[Pedro Henrique Penna (ppenna)]

Summary

The component responsibility map predates the aggregate virtio-fs work. The pinned OpenVMM now shares several host directories through the microVM's single virtio-fs slot as children of one aggregate. NVX's run and sandbox commands attach several shares that way, the guest binds each child at its target, and the aci_edge_sandboxes OpenVMM backend exports mapped paths as aggregate children and sends the guest a host-mapping table. The map named no owner for any of this, so contributors following it from the design index could not find where share composition, per-child policy, or the guest-side binds live. This PR names those owners. The contracts themselves stay in Sandbox filesystem and agent architecture, which already describes them.

OpenVMM SHA (pinned openvmm gitlink): 7bf0ee28b826374a2d386067df0456b81bcae818. The NVX base is origin/dev at 3184c76f9afebe8be793965dfcb164070b166e71.

Changes

All changes are in doc/design/code-ownership-map.md.

Statement	Evidence
HostFs row: the profile serves one host directory or a read-only, root-only aggregate of named host directories on the single virtio-fs slot, each child with its own mode and denied, allowed, and writable paths. Owner adds the virtio-fs aggregate.	openvmm/openvmm/openvmm_defs/src/microvm.rs (MICROVM_FILESYSTEM_SLOTS: [_; 1]); openvmm/openvmm/openvmm_entry/src/cli_args/microvm.rs (--mount-aggregate: "The aggregate's root is read-only, only the guest's root user may enter it"; --mount-child NAME,HOST_PATH[,ro|rw]; policy paths attributed to the containing child); openvmm/vm/devices/virtio/virtiofs/src/aggregate.rs; OpenVMM commits 3072d7a91, 3bb911803, efdf5df20, 7bf0ee28b
New row: the NVX launcher owns run/sandbox host shares: one share attached directly or several as aggregate children, their pre-launch checks, and the nvx_share= tokens.	scripts/nvx_tools/sandbox.py (mounts_openvmm_arguments, aggregate_child_name, aggregate_share_tokens); scripts/nvx.py (--mount-aggregate); commit 74bb05291
aci_edge_sandboxes default backend row: host-path export is aggregate children and their access policy, and the backend delivers the host-mapping table.	aci_edge_sandboxes/src/openvmm/filesystem.rs (--mount-aggregate, nvx_maps=); aci_edge_sandboxes/src/openvmm/session.rs (sends APP_MAPS); commit 55c31c4a5
New row: the guest init, host-mount helper, and init agent own live share mounts and the bind of each aggregate child at its target.	guest/common/init (calls /sbin/nvx-hostmount); guest/common/nvx-hostmount (virtfs_aggregate=1, nvx_share=); guest/common/nvx-init-agent (mount_live_shares)
Managed-agent row: "host-path binds" becomes "host-mapping table checks and binds", because mappings now arrive in MAPS requests rather than nvx_map= tokens.	guest/common/nvx-managed-agent.c (APP_MAPS, MAPS_TOKEN "nvx_maps="); commit 55c31c4a5

Conservative choices:

• The backend row says "aggregate children and their access policy" rather than "per-mapping access". Commit 55c31c4a5 states that the host does not enforce a read-only path inside a read-write mapping.
• The map stays a navigation aid. It names components and public tokens only and links to no code.

Follow-ups (out of scope)

• doc/openvmm-upstream-roadmap.md describes OpenVMM fork tip 2728f33ea (2026-10-01). The pin is now 139 commits past it, so its upstream status and commit-to-PR mapping are stale. It needs a refresh against the current fork, or a clearly dated status note.
• scripts/setup/README.md is documentation outside doc/. Relocating it means editing links in doc/setup.md and doc/ci.md, which open PRs Adopt bind-once microVM image slots #406 and test-microvm: pause and resume a microVM through OpenVMM state control #405 touch. CI also classifies that path as a runner input (scripts/test_nvx_tools.py, test_ci_change_classification_selects_suites_by_input), so moving it is not a documentation-only change.
• unittest_results.txt is a tracked test-output file at the repository root, present since the initial commit, and appears to be a stray artifact. It's a code-side cleanup, not a doc change.
• Docs touched by open PRs test-microvm: pause and resume a microVM through OpenVMM state control #405, Adopt bind-once microVM image slots #406, and Support filesystem-only streamed microVM snapshots #417 (ci.md, usage.md, run.md, setup.md, benchmarks.md, and several design chapters) were left alone.

Validation

• python -m unittest scripts.test_nvx_tools.CliTests scripts.test_performance.PerformanceTests: Ran 110 tests, OK (skipped=1).
• A throwaway link checker outside the repo checked the changed file and doc/design.md, which links to it: every relative link and anchor resolves, the changed file has one H1 and balanced fences, and doc/design.md links every chapter in doc/design/. Result: OK.
• git diff --check: clean.
• python scripts\nvx.py verify: passed (submodule at 7bf0ee28b matches HEAD:openvmm).
• Changed paths: doc/design/code-ownership-map.md only (documentation-only).

[Copilot]

🟢 Approval recommended

The documentation accurately reflects the current launcher, backend, OpenVMM, and guest implementations.

0 open findings

What changed in this PR

Updates the component responsibility map to identify ownership of aggregate host-share composition, policy, transport, and guest-side binding.

Changes:

• Expands OpenVMM and NVX launcher ownership for aggregate virtio-fs shares.
• Documents backend and guest responsibilities for host mappings and binds.

File	Description
doc/​design/​code-ownership-map.md	Adds aggregate host-share responsibilities to the ownership map.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.