refactor: delete pure-forwarding modules, callers use the owning crate (#4839)

crates/mvm-agentd/src/vsock/api.rs

@@ -357,7 +357,7 @@ pub fn query_fs_diff_at(vsock_uds_path: &str) -> Result<Vec<FsChange>> {
 
 /// Query filesystem diff on an already-connected stream. Backend-agnostic
 /// entry point for `mvmctl diff` — the stream comes from
-/// `mvm_runtime::vsock_transport::for_vm(name)` so the verb works against any VMM.
+/// `mvm_vmm::vsock_transport::for_vm(name)` so the verb works against any VMM.
 /// `FsDiff` is part of the filesystem RPC surface, so this drives
 /// the hello prelude requiring `FilesystemRpc` exactly like
 /// [`send_fs_request_on`] — the dir-based wrappers used to skip the hello,
@@ -409,7 +409,7 @@ pub fn send_proc_request(instance_dir: &str, req: GuestRequest) -> Result<ProcRe
 
 /// Dispatch a non-streaming process-control verb on an already-connected
 /// stream and return the `ProcResult`. The backend-agnostic entry point:
-/// the host CLI obtains the stream from `mvm_runtime::vsock_transport::for_vm(name)`
+/// the host CLI obtains the stream from `mvm_vmm::vsock_transport::for_vm(name)`
 /// so `mvmctl proc` works regardless of which VMM launched the VM.
 /// `send_proc_request` is the dir-based wrapper over this.
 pub fn send_proc_request_on(stream: &mut UnixStream, req: GuestRequest) -> Result<ProcResult> {
@@ -449,7 +449,7 @@ pub fn send_proc_wait<F: FnMut(&ProcWaitEvent)>(
 
 /// Stream `ProcWait` events on an already-connected stream. Backend-agnostic
 /// entry point for `mvmctl proc wait` — the stream comes from
-/// `mvm_runtime::vsock_transport::for_vm(name)` so the verb works against any VMM.
+/// `mvm_vmm::vsock_transport::for_vm(name)` so the verb works against any VMM.
 /// Mirrors the host shape of [`send_run_entrypoint`].
 pub fn send_proc_wait_on<F: FnMut(&ProcWaitEvent)>(
     stream: &mut UnixStream,
@@ -502,7 +502,7 @@ pub fn send_fs_request(instance_dir: &str, req: GuestRequest) -> Result<FsResult
 
 /// Dispatch a single FS RPC on an already-connected stream and return the
 /// `FsResult`. The backend-agnostic entry point: the host CLI obtains the
-/// stream from `mvm_runtime::vsock_transport::for_vm(name)` (which resolves the
+/// stream from `mvm_vmm::vsock_transport::for_vm(name)` (which resolves the
 /// right socket per backend — Firecracker's `v.sock`, or the per-port UNIX
 /// socket libkrun/QEMU expose), so `fs`/`cp` work regardless of which VMM
 /// launched the VM. `send_fs_request` is the dir-based wrapper

crates/mvm-build/src/builder_vm_runtime/image_lock.rs

@@ -797,8 +797,8 @@ pub fn hold_image_lock(lock_path: &Path, wait: LockWait) -> Result<HeldImageLock
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::test_support::isolated_lock_probe;
     use crate::volume_image::{VolumeImageLock, ensure_persistent_volume_image};
+    use mvm_core::util::test_env::isolated_lock_probe;
 
     // -----------------------------------------------------------------
     // The cache dir is a &Path argument, so each test passes a fresh TempDir

crates/mvm-build/src/lib.rs

@@ -20,9 +20,6 @@ pub mod source_closure;
 mod source_copy;
 pub mod workspace_graph;
 
-#[cfg(all(test, unix))]
-mod test_support;
-
 /// Portable image-contract verification; acquisition requires a Unix host.
 #[cfg(not(unix))]
 pub mod published_image_set {

crates/mvm-build/src/run_image.rs

@@ -1096,7 +1096,7 @@ pub fn resolve_guest_runtime_identity(cache_root: &Path) -> Result<String> {
 mod tests {
     use super::*;
     #[cfg(unix)]
-    use crate::test_support::isolated_lock_probe;
+    use mvm_core::util::test_env::isolated_lock_probe;
 
