nvx.py: retire the run and sandbox commands in favor of nvx-rs

.github/copilot-instructions.md

@@ -69,12 +69,12 @@
   and guest artifacts only when their inputs changed. Leave `test-openvmm-unit`,
   `test-openvmm`, `build-guest --guest all`, `verify-guest-determinism`, and
   `benchmark` to CI.
-- `nvx.py sandbox`, `nvx.py run`, and the microVM scenarios that drive them run
-  `nvx-rs`, which `nvx.py` builds with Cargo into `nvx-rs/target/release/` the
-  first time that a command needs it, in about a minute. Rebuild it with
-  `cargo build --release --locked --features cli --manifest-path nvx-rs/Cargo.toml`
-  after changing `nvx-rs/`, or set `NVX_RS` to another build (see
-  [Usage](../doc/usage.md#nvx-rs)). The `managed-lifecycle` scenario runs an
+- `nvx-rs/target/release/nvx-rs run` and `nvx-rs/target/release/nvx-rs sandbox`
+  run microVMs and sandboxes. Build `nvx-rs` there, in about a minute, with
+  `cargo build --release --locked --features cli --manifest-path nvx-rs/Cargo.toml`,
+  and again after changing `nvx-rs/`. The microVM scenarios run it too, and build
+  it there the first time that they need it, unless `NVX_RS` names another build
+  (see [Usage](../doc/usage.md#nvx-rs)). The `managed-lifecycle` scenario runs an
   `nvx-rs` test with Cargo.
 - Build trees are large. Check `df -h .` before a build, keep one OpenVMM build
   profile at a time, and delete trees you no longer need with `cargo clean` or

.github/skills/nvx-debug/SKILL.md

@@ -43,23 +43,23 @@ Set OpenVMM logging in the selected execution shell and rerun the same command:
 ```bash
 export OPENVMM_LOG=debug
 backend=kvm # Use mshv when required; append the original options.
-python3 scripts/nvx.py run --hypervisor "$backend"
+nvx-rs/target/release/nvx-rs run --hypervisor "$backend"
 ```
 
 ```powershell
 $env:OPENVMM_LOG = 'debug'
 # Append the options from the original failing command when needed.
-python scripts\nvx.py run --hypervisor whp
+nvx-rs\target\release\nvx-rs.exe run --hypervisor whp
 ```
 
 Use `trace` only when `debug` does not expose the failing component. Keep the guest
 interactive; do not pipe the command through a logger that can detach standard
 input. The terminal transcript is the primary debug record. Exit a responsive guest
 with `/sbin/nvx-exit 0`.
 
-Use `scripts/nvx.py run --dry-run` to inspect the generated OpenVMM command. Invoke
-that printed command directly only when low-level debugging requires options the NVX
-wrapper does not expose, and record every deviation.
+Use `nvx-rs run --dry-run` to inspect the generated OpenVMM command. Invoke that
+printed command directly only when low-level debugging requires options that
+`nvx-rs` does not expose, and record every deviation.
 
 ## 4. Reduce a Benchmark Failure
 

.github/skills/nvx-host-connect/SKILL.md

@@ -174,6 +174,9 @@ Choose artifact preparation according to the task:
   the package. Report the selected release as the artifact provenance.
 - For guest, OpenVMM, or build changes, use the relevant `build-guest`,
   `build-openvmm`, or `build` command.
+- `nvx-rs`, which runs NVX's microVMs and sandboxes, comes with the package only
+  when its release was built from the checkout's `nvx-rs` sources. Otherwise, or
+  for `nvx-rs` changes, build it with Cargo from the repository root.
 - For coordinator-only changes, existing matching release artifacts may be reused
   after reporting their provenance.
 
