Repository navigation
activation: keep only guest-applied settings in record v2 - #1311
Pedro Henrique Penna (ppenna) merged 3 commits into
Conversation
Enrique Saurez (esaurez)
added
tests-modified
There was a problem hiding this comment.
🟡 Changes recommended
An unresolved review finding flags a grammatical error in the comment at nvx-rs/src/activation/tests.rs:12, which should read “without an export or a network.”
1 open issue
What changed in this PR
Implements activation record v2 for #1101, narrowing NVX’s shared host–guest contract to guest-applied settings and the restore transaction. It builds on #1278’s RAM-upper cap support while preserving image identity validation and Ready’s wire format.
Changes:
- Removes store, binding, plan, policy, and execution identities from the record; replaces
WorkloadViewwithViewand rejects v1 records. - Encodes and applies a tmpfs cap of 1–90%, retaining the legacy clone default of 50%.
- Updates host and guest consumers, conformance vectors, tests, documentation, and public API snapshots together.
| File | Description |
|---|---|
tests/runtime-adapter/tests/vm_clone.rs |
Updates VM assertions for identity-free records. |
tests/runtime-adapter/tests/guest_session.rs |
Migrates session fixtures and changed-record retry cases. |
tests/runtime-adapter/tests/clone_start.rs |
Checks the clone’s new View fields. |
tests/runtime-adapter/src/worker/activation/tests.rs |
Updates activation fixtures and retry mutations. |
tests/runtime-adapter/src/worker/activation.rs |
Reads hostname from configuration.view. |
tests/runtime-adapter/src/worker.rs |
Clarifies per-execution identity in comments. |
tests/runtime-adapter/src/clone.rs |
Constructs View without execution credentials. |
tests/runtime-adapter/src/bin/runtime-adapter-host.rs |
Updates comments describing activation contents. |
tests/runtime-adapter/README.md |
Aligns adapter documentation with v2. |
nvx-rs/tests/vectors/README.md |
Links the v2 activation vectors. |
nvx-rs/tests/vectors/activation-v2.txt |
Adds v2 conformance and refusal vectors. |
nvx-rs/tests/vectors/activation-v1.txt |
Removes superseded v1 vectors. |
nvx-rs/src/tests.rs |
Loads the shared v2 fixture. |
nvx-rs/src/host/template/store.rs |
Corrects comments about stored template references. |
nvx-rs/src/host/template/key/tests.rs |
Updates the template-reference explanatory comment. |
nvx-rs/src/host/template/key.rs |
Clarifies key identity usage in documentation. |
nvx-rs/src/host/template/clone/tests/restore.rs |
Uses transaction-only restore fixtures. |
nvx-rs/src/host/template/clone/tests/launch.rs |
Updates persisted activation-record assertions. |
nvx-rs/src/host/template/clone/tests.rs |
Migrates host record expectations to v2. |
nvx-rs/src/host/template/clone/record.rs |
Builds smaller records with the default RAM cap. |
nvx-rs/src/host/template/clone.rs |
Adopts View and the revised record builder. |
nvx-rs/src/host/store/lease.rs |
Corrects template-reference documentation. |
nvx-rs/src/guest/clone/activation/tests.rs |
Updates fixtures and checks v1 rejection. |
nvx-rs/src/guest/clone/activation/apply/tests.rs |
Checks cap propagation and updates application fixtures. |
nvx-rs/src/guest/clone/activation/apply.rs |
Applies the recorded cap and reads View. |
nvx-rs/src/guest/clone.rs |
Documents records without execution identities. |
nvx-rs/src/activation/tests.rs |
Updates schema tests and validates tmpfs caps. |
nvx-rs/src/activation/ready/tests.rs |
Checks unchanged Ready behavior against v2 fixtures. |
nvx-rs/src/activation/mod.rs |
Defines and validates the v2 schema. |
nvx-rs/src/activation/codec/tests/vectors.rs |
Reads and verifies v2 vector values. |
nvx-rs/src/activation/codec/tests.rs |
Updates canonical encoding and refusal coverage. |
nvx-rs/src/activation/codec.rs |
Encodes and decodes the reduced record. |
nvx-rs/README.md |
Documents v2 fields, limits, and consumers. |
nvx-rs/public-api/windows.txt |
Aligns the Windows API snapshot. |
nvx-rs/public-api/linux.txt |
Aligns the Linux API snapshot. |
Review effort: Balanced
|
The PR body's Existing tests section accounts for all 102 existing test-asset changes: 93 named test/helper entries, 8 import groups and the replaced v1 vector file. It names each retained, rewritten or retired check, including the renamed tests; the local complete inventory also covers rows omitted by the bot's display limit. The two retired record-only tests validate store generation and execution credentials, which v2 no longer encodes. The v2 vectors retain explicit v1 refusal, expected EROFS UUID/GPT GUID coverage and bounded-parser checks. Real export isolation, networking, per-execution identity, retry/deadline and cleanup assertions remain. Both WHP and MSHV passed all four public sandbox scenarios and all 156 canonical adapter scenarios across 11 targets at d625c68; no scenario list, selector or timeout was changed. |
1ca29cb to
1fa9408
Compare
|
Rebased this PR's three owned commits onto the published #1278 head The existing description was preserved byte-for-byte; its Validation section
No new native VM/distro matrix or guest-image assembly was run for this simple |
1fa9408 to
fc44f2b
Compare
|
