feat(gateway,cli): windows compilation support by araza008 · Pull Request #2496 · NVIDIA/OpenShell

araza008 · 2026-07-27T14:43:51Z

Summary

compile the OpenShell gateway and CLI natively on Windows MSVC for x86-64 and arm64. It is build support only. It does not add functional Windows support for MXC, the sandbox supervisor, or Windows services.

Related Issue

Changes

adds windows mise tasks
supports bundled-z3 with optional system z3
gates unix-only dependencies so the geteway and cli compile on windows
adds linting and pre-commit tasks

Testing

mise run --skip-tools windows:build:x64
mise run --skip-tools windows:build:arm64

Checklist

Follows Conventional Commits
Commits are signed off (DCO)
Architecture docs updated (if applicable)

copy-pr-bot · 2026-07-27T14:43:55Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

github-actions · 2026-07-27T14:44:02Z

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

araza008 · 2026-07-27T17:33:14Z

I have read the DCO document and I hereby sign the DCO.

jamieknvidia · 2026-07-27T23:12:18Z

I have read the DCO document and I hereby sign the DCO.

drew · 2026-07-28T05:03:59Z

/ok to test d0bcaca

gburachas · 2026-07-28T16:14:00Z

I have read the DCO document and I hereby sign the DCO.

araza008 · 2026-07-29T16:04:08Z

/ok to test 15c622a

araza008 · 2026-07-29T16:55:59Z

/ok to test 7c96e78

drew · 2026-07-29T20:29:00Z

/ok to test 7c96e78

araza008 · 2026-07-29T21:47:34Z

/ok to test 923ecf0

araza008 · 2026-07-31T03:46:12Z

/ok to test c1d5e98

araza008 · 2026-07-31T05:08:32Z

/ok to test d1fa290

pimlock · 2026-07-31T22:32:02Z

/ok to test d1fa290

araza008 · 2026-08-04T08:59:36Z

/ok to test 60c2340

Signed-off-by: Shailendra Singh <shailendras@nvidia.com> Signed-off-by: Akber Raza <akberr@nvidia.com>

Signed-off-by: Akber Raza <akberr@nvidia.com>

…ove build logic Signed-off-by: Akber Raza <akberr@nvidia.com>

…re-specific subdirectories Signed-off-by: Akber Raza <akberr@nvidia.com>

Signed-off-by: Akber Raza <akberr@nvidia.com>

…ation and scripts Signed-off-by: Akber Raza <akberr@nvidia.com>

Why: windows-msvc-build-design.mdx is a design document ("design decisions for the native Windows MSVC build lane"), but it lived in the published, user-facing docs/reference/ tree. Per AGENTS.md (Documentation) and architecture/README.md ("rfc/ vs architecture/"), design content belongs in architecture/ (or rfc/), not in published reference. It also shared Fern sidebar "position: 6" with the MXC compute-driver design page, colliding in the Reference nav ordering. What: - Move docs/reference/windows-msvc-build-design.mdx -> architecture/windows-msvc-build.md. - Strip the Fern publish frontmatter and add a plain H1, matching the other architecture docs. - Register it in the architecture doc index in architecture/README.md. - Repoint the inbound references (build-openshell-mxc-windows skill + reference, implement-openshell-mxc-driver skill) to the new path. With both design pages moved out of docs/reference/, the duplicate position-6 sidebar collision is resolved. Signed-off-by: Akber Raza <akberr@nvidia.com>

…est exclusion list Signed-off-by: Akber Raza <akberr@nvidia.com> # Conflicts: # tasks/scripts/windows-msvc.ps1

openshell-gateway-interceptors failed to compile on Windows (E0432: no UnixStream in tokio::net), breaking any Windows build of openshell-server (which depends on it unconditionally). The connect_unix_endpoint fn was already #[cfg(unix)]-gated, but the imports it uses (UnixStream, TokioIo, Uri, service_fn) were left ungated. Gate those four imports with #[cfg(unix)] too. No behavior change on unix; Windows now compiles (no errors, no unused-import warnings). Signed-off-by: Akber Raza <akberr@nvidia.com>

