feat(zygote): add accelerated process launcher by geeknoid · Pull Request #772 · microsoft/oxidizer

Martin Taillefer (geeknoid) · 2026-09-21T03:55:17Z

Summary

add zygote_control, a std::process-style controller with accelerated Linux launches and native Windows/macOS process creation
add the pure-Rust zygote_rt target runtime with transparent and prepared entry modes plus a checked-in Protobuf protocol
add fail-closed portable and platform-specific sandbox controls, bounded output capture, worker sharding, lifecycle management, and fault-path coverage
add zygote_benchmarks, integration fixtures, user documentation, design notes, and the remaining forward-looking backlog

Validation

host and Windows-target cargo check, Clippy, and rustdoc
generated README checks, rustfmt, spellcheck, and diff hygiene
standalone fixture compilation
runtime, benchmark, coverage, Miri, and mutation suites left to CI

Copilot

Copilot review overview

🟡 Changes recommended

Unresolved critical and moderate findings affect child termination, protocol validation, descriptor cleanup, and lifecycle handling.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2

Open (2)

Reject out-of-range seccomp instruction values · New
Avoid running inherited atexit handlers in forked children · New

What changed in this PR

Adds accelerated Linux zygote launching, cross-platform process creation, runtime modes, sandboxing, protocol support, tests, documentation, and benchmarks.

Changes:

Introduces zygote_control and zygote_rt.
Adds transparent and prepared launch flows.
Adds fixtures, benchmarks, lifecycle handling, and workspace integration.

File	Summary
`README.md`	Documents workspace crates.
`crates/zygote_rt/src/zygote.proto`	Defines the protocol schema.
`crates/zygote_rt/src/prepared.rs`	Implements prepared runtime state.
`crates/zygote_rt/src/lib.rs`	Exposes runtime APIs.
`crates/zygote_rt/src/build.rs`	Configures runtime builds.
`crates/zygote_rt/README.md`	Documents runtime usage.
`crates/zygote_rt/logo.png`	Adds branding asset.
`crates/zygote_rt/favicon.ico`	Adds documentation favicon.
`crates/zygote_rt/CHANGELOG.md`	Records runtime changes.
`crates/zygote_rt/Cargo.toml`	Defines the runtime crate.
`crates/zygote_control/tests/protocol.rs`	Tests protocol behavior.
`crates/zygote_control/tests/launch_semantics.rs`	Tests launch semantics.
`crates/zygote_control/tests/fixtures/targets/src/lib.rs`	Implements test fixture behavior.
`crates/zygote_control/tests/fixtures/targets/src/bin/transparent.rs`	Defines transparent fixture entry.
`crates/zygote_control/tests/fixtures/targets/src/bin/prepared.rs`	Defines prepared fixture entry.
`crates/zygote_control/tests/fixtures/targets/examples/controller.rs`	Exercises controller usage.
`crates/zygote_control/tests/fixtures/targets/Cargo.toml`	Defines fixture package metadata.
`crates/zygote_control/tests/fixtures/targets/build.rs`	Configures fixture linking.
`crates/zygote_control/src/zygote.rs`	Implements launcher lifecycle.
`crates/zygote_control/src/unix.rs`	Provides Unix process support.
`crates/zygote_control/src/stdio.rs`	Defines standard-stream configuration.
`crates/zygote_control/src/sandbox.rs`	Defines sandbox controls.
`crates/zygote_control/src/lib.rs`	Exposes controller APIs.
`crates/zygote_control/src/command.rs`	Implements launch configuration.
`crates/zygote_control/src/child.rs`	Implements child handles and output capture.
`crates/zygote_control/README.md`	Documents controller usage.
`crates/zygote_control/logo.png`	Adds branding asset.
`crates/zygote_control/favicon.ico`	Adds documentation favicon.
`crates/zygote_control/examples/controller.rs`	Provides controller example.
`crates/zygote_control/docs/TODO.md`	Tracks future work.
`crates/zygote_control/CHANGELOG.md`	Records controller changes.
`crates/zygote_control/Cargo.toml`	Defines the controller crate.
`crates/zygote_benchmarks/src/bin/transparent.rs`	Defines transparent benchmark fixture.
`crates/zygote_benchmarks/src/bin/transparent_signals_ignored.rs`	Defines ignored-signal fixture.
`crates/zygote_benchmarks/src/bin/transparent_signals_custom.rs`	Defines custom-signal fixture.
`crates/zygote_benchmarks/src/bin/transparent_default.rs`	Defines default-signal fixture.
`crates/zygote_benchmarks/src/bin/transparent_close_fallback_512.rs`	Defines descriptor fallback fixture.
`crates/zygote_benchmarks/src/bin/transparent_close_fallback_4096.rs`	Defines large descriptor fallback fixture.
`crates/zygote_benchmarks/src/bin/startup.rs`	Configures startup benchmarks.
`crates/zygote_benchmarks/src/bin/prepared.rs`	Defines prepared benchmark fixture.
`crates/zygote_benchmarks/src/bin/prepared_64m.rs`	Defines 64 MiB fixture.
`crates/zygote_benchmarks/src/bin/prepared_1m.rs`	Defines 1 MiB fixture.
`crates/zygote_benchmarks/src/bin/prepared_0.rs`	Defines empty-state fixture.
`crates/zygote_benchmarks/src/bin/fixture.rs`	Implements benchmark workload.
`crates/zygote_benchmarks/Cargo.toml`	Defines benchmark package metadata.
`crates/zygote_benchmarks/build.rs`	Configures benchmark builds.
`crates/zygote_benchmarks/benches/zygote_benchmarks_specialization.rs`	Benchmarks specialization.
`crates/zygote_benchmarks/benches/zygote_benchmarks_scaling.rs`	Benchmarks scaling.
`crates/zygote_benchmarks/benches/zygote_benchmarks_output.rs`	Benchmarks output capture.
`crates/zygote_benchmarks/benches/zygote_benchmarks_launch.rs`	Benchmarks launch performance.
`crates/zygote_benchmarks/benches/support/mod.rs`	Provides benchmark utilities.
`CHANGELOG.md`	Registers crate changes.
`Cargo.toml`	Updates workspace configuration.
`Cargo.lock`	Locks dependencies.
`.spelling`	Adds project terminology.

