Repository navigation
host: open strict private snapshot directories - #1440
Merged
Pedro Henrique Penna (ppenna) merged 1 commit intoNov 10, 2026
Merged
Pedro Henrique Penna (ppenna) merged 1 commit into
Pedro Henrique Penna (ppenna) merged 1 commit into
Conversation
Enrique Saurez (esaurez)
added
the
tests-modified
Contributor
This pull request changes existing testsIt modifies or removes 2 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests. Test code
Test policy
Relocated unchanged: 0; added: 24. Compared the merge base |
This was referenced Nov 10, 2026
Base automatically changed from
esaurez/issue1100-sl210-0c8e42ad-20261110
to
feature/nvx-refactor
November 10, 2026 14:52
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues were identified for the strict snapshot-directory reader and related process-exit API updates.
No open issues 🎉
What changed in this PR
Adds the strict snapshot-directory reader for #1102, building on the confirmed VM-stop behavior from #1432. This prepares NVX’s host library for future restores without adding capture, restore, or snapshot-writing behavior.
Changes:
- Add
Snapshot::open, metadata accessors, and fixed entry names, validating private layout, artifact lengths, and key/manifest consistency without readingsnapshot.json. - Include the dependency’s typed process-exit confirmation and separate report-read errors, with callers adapted to those APIs.
- Extend validation tests, update API inventories, and document snapshot immutability and stop outcomes.
| File | Description |
|---|---|
tests/runtime-adapter/tests/vm_clone.rs |
Adapt clone assertions to typed exit confirmation. |
tests/runtime-adapter/tests/common/mod.rs |
Shorten sandbox paths while retaining creation diagnostics. |
tests/runtime-adapter/src/bin/runtime-adapter-host.rs |
Handle typed waits and report-read errors. |
scripts/test-layout-allowlist.json |
Register the snapshot directory’s unused-field expectation. |
nvx-rs/tests/supervisor.rs |
Adapt supervisor waits and cleanup checks. |
nvx-rs/tests/store.rs |
Adapt store tests to typed exit confirmation. |
nvx-rs/tests/fake_openvmm.rs |
Preserve lifecycle assertions with typed waits. |
nvx-rs/tests/cli/lifecycle.rs |
Update lifecycle exit and timeout assertions. |
nvx-rs/tests/cli/download.rs |
Copy the Unix executable through a child process. |
nvx-rs/tests/cli.rs |
Adapt CLI process-exit assertions. |
nvx-rs/tests/checked_handoff.rs |
Require typed exit confirmation in handoff tests. |
nvx-rs/src/host/vm/tests/reattach.rs |
Update reattachment’s exit assertion. |
nvx-rs/src/host/vm/tests.rs |
Use a valid snapshot fixture and test confirmed stop outcomes. |
nvx-rs/src/host/vm.rs |
Add confirmed stopping with separate report results. |
nvx-rs/src/host/template/store/leases/tests.rs |
Adapt lease cleanup and recovery waits. |
nvx-rs/src/host/template/clone/tests/restore.rs |
Update restore cleanup’s exit assertion. |
nvx-rs/src/host/template/clone/tests/launch.rs |
Adapt launch tests to wait and report APIs. |
nvx-rs/src/host/template/clone/records.rs |
Preserve best-effort report handling. |
nvx-rs/src/host/snapshot/tests.rs |
Add strict-layout, privacy, metadata, and unread-description tests. |
nvx-rs/src/host/snapshot/key/tests.rs |
Test rejection of inconsistent key contracts and filesystem tags. |
nvx-rs/src/host/snapshot/key.rs |
Check key consistency with the manifest and format contracts. |
nvx-rs/src/host/snapshot.rs |
Implement strict directory opening and metadata accessors. |
nvx-rs/src/host/report/tests.rs |
Distinguish missing, malformed, and unreadable reports. |
nvx-rs/src/host/report.rs |
Return report-read errors instead of treating them as absence. |
nvx-rs/src/host/process/tests/linux.rs |
Adapt last-thread exit checks to typed waits. |
nvx-rs/src/host/process/tests.rs |
Adapt polling-fallback assertions. |
nvx-rs/src/host/process.rs |
Return opaque exit proof from Process::wait. |
nvx-rs/src/host/platform/windows/tests.rs |
Add a wait-only handle helper and update exit assertions. |
nvx-rs/src/host/instance/locked.rs |
Retain legacy best-effort report behavior. |
nvx-rs/src/error/tests.rs |
Include StillRunning in error-code coverage. |
nvx-rs/src/error.rs |
Define and map the StillRunning error. |
nvx-rs/README.md |
Document strict snapshots, confirmed stops, and report errors. |
nvx-rs/public-api/windows.txt |
Record the new Windows-visible public APIs. |
nvx-rs/public-api/linux.txt |
Record the new Linux-visible public APIs. |
doc/usage.md |
Document the still-running error code. |
Review effort: Balanced
Validate the fixed snapshot layout, private regular files, bounded metadata and key/manifest agreement without reading snapshot.json. Retain the caller immutability contract and cover Linux/Windows refusal cases. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6789d491-7d13-4929-bc64-4edfec93ba60
Enrique Saurez (esaurez)
force-pushed
the
esaurez/issue1102-sl212b-20261110-6789d491
branch
from
November 10, 2026 17:15
797d300 to
4b29646
Compare
Enrique Saurez (esaurez)
marked this pull request as ready for review
November 10, 2026 17:21
Pedro Henrique Penna (ppenna)
merged commit Nov 10, 2026
cf5f914
into
feature/nvx-refactor
88 checks passed
Pedro Henrique Penna (ppenna)
deleted the
esaurez/issue1102-sl212b-20261110-6789d491
branch
November 10, 2026 17:39
This was referenced Nov 11, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #1102. Reconstructs the SL2.12b strict-reader slice from #1428;
the original source PR, branch, and qualification records are preserved.
