[starcatmeow]

Windows connectivity needs a real guest test: this adds one fixed win1 <-> linux <-> win2 topology and runs three consecutive ping replies in both directions between the Windows nodes, plus both directions between win1 and Linux.

Run locally with:

e2e/windows/run.sh /absolute/path/to/windows.qcow2

The standalone Python/WinRM test uses QEMU/KVM, Ubuntu's fixed OVMF paths, two fresh qcow2 overlays, and a Linux Docker container. It builds Nylon, installs Wintun, disables guest firewalls, starts Nylon as SYSTEM, saves logs, and cleans up the guests and network. The existing Linux e2e harness and Go dependencies are unchanged.

Keep the Windows IPv4 alias at /32 and preserve selected route prefixes individually on Windows. Reverting these fixes reproduced a win2-to-win1 timeout; Linux and macOS retain route aggregation, and explicitly advertised subnets remain intact.

CI builds github:starcatmeow/nylon-ci-windows-image/main#nylon-ci-win2025, decompresses the qcow2, and passes its path through a step output to the same script. Nix reads the public R2 cache at https://pub-b7e688bb852e422d84f49c2dce8e3461.r2.dev and verifies signatures with nylon-cache-1:B87/nHkgelYp2qg2AsYQ+Hmsg99ErIbbvkFCfS7u2WI=. Cache misses build locally, and download failures explicitly enable fallback. CI does not read R2 secrets or upload cache contents; the signed final image output can be published separately.

Validation:

• Built the external flake using the CI command; it reused an existing local Nix output. Decompressed that output and confirmed its Nix references are empty.
• Ran the standalone Windows test against this qcow2: all four ping directions passed (123.868s).
• Existing Linux TestConnectivity passed.
• go test -race -tags=router_test ./core passed.
• Python/YAML parsing, shell syntax and actionlint passed; actionlint ignored pre-existing setup-go@v4 warnings in unchanged jobs.
• The public endpoint is not yet recognized as a Nix binary cache; a small build with the configured public cache and fallback completed locally.
• No Windows QEMU processes, overlays, container or network remained.

GitHub-hosted execution was not exercised locally. The previous generic machine/preflight framework has been removed; the final diff against main is 7 files, +312/-7.