[Pedro Henrique Penna (ppenna)]

Leaving code only. This PR changes only code that this effort removes from NVX: the old config types (LaunchSpec, SandboxPlan, SandboxLaunch, SandboxSettings, SandboxNetwork, CaptureClass), the rest of host::launch, the prepared launch and its checked-file handoff, the transitional host::supervisor with spawn_command, the boot rendering of shares, WORKLOAD_ACCOUNT_TOKEN, and the shell /init's reading of OpenVMM's lifecycle and workload tokens, with the crate-private code that only they used and the edits that remove references to them. Nothing that stays changes, and no later PR uses what it changes, so the size limits for kept code don't apply.

Beyond what leaves, it carries out the decisions that the orchestrator made for Pedro Henrique Penna (@ppenna) on #1122 (D1 to D6): the external-launch example starts its VMM with a minimal launcher of its own (D1); the workload-identity and managed-lifecycle scenarios also give the CLI's tokens (D5); the shell /init fails closed when OpenVMM's workload identity and NVX's nvx_identity= disagree, or NVX's is missing (decided for Pedro Henrique Penna (@ppenna) on #1122 after review); and the tests of code that stays move out of the deleted test files to the owners of that code. What only the CLI uses now allows dead code without the cli feature, as host::spawn does.

Part of #1122 (SL6.3, "The old config types are gone"). Umbrella #1076.

Based on feature/nvx-refactor 230a1b0877d, which holds SL6.0f (#1526, merged): the CLI checks the command line that it launches there, so this PR deletes the old types whole (D2, D3). SL6.3 was built on SL6.1's branch (#1520, 5bffcd7f), then stacked on #1526; since both merged, its 7 commits are rebased on 230a1b0877d, where only the case matrix conflicted (the line of lib.rs's doc test, now 57, and the Docs counts, now 36, 25, 3 and 8, beside the rows of SL6.11a and SL6.11c), and an eighth commit adds the fail-closed check.

What and why

SL6.1 (#1520) left the old launch path without callers: the CLI's sandbox start and run name their images by path in a VmConfig, vm::create and vm::spawn launch every VM, and since SL6.0f the CLI checks the command line that it launches. What remained of the old path served only itself, the transitional host::supervisor re-exports and the tests. The commits, in order (consumers before providers):

1. 7c967b7fcd2 examples: launch the external-launch VM with a launcher of its own (D1). The example handed vm::create's command to supervisor::spawn_vm. It now starts the VMM on std::process: the capability through a pipe closed to writers before the spawn, the log as standard output and error, a process group of its own, and on Windows no console and the command's breakaway flag. It holds the VMM through a ProcessRef whose start time it reads itself, as ProcessRef defines it (the starttime field of /proc/<pid>/stat on Linux, the creation time on Windows), and takes Transport from host::transport, so it uses nothing of host::platform, which SL6.14 (host: make the platform layer private to nvx (SL6.14) #1529) makes crate-private. Its docs list what it leaves out, which a production launcher adds, as vm::spawn does: it passes no descriptor or handle besides the standard streams (and refuses a command that allows any); on Linux no new session and the caller's umask; on Windows every inheritable handle of the caller and no log-named job. No public API is added.
2. 313b00b2681 host: delete the prepared launch and its checked-file handoff. host::sandbox::prepared (PreparedLaunch, with adapter_arguments), Inherited::proc_path, Windows Process::close_inherited and ProcessHandle::close_inherited, and what only they used: Linux move_above_standard_streams, Windows seal::final_path, CheckedDistro's and CheckedScratch's file_mut, and CheckedDistro::bound. CheckedScratch::claim, which only the CLI reads, is gated by cli. The README's "Checked handoff" section becomes "Images by path" (D6, below).
3. d4459183915 host: delete the transitional supervisor path of the spawn. host::supervisor goes whole, with spawn, spawn_vm, VmmCommand::new, Launched::kill_and_wait with the Windows LaunchedProcess::terminate that only it called, and spawn_command. VmmCommand, Launched and Inherited become crate-private; spawn_vm_with_mode takes their docs. The spawn lock and the termination after a failed spawn stay, as vm::spawn's private foreground mode does (D4: inherit_only, SpawnMode::Foreground, Windows LaunchedProcess::wait_timeout).
4. 2853ff49c4f host: delete the capture class. CaptureClass, ClassIdentity, its domain and SnapshotKey::new; a key comes from its CaptureContext through SnapshotKey::from_capture. The conformance vectors lose their CLASS lines; the KEY vectors don't change.
5. 11ac217c9b0 host: delete the old sandbox plan and launch. host::sandbox::plan (SandboxPlan, SandboxDistro, SandboxUpper, SandboxNetwork, BlockRole, PLAN_VERSION), SandboxLaunch, SandboxSettings, the profile's KERNEL_COMMAND_LINE_MAX_SIZE, OPENVMM_COMMAND_LINE_RESERVE and SANDBOX_COMMAND_LINE_MAX_SIZE, the workload limits, options::validate_sandbox_systemd_policy, and the boot rendering of shares: BootShares, boot_shares, aggregate_share_tokens, aggregate_command_line_fragment, export_command_line_fragment, aggregate_child_name, aggregate_child_argument and mount_argument. plan_mounts, plan_mounts_with and path_text stay for nvx-rs slimming 4.3.1: image staging, artifact discovery, the policy-file reader and the mount syntax are private to the CLI #1124, at their owners.
6. 83b4141a789 host: delete the old launch. host::launch goes whole: LaunchSpec, VmmLaunch with RESERVE and arguments, WorkloadIdentity's DEFAULT and select, MAX_TIMEOUT, DEFAULT_MEMORY_MIB, DEFAULT_HOSTNAME, base_command_line, kernel_parameters_problem, timeout_problem, check_process_command_line, and its re-exports of host::config's helpers, which stay there with COMMAND_LINE_BUDGET, DEFAULT_GUEST_NETWORK, OPENVMM_COMMAND_LINE_RESERVE and VmConfig::check_command_line, unchanged. protocol::WORKLOAD_ACCOUNT_TOKEN goes; the fake OpenVMM spells its own.
7. 3e30b910961 guest: stop reading OpenVMM's lifecycle tokens in the shell init. guest/common/init no longer reads nvx_lifecycle=, nvx_workload_uid= or nvx_workload_gid=, and starts nvx-init for every layered root instead of handing one with nvx_lifecycle= to nvx-init-agent. A blockless guest takes its lifecycle from nvx_mode= and its identity from nvx_identity= alone. The workload-identity and managed-lifecycle scenarios, which start OpenVMM directly, keep OpenVMM's --microvm-workload-identity and --microvm-lifecycle, which OpenVMM itself checks, and also give the CLI's nvx_identity= and nvx_mode=managed (D5). No NVX launch passes OpenVMM's options any more: the old launch paths are gone.
8. c5d2ee8d0b7 guest: fail closed on OpenVMM's workload identity without nvx_identity. When the command line has OpenVMM's nvx_workload_uid= or nvx_workload_gid=, which --microvm-workload-identity appends, /init boots on only if nvx_identity= names the same UID and GID; otherwise it stops with NVX-WORKLOAD-ERROR and status 125 before it starts anything: an nvx_exec= program, a one-shot or managed workload, the shares or nvx-init. So the guest fails closed when OpenVMM's identity and NVX's disagree, or NVX's is missing, as OpenVMM's documentation of --microvm-workload-identity asks of a guest that cannot apply it. /init recognizes the two tokens only to refuse a mismatch: it still takes the identity from nvx_identity= alone, and still ignores nvx_lifecycle=. NVX's own launches don't change: the CLI and the library pass no OpenVMM identity, and the scenarios that pass one also pass the same nvx_identity=. The workload-identity scenario boots twice more, with OpenVMM's identity and no nvx_identity=, and with an nvx_identity= of another identity, and requires both to fail closed. The boot protocol (5.1) and the machine model (2.1.2) say so; 2.1.2 still said that the machine profile's tokens name the workload identity and lifecycle.