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Copilot review overview

🟡 Changes recommended

Unresolved packaging, lifecycle, and protocol-validation findings remain.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 · 1

Open (2)

Fix non-publishable path dependency in packaged fixture tests · New
Enforce shutdown state across native launcher clones · New

Resolved since last review (2)

Avoid running inherited atexit handlers in forked children
Reject out-of-range seccomp instruction values

Copilot

Copilot review overview

🟡 Changes recommended

One critical memory-safety issue and five moderate correctness or lifecycle issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

Bounds-check namespace_count before writing · New

Resolved since last review (2)

Fix non-publishable path dependency in packaged fixture tests
Enforce shutdown state across native launcher clones

Copilot

Copilot review overview

🟡 Changes recommended

Unresolved critical and moderate correctness, security, and portability issues remain.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2

Open (2)

Validate ancillary data before reading SCM_RIGHTS descriptors · New
Validate SCM_RIGHTS payload bounds before descriptor access · New

Resolved since last review (1)

Bounds-check namespace_count before writing

Copilot

Copilot review overview

🟡 Changes recommended

Unresolved critical and moderate issues affect process cleanup, descriptor safety, fail-closed validation, and FFI correctness.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 6 · 2

Open (8)

Close received descriptors on ancillary parsing errors · New
Handle readdir errors during proc enumeration · New
Terminate and reap child after send_body failure · New
Reject null argument_vector for zero-length arguments · New
Validate SCM_RIGHTS payload bounds before descriptor access
Validate ancillary data before reading SCM_RIGHTS descriptors
Add coverage exclusion annotation to Windows tests · New
Add coverage exclusion annotation to test module · New

Copilot

Copilot review overview

🟡 Changes recommended

Unresolved runtime safety and validation issues remain, so approval is blocked.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 6 · 2

Open (8)

Propagate collector read errors and terminate the child · New
Reject truncated datagrams before slicing the packet buffer · New
Reject null argument_vector for zero-length arguments
Terminate and reap child after send_body failure
Handle readdir errors during proc enumeration
Close received descriptors on ancillary parsing errors
Add coverage exclusion annotation to test module
Add coverage exclusion annotation to Windows tests

Resolved since last review (2)

Validate SCM_RIGHTS payload bounds before descriptor access
Validate ancillary data before reading SCM_RIGHTS descriptors

Copilot

Copilot review overview

🟡 Changes recommended

Unresolved critical prepared-bootstrap behavior and additional runtime, benchmark, and test-coverage findings block approval.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 3 · 1

Open (4)

Preparation runs before bootstrap authentication · New
Reject truncated datagrams before slicing the packet buffer
Propagate collector read errors and terminate the child
Unconditionally accesses Linux-only /proc files · New

