[Enrique Saurez (esaurez)]

Part of #1076.

Current CI follow-up 1017e0de adds one test-only linear commit on 49ee94b4; all five own commits remain single-parent, with no merge commit. The failing Ready-triggered CI run 42518746270 reached its 200 ms metadata deadline before the mocked connect started, so the pending-connect fixture's blocked assertion failed. The production timeout and shutdown behavior were correct and are unchanged. The fixture now models the request clock: first ensure the connect is actually pending, then reach the same 200 ms deadline. No assertion, workload deadline or production code was removed or weakened.

The original fixture deterministically fails with a 350 ms worker-start delay; the corrected fixture passes that identical delayed-start reproduction and all three metadata socket cases. The complete 1,818-case Windows unit suite passes with 69 recorded platform skips, using the exact current CI-built CLI/provenance; Python lint/format and both typing targets, host tests and helps also pass. Local broader adversarial checks retain separate Windows Store process-containment and PID-file-sharing fixture failures, not passes; no unrelated source was changed. Current full CI run 42523865334, attempt 1, is pending on 1017e0de. The same-head automatic PR run 42523863567 is tracked separately; automatic Draft-job skips are not CI green. Earlier source results below are retained history, not validation of this current test correction.

Add SL2.8's cold host::vm::create API and inspectable Prepared result without spawning a process. Require Boot, refuse snapshot restoration, retain the opened private log and inherited files, and expose the capability, output names and checked arguments. Failed preparation removes only the log it created; pre-existing outputs and runtime inputs remain untouched. Check the complete Windows command line with the actual paths and no reserve before returning.

Make the existing whole-config renderer internal, add the opaque Snapshot shell, and update the documentation and Linux/Windows public API snapshots. No restore, launcher, native pin, provider or budget changes. Preserve the predecessor's snapshot metadata, capture/restore types and legacy launch APIs rather than replacing them with the opaque shell.

The retained 7c4156ad correction refuses Linux listener-option delimiters (, and =) and generated control/boot-console socket names of 108 bytes or more before creating any output. Valid Unicode and space-containing names remain supported within the byte bound; Windows pipe selection is unchanged.

The retained e0b51916 correction additionally validates the canonical directory-derived Linux socket names for Unicode and the 107-byte limit before opening the log. This closes the ancestor-symlink bypass while preserving valid aliases, supplied output paths and arguments, and all existing ownership and rollback behavior.

Prior linear replay 49ee94b4 targeted the published #1334 head d86792ec, retaining the SL2.7 inputs and native 14dc4116. It replayed only the three original logical cold-create/socket commits and their test-only Boot.capture = None integration correction, preserving the original refs, history and captures. The only rebase conflict was README wording: keep the parent's listener/export refusal documentation and this layer's internal-renderer/Prepared inspection documentation. All four replayed commits and the additional current CI-fix commit have one parent; the latest parent remains an ancestor: zero merge commits in this PR's own history. The repository supports rebase-and-merge; no merge was performed. Child PR #1349 and complete native stack membership are preserved.

Prior replay e2d56248 targeted ac93c908 and had the same complete tree as the qualified c4935bee. Those source, review, CLI, runtime and CI captures remain retained at their original identities; they are not validation of the new inherited d86792ec guards.

Official whole-row measurement against the exact published parent: 149 core lines, 4 counted files, 10 raw paths, including the test-layout metadata without discounts. The inherited cold-block guard still preserves read-only ISO images and case-sensitive extension selection; the legacy sandbox wrapper retains its VMDK policy.

Tests

Add nine focused tests and two fixture helpers for cold preparation, Boot/snapshot refusal before outputs, rollback versus pre-existing resources, opened-file ownership, the exact complete-command-line boundary, Linux listener delimiters/socket byte limits, and canonical endpoint validation through ancestor symlinks. The direct-path regressions retain both console modes and Unicode/space names at 107/108/109 bytes. The two ancestor-symlink regressions cover valid canonical 107-byte Unicode/space names and real Unix binds, rejection at 108/109 bytes, non-Unicode canonical ancestors, both console modes, unchanged supplied outputs, and caller-file/symlink preservation before any failure output. Their genuine old-394b0833 production RED and corrected-source GREEN captures remain preserved.