Published the qualified mechanical rebase at The description was preserved byte-for-byte, so its original Validation
Earlier failed attempts and their corrections remain recorded; no assertion, |
Remove store references and host planning identities from the shared record while retaining expected image UUIDs and disk GUIDs. Use View without execution credentials and carry the tmpfs memory cap as a bounded percentage. Keep store identity types for their existing callers. Update producers, application and canonical fixtures together, and reject record version 1. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3532e012-2beb-4ff7-81ab-3795de501985
List the transaction-only restore section, View and bounded tmpfs cap, and remove the fields and types that no activation record carries. Regenerate both platform snapshots from the shared crate. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3532e012-2beb-4ff7-81ab-3795de501985
Describe the fixture as having neither an export nor a network. This only repairs the test helper documentation; executable code and assertions are unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3532e012-2beb-4ff7-81ab-3795de501985
fc44f2b to
02d4219
Compare
|
Rebased onto #1278's landed commit Current validation
The Linux checks include both public-API snapshots, the minimum supported Rust version, the macOS build, ten freshly built and checked guest executables, and the runtime-adapter configurations. Both hosts used newly built, source-verified CLI executables. The optional pinned-kernel-source reader remained skipped because its source tree was not prepared; this is not a passing check.
Other quality checks retain explicitly source-equivalent evidence: their 217 inputs are byte-identical to the previously qualified head, while the affected Markdown/layout checks ran again. This conflict-free carry claims no fresh VM matrix, image-regeneration result, or transfer of old runtime results to the new head. Draft state, title, body bytes, base and labels were preserved. |
bc9ceca
into
feature/nvx-refactor
Part of #1101
Change the shared activation record to version 2, updating its host encoder,
guest decoder/application, record writers and fixtures together. A restore
contains only its transaction; the remaining fields describe the root,
View,export kind and mapping count, network and expected resources. Template/store
references, binding/plan/policy identities and execution credentials are no
longer encoded.
Keep expected EROFS UUIDs/GPT disk GUIDs and their guest validation. Carry the
tmpfs percentage cap (1-90) through the existing RAM-upper implementation from
#1278; legacy clone construction retains its existing 50% default. Keep
TemplateReference,StoreGenerationandactivation::Identityfor theirexisting store callers. Version 1 is refused, without migration or negotiation.
Ready's wire format is unchanged.
This layer builds on #1278. Measured against its exact parent: 67 core lines,
5 counted files. The generated Linux/Windows public API snapshots and directly
stale record documentation are aligned with the new schema.
Validation
check-nvx-rscommands, including genuinebundling, public API, MSRV, feature configurations, guest binaries and runtime
adapter configurations.
validate-nvxcommand inventories: 1,811 Python tests on eachplatform, the complete 84-test adversarial command, host inventory and help
checks. Windows retains its complete same-input unittest pass and the complete
adversarial rerun; the earlier failed compound attempt remains failure history.
check-quality, including both type-check platforms, pinnedshell linters, test layout, Markdown links, kernel inventory, Specula and
normal culture-enabled PowerShell syntax checks.
layer; unchanged pinned OpenVMM/kernel/scratch inputs were hash-verified.
scenarios across 11 targets passed on each backend, with no failed, ignored
or filtered canonical cases. The WHP public command was rerun in full after
restoring a missing host PowerShell PATH prerequisite; no test was changed.
Existing tests
tests-modifiedis required. The inventory reports 102 changes to existing testassets, no unchanged relocations and 3 additions. The changes below remove
assertions about fields that no record contains, not checks of real root,
export, networking, execution, retry, deadline or cleanup behavior.
Rewritten codec fixtures and assertions in
activation::codec::tests:the_fields_keep_their_tags_and_names,a_clone_record_holds_its_restore_section_first,every_part_of_a_configuration_encodes_to_the_bytes_of_its_definition,a_maximal_record_holds_602_bytes_within_the_limit(renamed toa_maximal_record_holds_424_bytes_within_the_limit),every_prefix_of_an_encoding_is_refused,other_versions_are_refused,fields_out_of_order_are_refused,a_dns_server_or_a_proxy_without_a_network_is_refused,values_of_another_length_are_refused,unknown_codes_are_refused,values_that_a_configuration_refuses_are_refused, andrefusals_name_the_rule_that_they_break. They use v2 tags/lengths and retainbounded parsing and refusal coverage. The vector tests
records_match_their_vectorsand
invalid_records_are_refuseduse independently authored v2 expected bytes;the removed
activation-v1.txtis replaced byactivation-v2.txt, includingold-record refusal.