Resolved since last review (6)

Reject null argument_vector for zero-length arguments
Terminate and reap child after send_body failure
Handle readdir errors during proc enumeration
Close received descriptors on ancillary parsing errors
Add coverage exclusion annotation to test module
Add coverage exclusion annotation to Windows tests

Copilot

Copilot review overview

🟡 Changes recommended

Unresolved critical linker integration and moderate correctness/test findings remain.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

Export wrapper under the exact __wrap_main symbol · New

Resolved since last review (1)

Preserve surviving children after detached controller shutdown

Copilot

Copilot review overview

🟡 Changes recommended

Critical descriptor-leak and protocol field-presence issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2

Open (2)

Close SCM_RIGHTS descriptors on validation errors · New
Preserve presence of zero-valued resource limit fields · New

Resolved since last review (1)

Export wrapper under the exact __wrap_main symbol

Copilot

Copilot review overview

🔵 Needs a closer look

Address the worker-failure hang, bound worker allocation, and strengthen the denied-path sandbox test.

Review effort: Lite
Findings: None

Resolved since last review (2)

Preserve presence of zero-valued resource limit fields
Close SCM_RIGHTS descriptors on validation errors

Copilot

Copilot review overview

🟡 Changes recommended

Unresolved sandbox-probing and prepared-launch error-reporting issues remain, along with test and documentation fixes.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

Scope zygote_rt requirement to accelerated Linux launches · New

Copilot

Copilot review overview

🔵 Needs a closer look

The broad platform-sensitive change has an unresolved packet-size validation issue requiring human review.

Review effort: Lite
Findings: None

Resolved since last review (1)

Scope zygote_rt requirement to accelerated Linux launches

Copilot

Copilot review overview

🟡 Changes recommended

Critical descriptor handling and moderate protocol validation issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

Global standard-fd placeholders are racy across threads and child spawns · New

Copilot

Copilot review overview

🔵 Needs a closer look

A critical Windows SID-attribute issue remains unresolved, and the platform-wide process-launching changes require human review.

Review effort: Lite
Findings: 1

Open (1)

Use deny-only SID attributes when disabling SIDs · New

Resolved since last review (1)

Global standard-fd placeholders are racy across threads and child spawns

Copilot

Copilot review overview

🔵 Needs a closer look

Six unresolved moderate findings affect benchmark validity, backend consistency, fixture assertions, sandbox coverage, and prepared-startup diagnostics.

Review effort: Lite
Findings: None

Resolved since last review (1)

Use deny-only SID attributes when disabling SIDs

Review effort: Lite
Findings: 1

Open (1)

Initial exec drops loader-required environment variables · New

Copilot

Copilot review overview

🔵 Needs a closer look

A moderate validation issue remains, and the broad process-launching scope warrants final human review.

Review effort: Lite
Findings: None

Resolved since last review (1)

Initial exec drops loader-required environment variables

Martin Taillefer (geeknoid)

Static-only five-pass review completed. I found one Windows correctness defect and four test/measurement gaps; details are in the inline comments.

Claims I specifically attacked and did not break: bounded/canonical protobuf plus SCM_RIGHTS validation; specialization acknowledgement before Started; pidfd-backed signalling and failure cleanup; fail-closed privilege/seccomp/Landlock/cgroup policy application; worker/shutdown lock ordering; prepared-mode panic/FFI containment; and the raw-pointer/arena/ABI invariants across the unsafe runtime. I found no confirmed UB or exploitability chain meeting the security bar.

I assessed all 820 taxonomy classes (150 security, 162 correctness, 182 testing, 183 performance, 143 conformance), read and deduplicated 158 prior inline comments, and did not repeat optimization work already recorded in the PR’s TODO. Generated READMEs were excluded per repository policy.

Nothing was executed: no project code, tests, benchmarks, profiles, Miri, coverage, mutation, fuzzing, or live probes.