Signed-off-by: Shailendra Singh <shailendras@nvidia.com> Signed-off-by: Akber Raza <akberr@nvidia.com>

Signed-off-by: Akber Raza <akberr@nvidia.com>

Signed-off-by: Shailendra Singh <shailendras@nvidia.com>

Signed-off-by: Akber Raza <akberr@nvidia.com>

pimlock · 2026-08-04T20:41:50Z

+#![allow(clippy::result_large_err)]
+
+#[cfg(not(target_os = "windows"))]
+include!("lib.rs");
+
+#[cfg(target_os = "windows")]
+include!("lib_win.rs");


Note
I'm moving the original comment here, since the "root" comments don't support threads.

One question came up while reviewing this - was having driver crates conditional in the server crate, rather than rely on stubs for each driver considered?

I did a quick spike here and I think this should work, but don't have a windows machine to check: araza008/OpenShell@windows_compilation...NVIDIA:OpenShell:spike/windows-exclude-unsupported-drivers

This way driver crates don't need any conditions, they are just excluded from the build process. There are some guard required in the server crate itself, but that seems a bit less intrusive than condition + a stub for all driver crates.

Response from @araza008

This is something I contemplated when creating this PR. The #[cfg] block only applies to the next item and will require placing hundreds of macros in order to compile on windows making it a nightmare for maintenance.

I see. Could you please share more detail? Where would hundreds of macros come from in that case? That would only be required in the openshell-server, wherever we deal with drivers, which could then be isolated to a separate module and the cfg macro could be applied to that one only.

I updated the spike to do that: araza008/OpenShell@windows_compilation...NVIDIA:OpenShell:spike/windows-exclude-unsupported-drivers and I built that successfully on a Windows machine.

pimlock · 2026-08-04T20:50:48Z

+thiserror = { workspace = true }
+anyhow = { workspace = true }
+hmac = "0.12"
+sha2 = { workspace = true }
+hex = "0.4"



These dependencies appear to be stale.

Looks like these were removed when the supervisor functionality was split into the core, network, and process crates in #1650.

pimlock · 2026-08-04T21:10:37Z

-/// Run the prover end-to-end and return a result containing an exit code.
+/// Run the prover end-to-end and return an exit code.
 ///
-/// - `Ok(0)` — pass (no findings, or all accepted)
-/// - `Ok(1)` — fail (one or more unaccepted findings present)
-/// - `Err(_)` — input or registry loading error
+/// - `0` — pass (no critical/high findings, or all accepted)
+/// - `1` — fail (critical or high findings present)
+/// - `2` — input error


This is unrelated to this PR, please revert.

pimlock · 2026-08-04T21:21:13Z

+      - uses: actions/checkout@v4
+      - uses: jdx/mise-action@v3


Please update this to use SHA-pinned actions.

For jdx/mise-action currently approved ones are:

jdx/mise-action@6d1e696aa24c1aa1bcc1adea0212707c71ab78a8, jdx/mise-action@ca0c5fc9c8a8386dae8ba5d37608a083a307991c, jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d,

Suggested change

- uses: actions/checkout@v4

- uses: jdx/mise-action@v3

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0

pimlock · 2026-08-04T21:32:08Z

+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-pc-windows-msvc


We should match the toolchain version that we use in other places. Also, the @master version is on the approved list.

Suggested change

- uses: dtolnay/rust-toolchain@stable

with:

targets: x86_64-pc-windows-msvc

- uses: dtolnay/rust-toolchain@master

with:

toolchain: "1.95.0"

targets: x86_64-pc-windows-msvc

As per their docs:

When passing an explicit toolchain as an input instead of @rev, you'll want to use "dtolnay/rust-toolchain@master" as the revision of the action.

pimlock · 2026-08-04T21:33:09Z

+      - uses: actions/checkout@v4
+      - uses: jdx/mise-action@v3


Similar to above.

pimlock · 2026-08-04T21:55:44Z

@@ -0,0 +1,6 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.


