test(conformance): verify Snap status in Ubuntu VM

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

.github/workflows/conformance.yml

@@ -281,3 +281,56 @@ jobs:
             --copy "$guest_script:/tmp/conformance.sh" \
             --copy conformance-input/openshell-conformance:/tmp/openshell-conformance \
             -- bash /tmp/conformance.sh
+
+  ubuntu-snap:
+    name: Ubuntu Snap with Docker Snap (${{ needs.target.outputs.arch }})
+    needs: [build-snap, target]
+    runs-on: ${{ needs.target.outputs.test_runner }}
+    timeout-minutes: 45
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Enable KVM access
+        run: |
+          set -euo pipefail
+          if [[ ! -c /dev/kvm ]]; then
+            echo "::error::The runner did not expose /dev/kvm"
+            exit 1
+          fi
+          sudo chmod 0666 /dev/kvm
+          exec 3<>/dev/kvm
+          exec 3>&-
+
+      - uses: ./.github/actions/setup-nix
+
+      - name: Download Snap artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: snap-linux-${{ needs.target.outputs.arch }}
+          path: snap-input
+
+      - name: Install Snap and verify gateway status
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          snaps=(snap-input/*.snap)
+          if [[ ${#snaps[@]} -ne 1 ]]; then
+            echo "expected one Snap artifact" >&2
+            printf 'Snap artifacts:\n' >&2
+            printf '  %s\n' snap-input/* >&2
+            exit 1
+          fi
+
+          OPENSHELL_TEST_GUEST_CACHE_DISABLE=1 nix run .#test-guest -- \
+            --distro ubuntu-24-04 \
+            --with snapd \
+            --with docker-snap \
+            --copy "${snaps[0]}:/var/lib/openshell-conformance/candidate/openshell.snap" \
+            --provision openshell-snap \
+            -- true

architecture/build.md

@@ -253,8 +253,14 @@ its compatibility metadata as a custom OCI artifact. Normal test runs ensure
 the exact local entry exists, invoking the cache builder automatically on a
 miss before booting a disposable overlay. The separate cache app owns OCI
 pulls and explicit publication. OCI pulls require a trusted manifest digest
-and retain that provenance with the local entry; mutable tags are used only
-for explicit publication.
+  and retain that provenance with the local entry; mutable tags are used only
+  for explicit publication.
+
+The conformance workflow also builds a branch Snap for an Ubuntu QEMU guest.
+The guest installs snapd and Docker Snap, installs the unsigned candidate,
+connects its required interfaces, registers the local gateway, and verifies
+`openshell status`. Sandbox smoke conformance remains separate from this
+package-installation check.
 
 ## Python Wheel Packaging