Repository navigation
host: confirm VM exit before returning stop outcomes (SL2.10) - #1432
Merged
Pedro Henrique Penna (ppenna) merged 3 commits intoNov 10, 2026
Merged
Pedro Henrique Penna (ppenna) merged 3 commits into
Pedro Henrique Penna (ppenna) merged 3 commits into
Conversation
Port the preserved SL2.10 implementation and coupled callers, API snapshots, docs and real-process tests onto feature c52c710 without changing legacy lifecycle policy. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0c8e42ad-4102-451f-96f0-0a4ae0483d1a
Contributor
This pull request changes existing testsIt modifies or removes 50 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests. Test code
Relocated unchanged: 0; added: 12. Compared the merge base |
added 2 commits
November 10, 2026 02:29
Use the existing PID and atomic create-directory retry to retain unique fixture directories without a long diagnostic prefix. Keep the scenario name in creation errors. Capture and restore control sockets now fit approved data-volume temp roots without changing production limits, assertions, timeouts or skipped tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0c8e42ad-4102-451f-96f0-0a4ae0483d1a
Apply the pinned rustfmt wrapping requested by the final-head review; fixture semantics and production source remain unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0c8e42ad-4102-451f-96f0-0a4ae0483d1a
This was referenced Nov 10, 2026
Enrique Saurez (esaurez)
marked this pull request as ready for review
November 10, 2026 12:26
Enrique Saurez (esaurez)
marked this pull request as draft
November 10, 2026 12:26
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues remain for the changes separating confirmed VM exits from report-reading failures.
No open issues 🎉
What changed in this PR
Implements SL2.10 of #1100 in NVX’s host library: VM stop outcomes require confirmed process exit, while report-reading failures remain separate. Legacy lifecycle behavior is preserved; restart-time exit proof remains deferred to SL2.10b.
Changes:
- Adds opaque
Exitedproof, verifiedvm::stop, andStillRunningerrors. - Distinguishes missing reports from read or parse failures, and updates callers, documentation, and API snapshots.
- Adds real-process stop/report coverage, adapts existing tests, and adjusts executable-copy and temporary-directory fixtures.
| File | Description |
|---|---|
tests/runtime-adapter/tests/vm_clone.rs |
Adapts clone tests to typed exit results. |
tests/runtime-adapter/tests/common/mod.rs |
Shortens atomically created sandbox directory names. |
tests/runtime-adapter/src/bin/runtime-adapter-host.rs |
Adapts wait and report handling to the new APIs. |
nvx-rs/tests/supervisor.rs |
Preserves supervisor assertions with typed exit results. |
nvx-rs/tests/store.rs |
Updates cleanup helpers and exit assertions. |
nvx-rs/tests/fake_openvmm.rs |
Updates verified-process lifecycle assertions. |
nvx-rs/tests/cli/lifecycle.rs |
Adapts lifecycle and recycled-process checks. |
nvx-rs/tests/cli/download.rs |
Copies the POSIX executable through an owned child. |
nvx-rs/tests/cli.rs |
Adapts stop and restart exit assertions. |
nvx-rs/tests/checked_handoff.rs |
Requires typed exit confirmation in handoff tests. |
nvx-rs/src/host/vm/tests/reattach.rs |
Updates reattachment exit confirmation. |
nvx-rs/src/host/vm/tests.rs |
Adds real-process stop and report-result coverage. |
nvx-rs/src/host/vm.rs |
Adds confirmed stop outcomes and bounded stop sequencing. |
nvx-rs/src/host/template/store/leases/tests.rs |
Adapts lease recovery and cleanup waits. |
nvx-rs/src/host/template/clone/tests/restore.rs |
Updates restore cleanup exit assertions. |
nvx-rs/src/host/template/clone/tests/launch.rs |
Adapts launch tests to wait and report results. |
