[Enrique Saurez (esaurez)]

Part of #1098

SL2.4b builds on the renderer landed by #1312 and prevents caller boot text from replacing configuration-rendered tokens while leaving every other token caller-owned.

VmConfig::check and kernel_command_line refuse the fixed root/view/mapping names and all normalized virtfs_* names. The existing Linux and init token readers cover their differing quoting, whitespace and -- behavior; dash/underscore equivalence follows Linux parameter-name matching. Caller tokens such as nvx_entrypoint, nvx_arg and nvx_share remain accepted and unchanged.

VmConfig::mapping_table returns exactly ExportPlan::guest_table, without host I/O or another validation pass. Its entries are those counted by nvx_maps; without an export the table is empty and that token is absent. The existing protocol::maps module becomes public, with the protocol-root re-exports and wire codec retained. Only the existing COMMAND_LINE_BUDGET moves from host::launch to host::config. Both public-API snapshots and the configuration documentation describe these changes.

This does not change OpenVMM argument rendering, the Windows process-command-line check, the mapping wire format, protocol versions, guest implementation or the native pin. Legacy launch checks remain.

Tests

The official comparison against the parent reports 0 modified or removed existing test items, 0 unchanged relocations and 4 added tests in nvx-rs/src/host/config/tests.rs:

• caller_tokens_cannot_replace_rendered_tokens_under_kernel_name_matching: covers reserved names, every dash/underscore combination, both root forms, quoted/init-visible tokens, whitespace and tokens after --.
• caller_owned_guest_tokens_and_noncolliding_names_stay_unchanged: accepts representative guest-owned tokens and noncolliding names without rewriting their text.
• mapping_table_is_the_exact_export_projection_counted_by_the_boot_token: checks the exact ordered entries, writable/read-only and nested binds, their count, pure projection despite unrelated invalid configuration, and the no-export case.
• public_maps_codec_keeps_the_protocol_root_reexports_usable: uses the unchanged codec through both the public module and the retained root exports.

The existing host::launch tests mappings_add_the_export_and_the_mapping_count, kernel_parameters_are_checked and kernel_parameters_are_read_as_the_kernel_reads_them are retained unchanged. No existing assertion, timeout, fixture, test hook or CI wiring is weakened or removed.

Size

40 core lines in 3 counted files, across 7 changed paths, measured for the complete 09a6f041..82e1c0f3 range with the official size tool and its normal rules. Documentation/API snapshots and tests account for 78 and 172 added non-core lines respectively. No size exception is used.

Validation

The original two-commit slice was rebased onto current #1312 (43716c03). Configuration/API/documentation conflicts retained the parent's capture checking, public capture definitions and complete capture/restore documentation. Only three initializers in the added tests gained the required capture: None; their assertions and the original production checks are unchanged.

All commands below actually ran at bef7e6bb, whose complete source tree is 0cb8028b. While qualification ran, #1312 merged into feature/nvx-refactor at 09a6f041 and GitHub retargeted this PR automatically. The landed input has exactly the same tree as 43716c03; replaying only the two own commits onto it produced final 82e1c0f3, with the same complete source tree as tested bef7e6bb. Source/native identity, executable digests and source-provenance bindings were checked separately. Results retain their actual bef7e6bb execution identity: no unchanged matrix was repeated or relabelled as an 82e1c0f3 run. Historical 7a87b03e/9e1c7081 results are not qualification of this changed input.

The complete applicable Rust action passed on Windows and Linux: formatting, all five warning-denied Clippy configurations, tests, protocol-only builds, strict rustdoc, public-API snapshots, the MSRV check, bundling, runtime-adapter configurations and native vector/profile comparisons. Linux also passed the macOS cross-check and the static guest-binary lint/build/test and ELF checks.

