guest: let nvx-ingress start spawn its announcer itself (SL6.13c)

doc/acceptance-case-matrix.md

@@ -27,7 +27,7 @@ its own in turn.
 | Section | Tests | Kept | Rewritten | Retired |
 | --- | ---: | ---: | ---: | ---: |
 | [The adapter's scenarios](#the-adapters-scenarios) | 157 | 0 | 114 | 43 |
-| [The adapter's other tests](#the-adapters-other-tests) | 166 | 0 | 9 | 157 |
+| [The adapter's other tests](#the-adapters-other-tests) | 169 | 0 | 9 | 160 |
 | [MicroVM scenarios](#microvm-scenarios) | 52 | 49 | 3 | 0 |
 | [CI](#ci) | 69 | 43 | 3 | 23 |
 | [Docs](#docs) | 34 | 33 | 1 | 0 |
@@ -277,6 +277,7 @@ check the adapter's own code, and CI runs in its configurations of the adapter.
 | `src/worker/executions/tests.rs` | `a_cancellation_after_the_timeout_leaves_a_program_that_ended_before_it_its_own_end` | retired | The adapter's guest worker, over the exec engine that leaves (#1087) |
 | `src/worker/mapping/tests.rs` | `refusals_name_their_kind_and_path`, `the_probes_take_named_targets_and_paths_in_the_export` | retired | The adapter's guest worker and its probes |
 | `src/worker/probes/tests.rs` | `a_mount_table_is_read_with_its_escapes`, `escapes_are_three_octal_digits`, `process_records_are_read_as_the_kernel_writes_them`, `the_memory_total_is_read_in_bytes`, `the_os_release_id_loses_its_quotes`, `unknown_probes_and_arguments_are_refused`, `the_sectors_read_are_the_third_field_of_a_disk_s_statistics`, `the_time_state_s_lines_are_facts_with_their_keys_in_the_facts_form`, `the_first_partition_is_reported_in_hexadecimal`, `the_cpus_that_a_restore_brought_online_are_those_of_its_record` | retired | The adapter's probes |
+| `src/worker/tests.rs` | `announcer_launch_keeps_the_socket_and_monitors_its_owned_child`, `announcer_drop_stops_and_reaps_the_child_that_it_owns`, `announcer_failed_exec_reports_the_cause_and_leaves_no_child` | retired | The adapter's own launcher of a clone's announcer, which SL6.13c added when it deleted `nvx::guest::ingress::Announcer`. `nvx-ingress start`'s launch: `nvx-rs/src/guest/ingress/tests.rs` |
 | `src/worker/tests.rs` | `pid_1_goes_on_past_the_stops_of_the_threads_that_it_traces` | retired | The adapter's PID 1. nvx-init's: `nvx-rs/src/guest/init/tests.rs` |
 | `tests/guest_session.rs` | `the_guest_agent_answers_messages_that_span_records`, `a_reset_starts_the_new_epoch_with_a_new_message`, `the_guest_agent_ends_with_its_stream`, `the_guest_agent_fails_on_records_that_the_protocol_does_not_allow`, `the_guest_agent_refuses_messages_that_its_framing_does_not_allow`, `the_guest_agent_of_a_vm_without_a_layered_root_answers_probes_with_a_failure`, `the_guest_binary_serves_the_session_on_its_standard_streams`, `the_guest_agent_serves_a_tty_in_raw_mode`, `the_guest_binary_serves_a_tty_in_place_of_the_managed_agent`, `the_worker_assembles_the_root_serves_it_and_tears_it_down_on_stop`, `the_worker_assembles_an_image_over_ram_in_the_overlay_mode_of_its_configuration`, `the_worker_assembles_a_gpt_disk_with_the_first_partition_bound_of_its_configuration`, `the_worker_reports_the_stage_that_failed_and_ends_with_its_status`, `the_worker_checks_the_account_of_the_sandbox_s_workload_identity_in_the_assembled_root`, `the_worker_reports_a_teardown_that_failed_before_it_confirms_the_stop`, `the_worker_accepts_only_its_configuration_or_a_stop_before_its_root`, `a_broker_that_closes_only_its_end_of_the_stream_receives_what_the_worker_queued`, `the_worker_mounts_the_export_applies_the_mapping_table_in_order_and_starts_the_sandbox`, `a_table_of_zero_mappings_does_no_work`, `a_failed_mapping_latches_the_root_and_holds_the_sandbox_back`, `the_worker_refuses_parts_that_do_not_continue_the_table`, `the_worker_refuses_executions_and_the_start_out_of_order`, `the_guest_binary_runs_