[Enrique Saurez (esaurez)]

Part of #1076; implements the remaining SL2.8b slice of #1099.

Current settings integration

Current head is 4fdf55db0384354980a1267f64b5701d500969b8 / tree 2db5b7cfaa040d45ff217596b554037d13ccd641, replaying only the six owned commits in 4192cfd1..00245fd2 onto immutable feature input eba4c8b6a6a1dfe2ed1af4b11bcc35ec822483fe. The actual original remote 00245fd2d464fbeb23eca84624585bbf6aa96794 was captured before preparation and retained as the exact publication lease. OpenVMM remains 14dc4116ec7e57567633c4b7b07892aca3a58522.

The only manual conflict was adjacent README descriptions. Both complete descriptions survive; two rustdoc lines and a README note explain reading nic() or building activation_record(tx) before consuming Prepared. There is no new production or API logic reconciliation: the seven nonoverlapping owned source/test blobs remain byte-identical to 00245fd2; the VM source and tests are the automatic union, apart from those two rustdoc lines. The incoming checked-settings/getter and create bodies match EBA4 exactly, and into_command's complete ownership-transfer body matches 00245fd2 exactly. Every other incoming entry is retained. Both API listings are the exact additive union, retaining the command/supervisor and incoming settings entries. Snapshot compatibility, NIC, time and geometry code is unchanged.

The strict trusted Windows log-job refusal before child creation, ordinary-spawn permissive behavior, confirmed cleanup/reaping, original error propagation, retained exit identity and external-example failure cleanup are all unchanged. No producer aggregate, old private partial, descendant or native history was replayed. Rebase-specific measured change: 0 new core lines and 0 new production files; the only novel edits are explanatory documentation.

Actual new-source compilation

This exact prepared head/tree passed before publication on both approved Linux and Windows hosts, using Rust/Cargo 1.95.0, NVX_BUNDLE=skip, exact initialized native source and real task-private Git metadata. scripts/nvx.py verify passed before Cargo. Linux completed at 2026-11-10T22:25:01Z and Windows at 2026-11-10T22:25:51.3296088Z. Each platform passed:

cargo +1.95.0 check --locked --manifest-path nvx-rs/Cargo.toml --all-targets --all-features
cargo +1.95.0 check --locked --manifest-path nvx-rs/Cargo.toml --no-default-features --features host --example external-launch
cargo +1.95.0 check --locked --manifest-path tests/runtime-adapter/Cargo.toml --all-targets --features host

Windows used native backslash paths and initialized MSVC in the same cmd.exe process as each Cargo command. These are compilations, not test executions. Crate and adapter formatting passed on both hosts. Linux generated and compared both platform API snapshots successfully. The scoped layout, Markdown and test-accounting checks passed; module rows remain at most 188 characters. Against the selected feature input, the inventory remains 2 existing tests modified, 0 relocated and 8 added, all retained from the owned six. The origin/dev inventory is inherited workstream accounting, not this PR's own test or execution count. Both owned drivers and their processes are closed, with private mutable targets/caches and fresh physical/commit/disk admission recorded.

No tests, MSRV/full matrix, new native or manual Copilot review, kernel, guest or VM work was repeated solely for this unchanged logical replay. The private d1c27903 composition was an uncompiled reference only, never a donor or fresh quality proof. Historical F9's ordered positive reviews and affected checks stay F9-only. Separately, Main run 42898037924 passed on prior 00245fd2 with 34 successful jobs and 9 expected skips; it is not CI for this new head. Current-head automatic CI remains for the coordinator; no CI watch, merge, auto-merge or Ready/Draft transition is requested or performed.

