nvx-rs: reuse a platform template across mapped paths and network policies #543

Parent: #535. Phase 7 (full template through the RPC). Depends on the image-only activation proof #542, the reviewed VMM primitives tracked by #540 (dormant aggregate), #536 (fixed NIC/policy) and #548 (opened-object grants/receipts), and shared host/guest mapping/policy primitives #538/#539. Their combined NVX guest-activated acceptance closes here, not before this phase starts. This phase is not supplied by #358's guest port, #359's host CLI, or the already merged cold-aggregate nanvix/openvmm#127.

Goal

Reuse one platform template per immutable compatibility key across different approved images, ordered RO/RW/denied host paths, and authorized network/proxy/forward policies. Neither image nor mutable policy belongs in the captured RAM, guest boot command line or template key. Preserve exact-match rules for older/workload snapshots; never hotplug a filesystem or NIC.

Host and VMM operations

• Build separate templates per upper mode with one fixed empty image0 slot (no additional image slots), an aggregate-capable dormant filesystem slot and a fixed NIC enforced deny-all before capture; the ext4 class cold-plugs only its unmounted fresh-scratch role before capture, while the blockless RAM class has no scratch; neither class binds a lower image before capture. Version the template key for guest/VMM ABI, upper/scratch mode, scratch capacity/sector geometry, CPU/memory geometry, slot/NIC layout, saved NIC MAC/IPv4/IPv6 address family/prefix/gateway and activation schema. A request for incompatible saved addressing or a different family fails as a key mismatch; tenant egress/proxy rules may still change. Ordinary no-network cold boots may continue omitting the NIC. The no-NIC/image-only template from nvx-rs: prove cross-image platform restore with pre-ready activation RPC #542 has a different immutable key: capture new templates with the fixed topology; never reuse an old snapshot by adding devices or changing its saved command line on restore. Compose the independent single-image0 change from nvx-rs: prove cross-image platform restore with pre-ready activation RPC #542 with OpenVMM prerequisite: attach aggregate virtio-fs to a dormant platform snapshot slot #540/OpenVMM prerequisite: fixed NIC with pre-vCPU mutable policy on platform restore #536 on the current VMM aggregate/file-child/network baseline into one reviewed template contract and source pin. Test the sole image slot, dormant aggregate filesystem slot and fixed NIC together; no four-slot implementation or multi-slot PR merge is required.
• On restore, pin/authorize image and canonical host roots/denied paths and proxy services with an explicit caller policy. Reverify the exact ExportPlan and object-pinned versus live-path grant before VMM launch/bind; verify object-pinned grants against the actual VMM-opened handles through OpenVMM prerequisite: verify and receipt opened host attachments #548 and bind their attachment receipt to the authenticated activation identity. A pinned file child must not follow a replacement pathname after Ready; a caller-approved live-path child retains that behavior. ExportPlan::openvmm_arguments() attaches aggregate children; ExportPlan::guest_table() supplies guest bind instructions, not filesystem bytes. Do not substitute a single-root --mount planner or host-path boot tokens.
• The VMM validates the aggregate's identities/modes, installs a requested egress/host-loopback/proxy/forward policy before any restored vCPU executes, and keeps the fixed NIC unconfigured/deny-all when networking is absent. Failure to enforce a policy aborts restore; guest DNS/proxy activation alone is not an egress boundary.

Guest activation

• The same authenticated RPC profile as nvx-rs: prove cross-image platform restore with pre-ready activation RPC #542 sends generation/config identity, image/network/DNS/proxy settings, optional private/host-loopback listener announcement mode and expected mapping count, including zero. With zero, leave the virtio-fs slot dormant and send no batches; with nonzero, deliver the same validated HostMap { source, target, read_only } semantics in ordered bounded batches. NVXC may send literal APP_MAPS; another adapter need not share its application framing.
• Apply binds beneath export/overlay descriptors, enforce exact count/order and target restrictions, and publish Ready only after all image/root/mount/network work and an identity echo. A malformed/replayed batch, changed host object, partial mount, auth mismatch or session reset is terminal, not a half-configured or cold-booted success.

Acceptance

• Each upper-class template restores at least two distinct images and multiple different host-path/network policies, including a no-network/no-map sandbox, with the same immutable template ID within its class and fresh scratch on every ext4 restore.
• VMM and guest conformance tests cover zero/one/max maps and children, RO/RW/file/denied paths, proxy/forward policy, packet attempts before guest Ready, wrong image/plan identity, pinned-file replacement after Ready (held and new guest lookups), incompatible saved NIC addresses, optional ingress announcement after VMM policy enforcement and failed policy/listener installation. Before nvx-rs: replace activation RPC delivery with an uncaptured VMM configuration region #544, an RPC-activated guest discovers a dormant-to-aggregate layout without a captured virtfs_aggregate=1 token or changed saved command line, mounts only authenticated children and checks guest-observable indices/kind/modes against the host/VMM attachment receipt; zero maps leave the slot dormant.
• Old snapshots keep exact-match enforcement; a requested platform restore failure is explicit and tears down its verified VM without silent cold fallback.
• Supported-hypervisor end-to-end evidence records the exact single integrated OpenVMM/NVX/guest revisions and artifact identity, including restored egress, host-loopback, proxy and forwards and single-image0/aggregate/NIC coexistence; an image-only run or ignored test is not this phase's acceptance.