[Enrique Saurez (esaurez)]

Supporting input integration for #1114 (SL3.7b), not the capture consumer. This updates the existing Draft input PR by adopting the already-published SL2.14 full-time-contract checkpoint. It adds no new capture command, transaction, producer fix or input PR, and does not close #1114.

Exact source and published inputs

Current head: d814df2e0358ce17f86c45f71a8b1b7f8048eff2; tree: 0562032829106a4ac9c0bb8a11de0a9ab3156bb9.

The original join remains intact at b70d7e98de7f2ef2cb14875e00075f7149d44803, tree 0abebe498db2d15472c9440dd82eb4b3ab208ddd. Its inputs and merge order are preserved:

Input	Published branch	Original pinned commit
#1455, SL2.14, original first parent	esaurez/issue1102-sl214-20261110-b718df7e	2a0451d4ed1e27445bcd4615e7c0878c291edca5
#1445, SL3.7a named store	esaurez/issue1114-sl37a-0c8e42ad-20261110	a81a6c8d874b00e57046b8fcd8657e2a2cbdd2fe
#1446, SL3.3b recovery	private/simple-1108-02e4-sl33b-20261110	8921c45162e38761f1dc5beb51042ee2e7218803
#1453, SL7.8a boot route	esaurez/sl78a-init-routing-fe1cbbee-20261110	d56d3d343977178fd15bbd526a77a97603edbbac

Original merge commits: 06e7f9ef2b85d8d66e3670bd98d1ef4b486e9e24, 94c8e4aa6905e4a757f6f5d20d8c42929e8b1688, then 19119013eb12a962527a6bc426f7024a54f0b868.

The new ordinary merge has exactly two parents: original b70d7e98 and the selected public #1455 checkpoint d4d89270d45945c7a88486f5f238922a5c6ed095, tree 371e3fc936d232cc55d79e029a2d230681cf1656. That checkpoint is a direct child of original 2a0451d4. No later parent, feature, named-store, recovery or private integration head was merged.

The inherited #1454 input remains 4ca3e62da07723368edec89ced8d02f2cd3fbae4, and the inherited feature input remains cf5f91467c050f1e9508403964b1b4546e2724ab. The OpenVMM gitlink is unchanged at 14dc4116ec7e57567633c4b7b07892aca3a58522.

The base ref remains esaurez/issue1102-sl214-20261110-b718df7e. The compiled source uses the immutable D4D checkpoint above, not any subsequent movement of that branch. No retarget, native-stack operation, ancestor rewrite, Ready transition or merge is part of this update.

Full time-contract adoption, without a new design

The answered choice B is now present through D4D, not pending implementation in this input:

• The complete existing TimeContract persists and decodes in key.bin, and SnapshotKey::time exposes it.
• Strict opening checks the complete key/manifest time agreement, including capture anchors, host clock and identities, lineage and cut-to-anchor interval.
• KeyIdentity still hashes the unchanged compatibility prefix. Capture-specific time fields do not change that identity; declared rates and the time ABI remain compatibility inputs.
• The single Fresh encoding changes in place: no version bump, backward decoder, optional time contract or reduced substitute.
• D4D's snapshot-only privacy wrapper is retained without changing legacy template validation.

Actual merge inspection found zero conflicts and zero manual source edits. All five incoming production files, plus the incoming tests, vectors and API snapshots, have exactly D4D's Git modes and blob IDs: 12 entries exactly incoming. Only nvx-rs/README.md automatically combines non-overlapping documentation. All 1,008 unaffected entries exactly match original b70. The resulting tree also equals Git's independently computed ordinary merge tree.

There is no Snapshot::accepts/NIC API union or separate canonical reader/time integration here. Those independent producer changes are not needed by this bounded capture-input adoption.

The original join's selected Error/Result, Opened/Exited, bounded capture-preparation checks, restored-init activation/RESET handling, seventh init seam and ignored native-fixture API reconciliations remain unchanged. No native-fixture execution is claimed.

Size and ownership of the delta

This update versus b70 imports 13 files, 269 added / 81 removed physical lines, entirely from D4D apart from the automatic README combination. New hand-written production core: 0 lines / 0 counted files; new test bodies authored by this merge: 0.

Against the selected D4D checkpoint, the existing imported input integration remains 41 files, 3,552 added / 125 removed physical lines. Those producer changes are not a new consumer implementation. The original join's post-merge hand edits remain the same two test/policy files, 11 added / 5 removed physical lines, with no production-core addition.

Current-head verification

Both platforms compiled the exact current head and tree above, with real NVX Git metadata, the real initialized pinned OpenVMM source/Cargo manifest, private mutable targets/caches and Rust 1.95.0. Linux completed at 2026-11-10T21:47:05Z; Windows at 2026-11-10T22:09:28Z.

