[Pedro Henrique Penna (ppenna)]

Part of #1112: SL3.10b, step 1 of 3 (the CLI no longer uses the old launch, store or config APIs).

What and why

SL3.10b removes the last uses of nvx's old launch, store and config APIs from the CLI's four shared sandbox modules: host/cli/sandbox/{mod,options,state}.rs and sandbox/lifecycle/mod.rs. Its measured scope came to about ten times its estimate of 20 core lines, since SandboxLaunch, SandboxSettings, SandboxUpper and SandboxNetwork still carry provision, start and the sandbox's record. The split of SL3.10b into three stacked pull requests, each with one goal, was approved for Pedro Henrique Penna (@ppenna):

1. This pull request: the store and old-plan leftovers.
2. sandbox: record the network's options and build its policy at each start (SL3.10c) #1501 (SL3.10c): the sandbox network moves to NetworkConfig, and the record to format 10.
3. sandbox: record the launch's options without the old launch profile (SL3.10d) #1503 (SL3.10d): SandboxLaunch, SandboxSettings and SandboxUpper leave the four modules for the CLI's record and a VmConfig.

This step:

• sandbox/mod.rs imports RuntimeIdentity from host::runtime, its owner, rather than through host::store, which only re-exports it.
• sandbox_network (sandbox/options.rs) no longer calls host::sandbox::plan::guest_gateway, the old plan's wrapper around net::guest_gateway. It checks --net with Ipv4Cidr::parse, whose refusal is the plan's word for word, guest network "ADDRESS" must be an IPv4 address with a /1 to /30 prefix that is not its network's network, broadcast, or gateway (first) address, with the same code (unsupported), and takes the gateway from net::guest_gateway, which finds one for every address that parses. The order of the refusals does not change, and SandboxNetwork::new still checks the network until SL3.10c.

Nothing else changes: no output, record, test or public API.

Size. 4 core lines, 2 counted files: sandbox/mod.rs 1 and sandbox/options.rs 3. The public API, BOOT_CONTRACT_VERSION and CONTROL_CONTRACT_REVISION do not change.

Validation

At this head (2e33e1bd70d, on feature/nvx-refactor d4edeeb9ab9), the gates that local_gates.py --files selects for the two files, from this branch's action definitions:

Check	Result
Windows, check-nvx-rs: cargo fmt --check; Clippy with -D warnings (--all-targets --all-features, --lib, --lib --no-default-features, --lib --bins --features cli, --lib --bins --no-default-features --features testing); cargo test --all-features (lib 1464, cli 110) and cargo test; the --lib --no-default-features build and tests; the bundled-artifacts test; cargo doc with -D warnings; MSRV 1.89; the runtime adapter's protocol-only and host-only configurations	Passed
Windows, validate-nvx: compileall, the 22 scripts/test_*.py modules (1834 tests), test_adversarial.py, test_hosts.py, nvx.py help	Passed. test_adversarial.py's test_contained_process_timeout_kills_descendants failed once, with a PermissionError on its child.pid while Rust suites ran beside it, and passed in three reruns and a rerun of the module
Windows: check_test_layout.py, check_markdown_links.py, check_test_changes.py --base origin/feature/nvx-refactor	Passed; no change to existing tests
Linux (nvx-kvm-test, Azure Linux 3, KVM): the check-nvx-rs commands above, the public API, the macOS check, the guest binaries' lint, tests, build and checks, and the runtime adapter's three configurations; validate-nvx	Passed, but for the 28 guest:: unit tests of cargo test --all-features (lib 2276 passed, cli 119) and the 26 of nvx.py check-guest-binaries, which fail on that host at the base too (#1491); none touches the CLI

network_policies_that_the_planner_refuses_fail_before_launch (tests/cli.rs) keeps checking, word for word, that sandbox run --dry-run and sandbox provision refuse --net 10.0.0.1/24 before they launch or record anything. No other path changes: the microVM scenarios run at the top of the stack, with SL3.10d.

Left to CI: MSHV and WHP.

[Copilot]

🟢 Approval recommended

No active review issues were identified for the sandbox CLI dependency cleanup.

No open issues 🎉

What changed in this PR

This PR completes the first part of SL3.10b in #1112, removing residual store and old-plan dependencies from the sandbox CLI without changing its public API or intended behavior.

Changes:

• Imports RuntimeIdentity directly from its owning host::runtime module.
• Replaces the old plan gateway wrapper with Ipv4Cidr validation and net::guest_gateway, preserving validation errors and their order.

File	Description
nvx-rs/​src/​host/​cli/​sandbox/​options.rs	Uses network primitives directly for guest-address validation and gateway lookup.
nvx-rs/​src/​host/​cli/​sandbox/​mod.rs	Imports runtime identity without the store re-export.

_{Review effort: Balanced}