[Enrique Saurez (esaurez)]

Base ref: esaurez/slim-2.4.2-sl7.3-20261107 at 2b5b44fc38e3893de9e92d6f60caaabe67386101.

Expose the existing host transport through host::transport, verify that a VM endpoint belongs to the recorded and held process before authentication, and retain the blocking NVXS driver and compatibility paths. Process liveness checks, timed reads/writes, deadlines, unread accounting, handle duplication, partial receive recovery, terminal errors, and original causes remain intact.

Linux peer verification and CLI diagnostics

The sixth commit, 7654ec4, addresses the stale Unix-listener PID-reuse finding. After matching the numeric peer PID, the control connector uses the existing original-peer SO_PEERPIDFD check before returning a transport or sending a launch capability. Exited/reaped peers and unavailable or denied verification fail closed, without a numeric-PID fallback.

The seventh commit, 81f5875, addresses the follow-up CLI finding. Linux Unsupported verification failures now return immediately through the existing CLI I/O error path, retaining the SO_PEERPIDFD diagnostic instead of becoming an endpoint-unavailable timeout. Missing endpoints continue to retry, and Windows retry behavior is unchanged.

This newly requires SO_PEERPIDFD for all production Linux host control sessions: CLI, Instance, legacy sessions, and the independent adapter. Linux 6.5 or a backport is required. Previously the strict check was used by the experimental restore path, not all production control sessions. The host-only requirement was explicitly accepted. No guest kernel configuration, guest rebuild, Windows transport change, or OpenVMM pin update is introduced.

Complete owned slice and rebase-and-merge

All five original qualified SL2.11a commits remain in order, followed by the peer-verification and CLI-diagnostic fixes. These seven linear owned commits only are based directly on the current parent: no inherited old-parent history, merge commits, dropped/skipped original commits, or squashing. The first six published patches and messages remain unchanged by the seventh commit.

Actual GitHub REST reports rebaseable=true for the complete live tuple (81f58751f77787bc3fc9e6abfe4a3cfe12696be1, esaurez/slim-2.4.2-sl7.3-20261107, 2b5b44fc38e3893de9e92d6f60caaabe67386101), with exactly seven owned commits and no merge commits. This is structural eligibility, not formal review approval, complete qualification, or permission to merge. Any ancestor merge, ref move, or automatic retarget invalidates that observation and requires a fresh tuple check.

Canonical whole-owned scope is 369 CORE / 6 counted production paths / 22 raw paths, measured from the complete current parent to this frozen head with the existing measure_pr.py rules. The separate conservative both-side accounting is at most 377 CORE; neither correction is baseline-washed. The original 500 CORE ceiling is retained; the necessary sixth production owner, nvx-rs/src/host/cli/session.rs, is covered by the explicitly approved issue-scoped review-fix growth. CLI code is not discounted. All 306 original transport CORE remains charged. The three production adapter callers under tests/runtime-adapter/src/ retain their disclosed pathname classification; they are not tests and have not been moved or manually discounted. Transport and TransportHandle still re-export the single lower-platform definitions. The native pin remains 14dc4116ec7e57567633c4b7b07892aca3a58522.

Test changes

• nvx-rs/src/host/platform/tests.rs and platform/windows/tests.rs: expose existing owned pipe/server fixtures to transport tests.
• nvx-rs/src/host/platform/windows/endpoint/tests.rs: retain endpoint ownership and server lifetime fixtures.
• nvx-rs/src/host/session/tests.rs: cover legacy error translation and retain indeterminate process-query causes.
• nvx-rs/src/host/transport/tests.rs: retain the original connector, deadline, process-exit, endpoint-ownership, and error-cause coverage.
• nvx-rs/tests/nvxs/host.rs and tests/runtime-adapter/tests/host_session.rs: adapt existing session assertions to the canonical transport and preserved crate errors.
• nvx-rs/src/host/platform/linux/tests.rs: add transferred-listener/exited-creator and denied/unavailable peer-pidfd regressions (ENOPROTOOPT, EPERM, EINVAL), with subprocess completion markers.
• nvx-rs/src/host/cli/session/tests.rs: add a subprocess regression for ENOPROTOOPT, EPERM, and EACCES that verifies the retained diagnostic and zero retry/exit polls. Existing endpoint-unavailable timeout and process-exit tests are unchanged. Child completion markers reject zero-test false greens.
• nvx-rs/public-api/linux.txt and windows.txt: retain the original qualified transport API snapshots; these fixes add no public signature.
• Production changes in the adapter's src/bin/runtime-adapter-host.rs, src/host.rs, and src/host/executions.rs update dependent callers, not test coverage.