Copilot

Copilot review overview

🟡 Changes recommended

Unresolved critical and moderate issues affect memory safety, child lifecycle handling, worker capacity, configuration validity, and fail-closed sandboxing.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2 · 2

Open (4)

Propagate terminal worker disconnect errors · New
Avoid offset_from on null empty cursor pointers · New
Continue worker selection after pre-dispatch WouldBlock · New
Prevent min_idle from exceeding refill_threshold · New

Copilot

Copilot review overview

🟡 Changes recommended

Critical Windows sandbox and handle-inheritance issues, plus two moderate correctness issues, remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2

Open (2)

Explicit token policy can weaken portable privilege reduction · New
Empty handle list allows unintended handle inheritance · New

Resolved since last review (4)

Avoid offset_from on null empty cursor pointers
Propagate terminal worker disconnect errors
Prevent min_idle from exceeding refill_threshold
Continue worker selection after pre-dispatch WouldBlock

Copilot

Copilot review overview

🟡 Changes recommended

Critical CI runner exposure and worker-bound issues remain, along with additional moderate correctness and packaging issues.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2

Open (2)

Untrusted PRs can execute code on the persistent self-hosted runner · New
Unbounded worker count can exhaust memory and process limits · New

Resolved since last review (2)

Empty handle list allows unintended handle inheritance
Explicit token policy can weaken portable privilege reduction

Copilot

Copilot review overview

🔵 Needs a closer look

Five unresolved moderate findings affect benchmark correctness, health reporting, sandbox acknowledgement, and sensitive-data cleanup.

Review effort: Lite
Findings: None

Resolved since last review (2)

Unbounded worker count can exhaust memory and process limits
Untrusted PRs can execute code on the persistent self-hosted runner

Copilot

Copilot review overview

🔵 Needs a closer look

Two moderate unresolved runtime issues must be addressed before approval.

Review effort: Lite
Findings: None

Copilot

Copilot review overview

🔵 Needs a closer look

Critical sandbox startup and protocol-validation issues remain unresolved, alongside cross-platform health-accounting gaps.

Review effort: Lite
Findings: 2 · 1

Open (3)

Started event precedes seccomp installation · New
Validator permits out-of-bounds forward jumps · New
Native backends fail to track active child counts · New

Copilot

Copilot review overview

🟡 Changes recommended

Unresolved critical runtime packet handling and moderate arena-clearing, worker-health/counting, and benchmark-platform issues require fixes.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

Accept pool-state packets in the pre-runtime decoder · New

Resolved since last review (3)

Validator permits out-of-bounds forward jumps
Started event precedes seccomp installation
Native backends fail to track active child counts

Copilot

Copilot review overview

🟡 Changes recommended

Critical sandbox validation and reusable-memory wiping issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2 · 1

Open (3)

Validate sandbox capability descriptors against requested features · New
Wipe all reusable buffer and arena storage between launches · New
Add coverage exclusion to the new test module · New

Resolved since last review (1)

Accept pool-state packets in the pre-runtime decoder

Copilot

Copilot review overview

🟡 Changes recommended

Unresolved critical descriptor-inheritance and moderate sandbox-probing findings block approval.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

Seccomp policy can leave internal fd 3 open · New

Resolved since last review (3)

Wipe all reusable buffer and arena storage between launches
Validate sandbox capability descriptors against requested features
Add coverage exclusion to the new test module

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 16921781-b55f-423e-9ac1-851b2cba7ac2

Copilot

Copilot review overview

🟡 Changes recommended

Unresolved moderate issues affect benchmark failure handling, launch accounting, Linux shutdown recovery, sandbox capability reporting, and closed-stdio handling.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

Policy support check lacks actual capability probing · New

Resolved since last review (1)

Seccomp policy can leave internal fd 3 open

+        #[cfg(any(target_os = "linux", windows))]
+        {
+            Ok(())


Copilot AI lite review requested due to automatic review settings September 21, 2026 03:55

Copilot started reviewing on behalf of Martin Taillefer (geeknoid) September 21, 2026 03:55 View session

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Comment thread crates/zygote_rt/src/native.rs Outdated

Comment thread crates/zygote_rt/src/native.rs Outdated

Martin Taillefer (geeknoid) force-pushed the fork-server branch from c62f4eb to ff18816 Compare September 21, 2026 04:16

Copilot AI review requested due to automatic review settings September 21, 2026 04:16

Copilot started reviewing on behalf of Martin Taillefer (geeknoid) September 21, 2026 04:17 View session

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Comment thread crates/zygote_control/test-fixtures/targets/Cargo.toml Outdated

Comment thread crates/zygote_control/src/zygote.rs

Copilot AI review requested due to automatic review settings September 21, 2026 04:30

Martin Taillefer (geeknoid) force-pushed the fork-server branch from ff18816 to 34a2653 Compare September 21, 2026 04:30

Copilot started reviewing on behalf of Martin Taillefer (geeknoid) September 21, 2026 04:31 View session

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Comment thread crates/zygote_rt/src/native.rs

