[Enrique Saurez (esaurez)]

Stacked on #870; this PR retargets when its parent merges.

Chain: #863 → #867 → #869 → #865 → #864 → #872 → #875 → #878 → #862 → #868 → #870 → #866 (this PR) → #882 → #883.

Part of #822: PR 9 of 11, the policy on the plan.

What changed

• runtime-adapter-host launch --network FILE gives a layered launch a network. FILE holds an nvx::host::sandbox::SandboxNetwork in the serde form of a plan's network, which the new runtime_adapter::layered::read_network reads. Reading the form checks the network as the plan does (SandboxNetwork::new): the guest's address must leave a gateway, and the policy must lower to OpenVMM's arguments.
• The launch puts the network on the adapter's plan (SandboxPlan::with_network), which renders it after the block devices through NVX's one lowering of a policy, nvx::host::network::openvmm_arguments. A policy that lets nothing through attaches no network device. The network adds no boot token of the plan's: OpenVMM appends the guest's network settings to the kernel command line, and NVX's /init configures the network device from them before it hands the VM to the guest agent.
• The launch record (format 2) keeps the network in its plan, in the same form.
• A launch reads its network before anything else, so a network that the plan refuses, or a file that cannot be read, fails the launch with status 1 before it needs NVX's artifacts or creates the store. --network needs --distro, and only launch takes it.
• The adapter's README (a new "Networks" section, the commands, and the tests) and the module docs describe the network.

Tests

In tests/layered_launch.rs, host-only, with no hypervisor:

• a_launch_renders_each_element_of_its_network_through_the_plan: an open network, then each element of a policy changed in turn (the guest's address, egress, allow and deny rules, ingress, the three host-loopback accesses, forwards, and a proxy with each scheme), with the OpenVMM arguments that the plan renders between the block devices, which name the checked files of a launch prepared for each case, and the launch's own options, the proxy's URL, the unchanged kernel command line, and the record, which keeps the network as the file gave it and reads back as the same plan.
• a_launch_reads_only_the_networks_that_the_plan_takes: an unreadable file, forms that the plan does not read, and networks that it refuses, each with the plan's reason.
• the_host_program_refuses_a_network_before_it_launches: a refused and an unreadable network fail the launch with status 1, before it needs NVX's artifacts or creates the store, and a network that the plan takes passes.
• the_host_program_refuses_options_that_do_not_make_a_command: --network without --distro, twice, without a value, and on stage and stop.

Validation

• Windows (local), in tests/runtime-adapter: cargo fmt --all --check; the protocol-only and host-only configurations' cargo clippy --locked --all-targets [--features host] -- -D warnings, cargo build --locked, cargo test --locked, and cargo +1.89 check --locked --all-targets.
• Linux (x86_64), in tests/runtime-adapter: the same, plus the guest-only configuration (--features guest --target x86_64-unknown-linux-musl): clippy, build, tests, and the MSRV check; the guest-only library and guest_session tests as root; and a stress run of guest_session, 10 times as root and 10 times as a user, and of the library's tests, 3 times as root.
• python scripts/check_markdown_links.py.
• Left to CI: everything, once this PR targets dev; a stacked PR runs no NVX CI. This PR changes no VM scenario: the network's enforcement in VMs is runtime adapter: run cold sandboxes end to end on KVM, MSHV and WHP #822's PR 11, tests: enforce the runtime adapter's networks in VMs #883.

[Copilot]

🟢 Approval recommended

The narrowly scoped integration reuses existing NVX contracts, includes targeted host-only coverage, and has no identified blocking issues.

No open issues 🎉

What changed in this PR

Adds optional network policies to layered launches in the test runtime adapter, advancing #822 by reusing NVX’s existing plan validation, rendering, and persistence.

Changes:

• Adds launch --network FILE, validating the network before accessing artifacts or creating the store.
• Attaches the network to the adapter’s plan and preserves it in launch records.
• Adds host-only coverage for policy rendering, rejected inputs, and command-line constraints, with corresponding documentation.

File	Description
tests/​runtime-adapter/​tests/​layered_launch.rs	Tests network rendering, records, validation, and CLI restrictions.
tests/​runtime-adapter/​src/​lib.rs	Documents network support in layered plans.
tests/​runtime-adapter/​src/​layered.rs	Adds the network reader and documents plan integration.
tests/​runtime-adapter/​src/​bin/​runtime-adapter-host.rs	Parses, validates, and attaches launch networks.
tests/​runtime-adapter/​README.md	Documents network configuration, commands, and tests.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

Static review found no blocking issues in the focused integration with NVX’s validated network APIs and its host-only test coverage; tests were not executed during this review.

No open issues 🎉

_{Review effort: Balanced}