nvx-rs slimming 1.2.1: the guest helper binaries ship from nvx-guest-tools #1095

Parent: #1078, in #1076. Needs: #1092, #1093, #1094. Unblocks: #1096, #1120, #1131, #1132.

Goal. NVX's guest helper programs move, with their modules, into nvx-guest-tools: nvx-time-probe; nvx-console-pending, nvx-mmio-write, nvx-exit, nvx-device-io and nvx-reseed; nvx-ingress; and nvx-time. nvx keeps the library parts: Seed, reseed and ReseedError, for the capture's repair and the time ABI; guest::time's public facade, TimeAbi and its types, whose start_daemon forks the time daemon; and the announcer's Announcer, PROGRAM and StartError, until #1120 gives nvx-ingress start a spawner of its own; activation stops starting the announcer earlier, in #1105.

Notes.

• SL1.1a makes the guest build workspace-aware. guest_binaries.py builds, checks and tests the guest binaries across the workspace, each in the crate that owns it, so the later moves don't edit it.
• nvx-guest-tools is published after nvx. Its first version is published by hand.

PRs, in order. Each PR has one goal, leaves dev green, and names in its description each old test of its area as kept, rewritten or retired, with each change that check_test_changes.py reports. Its tests follow the repository's test layout: a module's unit tests, and the code that only they use, sit in its tests.rs or tests/ and move with it. The estimates count core lines (code, not comments, docs or tests) and counted files; each PR records its measured values. Each PR does what its Scope says and no more: a case, input or layout that its Scope doesn't name, and whatever "Not in this PR" lists, is out of scope. Address every review comment within the scope, and ask before acting on one that asks for more. A PR whose measured core lines pass the stop that its Estimate names (twice the estimate, at most 600) stops and asks before continuing.

1. SL1.1a: nvx-time-probe ships from nvx-guest-tools.

   • Objective: nvx-time-probe becomes the first guest binary owned by nvx-guest-tools. The guest build must consequently build, check, test, identify and stage binaries from whichever workspace crate owns each program, without changing the probe's behavior.
   • Contents: git mv of guest::time_probe (1.9K core lines) and its binary. guest_binaries.py, which ran Cargo in the nvx-rs member only, builds, checks and tests the guest binaries across the workspace, each in the crate that owns it, its test cases included, so the later moves don't edit it; the initramfs build takes the binary from the new crate. The publishing list adds nvx-guest-tools after nvx, its first version by hand.
   • Scope:
     • Move nvx-rs/src/guest/time_probe/ and nvx-rs/src/bin/nvx-time-probe.rs into crates/nvx-guest-tools, with time_probe/tests.rs, each submodule's tests.rs and the time_probe_* program cases; the unit tests use command_line through nvx-sys's test-support feature.
     • Make scripts/nvx_tools/guest_binaries.py run Cargo across the workspace and select each staged guest binary from its owning package.
     • Update the guest source inventory and initramfs staging so nvx-time-probe comes from nvx-guest-tools while the other guest binaries still come from nvx.
     • Add nvx-guest-tools after nvx in the publishing order; its first version is published manually.
   • Not in this PR:
     • Changes to nvx-time-probe options, diagnostics, output, exit statuses or probe algorithms: this PR only moves the program.
     • Renaming or reorganizing the probe modules, or cleaning up their implementation while moving them.
     • Moving any other guest binary: later PRs in nvx-rs slimming 1.2.1: the guest helper binaries ship from nvx-guest-tools #1095 and nvx-rs slimming 1.2.2: the managed agent lives in nvx-init #1096 do that.
     • A package-discovery framework for arbitrary binaries: the repository has a fixed guest-binary list and known owning crates.
   • Approach: Use git mv for the probe and its tests, then adapt the existing fixed guest-binary build flow to issue workspace Cargo commands and find each named artifact in its owning package. Keep one inventory and one staging path; do not introduce a new build abstraction or infer packages by parsing manifests.
   • Done when:
     • The moved time_probe_* cases still check the same command lines, exit statuses, output and probe results from nvx-guest-tools.
     • Guest checks and tests run across the workspace and find the probe's unit and integration tests in its owning crate.
     • The initramfs build stages nvx-time-probe from nvx-guest-tools, and a guest image boots with the staged binary.
     • The publishing list places nvx-guest-tools after nvx.
   • Needs: SL0.3b, in nvx-rs slimming 1.1.3: the guest's and the host's OS layers live in nvx-sys #1093; SL0.2b, in nvx-rs slimming 1.1.2: one Cargo workspace, and the new crates' empty shells #1092.
   • Estimate: 100 core lines, 6 counted files. Past 200 core lines, stop and ask before continuing.

