[Enrique Saurez (esaurez)]

Part of #1115. Depends on #1395.

Summary

Boot the real layered root from nvx-init using the existing root, view and mapping codecs. Assemble the root, retain its export and mapping descriptors, mount the runtime before live shares beneath /run, apply the view, then switch root exactly once. Hand the initialized root, control channel, identity, account defaults and mapping state to the control caller so it can apply MAPS through retained handles and require completeness before workloads.

Move account parsing into one crate-private owner while preserving the legacy public Entry paths. Account creation uses bounded, descriptor-relative atomic replacements that preserve database metadata and surface write, rename and directory-sync errors. Home lookup resolves ancestor symlinks inside the prepared root and refuses a final symlink, including trailing slashes. Only the lookup path is normalized; / and the original returned HOME bytes are preserved.

Identify a host export by both its directory and the aggregate marker. A single live share may use /run/nvx/hostfs/root without that marker and remains a shared directory. Malformed aggregate markers still use the unchanged strict export parser, and positive MAPS still require a real export.

This does not add restore activation, per-execution containment, another root switch, a new runtime/reaper, workload-exec integration, or kernel/OpenVMM changes.

Scope and existing tests

The complete owned delta is 693 CORE lines across eight counted files, with 15 changed paths and 653 test-category added lines. The physical account extraction is counted in full. The official classifier reproduces the original 693/eight/15 measurement and the same result for the new parent-to-candidate delta.

The existing-test inventory reports five changes: the adversarial fixture atomically publishes its live child PID and bounds readiness to five seconds before the unchanged one-second containment timeout; three obsolete cfg_attr(not(test), expect(dead_code)) annotations are removed from now-called methods; and the boot seam is declared in the existing allowlist. These annotations are lint expectations, not failure-injection hooks. Four tests relocate unchanged; 30 tests are added.

Home regressions cover final-symlink refusal and account repair with trailing slashes, while usable paths preserve the exact HOME bytes and account databases. Live-share regressions cover both access modes at ordinary and export-directory targets, malformed/incomplete/mixed forms, and positive-MAPS refusal without an actual export. Real unhooked nvx-init validation is separate from the declared unit-test seam.

Validation

Current candidate: 29fca59317ffb67d8a3c89061faddf224c086051, directly on PR1395 head 0dd708cfa28ede292101feba561b1e3a3de9dcf7; unchanged OpenVMM pin 14dc4116ec7e57567633c4b7b07892aca3a58522.

This is an owned-only linear replay of the single original f26845b0..c22e4459 commit, with zero merge commits and no conflicts or source corrections. Git range-diff reports an unchanged patch. Original commit-message bytes, trailers and file modes are preserved; the original and rebased commits are unsigned.

Current CI run 42659271988, attempt 2, completed successfully at this head. The first attempt failed three Windows WHP latency metrics at the unchanged greater-than-50% threshold. After an explicit one-job rerun authorization, the Windows platform and its dependent performance/required checks reran; the gate checked 111 metrics and reported zero regressions. Unchanged successful jobs were reused by GitHub, not represented as newly executed. The original measurements, failures and offline gate reproduction are retained. The cause of the earlier slow samples is unproved; no source, threshold or baseline was changed to obtain a pass.

The independent native Opus 5.5/max/long-context whole-owned review found no significant issues. Current-head Copilot review 5829477565 is COMMENTED with no open issues, not formal approval. Fresh current-head unhooked PID1 boot, post-switch MAPS and shutdown evidence requested by its maintainer caveat is now recorded on both MSHV and WHP below; maintainer approval is not inferred.

Fresh local Windows execution completed all 29 Rust rows, including formatting, feature-specific lint/test/build/doc/MSRV checks, runtime-adapter configurations, native vectors and the current CLI build/provenance. Applicable Python lint/type/format/layout/kernel-inventory checks passed. The complete Python unit command passed: 1823 tests, 67 skipped.

The four previously failing local containment cases now passed using the prescribed standalone Python profile, followed by the complete 84-test adversarial action (11 skipped), four host-profile tests, CLI help checks and native PowerShell syntax. These Python-only checks used the existing host guard and the unchanged complete remaining-resource forecast, preserving its reduced compiler cap without invoking a compiler or VM. The earlier virtual-environment launcher/actual-child PID discrepancy and all failed attempts remain recorded; the earlier slowdown or failure causes are not represented as a source fix. No repository assertion, test timeout, skip or default test concurrency was changed.