     #[test]
     fn pure_sealed_materialization_keeps_its_content_bound_seal() {

crates/mvm-build/src/volume_image.rs

@@ -291,7 +291,7 @@ mod tests {
     use std::path::Path;
 
     use super::*;
-    use crate::test_support::isolated_lock_probe;
+    use mvm_core::util::test_env::isolated_lock_probe;
 
     const SIZE: u64 = 16 * 1024 * 1024;
 

crates/mvm-cli/examples/agent_invoke.rs

@@ -20,7 +20,7 @@ fn main() -> anyhow::Result<()> {
     // string into valid JSON for ordinary names.
     let payload = format!("[[{name:?}], {{}}]").into_bytes();
 
-    let transport = mvm_runtime::vsock_transport::for_vm(&vm)?;
+    let transport = mvm_vmm::vsock_transport::for_vm(&vm)?;
     let mut stream = transport.connect(mvm_agentd::vsock::GUEST_AGENT_PORT)?;
 
     let stdout = RefCell::new(Vec::<u8>::new());

crates/mvm-cli/examples/agent_ping.rs

@@ -8,7 +8,7 @@ fn main() -> anyhow::Result<()> {
     let vm = std::env::args()
         .nth(1)
         .ok_or_else(|| anyhow::anyhow!("usage: agent_ping <vm-name>"))?;
-    let transport = mvm_runtime::vsock_transport::for_vm(&vm)?;
+    let transport = mvm_vmm::vsock_transport::for_vm(&vm)?;
     let mut stream = transport.connect(mvm_agentd::vsock::GUEST_AGENT_PORT)?;
     let ack = mvm_agentd::vsock::negotiate_protocol(
         &mut stream,

crates/mvm-cli/src/commands/agent_session.rs

@@ -445,7 +445,7 @@ fn renew_audit_extras(record: &AgentSessionRecord) -> Vec<(String, String)> {
 /// exactly as a park is.
 fn record_renew_in_chain(
     record: &AgentSessionRecord,
-    emitter: &super::vm::audit_chain::AuditEmitter,
+    emitter: &mvm_client::audit::chain::emitter::AuditEmitter,
 ) -> Result<()> {
     let plan = member_plan(record)?;
     emitter.emit_session_renewed(&plan, renew_audit_extras(record))
@@ -588,7 +588,7 @@ fn park_audit_extras(record: &AgentSessionRecord) -> Vec<(String, String)> {
 /// reported rather than recorded under a plan it never ran.
 fn record_park_in_chain(
     record: &AgentSessionRecord,
-    emitter: &super::vm::audit_chain::AuditEmitter,
+    emitter: &mvm_client::audit::chain::emitter::AuditEmitter,
 ) -> Result<()> {
     let plan = member_plan(record)?;
     emitter.emit_session_parked(&plan, park_audit_extras(record))
@@ -607,10 +607,10 @@ fn member_plan(record: &AgentSessionRecord) -> Result<mvm_core::plan::ExecutionP
 }
 
 /// The host's chain-signed audit emitter, under the host signer.
-fn host_audit_emitter() -> Result<super::vm::audit_chain::AuditEmitter> {
-    let signer = super::vm::host_signer::load_or_init()
+fn host_audit_emitter() -> Result<mvm_client::audit::chain::emitter::AuditEmitter> {
+    let signer = mvm_client::host_keypair::load_or_init()
         .context("loading the host signer to sign the session entry")?;
-    super::vm::audit_chain::AuditEmitter::new(signer.signing)
+    mvm_client::audit::chain::emitter::AuditEmitter::new(signer.signing)
         .context("opening the audit chain to record the session transition")
 }
 
@@ -789,9 +789,9 @@ fn resume_boot_record(
     // The session's own state dir, named for the session, so the staged resume
     // point sits where every other per-VM artifact for that name does.
     let state_dir = mvm_core::config::vm_state_dir(inputs.id.as_str());
-    let signer = super::vm::host_signer::load_or_init()
+    let signer = mvm_client::host_keypair::load_or_init()
         .context("loading the host signer to sign the resume entry")?;
-    let emitter = super::vm::audit_chain::AuditEmitter::new(signer.signing)
+    let emitter = mvm_client::audit::chain::emitter::AuditEmitter::new(signer.signing)
         .context("opening the audit chain to record the resume")?;
     let resume = inputs.request();
     let request = ResumeBootLocalRequest::builder()
@@ -1896,7 +1896,7 @@ mod tests {
     struct ChainedHost {
         _env: mvm_core::util::test_env::TestEnv,
         home: tempfile::TempDir,
-        emitter: super::super::vm::audit_chain::AuditEmitter,
+        emitter: mvm_client::audit::chain::emitter::AuditEmitter,
     }
 