Current-source scope	Linux	Windows
Exact native source and scripts/nvx.py verify before Cargo	Passed	Passed
Formatting, nvx and runtime adapter	Passed	Passed
Actual CLI/library/binary build, cli,testing	Passed	Passed
Library, binary and integration-test compilation, NO-RUN	Passed	Passed
CLI/testing all-targets Clippy, warnings denied	Passed	Passed
Affected host adapter all-targets build and Clippy, warnings denied	Passed	Passed
Test layout and both exact-input existing-test inventories	Passed	Passed

Main Cargo commands, shown from each crate's directory; the receipts retain their explicit private target directories and complete arguments:

cargo +1.95.0 fmt --all --check
cargo +1.95.0 build --locked --lib --bins --features cli,testing
cargo +1.95.0 test --locked --no-run --lib --bins --tests --features cli,testing
cargo +1.95.0 clippy --locked --all-targets --features cli,testing -- -D warnings
cargo +1.95.0 build --locked --all-targets --features host
cargo +1.95.0 clippy --locked --all-targets --features host -- -D warnings

The final two commands are the runtime adapter's host configuration. Windows MSVC setup and each Cargo invocation ran in the same cmd.exe process. Inherited CARGO_TARGET_DIR and CARGO_BUILD_JOBS were removed; no fixed CPU/RAM/compiler-job caps were imposed. Windows compilation waited for a fresh safe physical/commit-capacity observation, not an inherited admission promise.

These are current-head compilation/lint receipts, not executed test or hardware results. The older b70 software matrix and producer D4D review/matrix remain historical, pinned evidence; they are not relabeled as runs on this merge. No extra VM, native, kernel, guest-binary, MSRV or full feature matrix, nor manual Copilot review request, was added solely for this unchanged-production adoption.

Existing tests: kept, not retired

The exact update inventory, check_test_changes.py --base b70d7e98de7f2ef2cb14875e00075f7149d44803, reports 4 existing-asset changes and 4 input-added test items:

Existing asset	Accounting
finish_writes_matching_metadata_and_only_its_three_entries_are_published	Keep all finalization/publication assertions; import D4D's explicit key/manifest time equality assertion.
keys_read_back_from_their_canonical_encoding	Keep canonical round trips; hash the specified compatibility prefix rather than the longer persisted time suffix.
keys_of_machines_that_no_manifest_describes_are_refused	Keep the invariant-order refusal; corrupt invariants before the new time suffix, not time accidentally.
snapshot-key-v1.txt	Import D4D's complete time suffixes and malformed encodings; preserve compatibility identity values and CLASS vectors.

The added items are D4D's full-time round-trip/identity case, required-time/known-clock refusal case, strict-opening time-mismatch case, and independent suffix-length helper. They are imported and compiled, not newly authored or executed here.

Against the selected D4D checkpoint, not a subsequently advanced base tip, the original integration still reports 8 existing-asset changes and 137 input-added items:

Existing asset	Accounting
Adapter initramfs::expected helper	Keep archive checks; expect the published /sbin/nvx-init overlay.
APP_ACTIVATE test hook	Keep the codec and published guest-feature gating.
decode_activate_payload test hook	Keep the published gating and payload checks.
Interrupted-launch journal test	Keep journal/capability and duplicate-launch assertions; inspect persisted files without acquiring the recovering lock.
Adapter launcher test	Keep control-tty assertions; expect the published init path and ignored helper PID arguments.
Init seam allowance, 6 to 7	Keep the route input's existing restored-announcer hook.
CLI sandbox-state seam allowance, 1	Keep the published named-store input's single hook.
CLI named-snapshot seam allowance, 1	Keep the same input's single hook.

No existing test is retired, no CI test command is removed, and capture-timeout/restored-activation cases remain intact. The ancestry-wide origin/dev inventory is retained separately and is not attributed to this bounded update.

Remaining conformance and scope limits

• The inherited host: prepare blockless capture launches #1454 pin's known selector-cardinality defect is not fixed or qualified here; later producer fixes are separate inputs.
• The SL3.7b capture command/parser and orchestration remain a separate consumer change. This PR adds no second journal, capture transaction, restore ledger, running-layered capture, restore command or speculative future input.
• Current-head tests were compiled NO-RUN. VM/native capture/restore, broad feature/docs/API/runtime qualification, full CI and hardware/manual conformance are not claimed. Draft CI skips are not passes.
• The input update conveys no inherited consumer qualification and imposes no extra canonical-reader/API or QA merge hold. Eventual Ready/merge and broader qualification remain maintainer-owned.