Breaking change, for #1131's migration notes (SL6.10h). NVX's guests take the workload identity and lifecycle only from nvx_identity=UID:GID and nvx_mode=one-shot or nvx_mode=managed on the kernel command line. A caller that launches OpenVMM directly with --microvm-workload-identity or --microvm-lifecycle also gives these tokens in --cmdline, with the same identity: a boot with OpenVMM's identity and no nvx_identity=, or another one, now fails closed with NVX-WORKLOAD-ERROR and status 125. The CLI and the library pass neither OpenVMM option, so their launches don't change.

Public API. The snapshots lose 231 items on Linux and 230 on Windows, and gain none: the modules host::launch, host::supervisor, host::sandbox::plan and host::sandbox::prepared, the plan's re-exports from host::sandbox, the boot rendering of host::sandbox::mount, options::validate_sandbox_systemd_policy, CaptureClass, ClassIdentity and SnapshotKey::new, and protocol::WORKLOAD_ACCOUNT_TOKEN. protocol's WorkloadIdentity, which activation payloads carry and which was public only through host::launch, becomes pub(crate).

Crate-private code that the deletions leave unused, as warning-denied builds of every feature set find it on Linux and Windows, goes: move_above_standard_streams (Linux), seal::final_path (Windows), CheckedDistro::file_mut and bound, CheckedScratch::file_mut, Process::close_inherited and ProcessHandle::close_inherited (Windows), LaunchedProcess::terminate (Windows), host::sys::effective_ids, and mount::request::command_line_fragment with the bootstrap-token constants of mount. What only the CLI uses now allows dead code without cli, with a reason, as host::spawn does: host::process::KILL_TIMEOUT, Launched::wait_timeout and its reaping and status helpers, Windows LaunchedProcess::wait_timeout, CheckedScratch's claim (its field, and Windows' claim(), which only the CLI calls), mount::check_distinct_export_roots and its re-export beside HostQueries, and config::reject_container_path; outside Windows, the spawn lock, which only the tests take there, and VmmCommand::breakaway_from_job, which only Windows reads. protocol re-exports its workload module only for the CLI and the guest.

The by-path model (D6, Pedro Henrique Penna (@ppenna)'s note on #1122)

Confirmed as the intended model: a launch names its images by path. The checks, DistroBinding::check and ScratchBinding::check, find a staged image unchanged from its metadata alone and return it open, but what takes an image's path after its check is what OpenVMM opens. The docs of host::sandbox::distro, host::sandbox::scratch and host::seal require callers to stage their images in a directory that only their own account can write, so no other account can replace a checked path. On Windows, a held checked distro layer also denies other opens for writing or deleting it, and the scratch image's guard denies deleting and renaming it; the VMM inherits the scratch claim. SL5.1a's security checklist checks the precondition (tests/security_checklist.rs::a_staged_image_that_was_replaced_fails_its_check). The README's "Images by path" section states it, and the case matrix retires images_replaced_after_the_checks_never_reach_the_vm under it and drops checked_handoff.rs from the coverage of a_layered_launch_hands_openvmm_the_checked_images.

Every removed test, and its fate

python scripts/check_test_changes.py --base origin/feature/nvx-refactor (230a1b0877d) reports 372 changes to existing tests: 78 removed tests, 76 modified tests, 96 removed and 92 modified helpers, and imports, attributes and modules; 33 tests relocate unchanged and 45 are added (moved, renamed or new). No removed test is named in the case matrix, as coverage or otherwise (git grep of each name), but for the doc test of PreparedLaunch and the module doc test of host::supervisor, whose rows say where their coverage went. The fates, by deleted code:

host::launch: 14 retire

kernel_command_line_sets_the_hostname, arguments_select_the_managed_direct_guest, mappings_add_the_export_and_the_mapping_count, oversized_process_command_lines_are_rejected, launches_may_use_the_reserve_that_provisioning_keeps, every_launch_names_its_own_inputs_alike, the_reserve_of_a_plan_holds_the_rest_of_a_launch_of_inputs_of_max_path, kernel_parameters_are_checked, kernel_parameters_are_read_as_the_kernel_reads_them, reserved_parameters_are_refused_whatever_separates_them, the_kernel_reads_the_hostname_after_accepted_parameters, every_command_line_checks_the_specification, timeouts_are_bounded, workloads_that_map_host_paths_take_the_host_identity. The helpers that stay keep their tests in host::config: process_command_lines_are_measured_as_windows_quotes_them, a_process_command_line_fits_while_it_leaves_its_reserve and configuration_command_lines_keep_the_same_reserve_on_every_host, with vm::tests::creation_checks_the_complete_actual_command_line_at_the_windows_boundary.