pid_1_and_the_worker_of_a_layered_root`, `a_test_that_gives_up_on_pid_1_ends_every_process_that_it_started`, `a_test_ends_every_process_that_outlives_pid_1`, `pid_1_collects_what_real_time_signals_leave_and_supervises_on`, `pid_1_finds_the_children_that_real_time_signals_end_whatever_their_names`, `the_worker_runs_executions_at_once_with_frame_counted_credit_and_one_output_pool`, `a_stalled_sink_stalls_only_its_own_execution_while_timers_cancellations_and_control_go_on`, `the_worker_refuses_probes_while_it_runs_executions`, `a_full_stream_to_the_host_holds_back_only_output_while_cancellations_and_stops_go_on`, `executions_that_write_without_end_take_turns_at_the_stream_to_the_host`, `the_worker_refuses_starts_beyond_its_limits_with_a_failed_launch`, `the_worker_ends_its_session_on_messages_about_executions_that_break_their_rules`, `a_reset_or_a_later_generation_abandons_executions_whose_programs_end`, `the_worker_ends_its_executions_when_the_host_stops_it`, `the_worker_collects_the_status_of_a_program_that_outlives_its_execution`, `the_worker_ends_what_is_left_of_the_process_group_of_a_program_that_ended`, `an_execution_s_settlement_ends_a_descendant_that_left_its_process_group`, `an_execution_that_does_not_settle_keeps_its_place_until_the_host_stops_the_worker`, `an_execution_runs_in_its_working_directory_with_exactly_its_environment`, `an_execution_enters_the_root_as_the_identity_that_its_start_names`, `an_execution_enters_the_root_with_the_publication_of_listeners_that_its_configuration_names`, `the_worker_refuses_at_stage_0_a_start_whose_identity_breaks_the_rules`, `the_worker_collects_the_status_of_a_program_that_a_real_time_signal_ended`, `an_execution_that_starts_with_the_root_counts_its_timeout_from_its_own_start`, `a_host_that_a_test_drops_while_its_broker_pauses_ends_the_worker_and_its_programs`, `the_worker_remembers_the_generations_that_the_host_started`, `the_worker_runs_executions_on_a_tty`, `a_clone_answers_the_restore_s_reset_and_activates_with_the_record_of_its_activate`, `a_clone_takes_nothing_but_its_activate_before_it_is_ready`, `a_clone_s_activation_fails_finally_with_the_status_of_the_failure_s_class`, `application_failures_follow_export_gateway_and_view_order`, `a_clone_fails_on_an_activate_longer_than_a_record_before_it_takes_its_body`, `a_clone_that_the_host_does_not_activate_in_time_ends_with_the_deadline_s_status`, `a_clone_s_application_ends_by_the_activation_s_deadline`, `a_clone_takes_what_came_during_its_application_before_it_is_ready`, `a_clone_whose_stream_takes_nothing_still_ends_once_its_activation_failed`, `a_clone_whose_broker_closes_the_stream_before_it_is_ready_is_abandoned`, `a_clone_whose_broker_is_gone_still_ends_as_its_activation_tells`, `a_ready_clone_fails_on_an_activate_that_is_not_a_retry`, `a_clone_s_executions_name_their_own_identity_and_take_the_hostname_of_its_record`, `a_clone_s_executions_enter_the_root_with_the_publication_of_its_record_s_network`, `a_clone_whose_announcer_ends_ends_with_the_network_s_status`, `a_clone_reports_when_its_events_happened_after_the_acknowledgement`, `a_clone_maps_its_record_s_table_from_its_export_and_leaves_the_proxy_to_the_host` | retired | The adapter's guest agent and worker. NVX's guest session, nvx-init and managed agent: `nvx-rs/tests/nvxs/guest.rs`, `nvx-rs/src/guest/init/tests.rs` and its `tests/`, and `nvx-rs/src/guest/managed_agent/**/tests.rs` |
 | `tests/independent_build.rs` | `the_adapter_is_a_workspace_of_its_own_with_its_own_lockfile`, `the_adapter_declares_the_minimum_rust_version_of_nvx`, `the_host_binary_reports_the_contract_that_it_was_built_against`, `the_guest_binary_reports_the_contract_that_it_was_built_against` | retired | The adapter's own workspace, manifest and binaries |