Preserved implementation and historical provenance

The complete corrected six-commit owned-command delta from original fork cf5f91467c050f1e9508403964b1b4546e2724ab through f9cdd2f55a176e892cca60726278d87b6036ad55 is replayed onto actual feature/nvx-refactor input 4192cfd1bbd2aa2a428fcb6eaa64ca042510ea62. That earlier head was 00245fd2d464fbeb23eca84624585bbf6aa96794 / tree 3a438ac6962a850bfca395dfa6656703fb5431e1, with unchanged OpenVMM gitlink 14dc4116ec7e57567633c4b7b07892aca3a58522. The only manual conflict resolution combined adjacent README module rows, retaining the owned cold-command/confirmed-stop description and the current snapshot compatibility/NIC/time description. Both API listings retain their exact additive union. All nine owned non-documentation blobs and the complete logical owned delta are byte-identical to F9; all four incoming snapshot source/test blobs are identical to the feature input. No production or API behavior was reconciled or changed.

Change

Prepared::into_command() moves the checked program, arguments, working directory, capability, outputs, inherited resources, opened log and Windows breakaway setting into host::vm::VmmCommand. InheritedHandle owns its resource, accepts standard Unix OwnedFd or Windows OwnedHandle, and provides borrowed views and ownership-preserving reverse conversions. Nothing is reopened, duplicated or rendered again.

The compiled external-launch example consumes this command without a sandbox store. It checks the guest's boot marker and shell response, actual VMM exit status 0, a successful outcome and complete teardown. Status-bearing supervisor::Launched::wait_timeout is available to host-only callers. The example consumes the verified Process::wait exit proof and propagates strict outcome-reader errors.

The first Copilot finding was fixed by exposing and using the existing strict supervisor::spawn_vm path. On Windows an untrusted log-job name is refused before child creation instead of falling back without the required job. Ordinary supervisor::spawn retains its existing permissive behavior. Both public-API snapshots include the strict entry point. Copilot's completed review on 874b16f9 resolved that first finding.

The follow-up setup-failure cleanup finding is addressed by exposing and reusing the existing Launched::kill_and_confirm_exit operation. Its strict implementation is unchanged. Every post-spawn setup failure in the example uses confirmed termination/reaping and preserves both the original error and any cleanup error. Ordinary bounded kill_and_wait remains unchanged. This fix was published at f9cdd2f5; its positive after-check GitHub Copilot review completed on that exact F9 source. That review is historical F9 evidence, not a review of the newly replayed head.

Directory privacy, creation/rollback, relative-input resolution, final command-line preflight and library VM spawn contracts remain intact. No restore implementation, new launcher framework, native pin change or unrelated parent/child rewrite is included.

Test changes

• Adapted the_log_and_inherited_resources_stay_open_without_reopening_their_paths to consume the owned inheritance wrapper, retaining its original-file and replacement-file assertions.
• Added ownership/vector/resource identity and standard owned descriptor/handle conversion cases.
• Added a public-API fixture checking zero timeout, actual exit statuses 0 and 17, and repeated retained status reads. Those original assertions remain; the fixture also checks strict cleanup after the child has already been reaped.
• Added a real running-child strict-cleanup regression. An independently held Process observes the child alive before cleanup and confirms exit after Launched is consumed.
• Added real Windows empty/world-access ACL job, event-name and object-manager-link collision cases. The existing inheritance-window observation proves refusal before child creation; a successful launch after removing the collisions proves that the observation is live.
• Extended the existing NUL/pipe-log test to require strict rejection while retaining ordinary-spawn success assertions. No assertions, deadlines or existing coverage were weakened or retired.

Earlier exact-00245 prepared-code compilation

The actual prepared 00245fd2d464fbeb23eca84624585bbf6aa96794 / tree 3a438ac6962a850bfca395dfa6656703fb5431e1 was compiled before publication on both approved hosts with Rust/Cargo 1.95.0, NVX_BUNDLE=skip, exact initialized OpenVMM source and real task-private Git metadata. scripts/nvx.py verify passed before Cargo. Linux completed at 20:28:39 UTC and Windows at 20:30:08 UTC on 2026-11-10; both commands below exited 0 on each platform:

cargo +1.95.0 check --locked --manifest-path nvx-rs/Cargo.toml --all-targets --all-features
cargo +1.95.0 check --locked --manifest-path tests/runtime-adapter/Cargo.toml --all-targets --features host

Windows used native backslash paths and initialized MSVC in the same cmd.exe process as each Cargo command. These commands compile the affected test and example targets without executing tests. Private targets/caches were used, and both owned drivers and their processes are closed. The mechanical README resolution passed the repository Markdown checker; every module row is at most 188 characters. No tests, native/manual Copilot review, MSRV matrix, VM, guest, kernel or OpenVMM runtime build was rerun solely for this unchanged rebase. Older execution/review tuples below are not relabeled as fresh results for this head.

After preparation, the feature branch independently advanced to db39a5d609eb6863f96a8c33f5e3fcaa71339e33 with unrelated CLI-store liveness changes. An approved read-only merge-tree probe integrated that tip cleanly, preserving every incoming store entry and every owned entry byte-identically, with native14dc unchanged. Its hypothetical integration tree 13d12c77edab2fbe7b45f59931a5a0f9d3bef5d6 was not compiled or executed; the fresh both-host compilation above applies only to actual 00245fd2d464fbeb23eca84624585bbf6aa96794. The original pinned input and F9 publication lease remain unchanged; no second replay was performed for target movement.

Earlier exact-F9 validation

The following are actual executions of f9cdd2f55a176e892cca60726278d87b6036ad55 / tree 6df934ea36f0f13edcff7a2bcc426bac564323f2, on base cf5f9146 with unchanged OpenVMM gitlink 14dc4116.

• Linux: focused cleanup 2 passed; affected VM/spawn/process/report units 64 passed, 3 ignored; checked handoff 5 passed, 3 ignored.
• Windows: focused cleanup 2 passed; affected selection 62 passed, 3 ignored, including the real untrusted log-job collision case; checked handoff 5 passed, 2 ignored.
• Both hosts: source verification, formatting, explicit host-only external-example compilation, all-target/all-feature and scoped host/CLI/testing Clippy, rustdoc with warnings denied, MSRV all-target/all-feature checks, dependent adapter host/protocol checks on stable and MSRV, test layout and Markdown checks passed. Linux also passed generated comparison of both public-API snapshots.
• Actual toolchains were Rust/Cargo 1.95.0 and MSRV Rust 1.89.0. These runs used fresh private source/toolchain/target/cache/TMP roots; actual transferred recipes, bundle hashes and source identities were independently checked. Owned build/test drivers are closed.
• Independent native source review was clean for this exact f9cdd2f5 / tree 6df934ea, including the cleanup contract, unchanged strict-helper implementation, complete checked-handoff test and example bodies, and unchanged affected bodies bound by identical git blobs. That static review is separate from tests and GitHub Copilot review.
• The earlier Windows 1425bd32 attempt failed formatting before compilation or tests. Linux 1425bd32 was never launched. The normal f9cdd2f5 formatting successor is the input that actually passed the checks above; no earlier failed or unexecuted attempt is relabeled as passing.

Counts are per command, not sums of distinct tests. Ignored tests are not runtime passes. No hardware VM, guest image, kernel or OpenVMM build/boot was run for this cleanup fix; the cold-runtime case remains explicitly ignored.

This PR is Ready, with that existing state preserved. The ordered exact-F9 round completed: positive Copilot review 5847760798 at 19:08:21 UTC; final affected checks on Windows at 19:46:28 UTC and Linux at 19:47:01 UTC; then after-check Copilot review 5848434774 at 19:56:48 UTC on 2026-11-10. The latter is an actual submitted COMMENTED review recommending approval with no active or open issues, not formal human approval. These tests and reviews remain F9-only provenance. The unchanged mechanical replay does not repeat that ordered round. These historical results do not qualify the current settings-integration head. Current-head automatic CI remains a separate coordinator gate; no new CI result is claimed here. No merge or auto-merge is requested.

Earlier validation provenance

• Actual Linux input b212ff2b: affected VM/spawn/process/report units 62 passed, 3 ignored; checked handoff 4 passed, 3 ignored. Source verification, formatting, Clippy variants, rustdoc, both-platform generated API comparison, MSRV, dependent adapter checks, explicit host-only example compilation, test layout and Markdown checks passed.
• Actual Windows input ba55c7c0: focused real-name collision regression 1 passed; affected VM/process/report/inheritance/log-job tests 62 passed, 3 ignored; checked handoff 4 passed, 2 ignored. Source verification, formatting, Clippy variants, documentation, MSRV, dependent adapter checks, explicit host-only example compilation, test layout and Markdown checks passed. Owned-task process closure was recorded.
• These earlier actual execution identities are retained. The approved rebase policy bound them to the unchanged logical PR patch and qualified incoming changes; they are not represented as executions on 874b16f9 or f9cdd2f5. The snapshot-reader import updated an existing upstream VM-test fixture; no PR-owned production logic changed.
• The documentation-only rebase resolution passed the existing Markdown/link checker; the VM and snapshot purpose rows remain below 200 characters.
• Earlier independent native source review was clean for exact 874b16f9 / tree e8876dcc / base cf5f9146, including all seven then-affected test bodies and the incoming snapshot-opening API interaction. Unchanged bodies were explicitly bound by identical git blobs; the updated VM test file was read in full. This remains historical static-review evidence, not GitHub approval of the corrected head.

Historical qualification only

The preserved 123e93ed input qualified the original handoff with compiled-example cold launches on MSHV and WHP, relative artifact inputs, real boot/shell markers, VMM and example exit status 0, successful outcome and complete teardown.

Full CI for 123e93ed passed with 43 jobs: 34 successful and 9 expected skips, including the required status check and executed KVM, MSHV and WHP jobs. That run does not qualify this rebased source or any descendant.

[github-actions]

This pull request changes existing tests

It modifies or removes 2 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified test	fn a_vmm_whose_log_is_no_file_of_a_disk_volume_starts_without_a_job in host::platform::windows::tests	nvx-rs/src/host/platform/windows/tests.rs:1014	nvx-rs/src/host/platform/windows/tests.rs:1091
modified test	fn the_log_and_inherited_resources_stay_open_without_reopening_their_paths in host::vm::tests	nvx-rs/src/host/vm/tests.rs:1418	nvx-rs/src/host/vm/tests.rs:1418

Relocated unchanged: 0; added: 8. Compared the merge base 9298cd72d5b3 with cfb4363ebc98.

[Copilot]

🟡 Changes recommended

The Windows example can launch the VMM without its required log-named job when an untrusted object occupies that name, violating the launch contract and requiring a strict no-fallback spawn path with test coverage.

1 open issue

• Reject Windows launches when the log-named job is untrusted · New

What changed in this PR

This PR advances the library-focused refactor by letting callers take ownership of a checked cold-launch command without reopening resources or rebuilding arguments.

Changes:

• Adds Prepared::into_command(), an owned VmmCommand, and platform-owned resource conversions.
• Exposes status-bearing waits to host-only callers and adds ownership and exit-status regression tests.
• Adds a compiled external-launch example, documentation, and updated public API snapshots.

File	Description
nvx-rs/​tests/​checked_handoff.rs	Tests actual exit statuses and repeated status reads.
nvx-rs/​src/​host/​vm/​tests.rs	Tests moved command data and resource identity.
nvx-rs/​src/​host/​vm.rs	Adds owned launch commands and inherited-resource wrappers.
nvx-rs/​src/​host/​spawn.rs	Exposes timed waits and documents process lifetime.
nvx-rs/​src/​host/​platform/​windows/​spawn.rs	Enables Windows status waits without the CLI feature.
nvx-rs/​README.md	Documents command ownership and example usage.
nvx-rs/​public-api/​windows.txt	Records the Windows public API additions.
nvx-rs/​public-api/​linux.txt	Records the Linux public API additions.
nvx-rs/​examples/​external-launch.rs	Demonstrates caller-owned launch and shutdown checks.
nvx-rs/​Cargo.toml	Registers the host-feature external-launch example.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Failed process verification can leave an unverified, unrecorded VMM running because cleanup may abandon the child instead of confirming termination and reaping it, violating the setup-failure contract.