host::sandbox::plan: 23 retire

adapter_launches_are_planned_with_room_for_the_rest_of_the_launch, adapter_plans_persist_without_settings_or_an_export, adapter_plans_refuse_the_settings_of_their_root_that_they_do_not_name, adapter_plans_refuse_what_their_root_and_openvmm_own, adapter_plans_render_their_root_and_devices_alone, every_format_and_upper_plans_and_renders, launches_carry_their_network_into_their_plans, launches_plan_the_image_that_the_binding_of_their_distro_layer_records, launches_plan_their_distro_layer_over_ram, launches_plan_their_distro_layer_over_their_scratch_image, networks_check_their_guest_network_and_their_policy, persisted_plans_that_break_the_form_or_the_checks_are_refused, plans_check_the_images_of_their_block_devices_against_the_host, plans_check_their_export_plan_for_the_container_root, plans_check_their_settings_as_launches_do, plans_persist_in_their_versioned_form, plans_refuse_the_command_lines_that_the_guest_refuses, plans_refuse_the_tokens_that_the_guest_init_reads_in_quoted_values, plans_render_and_report_their_network, plans_require_properly_nested_disk_path_brackets, the_guest_reads_the_root_of_every_plan_from_its_command_line, the_longest_boot_tokens_fit_the_command_line_budget_to_the_byte, the_managed_lifecycle_exports_the_shares_and_announces_their_mapping_table. What stays of their checks is tested where it lives now: the CLI's command line in starts_check_the_kernel_command_line_that_they_launch and cold_share_command_lines_fit_the_kernel_budget_to_the_byte (SL6.0f), the rendering of roots, networks and exports in host::config's cold_boot_arguments_* tests, the disk paths in cold_boot_arguments_refuse_disk_syntax_in_image_and_scratch_paths and tests/cli/validation.rs, and the proxy's URL in network::tests::proxy_urls_name_the_gateway_as_the_guest_sees_it.

host::sandbox::prepared and the checked-file handoff: 16 retire, 2 move

The 10 unit tests of prepared: a_release_through_a_process_that_inherited_nothing_closes_none_of_its_handles, an_adapter_s_launch_renders_complete_arguments_that_fit_a_command_line, an_upper_in_ram_takes_no_scratch_image, gpt_disks_are_prepared_from_their_bindings, no_plan_encodes_root_as_the_workload_identity, prepared_launches_accept_balanced_brackets_in_final_paths, prepared_launches_hand_the_vmm_the_checked_files, prepared_launches_refuse_final_paths_that_openvmm_cannot_take, prepared_launches_take_only_the_checked_files_of_their_plan, staging_checking_and_preparing_a_launch_read_no_content. The 4 handoff cases of tests/checked_handoff.rs: a_prepared_launch_hands_the_vmm_its_checked_images_alone, a_vmm_keeps_the_scratch_images_claim_once_its_launcher_is_gone, a_vmm_finds_the_checked_images_past_replaced_links_from_another_directory, a_launch_passes_a_checked_file_that_took_a_standard_streams_descriptor. Windows a_child_loses_only_the_inherited_handle_that_is_closed_in_it (of close_inherited) and seal::windows::tests::final_paths_hold_no_nul_whatever_their_length (of final_path). The file's 2 cases of the spawn that stays, launched_waits_return_and_retain_the_actual_exit_status and strict_cleanup_terminates_and_confirms_a_running_child, move to host::spawn's unit tests, and its exit_status_fixture joins their vmm_fixture. gpt_disks_bind_by_their_disk_guid no longer checks bound(), and checks_claim_the_image_without_reading_it no longer checks proc_path.

host::supervisor: the 11 kept cases move

As the notes on #1122 and D1 ask, tests/supervisor.rs becomes tests/process.rs, with its 7 tests of host::process, whose processes a fixture of its own starts through std::process: processes_can_be_shared_between_threads, a_child_that_exits_wakes_its_waiter, a_process_that_is_not_a_child_wakes_its_waiters, a_reused_process_id_is_never_signaled, references_that_name_no_process_are_never_opened, and on Windows a_process_that_this_user_may_not_query_has_an_unknown_state and a_process_that_this_user_may_not_terminate_is_waited_for_but_never_signaled. Its 4 tests of the spawn move to src/host/spawn/tests.rs, which now builds on Linux and Windows: working_directory_limits_include_trailing_separators (Windows), a_restarted_launcher_finds_its_vmm_again_and_ends_it (the breakaway), vmms_inherit_only_their_streams_and_allowed_descriptors_while_others_spawn and a_job_that_ends_its_vmm_wakes_the_waiters (Windows), with the launcher fixture; its vmm_fixture joins the spawn tests' one. The spawn's Linux tests move to src/host/spawn/tests/linux.rs, unchanged but for the strict spawn. Windows a_vmm_whose_log_is_no_file_of_a_disk_volume_starts_without_a_job becomes ..._is_refused: the start without a job that only supervisor::spawn made goes, its refusal by the strict spawn stays. The tests that spawned through the old paths spawn through spawn_vm_with_mode (host::platform::windows::tests, host::restore::tests, host::cli::store::tests::liveness), and host_modules' graph test loses the edge from supervisor to spawn.

CaptureClass: 2 retire, 13 rewritten

the_guest_build_is_not_part_of_a_snapshot_key and each_field_of_a_class_changes_its_identity retire, with the class's part of identities_have_a_text_form. The key's other tests derive their keys from contexts through from_capture (a_capture_that_does_not_match_its_class_is_refused, which loses the case of a network whose policy attaches no NIC, a_class_selects_a_profile_as_openvmm_does, a_generations_own_metadata_leaves_the_key_as_it_is, a_key_holds_what_its_capture_made, a_key_that_holds_its_network_s_lowering_after_its_invariants_is_refused, complete_capture_time_round_trips_without_changing_compatibility_identity, each_part_of_the_key_changes_it, keys_of_machines_that_no_manifest_describes_are_refused, keys_read_back_from_their_canonical_encoding, keys_with_the_removed_guest_build_field_are_refused, the_conformance_vectors_decode_and_encode), and invalid_classes_are_refused becomes captures_of_invalid_contexts_are_refused. The snapshot fixtures class() and network_class() become context() and network_context() (snapshot_open_refuses_*, the capture tests).

The sandbox profile's own tests: 17 retire, 21 rewritten

Retired with the plan and the launch: launch_contract_builds_agent_command_line, launch_contract_rejects_duplicates_and_reserved_tokens, launch_settings_are_checked_in_order, launch_rejects_limits_the_guest_cgroup_cannot_store, launch_contract_attaches_mount_and_reserves_bootstrap_tokens, launch_contract_attaches_several_shares_as_an_aggregate, launch_bounds_shares_by_the_kernel_command_line, launch_contract_rejects_disk_option_delimiters_and_unbalanced_brackets (the CLI's refusal stays tested in tests/cli/validation.rs); the specifications aggregate_child_name_known_answer, launch_arguments_follow_the_openvmm_contract, accepted_launch_shapes_keep_their_arguments_and_kernel_tokens, shares_follow_the_openvmm_and_guest_contracts, launch_settings_follow_the_guest_contract, caller_parameters_follow_linux_and_guest_rules, aggregate_child_names_follow_the_restore_contract, kernel_command_line_stays_within_1024_bytes and reserved_kernel_tokens_are_always_refused; and the share tests aggregate_child_names_pin_their_targets and boot_tokens_refuse_what_the_shell_cannot_bind.