The existing-test inventory flags one removed hook: VmDir::outputs is now used by production preparation, so its obsolete conditional dead-code allowance is removed. Against the current predecessor, tighten its remaining test-layout seam allowance from 6 to 5. Adapt the original cold fixture with capture: None inside Boot, without enabling capture rendering. No existing tests, assertions or workload deadlines are removed or weakened.

Validation

Prior 49ee94b4 verification passed source/native consistency, exact parent ancestry, four single-parent own commits, clean integration tree, whole-row measurement, test-layout inventory and Markdown links. Its README-only rebase correction qualified for the mechanical fast path. Manual CI run 42518070173, attempt 1, succeeded and its Copilot review was clear; the separate Ready-triggered CI failure is addressed above. None of these prior results is relabeled as a current 1017e0de CI pass.

• Completed the full applicable Rust actions on c4935bee: 30 Windows and 35 Linux commands, including feature combinations, warnings-denied Clippy/rustdoc, tests, public API snapshots, MSRV 1.89, the macOS check, and protocol/host/guest runtime-adapter checks. Reuse is explicitly bound to the identical complete e2d56248 source tree and unchanged four-patch diff; these are not reruns or commit-hash-relabeled passes.
• Independent native Opus 5.5 review: CLEAN for c4935bee / tree 8a88c619, exactly the current source tree and layer diff. No unchanged review replay or new-hash review claim.
• Rebuilt the current Windows static-CRT and Linux static-musl CLIs at c4935bee, source digest 683f505b, executable hashes a36bdbb5 / 0784c90c. Their provenance validates against the identical current e2d56248 inputs. The three genuinely CLI-dependent unit cases passed on each platform.
• Fresh actual e2d56248 WHP and MSHV acceptance: six owned consumers each, processors=1, covering guest-boot, command-line-limit, managed-execution configuration, sandbox-lifecycle, proxy-only and RAM-upper behavior. Both hosts retained clean source/runtime tuples; no owned VMM remains. No compiler ran in these VM phases, and the compiler-bearing managed-lifecycle scenario was excluded.
• Current guest lint/build/static-ELF verification and all 33 guest-binary tests passed. Regenerated the consumed Alpine initramfs and Ubuntu distro layer natively from verified prebuilt guest binaries, guest source digest a9f23c1e, without a kernel or OpenVMM producer. Installed and validated only the needed current guest artifacts on Windows; original payloads/provenance remain retained.
• Preserve actual failures and recovery lineage: the intermediate fixture compilation failed E0063/E0560 before tests ran and was corrected normally; the Windows emergency interruption reused only its nine actually passed same-source prefix commands. Linux's single CLI ETXTBSY failure passed a narrow recovery and a full all-feature rerun; subsequent default/guest-adapter emergency interruptions retained their failed records and resumed only unfinished actions. Independent default libtests were scheduled serially; all cases, assertions, explicit within-test concurrency and deadlines remained unchanged, with compiler concurrency still 12.
• Retain explicitly unchanged component coverage with original source identities: predecessor efa7e627 quality actions, and its input-equivalent a919db3e Python/CLI-unit, adversarial, host-inventory and help evidence. The inherited unit runs recorded 1,818 cases with 70 Windows / 39 Linux skips; adversarial runs recorded 84 cases with 11 Windows / zero Linux skips. Those are component reuse, not fresh current-head full-suite or old-CLI passes; the actual current CLI-dependent, guest and selected native-runtime results are above.
• Current source/native consistency, whole-row measurement, changed-test inventory, test layout, 33 affected layout-unit tests per platform and Markdown links passed. Native/kernel/guest acceptance has authenticated artifact-level provenance; the historical native compiler/full build recipe remains unavailable and is not reconstructed. Parent readiness or its listener assessment is not formal approval, direct native-renderer boot or CI proof.