     impl ChainedHost {
@@ -1909,7 +1909,7 @@ mod tests {
                 &mvm_core::plan::signing::test_support::sample_plan(),
             )
             .unwrap();
-            let emitter = super::super::vm::audit_chain::AuditEmitter::with_dir(
+            let emitter = mvm_client::audit::chain::emitter::AuditEmitter::with_dir(
                 ed25519_dalek::SigningKey::from_bytes(&[7u8; 32]),
                 &home.path().join("audit"),
             )

crates/mvm-cli/src/commands/build/kernel.rs

@@ -223,8 +223,8 @@ fn run_boot_check(
     arch: &str,
 ) -> Result<()> {
     use crate::commands::env::builder_vm::KernelVariant;
-    use crate::commands::shared::wait_for_guest_agent;
     use crate::ui;
+    use mvm_client::readiness::wait_for_guest_agent;
 
     if !variants.iter().any(|(v, _)| *v == KernelVariant::Workload) {
         ui::warn(

crates/mvm-cli/src/commands/cmd_audit.rs

@@ -17,7 +17,7 @@
 //! half), the wrap logs a `tracing::warn` and the command runs
 //! without cmd-level audit. Audit emits themselves are also
 //! best-effort — a chain-signer failure does NOT fail the command,
-//! same posture as `mvm_cli::commands::vm::audit_chain::AuditEmitter`
+//! same posture as `mvm_client::audit::chain::emitter::AuditEmitter`
 //! and the secret command's audit wiring.
 //!
 //! ## Why a separate module
@@ -35,8 +35,8 @@ use mvm_core::plan::TenantId;
 
 use super::Commands;
 use super::machine;
-use super::vm::audit_chain::default_audit_dir;
-use super::vm::host_signer;
+use mvm_client::audit::chain::emitter::default_audit_dir;
+use mvm_client::host_keypair;
 
 /// Owns the command recorder and keeps its concrete file signer available to
 /// launch audit emitters for the duration of dispatch.
@@ -62,7 +62,7 @@ impl CommandAudit {
 /// `EventCategory::Cmd` for both `cmd.<verb>` and `cmd.tool.<verb>`
 /// events), so one builder serves every consumer.
 pub(crate) fn build_cmd_recorder() -> Option<CommandAudit> {
-    let signer = match host_signer::load_or_init() {
+    let signer = match host_keypair::load_or_init() {
         Ok(s) => s,
         Err(e) => {
             tracing::warn!(

crates/mvm-cli/src/commands/deps/live_capture.rs

@@ -324,7 +324,7 @@ fn list_guest(vm: &str, path: &str) -> Result<Vec<mvm_agentd::vsock::FsEntry>> {
         path: path.to_string(),
         follow_symlinks: false,
     };
-    crate::commands::shared::emit_vsock_rpc_audit(vm, &request);
+    mvm_client::guest::emit_vsock_rpc_audit(vm, &request);
     match crate::commands::vm::fs::fs_request(vm, request)? {
         FsResult::List { entries, truncated } if !truncated => Ok(entries),
         FsResult::List {
@@ -344,7 +344,7 @@ fn stat_guest(vm: &str, path: &str) -> Result<mvm_agentd::vsock::FsStat> {
         path: path.to_string(),
         follow_symlinks: false,
     };
-    crate::commands::shared::emit_vsock_rpc_audit(vm, &request);
+    mvm_client::guest::emit_vsock_rpc_audit(vm, &request);
     match crate::commands::vm::fs::fs_request(vm, request)? {
         FsResult::Stat(stat) => Ok(stat),
         FsResult::Error { kind, message } => {

crates/mvm-cli/src/commands/image/materialize.rs

@@ -275,7 +275,7 @@ pub(super) fn rematerialize_cached_image(
     if !reusable_rootfs(&rootfs_abs, prod)? {
         let signer;
         let evidence = if prod {
-            signer = crate::commands::vm::host_signer::load_or_init()
+            signer = mvm_client::host_keypair::load_or_init()
                 .context("load host signing key for the provenance mark")?;
             Some(
                 mvm_build::provenance_mark::SealEvidence::builder(&signer.signing)