@@ -183,25 +186,29 @@ Linux examples:
 python3 scripts/nvx.py download --hypervisor kvm
 python3 scripts/nvx.py download --hypervisor mshv
 python3 scripts/nvx.py build
+cargo build --release --locked --features cli --manifest-path nvx-rs/Cargo.toml \
+    --target-dir nvx-rs/target
 ```
 
 Windows examples:
 
 ```powershell
 python scripts\nvx.py download --hypervisor whp
 python scripts\nvx.py build
+cargo build --release --locked --features cli --manifest-path nvx-rs/Cargo.toml `
+    --target-dir nvx-rs/target
 ```
 
 Do not download over artifacts the user wants to preserve. Verify the generated
 command and required files without starting a VM:
 
 ```bash
 backend=kvm # Use the resolved profile backend.
-python3 scripts/nvx.py run --hypervisor "$backend" --dry-run
+nvx-rs/target/release/nvx-rs run --hypervisor "$backend" --dry-run
 ```
 
 ```powershell
-python scripts\nvx.py run --hypervisor whp --dry-run
+nvx-rs\target\release\nvx-rs.exe run --hypervisor whp --dry-run
 ```
 
 ## Handoff

.github/skills/nvx-openvmm-promote/SKILL.md

@@ -98,10 +98,22 @@ must follow. Copy both files unchanged into `nvx-rs/tests/vectors/openvmm/`, rec
 revision in [the vectors' README](../../../nvx-rs/tests/vectors/README.md#openvmms-vectors),
 and run the `nvx-rs` tests, which may need coordinated changes too.
 
+`nvx-rs run` also reads a copy of the identities of OpenVMM's built-in CPU profiles, from
+which it guides a failed cold boot on a CPU that none serves. Compare it with the revision's
+profiles too:
+
+```console
+cargo test --locked --manifest-path nvx-rs/Cargo.toml --no-default-features --test openvmm_cpu_profiles -- --ignored
+```
+
+A failure means that the revision adds, revises, or removes a built-in profile. Update
+`nvx-rs/src/host/cli/cpu_generations.json` and the copy of `scripts/nvx_tools/time_abi.py`,
+which `scripts/test_time_abi.py` compares with the same profiles, as coordinated changes.
+
 Before committing, require `git diff --name-only` to contain exactly `openvmm`
 unless coordinated NVX changes were explicitly requested, or the revision needs them,
-as a change to OpenVMM's protocol vectors does. Stage only the gitlink and those
-changes, and name the coordinated changes in the pull request.
+as a change to OpenVMM's protocol vectors or CPU profiles does. Stage only the gitlink and
+those changes, and name the coordinated changes in the pull request.
 Commit only when the user requested it. Follow the repository's subject convention,
 sign the commit with the user's existing configuration, and stop rather than falling
 back to an unsigned commit if signing fails. Never amend, force-push, or rewrite an
@@ -168,5 +180,5 @@ head SHA matches the current pull-request head. Treat older runs as superseded a
 
 Report the source PR and revision, signature result, dependency state, equivalence
 method and result, NVX target commit, final changed-file set, local validation, the
-comparison of OpenVMM's protocol vectors, pull-request state and URL, exact-head
-workflow URL, and every blocked or pending gate.
+comparisons of OpenVMM's protocol vectors and CPU profiles, pull-request state and URL,
+exact-head workflow URL, and every blocked or pending gate.

.github/skills/nvx-run/SKILL.md

@@ -31,36 +31,43 @@ For SSH execution, load and complete
 repository directory, backend, revision, and artifact provenance. Keep standard
 input attached to the guest; use `ssh -tt` if opening a direct interactive command.
 
-Use `scripts/nvx.py run` rather than invoking OpenVMM directly. If artifacts are
-missing, choose an explicit `download --hypervisor <backend>` for packaged artifacts
-or the relevant build command for checkout changes. Do not overwrite artifacts the
-user wants to preserve.
+Use `nvx-rs run` rather than invoking OpenVMM directly: the checkout's
+`nvx-rs/target/release/nvx-rs`, or `nvx-rs\target\release\nvx-rs.exe` on Windows.
+If artifacts are missing, choose an explicit `download --hypervisor <backend>` for
+packaged artifacts or the relevant build command for checkout changes. If `download`
+installed no `nvx-rs`, or the task changes `nvx-rs`, build it from the repository root:
+
+```console
+cargo build --release --locked --features cli --manifest-path nvx-rs/Cargo.toml --target-dir nvx-rs/target
+```
+
+Do not overwrite artifacts the user wants to preserve.
 
 ## 2. Assemble the Run
 
 Start with an explicit backend and add only options required by the task:
 
