[Enrique Saurez (esaurez)]

Closes #1104

Apply the VM-wide view once to an assembled root: set the decoded hostname bytes, preserve the image's machine ID or bind a generated UUID, and optionally bind the existing single-server resolver file. The hidden guest::view::apply uses the existing crate-wide error contract and file formats; the activation record's limit and machine-ID modes stay unchanged.

Root owns successful binds and attachments retained after a failure. Teardown removes them before the root switch, while a switched root leaves them mounted. The existing file/runtime binding implementations now live in root; legacy Entry delegates to that one implementation. Existing caller paths remain usable. There is no new switch implementation, syscall layer, resolver framework, or per-execution view setup.

This is stacked on #1342 at 0701ea5f, retaining the view configuration from #1312 and the runtime mounts and root-switch implementation from #1295.

Size and API

296 core lines in seven production files, measured against 0701ea5f; 15 tracked paths including six test files, the README, and the Linux API snapshot. The seven production paths are guest/view.rs, guest/root.rs, guest/entry.rs, guest/clone/activation/apply.rs, guest/mod.rs, guest/sys/entry.rs, and guest/sys/mod.rs. Moved binding implementations are counted in full. The hidden view surface adds 11 snapshot lines; the supported mapping API stays unchanged.

Tests

The exact-base inventory reports five modified existing assets, three unchanged relocations, and 20 added assets. No existing test is retired; no scenario, timeout, CI wiring, test-layout allowance, or production test hook is changed.

Existing asset	Disposition
entry::tests::machine_ids_are_version_4_uuids_in_lowercase_hexadecimal	Moved unchanged to view::tests; UUID version, variant, lowercase digits, and newline assertions retained.
entry::tests::a_machine_id_is_generated_once_per_file	Moved unchanged to view::tests; exclusive creation, mode, symlink refusal, and distinct-ID assertions retained.
entry::tests::a_generated_machine_id_has_mode_0444_whatever_the_umask	Moved to view::tests; the isolated child filter and existing process-isolation helper follow their current owners, with the same 0444 assertion.
clone::activation::apply::tests::a_resolver_file_names_its_dns_server_once_and_every_execution_may_read_it	Moved to view::tests, retaining IPv4/IPv6 text, mode, exclusive creation, and symlink assertions. It now compiles with its Linux guest owner instead of the old x86-64-only activation test module.
entry::tests::runtime_sources_are_the_directories_beside_their_files	Moved unchanged to root::tests::view.
entry::tests::only_a_link_at_a_runtime_file_of_etc_is_removed	Moved to root::tests::view; the fixture creates its own root and etc directory. Existing symlink, regular-file, traversal, and target-policy assertions are retained.
root::tests::privileged::Scene::root	Initializes the two new view-ownership fields to None; all existing scene behavior is retained.
Imports in clone::activation::apply::tests	Follow the resolver test's new owner and shared constants; no assertion is removed.

The existing privileged runtime/switch tests remain unchanged: the_runtime_s_file_systems_have_an_execution_s_options_nodes_and_links, a_call_that_fails_part_of_the_way_unmounts_what_it_mounted, a_call_after_a_mapping_is_refused_and_leaves_it_reachable, mappings_beneath_run_after_the_runtime_are_on_its_tmpfs_and_go_with_it, and a_switched_root_keeps_its_mounts_and_maps_through_earlier_descriptors. Legacy privileged_entries_see_their_own_view_and_identity and privileged_runtime_binds_are_removed_before_a_teardown are kept too.

New tests in root::tests::view:

• the_root_removes_its_view_binds_in_reverse_order_before_the_overlay
• image_mode_without_dns_binds_nothing_and_a_second_view_is_refused
• invalid_hostname_bytes_are_refused_before_any_view_effect
• a_later_bind_failure_stays_owned_and_its_teardown_removes_the_earlier_bind
• a_switched_root_never_unmounts_or_detaches_its_view_binds
• switched_or_failed_roots_refuse_a_view_before_opening_its_root
• teardown_reports_each_view_bind_that_stays_mounted
• a_view_bind_that_moves_and_cannot_detach_stays_owned_until_teardown

New privileged tests:

• view_image_mode_applies_decoded_bytes_without_machine_id_or_resolver_binds
• view_generated_id_and_dns_are_read_only_and_the_root_unmounts_them
• view_failure_after_the_machine_id_bind_leaves_it_owned_for_teardown
• view_binds_survive_the_actual_switch_teardown_refusal_and_drop

The remaining eight added assets are the two owner modules, their imports and inner attributes, and the prepared and view_scene fixtures. They support these 12 new tests rather than adding hidden production hooks.