2. SL1.1b: The small guest tools ship from nvx-guest-tools.

   • Objective: The small standalone guest programs ship from nvx-guest-tools instead of the nvx library crate. The reusable reseed API remains in nvx for capture repair and the time ABI.
   • Contents: git mv of nvx-console-pending, nvx-mmio-write, nvx-exit and nvx-device-io with their modules, and of nvx-reseed's main, once reseed's library part is factored from it. Seed, reseed and ReseedError stay, for the capture's repair and the time ABI. The crate's binaries are found under src/bin/, so its manifest declares none.
   • Scope:
     • Move console_pending, mmio_write, exit and device_io, their binary entry points, adjacent tests.rs files and program cases into crates/nvx-guest-tools; the moved tests use command_line, Failing and create_fifo through nvx-sys's test-support feature.
     • Factor nvx-reseed's binary entry point from guest::reseed, then move only that entry point and its program tests to nvx-guest-tools.
     • Keep Seed, reseed and ReseedError, and keep their cases in nvx-rs/src/guest/reseed/tests.rs after moving the binary cases.
     • Place the moved entry points under nvx-guest-tools/src/bin/; its manifest does not enumerate the binaries.
   • Not in this PR:
     • Changes to command lines, output, exit statuses or device behavior: these are code moves plus the reseed split they require.
     • Renaming binaries, modules, public reseed items or test cases.
     • Redesigning the reseed API or moving its library implementation: nvx callers still need it.
     • General cleanup, shared utility extraction or consolidation among the small programs.
   • Approach: Use git mv for each complete program and its tests. Make the narrowest split in reseed.rs that leaves the reusable API in nvx and moves the existing main; rely on Cargo's src/bin/ discovery rather than adding manifest entries or a binary-registration layer.
   • Done when:
     • The console_pending_*, mmio_write_*, reseed_*, exit_* and device_io_* program cases run from nvx-guest-tools with their existing command-line, status and output assertions.
     • The unit tests of the moved programs move with them, while the tests of Seed, reseed and ReseedError remain in nvx.
     • The guest build stages all five moved binaries from nvx-guest-tools, and the guest image boots with them.
   • Needs: SL1.1a, above.
   • Estimate: 150 core lines, 5 counted files. Past 300 core lines, stop and ask before continuing.

3. SL1.2: nvx-ingress ships from nvx-guest-tools.

   • Objective: nvx-ingress, including its restored-guest start GATEWAY mode, ships from nvx-guest-tools. nvx temporarily retains only the announcer spawner that activation still uses.
   • Contents: git mv of the announcer's program: ingress::{main, address, collect, diag, encode, sender, table, test_mode}, with its start GATEWAY mode, which starts and detaches an announcer for a restored guest, and its tests. Announcer, PROGRAM and StartError stay in nvx, and start uses them, until SL6.13c gives nvx-ingress its own spawner, because activation starts the announcer until SL7.3. The privileged-port search (bind_privileged), which both use, splits into two crate-local copies: Announcer keeps one in nvx until SL6.13c deletes it with guest::ingress, and the program takes the other, which SL6.13c reuses.
   • Scope:
     • Move the ingress program modules main, address, collect, diag, encode, sender, table and test_mode, its binary entry point and its program tests into crates/nvx-guest-tools.
     • Keep Announcer, PROGRAM and StartError in nvx-rs/src/guest/ingress, and keep start GATEWAY calling them until SL6.13c.
     • Copy the existing privileged-port search into each crate locally: one copy serves Announcer, and one serves the moved program.
     • Preserve the five ingress integration cases; move ingress/tests.rs and the program modules' adjacent tests.rs files, while announcer/tests.rs stays in nvx. The diagnostics tests use nvx-sys's test-support feature, and the NVXL fixture and needed reader support move into crate-local tests.
   • Not in this PR:
     • Changes to ingress commands, snapshots, announcements, socket inheritance, diagnostics or exit statuses: this PR moves existing behavior.
     • Renaming or redesigning the ingress modules or their wire and table formats.
     • A shared crate or abstraction for the small privileged-port search: only two temporary crate-local users need it.
     • Giving nvx-ingress start its own spawner or deleting Announcer; SL6.13c does both after activation stops using it.
   • Approach: Use git mv for the program side and its tests. Leave the spawner types at their current public names in nvx, and duplicate only bind_privileged across the crate boundary; do not create a utility crate, redesign spawning or mix the later announcer removal into this move.
   • Done when:
     • The five moved ingress_* program cases still check test mode, UDP settling, invalid invocations, socket inheritance and start failure from nvx-guest-tools.
     • The program modules' unit tests move, while tests of Announcer, PROGRAM and StartError remain in nvx.
     • The guest build stages nvx-ingress from nvx-guest-tools, and its command line, output and exit statuses are unchanged.
   • Needs: SL1.1a, above.
   • Estimate: 150 core lines, 4 counted files. Past 300 core lines, stop and ask before continuing.