Similar to drivers, I think the sandbox build should be excluded from the build graph on windows, rather than having stubs for windows. This way we could eliminate the need for cfg macros in crates we don't need for windows anyways (this includes the sandbox and vfio.

Spike with this approach: araza008/OpenShell@windows_compilation...NVIDIA:OpenShell:spike/windows-exclude-unsupported-runtime-crates

pimlock · 2026-08-04T23:05:26Z

/ok to test 97ce1f3

araza008 requested review from a team, derekwaynecarr, maxamillion and mrunalp as code owners July 27, 2026 14:43

drew changed the title ~~Windows compilation~~ feat(gateway,cli): windows compilation support Jul 28, 2026

araza008 force-pushed the windows_compilation branch from d0bcaca to 6d0f148 Compare July 29, 2026 14:56

matthewgrossman reviewed Jul 31, 2026

View reviewed changes

Comment thread .agents/skills/build-openshell-mxc-windows/SKILL.md Outdated

This comment was marked as outdated.

Sign in to view

shailendra-nv and others added 7 commits August 4, 2026 12:56

chore(windows): gate Unix-only workspace code for MSVC

35c59d0

Signed-off-by: Shailendra Singh <shailendras@nvidia.com> Signed-off-by: Akber Raza <akberr@nvidia.com>

feat(windows): stub unsupported compute drivers

30210c0

Signed-off-by: Shailendra Singh <shailendras@nvidia.com> Signed-off-by: Akber Raza <akberr@nvidia.com>

ci(windows): add MSVC mise build lane

ae41b57

Signed-off-by: Shailendra Singh <shailendras@nvidia.com> Signed-off-by: Akber Raza <akberr@nvidia.com>

docs(windows): document MSVC build-only design

cf90ebc

Signed-off-by: Shailendra Singh <shailendras@nvidia.com> Signed-off-by: Akber Raza <akberr@nvidia.com>

docs(agent): add Windows MSVC build skill

4cea635

Signed-off-by: Shailendra Singh <shailendras@nvidia.com> Signed-off-by: Akber Raza <akberr@nvidia.com>

feat(windows): add Windows build support

15b045b

Signed-off-by: Akber Raza <akberr@nvidia.com>

refactor(windows): consolidate Windows-specific dependencies and impr…

39e2330

…ove build logic Signed-off-by: Akber Raza <akberr@nvidia.com>

araza008 and others added 27 commits August 4, 2026 12:56

feat(windows): enhance libclang path resolution to support architectu…

f26d169

…re-specific subdirectories Signed-off-by: Akber Raza <akberr@nvidia.com>

Fix Windows dependency gating after sync merge

e2a6a14

Signed-off-by: Akber Raza <akberr@nvidia.com>

fix(z3): update Z3 header path requirements in Windows build document…

09c7c0e

…ation and scripts Signed-off-by: Akber Raza <akberr@nvidia.com>

remove openshell-supervisor-network from unsupported driver package t…

6806021

…est exclusion list Signed-off-by: Akber Raza <akberr@nvidia.com> # Conflicts: # tasks/scripts/windows-msvc.ps1

feat(windows): add native ARM64 test support

8a68e3e

Signed-off-by: Shailendra Singh <shailendras@nvidia.com> Signed-off-by: Akber Raza <akberr@nvidia.com>

fix(mise): skip Skaffold on Windows

733fe4f

Signed-off-by: Shailendra Singh <shailendras@nvidia.com> Signed-off-by: Akber Raza <akberr@nvidia.com>