The tests-modified label is intentional.

Validation

Current published head: 81f58751f77787bc3fc9e6abfe4a3cfe12696be1.

• Actual current structural checks establish seven true owned linear commits directly on the live parent, no merges or inherited old-parent history, unchanged first six commits, native pin and clean source. GitHub reports rebaseable=true; this remains time-bound to the actual head/base-ref/base-SHA tuple and is not merge permission.
• Fresh current-head Windows evaluation completed all 25 applicable Rust/adapter gates successfully, including all-feature/default/no-default configurations, formatting, Clippy, bundling, documentation, and MSRV.
• Fresh current-head Linux evaluation completed 21 Rust95 library/protocol/host-adapter gates, three Rust1.89 MSRV configurations, and 12 special-target/API/guest/adapter/layout/link gates. macOS and both public API snapshots passed; guest Rust binaries and the musl guest adapter passed without an OpenVMM or guest-kernel rebuild.
• Actual Linux regressions passed: the new permanent-verification CLI test, 15 ownership/stale-listener/denied-pidfd/retry/transport cases, and the unchanged clone fixture that initially failed with an overlong temporary path. Child completion markers and zero retry polls are asserted by the new tests.
• The independent current-head incremental native review found no significant code or stored-body issues and verified byte-identical retained inputs for the first six commits. Copilot review 5822764019 is COMMENTED, "Needs a closer look", not formally APPROVED. Both actionable review threads have actual published-fix replies and are resolved.
• Current CI 42579436445, attempt 1, completed with FAILURE under an explicitly accepted temporary GitHub-download infrastructure exception. Its Windows OpenVMM setup exhausted three attempts to download the unchanged zstd1.5.7 archive with HTTP504 before any native compilation. The required-check failure is downstream of that failure. The other 25 executed jobs succeeded; 15 jobs were skipped. This is not an all-green CI result, and no rerun or substitute commit was created.
• Current CI actually executed the Linux runtime-adapter step40 successfully on both KVM and MSHV. WHP runtime/performance descendants were skipped after the failed Windows setup, including step42; they are not recorded as passed. The PR remains Draft, with no final Ready or merge action.
• Linux software initially failed the unchanged deep template/clone fixtures because the mandated long temporary root exceeded the Unix108-byte socket limit. The checks passed after using an explicitly permitted, uniquely owned short directory on the DATA disk, without symlinks, OS/tmp fallback, assertion weakening, or source changes. The initial failure is preserved and is not excused as a download/NFV failure.
• Private Rust1.95 and Rust1.89 programs were restored from the exact approved read-only pinned sources only after real missing-toolchain failures. Forty-six locked archives and their public sparse-index entries were checksum-verified before private-cache restoration; no credentials, shared locks, settings, or new versions were copied. The Windows CRLF versus canonical Git-LF lock-receipt failure remains archived.
• Other preparation failures remain preserved: an unintended recursive native-bundle fetch failed on a historical object and was prevented by nonrecursive NVX import flags; an incremental bundle first used an unnamed SHA and was corrected to the verified HEAD ref. Neither recovery changed the native pin, checkout, configuration, foreign object stores, or source code.
• Earlier heads 7654ec4e..., 74ca4245..., and 634fa887... passed their own CI runs but do not qualify this head. All ignored cases and raw failures are retained. The unchanged199.1178ms/200ms timing failure and the corrected uninstalled 1.89.0 runner alias remain historical facts, not weakened assertions or tool-version changes.