Validation

Rebased head

The four own commits are rebased onto #1342 at 0701ea5f, producing 9c9b0182 (tree 04d2a678) with the unchanged OpenVMM pin 14dc4116. The only conflict combined two adjacent import deletions: the parent's obsolete NonZeroU64 import and the resolver test's old PermissionsExt/symlink imports. No test body, assertion, filter, timeout, API, or production behavior was changed by that resolution.

python scripts/nvx.py verify, python scripts/check_test_layout.py, python scripts/check_test_changes.py --base 0701ea5f22d26fa193b7a6f4cba550de3158c68b, and cargo fmt --all --check passed on this head. The inventory remains five modified existing assets, three unchanged relocations, and 20 added assets.

Full CI run 42530728776 completed successfully on exact head 9c9b0182: all 35 executed jobs succeeded, including both Rust/CLI platforms, guest builds, KVM/MSHV/WHP scenarios and packages, and the required status check. Eight conditional jobs stayed skipped: artifact-reuse rehearsal, performance regression gating, merge-group cancellation, performance persistence/recording, development release, and crate packaging/publication. Those skips are not reported as passes.

Copilot's review 5820066487 of exact head 9c9b0182 recommends approval, with no open issues and zero unresolved threads; its formal state is COMMENTED, not a maintainer approval. The PR remains Draft. No earlier-source artifact or runtime result is substituted for this head's checks. Local compilation and runtime execution were not repeated for the import-only resolution.

Earlier source qualification

The following results belong to the earlier qualified source f26845b0, not the rebased head's CI or runtime execution.

Completed applicable local checks at f26845b0 (tree e25c652e), directly on published #1312 7d4b7e86 with merged #1310 in its ancestry and inherited OpenVMM pin 14dc4116:

• Complete current Windows/Linux Rust action commands, formatting, Clippy, documentation, MSRV, API, canonical CLI and guest checks passed. All-feature main-library results were Windows 1,224 passed/6 ignored and Linux 1,979 passed/37 ignored; protocol tests passed 278 on each platform.
• Complete quality checks passed, including 25 Specula tests and six native PowerShell parser tests with normal ICU. Whole Python actions ran 1,818 tests on each platform, retaining Windows 67/Linux 32 skips. Adversarial suites ran 84 tests each, retaining Windows 11/Linux 0 skips; host inventories passed four each.
• Current View/Root-view selections passed 14 tests. Real privileged Root/legacy-Entry selections passed 11 with no effect skips, including bind failure, teardown and accessibility after the actual root switch.
• Fresh current guest artifacts passed complete WHP and MSHV suites: Alpine 51 selected names/57 passing spans on WHP and 57 on MSHV, Ubuntu six and Azure Linux seven on each. The unchanged whole adapter suite passed all 156 tests across 11 targets on each backend, with zero ignored tests.

Both runtime runs used this candidate's own canonical CLI, static guest helpers and actual admitted prebuilt test runners. Existing matching native component binaries and the unchanged kernel were authenticated against current inputs; no other candidate's guest or test result was reused. The existing mount-only, data-backed temporary-directory route preserved the MSHV adapter's full command, cases, timeouts and PID/user/network namespaces. Independent read-only review found no blocking own-patch issue.

The earlier rebase conflict preserved the moved tests and followed the same shared process-isolation helper at its new location; no assertion or production behavior was changed. Earlier source, failures and interrupted prestart attempts remain separate. Completed commands were reused only with demonstrably exact inputs, and interrupted commands were rerun in full through the standard compiler entry. At that source qualification, KVM and GitHub CI were not run or queried locally; the PR remained Draft.