This remains a Draft. Prior CI run 42514434863, attempt 1, and Copilot review 5819320543 succeeded on e2d56248; they are historical, not current-head evidence. This latest head requires its own single ci.yml dispatch and current Copilot review; automatic Draft-job skips are not CI green. No development-release dispatch, Ready/demotion, merge or other-ref mutation.

[github-actions]

This pull request changes existing tests

It modifies or removes 2 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified test	def AzureMetadataRequestTests.test_a_connect_still_in_progress_is_shut_down_at_the_deadline in scripts/test_host_telemetry.py	scripts/test_host_telemetry.py:2061	scripts/test_host_telemetry.py:2061
removed hook	the test hooks of fn outputs in host::vm (impl VmDir)	nvx-rs/src/host/vm.rs:105

Relocated unchanged: 0; added: 11. Compared the merge base fdd642fc705c with 0701ea5f22d2.

[Copilot]

🟡 Changes recommended

VM preparation can accept Linux socket paths that exceed the address byte limit or contain listener-option delimiters, leading to unusable endpoints, incorrect socket selection, or startup failures.

2 open issues

• Reject listener delimiters in Linux VM directory paths · New
• Reject socket paths exceeding Linux’s Unix-socket byte limit · New

What changed in this PR

Adds inspectable cold-launch preparation as part of the move toward a mechanism-focused nvx library. Callers can obtain checked arguments, output names, and a capability without starting a VM.

Changes:

• Add vm::create and Prepared, retaining opened resources and cleaning up the newly created log on failure.
• Make the whole-config renderer internal and add an opaque Snapshot type, with restoration explicitly unsupported.
• Add focused preparation tests and update documentation, public API snapshots, and test-layout metadata.

File	Description
scripts/​test-layout-allowlist.json	Remove the obsolete VM test-seam allowance.
nvx-rs/​src/​host/​vm/​tests.rs	Test preparation, refusal, cleanup, resource ownership, and command-line limits.
nvx-rs/​src/​host/​vm.rs	Implement cold-launch preparation and resource retention.
nvx-rs/​src/​host/​snapshot.rs	Introduce the opaque snapshot input type.
nvx-rs/​src/​host/​mod.rs	Export snapshots and document prepared launches.
nvx-rs/​src/​host/​config/​mod.rs	Make argument rendering internal to preparation.
nvx-rs/​README.md	Document the preparation API and ownership contract.
nvx-rs/​public-api/​windows.txt	Record the updated Windows public API.
nvx-rs/​public-api/​linux.txt	Record the updated Linux public API.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues block approval of the cold-launch preparation API change.

No open issues 🎉

2 resolved since last review

• Reject listener delimiters in Linux VM directory paths
• Reject socket paths exceeding Linux’s Unix-socket byte limit

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

There are no active review issues blocking the checked cold-boot preparation API change.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Ancestor symlinks can bypass socket-path validation, allowing preparation to succeed for canonical paths that OpenVMM rejects due to excessive byte length or non-Unicode components.

1 open issue

• Validate canonical socket paths before opening the log · New

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Socket validation ignores canonical paths through symlinked ancestors, allowing creation to report Prepared even when OpenVMM’s resolved socket exceeds the Unix address limit.

1 open issue

• Validate canonical socket paths before opening the log

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the checked cold-launch preparation changes.

No open issues 🎉

1 resolved since last review

• Validate canonical socket paths before opening the log

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues block approval of the checked cold-launch preparation changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the cold-launch preparation changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are identified for the cold-launch preparation changes.

No open issues 🎉

_{Review effort: Balanced}