[Pedro Henrique Penna (ppenna)]

Leaving code only. This PR changes only code that this effort removes from NVX: five items of nvx::host::filesystem that no NVX program calls, resolve_guest_path with its re-exports at nvx:: and nvx::host::filesystem::, Target::Convention with its branch of resolve_mapping, Mapping::convention, ExportRequest::new and PathList::EMPTY, with the edits that remove references to them. Nothing that stays changes, and no later PR uses what it changes, so the size limits for kept code don't apply.

Part of #1122 (SL6.6d, "the planner items that only tests use are gone", recorded on #1122). Parent #1087, umbrella #1076.

It was stacked on #1539 (SL6.7b), which merged, and its base is now feature/nvx-refactor. SL6.5a2 (#1544, #1125) stacks on this one and makes the export planner private to the CLI, which would leave these five items dead; the note on #1125 records that resolve_guest_path goes rather than becoming private.

What and why

SL6.5a2 makes the export planner of nvx::host::filesystem crate-private and gated by cli. Five of its items have no caller in any NVX program, only in the public API and in tests, so the warning-denied build of the cli feature finds them dead once private: Clippy reports resolve_guest_path, the variant Convention, Mapping::convention, PathList::EMPTY and ExportRequest::new on Windows, Linux and macOS. As SL6.6b did for SL6.4 and SL6.6c for SL6.7b, this PR deletes them first, so that SL6.5a2 stays visibility-only. One commit, host: delete the planner items that only tests use (c6d9d604):

• resolve_guest_path, with its re-exports at nvx:: and nvx::host::filesystem::, which gave the guest path of a host path once resolved, or as spelled when it did not resolve. No NVX program translates a host path that way. guest_path, the convention itself, stays public at both paths. The import of canonicalize that only it used goes with it.
• Target::Convention, with its branch of resolve_mapping, which derived a mapping's target from its resolved host path, and Mapping::convention, which mapped a list's paths there. NVX's callers, nvx-rs run and the sandbox's shares, give every target as Target::Guest. resolve_mapping now takes the target from the mapping and checks it as the Guest branch did, with the same messages, after the host path resolves, as before. The two messages that only the convention's branch made ("has no guest path; use an absolute local path", and "would cover the guest's …" without the target) go with it; no NVX program could reach them.
• ExportRequest::new, and PathList::EMPTY, which only it used. The CLI builds its requests field by field.
• Docs: host::filesystem's module docs and plan's say that the caller gives each target, which guest_path may derive from a resolved host path, and the README's nvx::host::filesystem section drops resolve_guest_path and the convention's targets.
• The public API snapshots lose 6 lines on each platform: ExportRequest::new, Mapping::convention, PathList::EMPTY, Target::Convention, and resolve_guest_path at both of its paths. Nothing is added.

What NVX's programs do with host paths doesn't change: resolution, reserved targets, policy paths, aliases, OpenVMM's limits and the pins. BOOT_CONTRACT_VERSION and CONTROL_CONTRACT_REVISION don't change either.

Size

Measured against adfc481e2cb (feature/nvx-refactor with SL6.7b), by #1076's rules: leaving code only, no limit. The measuring script counts 17 added or changed code lines: 16 in resolve_mapping, whose target checks lose the match around them and move left, and the root's re-export. Counted files: 3, src/host/filesystem/{mod, guest_path}.rs and src/lib.rs. 9 files change: +145 and −182 lines, tests, docs and snapshots included.

Old tests of the area

• Retired: host::filesystem::tests::resolved_guest_paths_canonicalize_temp_directory_case_aliases (Windows), with resolve_guest_path. Its case moves to spellings_of_one_object_share_its_guest_path, as the note on nvx-rs slimming 4.3.2: path rules are private to the CLI, and the export holds paths only #1125 promises (below).
• Rewritten, checking what they checked of the code that stays: the tests in Test changes.
• Kept: every other test of host::filesystem, the CLI's tests, and the integration and doc tests.

Test changes

python scripts/check_test_changes.py --base adfc481e2cb lists 14 changes to existing tests and 3 added helpers, hence tests-modified:

• nvx-rs/src/host/filesystem/tests.rs (10, and 2 added helpers):
  • The helper plan maps each path of a FilesystemPolicy at the guest path that the new helper convention gives it, guest_path of the resolved host path, as Target::Convention did, in the same order and under the same list names, through Target::Guest, and builds its request directly. A path that doesn't resolve takes an empty target, which the planner never reads: it refuses such a path first, with the same message as before. So the 17 tests that plan a FilesystemPolicy keep every assertion; the one convention-only message that one of them could reach, for /usr on Linux in unenforceable_policies_are_rejected, isn't asserted, only its Unsupported kind, which stays.
  • The new helper plain_request holds what ExportRequest::new did, for the 7 tests that called it: explicit_targets_place_mappings_at_any_free_guest_path, policy_paths_hide_show_and_narrow_writes, narrowed_writes_pin_only_what_lies_in_writable_paths, the_caller_owner_reaches_openvmm_on_linux_hosts, read_write_mappings_to_which_writes_are_narrowed_stay_visible, denied_mapped_directories_inside_denied_ones_show_their_allowed_paths and mapped_paths_resolve_to_utf8_paths.
  • spellings_of_one_object_share_its_guest_path takes the retired test's Windows case, the temporary directory's case alias: the object's whole path in capitals, that of the temporary directory included, whose guest path as spelled differs from the resolved path's, as the retired test asserted and this one still does. Every spelling plans to the object's one child at its resolved path, with one read-only bind at the resolved path's guest path; it now also checks the child's count and root.
  • resolved_guest_paths_canonicalize_temp_directory_case_aliases: retired (above).
• nvx-rs/src/host/cli/run/guest_tokens/tests.rs (1): planned_boot_shares_keep_table_sources_targets_access_and_file_kind builds its request directly, with the CLI's list names and the VMM owner, as ExportRequest::new did; its imports follow.
• nvx-rs/tests/security_checklist.rs (3, and 1 added helper): plan plans through the new helper request, which builds the request directly with an owner, and the_caller_owner_is_refused_on_windows asks it for the caller owner, in place of setting the owner of ExportRequest::new's request; the imports follow. SL6.5a2 moves these export tests to host::filesystem's unit tests.

doc/acceptance-case-matrix.md names none of these tests or items, and check_matrix.py passes.

Validation

local_gates.py --files (from dev) selects test-changes, markdown-links, test-layout, the check-nvx-rs steps and nvx-cli; I ran them from this branch's action definitions, with Rust 1.95.0, locally on Windows and on nvx-mshv-test (Azure Linux 3, kernel 6.18, linux-mshv, virtual machine), in a temporary worktree. No NVX program called these items, so nothing changes what a VM shows, and no microVM scenario needs to run. Everything ran first on 0da7043def2, on SL6.7b's earlier head ede4ebe359f, and again on 3e29656ec07, on 893419a7c68, and passed. Then the guest and NVXC chains, SL6.6c and SL6.7b's restack landed under it, and the commit was rebased onto SL6.7b's last head 484e0c7ff03 as c6c3a9b66fb, with one conflict, in the imports of tests/security_checklist.rs, which had lost process below it; everything ran again there and passed. SL6.7b then merged as adfc481e2cb, with the same tree as 484e0c7ff03, and the commit moved onto it as c6d9d6042b8, with the same tree as c6c3a9b66fb (git range-diff: context only). On that tree:

Check	Windows (local)	Linux (MSHV, kernel 6.18)
cargo fmt --all --check	passed	passed
Clippy -D warnings: --all-targets --all-features, --lib, --lib --no-default-features, and serde, cli and testing alone	passed, natively and for --target x86_64-unknown-linux-gnu, and --all-targets with default features	passed, and --all-targets --no-default-features --features guest
Guest Clippy, --target x86_64-unknown-linux-musl --no-default-features --features guest -D warnings	passed	passed (check-guest-binaries)
cargo check --all-targets --all-features --target aarch64-apple-darwin	passed; its one warning, in host/snapshot/tests.rs, is the base's	passed, the same warning
cargo test --locked --all-features	passed: lib 1060 passed, 18 ignored; cli 113 passed, 2 ignored; security_checklist 7 passed; every other integration and doc test	passed: lib 1764 passed, 59 ignored; cli 123 passed; security_checklist 6 passed; every other integration and doc test
cargo test --locked, cargo build --locked --lib --no-default-features, cargo test --locked --lib --no-default-features	passed (lib 540 passed, 10 ignored; 191 passed)	passed (lib 542 passed, 10 ignored; 191 passed)
RUSTDOCFLAGS=-D warnings cargo doc --locked --no-deps --all-features	passed	passed
MSRV: cargo +1.89 check --locked --all-targets --all-features	passed	passed
python scripts/public_api.py	passed	passed
check_test_layout.py, check_matrix.py <worktree> 99d2022085f	passed

• Before this PR, with the planner already private and cli-gated (SL6.5a2's change), cargo clippy --lib --bins --features cli -D warnings reported exactly these five items, natively and for x86_64-unknown-linux-gnu and aarch64-apple-darwin; the other feature sets don't build the planner.
• A code-review subagent reviewed the whole diff and found no issue.

CI run 43306214365 on c6d9d6042b8 passed: 33 jobs succeeded, among them the microVM scenarios on KVM, MSHV and WHP, and 9 were skipped as for every pull request (OpenVMM CI of the pinned revision, for the unchanged pin, the debug kernels, publishing and performance records).

