[hanthor]

The managed VM engine previously accepted a matching QMP response ID without requiring a successful return. This draft requires typed successful replies and adds internal, session-bound status, mouse, key-input and PPM capture operations through the existing engine-owned stdio channel. Requests have bounded deadlines and ephemeral session identities; captures retain at most eight files and 32 MiB across session restarts. A new start also clears inherited DesktopReady claims.

Based on the reviewed VM-first stack 8e1c93e; integrates main through 347f696 (#487/#488/#490). The main integrations are included in this comparison because the candidate base remains frozen.

Validation: actual paused native QEMU TCG component controls, focused race tests with native QEMU required and zero skips, full Go tests, seven removed-guard counterexamples, and an actual inherited DesktopReady before/after counterexample pass. Immutable source hashes, raw logs, and historical failing controls are retained in docs/experiments/evidence/2026-09-27-scoped-qmp/provenance.json. The focused hosted workflow requires QEMU and builds the frontend before running these controls. English budget remains 1512.

This is an internal engine boundary. The scoped test adapter and guest semantic channel remain owed. It establishes no Windows/WHPX, ordinary-user desktop, editor persistence, or full VM acceptance. No image/runtime contract or preserved fixture was changed. #178 and #383 remain open.

Exact original c9b6077 hosted native QMP and ordinary CI passed; fast tier failed because the inherited VM preparation producer added fields to install reports. Superseding aa1784c emits the nine VM fields only for prepare-vm, preserving exact twelve-field install/reboot reports and the unchanged strict install host parser. Eleven actual drive-loop producer/host controls pass, including missing/wrong-field refusals and a removed action-guard mutation. Original hosted/local failure logs and source bindings are retained under the evidence receipt-schema/ directory. New exact native/source and ordinary build gates are pending.

[hanthor-hive-agent]

aa1784c

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @hanthor, head aa1784cad7a9) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 3 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/native-rpc-capabilities.yml
  • .github/workflows/vm-first-hosted.yml
  • .github/workflows/vm-qmp-controls.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hanthor-hive-agent]

aa1784c

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @hanthor, head aa1784cad7a9) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 3 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/native-rpc-capabilities.yml
  • .github/workflows/vm-first-hosted.yml
  • .github/workflows/vm-qmp-controls.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hanthor-hive-agent]

aa1784c

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @hanthor, head aa1784cad7a9) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 3 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/native-rpc-capabilities.yml
  • .github/workflows/vm-first-hosted.yml
  • .github/workflows/vm-qmp-controls.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.