nvx-rs/src/host/template/clone/records.rs |
Preserves best-effort report reads for legacy callers. |
nvx-rs/src/host/report/tests.rs |
Tests missing, malformed, and unreadable reports. |
nvx-rs/src/host/report.rs |
Returns report-read errors with their underlying causes. |
nvx-rs/src/host/process/tests/linux.rs |
Preserves last-thread exit checks with typed results. |
nvx-rs/src/host/process/tests.rs |
Updates polling fallback exit assertions. |
nvx-rs/src/host/process.rs |
Introduces opaque exit proof returned by wait. |
nvx-rs/src/host/platform/windows/tests.rs |
Adds a wait-only handle helper and updates exit checks. |
nvx-rs/src/host/instance/locked.rs |
Preserves the legacy best-effort report policy. |
nvx-rs/src/error/tests.rs |
Includes StillRunning in error-code checks. |
nvx-rs/src/error.rs |
Adds StillRunning and its code mappings. |
nvx-rs/README.md |
Documents confirmed stops, exit proof, and report errors. |
nvx-rs/public-api/windows.txt |
Records new Windows public API symbols. |
nvx-rs/public-api/linux.txt |
Records new Linux public API symbols. |
doc/usage.md |
Documents the still-running error code. |
Review effort: Balanced
Enrique Saurez (esaurez)
marked this pull request as ready for review
November 10, 2026 14:29
Pedro Henrique Penna (ppenna)
merged commit Nov 10, 2026
887dc51
into
feature/nvx-refactor
163 of 165 checks passed
Pedro Henrique Penna (ppenna)
deleted the
esaurez/issue1100-sl210-0c8e42ad-20261110
branch
November 10, 2026 14:52
This was referenced Nov 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #1100. Clean Draft reconciliation of #1426 onto
feature/nvx-refactoratc52c7101d4f66313b5f00f23b88530c38e3d0b60.The original PR and its checkpoint branch remain unchanged.
Scope
Return stop outcomes only after a verified process wait confirms exit.
Process::waitreturns opaqueExitedproof orNone;vm::stoppreservesgraceful/forced ordering and reports an unconfirmed exit as
StillRunning.Report errors remain separate from proved exit: only a missing report is
Ok(None), while unreadable or malformed reports retain their I/O causes.Keep the four legacy lifecycle callers on
wait_booland preserve existingbest-effort report policies. Update the directly affected callers, both
public-API snapshots, documentation, and real-process tests. No report schema,
restart-proof process-open API, background service, native runtime, dependency,
or OpenVMM pin change. SL2.10b remains a separate successor.
This ports only the preserved donor range
c7e971607a0ea3b638800b4d90a3fd549685c42b..e4af86899218cde7ad3228b3a63aa678ed19f1c2.The resulting production files are byte-identical to that donor, while the
current feature's restore-failure facts and listener fixes remain present.
The stale PR-recorded base is not treated as an implementation ancestor.
The pinned OpenVMM commit remains
14dc4116ec7e57567633c4b7b07892aca3a58522.The append-only test-infrastructure correction uses compact, atomically created
adapter sandbox names so the unchanged real capture/restore cases can execute
under data-volume temporary directories. Production socket/path limits,
assertions, deadlines, hardware ignores, and guest code remain unchanged.
Size: 101 production lines across seven production files, 30 changed paths,
including the runtime adapter's ten production lines. Tests, docs, and generated
API snapshots are excluded from the core-line count.
Existing tests
All 50 modified tests/helpers are retained and adapted to typed wait/report
results without weakening assertions or changing deadlines, parallelism, or
hardware ignores. The POSIX executable-copy fixture uses an owned child, keeping
writable descriptors out of concurrent CLI children while preserving its
original premise and assertions.
nvx-rs/src/error/tests.rsevery_kind_has_a_code_of_its_own_spellingnvx-rs/src/host/platform/windows/tests.rsa_launch_whose_vmm_exited_ends_while_a_process_spawned_in_its_window_holds_its_lognvx-rs/src/host/process/tests.rshosts_without_pidfds_poll_and_never_signalnvx-rs/src/host/process/tests/linux.rsa_process_runs_until_its_last_thread_exitsnvx-rs/src/host/report/tests.rsreports_are_summarized_without_free_form_fieldsnvx-rs/src/host/template/clone/tests/launch.rsVmmDir::end_and_wait,VmmDir::wait_exit,VmmDir::drop,a_clone_whose_launch_failed_before_it_began_launches_no_more_until_its_release,a_launch_whose_caller_crashes_once_its_vmm_started_ends_the_vmm_as_reattach_recovers_it,a_restore_whose_caller_crashes_before_its_commit_ends_its_vmm_as_reattach_recovers_itnvx-rs/src/host/template/clone/tests/restore.rsassert_vmm_endednvx-rs/src/host/template/store/leases/tests.rsVmmDir::drop,a_clone_that_crashes_after_its_spawn_keeps_its_lease_until_its_unrecorded_vmm_exits,a_clone_that_crashes_after_recording_its_vmm_keeps_its_lease_until_reattach_ends_itnvx-rs/src/host/vm/tests.rsspawn_caller_helper,an_unrelated_process_started_in_the_library_spawn_window_gets_no_vm_claim,current_cold_spawn_boots_a_guest_accepts_shell_input_and_exits_cleanlynvx-rs/src/host/vm/tests/reattach.rsreattaching_returns_the_held_owned_child_and_authenticated_connectionnvx-rs/tests/checked_handoff.rsa_prepared_launch_hands_the_vmm_its_checked_images_alone,a_vmm_keeps_the_scratch_images_claim_once_its_launcher_is_gonenvx-rs/tests/cli.rsa_stop_under_another_identity_never_ends_a_process_that_its_record_does_not_name,stop_reports_its_timeout_and_leaves_the_vm_running,a_sandbox_whose_openvmm_exited_reports_it_once_and_starts_againnvx-rs/tests/cli/download.rsprovision_and_deprovision_need_no_artifact_rootnvx-rs/tests/cli/lifecycle.rscheck_lifecycle,recycled_process_id,lifecycle_of_a_sandbox_whose_upper_is_in_ram,stops_keep_an_outcome_report_that_the_caller_reads_whatever_its_umasknvx-rs/tests/fake_openvmm.rsoutcome_reports_of_another_runtime_are_never_read,records_that_name_another_process_never_end_itnvx-rs/tests/store.rskill,a_committed_launch_names_its_vm_for_another_buildnvx-rs/tests/supervisor.rsVmmDirectory::drop,check_vmm,long_stores_launch_with_a_short_working_directory,a_child_that_exits_wakes_its_waiter,a_process_that_is_not_a_child_wakes_its_waiters,a_restarted_launcher_finds_its_vmm_again_and_ends_it,a_reused_process_id_is_never_signaled,references_that_name_no_process_are_never_opened,an_unrecorded_vmm_that_serves_no_endpoint_is_never_signaled,a_vmm_in_its_orchestrators_job_ends_with_it,a_job_that_ends_its_vmm_wakes_the_waiters,a_process_that_this_user_may_not_terminate_is_waited_for_but_never_signaledtests/runtime-adapter/tests/vm_clone.rsEarly::activate,a_host_program_of_another_runtime_ends_the_clone_through_its_verified_identity,a_clone_whose_vm_exits_once_a_stop_found_it_fails_before_its_lease_is_released,a_run_whose_clone_s_vm_exits_during_its_execution_ends_with_the_clone_s_failuretests/runtime-adapter/tests/common/mod.rsSandbox::new: keep its atomic collision/retry and retained-directory behavior, shorten only its fixture name, and retain the scenario in creation errorsNew coverage exercises self-exit and report outcomes, verified forced exit
after grace, and unconfirmed exit, plus missing, malformed, and unreadable reports.
Qualification status
This is a locally qualified scoped slice, still Draft and not merge-ready.
The exact candidate is
adeb1d4778229fd23b64c2be6cd762df352de382.The following checks ran against that exact final head with fresh, private
head/toolchain-specific targets; no initial-head NVX executable or target was reused.
test layout, Markdown links, committed test-change inventory, and whitespace.
ignored tests in that focused run.
final
c52c7101..adeb1d47slice, including the fixture correction. Its soleformatting blocker was fixed and all 26 changed Rust files passed the pinned
formatting check. The review is read-only, not test evidence.
MSRV matrices, native-source comparisons, and independent adapter
configurations; Linux also checked both API snapshots, macOS, and the static
musl guest binaries.
with one pass, no failure or ignore: cold boot/shell/confirmed exit/report;
four clone fatal paths; corrupt-layer assembly failure; and failed-mapping
teardown. Cases ran serially and confirmed owned VMM teardown between cases.
components retained their true origin and were reused only after complete
current effective-input comparison and copied-byte verification on each host.
Final-head CLI and test executables were built afresh.
none is counted as a pass. No assertion, deadline, hardware ignore, or
production path limit was relaxed.
MSHV is not KVM coverage; KVM was not run. Other ignored hardware tests are
not counted as passes.
No previous-head test result is transferred to this candidate. A native gitlink
match alone does not qualify a guest image. The exact qualified stop producer
has been reported for dependent work before completing SL2.10b or waiting for CI.
Existing checkpoint PRs remain open and unchanged.