Repository navigation
host: stop VMs only after verified exit - #1426
Closed
Enrique Saurez (esaurez) wants to merge 6 commits into
Closed
Enrique Saurez (esaurez) wants to merge 6 commits into
Enrique Saurez (esaurez) wants to merge 6 commits into
Conversation
Return typed exit proof from process waits and keep outcome-report read failures separate from confirmed exits. Preserve legacy lifecycle waits and best-effort report handling. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ad4b260-76ef-4afa-bd83-887489696103
Adapt the remaining direct process-wait assertions and test helpers without changing their deadlines or expected lifecycle behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ad4b260-76ef-4afa-bd83-887489696103
Record the generated Linux and Windows API surfaces. Keep exit-proof construction explicitly conditional and avoid importing error kinds that make existing documentation links redundant. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ad4b260-76ef-4afa-bd83-887489696103
Keep the CLI and library error inventories consistent and place process-wait and outcome-reader details in their owning module sections. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ad4b260-76ef-4afa-bd83-887489696103
Keep writable fixture descriptors out of concurrently forked CLI children while preserving the real copied executable, root-discovery premise and existing assertions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ad4b260-76ef-4afa-bd83-887489696103
Contributor
This pull request changes existing testsIt modifies or removes 49 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests. Test code
Relocated unchanged: 0; added: 12. Compared the merge base |
Enrique Saurez (esaurez)
marked this pull request as ready for review
November 9, 2026 22:09
Enrique Saurez (esaurez)
marked this pull request as draft
November 9, 2026 22:09
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The changed wait return type leaves a test passing Option<Exited> to assert!, preventing host-enabled library tests from compiling on both Linux and Windows.
1 open issue
What changed in this PR
This PR advances #1100 by requiring verified process exit before the host VM stop API returns success, while preserving legacy lifecycle behavior.
Changes:
- Introduces opaque exit proof,
vm::stop, andStillRunningfor unconfirmed exits. - Separates missing outcome reports from read or parse errors without hiding confirmed exit.
- Adapts callers and tests, adds real-process coverage, and updates documentation and public API snapshots.
| File | Description |
|---|---|
tests/runtime-adapter/tests/vm_clone.rs |
Adapts clone tests to typed exit results. |
tests/runtime-adapter/src/bin/runtime-adapter-host.rs |
Handles typed waits and report errors. |
nvx-rs/tests/supervisor.rs |
Updates supervisor wait assertions and cleanup. |
nvx-rs/tests/store.rs |
Adapts store process-wait helpers. |
nvx-rs/tests/fake_openvmm.rs |
Updates process identity and exit assertions. |
nvx-rs/tests/cli/lifecycle.rs |
Adapts lifecycle exit checks. |
nvx-rs/tests/cli/download.rs |
Copies the Unix executable through a child process. |
nvx-rs/tests/cli.rs |
Updates CLI process-wait assertions. |
nvx-rs/tests/checked_handoff.rs |
Adapts handoff exit checks. |
nvx-rs/src/host/vm/tests.rs |
Adds real-process stop and report coverage. |
nvx-rs/src/host/vm.rs |
Adds verified stop outcomes and bounded termination. |
nvx-rs/src/host/template/store/leases/tests.rs |
Updates lease cleanup and exit checks. |
nvx-rs/src/host/template/clone/tests/restore.rs |
Adapts restore exit confirmation. |
nvx-rs/src/host/template/clone/tests/launch.rs |
Updates launch wait and report assertions. |
nvx-rs/src/host/template/clone/records.rs |
Preserves best-effort report reads. |
nvx-rs/src/host/report/tests.rs |
Tests missing, malformed, and unreadable reports. |
nvx-rs/src/host/report.rs |
Returns distinct report absence and error results. |
nvx-rs/src/host/process/tests/linux.rs |
Updates last-thread exit assertions. |
nvx-rs/src/host/process/tests.rs |
Adapts polling fallback assertions. |
nvx-rs/src/host/process.rs |
Introduces Exited and typed wait results. |
nvx-rs/src/host/platform/windows/tests.rs |
Adds a wait-only handle helper and updates assertions. |
nvx-rs/src/host/instance/locked.rs |
Retains legacy best-effort report handling. |
nvx-rs/src/error/tests.rs |
Includes StillRunning in error-code checks. |
nvx-rs/src/error.rs |
Adds StillRunning and its code mappings. |
nvx-rs/README.md |
Documents stop, exit proof, and report semantics. |
nvx-rs/public-api/windows.txt |
Records new Windows public API symbols. |
nvx-rs/public-api/linux.txt |
Records new Linux public API symbols. |
doc/usage.md |
Documents the still-running error code. |
Review effort: Balanced
Adapt the parent-provided reattach assertion to the opaque exit-proof result without weakening its verified-exit requirement. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6a8293af-330b-47af-99ea-b48bfe7ebbbd
Enrique Saurez (esaurez)
marked this pull request as ready for review
November 9, 2026 22:30
Enrique Saurez (esaurez)
marked this pull request as draft
November 9, 2026 22:32
Base automatically changed from
esaurez/slim-3.3.2-sl7.6b-20261109
to
feature/nvx-refactor
November 10, 2026 04:40
Enrique Saurez (esaurez)
deleted the
esaurez/slim-2.2.2-sl2.10-20261109
branch
November 13, 2026 17:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

Part of #1100.
Return stop outcomes only after a verified process wait confirms exit.
