VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list

VM track of the deployment-architecture epic (design: PR #5764 §6).

Current state (2026-11-04 inventory): virtualisation.libvirtd.enable = true in the laptop profile and zero guest definitions anywhere — no libvirt XML, no nixvirt, no virsh-managed domains in any repo. Seeds present: microvm.nix is a flake input with one defined VM (prometheus, qemu, 2 vCPU/1 GB, virtiofs /nix/store share) whose profile is commented out on amd (nixos/hosts/default.nix:30); the flake has lib.make-vm-configurations machinery (per-host vm_<host> NixOS variants).

Work:

Evaluate nixvirt (declarative libvirt domains/networks/pools as Nix) vs flake-generated libvirt XML as the renderer for libvirt guests; record the pick and why in this issue. microvm.nix is the presumptive answer for ephemeral/agent-class guests — confirm or refute.
Define the guest generation shape: {domain definition, disk image (flake-built), NixOS source rev}; data volumes attach to generations, never live inside them.
Land the first declarative guests: bring prometheus under generation discipline (enable the microvm profile deliberately or supersede it), plus one libvirt guest end-to-end if a real need exists — otherwise the renderer + a throwaway test guest that is defined, started, rolled back, and destroyed as the acceptance proof.
Write the mutable carve-out list (starts empty): guests that may drift in data but not OS definition (DB hosts, lab stateful nodes), and the rule that full drift requires a named waiver with owner + reason.

Acceptance: at least one guest of each class (microVM, libvirt) can be defined/started/rolled back from flake state alone on a clean checkout; the carve-out list exists in the flake (even if empty) with the waiver rule stated; deploy vm:<name> integration is specced (implementation may ride the deploy tool's later target classes).

CODE-1458

agent-note:v1
task: 10178
lane: code-u
state: handed-off
summary: Task 10178 claimed by lane code-u; execution-lane assignment returned opencode, so this task is handed off to the opencode claimant per the worker runbook §1b. Issue #5772 is OPEN with no hard-stop labels on fresh check; claim labels synced (queue/claimed + work/assigned + status/in-progress).
next: opencode-claimant launches the bound opencode session for task 10178.

agent-note:v1
task: 10178
lane: code-u
state: handed-off
summary: Task 10178 re-claimed by lane code-u after the first opencode handoff's lease expired without a claimant launch; execution-lane assignment again returned opencode, so the task is handed off to the opencode claimant again per the worker runbook §1b. Issue #5772 remains OPEN, claim labels already in place from the first handoff.
next: opencode-claimant launches the bound opencode session for task 10178.

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-i
Session / ID: task 10178
Found via: queue claim
Task: handing task 10178 (issue VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list #5772) to the opencode execution lane; the laptop claimant launches the bound opencode session
Expectation: claimant drives task 10178 to a terminal state; parked 30 min to release this lane's claim
Links: issue VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list #5772

🤖 Agent note · state: handed off

Agent: queue worker (repo-worker-code), lane code-o
Session / ID: task 10178
Found via: queue claim
Task: triage of issue VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list #5772 is assigned to the opencode execution lane — handed off to the opencode claimant, which launches a bound session to drive task 10178 to its terminal state.
Expectation: claimant launches the bound opencode session during the park window; if unbound at lease expiry, task 10178 returns to the queue.
Links: issue VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list #5772

🤖 Agent note · handed off

Agent: repo queue worker, lane code-p (repo-worker-code)
Session / ID: cron repo-queue-worker-shift-p run 2026-11-05 09:22 CST; task 10178
Found via: claimed task 10178 this shift; execution-lane assignment returned opencode (repeat handoff, attempt 4/6)
Task: Triage for issue VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list #5772: VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list — issue VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list #5772. Fresh check: issue VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list #5772 is OPEN, no hard-stop labels (held / user/owned / do-not-merge / do-not-auto-edit). Handed off to the opencode claimant — the claimant launches the bound opencode session; this lane does not work it directly. Parked 1200s to release the claim for the claimant window.
Expectation: claimant session drives task 10178 to a terminal state.
Links: task 10178 · issue VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list #5772

🤖 Agent note · picked up

Agent: repo queue worker (repo-worker-code), OpenChamber scheduled lane 9aca43b4-5439-4939-9f71-323f5d32521b
Session / ID: task 10178
Found via: atomic claim from repo-health-code-pilot
Task: triage issue VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list #5772; fresh REST checks show it is open, has no hard-stop labels, and its referenced architecture PR doc: deployment architecture — a services layer outside the system switch #5764 is merged.
Expectation: verify the design against current main, then post scoped triage findings and blockers/order on this issue.
Links: VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list #5772 · doc: deployment architecture — a services layer outside the system switch #5764

Triage result (verified against current main)

Issue #5772 remains open. The architecture decision is already recorded in merged PR #5764 §6, but implementation is not complete: current main has no libvirt domain definitions; the prometheus microVM is declared but the microvm profile remains disabled on amd.

Evidence at main 00a294ab6a38b23b3a3f855ff5e6102d5aed78c5:

flake.nix merges lib.make-vm-configurations; lib/default.nix emits vm_<host> NixOS variants, not a guest generation/deploy lifecycle.
microvm.nix is an input, and nixos/microvm/default.nix declares Prometheus, but nixos/hosts/default.nix comments out the microvm profile. The guest currently has a persistent /var volume (config lines 32–37); preserve it as external data across OS-generation rollback.
nixos/virtualisation/default.nix enables libvirtd, but repository search found no declarative libvirt guest/domain definition.

Scoped path and order: (1) implement the §6 guest-generation contract: NixOS source revision + generated domain definition + flake-built disk image, with data volumes attached but outside the rollback unit; use nixvirt as the libvirt renderer and generated XML as fallback, and microvm.nix for ephemeral/agent-class guests. (2) Add the finite carve-out registry, initially empty; every exception needs an owner and reason. (3) Prove both classes from a clean checkout: deliberately enable/test the Prometheus microVM and use a throwaway libvirt guest (no production guest need is established), covering define/start/rollback/destroy. (4) Treat deploy vm:<name> lifecycle wiring as a follow-on to the deploy tool target-class work, as PR #5764 already allows.

No design blocker surfaced in triage. Runtime acceptance needs a safe test host/throwaway guest; no Nix evaluation or guest runtime test was run in this triage-only pass.

🤖 Agent note · state: triaged

Agent: repo queue worker (repo-worker-code), OpenChamber scheduled lane 9aca43b4-5439-4939-9f71-323f5d32521b
Task: 10178 · triage issue VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list #5772
Result: implementation remains outstanding; evidence and ordered scope are above.
Next: implement the guest-generation foundation, then the two class acceptance paths.

🤖 Agent note · done

Agent: repo queue worker (repo-worker-code), OpenChamber scheduled lane 9aca43b4-5439-4939-9f71-323f5d32521b
Task: 10178 · triage VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list #5772
Result: triage findings and ordered implementation path posted in the preceding comment; queue task completed as triaged. Issue remains open for implementation.
Links: VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list #5772 (comment)

Navigation Menu

Repository navigation

VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list #5772

Triage result (verified against current main)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

VMs: declarative guest definitions (nixvirt / microvm.nix) + mutable carve-out list #5772

Description

Activity

developing-today commented on Nov 5, 2026

developing-today commented on Nov 5, 2026

developing-today commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

Triage result (verified against current main)

dezren39 commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions