[Pedro Henrique Penna (ppenna)]

Part of #1120 (SL6.0e: host::vm and the CLI's sandbox lifecycle stop using the instance, the sandbox store and the supervisor). Parent #1087, umbrella #1076.

What and why

SL6.1 (#1121) deletes host::instance, the sandbox store host::store, and the supervisor's store-coupled launch, wait and stop. SL6.1's analysis found three more uses of them by code that stays, beyond the file helpers that SL6.0d (#1518) moves:

• host::vm::create draws each launch's capability with host::instance::generate_capability;
• the CLI's stop of a sandbox reports its outcome as the supervisor's StopOutcome;
• the CLI's provision creates the state directory with SandboxStore::create.

This kept-code PR for #1120 moves these uses to owners that stay. Behavior doesn't change. The change is one commit, host: keep vm and the CLI's sandbox lifecycle off the old store:

• generate_capability moves to host::vm, crate-private, after Capability's Debug. vm::create calls it. host::instance's public generate_capability calls it until SL6.1 deletes the instance, so the public API doesn't change. The function is unchanged: it draws until the capability isn't all zero, and fails with the same message.
• The CLI's stop takes a StopOutcome of its own: pub(super) enum StopOutcome { Graceful, Forced, TimedOut } in host/cli/sandbox/lifecycle/stop.rs. These are the three outcomes that the CLI matched on, with the same meanings, and its tests import it from super::stop.
• create_state_directory creates the directory with the CLI's own StateDir::create, which provision's lock already uses. Both create the directory private to the current user through platform::create_store_dir, refuse one that isn't, and fail with the same codes and messages. SandboxStore::create also resolved a relative path, which changed nothing here: provision hands it the state directory that it already resolved, an absolute path. StateDir::create returns the CLI's own error, so error_with_cause's conversion goes.
• Two tests draw their own random capability: the managed-lifecycle test (tests/managed_lifecycle.rs) and the live restore test (host/restore/tests/live_init.rs). Each fills [0; CAPABILITY_LEN] with getrandom::fill. They used instance::generate_capability, which leaves, and vm's is crate-private.

As the orchestrator decided for Pedro Henrique Penna (@ppenna), generate_capability becomes crate-private in host::vm rather than public, since only vm::create and the tests need it, and the tests draw their own.

Size

Measured against a4f04f63:

• Core lines: 19: 10 in vm.rs, the moved function and its call; 6 in stop.rs, the enum; 2 in directory.rs; and 1 in instance/mod.rs, which now calls vm's.
• Counted files: 4: host/vm.rs, host/cli/sandbox/lifecycle/directory.rs, host/cli/sandbox/lifecycle/stop.rs and host/instance/mod.rs.

BOOT_CONTRACT_VERSION and CONTROL_CONTRACT_REVISION don't change, and the public API doesn't change (python scripts/public_api.py passes unchanged).

Not in this PR

Deleting host::instance, host::store or the supervision (SL6.1); the store's file helpers (SL6.0d, #1518); any change to the CLI's lifecycle beyond the type and the call above.

Validation

Rebased on a4f04f63, after #1518 and the PRs of SL6.1's former temporary base, as f319bd0b. The rebase applied without conflicts. Against the head before it, the only difference is a line of context: the live restore test imports SnapshotManifest since #1513. The commit is identical to SL6.1's stacked copy, f4a29f2e in #1520, which passed the Linux gates and the microVM scenarios in #1520's validation. On f319bd0b, cargo fmt --all --check and Clippy -D warnings with --all-targets --all-features, --lib and --lib --bins --features cli, and for --target x86_64-unknown-linux-gnu with --all-targets --all-features, passed on Windows. So did the 114 unit tests of host::vm, host::cli::sandbox and host::restore with --all-features, and the 15 lifecycle tests of tests/cli.rs.

The table and the scenarios below ran on f61ee3cc, the head before the rebase, with Rust 1.95.0 and NVX_BUNDLE=skip. The checks ran locally on Windows, and in temporary worktrees on nvx-mshv-test (Azure Linux 3, kernel 6.18, linux-mshv, virtual machine) and nvx-kvm-test (Azure Linux 3, kernel 6.6, linux-kvm, virtual machine). The gates are those that local_gates.py --files selects for the change, run from this branch's actions:

Check	Windows	Linux
cargo fmt --all --check	passed
Clippy -D warnings: --all-targets --all-features, --lib, --lib --no-default-features, --lib --no-default-features --features serde, --lib --bins --features cli, --lib --bins --no-default-features --features testing	passed
Clippy -D warnings for --target x86_64-unknown-linux-gnu: --all-targets --all-features, --lib, --all-targets, --lib --bins --features cli, --lib --no-default-features --features guest	passed
cargo check --locked --all-targets --all-features --target aarch64-apple-darwin	passed
cargo test --locked --all-features	passed	passed, on nvx-mshv-test: 104 suites, 2696 tests, 78 ignored
cargo test --locked	passed	passed, on nvx-mshv-test: 22 suites, 1292 tests, 28 ignored
cargo build --locked --lib --no-default-features, cargo test --locked --lib --no-default-features	passed
RUSTDOCFLAGS=-D warnings cargo doc --locked --no-deps --all-features	passed
cargo +1.89 check --locked --all-targets --all-features (MSRV)	passed
python scripts/public_api.py (both snapshots)	passed, unchanged
python scripts/check_test_layout.py, python scripts/check_markdown_links.py	passed
The case matrix, with SL5.2's check (check_matrix.py)	passed

