Repository navigation
host: prove recorded process exit when opening (SL2.10b) - #1438
Merged
Pedro Henrique Penna (ppenna) merged 1 commit intoNov 10, 2026
Merged
Pedro Henrique Penna (ppenna) merged 1 commit into
Pedro Henrique Penna (ppenna) merged 1 commit into
Conversation
Enrique Saurez (esaurez)
added
the
tests-modified
Contributor
This pull request changes existing testsIt modifies or removes 41 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests. Test code
Relocated unchanged: 0; added: 5. Compared the merge base |
Enrique Saurez (esaurez)
marked this pull request as ready for review
November 10, 2026 14:09
Enrique Saurez (esaurez)
marked this pull request as draft
November 10, 2026 14:09
Base automatically changed from
esaurez/issue1100-sl210-0c8e42ad-20261110
to
feature/nvx-refactor
November 10, 2026 14:52
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
There are no active review issues for the typed process-opening lifecycle changes.
No open issues 🎉
What changed in this PR
Extends NVX’s verified process lifecycle so a restarted caller can distinguish a matching process from a recorded process that has exited. This implements SL2.10b from #1100 on top of #1432’s confirmed-stop support.
Changes:
- Introduces
Opened::{Running, Exited}while preserving process identity checks and error propagation. - Adapts store, supervisor, VM, transport, and test callers without changing legacy recovery policies.
- Adds real-child opening coverage and updates documentation and API snapshots; the supplied diff also includes the parent’s stop/report changes.
| File | Description |
|---|---|
| tests/runtime-adapter/tests/vm_steps.rs | Matches the running VMM explicitly during paused launches. |
| tests/runtime-adapter/tests/vm_clone.rs | Adapts clone checks to typed opening and exit proof. |
| tests/runtime-adapter/tests/common/mod.rs | Adapts VMM lookup and shortens sandbox fixture paths. |
| tests/runtime-adapter/src/bin/runtime-adapter-host.rs | Handles typed waits and fallible report reads. |
| nvx-rs/tests/template_capture.rs | Adapts orphan cleanup to Opened::Running. |
| nvx-rs/tests/supervisor.rs | Preserves lifecycle assertions with typed process results. |
| nvx-rs/tests/store.rs | Adapts process recovery and cleanup assertions. |
| nvx-rs/tests/fake_openvmm.rs | Updates restart and identity-safety checks. |
| nvx-rs/tests/cli/lifecycle.rs | Adapts recorded-process and exit assertions. |
| nvx-rs/tests/cli/download.rs | Copies the Unix executable through an owned subprocess. |
| nvx-rs/tests/cli.rs | Updates process lookup and lifecycle assertions. |
| nvx-rs/tests/checked_handoff.rs | Requires exit proof after handoff scenarios. |
| nvx-rs/src/host/vm/tests/reattach.rs | Checks typed exit proof after reattachment. |
| nvx-rs/src/host/vm/tests.rs | Adapts opening checks and tests confirmed-stop outcomes. |
| nvx-rs/src/host/vm.rs | Adapts saved-process verification and adds confirmed stop. |
| nvx-rs/src/host/transport/tests.rs | Preserves peer-refusal process-survival checks. |
| nvx-rs/src/host/transport.rs | Handles explicit exit results before connecting. |
| nvx-rs/src/host/template/store/leases/tests.rs | Adapts lease recovery and cleanup checks. |
| nvx-rs/src/host/template/clone/tests/restore.rs | Updates restore process-state assertions. |
| nvx-rs/src/host/template/clone/tests/launch.rs | Adapts launch recovery, cleanup, and report checks. |
| nvx-rs/src/host/template/clone/records.rs | Preserves best-effort report handling. |
| nvx-rs/src/host/supervisor/reattach.rs | Maps typed opening results into existing recovery logic. |
| nvx-rs/src/host/store/vmm.rs | Preserves optional live-process lookup. |
| nvx-rs/src/host/store/locked.rs | Adapts identified-launch recovery to Opened. |
| nvx-rs/src/host/restore/tests.rs | Updates the held-process fixture. |
| nvx-rs/src/host/report/tests.rs | Distinguishes missing, malformed, and unreadable reports. |
| nvx-rs/src/host/report.rs | Returns report-read errors separately from missing reports. |
| nvx-rs/src/host/process/tests/linux.rs | Preserves final-thread and non-UTF-8 identity coverage. |
| nvx-rs/src/host/process/tests.rs | Adds recorded-child identity and reaped-child exit coverage. |
| nvx-rs/src/host/process.rs | Defines typed opening results and opaque exit proof. |
| nvx-rs/src/host/platform/windows/tests.rs | Adds a wait-only handle fixture and adapts exit checks. |
| nvx-rs/src/host/instance/locked.rs | Retains the legacy best-effort report policy. |
| nvx-rs/src/error/tests.rs | Includes StillRunning in error-code coverage. |
| nvx-rs/src/error.rs | Adds the StillRunning kind and code mappings. |
| nvx-rs/README.md | Documents opening, exit proof, stop, and report behavior. |
