[Enrique Saurez (esaurez)]

Why

A filesystem-only, agent-ready guest has no persistent workload PID, while a streamed immutable distro is attached as a read-only block device. Neither a host save RPC nor a guessed scratch or distro path is an acceptable substitute for guest-triggered capture.

Change

• Accept the missing workload PID and machine identity during restore only when the authenticated native snapshot explicitly identifies the flat-ext4 filesystem mode; keep the required post-restore steps, including dev's time ABI restore, and fail closed on other modes.
• Pin OpenVMM 4b8e9bae for no-follow, read-only distro block attachment while keeping scratch file-backed. It is Accept read-only streamed distro blocks for microVM snapshots nanvix/openvmm#120's two commits applied unchanged to Harden source provenance integrity #124's head 3796991d, which dev already pins, so dev's egress protocol selectors are kept. Its tree equals the three-way merge of microvm: integrate MP-table boot and restore #120's head e7eed1e3 and 3796991d. Re-pin to main after both OpenVMM PRs merge.
• Document exact external distro identity and the native tier contract.

Base

Rebased onto dev 57b4a428. #261 has merged, so its copied commit was dropped and this PR now contains only its own three commits. The filesystem-only and documentation commits applied unchanged; only the pin commit changed, from fae502e8 to the revision above. fae502e8 remains reachable at esaurez/nvx-streamed-block-snapshot-pre-main-rebase-20261009.

Validation

• This head: nvx.py verify, shellcheck, shfmt, ruff check and format, pyright for Linux and Windows, the Specula tests (25), the validate-nvx unit tests (826 run, 13 skipped), the host-connect tests, and the CLI help checks passed in a non-root Python 3.10 container. In that container one scripts/test_adversarial.py subtest (test_contained_native_process_preserves_child_signal_status, sigkill) fails with 1 != -9; it fails identically on unmodified dev 75f5ba35, so it is environmental and left to CI.
• OpenVMM 4b8e9bae, Linux, Rust 1.95.0: clippy with -D warnings and rustdoc for disk_blockdevice, openvmm_entry, openvmm_helpers, and net_backend_resources; the openvmm_entry (220) and net_backend_resources (18) unit tests passed. Accept read-only streamed distro blocks for microVM snapshots nanvix/openvmm#120 lists its own Linux and Windows results.
• End-to-end, not repeated after this rebase: the earlier stack (these commits on dev 8e1b6115 with OpenVMM fae502e8) passed all 7 streamed-distro runs, and all 8 file-backed GPT runs, of a 15-run guest-triggered capture and restore matrix on an isolated MSHV host. Streamed runs attached the read-only distro as an overlaybd TCMU block node and covered reusable workload-start clones and single-use instance-checkpoint continuations; restore in place, after a portable export without a distro copy, and after a round trip through a Blob storage emulator; and one capture requested while a guest command was running. Each run checked source termination, authenticated reconnect with fresh identities, restored memory and scratch sentinels, guest execution, a repeated restore, and complete teardown. That host's hypervisor cannot present amd.genoa.v1, so the runs launched with the development --cpu-profile host.

[Copilot]

🔵 Needs a closer look

It combines restore-boundary changes with an exact OpenVMM pin whose upstream dependencies remain unmerged and whose current-head CI is still running.

0 open findings

What changed in this PR

Adds filesystem-only streamed microVM snapshot support while preserving fail-closed restore behavior.

Changes:

• Allows flat-ext4 restores without workload process identity.
• Pins OpenVMM’s read-only distro block-device support.
• Documents the native snapshot and external distro contracts.

File	Description
guest/​common/​nvx-snapshot	Relaxes identity requirements only for flat-ext4.
scripts/​test_microvm_tests.py	Tests filesystem-only identity handling.
doc/​design/​snapshot-and-restore.md	Documents filesystem-only and external block contracts.
openvmm	Pins revision 4b8e9bae.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Enrique Saurez (esaurez)]

Closing for now: the plan in #535 doesn't need snapshots of streamed distro blocks, and nanvix/openvmm#120 is closed. The branch stays, and this can be reopened if later work needs it.