[Enrique Saurez (esaurez)]

Closes #1097. Stacked on #1270.

What and why

SL2.3c: a capture is one value, which names its snapshots.

Boot::capture holds a CaptureConfig: fresh disk geometries, processor and
memory boot values and capacities, and opaque invariants. DiskCapture is
non-exhaustive; its supported variant is Fresh { image, scratch }.

CaptureConfig::check performs value-only checks, without host I/O. Processor
boot values and capacities must be 1, 2, 4 or 8, with boot no greater than
capacity. Memory at boot must be nonzero; its capacity must cover it and be
aligned to 128 MiB. Disk geometries and invariants retain their existing checks.
Refusals use the crate's single Error/Result contract and Unsupported.
VmConfig::check also checks its boot's capture and preserves its error.

CaptureConfig::identity returns a CaptureIdentity, displayed and serialized
as 64 lowercase hexadecimal digits. Its domain-separated, length-prefixed
SHA-256 encoding includes runtime identity and contract versions, hypervisor
and requested CPU profile, capture geometries, processor and memory capacities,
invariants, effective NIC address, console, export presence and boot command
line. An omitted NIC address equals the explicit default.

Identity excludes paths, launch options, view and network policy, the VM's
separate processor and memory settings, and every root setting. Computing it
reads nothing on the host and does not create, validate or store a snapshot.

Invariants and BlockGeometry move into host::config, together with the
existing invariant, geometry and processor checks. Existing template paths
remain available through re-exports. Both public API snapshots and the host
documentation describe the new configuration values.

Size

283 core lines in 4 counted files, within the 500-line cap. The change is one
logical commit; it retains both the root-independent identity and the boot
capture check.

Tests

The change carries tests-modified. Existing test changes are:

• configurations_pass_with_or_without_a_nic_address_and_a_boot adds
  capture: None to its two Boot values; its assertions are unchanged.
• manifests_of_invalid_machines_are_refused moves three geometry cases
  (logical block size 256, physical block size 256, and length 1000) to the
  direct configuration test block_geometries_hold_whole_blocks_of_power_of_two_sizes,
  retaining their expected messages.
• invariant_settings_have_one_form moves unchanged with Invariants.

The test-change checker reports eleven added tests. Focused configuration
coverage includes supported and refused capacities and geometries, invariant
limits, checking a boot's capture through VmConfig::check, identity text and
serialization, every identifying input, omitted versus explicit default NIC,
and exclusion of all launch, clone and root settings.

Validation

At 240dfc814c3840cae379db7b1ca85f2710a2eaad, the complete applicable commands
from check-nvx-rs and validate-nvx passed on Windows and Linux, and
check-quality passed on Linux. The full CLI unit commands ran 1810 tests on
each platform, with the expected platform skips (67 on Windows, 30 on Linux).
The focused configuration tests passed 13 of 13.

On both WHP and MSHV, the complete default Alpine suite passed all 50 selected
scenarios (56 execution records across 1, 2, 4 and 8 processors), the required
Ubuntu and Azure Linux sets passed 6 and 7 scenarios, and the complete canonical
runtime-adapter suite passed 156 scenarios in 11 targets, with no failed or
ignored scenarios. The canonical VM drivers used the actual hash-verified test
runners built at this head; their inventory and selectors were unchanged.

[github-actions]

This pull request changes existing tests

It modifies or removes 2 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified test	fn configurations_pass_with_or_without_a_nic_address_and_a_boot in host::config::tests	nvx-rs/src/host/config/tests.rs:112	nvx-rs/src/host/config/tests.rs:116
modified test	fn manifests_of_invalid_machines_are_refused in host::template::manifest::tests	nvx-rs/src/host/template/manifest/tests.rs:590	nvx-rs/src/host/template/manifest/tests.rs:590

Relocated unchanged: 1; added: 11. Compared the merge base 8ed1f53e3452 with b5c0eb98ac1b.

[Copilot]

🟢 Approval recommended

No active review issues block the capture-configuration API and shared-type changes.

No open issues 🎉

What changed in this PR

This PR advances #1097 by adding a caller-owned CaptureConfig to NVX’s VM configuration API. It validates capture settings without host access and derives a stable identity for naming snapshots.

Changes:

• Adds capture configuration, resource capacities, disk geometry checks, and SHA-256 capture identities.
• Moves shared invariant and geometry types into host::config, preserving existing template exports.
• Adds validation and identity tests, updates documentation, and records the new public API on both platforms.

File	Description
nvx-rs/​src/​host/​template/​manifest/​tests.rs	Relocates geometry validation cases to configuration tests.
nvx-rs/​src/​host/​template/​manifest.rs	Uses shared processor counts and relocated geometry validation.
nvx-rs/​src/​host/​template/​key/​tests.rs	Moves invariant-setting tests to their new owning module.
nvx-rs/​src/​host/​template/​key.rs	Re-exports invariants while retaining their canonical encoding.
nvx-rs/​src/​host/​sandbox/​geometry.rs	Re-exports the relocated block geometry type.
nvx-rs/​src/​host/​mod.rs	Documents capture configuration and snapshot identities.
nvx-rs/​src/​host/​config/​tests.rs	Tests capture validation, identity inputs, serialization, and exclusions.
nvx-rs/​src/​host/​config/​mod.rs	Implements capture configuration, validation, identities, and shared types.
nvx-rs/​README.md	Explains the capture API and identity contract.
nvx-rs/​public-api/​windows.txt	Records the added Windows public API items.
nvx-rs/​public-api/​linux.txt	Records the added Linux public API items.

_{Review effort: Balanced}

[Enrique Saurez (esaurez)]

Scope update following the revised #1076/#1097 contract: new host APIs return the crate's Result, not the per-domain types from retired PR #1267.

CaptureConfig::check refusals are ErrorKind::Unsupported. Preserve the live capture-identity contract, supported fresh-capture fields and exclusions, moved validation cases and pure operation. Do not add a replacement error facade or broaden the capture API.

Adapt this PR with the updated #1270 stack and remove the obsolete error ancestor. Earlier validation keeps its recorded-head labels; revised code/input and error-kind changes need affected checks and reviews before current-design readiness. No Ready transition or manual CI dispatch is included.

[Copilot]

🟢 Approval recommended

The capture-configuration changes have no active review issues blocking approval.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are reported for the capture-configuration and snapshot-identity changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The capture configuration and deterministic snapshot identity changes have no active review issues.

No open issues 🎉

_{Review effort: Balanced}