Complete selection	Windows	Linux
Rust all-features primary targets, passed / ignored	1,413 / 19	2,216 / 48
Rust default primary targets, passed / ignored	1,160 / 17	1,124 / 19
Protocol-only library, passed / ignored	283 / 0	283 / 0
Full CLI unit action, total / skipped	1,818 / 67	1,818 / 30
Full adversarial action, total / skipped	84 / 11	84 / 0

The configuration selection passed all 20 tests on each OS. Both complete CLI actions included all 22 action-defined modules, all eight root-token shell cases and the required cancellation shell case without skipping those cases; host-inventory tests and all command-help checks passed. Linux passed all 14 quality commands, including both typing platforms, shell linters, Markdown/test-layout checks, 25 Specula tests and six PowerShell syntax checks.

An initial complete Linux all-features run encountered ETXTBSY while an unchanged CLI fixture executed its temporary binary copy. One repeat of the same complete command passed, without source, assertion, deadline, skip or test-threading changes; no specific descriptor holder or source fix is claimed. A separate Linux CLI transport prestart failed before any controller or command existed; that no-effect state was verified before its actual complete execution passed. Both complete unit actions took over 12 minutes and finished normally, without interruption or timeout changes. The original failures and observations remain retained.

Independent read-only review of the exact final head has no open findings. Final size/test-change preflight was repeated against the actual landed base; test-layout and the other quality checks passed on the byte-identical tested tree.

Own VM runs are not applicable to this intermediate configuration-only change: it changes no guest code, VMM arguments, CLI VM path or API consumed by the runtime adapter. No new VMM/kernel build, KVM/WHP/MSHV runtime scenario or full-group distro evaluation is claimed here; applicable group/runtime coverage remains with the later changes and CI. This PR remains Draft; its CI jobs may be skipped, and no CI result is claimed.

[Copilot]

🟢 Approval recommended

The review identifies no active issues with the reserved boot-token protection and related API updates.

No open issues 🎉

What changed in this PR

This PR advances #1098 by preventing caller boot text from overriding configuration-rendered tokens, building on the cold-boot renderer introduced in #1312. Other caller-owned tokens remain accepted and unchanged.

Changes:

• Reject reserved root, view, mapping and virtfs_* names using Linux and init token parsing, including dash/underscore equivalence.
• Expose the configuration’s mapping table and existing mapping protocol module, and move COMMAND_LINE_BUDGET into configuration.
• Add four tests and update documentation and both public-API snapshots.

File	Description
nvx-rs/​src/​protocol/​mod.rs	Makes the existing maps module public.
nvx-rs/​src/​host/​launch.rs	Imports the relocated command-line budget.
nvx-rs/​src/​host/​config/​tests.rs	Tests token rejection, caller-text preservation, mapping projection and codec access.
nvx-rs/​src/​host/​config/​mod.rs	Adds reserved-token checks, mapping-table access and the relocated constant.
nvx-rs/​README.md	Documents token ownership, mapping access and the budget location.
nvx-rs/​public-api/​windows.txt	Records the Windows public-API changes.
nvx-rs/​public-api/​linux.txt	Records the Linux public-API changes.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the boot-token protections and related configuration API changes.

No open issues 🎉

_{Review effort: Balanced}

[github-actions]

This pull request changes no existing test

Relocated unchanged: 0; added: 4. Compared the merge base 09a6f041703c with 95920a27fb65.

[Enrique Saurez (esaurez)]

Copilot please review the current head 82e1c0f3 after the scoped rebase onto feature/nvx-refactor. Please check the caller-token refusal, exact mapping-table projection, retained codec/re-exports and preservation of the parent configuration behavior.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the caller-token collision checks and related configuration API updates.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

Copilot please review the current head 82e1c0f3 after the scoped rebase onto feature/nvx-refactor. Please check the caller-token refusal, exact mapping-table projection, retained codec/re-exports...

Reviewed 82e1c0f3 against 09a6f041. The reserved-token checks cover the Linux/init readers and normalized names; mapping_table delegates directly to ExportPlan::guest_table; and the public maps codec/re-exports and parent configuration checks are intact. I found and fixed an API compatibility regression locally: host::launch::COMMAND_LINE_BUDGET now publicly re-exports the config constant, and both API snapshots include that path. The fix is uncommitted in the working tree. Focused config tests, full nvx-rs test/lint selections, API/docs/MSRV/macOS-cross and runtime-adapter checks passed. The exact-head PR CI's substantive jobs were skipped while Draft.