nvx-rs: lower adapter plans into the plans of template captures

.github/workflows/ci.yml

@@ -137,10 +137,11 @@ jobs:
       - name: Validate NVX CLI
         uses: ./.github/actions/validate-nvx
 
-      # nvx-rs's protocol tests read copies of OpenVMM's control-session
-      # protocol vectors, because the nvx-rs job cannot check out OpenVMM.
-      # This job can, so it compares the copies with the submodule's files,
-      # and nvx::contract's versions of OpenVMM's contracts with OpenVMM's.
+      # nvx-rs's protocol and template tests read copies of OpenVMM's
+      # control-session protocol vectors and of the lines of its platform
+      # allowlist, because the nvx-rs job cannot check out OpenVMM. This job
+      # can, so it compares the copies with the submodule's files, and
+      # nvx::contract's versions of OpenVMM's contracts with OpenVMM's.
       - name: Compare OpenVMM's protocol vectors
         shell: bash
         run: >-

doc/ci.md

@@ -573,10 +573,11 @@ for the curl shim test and the `nvx-rs` build. Each job first builds the
 `nvx-rs` executable that the microVM tests run, tests with it, and hands it to the
 microVM test and platform jobs of its operating system, as described above.
 Each also runs the ignored `nvx-rs` test `tests/openvmm_vectors.rs`, which
-compares the submodule's control-session protocol vectors with the copies that
-the protocol tests read in the `nvx-rs` job, which cannot check out OpenVMM,
-and the versions of OpenVMM's snapshot format, saved-state schema, time ABI,
-and restore packet with those of `nvx::contract`;
+compares the submodule's control-session protocol vectors, and the lines of its
+platform allowlist of kernel command-line tokens, with the copies that the
+protocol and template tests read in the `nvx-rs` job, which cannot check out
+OpenVMM, and the versions of OpenVMM's snapshot format, saved-state schema,
+time ABI, and restore packet with those of `nvx::contract`;
 see [OpenVMM's vectors](../nvx-rs/tests/vectors/README.md#openvmms-vectors).
 The ignored test `tests/openvmm_cpu_profiles.rs` likewise compares the
 submodule's built-in CPU profiles with the copy of their identities from which

nvx-rs/src/host/mod.rs

@@ -23,8 +23,10 @@
 //! - [`template`] holds the metadata of templates, captures from which clones are restored: the
 //!   compatibility key of a template, [`TemplateKey`](template::TemplateKey), which it derives
 //!   from the [`CaptureClass`](template::CaptureClass) of the capture and the capture's
-//!   [`TemplateManifest`](template::TemplateManifest), and the [`Store`](template::Store) of the
-//!   generations of templates that a host published, which leases them to clones.
+//!   [`TemplateManifest`](template::TemplateManifest), the [`Store`](template::Store) of the
+//!   generations of templates that a host published, which leases them to clones, and the plan
+//!   of a template's capture, [`TemplatePlan`](template::TemplatePlan), which it lowers from an
+//!   adapter's plan.
 //! - [`session`] speaks NVX's control protocol, `NVXC`, over [`nvxs`], which runs the host's role
 //!   of the NVXS session for it and for any other application protocol, over a platform
 //!   transport. [`platform`] holds the primitives of Linux and Windows hosts. Other hosts compile

nvx-rs/src/host/sandbox/mod.rs

@@ -156,7 +156,7 @@ pub fn require_file(path: &Path, description: &str) -> Result<()> {
 
 /// Refuses a disk path that OpenVMM's `--microvm-sandbox-block` value could not hold: one with
 /// a comma or semicolon. The message shows `path` as `shown`.
-fn reject_disk_path(path: &Path, shown: &str) -> Result<()> {
+pub(crate) fn reject_disk_path(path: &Path, shown: &str) -> Result<()> {
     if path.to_string_lossy().contains([',', ';']) {
         return Err(refused(format!(
             "disk paths containing commas or semicolons are unsupported: {shown}"
@@ -174,7 +174,7 @@ const CONTAINER_EXTENSIONS: [&str; 4] = ["vhd", "vhdx", "vmgs", "iso"];
 /// as a raw image: if the name of `path` has an extension of [`CONTAINER_EXTENSIONS`]. The
 /// extension is the text after the name's last dot, unless that dot starts the name, and compares
 /// case-sensitively, as OpenVMM reads and compares it.
-fn reject_container_path(path: &Path, shown: &str) -> Result<()> {
+pub(crate) fn reject_container_path(path: &Path, shown: &str) -> Result<()> {
     let name = path.file_name().map(|name| name.to_string_lossy());
     let extension = match name.as_deref().unwrap_or_default().rsplit_once('.') {
         Some((stem, extension)) if !stem.is_empty() => extension,

nvx-rs/src/host/template/mod.rs

@@ -51,6 +51,7 @@ mod canonical;
 mod eligibility;
 mod key;
 mod manifest;
+mod plan;
 mod store;
 #[cfg(test)]
 mod test_support;
@@ -61,6 +62,7 @@ pub use self::key::{CaptureClass, ClassIdentity, Invariants, KeyIdentity, Templa
 pub use self::manifest::{
     BlockGeometry, HostClock, MANIFEST_NAME, MAX_MANIFEST_LEN, TemplateManifest, TimeContract,
 };
+pub use self::plan::{MEMORY_BLOCK_SIZE, SCRATCH_NAME, TemplatePlan, TemplateResources};
 pub use self::store::{
     Acquired, GENERATIONS_NAME, Generation, INDEX_LOCK_NAME, INDEX_NAME, Index, KEY_NAME,
     LEASES_NAME, Lease, LeaseId, MAX_GENERATIONS, Retirement, SNAPSHOT_NAME, STORE_FORMAT,