[Enrique Saurez (esaurez)]

Summary

Prepares the second crates.io preview of the nvx crate, 0.1.0-alpha.2. As for 0.1.0-alpha.1 (#654), publishing happens after this merges, from the merged dev commit.

• nvx-rs/Cargo.toml moves to 0.1.0-alpha.2, which aci_edge_sandboxes and aci_edge_sandboxes_model now require. In the three lockfiles, only nvx's version changes.
• bundled keeps its pin, v0.1.0-dev.9ceb89fcc31f. The crate's control contract is still nvx-microvm-v2-control-v2, as it was for 0.1.0-alpha.1.

Since 0.1.0-alpha.1, the crate has gained the shared host and guest building blocks that orchestrators and guest agents outside this repository build on:

• Host: the VMM supervisor, with a spawn allowlist, stop, and reattach (nvx-rs: add the VMM supervisor with a spawn allowlist, stop, and reattach #656); the control session on the shared NVXS host role (nvx-rs: run the control session on the shared NVXS session's host role #641); distro verification separate from launch planning (nvx-rs: separate distro verification from launch planning #653); and the refusal of unrepresentable resource limits (Reject unrepresentable sandbox resource limits #735).
• Guest: the spawn API (nvx-rs: add a neutral guest spawn API and launch managed workloads through it #629), caller-owned cgroup and child-status APIs (nvx-rs: add caller-owned guest cgroup and child-status APIs #655), the mapping API (nvx-rs: add a guest mapping API with explicit export and target roots #652), typed time and reseed calls (nvx-rs: hold the guest port permission for one transaction at a time #662, nvx-rs: run the guest time and reseed steps through typed calls #663), the NVXS guest role (nvx-rs: run the managed agent on the shared NVXS session's guest role #639), and the exec driver (nvx-rs: add a guest exec driver and run the managed agent on it #668).

Validation

On a Windows host:

• cargo publish --dry-run --locked packages 216 files and verifies the build.
• cargo doc --no-deps --locked --features cli,testing,guest with -D warnings succeeds for x86_64-pc-windows-msvc, and for x86_64-unknown-linux-musl, which documents the Linux guest modules.
• cargo metadata --locked succeeds for nvx-rs, aci_edge_sandboxes, and tests/runtime-adapter.

[Enrique Saurez (esaurez)]

Pedro Henrique Penna (@ppenna), once this merges, could you publish nvx 0.1.0-alpha.2 to crates.io from the merged dev commit, as you did for 0.1.0-alpha.1? You are the crate's only owner.

[Copilot]

🟢 Approval recommended

All six changes consistently update version metadata, with no runtime changes or unresolved issues.

No open issues 🎉

What changed in this PR

Prepares nvx version 0.1.0-alpha.2 for its second crates.io preview, with publication planned after merge. This is a version-only update with no runtime changes.

Changes:

• Bumps the crate version and both sandbox dependency requirements to 0.1.0-alpha.2.
• Updates the nvx entry in all three lockfiles, leaving the bundled release pin and control contract unchanged.

File	Description
tests/​runtime-adapter/​Cargo.lock	Records the updated nvx version for the runtime adapter.
nvx-rs/​Cargo.toml	Sets the crate version to 0.1.0-alpha.2.
nvx-rs/​Cargo.lock	Aligns the crate’s lockfile version.
aci_edge_sandboxes/​model/​Cargo.toml	Updates the model’s nvx dependency requirement.
aci_edge_sandboxes/​Cargo.toml	Updates the sandbox library’s nvx dependency requirement.
aci_edge_sandboxes/​Cargo.lock	Aligns the sandbox workspace’s locked nvx version.

_{Review effort: Balanced}