Rewritten, keeping their checks of code that stays: launch_contract_attaches_a_file_as_an_aggregate_child becomes file_shares_take_no_policy_paths_or_reserved_targets and launch_validation_requires_the_layers_and_the_scratch_image becomes missing_files_are_named_with_their_components_alone (require_file); launch_validation_rejects_overlapping_or_foreign_host_paths, shares_that_only_a_verbatim_path_names_are_refused, launch_validation_rejects_shares_that_came_to_overlap and launch_validation_requires_plain_mount_directory plan their shares with plan_mounts and check them again as a start does, with check_distinct_export_roots and ExportPlan::verify; the specifications layer_values_are_role_path_uuid, kernel_token_values_refuse_separators, the_reproduction_of_microsoft_nvx_723_is_refused and accepted_values_stay_one_kernel_parameter keep their checks of layers and targets, and canonical_layer_uuids_reach_the_guest becomes canonical_layer_uuids_round_trip; the share tests mount_parser_defaults_to_read_only_and_accepts_rw, mount_parser_accepts_host_paths_with_commas, mount_owner_defaults_to_vmm_and_forwards_caller, mount_access_policy_is_validated_and_forwarded and shares_are_planned_through_the_export_planner drop the boot rendering; and the option tests distro_manifest_binds_the_layer, systemd_entrypoints_and_images_are_refused_independently, sandbox_allows_non_systemd_sbin_init, the_entrypoint_check_needs_no_manifest_and_precedes_the_distro_verification, sandbox_rejects_systemd_from_bound_distro_metadata and distro_manifests_are_strict_json run the CLI's preflight, validate_sandbox_entrypoint and DistroBinding::verify, while sandbox_command_shares_a_file and sandbox_command_attributes_mount_deny_to_the_preceding_mount check the export plan's kernel token.

Elsewhere: 1 renamed, helpers adjusted

config::tests::cold_command_lines_keep_the_old_root_view_and_mapping_values compared a configuration's command line with those of LaunchSpec and SandboxPlan; as cold_command_lines_carry_the_root_the_view_and_the_mapping_count, it checks the line against the configuration, and its case-matrix row follows the rename. The restore driver's test workload spells the identity that WorkloadIdentity::DEFAULT named, and tests/cli/openvmm.rs's two_share_command_line_room the tokens that OpenVMM appends. The CLI's capture and store tests build VmmCommand as a struct.

The shell /init and the scenarios

test_old_lifecycle_tokens_keep_the_old_layered_init becomes test_old_lifecycle_tokens_no_longer_select_the_old_layered_init, and the new test_openvmm_workload_identity_needs_the_same_nvx_identity checks that OpenVMM's identity tokens without the same nvx_identity= (none, its UID alone, or another identity) stop every route, nvx_exec, one-shot, managed and sandbox, with NVX-WORKLOAD-ERROR before anything starts, and that the same identity boots on; test_exec_override_cannot_bypass_the_new_sandbox_init and test_missing_helpers_or_selected_init_fail_without_fallback expect nvx-init for a layered root with nvx_lifecycle=. All four fail on the old init. The scenarios' unit tests check the CLI's tokens on the command line, and test_workload_identity_scenario_checks_enforcement_and_rejection and the new test_workload_identity_scenario_fails_a_guest_that_does_not_fail_closed the workload-identity scenario's two boots that must fail closed.

Size

Measured against 230a1b0877d, by #1076's rules: leaving code only, no limit. The workstream's measuring script counts 221 added or changed code lines in 29 Rust files, plus 38 in scripts/nvx_tools/microvm_tests.py and 10 in guest/common/init: 31 counted files. Of the 221, the 117 in nvx-rs/src only gate items by cli or by platform, make items crate-private, or shorten the import and re-export lists of what goes, and so don't count; the other 104 are the example's own launcher (D1). The 48 lines of the scenarios (D5 and the refused boots) and of the init (its remaining case and condition, and the 8 lines of the fail-closed check) count. The estimate was 0 core lines and 9 counted files. 77 files change: +2916 and −12615 lines, tests and docs included. BOOT_CONTRACT_VERSION and CONTROL_CONTRACT_REVISION don't change.

Left as is

• nvx-init-agent and the container scripts, which no launch starts any more; doc/project-structure.md says so. Their removal is not in SL6.3's Scope.
• The CLI's run accepts nvx_lifecycle=, nvx_workload_uid= and nvx_workload_gid= in --cmdline as aliases of its own nvx_mode= and nvx_identity=, which it renders before the guest reads them, and the fake OpenVMM keeps emulating OpenVMM's options, as nvx-rs slimming 3.1.4: run uses the new interface and the CLI's own guest tokens #1109 left it.
• doc/modules, which CI draws again after the merge.

Not in this PR

Rewriting, refactoring or improving retained mount planning, path handling, VM configuration or VM spawning; re-homing the deleted APIs or adding replacements (no public constructor of ProcessRef was added for the example); deleting plan_mounts, plan_mounts_with or path_text (#1124); changing DEFAULT_GUEST_NETWORK, COMMAND_LINE_BUDGET, the Windows command-line helpers, the private spawn lock or the failed-spawn termination; incrementing a contract version.

Validation

The checks ran on a3d93c075ad, and the test suites again on c04cd8a7b18, whose tree differs only by one Linux test helper (below), then on 604d8dacccb and on this head, c5d2ee8d0b7 (after the tables), with Rust 1.95.0 and NVX_BUNDLE=skip, locally on Windows, on nvx-mshv-test (Azure Linux 3, kernel 6.18, linux-mshv, virtual machine), nvx-kvm-test (Azure Linux 3, kernel 6.6, linux-kvm, virtual machine) and nvx-whp-test (Windows, WHP, virtual machine), in temporary worktrees. The gates are those that local_gates.py --files selects, run from this branch's actions.