fix(windows): harden ARM64 toolchain discovery

c6f211f

Signed-off-by: Shailendra Singh <shailendras@nvidia.com> Signed-off-by: Akber Raza <akberr@nvidia.com>

fix(windows): scope ARM64 toolchain preflight

4b01aab

Signed-off-by: Shailendra Singh <shailendras@nvidia.com> Signed-off-by: Akber Raza <akberr@nvidia.com>

fix(windows): restore compatibility after GitHub sync

96d2d41

Signed-off-by: Shailendra Singh <shailendras@nvidia.com> Signed-off-by: Akber Raza <akberr@nvidia.com>

fix(windows): avoid rate-limited Z3 source lookup

dc92689

Signed-off-by: Shailendra Singh <shailendras@nvidia.com> Signed-off-by: Akber Raza <akberr@nvidia.com>

fix(mise): skip Helm checks on Windows

bc0acb5

Signed-off-by: Shailendra Singh <shailendras@nvidia.com> Signed-off-by: Akber Raza <akberr@nvidia.com>

fix(windows): support repository pre-commit checks

4a5669a

Signed-off-by: Shailendra Singh <shailendras@nvidia.com> Signed-off-by: Akber Raza <akberr@nvidia.com>

fix(windows): stabilize native MSVC validation

de838cb

Signed-off-by: Akber Raza <akberr@nvidia.com>

fix(windows): harden shared Z3 source cache

2877b8e

Signed-off-by: Shailendra Singh <shailendras@nvidia.com>

fix(windows): avoid leaking MSVC flags into clang-cl

05f817a

Signed-off-by: Akber Raza <akberr@nvidia.com>

fix(windows): complete ARM64 migration audit

912c8d1

Signed-off-by: Akber Raza <akberr@nvidia.com>

fix(windows): restore ARM64 Ninja discovery

a16cad2

Signed-off-by: Akber Raza <akberr@nvidia.com>

refactor(windows): separate platform crate roots

959f3bd

Signed-off-by: Akber Raza <akberr@nvidia.com>

fix(windows): restore proto include cfg gating

cdd930f

Signed-off-by: Akber Raza <akberr@nvidia.com>

refactor: address lint errors

1e48b8e

fix(windows): add preflight check for proxy auth file path

0cde671

docs(windows): update GitHub checkout guidance

69cdb81

Signed-off-by: Akber Raza <akberr@nvidia.com>

fix(windows): restore CI after dependency updates

b104d67

Signed-off-by: Akber Raza <akberr@nvidia.com>

fix(mise): repair Windows sccache lock entry

b8e0e48

Signed-off-by: Akber Raza <akberr@nvidia.com>

fix(windows): reconcile validation after rebase

97ce1f3

Signed-off-by: Akber Raza <akberr@nvidia.com>

araza008 force-pushed the windows_compilation branch from 602d192 to 97ce1f3 Compare August 4, 2026 18:54

pimlock reviewed Aug 4, 2026

View reviewed changes

		@@ -0,0 +1,6 @@
		// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.

Uh oh!

Conversation

araza008 commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Testing

Checklist

Uh oh!

copy-pr-bot Bot commented Jul 27, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

araza008 commented Jul 27, 2026

Uh oh!

jamieknvidia commented Jul 27, 2026

Uh oh!

drew commented Jul 28, 2026

Uh oh!

gburachas commented Jul 28, 2026

Uh oh!

araza008 commented Jul 29, 2026

Uh oh!

araza008 commented Jul 29, 2026

Uh oh!

drew commented Jul 29, 2026

Uh oh!

araza008 commented Jul 29, 2026

Uh oh!

araza008 commented Jul 31, 2026

Uh oh!

araza008 commented Jul 31, 2026

Uh oh!

pimlock commented Jul 31, 2026

Uh oh!

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

araza008 commented Aug 4, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pimlock commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

araza008 commented Jul 27, 2026 •

edited

Loading

github-actions Bot commented Jul 27, 2026 •

edited

Loading