Process::waitreturns opaqueExitedproof orNone;vm::stoppreserves graceful/forced ordering and reports an unconfirmed exit asStillRunning. Outcome-report errors remain separate from proved exit: only a missing report isOk(None), while unreadable or malformed reports retain their I/O causes.Keep the four legacy lifecycle callers on
wait_booland preserve existing best-effort report policies. Update the directly affected callers, both public-API snapshots, documentation, and real-process tests. No report schema, restart-proof process-open API, background service, native runtime, or dependency change.This is a linear change on #1421: the five original commits are preserved, followed by one coupled test-only correction. The OpenVMM pin is unchanged. Size: 101 production lines across seven production files, 29 changed paths; this includes the runtime adapter's ten production lines rather than treating them as tests.
Both Copilot and the independent local review found one inherited reattach test still asserting the old boolean wait result. The append-only correction asserts
is_some()instead, retaining verified-exit confirmation without changing the original five commits.Existing tests
The 49 modified tests/helpers below are retained and adapted to typed wait/report results without changing their assertions, deadlines, parallelism, or hardware skips. The one fixture-mechanism change copies the real POSIX executable through an owned child, keeping writable descriptors out of concurrent CLI children.
nvx-rs/src/error/tests.rsevery_kind_has_a_code_of_its_own_spellingnvx-rs/src/host/platform/windows/tests.rsa_launch_whose_vmm_exited_ends_while_a_process_spawned_in_its_window_holds_its_lognvx-rs/src/host/process/tests.rshosts_without_pidfds_poll_and_never_signalnvx-rs/src/host/process/tests/linux.rsa_process_runs_until_its_last_thread_exitsnvx-rs/src/host/report/tests.rsreports_are_summarized_without_free_form_fieldsnvx-rs/src/host/template/clone/tests/launch.rsVmmDir::end_and_wait,VmmDir::wait_exit,VmmDir::drop,a_clone_whose_launch_failed_before_it_began_launches_no_more_until_its_release,a_launch_whose_caller_crashes_once_its_vmm_started_ends_the_vmm_as_reattach_recovers_it,a_restore_whose_caller_crashes_before_its_commit_ends_its_vmm_as_reattach_recovers_itnvx-rs/src/host/template/clone/tests/restore.rsassert_vmm_endednvx-rs/src/host/template/store/leases/tests.rsVmmDir::drop,a_clone_that_crashes_after_its_spawn_keeps_its_lease_until_its_unrecorded_vmm_exits,a_clone_that_crashes_after_recording_its_vmm_keeps_its_lease_until_reattach_ends_itnvx-rs/src/host/vm/tests.rsspawn_caller_helper,an_unrelated_process_started_in_the_library_spawn_window_gets_no_vm_claim,current_cold_spawn_boots_a_guest_accepts_shell_input_and_exits_cleanlynvx-rs/src/host/vm/tests/reattach.rsreattaching_returns_the_held_owned_child_and_authenticated_connection(retains exit confirmation withis_some())nvx-rs/tests/checked_handoff.rsa_prepared_launch_hands_the_vmm_its_checked_images_alone,a_vmm_keeps_the_scratch_images_claim_once_its_launcher_is_gonenvx-rs/tests/cli.rsa_stop_under_another_identity_never_ends_a_process_that_its_record_does_not_name,stop_reports_its_timeout_and_leaves_the_vm_running,a_sandbox_whose_openvmm_exited_reports_it_once_and_starts_againnvx-rs/tests/cli/download.rsprovision_and_deprovision_need_no_artifact_root(owned-child executable-copy fixture; existing premise and assertions retained)nvx-rs/tests/cli/lifecycle.rscheck_lifecycle,recycled_process_id,lifecycle_of_a_sandbox_whose_upper_is_in_ram,stops_keep_an_outcome_report_that_the_caller_reads_whatever_its_umasknvx-rs/tests/fake_openvmm.rsoutcome_reports_of_another_runtime_are_never_read,records_that_name_another_process_never_end_itnvx-rs/tests/store.rskill,a_committed_launch_names_its_vm_for_another_buildnvx-rs/tests/supervisor.rsVmmDirectory::drop,check_vmm,long_stores_launch_with_a_short_working_directory,a_child_that_exits_wakes_its_waiter,a_process_that_is_not_a_child_wakes_its_waiters,a_restarted_launcher_finds_its_vmm_again_and_ends_it,a_reused_process_id_is_never_signaled,references_that_name_no_process_are_never_opened,an_unrecorded_vmm_that_serves_no_endpoint_is_never_signaled,a_vmm_in_its_orchestrators_job_ends_with_it,a_job_that_ends_its_vmm_wakes_the_waiters,a_process_that_this_user_may_not_terminate_is_waited_for_but_never_signaledtests/runtime-adapter/tests/vm_clone.rsEarly::activate,a_host_program_of_another_runtime_ends_the_clone_through_its_verified_identity,a_clone_whose_vm_exits_once_a_stop_found_it_fails_before_its_lease_is_released,a_run_whose_clone_s_vm_exits_during_its_execution_ends_with_the_clone_s_failureNew coverage exercises self-exit and report outcomes, verified forced exit after grace, and unconfirmed exit, plus missing, malformed, and unreadable reports.
Validation
e4af8689. Current-head Copilot feedback has no unresolved threads; the independent whole-owned review and its correction review are clean. The PR remains Draft.