Historical qualification belongs to original source 48e6d91a..., not this head. Its completed software/runtime evidence includes actual CPU-profile/vector comparisons and the required managed-exec-config, sandbox-lifecycle, sandbox-proxy-only, and sandbox-ram-upper scenarios. Earlier comparison and scenario omissions were subsequently completed by real executions.

Retained historical failures/caveats include delimiter/doc-lint/dependency failures, CRLF runner issues, MSVC-descendant cleanup and Windows interruption/child.pid diagnostics, the compiler-found duplicate ErrorKind import missed by an earlier static review, the Ubuntu 64-case setup block, an unbudgeted Cargo attempt, offline serde/cache failures, storage-floor refusals, and the unavailable native-alternate warning. Raw failures, skips, and recoveries are preserved.

[github-actions]

This pull request changes existing tests

It modifies or removes 17 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified imports	the imports of nvxs/host (tests)	nvx-rs/tests/nvxs/host.rs:5	nvx-rs/tests/nvxs/host.rs:5
modified test	fn a_duplicated_transport_keeps_the_verified_connection_without_reconnecting in host::platform::windows::endpoint::tests	nvx-rs/src/host/platform/windows/endpoint/tests.rs:9	nvx-rs/src/host/platform/windows/endpoint/tests.rs:40
modified test	fn the_host_connection_waits_attaches_and_exchanges_messages in nvxs/host (tests)	nvx-rs/tests/nvxs/host.rs:133	nvx-rs/tests/nvxs/host.rs:138
modified test	fn a_receive_that_times_out_keeps_the_partial_record in nvxs/host (tests)	nvx-rs/tests/nvxs/host.rs:242	nvx-rs/tests/nvxs/host.rs:247
modified test	fn the_host_connection_reports_refusals_and_closed_streams_while_attaching in nvxs/host (tests)	nvx-rs/tests/nvxs/host.rs:285	nvx-rs/tests/nvxs/host.rs:291
modified test	fn resets_truncations_violations_and_transport_failures_end_the_connection in nvxs/host (tests)	nvx-rs/tests/nvxs/host.rs:327	nvx-rs/tests/nvxs/host.rs:334
modified test	fn a_send_that_times_out_before_writing_leaves_the_connection_usable in nvxs/host (tests)	nvx-rs/tests/nvxs/host.rs:379	nvx-rs/tests/nvxs/host.rs:387
modified test	fn a_send_that_fails_after_writing_ends_the_connection in nvxs/host (tests)	nvx-rs/tests/nvxs/host.rs:398	nvx-rs/tests/nvxs/host.rs:464
modified test	fn the_client_reassembles_messages_from_partial_and_shared_records in host_session (tests)	tests/runtime-adapter/tests/host_session.rs:640	tests/runtime-adapter/tests/host_session.rs:646
modified test	fn a_receive_that_times_out_keeps_the_partial_message in host_session (tests)	tests/runtime-adapter/tests/host_session.rs:679	tests/runtime-adapter/tests/host_session.rs:685
modified test	fn a_send_that_fails_or_times_out_ends_the_client_with_what_it_holds in host_session (tests)	tests/runtime-adapter/tests/host_session.rs:711	tests/runtime-adapter/tests/host_session.rs:717
modified test	fn a_reset_or_a_disconnect_in_the_middle_of_a_message_drops_it in host_session (tests)	tests/runtime-adapter/tests/host_session.rs:745	tests/runtime-adapter/tests/host_session.rs:751
modified test	fn the_client_waits_for_the_guest_and_reports_refusals_while_attaching in host_session (tests)	tests/runtime-adapter/tests/host_session.rs:809	tests/runtime-adapter/tests/host_session.rs:816
modified test	fn the_client_fails_on_records_that_the_protocol_does_not_allow in host_session (tests)	tests/runtime-adapter/tests/host_session.rs:868	tests/runtime-adapter/tests/host_session.rs:875
modified test	fn requests_check_their_answers_and_end_the_client_when_they_fail in host_session (tests)	tests/runtime-adapter/tests/host_session.rs:1265	tests/runtime-adapter/tests/host_session.rs:1272
modified test	fn only_a_session_that_ended_is_lost_to_a_clone_s_order in host_session (tests)	tests/runtime-adapter/tests/host_session.rs:2079	tests/runtime-adapter/tests/host_session.rs:2086
modified test	fn the_driver_ends_its_run_on_a_message_that_breaks_the_rules in host_session (tests)	tests/runtime-adapter/tests/host_session.rs:2517	tests/runtime-adapter/tests/host_session.rs:2523

