Add Windows hypervisor primitives

[sjmiller609]

summary

• add direct-kernel and UEFI boot modes with raw and qcow2 disks
• support Secure Boot OVMF and per-instance swtpm lifecycle on standard QEMU
• advertise and validate UEFI/TPM requirements through runtime capabilities
• manage QEMU and swtpm through one cleanup stack while preserving required socket ordering
• expose software TPM output through the instance logs API
• document firmware, TPM ownership, restart, and cleanup semantics in the hypervisor READMEs

targeted tests

• go test ./lib/hypervisor/qemu ./lib/hypervisor ./lib/paths ./lib/instances ./cmd/api/api -run ... -count=1

Long-running KVM and full CI suites were not run for this review pass.

---

Note

Medium Risk
Touches VM boot orchestration and TPM process lifecycle on the critical QEMU start path, though changes are gated by validation and profile capabilities rather than altering existing Linux direct-boot instances.

Overview
Adds UEFI firmware boot, Secure Boot OVMF, per-instance software TPM 2.0, and qcow2 disks on the standard amd64 QEMU (q35) profile, aimed at Windows-style guests. Shared VMConfig now carries boot mode, firmware paths, TPM socket/state, and disk format; empty values keep the existing direct-kernel + raw-disk behavior for Linux callers.

QEMU builds pflash drives, optional smm=on / secure flash, TPM-CRB devices, and format-aware disk drives. swtpm starts before QEMU (socket ordering), shares one cleanup stack with QEMU, waits out a prior instance’s exiting swtpm via a pid record, and logs to swtpm.log. Capabilities advertise SupportsUEFIBoot / SupportsTPM on q35; cloud-hypervisor, firecracker, vz, and qemu-microvm reject firmware/TPM/qcow2 via ValidateDirectRawConfig. Instance logs API and OpenAPI add source=swtpm; log rotation includes that file.

CI installs ovmf and swtpm, exports OVMF paths, and runs a KVM integration test (TestWindowsConfigIntegration) with retries.

^{Reviewed by Cursor Bugbot for commit e591b6b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

-->

✱ stlc build

✅ go code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

116 files generated at b4712d2 (pushed)

go get github.com/kernel/hypeman-go-staging@b4712d2cabd5b5d61b076f7f8d6346b760ec95d1

✅ python code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

230 files generated at 1d0ddeb (pushed)

✅ typescript code · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

138 files generated at 023adca (pushed)

Diagnostics: ❗ 0 new / 1 total error, 💡 0 new / 5 total note

Level	Code	Message	Targets

Build metadata

Build	bd_76BL5tnQ-tidal-sheen
Timestamp	2026-08-20T23:45:35.109Z
stlc	8413509
Spec hash	ddbd3be87ae7
Config hash	55e15f6f4434

---

This comment is auto-generated by stlc and is kept up to date as you push.
If you push new commits, re-run this workflow to update this comment.
Last updated: 2026-08-20 23:45:59 UTC

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 32eb71a. Configure here.}