DL-486

The microVM backend is certified production-ready (OQ-1 of the runner adoption-strategy record, RIG-3070) only when four criteria hold for one pinned main commit, the dogfood soak’s build: (1) the microvm CI job passes, with V8’s (RIG-2499) source-derived presence check widened to every microvm-tagged test file and a closed three-entry skip allowlist keyed on test name plus skip message, on that commit and the 20 most recent main runs ending at certification over at least 7 days, where a superseded run is skipped, a timeout cancel or re-run-to-green is red, and only a setup-skip, a pre-suite step failure or a withheld-KVM fatal is infrastructure; (2) runContractSuite passes every row registered for each backend, the microVM leg setting exactly its eight backendCaps flags, with V2b divergence 5 proven by TestCreateRefusesInexpressibleMount’s two-mount case in the untagged unit lane; (3) the documented self-host path (preflight --runtime-backend microvm green, up --runtime-backend microvm --guest-artifact, one agent turn, down with no surviving VMM/virtiofsd/passt) passes once on a fresh KVM host and on every main run as a microVM e2e leg; (4) a 14-day soak on a compass-stack microVM host exporting to a retained OTLP backend meets a load floor with a named source per quantity, and resets to day 0 on a reproduced criterion-1/2 red, any non-PASS in a daily microVM probe of guest escape, cross-session reach and egress, a frozen Q-budget breach on boot time or two-process (VMM plus virtiofsd) PSS, any backend session loss or canary failure not exempted by Matt, a possibly-live orphan, a podman fallback, or a no-data day; a later reset lapses certification.

Status: Active (proposed, pending Matt, 2026-10-11)

Record: ../../infra/runtime/compass-elastic-session-runtime/microvm-production-readiness-bar.md#approach