| nvx-rs/public-api/windows.txt | Records the Windows public API additions. |
| nvx-rs/public-api/linux.txt | Records the Linux public API additions. |
| doc/usage.md | Documents the still-running error code. |
Review effort: Balanced
Return Running or opaque exit proof after checking the recorded identity. Preserve indeterminate errors and current VM/transport verification policies. Keep the existing exit-handle and recovery tests alongside opening proof cases. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0c8e42ad-4102-451f-96f0-0a4ae0483d1a
Enrique Saurez (esaurez)
force-pushed
the
esaurez/issue1100-sl210b-0c8e42ad-20261110
branch
from
November 10, 2026 15:25
92ac710 to
b5f66d7
Compare
Enrique Saurez (esaurez)
marked this pull request as ready for review
November 10, 2026 15:45
Pedro Henrique Penna (ppenna)
merged commit Nov 10, 2026
2d68390
into
feature/nvx-refactor
106 of 107 checks passed
Pedro Henrique Penna (ppenna)
deleted the
esaurez/issue1100-sl210b-0c8e42ad-20261110
branch
November 10, 2026 16:34
This was referenced Nov 10, 2026
This was referenced Nov 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #1100. Separate SL2.10b successor to #1432, based on its qualified
adeb1d4778229fd23b64c2be6cd762df352de382stop producer.The ultimate base remains
feature/nvx-refactoratc52c7101.Scope
Process::openreturnsio::Result<Opened>: either a held, identity-verifiedRunning(Process)orExited(Exited), carrying opaque exit proof. Theexisting boot, process ID, and start-time verification remains authoritative.
Permission and indeterminate failures remain errors, never exit proof.
Adapt the existing store and supervisor consumers without changing their
recovery policies. Also reconcile the current parent's VM verification and
verified-transport callers, which the historical donor did not contain:
preserve runtime-check ordering, peer identity checks,
Exited/Iokinds,NotFoundand original I/O sources, and the crate's single public Error/Result.No new dependency, error crate, process implementation, guest code, OpenVMM
pin, report schema, or background service is introduced.
Port only
d1a64911and API-snapshot-only78c94958from the preserved7bca08c5..78c94958donor range. Do not replay its historical parent chain.The old donor refs and the separately qualified stop producer remain unchanged.
Measured slice: 26 changed paths, 286 insertions/121 deletions.
The six production files have 94 changed lines including documentation,
imports, and blank lines; the two additional current callers are necessary
integration, not unrelated scope.
Existing tests
All 41 modified existing tests/helpers retain their premises, assertions,
deadlines, and hardware ignores. Changes replace optional-process assertions
with explicit
Openedvariants and retain verified waits:Five new tests/helpers include the two focused real-child opening cases:
only the matching recorded identity is
Running; another boot/start time isproved exited without ending the live child; and a reaped child produces exit
proof. The current strict child guard is reused, while the existing exit-handle
test and newer snapshot-artifact helpers are preserved. The parent's compact,
atomic test-sandbox naming fix is unchanged.
Qualification status
Locally qualified scoped successor; still Draft and not merge-ready.
Exact candidate:
92ac710d5ed88e0d14c4f36b2a7aafa9f7573f13.whitespace checks, and committed test-change inventory.
adeb1d47..92ac710dslice, including every modified test/helper's full bodyand all five added items. The actual profile was independently verified from
native configuration records.
source/head/toolchain-specific targets. This includes the feature, five-mode
Clippy, documentation, MSRV, native-source and standalone adapter matrices;
Linux also checked both API snapshots, macOS, and fresh static guest binaries.
case per platform, and three real-process stop cases per platform, all with
zero failures or ignores.
one pass and no failure or ignore: cold boot/shell/confirmed exit/report,
four clone fatal paths, corrupt-layer assembly failure, and failed-mapping
teardown. Cases ran serially and confirmed owned VMM teardown between cases.
matched complete current effective inputs and copied bytes on each host.
Final-head NVX CLI, test, and host-adapter executables were built afresh.
A gitlink match alone did not qualify any guest image.
KVM was not run; MSHV is not KVM coverage. Other ignored hardware tests and
parent-head results are not counted as passes for this candidate.
The actual intended published parent is #1432. Shared-parent joins and native
stack metadata remain coordinator-owned; this Draft adds no artificial chain.