[Enrique Saurez (esaurez)]

Part of #1097. Stacked on #1269.

What and why

SL2.3b adds the network and cold-boot settings to the caller-owned VM
configuration:

• net::Ipv4Cidr checks a static IPv4 guest address, with a /1 through
  /30 prefix, excluding the network, broadcast and gateway addresses.
  Construction, parsing, display and string serde share the existing
  address rules; is_valid_guest_network and guest_gateway keep their
  behavior.
• VmConfig gains optional network and boot fields.
  NetworkConfig holds the existing policy and an optional checked
  address; NicConfig records the settled address. An omitted address
  remains unset: a cold boot uses the default and a restore the snapshot.
  Boot holds the caller's cold-only command line.
• DEFAULT_GUEST_NETWORK moves into host::config, with the existing
  host::launch path preserved by a re-export.
• VmConfig::check adds no refusals. Boot-versus-restore presence,
  command-line rendering and network-policy lowering remain with their
  consuming APIs.

The stack uses the crate's existing Error/Result/ErrorKind surface;
the retired per-domain-error commit is not an ancestor. This change adds
no error family, crate, protocol version, builder or validation framework.
The existing network primitives retain their string errors.

Both public-API snapshots add the same 15 named items and remove none:
Ipv4Cidr and its four methods; Boot, NetworkConfig, NicConfig and
their fields; the configuration's default-address constant; and
VmConfig::network and VmConfig::boot. README and crate/module feature
documentation describe the new values and their validation boundaries.

Tests and size

tests-modified: the existing host::config::tests::blockless fixture
adds network: None and boot: None for the new fields. No existing test
assertion is removed or relaxed. The existing guest-network, gateway,
hostname and VM-configuration tests are kept.

Three tests are added:
guest_addresses_keep_their_address_and_prefix_through_every_form,
guest_addresses_refuse_what_openvmm_refuses, and
configurations_pass_with_or_without_a_nic_address_and_a_boot. They cover
construction/parsing/string-serde round trips and refusals, omitted and
explicit addresses, both root forms, and configurations with or without
boot settings.

Measured against the immediate parent: 90 core lines in 3 counted
files, within the estimate of 220 lines in 3 files.

Validation

All commands below passed in complete runs at source
b6cd20c3aa1848ecc9b4db59d1494907ae100d69, on parent
885be7ba1896f5dacb5f2fc7fbf53ecb15f7a847, which contains the pinned
qualification baseline 256ebe3d.

• check-nvx-rs on Windows and Linux: formatting, all warning-denied
  feature builds, full tests and documentation, the real bundling fixture,
  MSRV, both public-API snapshots, macOS cross-check, static musl guest
  tooling and all runtime-adapter configurations. OpenVMM vector and CPU
  profile comparisons passed too.
• Linux check-quality, including native ShellCheck/shfmt, both Python
  platform type checks, links, test layout, kernel configuration, Specula
  and the PowerShell syntax command.
• The complete validate-nvx unittest command: 1,810 cases on each OS,
  with 67 expected skips on Windows and 35 on Linux. Windows used native
  CPython 3.14.9 and Git's POSIX shell; the canceled-capture shell check ran.
  Linux ran the whole unittest command under its original UID in private
  PID/mount namespaces, with Bash as PID1. The complete adversarial module
  ran 84 cases on each OS and passed (11 expected Windows skips), the host
  resolver passed four, and every help check passed.
• WHP and MSHV: all 11 covering scenarios, including the four public
  sandbox scenarios; six Ubuntu scenarios; and all 156 canonical adapter
  scenarios across 11 targets. Alpine/Ubuntu initramfses and the Ubuntu
  layer were rebuilt natively from this source's validated guest binaries.
  Reused kernel/OpenVMM/scratch inputs were hash-verified before and after;
  no released guest image or CLI stood in for the changed source.
• Independent read-only review found no in-scope issue at this exact head.

An initial Windows adversarial run missed a fixture PID file within its
unchanged one-second startup deadline. The complete 84-case native-Python
replay passed; no test, assertion or timeout was changed. That full replay,
not a focused diagnostic, supplies the command's result.

KVM execution and native macOS execution were unavailable locally. This
mid-group qualification does not claim the group-final Azure Linux matrix.

[github-actions]

This pull request changes existing tests

It modifies or removes 1 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified helper	fn blockless in host::config::tests	nvx-rs/src/host/config/tests.rs:18	nvx-rs/src/host/config/tests.rs:19

Relocated unchanged: 0; added: 3. Compared the merge base 6d6ddf7f4b56 with d9cf939b1d52.

[Copilot]

🟢 Approval recommended

The network and cold-boot configuration changes have no active review issues.

No open issues 🎉

What changed in this PR

Extends the unified VM configuration introduced in #1269 with network and cold-boot settings, completing SL2.3b of #1097.

Changes:

• Adds Ipv4Cidr, a validated guest IPv4 address with parsing, display, and optional serde support.
• Adds network and boot configuration types and fields, while preserving the existing launch path for DEFAULT_GUEST_NETWORK.
• Adds tests and updates documentation and both platform API snapshots.

File	Description
nvx-rs/​src/​net/​tests.rs	Tests guest address validation, round trips, and serialization.
nvx-rs/​src/​net/​mod.rs	Adds Ipv4Cidr and uses it in guest network helpers.
nvx-rs/​src/​host/​mod.rs	Documents network and cold-boot configuration.
nvx-rs/​src/​host/​launch.rs	Re-exports the relocated default guest address.
nvx-rs/​src/​host/​config/​tests.rs	Covers optional network addresses and boot settings.
nvx-rs/​src/​host/​config/​mod.rs	Adds network, NIC, and boot types to VM configuration.
nvx-rs/​README.md	Describes the new types and validation boundaries.
nvx-rs/​public-api/​windows.txt	Records the new public API for Windows.
nvx-rs/​public-api/​linux.txt	Records the new public API for Linux.
nvx-rs/​Cargo.toml	Updates the serde feature comment to include Ipv4Cidr.

_{Review effort: Balanced}

[Enrique Saurez (esaurez)]

Scope update following the revised #1076/#1097 contract: the stack must no longer include the retired per-domain-error PR #1267.

Keep SL2.3b's checked IPv4 address, optional guest address, network configuration and cold-only boot settings. Rebase this logical slice with the adapted #1268/#1269 stack, using the crate's existing error surface rather than adding domain-error families. No new validation framework, lowering algorithm or contract-version change is requested.

Preserve the original tests and evidence; changed inputs and error expectations require affected qualification before current-design readiness. No Ready transition or manual CI dispatch is included.

[Enrique Saurez (esaurez)]

Updated in b6cd20c on the revised
#1268/#1269 stack, without the retired #1267 commit. Configuration checks
retain the crate's existing Error/Result/ErrorKind surface; the checked
network primitive follows the existing string-error convention. No new
error family, validation framework, lowering change or contract-version
change was added.

The original assertions are preserved, and the changed fixture is
explained in the PR body. Complete source checks, fresh native guests and
the required WHP/MSHV suites were run at this exact source head; the
Validation section replaces the historical-head evidence.

[Copilot]

🟢 Approval recommended

No active review issues remain for the VM configuration changes adding network and cold-boot settings.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the VM network and cold-boot configuration additions.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues block the network and cold-boot configuration additions.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues block the network and cold-boot configuration additions.

No open issues 🎉

_{Review effort: Balanced}