4. SL1.3: nvx-time ships from nvx-guest-tools.

   • Objective: nvx-time ships from nvx-guest-tools while nvx retains the TimeAbi facade that starts and signals the daemon. The moved front end keeps the host-clock correction and restored network settings already supported on dev.
   • Contents: git mv of time::{main, commands, test_mode}, on nvx-sys's time implementation. TimeAbi stays in nvx: TimeAbi::start_daemon forks the daemon, and a restore signals it. commands and test_mode carry the host-clock correction and the restore's network settings that dev added.
   • Scope:
     • Move guest::time::{main, commands, test_mode}, the nvx-time binary, time/tests.rs, commands/tests.rs, test_mode/tests.rs and the program cases into crates/nvx-guest-tools; the main tests use command_line through nvx-sys's test-support feature.
     • Build the moved program on the time implementation already owned by nvx-sys.
     • Keep TimeAbi and TimeAbi::start_daemon in nvx; the facade continues to fork the daemon, and restore continues to signal it.
     • Carry the existing host-clock correction and version-6 restore network settings with commands and test_mode.
   • Not in this PR:
     • Changes to nvx-time commands, packet formats, arithmetic, logging, output or exit statuses: this PR moves the front end.
     • Moving or redesigning TimeAbi, daemon startup or restore signaling.
     • Further refactoring of the time implementation in nvx-sys; its ownership is established before this PR.
     • Renaming time modules or cleaning up their tests during the move.
   • Approach: Use git mv for the program front end and its tests, point its existing calls at nvx-sys, and leave the nvx facade intact. Do not combine the move with protocol changes, a new daemon interface or a broader time-module reorganization.
   • Done when:
     • The moved time_test_mode_* cases and time_reads_a_plain_capture_request still check the same packets, samples, logs, status, network settings, command line and failures.
     • The commands and test_mode unit tests move to nvx-guest-tools, while the facade and implementation tests remain with their owners.
     • The guest build stages nvx-time from nvx-guest-tools, and the guest image boots with it.
   • Needs: SL0.3e3, in nvx-rs slimming 1.1.4: the time core that nvx and nvx-time share lives in nvx-sys #1094; SL1.1a, above.
   • Estimate: 200 core lines, 5 counted files. Past 400 core lines, stop and ask before continuing.

Tests. SL1.1a moves the time_probe unit tests and the time_probe_* cases of nvx-rs/tests/guest_tools.rs. SL1.1b moves the console_pending_*, mmio_write_*, reseed_*, exit_* and device_io_* program cases, with the programs' unit tests; the tests of Seed, reseed and ReseedError stay in nvx. SL1.2 moves the five ingress_* program cases and the program modules' unit tests; the tests of Announcer, PROGRAM and StartError stay in nvx. SL1.3 moves the time_test_mode_* cases, time_reads_a_plain_capture_request, and the commands and test_mode unit tests; the time facade's tests stay with nvx or its nvx-sys implementation. Each moved case still checks the same command line, exit status and output. The guest build takes each helper binary that this group moves from nvx-guest-tools, while nvx-managed-agent stays in nvx until #1096; the guest image boots with them. After each move, the guest build, its checks and the staged binaries' tests find the programs and their cases in the crates that own them.

Done when: every PR above has merged, with dev green.