Relocated unchanged: 0; added: 31. Compared the merge base 2b5b44fc38e3 with 81f58751f777.

[Copilot]

🟡 Changes recommended

A critical PID-reuse flaw in Linux peer verification can let an unrelated holder of a transferred Unix listener receive the launch capability.

1 open issue

• Reject stale Unix listeners when peer PIDs are reused · New

What changed in this PR

This PR adds host::transport as the canonical host transport API, combining VM endpoint verification with the existing blocking NVXS driver. It builds on the activation changes in #1346 and retains legacy import paths and session wrappers.

Changes:

• Verify the recorded process and endpoint ownership before sending authentication capabilities.
• Return crate-level errors while retaining original causes and adapting dependent callers.
• Add connector coverage and update session tests, documentation, and public API snapshots.

File	Description
tests/​runtime-adapter/​tests/​host_session.rs	Adapt session assertions to crate errors and retained causes.
tests/​runtime-adapter/​src/​host/​executions.rs	Handle timeouts through ErrorKind.
tests/​runtime-adapter/​src/​host.rs	Use canonical transport imports and error handling.
tests/​runtime-adapter/​src/​bin/​runtime-adapter-host.rs	Update unanswered-request timeout classification.
nvx-rs/​tests/​nvxs/​host.rs	Adapt NVXS tests and cover original error causes.
nvx-rs/​src/​host/​transport/​tests.rs	Add endpoint ownership, process-exit, deadline, and I/O coverage.
nvx-rs/​src/​host/​transport.rs	Introduce verified connections and relocate the NVXS driver.
nvx-rs/​src/​host/​session/​tests.rs	Test legacy process-query error translation.
nvx-rs/​src/​host/​session.rs	Delegate connections and translate transport errors.
nvx-rs/​src/​host/​platform/​windows/​tests.rs	Re-export pipe fixtures for transport tests.
nvx-rs/​src/​host/​platform/​windows/​endpoint/​tests.rs	Extract reusable pipe server fixtures.
nvx-rs/​src/​host/​platform/​windows/​endpoint.rs	Expose the endpoint test module within the crate.
nvx-rs/​src/​host/​platform/​tests.rs	Make Windows fixtures available to sibling tests.
nvx-rs/​src/​host/​nvxs.rs	Retain compatibility re-exports.
nvx-rs/​src/​host/​mod.rs	Export and document the transport module.
nvx-rs/​README.md	Describe transport verification and error semantics.
nvx-rs/​public-api/​windows.txt	Record the Windows transport API.
nvx-rs/​public-api/​linux.txt	Record the Linux transport API.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The Linux authentication-boundary change depends on SO_PEERPIDFD semantics and needs exact-head endpoint-ownership and stale-listener/denial regressions plus Linux/Windows runtime qualification, which historical runs do not establish.

1 open issue

• Reject stale Unix listeners when peer PIDs are reused

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The CLI retries and discards permanent SO_PEERPIDFD verification failures, producing a misleading endpoint-unavailable error instead of preserving the diagnostic.

1 open issue

• Propagate SO_PEERPIDFD verification failures instead of retrying · New

1 resolved since last review

• Reject stale Unix listeners when peer PIDs are reused

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Mandatory SO_PEERPIDFD authentication changes the security boundary for every Linux control session, while exact-head Linux and Windows runtime qualification remains pending and requires maintainer confirmation beyond static review.

1 open issue

• Propagate SO_PEERPIDFD verification failures instead of retrying

_{Review effort: Balanced}