Check	Windows (local)	Linux
cargo fmt --all --check	passed	passed (MSHV)
Clippy -D warnings: --all-targets --all-features, --lib, --lib --no-default-features, --lib --no-default-features --features serde, --lib --bins --features cli, --lib --bins --no-default-features --features testing, --all-targets	passed, natively and for --target x86_64-unknown-linux-gnu; every commit also passes cargo check --all-targets --all-features on both	passed (MSHV)
cargo check --all-targets --all-features --target aarch64-apple-darwin; guest Clippy for x86_64-unknown-linux-musl	passed
cargo test --locked --all-features	passed: 16 suites, 1279 tests, 25 ignored (a3d93c075ad; the change since is Linux-only)	MSHV: passed, 95 suites, 2292 tests, 65 ignored. KVM: the 28 guest:: failures of the base on kernel 6.6, the same names, and none else
cargo test --locked	passed: 13 suites, 847 tests	MSHV and KVM: passed 3 times each, 840 tests; the lib binary 20 more times on each, with no failure
cargo build --lib --no-default-features, cargo test --lib --no-default-features	passed: 246	passed: 246 (MSHV)
The bundled-artifact check with a synthetic release		passed: 21 (MSHV)
RUSTDOCFLAGS=-D warnings cargo doc --no-deps --all-features	passed	passed (MSHV)
public_api.py	updated with --update, then passed	passed (MSHV)
cargo +1.89 check --all-targets --all-features (MSRV)		passed (MSHV)
check-guest-binaries, then build-guest-binaries and test-guest-binaries		MSHV: passed, 64 suites, 1211 tests, 47 ignored; 33. KVM: the base's guest:: failures on kernel 6.6
check_test_layout.py, check_markdown_links.py, SL5.2's check_matrix.py	passed
Python: ruff check, ruff format --check, pyright (Linux and Windows) of the changed scripts; shellcheck --shell=sh guest/common/init; GuestInitRoutingTests, GuestInitWorkloadIdentityTests and the scenarios' unit tests	passed

The microVM scenarios and the example ran on a3d93c075ad with the static nvx-rs that each host built, the Alpine initramfs that nvx.py build-initramfs built from this branch on nvx-kvm-test (its /init is guest/common/init byte for byte; copied to the other hosts and checked by SHA-256), and CI run 43168368915's kernel, Ubuntu distro layer, scratch template and OpenVMM builds of the pin 14dc4116, with their provenance:

	nvx-kvm-test	nvx-mshv-test	nvx-whp-test
workload-identity, managed-lifecycle (D5)	passed	passed	passed
guest-boot, lifecycle, vm-lifecycle	passed	passed	passed
sandbox-lifecycle, sandbox-ram-upper, sandbox-blocks, managed-exec-config	passed	passed	passed
sandbox-gpt-layer, sandbox-proxy-only	passed	passed
filesystem-shares, snapshot-core, command-line-limit, structured-outcome	passed	passed	passed
filesystem-comma-paths, filesystem-owner, platform-filesystem, platform-aggregate-export	passed	passed
external-launch: a cold boot, then a restore up to its restore-ready event from a snapshot that nvx-rs snapshot capture captured	passed	passed	passed

The microVM scenarios ran with the default signal dispositions. They also passed on 38dd99330ba, before the restack on f03c21c3f0c.

604d8dacccb, before the rebase onto 230a1b0877d, differs from c04cd8a7b18 only by #1526's fix of its review thread, in sandbox/lifecycle/start.rs and its tests. On it, Windows passed cargo test --all-features (16 suites, 1279 tests, 25 ignored), cargo test (13 suites, 847 tests), cargo test --lib --no-default-features (246), cargo doc with -D warnings, public_api.py, check_test_layout.py, and Clippy --all-targets --all-features, --lib --no-default-features and --lib --bins --features cli, natively and for x86_64-unknown-linux-gnu, with the macOS check. nvx-mshv-test passed cargo test --all-features (95 suites, 2292 tests, 65 ignored), cargo test (13 suites, 840 tests), Clippy --all-targets --all-features, and sandbox-lifecycle, sandbox-ram-upper, managed-exec-config, workload-identity and managed-lifecycle with nvx-rs built at that commit.

This head, c5d2ee8d0b7: Windows passed the full Clippy matrix of check-nvx-rs with -D warnings on the rebased commits, natively and for x86_64-unknown-linux-gnu, with the macOS check; and on this head cargo test --all-features (16 suites, 1225 tests, 25 ignored), cargo test (13 suites, 790 tests), cargo test --lib --no-default-features (190), cargo doc with -D warnings, public_api.py, check_test_layout.py, check_markdown_links.py, SL5.2's check_matrix.py, ruff check, ruff format --check, pyright for Linux and Windows, shellcheck, and GuestInitRoutingTests, GuestInitWorkloadIdentityTests and the scenarios' unit tests. nvx-kvm-test passed shellcheck and shfmt of the shell scripts with CI's pinned images, the same Python unit tests, and workload-identity, managed-lifecycle, guest-boot, lifecycle, vm-lifecycle, sandbox-lifecycle, sandbox-ram-upper and managed-exec-config, with the Alpine initramfs that nvx.py build-initramfs built from this head (SHA-256 beb5d8e5, copied to the other hosts) and nvx-rs built at this head. nvx-mshv-test passed the same scenarios and unit tests, and cargo test --all-features (95 suites, 2200 tests, 65 ignored). nvx-whp-test passed workload-identity, managed-lifecycle, guest-boot, lifecycle, sandbox-lifecycle and managed-exec-config. On each host, the workload-identity scenario's two new boots stopped with NVX-WORKLOAD-ERROR: nvx_identity must name OpenVMM's workload identity. CI run 43203015701 passed on this head: 33 jobs, the microVM shards, guests and sandboxes, and platform jobs of KVM, MSHV and WHP among them, with 9 skipped (publication, recording and persistence). A code-review agent found no issue in the new commit, and Copilot's review of this head reports none.

Changes to existing tests (tests-modified)

check_test_changes.py --base origin/feature/nvx-refactor lists 372 changes, explained by deleted code in "Every removed test, and its fate" above: the tests of deleted code retire; the tests of code that stays move to its owners, or drop the assertions on deleted rendering, or run what the CLI runs; one renamed test follows its new reference. Two changes go beyond a move:

• vmms_inherit_only_their_streams_and_allowed_descriptors_while_others_spawn now runs beside the crate's other unit tests, where its check that a process spawned through std::process holds none of the VMMs' descriptors failed on Linux, consistently in the default-feature lib binary on nvx-mshv-test: the kernel wakes posix_spawn's parent before the child's exec closes its close-on-exec descriptors, so for an instant the child's table still lists every descriptor of the parent, both ends of the test's pipes included. held_objects looks again until the objects are gone or a second passes: an inherited descriptor stays for the child's life. The same check in tests/supervisor.rs had this race; it showed in the busier process. With the fix, 20 runs of that binary passed on each Linux host, where 20 of 20 failed without it.
• tests/vectors/snapshot-key-v1.txt loses its CLASS vectors, whose type goes; its KEY vectors don't change.