crates/mvm-cli/src/commands/image/pull_core.rs

@@ -306,7 +306,7 @@ fn resolve_run_image_with(
                 sweep_before_builder_vm();
                 let signer;
                 let evidence = if prod {
-                    signer = crate::commands::vm::host_signer::load_or_init()
+                    signer = mvm_client::host_keypair::load_or_init()
                         .context("load host signing key for the provenance mark")?;
                     Some(
                         mvm_build::provenance_mark::SealEvidence::builder(&signer.signing)
@@ -833,7 +833,7 @@ fn materialize_pulled_rootfs(
 ) -> Result<()> {
     let signer = pulled
         .prod
-        .then(crate::commands::vm::host_signer::load_or_init)
+        .then(mvm_client::host_keypair::load_or_init)
         .transpose()
         .context("load host signing key for the provenance mark")?;
     let evidence = signer.as_ref().map(|signer| {

crates/mvm-cli/src/commands/image/trust_policy.rs

@@ -98,7 +98,7 @@ pub(super) fn write_verification_receipt(
     };
     let payload_bytes =
         serde_json::to_vec(&payload).context("serialize OCI verification receipt payload")?;
-    let signer = crate::commands::vm::host_signer::load_or_init()
+    let signer = mvm_client::host_keypair::load_or_init()
         .context("load host signing key for OCI verification receipt")?;
     let receipt = OciVerificationReceipt {
         schema_version: payload.schema_version,
@@ -146,15 +146,15 @@ pub(super) fn trust_decision_from_verification_receipt(
     })?;
     let receipt: OciVerificationReceipt =
         serde_json::from_slice(&bytes).context("parse OCI verification receipt")?;
-    let public_key_path = crate::commands::vm::host_signer::default_keys_dir()?
-        .join(crate::commands::vm::host_signer::PUBLIC_FILENAME);
+    let public_key_path = mvm_client::host_keypair::default_keys_dir()?
+        .join(mvm_client::host_keypair::PUBLIC_FILENAME);
     let public_key_bytes = fs::read(&public_key_path).with_context(|| {
         format!(
             "read host public key for OCI verification receipt {}",
             public_key_path.display()
         )
     })?;
-    let public_key: [u8; crate::commands::vm::host_signer::KEY_BYTES] = public_key_bytes
+    let public_key: [u8; mvm_client::host_keypair::KEY_BYTES] = public_key_bytes
         .as_slice()
         .try_into()
         .map_err(|_| anyhow::anyhow!("host public key must contain exactly 32 bytes"))?;

crates/mvm-cli/src/commands/machine/mod.rs

@@ -55,9 +55,6 @@ use super::Cli;
 use super::build::build;
 use super::vm::exec::{RunArgs, RunProfile, run_secure_started};
 use super::vm::group::VmCmd;
-#[cfg(test)]
-use super::vm::host_signer::PUBLIC_FILENAME;
-use super::vm::host_signer::{host_signer_id, load_or_init};
 use super::vm::{console, down};
 use crate::ui;
 use checkpoint::{ForkVmFullMachineInput, fork_vm_full_machine};
@@ -68,6 +65,9 @@ use lifecycle::{
 use mailbox::{MachineMailboxAction, recv_mailbox};
 use manifest_source::{absolutize_manifest_volume_spec, load_machine_manifest_source};
 #[cfg(test)]
+use mvm_client::host_keypair::PUBLIC_FILENAME;
+use mvm_client::host_keypair::{host_signer_id, load_or_init};
+#[cfg(test)]
 use receipt::verify_machine_start_receipt;
 use receipt::{
     MachineStartJsonSummary, MachineStartReceiptInput, MachineStartReceiptOutcome,

crates/mvm-cli/src/commands/machine/receipt.rs

@@ -1,7 +1,7 @@
 use super::*;
 use crate::commands::shared::{self, VolumeSpec};
 #[cfg(test)]
-use crate::commands::vm::host_signer;
+use mvm_client::host_keypair;
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub(super) struct MachineStartReceiptInput {
@@ -426,7 +426,7 @@ pub(super) fn load_machine_start_receipt_pubkey(
 ) -> Result<VerifyingKey> {
     let path = match pubkey_path {
         Some(path) => path.to_path_buf(),
-        None => host_signer::default_keys_dir()?.join(PUBLIC_FILENAME),
+        None => host_keypair::default_keys_dir()?.join(PUBLIC_FILENAME),
     };
     let bytes = std::fs::read(&path)
         .with_context(|| format!("reading machine-start receipt pubkey {}", path.display()))?;