[github-actions]

This pull request changes existing tests

It modifies or removes 17 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified helper	fn expected in initramfs (tests)	tests/runtime-adapter/tests/initramfs.rs:83	tests/runtime-adapter/tests/initramfs.rs:83
modified hook	the test hooks of const APP_ACTIVATE in protocol::app	nvx-rs/src/protocol/app.rs:71	nvx-rs/src/protocol/app.rs:74
modified hook	the test hooks of fn decode_activate_payload in protocol::app	nvx-rs/src/protocol/app.rs:210	nvx-rs/src/protocol/app.rs:216
modified imports	the imports of host::template::store::tests	nvx-rs/src/host/template/store/tests.rs:5	nvx-rs/src/host/template/store/tests.rs:5
modified test	fn an_interruption_keeps_the_journal_and_capability_without_publishing_runtime in host::cli::store::tests::launch	nvx-rs/src/host/cli/store/tests/launch.rs:163	nvx-rs/src/host/cli/store/tests/launch.rs:166
modified test	fn keys_read_back_from_their_canonical_encoding in host::snapshot::key::tests	nvx-rs/src/host/snapshot/key/tests.rs:661	nvx-rs/src/host/snapshot/key/tests.rs:720
modified test	fn keys_of_machines_that_no_manifest_describes_are_refused in host::snapshot::key::tests	nvx-rs/src/host/snapshot/key/tests.rs:800	nvx-rs/src/host/snapshot/key/tests.rs:859
modified test	fn cold_creation_is_inspectable_without_a_process_listener_or_capability_file in host::vm::tests	nvx-rs/src/host/vm/tests.rs:458	nvx-rs/src/host/vm/tests.rs:878
modified test	fn the_launchers_run_the_guest_agent_on_the_control_tty in initramfs (tests)	tests/runtime-adapter/tests/initramfs.rs:145	tests/runtime-adapter/tests/initramfs.rs:145
removed hook	the test hooks of const OPENVMM in host::vm	nvx-rs/src/host/vm.rs:56
removed hook	the test hooks of const CAPTURE_IMAGE in host::vm	nvx-rs/src/host/vm.rs:74
removed hook	the test hooks of const CAPTURE_SCRATCH in host::vm	nvx-rs/src/host/vm.rs:80
removed test	fn cold_boot_arguments_refuse_capture_configurations in host::config::tests	nvx-rs/src/host/config/tests.rs:1123

Test data

Change	What	Before	After
modified file	nvx-rs/tests/vectors/snapshot-key-v1.txt	nvx-rs/tests/vectors/snapshot-key-v1.txt	nvx-rs/tests/vectors/snapshot-key-v1.txt

Test policy

Change	What	Before	After
loosened allowlist entry	nvx-rs/src/guest/init.rs (the seams allow 7 test hooks, up from 6)		scripts/test-layout-allowlist.json
loosened allowlist entry	nvx-rs/src/host/cli/sandbox/state.rs (the seams allow 1 test hooks)		scripts/test-layout-allowlist.json
loosened allowlist entry	nvx-rs/src/host/cli/snapshots.rs (the seams allow 1 test hooks)		scripts/test-layout-allowlist.json

Relocated unchanged: 0; added: 182. Compared the merge base cf5f91467c05 with d814df2e0358.

[Pedro Henrique Penna (ppenna)]

Closing as superseded: everything that this pull request joined is in feature/nvx-refactor at 5947e4e8.

• Each of its own commits landed through guest: handle snapshot capture requests in nvx-init #1431, host: confirm VM exit before returning stop outcomes (SL2.10) #1432, host: journal CLI launches and persist saved VM records (SL3.2b) #1433, host: verify CLI launch liveness from its log and endpoint (SL3.3a) #1436, host: prove recorded process exit when opening (SL2.10b) #1438, guest: retain restored ingress as an init helper #1439, host: open strict private snapshot directories #1440, host: keep immutable named CLI snapshots #1445, [SL3.3b] Recover interrupted CLI launches under the sandbox lock #1446, guest: activate repaired nvx-init sessions #1447, guest: route new sandbox boots through nvx-init #1453, host: prepare blockless capture launches #1454 or host: finish exited captures into snapshot entries #1455, either patch-identical or rebased with its conflicts resolved.
• Its four integration commits aren't needed there:
  • b134e702dc's liveness change is already in nvx-rs/src/host/cli/store/liveness.rs, verbatim.
  • ce7fa06740's allowlist count of 7 seams for nvx-rs/src/guest/init.rs is already on the branch.
  • e1f7611bda and b70d7e98de only adapt and format the restored-init fixture for the typed host results. They add no test.

#1464, the SL3.7b capture that was stacked on this pull request, has also merged into feature/nvx-refactor. Reopen this pull request if anything is missing.