[github-actions]

This pull request changes existing tests

It modifies or removes 372 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified attributes	the inner attributes of host::launch::tests (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and target_os = "linux" and test hold, not where feature = "host" and test did)	nvx-rs/src/host/launch/tests.rs:1	nvx-rs/src/host/spawn/tests/linux.rs:1
modified attributes	the inner attributes of host::spawn::tests (it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and test hold, not where feature = "host" and target_os = "linux" and test did)	nvx-rs/src/host/spawn/tests.rs:1	nvx-rs/src/host/spawn/tests.rs:1
modified attributes	the inner attributes of supervisor/restricted (tests) (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and test and windows hold, not where any ( target_os = "linux" , windows ) and feature = "host" and windows did)	nvx-rs/tests/supervisor.rs:978	nvx-rs/src/host/spawn/tests.rs:876
modified helper	fn runtime in host::cli::snapshots::capture::tests	nvx-rs/src/host/cli/snapshots/capture/tests.rs:185	nvx-rs/src/host/cli/snapshots/capture/tests.rs:186
modified helper	fn fake_spawn in host::cli::snapshots::capture::tests	nvx-rs/src/host/cli/snapshots/capture/tests.rs:263	nvx-rs/src/host/cli/snapshots/capture/tests.rs:264
modified helper	fn running in host::cli::store::tests::recovery::process	nvx-rs/src/host/cli/store/tests/recovery.rs:140	nvx-rs/src/host/cli/store/tests/recovery.rs:140
modified helper	fn finish in host::platform::windows::tests, impl HeldSpawn``	nvx-rs/src/host/platform/windows/tests.rs:683	nvx-rs/src/host/platform/windows/tests.rs:633
modified helper	fn start in host::restore::tests, impl Client``	nvx-rs/src/host/restore/tests.rs:49	nvx-rs/src/host/restore/tests.rs:49
modified helper	fn drop in host::restore::tests::live_init, impl Drop for OwnedVm``	nvx-rs/src/host/restore/tests/live_init.rs:31	nvx-rs/src/host/restore/tests/live_init.rs:31
modified helper	fn run in host::restore::tests::live_init	nvx-rs/src/host/restore/tests/live_init.rs:160	nvx-rs/src/host/restore/tests/live_init.rs:160
modified helper	fn workload in host::restore_driver::tests	nvx-rs/src/host/restore_driver/tests.rs:182	nvx-rs/src/host/restore_driver/tests.rs:182
modified helper	fn new in host::sandbox::options::tests, impl Shares``	nvx-rs/src/host/sandbox/options/tests.rs:916	nvx-rs/src/host/sandbox/options/tests.rs:903
modified helper	fn run in host::sandbox::options::tests, impl Shares``	nvx-rs/src/host/sandbox/options/tests.rs:939	nvx-rs/src/host/sandbox/options/tests.rs:924
modified helper	fn layer in host::sandbox::prepared::tests, impl Staged`` (moved, and it now compiles where feature = "host" and `test` hold, not where `any ( target_os = "linux" , windows )` and `feature = "host"` and `test` did)	nvx-rs/src/host/sandbox/prepared/tests.rs:106	nvx-rs/src/host/sandbox/options/tests.rs:80
modified helper	fn host_text in host::sandbox::tests (moved, and it now compiles where feature = "host" and test and windows hold, not where feature = "host" and test did)	nvx-rs/src/host/sandbox/tests.rs:60	nvx-rs/src/host/sandbox/tests.rs:46
modified helper	fn new in host::sandbox::tests, impl Fixture``	nvx-rs/src/host/sandbox/tests.rs:788	nvx-rs/src/host/sandbox/tests.rs:218
modified helper	fn planned in host::sandbox::tests, impl Fixture``	nvx-rs/src/host/sandbox/tests.rs:816	nvx-rs/src/host/sandbox/tests.rs:230
modified helper	fn new in host::snapshot::capture::tests, impl Fixture``	nvx-rs/src/host/snapshot/capture/tests.rs:78	nvx-rs/src/host/snapshot/capture/tests.rs:78
modified helper	fn key in host::snapshot::key::tests	nvx-rs/src/host/snapshot/key/tests.rs:33	nvx-rs/src/host/snapshot/key/tests.rs:33
modified helper	fn network_key in host::snapshot::key::tests	nvx-rs/src/host/snapshot/key/tests.rs:38	nvx-rs/src/host/snapshot/key/tests.rs:38
modified helper	type Change in host::snapshot::key::tests	nvx-rs/src/host/snapshot/key/tests.rs:43	nvx-rs/src/host/snapshot/key/tests.rs:44
modified helper	fn identity_after in host::snapshot::key::tests	nvx-rs/src/host/snapshot/key/tests.rs:47	nvx-rs/src/host/snapshot/key/tests.rs:48
modified helper	fn set_memory in host::snapshot::key::tests	nvx-rs/src/host/snapshot/key/tests.rs:54	nvx-rs/src/host/snapshot/key/tests.rs:69
modified helper	fn assert_mismatched in host::snapshot::key::tests	nvx-rs/src/host/snapshot/key/tests.rs:442	nvx-rs/src/host/snapshot/key/tests.rs:442
modified helper	fn vector_class in host::snapshot::key::tests (renamed to vector_context)	nvx-rs/src/host/snapshot/key/tests.rs:984	nvx-rs/src/host/snapshot/key/tests.rs:882
modified helper	fn network_class in host::snapshot::tests (renamed to network_context)	nvx-rs/src/host/snapshot/tests.rs:995	nvx-rs/src/host/snapshot/tests.rs:1003
modified helper	fn new in host::snapshot::tests, impl SnapshotFixture``	nvx-rs/src/host/snapshot/tests.rs:1012	nvx-rs/src/host/snapshot/tests.rs:1020
modified helper	fn new in host::snapshot::tests, impl RestoreFixture``	nvx-rs/src/host/snapshot/tests.rs:1473	nvx-rs/src/host/snapshot/tests.rs:1481
modified helper	fn write_metadata in host::snapshot::tests, impl RestoreFixture``	nvx-rs/src/host/snapshot/tests.rs:1550	nvx-rs/src/host/snapshot/tests.rs:1558
modified helper	struct Reaped in host::spawn::tests (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" hold, not where feature = "host" and target_os = "linux" and test did)	nvx-rs/src/host/spawn/tests.rs:11	nvx-rs/tests/process.rs:174
modified helper	impl Drop for Reaped in host::spawn::tests (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" hold, not where feature = "host" and target_os = "linux" and test did)	nvx-rs/src/host/spawn/tests.rs:13	nvx-rs/tests/process.rs:176
modified helper	fn drop in host::spawn::tests, impl Drop for Reaped`` (moved, and it now compiles where any ( target_os = "linux" , windows ) and `feature = "host"` hold, not where `feature = "host"` and `target_os = "linux"` and `test` did)	nvx-rs/src/host/spawn/tests.rs:14	nvx-rs/tests/process.rs:177
modified helper	fn object in host::spawn::tests (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and target_os = "linux" and test hold, not where feature = "host" and target_os = "linux" and test did)	nvx-rs/src/host/spawn/tests.rs:22	nvx-rs/src/host/spawn/tests/linux.rs:24
modified helper	fn holds in host::spawn::tests (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and target_os = "linux" and test hold, not where feature = "host" and target_os = "linux" and test did)	nvx-rs/src/host/spawn/tests.rs:27	nvx-rs/src/host/spawn/tests/linux.rs:29
modified helper	fn close_on_exec in host::spawn::tests (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and target_os = "linux" and test hold, not where feature = "host" and target_os = "linux" and test did)	nvx-rs/src/host/spawn/tests.rs:34	nvx-rs/src/host/spawn/tests/linux.rs:36
modified helper	fn child_inherits_writer in host::spawn::tests (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and target_os = "linux" and test hold, not where feature = "host" and target_os = "linux" and test did)	nvx-rs/src/host/spawn/tests.rs:44	nvx-rs/src/host/spawn/tests/linux.rs:46
modified helper	fn sleeper in host::spawn::tests (it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and test hold, not where feature = "host" and target_os = "linux" and test did)	nvx-rs/src/host/spawn/tests.rs:57	nvx-rs/src/host/spawn/tests.rs:789
modified helper	fn spawn_sleeper in host::spawn::tests (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and target_os = "linux" and test hold, not where feature = "host" and target_os = "linux" and test did)	nvx-rs/src/host/spawn/tests.rs:64	nvx-rs/src/host/spawn/tests/linux.rs:66
modified helper	fn umask_in in host::spawn::tests (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and target_os = "linux" and test hold, not where feature = "host" and target_os = "linux" and test did)	nvx-rs/src/host/spawn/tests.rs:149	nvx-rs/src/host/spawn/tests/linux.rs:152
modified helper	fn assert_spawns_clear_the_owners_bits in host::spawn::tests (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and target_os = "linux" and test hold, not where feature = "host" and target_os = "linux" and test did)	nvx-rs/src/host/spawn/tests.rs:162	nvx-rs/src/host/spawn/tests/linux.rs:165
modified helper	const VMM_MARKER in checked_handoff (tests) (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and test hold, not where any ( target_os = "linux" , windows ) and feature = "host" did)	nvx-rs/tests/checked_handoff.rs:36	nvx-rs/src/host/spawn/tests.rs:41
modified helper	const GO_MARKER in checked_handoff (tests) (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and test hold, not where any ( target_os = "linux" , windows ) and feature = "host" did)	nvx-rs/tests/checked_handoff.rs:38	nvx-rs/src/host/spawn/tests.rs:47
modified helper	const STARTED_REPORT in checked_handoff (tests) (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and test hold, not where any ( target_os = "linux" , windows ) and feature = "host" did)	nvx-rs/tests/checked_handoff.rs:40	nvx-rs/src/host/spawn/tests.rs:49
modified helper	const DESCRIPTORS_REPORT in checked_handoff (tests) (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and target_os = "linux" and test hold, not where any ( target_os = "linux" , windows ) and feature = "host" and target_os = "linux" did)	nvx-rs/tests/checked_handoff.rs:49	nvx-rs/src/host/spawn/tests.rs:53
modified helper	const CAPABILITY in checked_handoff (tests) (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and test hold, not where any ( target_os = "linux" , windows ) and feature = "host" did)	nvx-rs/tests/checked_handoff.rs:62	nvx-rs/src/host/spawn/tests.rs:67
modified helper	const VMM_LIFETIME in checked_handoff (tests) (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and test hold, not where any ( target_os = "linux" , windows ) and feature = "host" did)	nvx-rs/tests/checked_handoff.rs:66	nvx-rs/src/host/spawn/tests.rs:71
modified helper	fn write_whole in checked_handoff (tests) (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and test hold, not where any ( target_os = "linux" , windows ) and feature = "host" did)	nvx-rs/tests/checked_handoff.rs:128	nvx-rs/src/host/spawn/tests.rs:122
modified helper	fn report_descriptors in checked_handoff (tests) (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and target_os = "linux" and test hold, not where any ( target_os = "linux" , windows ) and feature = "host" and target_os = "linux" did)	nvx-rs/tests/checked_handoff.rs:149	nvx-rs/src/host/spawn/tests.rs:131
modified helper	struct VmmDirectory in checked_handoff (tests) (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and test hold, not where any ( target_os = "linux" , windows ) and feature = "host" did)	nvx-rs/tests/checked_handoff.rs:311	nvx-rs/src/host/spawn/tests.rs:237
modified helper	impl VmmDirectory in checked_handoff (tests) (moved, and it now compiles where any ( target_os = "linux" , windows ) and feature = "host" and test hold, not where any ( target_os = "linux" , windows ) and feature = "host" did)	nvx-rs/tests/checked_handoff.rs:318	nvx-rs/src/host/spawn/tests.rs:246

