[Enrique Saurez (esaurez)]

Part of #1091 (SL0.4: the public API has a checked snapshot).

What and why

#1261 added the snapshots of nvx's public API, nvx-rs/public-api/linux.txt and windows.txt, and the check that compares the API with them. While it was in review, #1258 added two public items to nvx::host::platform, on Linux and on Windows: the method Transport::try_clone_handle and the type TransportHandle. #1261 merged without them in its snapshots, so the check fails on dev, as in run 41783992397, job nvx-rs / ubuntu-latest, step "Check nvx-rs":

--- nvx-rs/public-api/linux.txt
+++ the public API on linux
@@ -1956,8 +1956,10 @@
 const nvx::host::platform::SUPPORTED
 trait nvx::host::platform::Transport
 method nvx::host::platform::Transport::read
+method nvx::host::platform::Transport::try_clone_handle
 method nvx::host::platform::Transport::unread
 method nvx::host::platform::Transport::write_all
+type nvx::host::platform::TransportHandle
 fn nvx::host::platform::create_private_dir
 fn nvx::host::platform::file_identity
 fn nvx::host::platform::probe_hypervisor
--- nvx-rs/public-api/windows.txt
+++ the public API on windows
@@ -947,8 +947,10 @@
 const nvx::host::platform::SUPPORTED
 trait nvx::host::platform::Transport
 method nvx::host::platform::Transport::read
+method nvx::host::platform::Transport::try_clone_handle
 method nvx::host::platform::Transport::unread
 method nvx::host::platform::Transport::write_all
+type nvx::host::platform::TransportHandle
 fn nvx::host::platform::create_private_dir
 fn nvx::host::platform::file_identity
 fn nvx::host::platform::probe_hypervisor

This pull request regenerates both snapshots with python scripts/public_api.py --update. Each gains those two lines and nothing else. No code, test, script, workflow or documentation changes.

Tests

No test changes: python scripts/check_test_changes.py --base 74a44fd6c1620023d33457318b28047f2fc84c25 reports "0 change(s) to existing tests; relocated unchanged: 0; added: 0". The 8 tests of scripts/test_public_api.py stay unchanged and pass:

• test_lists_each_kind_of_item_by_its_path
• test_follows_re_exports
• test_marks_hidden_items_and_what_hidden_items_contain
• test_lists_feature_gated_items_as_any_other
• test_refuses_another_format_version
• test_refuses_what_it_cannot_list
• test_check_prints_how_the_api_differs_and_fails
• test_update_rewrites_the_snapshots

Size

0 core lines in 0 counted files, under #1076's rules: the snapshots are generated and don't count. They gain 4 generated lines, 2 per platform.

Validation

With Rust 1.95.0, whose rustdoc writes JSON format 57, on Windows and on Linux, x86-64. Nothing was published.

• At the base, 74a44fd: python scripts/public_api.py fails on both with exactly the diff above. The listings that it generates have 3428 lines for Linux and 2418 for Windows, against 3426 and 2416 in the committed snapshots.
• At this head: python scripts/public_api.py passes on both, and the listings that it generates equal the committed snapshots byte for byte, identical on both. scripts/test_public_api.py, the test-change check, the test layout check and the Markdown links pass on both, with Python 3.13 on Windows and Python 3.12 on Linux.
• Inputs:
  • Only scripts/public_api.py uses the snapshots: check-nvx-rs runs it to compare the API with them, and --update rewrites them. scripts/test_public_api.py writes its own in temporary directories. No build, Rust source, test or program reads them.
  • The source digest of the guest binaries, over the files that they're built from, nvx-rs/src among them, is the same at the base and at this head.
  • The module diagrams, which module-diagrams.yml redraws for a change under nvx-rs/, come from the crate's modules through cargo-modules, which the snapshots aren't part of.
  • The crate's package includes the snapshots, so it changes by these 4 lines, and the next full run of dev, which publishes the crate when nvx-rs/ changed, counts them as such a change, like any other file there.
  • CI's change detection counts every file under nvx-rs/ but Markdown as an input of the microVM tests and the benchmarks, so it selects them for this change, with the guest artifacts and the OpenVMM binaries that they use.
• Not run locally: the Rust checks and tests, and the VM scenarios, since no Rust, Cargo or program input changed. This pull request claims no pass of them; CI runs them.
• Not addressed: the same run of dev also failed NVX microVM tests / Linux / KVM / Guests and sandboxes, at step "Run runtime adapter scenarios on Linux": the vm_clone scenario one_template_serves_the_clones_of_every_network_policy_at_its_guest_s_address failed its assertion at tests/runtime-adapter/tests/vm_clone.rs:1635. This pull request changes nothing that the scenario runs, so it neither fixes nor waives that failure, and CI's microVM tests run the scenario again for this change.

[Copilot]

🟢 Approval recommended

No active review issues remain for the Linux and Windows public API snapshot updates.

No open issues 🎉

What changed in this PR

Updates nvx’s checked public API snapshots to include the native transport handle API added in #1258, correcting the snapshot mismatch left after #1261 merged.

Changes:

• Records Transport::try_clone_handle and TransportHandle in both platform snapshots.
• Adds four generated lines without changing runtime code, tests, or CI configuration.

File	Description
nvx-rs/​public-api/​windows.txt	Records the two existing Windows transport API items.
nvx-rs/​public-api/​linux.txt	Records the two existing Linux transport API items.

_{Review effort: Balanced}

[github-actions]

Neuro-formal verification (NFV) selects nontrivial properties from PR intent and source, tries verification, then tries refutation.

NFV: 0 refuted, 0 verified in PR #1277

PR head cfd105a9797f, base 74a44fd6c162 · run and evidence

These are results for translated models under their stated assumptions, not proofs of source-code correctness or confirmed source bugs.

refuted: 0 · verified: 0 · resources exhausted: 0 · type-check/audit failure: 0

Generated by NFV PR reviewer for #1277 · ⌖ 7.62 AIC · ◷

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add microsoft/neuro-formal-verification/workflow@498aad98c39314a8c55c89dff42d771276b957d8