Fresh Pedro/Linux qualification now actually passed on the user-selected /mnt/slim-data-2 filesystem. The shared compilation broker, versioned full host guard, common reservations and complete-pipeline forecast bound that actual new device; no resource threshold, job ceiling or compiler/VM overlap exception was introduced. All 39 Rust/guest/adapter/vector/CLI rows passed. The ordinary-user Python unit command passed 1823 tests with 30 skipped; adversarial passed all 84 without skips, and all four host-profile tests passed. All 16 quality rows passed, including 25 Specula tests. The exact approved current precompiled nine Root and two Entry cases also executed successfully as UID0/PID1 inside private mount/PID/proc namespaces; approval alone is not counted as execution. No owned privileged mount or test process remained in the host namespace. Root-owned post-test fixture data is retained, not falsely reported removed.

Actual guarded MSHV execution passed all three current native cases: MAPS and live-share fixtures exited naturally with zero, and the real unhooked production PID1/root-switch fixture reached its intended time-helper witness and natural exit 125. That expected fixture exit is not represented as a normal zero guest exit. Every structured teardown flag was true. The four public managed-exec configuration, sandbox lifecycle, proxy-only and RAM-upper scenarios then passed, with no observed owned VMM left afterward.

The Linux musl test binary and MAPS/live fixtures were freshly built from this candidate. Runtime kernel/Alpine/Ubuntu/native/CLI inputs passed complete official source/provenance validation. Fresh local guest helpers and current CI runtime helpers have the same complete guest-source identity but different executable bytes; their identities remain separate, and runtime used the explicitly authenticated current CI helpers. Earlier CRLF, temporary-path, wrong-platform-helper and transport failures remain recorded separately; no old-head execution, assertion waiver, deadline change or test-concurrency override was used as a pass.

Fresh guarded WHP execution also passed the same three native cases with natural exits zero/zero/125 and every structured teardown flag true. All four public managed-exec configuration, sandbox lifecycle, proxy-only and RAM-upper scenarios passed, recording 27/41/12/14 checks respectively. No owned VMM remained, and the NVX/native source and index were clean afterward. The original complete remaining 8-GiB RAM/16-GiB DATA reservation was not reduced: the existing shared host guard waited for actual capacity, admitted the policy-reduced 16-GiB VM reservation, then monitored the complete execution. No compiler or additional CI run was invoked.

Applicable local qualification is complete for this frozen candidate. Both platforms used the freshly compiled current Linux musl fixture binary, source-validated current runtime artifacts and unchanged native pin. Prior source executions remain historical; all failed operational attempts remain separate from the successful current evidence.

The main CI run above remains successful. The separate current repository_context / agent check is failed; it was not rerun or represented as a successful check.

The preceding c22e4459 qualification remains historical, not a pass for this candidate. Parent local hardware/RESET-ACK qualification is not claimed complete here. The PR stays Draft; no final Ready or merge is requested.

[github-actions]

This pull request changes existing tests

It modifies or removes 5 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified test	def AdversarialOracleTests.test_contained_process_timeout_kills_descendants in scripts/test_adversarial.py	scripts/test_adversarial.py:979	scripts/test_adversarial.py:979
removed hook	the test hooks of impl impl Runtime in guest::init	nvx-rs/src/guest/init.rs:843
removed hook	the test hooks of fn mount_runtime in guest::root (impl Root)	nvx-rs/src/guest/root.rs:917
removed hook	the test hooks of fn switch in guest::root (impl Root)	nvx-rs/src/guest/root.rs:1052

Test policy

Change	What	Before	After
loosened allowlist entry	nvx-rs/src/guest/init/boot.rs (the seams allow 1 test hooks)		scripts/test-layout-allowlist.json

Relocated unchanged: 4; added: 30. Compared the merge base 0dd708cfa28e with 29fca59317ff.

[Copilot]

🟡 Changes recommended

Trailing slashes bypass the directory-symlink rejection during home resolution, allowing boot to retain a symlinked home that account-creation mode should reject or repair.