... and 319 more, which the job's summary lists.

Test data

Change	What	Before	After
modified file	nvx-rs/tests/vectors/snapshot-key-v1.txt	nvx-rs/tests/vectors/snapshot-key-v1.txt	nvx-rs/tests/vectors/snapshot-key-v1.txt

End-to-end tests

Change	What	Before	After
modified helper	def run_workload_identity in scripts/nvx_tools/microvm_tests.py	scripts/nvx_tools/microvm_tests.py:1311	scripts/nvx_tools/microvm_tests.py:1312
modified helper	def run_managed_lifecycle in scripts/nvx_tools/microvm_tests.py	scripts/nvx_tools/microvm_tests.py:1410	scripts/nvx_tools/microvm_tests.py:1446

Relocated unchanged: 33; added: 45. Compared the merge base 230a1b0877d5 with c5d2ee8d0b7c.

[Copilot]

🟢 Approval recommended

No active review issues remain for the legacy launch API removal and transition to CLI-owned lifecycle and identity tokens.

No open issues 🎉

What changed in this PR

This PR implements SL6.3 of #1122, advancing #1076’s move toward a smaller NVX library centered on host::vm. It removes obsolete configuration and launch APIs while preserving the current VM launch path.

Changes:

• Removes legacy launch, checked-file handoff, capture-class, and share-rendering code.
• Gives external-launch its own minimal launcher and switches guest initialization to CLI-owned lifecycle and identity tokens.
• Relocates or updates retained tests and documents the path-based image model and retired coverage.