 ```bash
 backend=kvm # Use mshv when required.
-python3 scripts/nvx.py run --hypervisor "$backend" --dry-run
+nvx-rs/target/release/nvx-rs run --hypervisor "$backend" --dry-run
 ```
 
 ```powershell
-python scripts\nvx.py run --hypervisor whp --dry-run
+nvx-rs\target\release\nvx-rs.exe run --hypervisor whp --dry-run
 ```
 
 Supported examples:
 
 ```bash
-python3 scripts/nvx.py run --hypervisor kvm \
+nvx-rs/target/release/nvx-rs run --hypervisor kvm \
     --memory-mib 256 --net 10.0.0.2/24 --network-profile portable \
     --cmdline "quiet loglevel=0"
-python3 scripts/nvx.py run --hypervisor mshv \
+nvx-rs/target/release/nvx-rs run --hypervisor mshv \
     --mount "/mnt/host,/absolute/host/share,rw"
 ```
 
 ```powershell
-python scripts\nvx.py run --hypervisor whp `
+nvx-rs\target\release\nvx-rs.exe run --hypervisor whp `
     --mount "/mnt/host,C:\Users\me\microvm-share,rw"
 ```
 
@@ -89,12 +96,12 @@ current session did not start.
 
 ```bash
 backend=kvm # Use mshv when required; append the approved options.
-python3 scripts/nvx.py run --hypervisor "$backend"
+nvx-rs/target/release/nvx-rs run --hypervisor "$backend"
 ```
 
 ```powershell
 # Append the options approved from the dry run when needed.
-python scripts\nvx.py run --hypervisor whp
+nvx-rs\target\release\nvx-rs.exe run --hypervisor whp
 ```
 
 Success requires the guest's `NVX-GUEST-BOOT-OK: <guest>` marker, such as

.github/workflows/ci.yml

@@ -130,11 +130,12 @@ jobs:
         with:
           python-version: "3.12"
 
-      # nvx.py runs nvx-rs for its run and sandbox commands. A static musl
-      # build runs on every self-hosted Linux runner, so the microVM jobs take
-      # this one, as they take OpenVMM from its build jobs. It goes where
-      # `cargo build --release` puts it, where nvx.py, and so the CLI tests,
-      # look for it, and NVX_RS names it for the tests that run it directly.
+      # The microVM tests run their microVMs and sandboxes with nvx-rs. A
+      # static musl build runs on every self-hosted Linux runner, so the
+      # microVM jobs take this one, as they take OpenVMM from its build jobs.
+      # It goes where `cargo build --release` puts it, where nvx.py, and so
+      # the CLI tests, look for it, and NVX_RS names it for the tests that run
+      # it directly.
       - name: Build nvx-rs
         shell: bash
         run: |
@@ -169,6 +170,15 @@ jobs:
           cargo test --locked --manifest-path nvx-rs/Cargo.toml
           --no-default-features --test openvmm_vectors -- --ignored
 
+      # nvx-rs run reads a copy of the identities of OpenVMM's built-in CPU
+      # profiles, to guide a failed cold boot on a CPU that none serves, which
+      # this job compares with the submodule's profiles as it does the vectors.
+      - name: Compare OpenVMM's CPU profiles
+        shell: bash
+        run: >-
+          cargo test --locked --manifest-path nvx-rs/Cargo.toml
+          --no-default-features --test openvmm_cpu_profiles -- --ignored
+
       - name: Upload nvx-rs executable
         uses: actions/upload-artifact@v7
         with:
@@ -266,6 +276,15 @@ jobs:
             --test openvmm_vectors -- --ignored
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
+      # As on Linux.
+      - name: Compare OpenVMM's CPU profiles
+        shell: powershell
+        run: |
+          $ErrorActionPreference = "Stop"
+          cargo test --locked --manifest-path nvx-rs/Cargo.toml --no-default-features `
+            --test openvmm_cpu_profiles -- --ignored
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
       - name: Upload nvx-rs executable
         uses: actions/upload-artifact@v7
         with: