Add OCI Windows machine images

[sjmiller609]

summary

• add OCI metadata and materialization for launchable Windows machine images
• distinguish immutable windows-base artifacts from launchable windows-image artifacts
• normalize raw, qcow2, VHD, and VHDX bases into immutable sparse raw disks
• pin Windows images to digest-addressed bases and replace artifact-supplied backing paths
• reflink-clone writable per-instance qcow2 disks with private NVRAM and TPM state
• validate Windows requirements through hypervisor UEFI/TPM capabilities
• document image processing, launch defaults, and fixed disk sizing in library READMEs
• remove the redundant image-only Windows VM boot gate

targeted tests

• Windows machine-image parsing, validation, materialization, and OCI tests
• Windows create validation and hypervisor-config tests

Long-running KVM and full CI suites were not run for this review pass.

---

Note

High Risk
Touches image pull/materialization, deletion of digest-backed artifacts, and instance boot/hypervisor config for a new guest OS. Disk rebase, firmware/TPM setup, and delete-dependency checks are security- and data-sensitive.

Overview
Adds Windows machine images as labeled OCI artifacts (windows-base vs launchable windows-image) instead of treating ordinary Windows containers as bootable.

On pull, Hypeman parses io.hypeman.machine-image.* labels, rejects path escapes and encrypted/external backing, converts bases (raw/qcow2/VHD/VHDX) to immutable sparse raw, and rebases qcow2 images onto a digest-pinned cache-owned base. Image metadata now stores Machine; deleting a base is blocked while a cached image still references it. windows/amd64 is a valid platform; implicit host-platform creates no longer pick a cached Windows image.

Instance create clones the image to a private qcow2, copies OVMF NVRAM, and sets up swtpm. Boot is UEFI + Secure Boot + TPM 2.0 with 8 GiB / 4 vCPU defaults (min 4 GiB / 2 vCPU). Overlay resize, Linux config disks, kernels, networking, volumes, devices, env/cmd, and snapshot/fork/standby/restore are rejected for this phase.

^{Reviewed by Cursor Bugbot for commit 0dc80f4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

-->

✱ stlc build

✅ gocode · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

116 files generated at 72751bb (pushed)

go get github.com/kernel/hypeman-go-staging@72751bb4fcb05519886a96eff977c12c9a40f8ee

✅ pythoncode · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

230 files generated at b0465be (pushed)

✅ typescriptcode · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

138 files generated at fbe49da (pushed)

Diagnostics: ❗ 0 new / 1 total error, 💡 0 new / 5 total note

Level	Code	Message	Targets

Build metadata

Build	bd_76BHqpcQ-still-maze
Timestamp	2026-08-20T20:29:54.044Z
stlc	8413509
Spec hash	ddbd3be87ae7
Config hash	55e15f6f4434

---

This comment is auto-generated by stlc and is kept up to date as you push.
If you push new commits, re-run this workflow to update this comment.
Last updated: 2026-08-20 20:30:27 UTC

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 31b5a61. Configure here.}