MicroVM scenarios, with the static musl nvx-rs that CI runs, CI run 43149037772's guest artifacts (5b3fab2c, the same guest inputs) and that run's OpenVMM builds of the pin (14dc4116), with their provenance, on WHP its Windows build, 7abd8c8d, on Windows 11. The public set provisions, starts and stops sandboxes, so it runs the CLI's state directory and stop:

Scenarios	nvx-kvm-test	nvx-mshv-test	WHP, locally
The public set: managed-exec-config, sandbox-lifecycle, sandbox-proxy-only, sandbox-ram-upper, sandbox-gpt-layer, vm-lifecycle, snapshot-core and snapshot-tiers	passed: 8	passed: 8	passed: 8
managed-lifecycle, which runs the changed tests/managed_lifecycle.rs	passed	passed

Left to CI: the bundled-artifact check, the guest binaries and the default suites. The CLI's Windows lifecycle tests, which create state directories with Windows' access control, passed locally in cargo test --all-features.

A code-review agent reviewed the whole diff and found no issues. It checked that the state directory is created as before on each platform, and that the CLI's StopOutcome keeps the outcomes and meanings that the CLI matched on.

Changes to existing tests (tests-modified)

python scripts/check_test_changes.py --base origin/feature/nvx-refactor reports 5 changes to existing tests. Each replaces what used an item that leaves, and checks the same things as before:

• managed_lifecycle::a_managed_guest_runs_request_scoped_workloads_until_it_stops, and the imports of tests/managed_lifecycle.rs: the test draws its VM's capability with getrandom::fill into [0; CAPABILITY_LEN] instead of nvx::host::instance::generate_capability, which leaves.
• host::restore::tests::live_init's helper run, and its imports: the same, in place of crate::host::instance::generate_capability.
• The imports of host::cli::sandbox::lifecycle::tests: StopOutcome comes from super::stop, the CLI's own, instead of crate::host::supervisor.

No changed test is named in the case matrix.

[github-actions]

This pull request changes existing tests

It modifies or removes 5 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified helper	fn run in host::restore::tests::live_init	nvx-rs/src/host/restore/tests/live_init.rs:161	nvx-rs/src/host/restore/tests/live_init.rs:160
modified imports	the imports of host::cli::sandbox::lifecycle::tests	nvx-rs/src/host/cli/sandbox/lifecycle/tests.rs:1	nvx-rs/src/host/cli/sandbox/lifecycle/tests.rs:1
modified imports	the imports of host::restore::tests::live_init	nvx-rs/src/host/restore/tests/live_init.rs:1	nvx-rs/src/host/restore/tests/live_init.rs:1
modified imports	the imports of managed_lifecycle (tests)	nvx-rs/tests/managed_lifecycle.rs:29	nvx-rs/tests/managed_lifecycle.rs:29
modified test	fn a_managed_guest_runs_request_scoped_workloads_until_it_stops in managed_lifecycle (tests)	nvx-rs/tests/managed_lifecycle.rs:494	nvx-rs/tests/managed_lifecycle.rs:493

Relocated unchanged: 0; added: 0. Compared the merge base a4f04f63f2ac with f319bd0b5c28.

[Copilot]

🟢 Approval recommended

No active review issues remain for the VM and CLI lifecycle decoupling changes.

No open issues 🎉

What changed in this PR

This PR detaches retained VM and CLI sandbox lifecycle code from legacy modules scheduled for removal in SL6.1. It supports the NVX library-slimming workstream while preserving the existing public API.

Changes:

• Moves capability generation into host::vm, retaining the public instance helper as a forwarding wrapper.
• Gives the CLI its own StopOutcome and uses StateDir::create for sandbox state-directory creation.
• Updates lifecycle and restore tests to stop depending on the legacy helpers and types.

File	Description
nvx-rs/​tests/​managed_lifecycle.rs	Generates the test capability directly with getrandom.
nvx-rs/​src/​host/​vm.rs	Owns crate-private capability generation and uses it during VM creation.
nvx-rs/​src/​host/​restore/​tests/​live_init.rs	Generates the restore test capability without the instance helper.
nvx-rs/​src/​host/​instance/​mod.rs	Preserves the public capability helper by forwarding to host::vm.
nvx-rs/​src/​host/​cli/​sandbox/​lifecycle/​tests.rs	Imports the CLI-owned stop outcome type.
nvx-rs/​src/​host/​cli/​sandbox/​lifecycle/​stop.rs	Defines the CLI’s stop outcome enum locally.
nvx-rs/​src/​host/​cli/​sandbox/​lifecycle/​directory.rs	Creates state directories through the CLI’s StateDir.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the VM and CLI dependency-ownership changes.

No open issues 🎉

_{Review effort: Balanced}