[github-actions]

This pull request changes existing tests

It modifies or removes 6 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified helper	fn root in guest::root::tests::privileged, impl Scene``	nvx-rs/src/guest/root/tests/privileged.rs:80	nvx-rs/src/guest/root/tests/privileged.rs:80
modified helper	fn cold_runtime in host::vm::tests	nvx-rs/src/host/vm/tests.rs:428	nvx-rs/src/host/vm/tests.rs:434
modified imports	the imports of guest::clone::activation::apply::tests	nvx-rs/src/guest/clone/activation/apply/tests.rs:18	nvx-rs/src/guest/clone/activation/apply/tests.rs:18
modified test	fn a_resolver_file_names_its_dns_server_once_and_every_execution_may_read_it in guest::clone::activation::apply::tests (moved, and it now compiles where feature = "guest" and target_os = "linux" and test hold, not where feature = "guest" and target_arch = "x86_64" and target_os = "linux" and test did)	nvx-rs/src/guest/clone/activation/apply/tests.rs:1424	nvx-rs/src/guest/view/tests.rs:79
modified test	fn a_generated_machine_id_has_mode_0444_whatever_the_umask in guest::entry::tests (moved)	nvx-rs/src/guest/entry/tests.rs:532	nvx-rs/src/guest/view/tests.rs:61
modified test	fn only_a_link_at_a_runtime_file_of_etc_is_removed in guest::entry::tests (moved)	nvx-rs/src/guest/entry/tests.rs:828	nvx-rs/src/guest/root/tests/view.rs:31

Relocated unchanged: 3; added: 40. Compared the merge base 708dcef59a86 with 207548c5cf04.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the VM-wide view application and root-owned binding changes.

No open issues 🎉

What changed in this PR

Adds VM-wide view application to NVX’s hidden guest reference code, building on the existing view configuration and root-switch support. Root owns the hostname-related file binds, removing them during teardown before switching and preserving them afterward.

Changes:

• Adds view::apply for decoded hostname bytes, image or generated machine IDs, and optional single-server DNS.
• Centralizes binding helpers in root, preserving legacy caller paths through delegation and re-exports.
• Adds lifecycle and privileged tests, relocates existing coverage, and updates documentation and the Linux API snapshot.

File	Description
nvx-rs/​src/​guest/​view/​tests.rs	Relocates machine-ID and resolver-format tests.
nvx-rs/​src/​guest/​view.rs	Implements VM-wide view application and shared file generation.
nvx-rs/​src/​guest/​sys/​mod.rs	Re-exports the internal hostname setter.
nvx-rs/​src/​guest/​sys/​entry.rs	Makes the hostname setter crate-visible and clarifies its namespace scope.
nvx-rs/​src/​guest/​root/​tests/​view.rs	Tests view ownership, failure handling, teardown, and switch behavior.
nvx-rs/​src/​guest/​root/​tests/​privileged.rs	Adds real hostname, bind, teardown, and root-switch tests.
nvx-rs/​src/​guest/​root/​tests.rs	Registers the view test module.
nvx-rs/​src/​guest/​root.rs	Owns view attachments and centralizes runtime binding helpers.
nvx-rs/​src/​guest/​mod.rs	Exposes and documents the hidden view module.
nvx-rs/​src/​guest/​entry/​tests.rs	Moves shared helper tests to their new owners.
nvx-rs/​src/​guest/​entry.rs	Delegates binding and re-exports existing identity symbols.
nvx-rs/​src/​guest/​clone/​activation/​apply/​tests.rs	Moves resolver-file coverage to the view module.
nvx-rs/​src/​guest/​clone/​activation/​apply.rs	Reuses shared identity and resolver helpers.
nvx-rs/​README.md	Documents view application and bind ownership.
nvx-rs/​public-api/​linux.txt	Records the hidden view surface.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the VM-wide view application and root-owned file-bind lifecycle changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues block approval of the VM-wide view application changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the VM-wide view application and root-owned file-binding lifecycle changes.

No open issues 🎉

_{Review effort: Balanced}