Kept Ready behavior, with only the surrounding record fixture rewritten:
ready_reports_a_clone_s_transaction_and_nothing_more_for_a_cold_boot,ready_activations_match_their_vectors, andinvalid_ready_activations_are_refused.Rewritten schema fixtures in
activation::tests:the_limits_keep_their_values,hostnames_are_admitted_up_to_the_limit_without_a_nul,a_zero_first_partition_bound_is_refused,the_first_broken_limit_is_reported_in_the_order_of_the_fields,errors_name_the_limits_that_they_break, andan_image_reports_its_format_binding_and_expected_identity(renamed toan_image_reports_its_format_and_expected_identity). Expected image identityand partition-bound validation remain.
Rewritten guest fixtures, keeping application/refusal behavior:
assembly_inputs_are_taken_exactly_from_the_record,a_gpt_disk_s_partition_table_is_reread_before_its_root_is_assembled,the_application_checks_no_account_of_the_record_s_workload_identity(renamedto
the_application_leaves_the_images_accounts_to_each_execution),the_application_refuses_without_privileges_what_it_cannot_assemble, andan_activate_is_decoded_and_validated_before_any_side_effect. Assembly nowasserts the explicit RAM cap, and accounts remain an execution concern.
Rewritten host clone fixtures, keeping actual store/launch behavior:
the_activation_record_of_a_clone_in_ram_names_its_restore_image_and_settings,the_activation_record_of_a_clone_on_a_scratch_image_names_its_binding_and_journal(renamed to
the_activation_record_of_a_clone_on_a_scratch_image_names_only_its_journal),the_activation_record_of_a_gpt_clone_names_its_disk_and_the_bound_of_its_first_partition,the_activation_record_of_a_clone_of_a_template_with_a_nic_names_its_own_network,settings_that_no_activation_record_holds_are_refused_before_anything_is_created,a_clone_with_an_export_records_its_plan_and_maps_from_its_children, anda_retry_never_sends_another_record_nor_takes_another_activation. Store plansremain outside the wire record. Changed-record retry coverage mutates hostname
rather than a removed credential.
Rewritten adapter fixtures, retaining their failure, deadline, execution,
networking and mapping assertions:
each_class_of_failure_ends_the_clone_with_its_own_status,a_clone_s_request_takes_the_staged_bindings_and_the_guest_s_defaults,a_clone_answers_the_restore_s_reset_and_activates_with_the_record_of_its_activate,a_clone_s_activation_fails_finally_with_the_status_of_the_failure_s_class,a_clone_fails_on_an_activate_longer_than_a_record_before_it_takes_its_body,a_clone_that_the_host_does_not_activate_in_time_ends_with_the_deadline_s_status,a_clone_s_application_ends_by_the_activation_s_deadline,a_clone_takes_what_came_during_its_application_before_it_is_ready,a_clone_whose_broker_closes_the_stream_before_it_is_ready_is_abandoned,a_ready_clone_fails_on_an_activate_that_is_not_a_retry,a_clone_s_executions_name_their_own_identity_and_take_the_hostname_of_its_record,a_clone_s_executions_enter_the_root_with_the_publication_of_its_record_s_network,a_clone_whose_announcer_ends_ends_with_the_network_s_status,a_clone_reports_when_its_events_happened_after_the_acknowledgement, anda_clone_maps_its_record_s_table_from_its_export_and_leaves_the_proxy_to_the_host.Rewritten VM record assertions, keeping real guest/VMM behavior:
clones_at_once_see_only_their_own_exportsandone_template_serves_the_clones_of_every_network_policy_at_its_guest_s_address.Only encoded plan/policy-identity uniqueness assertions are retired; export
isolation/access and network/DNS/proxy/publication/reachability checks remain.
Retired obsolete record-only tests/helpers:
activation::codec::tests::a_store_generation_of_0_is_refused,activation::tests::a_uid_or_gid_of_0_or_u32_max_is_refused,activation::codec::tests::identities,activation::codec::tests::vectors::identity,guest::clone::activation::apply::tests::WORKLOAD, andhost::template::clone::tests::digest_of. Their values are no longer recordfields; store identities and per-execution credentials remain outside the
record.
Rewritten supporting helpers/imports, solely to construct the new fixtures:
codec
encoding,cold_fields,with_export,with_network,fields_of,configurations,records, and vectors'record_of; schemaconfiguration,maximal,restore,export,proxy; guest applyerofs,gpt,scratch,configuration,clone_record,accepted,accepted_assembly,with_generated_id,export,network; guest activationconfiguration,clone_record; host clonetmpfs_request,workload(renamedview), andCrashed::kept_its_files; sharedACTIVATION_V1(renamedACTIVATION_V2);adapter worker
record,activating; adapter guest-sessionFakeRoot::apply; adapter clone-sessionrecord,exported,networked.Corresponding imports in codec/vectors/Ready/guest application/guest activation/
host clone/adapter worker/clone-session tests follow the same type removals.
Added focused coverage includes tmpfs cap validation and cap encoding
round-trips. No scenario list, test selector, timeout, CI wiring or production
test hook is changed.