nvx-rs: declare 0.2.0-alpha.1, the breaking release, and its changelog

The breaking release of #1076 must declare its version and record
what it breaks (#1132). crates.io holds 0.1.0-alpha.1 to
0.1.0-alpha.16, and dev's nightly runs take the next number of the
0.1.0-alpha series whenever the crate changes there, until this work
reaches dev. The crate now declares 0.2.0-alpha.1, the first version
of a series that nothing has published, which doc/distribution.md
describes for a new series: the full run of dev that first packs
this commit publishes exactly that version, whatever numbers the
nightlies took meanwhile, and a requirement such as
nvx = "0.1.0-alpha.7", which Cargo also resolves to later 0.1.0
pre-releases, never resolves to it.

The new root CHANGELOG.md records the release in one entry, which
lists its breaking changes and links doc/migrate-from-alpha.7.md for
the details. doc/distribution.md names the two series.

Tests: ChangelogTests keeps the changelog's newest entry equal to the
version that nvx-rs/Cargo.toml declares, so a pull request that starts
another series adds its entry.

Part of #1132 (SL8.1).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: ppenna

CHANGELOG.md

@@ -0,0 +1,46 @@
+# Changelog
+
+This file lists NVX's breaking releases: those of the
+[`nvx` crate](nvx-rs/README.md), with the guest artifacts of the same commit.
+CI publishes the crate's other versions every night, as
+[crates.io releases](doc/ci.md#cratesio-releases) describes.
+
+## 0.2.0-alpha.1
+
+`nvx` becomes a library of mechanisms and value types for microVMs, on which
+NVX's own programs and other users build
+([microsoft/nvx#1076](https://github.com/microsoft/nvx/issues/1076)). The
+release is not backward compatible: users that need `0.1.0-alpha.7` stay on it.
+[Migrating from alpha.7](doc/migrate-from-alpha.7.md) maps each removed or
+changed item to its replacement, or to what its caller now does.
+
+### Breaking changes
+
+- **No durable state.** The sandbox and template stores, the instance layer and
+  the supervisor are gone from `nvx::host`. A caller keeps its own state from the
+  values that `nvx::host::vm` returns.
+- **One launch.** The old configurations and launch paths, such as
+  `LaunchSpec`, `SandboxPlan` and `ClonePlan`, are gone: `nvx::host::vm::create`
+  takes a `VmConfig` and, for a restore, a `Snapshot`.
+- **No exec.** The exec engine, `nvx::exec`, and the guest's process modules,
+  `nvx::guest::{exec, spawn, process, cgroup, entry}`, are gone. A guest's init
+  runs its executions itself.
+- **The guest's space is private.** nvx-init's space, `nvx::guest::{root, gpt}`
+  and the mapper of `nvx::guest::mappings`, is private to `nvx`.
+  `resolve_guest_path` is gone, and `ExportPlan` holds paths only.
+- **NVXC is private.** NVX's own protocol is private to `nvx`, and speaks only
+  version 2: version 1 and its `FEATURES` request are gone.
+- **Errors.** `ErrorCode` and `Error`'s constructors are private: callers tell
+  errors apart by their `ErrorKind`.
+- **NVX's programs are private.** Each binary calls a hidden `main`, which is all
+  that the programs add to the public API. Artifact discovery (`nvx::Artifacts`),
+  image staging, the control session and the platform layer are private to them.
+- **Features.** The `bundled` feature is gone, with its build script.
+- **Fresh state.** The CLI reads a sandbox's configuration only in format 10,
+  which requires `export_pins`: deprovision each sandbox that an earlier build
+  provisioned, and provision it again. Nothing reads alpha.7's records, keys or
+  snapshots, so a deploy captures its snapshots again.
+- **The guest's `/init`** fails closed on OpenVMM's workload identity: a command
+  line with `nvx_workload_uid=` or `nvx_workload_gid=` boots only when
+  `nvx_identity=` names the same UID and GID.
+- **The guest kernel** no longer sets `CONFIG_MAGIC_SYSRQ`.

doc/distribution.md

@@ -154,15 +154,18 @@ released first-parent ancestor.
 ## The nvx crate
 
 [`nvx-rs/`](../nvx-rs/README.md) is also published on crates.io as the `nvx`
-crate, a preview whose versions are pre-releases, `0.1.0-alpha.N`, which Cargo
-selects only for a requirement that names a pre-release. The nightly CI run
-publishes a new version from `dev` whenever the crate changed, with the next
-number, as [crates.io releases](ci.md#cratesio-releases) describes, so a
-change reaches crates.io within a day of its merge.
+crate, a preview whose versions are pre-releases, which Cargo selects only for
+a requirement that names a pre-release: `0.2.0-alpha.N` since the breaking
+release that the [changelog](../CHANGELOG.md) records, and `0.1.0-alpha.N`
+before it. The nightly CI run publishes a new version from `dev` whenever the
+crate changed, with the next number, as
+[crates.io releases](ci.md#cratesio-releases) describes, so a change reaches
+crates.io within a day of its merge.
 
 The version that `nvx-rs/Cargo.toml` declares is the lowest that CI
-publishes. A pull request changes it to start another series, such as
-`0.2.0-alpha.1`. Only `nvx`'s version changes in `nvx-rs/Cargo.lock`.
+publishes. A pull request changes it to start another series, as the breaking
+release started `0.2.0-alpha.1`. Only `nvx`'s version changes in
+`nvx-rs/Cargo.lock`.
 
 When CI cannot publish, as when the newest version on crates.io records no
 commit that `dev` holds, a pull request declares the next version as above,

nvx-rs/Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "nvx"
-version = "0.1.0-alpha.3"
+version = "0.2.0-alpha.1"
 edition = "2024"
 rust-version = "1.89"
 description = "NVX mechanics: the OpenVMM control protocol and the launch, policy lowering, and supervision of NVX microVMs"

nvx-rs/Cargo.toml

@@ -1434,6 +1434,21 @@ def test_publish_checks_what_crates_io_serves(self):
             self.publish()
 
 
+class ChangelogTests(unittest.TestCase):
+    def test_the_newest_entry_is_the_series_that_the_crate_declares(self):
+        # CHANGELOG.md lists the breaking releases, each the first version of
+        # the series whose floor nvx-rs/Cargo.toml then declares, so a pull
+        # request that starts another series adds its entry.
+        root = BuildConstants.REPO_ROOT
+        manifest = crate_release.read_manifest(
+            (root / "nvx-rs" / "Cargo.toml").read_bytes(), "nvx-rs/Cargo.toml"
+        )
+        entries = re.findall(
+            r"(?m)^## (\S+)$", (root / "CHANGELOG.md").read_text(encoding="utf-8")
+        )
+        self.assertEqual(entries[:1], [str(manifest.version)])
+
+
 class CommandLineTests(unittest.TestCase):
     def test_runs_the_step_on_the_crate(self):
         with (