1 open issue

• Trailing slashes bypass home-directory symlink rejection · New

What changed in this PR

Adds layered-root cold boot to nvx-init, building on the existing root, view, and mapping components. It prepares the shared VM root and retains control and mapping handles across a single root switch; workload execution remains outside this PR.

Changes:

• Assemble the root, mount runtime filesystems before live shares, apply the view, and switch root once.
• Centralize account parsing while preserving legacy Entry APIs, and add bounded atomic account updates.
• Add boot and filesystem regression tests and stabilize the adversarial timeout fixture.

File	Description
scripts/​test-layout-allowlist.json	Update allowances for the boot test seam and root annotations.
scripts/​test_adversarial.py	Wait for child readiness before testing containment timeout.
nvx-rs/​src/​guest/​sys/​rooted/​tests.rs	Test atomic replacement, metadata preservation, and failure cleanup.
nvx-rs/​src/​guest/​sys/​rooted.rs	Add rooted directory lookup and atomic file replacement.
nvx-rs/​src/​guest/​root.rs	Remove obsolete dead-code expectations from boot operations.
nvx-rs/​src/​guest/​mod.rs	Register the shared account module.
nvx-rs/​src/​guest/​init/​tests.rs	Preserve helper and signal tests through test-local drivers.
nvx-rs/​src/​guest/​init/​boot/​tests.rs	Cover boot inputs, account preparation, and native layered boots.
nvx-rs/​src/​guest/​init/​boot/​account.rs	Resolve or create the shared root’s workload account.
nvx-rs/​src/​guest/​init/​boot.rs	Implement layered boot and retain control and mapping state.
nvx-rs/​src/​guest/​init.rs	Connect PID 1 startup to layered boot.
nvx-rs/​src/​guest/​entry/​tests.rs	Reuse shared account fixtures and relocate parser tests.
nvx-rs/​src/​guest/​entry.rs	Delegate account parsing while preserving public paths.
nvx-rs/​src/​guest/​account/​tests.rs	House relocated account parser tests and fixtures.
nvx-rs/​src/​guest/​account.rs	Centralize bounded account database reading and parsing.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

A valid single live share targeting /run/nvx/hostfs/root is misclassified as a host export and rejected for lacking virtfs_aggregate=1, causing cold boot to fail.

1 open issue

• Rejects valid single live share at host export mount target · New

1 resolved since last review

• Trailing slashes bypass home-directory symlink rejection

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The privileged PID 1 root/mount transition and retained mapping handles carry guest-wide risk, and the reported native-boot and multi-backend evidence requires maintainer validation.

No open issues 🎉

1 resolved since last review

• Rejects valid single live share at host export mount target

_{Review effort: Balanced}

[Enrique Saurez (esaurez)]

For this review, the current evidence is bound to c22e445, not an earlier candidate: all applicable Windows/Linux Rust, Python and quality commands passed; the privileged filesystem cases passed 9 Root and 2 Entry tests; and fresh WHP/MSHV guest boots checked mappings through handles opened before the only root switch, a markerless live share at /run/nvx/hostfs/root, and the original helper-failure path. Those three guest cases produced natural 0/0/125 statuses with complete VM/process/control-channel teardown. The four public sandbox scenarios also passed on both backends.

The guest SDK source digest is 565b0e7debf291439c75e671842e120049df0b819768cfd2e331ae4c2c4d787a, and both CLI source inventories are 361840490f8fe710f4b9676c587c96aa43e1c1f7e546384e382fec248d595321. The existing boot tests retain the mapping, runtime ordering and single-switch assertions. OpenVMM remains pinned to 14dc4116ec7e57567633c4b7b07892aca3a58522; inherited native compiler-argument/profile history remains unknown, not reconstructed.

These are author-run results, not CI or maintainer approval. The requested maintainer validation of this privileged transition remains outstanding; the PR stays Draft.

[Copilot]

🔵 Needs a closer look

PID-1 root switching and retained-descriptor changes require human confirmation of reported privileged microVM boot, mapping, and shutdown results that could not be independently validated in this source-only review.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The PID 1 root-switch and retained mount descriptors still require maintainer-verified, current-head unhooked microVM validation of boot, post-switch MAPS behavior, and shutdown.

No open issues 🎉

_{Review effort: Balanced}