crates/mvm-cli/src/commands/machine/runtime.rs

@@ -241,7 +241,7 @@ fn run_persistent_post_start(
     if !args.run.argv.is_empty() && !command_is_followed(args) {
         start_detached_argv(name, &args.run.argv)?;
     } else if !args.run.argv.is_empty() {
-        let outcome = if shared::wait_for_guest_agent(name, 30) {
+        let outcome = if mvm_client::readiness::wait_for_guest_agent(name, 30) {
             console::run_for_exit(
                 cli,
                 console::Args {
@@ -297,7 +297,7 @@ fn command_is_followed(args: &MachineRunArgs) -> bool {
 /// accepted it, rather than following its output.
 fn start_detached_argv(name: &str, argv: &[String]) -> Result<()> {
     anyhow::ensure!(
-        shared::wait_for_guest_agent(name, 30),
+        mvm_client::readiness::wait_for_guest_agent(name, 30),
         "guest agent for {name:?} not reachable to start the command"
     );
     mvm_client::guest::start_process(

crates/mvm-cli/src/commands/ops/audit.rs

@@ -21,10 +21,10 @@ use mvm_client::audit::{AuditSourceId, AuditSourceKind, LocalAuditReader};
 use mvm_contract::merkle::{InclusionProof, SignedAuditRoot, verify_membership};
 use mvm_core::user_config::MvmConfig;
 
-use super::super::vm::audit_chain::{AuditEmitter, audit_path_for_tenant, default_audit_dir};
-use super::super::vm::host_signer;
 use super::Cli;
 use mvm_client::audit::chain::decisions::DecisionStore;
+use mvm_client::audit::chain::emitter::{AuditEmitter, audit_path_for_tenant, default_audit_dir};
+use mvm_client::host_keypair;
 use mvm_contract::provenance::DecisionId;
 
 use inspect::audit_tail;
@@ -607,7 +607,7 @@ impl ExportArgs {
 }
 
 fn audit_receipts_export(args: &ExportArgs) -> Result<()> {
-    let signer = host_signer::load_or_init().context("loading host signer to export receipts")?;
+    let signer = host_keypair::load_or_init().context("loading host signer to export receipts")?;
     let dir = default_audit_dir().context("resolving audit directory")?;
 
     if let Some(path) = &args.archive {
@@ -927,7 +927,7 @@ fn verify_cert(
 /// Build, sign, and publish a Merkle root over the tenant's audit chain.
 fn audit_publish_root(tenant: &str) -> Result<()> {
     let signer =
-        host_signer::load_or_init().context("loading host signer to publish audit root")?;
+        host_keypair::load_or_init().context("loading host signer to publish audit root")?;
     let emitter = AuditEmitter::new(signer.signing).context("opening host audit emitter")?;
     let signed = emitter
         .publish_root(tenant)
@@ -948,7 +948,7 @@ fn audit_prove(tenant: &str, selector: &str, json: bool) -> Result<()> {
     use mvm_contract::merkle::build_inclusion_proof;
 
     let signer =
-        host_signer::load_or_init().context("loading host signer to build inclusion proof")?;
+        host_keypair::load_or_init().context("loading host signer to build inclusion proof")?;
     let dir = default_audit_dir()?;
     // Read the verified leaf set once; the selector resolves against exactly
     // the leaves the proof is built over, so indices can't drift.
@@ -1083,7 +1083,7 @@ fn audit_verify_inclusion(
     let vk = match pubkey_path {
         Some(p) => load_verifying_key(p)?,
         None => {
-            host_signer::load_or_init()
+            host_keypair::load_or_init()
                 .context("loading host signer public key")?
                 .verifying
         }
@@ -1371,7 +1371,7 @@ fn audit_verify(tenant: &str) -> Result<()> {
 
     // Both chain kinds are signed under the host key; load it once.
     let signer =
-        host_signer::load_or_init().context("loading host signer to verify audit chain")?;
+        host_keypair::load_or_init().context("loading host signer to verify audit chain")?;
 
     // The canonical verification seam: the same source discovery +
     // verification the verified-audit UI reader uses, so the CLI and UI
@@ -2340,7 +2340,7 @@ mod chain_summary_tests {
         let mut env = mvm_core::util::test_env::TestEnv::new();
         let tmp = tempfile::tempdir().unwrap();
         env.set("MVM_HOME", tmp.path());
-        let signer = host_signer::load_or_init().unwrap();
+        let signer = host_keypair::load_or_init().unwrap();
         let dir = default_audit_dir().unwrap();
         let emitter = mvm_hostd::audit::emitter::AuditEmitter::new(signer.signing.clone()).unwrap();
         let plan = PlanFixture::new().tenant("local").plan_id("plan-a").build();