1 open issue

• Ensure failed setup terminates and reaps the VMM child · New

1 resolved since last review

• Reject Windows launches when the log-named job is untrusted

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the owned-command handoff and external-launch lifecycle changes.

No open issues 🎉

1 resolved since last review

• Ensure failed setup terminates and reaps the VMM child

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues block the owned cold-launch handoff.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are reported for the checked-command ownership handoff and store-free launch changes.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the checked-command ownership and store-free launch changes.

No open issues 🎉

_{Review effort: Balanced}

[Pedro Henrique Penna (ppenna)]

Rebased onto the current feature/nvx-refactor

feature/nvx-refactor moved nine commits ahead of this pull request's base, from eba4c8b6 to 9298cd72. Those commits add capture preparation, immutable named CLI snapshots, and unique adapter sandbox names. The pull request then conflicted with its base, so I rebased its six commits onto 9298cd72. The new head is cfb4363ebc981a3810d5f6f910ba01bc94a99708, and the OpenVMM gitlink stays at 14dc4116. I pushed with a lease on 4fdf55db.

Conflict resolution

Two files conflicted, both in the first commit (host: hand owned cold-launch commands to callers), and I kept both sides of each:

• nvx-rs/src/host/vm.rs: the imports now hold the base's CaptureContext together with this pull request's module-only spawn import, because vm::VmmCommand is defined locally. Prepared holds both inherit: Vec<InheritedHandle> and the base's capture_context. Prepared::capture_context() and Prepared::into_command() both remain.
• nvx-rs/README.md: the nvx::host::vm module row combines both descriptions. It reads "cold and capture preparation, owned cold-launch command" and is 188 characters long, within the 200-character limit.

I made one reconciliation edit, to documentation only. into_command() moves fields out of Prepared, so it drops the new capture context, just as vm::spawn does. Its rustdoc and the README note now name capture_context among the things to read before Prepared is consumed, next to nic() and activation_record(tx). No production logic changed.

git range-diff shows that commits 4 to 6 are identical. Commits 2 and 3 differ only in diff context from the public-API listing and the README; both API listings are still the exact union. The test-change inventory against the new base is unchanged: 2 existing tests modified, 0 relocated, and 8 added.

Review status

Both review threads were already resolved, and Copilot's review of 4fdf55db reported no open issues. Because this rebase adds reconciled content, I requested a fresh Copilot review of cfb4363e. That review recommends approval, with no open issues and no inline comments.

Validation of cfb4363e

I ran these on Windows with Rust 1.95.0 and MSRV 1.89, with NVX_BUNDLE=skip:

• python scripts\nvx.py verify: passed.
• check-nvx-rs: cargo fmt --all --check, all five clippy variants with -D warnings, and cargo doc --no-deps --all-features with RUSTDOCFLAGS=-D warnings passed. cargo +1.89 check --all-targets --all-features also passed.
• Tests: cargo test --locked --all-features passed, including 1373 library tests with 10 ignored and checked_handoff with 5 passed and 2 ignored. cargo test --locked passed 1189 library tests with 9 ignored. cargo test --locked --lib --no-default-features passed 283.
• python scripts\public_api.py: both platform snapshots match.
• Runtime adapter: the protocol-only and host-only configurations passed fmt, clippy, build, test, doc and the MSRV check.
• check_markdown_links.py, check_test_layout.py, the README module-row unit test, and check_test_changes.py --base origin/feature/nvx-refactor passed.

I left the Linux-only steps and the microVM scenarios to CI. CI run 42927818503 passed on cfb4363e, with 34 jobs successful and 9 expected skips, including Required status check and the KVM, MSHV and WHP jobs.

The description's "Current settings integration" section still describes the earlier head 4fdf55db; this comment records the rebase.