[github-actions]

This pull request changes existing tests

It modifies or removes 14 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified helper	fn plan in host::filesystem::tests	nvx-rs/src/host/filesystem/tests.rs:15	nvx-rs/src/host/filesystem/tests.rs:17
modified helper	fn plan in security_checklist (tests)	nvx-rs/tests/security_checklist.rs:30	nvx-rs/tests/security_checklist.rs:47
modified imports	the imports of security_checklist (tests)	nvx-rs/tests/security_checklist.rs:13	nvx-rs/tests/security_checklist.rs:13
modified test	fn planned_boot_shares_keep_table_sources_targets_access_and_file_kind in host::cli::run::guest_tokens::tests	nvx-rs/src/host/cli/run/guest_tokens/tests.rs:47	nvx-rs/src/host/cli/run/guest_tokens/tests.rs:47
modified test	fn spellings_of_one_object_share_its_guest_path in host::filesystem::tests	nvx-rs/src/host/filesystem/tests.rs:687	nvx-rs/src/host/filesystem/tests.rs:725
modified test	fn explicit_targets_place_mappings_at_any_free_guest_path in host::filesystem::tests	nvx-rs/src/host/filesystem/tests.rs:1090	nvx-rs/src/host/filesystem/tests.rs:1125
modified test	fn policy_paths_hide_show_and_narrow_writes in host::filesystem::tests	nvx-rs/src/host/filesystem/tests.rs:1294	nvx-rs/src/host/filesystem/tests.rs:1329
modified test	fn narrowed_writes_pin_only_what_lies_in_writable_paths in host::filesystem::tests	nvx-rs/src/host/filesystem/tests.rs:1457	nvx-rs/src/host/filesystem/tests.rs:1492
modified test	fn the_caller_owner_reaches_openvmm_on_linux_hosts in host::filesystem::tests	nvx-rs/src/host/filesystem/tests.rs:1534	nvx-rs/src/host/filesystem/tests.rs:1569
modified test	fn read_write_mappings_to_which_writes_are_narrowed_stay_visible in host::filesystem::tests	nvx-rs/src/host/filesystem/tests.rs:1596	nvx-rs/src/host/filesystem/tests.rs:1628
modified test	fn denied_mapped_directories_inside_denied_ones_show_their_allowed_paths in host::filesystem::tests	nvx-rs/src/host/filesystem/tests.rs:1657	nvx-rs/src/host/filesystem/tests.rs:1689
modified test	fn mapped_paths_resolve_to_utf8_paths in host::filesystem::tests	nvx-rs/src/host/filesystem/tests.rs:1756	nvx-rs/src/host/filesystem/tests.rs:1788
modified test	fn the_caller_owner_is_refused_on_windows in security_checklist (tests)	nvx-rs/tests/security_checklist.rs:96	nvx-rs/tests/security_checklist.rs:110
removed test	fn resolved_guest_paths_canonicalize_temp_directory_case_aliases in host::filesystem::tests	nvx-rs/src/host/filesystem/tests.rs:712

Relocated unchanged: 0; added: 3. Compared the merge base adfc481e2cb0 with c6d9d6042b8f.

[Copilot]

🟢 Approval recommended

No active review issues remain for the removal of unused filesystem-planner APIs.

No open issues 🎉

What changed in this PR

Removes five filesystem-planner items unused by NVX programs, preparing for the planner to become private to the CLI in SL6.5a2. The retained explicit-target planning behavior stays unchanged.

Changes:

• Deletes convention-based mapping helpers, resolve_guest_path, and unused request-construction conveniences.
• Updates tests to construct requests directly, retaining policy checks and Windows path-alias coverage.
• Updates documentation and Linux/Windows API snapshots to reflect the removals.

File	Description
nvx-rs/​tests/​security_checklist.rs	Constructs export requests through a test-local helper.
nvx-rs/​src/​lib.rs	Removes the resolve_guest_path re-export; retains guest_path.
nvx-rs/​src/​host/​filesystem/​tests.rs	Replaces deleted helpers and consolidates path-alias coverage.
nvx-rs/​src/​host/​filesystem/​mod.rs	Deletes unused planner items and retains explicit-target validation.
nvx-rs/​src/​host/​filesystem/​guest_path.rs	Removes resolve_guest_path and its unused import.
nvx-rs/​src/​host/​cli/​run/​guest_tokens/​tests.rs	Builds the export request directly for boot-share checks.
nvx-rs/​README.md	Documents caller-supplied targets and the retained path convention.
nvx-rs/​public-api/​windows.txt	Removes six API entries for the deleted items and re-exports.
nvx-rs/​public-api/​linux.txt	Records the same six API removals on Linux.

_{Review effort: Balanced}