Daybreak scan was performed.

Follow-up sequence

1. Review code and CI, especially security, path validation, libvirt XML checks, races and manual command warnings.
2. Owner-requested Daybreak source code scan and findings remediation only when ready.
3. Owner review/merge.
4. On an owned local host: verify KVM, media entitlement/checksum, manual definition, effective containment, and actual baseline receipts.
5. Explicit separate authorization for any guest experiments.

This PR does not claim that a no-NIC XML definition alone proves isolation or that qemu-img copy is atomic against concurrent host processes.

Summary by Sourcery

Introduce review-gated offline KVM testbed tooling and Daybreak readiness controls without provisioning or running a guest.

New Features:

• Add an offline-first, unprivileged local KVM testbed profile with deterministic x86_64 resources, no guest networking, and serial-console-only access.
• Provide operator-gated commands for read-only planning, disk preparation, libvirt XML auditing, and shut-off-only QCOW2 snapshots with SHA-256 receipts.

Enhancements:

• Add fail-closed validation for configuration, host paths, device definitions, approvals, and snapshot safety conditions.
• Document the testbed operating boundaries, evidence requirements, isolation limitations, and staged Daybreak security review process.

CI:

• Expand pure, mocked unit coverage while keeping CI free of virsh, qemu-img, VM boot, and privileged operations.

Documentation:

• Update project status, setup guidance, roadmap, and research boundaries to distinguish tooling readiness from actual guest installation, isolation proof, or experiments.

Tests:

• Add regression tests covering profile validation, XML/device restrictions, path safety, approval gates, subprocess diagnostics, and snapshot refusal conditions.

Chores:

• Add a baseline receipt template and local lab profile for future authorized guest validation.

[sourcery-ai]

Sorry @EmergentMonk, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day and 3 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's Guide

Data structures

Define the offline VM profile that the testbed tooling uses to generate and audit the domain configuration.

• lab/testbed.json L1-9

Implementation

Implement the operator-gated testbed commands, path and XML validation, subprocess handling, and offline snapshot receipt workflow.

• scripts/testbed.py L1-381

Configuration

Provide a baseline receipt template for recording future guest and snapshot evidence.

• templates/baseline_receipt.json L1-24

Documentation

Set repository guardrails for local host operations, guest networking, publication, and Daybreak authorization.

• AGENTS.md L18-25

Document the staged Daybreak review and authorization gates, including what scans can and cannot establish.

• docs/DAYBREAK_GATE.md L1-25

Update the setup checklist to point readers to the optional testbed tooling and its operational guidance.

• docs/LAB_SETUP.md L3

Update milestone status and acceptance criteria to distinguish completed tooling from future guest installation and validation.

• docs/ROADMAP.md L9-22

Explain the offline testbed workflow, operator approvals, XML audit limits, snapshot procedure, and test boundaries.

• docs/VIRTUAL_TESTBED.md L1-94

Update the project status and guide readers to the testbed profile, commands, and review gates without claiming a guest has run.

• README.md L7, L28, L49-62

Tests

Add mocked unit tests for profile validation, XML restrictions, path safety, approval gates, subprocess diagnostics, and snapshot refusal behavior.

• tests/test_testbed.py L1-206

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-12T07:33:18.897662Z	a510e09	Manual request
🔒 Security Review	✅ Completed 2026-11-12T07:13:44.045260Z	a07f1c5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a07f1c5416

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[EmergentMonk]

@codex Please Review this exact SHA a510e09 against the existing contract. Report only actionable correctness defects, with a minimal reproduction, expected versus actual behavior, and affected lines. State whether each reproduction was executed or statically inferred. Don’t repeat fixed findings without a new failing case. Keep architectural suggestions separate and non-blocking.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: a510e09494

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".