nvx-rs/README.md

@@ -3392,7 +3392,7 @@ disk's block device.
 | `nvx-exit [CODE]` | Stops the VM with an 8-bit exit code through OpenVMM's control port 0x604 (x86_64) |
 | `nvx-device-io file ...`, `nvx-device-io network ...`, `nvx-device-io map PATH TEXT` | The benchmark helper that measures file and UDP round-trip I/O and prints one JSON line, and reports a file benchmark's progress on stderr; `map` writes TEXT at the start of a file through a shared mapping and holds the dirty mapping until its standard input ends, for the microVM scenarios (x86_64) |
 | `nvx-managed-agent CONTROL_TTY ROOTFS HOSTNAME UID GID USER HOME` | Serves the managed control session and supervises sequential workloads (x86_64) |
-| `nvx-ingress [inherit\|start] GATEWAY_IPV4` | Announces reachable TCP listeners and settled UDP sockets to the portable-network gateway, from a privileged source port that it binds, or, with `inherit`, from its standard input, a socket that the caller bound to one after the clone's process-free application; `start` starts `inherit` as `Announcer::start` does and exits once it runs, or with status 1 if it does not start, for a guest agent that cannot hold the announcer; `test DIRECTORY` runs synthetic procfs snapshots |
+| `nvx-ingress [inherit\|start] GATEWAY_IPV4` | Announces reachable TCP listeners and settled UDP sockets to the portable-network gateway, from a privileged source port that it binds, or, with `inherit`, from its standard input, a socket that the caller bound to one after the clone's process-free application; `start` binds such a socket and starts `inherit` on it in a session of its own, then exits once its program runs, or with status 1 if it does not start, for a guest agent that cannot hold the announcer; `test DIRECTORY` runs synthetic procfs snapshots |
 | `nvx-time [--report-only] COMMAND` | Enforces NVX time ABI v1: runs its conformance checks, repairs the wall clock after a restore, publishes the time state, and runs the discipline and violation-watcher daemon; `test NAME ...` runs its decoder and process test hooks (x86_64) |
 | `nvx-time-probe latency\|warp\|clock ...` | Diagnoses clock-read latency, cross-CPU TSC warp and offset, the clocks, CPUID, clock events, kernel messages, and optionally MSRs (x86_64) |
 | `nvx-init TIME_DAEMON [ANNOUNCER]` | Takes PID 1 over from a layered root's early boot, with its time daemon and optional announcer: gives itself and them an out-of-memory score adjustment of -1000 and a nice value of -10, collects every child's status, and, after `sync`, ends the VM with status 125 when a helper ends or 0 on `SIGTERM`; elsewhere it exits with 2 (x86_64) |

nvx-rs/public-api/linux.txt

@@ -1279,24 +1279,7 @@ field nvx::guest::gpt::DeviceError::Size::0 (hidden)
 variant nvx::guest::gpt::DeviceError::Table (hidden)
 field nvx::guest::gpt::DeviceError::Table::0 (hidden)
 fn nvx::guest::gpt::read_disk (hidden)
-mod nvx::guest::ingress
-struct nvx::guest::ingress::Announcer
-method nvx::guest::ingress::Announcer::id
-method nvx::guest::ingress::Announcer::pidfd
-method nvx::guest::ingress::Announcer::start
-method nvx::guest::ingress::Announcer::stop
-method nvx::guest::ingress::Announcer::try_wait
-const nvx::guest::ingress::PROGRAM
-enum nvx::guest::ingress::StartError
-variant nvx::guest::ingress::StartError::Bind
-field nvx::guest::ingress::StartError::Bind::0
-variant nvx::guest::ingress::StartError::Launch
-field nvx::guest::ingress::StartError::Launch::0
-variant nvx::guest::ingress::StartError::NoPrivilegedPort
-variant nvx::guest::ingress::StartError::Socket
-field nvx::guest::ingress::StartError::Socket::0
-variant nvx::guest::ingress::StartError::Spawn
-field nvx::guest::ingress::StartError::Spawn::0
+mod nvx::guest::ingress (hidden)
 fn nvx::guest::ingress::main (hidden)
 mod nvx::guest::init (hidden)
 fn nvx::guest::init::main (hidden)