File	Description
scripts/​test_nvx_tools.py	Tests new init routing and rejection of obsolete identity tokens.
scripts/​test_microvm_tests.py	Checks scenarios supply CLI-owned boot tokens.
scripts/​nvx_tools/​microvm_tests.py	Adds identity and lifecycle tokens to direct OpenVMM scenarios.
nvx-rs/​tests/​vectors/​snapshot-key-v1.txt	Removes capture-class vectors; preserves key vectors.
nvx-rs/​tests/​vectors/​README.md	Documents snapshot-key vectors without capture classes.
nvx-rs/​tests/​host_modules.rs	Removes the deleted supervisor dependency assertion.
nvx-rs/​tests/​cli/​openvmm.rs	Replaces deleted rendering helpers with explicit fixture tokens.
nvx-rs/​src/​protocol/​mod.rs	Removes the account-token export and narrows workload gating.
nvx-rs/​src/​protocol/​boot.rs	Deletes WORKLOAD_ACCOUNT_TOKEN.
nvx-rs/​src/​protocol/​app.rs	Makes workload identity crate-private and narrows feature gating.
nvx-rs/​src/​host/​sys/​process.rs	Deletes descriptor relocation used by checked-file handoff.
nvx-rs/​src/​host/​sys/​mod.rs	Removes unused identity helpers and descriptor-helper exports.
nvx-rs/​src/​host/​supervisor/​mod.rs	Deletes the transitional supervisor module.
nvx-rs/​src/​host/​spawn/​tests/​linux.rs	Houses retained Linux inheritance and umask tests.
nvx-rs/​src/​host/​spawn.rs	Removes legacy spawn wrappers and narrows remaining types’ visibility.
nvx-rs/​src/​host/​snapshot/​tests.rs	Builds snapshot fixtures from capture contexts.
nvx-rs/​src/​host/​snapshot/​key.rs	Removes capture classes and the legacy key constructor.
nvx-rs/​src/​host/​snapshot/​capture/​tests.rs	Uses the shared capture-context fixture.
nvx-rs/​src/​host/​snapshot/​canonical.rs	Updates module comments to describe key encoding only.
nvx-rs/​src/​host/​snapshot.rs	Removes capture-class exports and updates documentation.
nvx-rs/​src/​host/​session/​tests/​managed_lifecycle.rs	Updates a comment to reference vm::spawn.
nvx-rs/​src/​host/​seal/​windows/​tests.rs	Retires tests for deleted final-path handling.
nvx-rs/​src/​host/​seal/​windows.rs	Deletes Windows final-path resolution helpers.
nvx-rs/​src/​host/​seal.rs	Removes the final-path wrapper.
nvx-rs/​src/​host/​sandbox/​scratch/​tests.rs	Checks the Windows claim through its retained field.
nvx-rs/​src/​host/​sandbox/​scratch.rs	Removes handoff-only accessors and updates claim documentation.
nvx-rs/​src/​host/​sandbox/​options.rs	Deletes preflight tied to SandboxLaunch.
nvx-rs/​src/​host/​sandbox/​mount/​tests.rs	Retains planning checks while retiring renderer assertions.
nvx-rs/​src/​host/​sandbox/​mount/​request.rs	Deletes the bootstrap-token rendering helper.
nvx-rs/​src/​host/​sandbox/​mount/​mod.rs	Removes renderer exports and obsolete token constants.
nvx-rs/​src/​host/​sandbox/​mount/​host_paths.rs	Allows the CLI-only recheck to be unused without cli.
nvx-rs/​src/​host/​sandbox/​mount/​boot.rs	Removes boot rendering while retaining path-text conversion.
nvx-rs/​src/​host/​sandbox/​mount/​aggregate.rs	Removes legacy aggregate naming and argument rendering.
nvx-rs/​src/​host/​sandbox/​layer.rs	Updates documentation after BlockRole removal.
nvx-rs/​src/​host/​sandbox/​distro/​tests.rs	Removes the deleted binding-accessor assertion.
nvx-rs/​src/​host/​sandbox/​distro.rs	Deletes handoff-only fields and accessors.
nvx-rs/​src/​host/​restore/​tests/​live_init.rs	Uses private strict spawning and confirmed cleanup.
nvx-rs/​src/​host/​restore/​tests.rs	Replaces the deleted spawn helper with test-owned locking.
nvx-rs/​src/​host/​restore_driver/​tests.rs	Specifies workload identity directly in fixtures.
nvx-rs/​src/​host/​process.rs	Removes inherited-handle closure and updates spawn documentation.
nvx-rs/​src/​host/​platform/​windows/​tests.rs	Adapts retained spawn tests and retires handle-closure coverage.
nvx-rs/​src/​host/​platform/​windows/​spawn.rs	Deletes legacy timed termination and annotates CLI-only waiting.
nvx-rs/​src/​host/​platform/​windows/​process.rs	Deletes cross-process inherited-handle closure.
nvx-rs/​src/​host/​platform/​inherit.rs	Removes generic spawning and descriptor-path APIs; keeps private locking.
nvx-rs/​src/​host/​mod.rs	Removes launch and supervisor modules and updates module documentation.
nvx-rs/​src/​host/​config/​tests.rs	Checks rendered configuration directly instead of comparing legacy launches.
nvx-rs/​src/​host/​config/​mod.rs	Updates legacy comments and annotates a CLI-only check.
nvx-rs/​src/​host/​cli/​store/​tests/​recovery.rs	Adapts recovery fixtures to private spawning.
nvx-rs/​src/​host/​cli/​store/​tests/​liveness.rs	Adapts liveness fixtures to private spawning.
nvx-rs/​src/​host/​cli/​snapshots/​capture/​tests.rs	Uses capture contexts and private spawn fixtures.
nvx-rs/​src/​host/​cli/​sandbox/​state.rs	Removes legacy-plan comparisons from documentation.
nvx-rs/​examples/​external-launch.rs	Adds a minimal caller-owned launcher and process identity capture.
guest/​common/​init	Stops reading obsolete tokens and routes layered roots to nvx-init.
doc/​project-structure.md	Documents current init routing and inactive legacy scripts.
doc/​design/​5.1-boot-protocol.md	Documents CLI-owned identity and lifecycle tokens.
doc/​design/​4.2-guest-agents-and-workload-model.md	Describes nvx-init as the layered-root init.
doc/​acceptance-case-matrix.md	Records retired handoff coverage and updated test locations.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are reported for the legacy API cleanup and migration to host::vm.

No open issues 🎉

_{Review effort: Balanced}