Copilot AI review requested due to automatic review settings September 21, 2026 04:39

Martin Taillefer (geeknoid) force-pushed the fork-server branch from 34a2653 to a4615d3 Compare September 21, 2026 04:39

Copilot started reviewing on behalf of Martin Taillefer (geeknoid) September 21, 2026 04:39 View session

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Comment thread crates/zygote_control/src/linux.rs

Comment thread crates/zygote_rt/src/native.rs Outdated

Copilot AI review requested due to automatic review settings September 21, 2026 04:48

Martin Taillefer (geeknoid) force-pushed the fork-server branch from a4615d3 to 1b97067 Compare September 21, 2026 04:48

Copilot started reviewing on behalf of Martin Taillefer (geeknoid) September 21, 2026 04:48 View session

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 21, 2026 04:56

Martin Taillefer (geeknoid) force-pushed the fork-server branch from 1b97067 to 8fbf7af Compare September 21, 2026 04:56

Copilot started reviewing on behalf of Martin Taillefer (geeknoid) September 21, 2026 04:56 View session

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Comment thread crates/zygote_control/src/child.rs Outdated

Comment thread crates/zygote_control/src/linux.rs Outdated

Copilot AI review requested due to automatic review settings September 21, 2026 05:02

Martin Taillefer (geeknoid) force-pushed the fork-server branch from 8fbf7af to 4a3b201 Compare September 21, 2026 05:02

Copilot started reviewing on behalf of Martin Taillefer (geeknoid) September 21, 2026 05:03 View session

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Comment thread crates/zygote_rt/src/prepared.rs

Comment thread crates/zygote_benchmarks/benches/support/mod.rs

Copilot AI review requested due to automatic review settings September 21, 2026 05:12

Martin Taillefer (geeknoid) force-pushed the fork-server branch from 4a3b201 to e45f0ef Compare September 21, 2026 05:12

Copilot started reviewing on behalf of Martin Taillefer (geeknoid) September 21, 2026 05:12 View session

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Comment thread crates/zygote_rt/src/build.rs

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Comment thread crates/zygote_control/src/linux.rs

Comment thread crates/zygote_rt/src/zygote.proto

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Comment thread crates/zygote_control/src/lib.rs Outdated

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Comment thread crates/zygote_control/src/linux.rs Outdated

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Comment thread crates/zygote_control/src/windows.rs Outdated

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Comment thread crates/zygote_control/src/linux.rs

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Copilot AI reviewed Sep 22, 2026

View reviewed changes

Martin Taillefer (geeknoid) commented Sep 24, 2026

View reviewed changes

Copilot AI reviewed Sep 24, 2026

View reviewed changes

Comment thread crates/zygote_control/src/linux.rs Outdated

Comment thread crates/zygote_rt/src/native.rs

Comment thread crates/zygote_control/src/linux.rs

Comment thread crates/zygote_control/src/zygote.rs Outdated

Copilot AI reviewed Sep 24, 2026

View reviewed changes

Comment thread crates/zygote_control/src/windows.rs Outdated

Comment thread crates/zygote_control/src/windows.rs

Copilot AI reviewed Sep 24, 2026

View reviewed changes

Comment thread .github/workflows/repository-checks.yml

Comment thread crates/zygote_control/src/zygote.rs

Copilot AI reviewed Sep 24, 2026

View reviewed changes

Comment thread crates/zygote_rt/src/native.rs Outdated

Comment thread crates/zygote_rt/src/protocol.rs

Comment thread crates/zygote_control/src/command.rs

Copilot AI reviewed Sep 25, 2026

View reviewed changes

Comment thread crates/zygote_rt/src/native.rs Outdated

Copilot AI reviewed Sep 25, 2026

View reviewed changes

Comment thread crates/zygote_rt/src/native.rs

Comment thread crates/zygote_rt/src/native.rs Outdated

Comment thread crates/zygote_control/src/zygote.rs

Copilot AI reviewed Sep 25, 2026

View reviewed changes

Comment thread crates/zygote_rt/src/native.rs Outdated

Introduce the zygote_control and zygote_rt crates

aa5048f

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 16921781-b55f-423e-9ac1-851b2cba7ac2

Copilot AI reviewed Sep 25, 2026

View reviewed changes

Comment thread crates/zygote_control/src/sandbox.rs

Comment on lines +68 to +70

#[cfg(any(target_os = "linux", windows))]

{

Ok(())

Conversation

Martin Taillefer (geeknoid) commented Sep 21, 2026

Summary

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!