This PR directly targets
feature/nvx-refactor, after the original SL2.10parent in #1432 merged. The current reader-only linear replay is:
4b296464831d3b246e914750dbcd3b85baa3c4ecd260f1cacae54aa182835b34b4bebe61625cea72b253a3dd1f6698684177223ea0e1abcccac3801614dc4116ec7e57567633c4b7b07892aca3a58522Only the entire own reader delta was replayed, not historical producer
commits. The real range-diff against the original
adeb..797is unchanged(
1 = 1), with stable patch IDc342605fa1dd93d19add7e18a096379f5916db67. The replay had no conflicts andpreserves every incoming base change, including the
Openedprocess API,the journal/persistent-VM changes, and the guest capture series. No child
branch was rewritten or retargeted.
Changes
Snapshot::open,key, andmanifest, plus the three fixed entry names.bounded metadata, matching artifact lengths, and key/manifest consistency.
snapshot.jsonwithout reading, parsing, or trusting its contents.immutable; opening neither watches files nor retains handles.
No compatibility checks, capture creation, snapshot writer, store, migration,
guest change, or VMM argument change is included.
Measured scope: 150 core lines in 3 counted files; 9 changed paths.
The third counted file is the one-line test-layout registry entry for the
snapshot directory field's production-only unused-field expectation.
Existing tests
a_missing_boot_and_a_snapshot_are_refused_before_any_output_is_creatediskept with the same refusal assertions, using a complete snapshot fixture
instead of the former opaque placeholder. The test-layout registry adds the
single snapshot metadata seam; no assertion or executable test is disabled.
Focused cases cover missing/extra/wrong-kind entries, private ownership and
Unix permissions or Windows ACLs, links/reparse points, artifact lengths,
strict manifest/key decoding, key consistency, and a description without
data-read permission. Existing metadata tests remain in their test modules.
The unchanged reader patch contains 2 existing-test/policy changes and
24 additions.
Qualification and provenance
Independent exact-current-head native Opus 5.5 review is clean for
4b296464831d3b246e914750dbcd3b85baa3c4ec; its actual configured profileand usage were verified as maximum reasoning and long context.
The explicit clean-rebase decision binds the original reader qualification
at
797d300557e54644f0a8e66ba729de0dcf1884fb, tree5e3e00fc7d1cd9ad9b2580b4527ceaced38941ee, to the unchanged reader patch onthe current actual base. No additional local builds, test matrices, or VM
jobs were run solely for this conflict-free rebase.
The original own Linux and Windows software matrices passed at 797:
focused snapshot tests, formatting and warnings-denied Clippy configurations,
all-feature/default/no-default tests, docs, Rust 1.89 checks, artifact
bundling, and applicable runtime-adapter configurations. Linux additionally
passed both-platform API snapshots, macOS checking, and guest-binary
lint/build/tests. Layout, Markdown, and scoped test-change checks passed.
Those focused tests passed 69 cases on Linux and 68 on Windows. The initially
ignored Linux foreign-owner case was then run separately as the single
privileged test against the normally compiled 797 binary and passed with
no ignored cases. Its private fixture boundary and binary hash were recorded
before execution. Other ignored runtime fixtures are not runtime passes.
The original Windows SSH reset was reconciled against its durable successful
job result and ended process; no command was replayed.
The current whole host-source tree differs because the incoming base is
preserved. The original 797 binaries, hashes, execution logs, and Git
provenance remain associated with 797; they have not been relabeled as
built or run at 4b296. Git HEAD and first-parent release discovery remain
ancestry-sensitive; no nearest-release substitute was used as current-source
execution proof.
Current-head GitHub review and automatic CI results are reported by GitHub.
No new VM runtime, KVM runtime, full-CI success, formal approval, or merge
claim is implied by the historical local reader qualification.