feat: replace Guest control with ComponentSession

.bazelrc

@@ -42,6 +42,7 @@ build:remote --@rules_rust//rust/settings:extra_rustc_flag=-Clink-arg=-fuse-ld=b
 build:remote --@rules_rust//rust/settings:extra_exec_rustc_flag=-Clink-arg=-fuse-ld=bfd
 build:remote --action_env=PATH=/run/current-system/sw/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 build:remote --test_env=PATH=/run/current-system/sw/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+build:remote --strategy=TestRunner=local
 build:remote --remote_download_minimal
 build:remote --jobs=50
 build:remote --remote_cache_compression
@@ -63,6 +64,7 @@ build:trusted-seed --@rules_rust//rust/settings:extra_rustc_flag=-Clink-arg=-fus
 build:trusted-seed --@rules_rust//rust/settings:extra_exec_rustc_flag=-Clink-arg=-fuse-ld=bfd
 build:trusted-seed --action_env=PATH=/run/current-system/sw/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 build:trusted-seed --test_env=PATH=/run/current-system/sw/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+build:trusted-seed --strategy=TestRunner=local
 build:trusted-seed --remote_upload_local_results=true
 build:trusted-seed --remote_cache_async=false
 build:trusted-seed --remote_download_minimal

.github/CODEOWNERS

@@ -3,7 +3,7 @@
 /Cargo.toml @vicondoa
 /Cargo.lock @vicondoa
 /packages/Cargo.guest.lock @vicondoa
-/packages/d2b-priv-broker/Cargo.toml @vicondoa
+/packages/d2b-broker/Cargo.toml @vicondoa
 /packages/d2b-guest-shell-runner/Cargo.toml @vicondoa
 /packages/policy-inputs/** @vicondoa
 /packages/policy-inputs/advisory-policy.json @vicondoa
@@ -13,7 +13,7 @@
 /packages/xtask/tests/policy_production_closure.rs @vicondoa
 /Makefile @vicondoa
 /flake.nix @vicondoa
-/nixos-modules/guest-control.nix @vicondoa
+/nixos-modules/component-session.nix @vicondoa
 /nixos-modules/host-activation.nix @vicondoa
 /nixos-modules/host-broker.nix @vicondoa
 /nixos-modules/host-daemon.nix @vicondoa

.github/workflows/pr-l1-static-fast.yml

@@ -107,24 +107,6 @@ jobs:
       - name: Guest shell runner suite
         run: make test-rust-guest-shell-runner
 
-  rust-local:
-    runs-on: ubuntu-latest
-    timeout-minutes: 90
-    env:
-      D2B_BAZEL_PROFILE: local
-      D2B_BAZEL_UNTRUSTED: "1"
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-        with:
-          persist-credentials: false
-      - uses: cachix/install-nix-action@23cf0fec1d55e0b1f2631aedd2a610c21ef8b077
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-          extra_nix_config: |
-            experimental-features = nix-command flakes
-      - name: Local Rust suite
-        run: make test-rust-local
-
   nix-eval:
     runs-on: ubuntu-latest
     timeout-minutes: 45
@@ -163,7 +145,7 @@ jobs:
 
   nix-realized:
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 120
     env:
       D2B_BAZEL_PROFILE: local
       D2B_BAZEL_UNTRUSTED: "1"
@@ -218,7 +200,7 @@ jobs:
   test-performance-budgets:
     runs-on: ubuntu-latest
     continue-on-error: true
-    timeout-minutes: 10
+    timeout-minutes: 30
     env:
       D2B_BAZEL_PROFILE: local
       D2B_BAZEL_UNTRUSTED: "1"
@@ -236,7 +218,7 @@ jobs:
 
   check:
     if: ${{ always() }}
-    needs: [tier0, policy-tooling, rust-main, rust-broker, rust-guest, rust-local, nix-eval, nix-unit, nix-realized, nix-aarch64, fixtures-proofs]
+    needs: [tier0, policy-tooling, rust-main, rust-broker, rust-guest, nix-eval, nix-unit, nix-realized, nix-aarch64, fixtures-proofs]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

.github/workflows/release-host-binaries.yml

@@ -105,7 +105,7 @@ jobs:
             packages/d2b-wayland-proxy/Cargo.toml \
             packages/d2b-unsafe-local-helper/Cargo.toml \
             packages/d2b-host/Cargo.toml \
-            packages/d2b-priv-broker/Cargo.toml
+            packages/d2b-broker/Cargo.toml
           do
             package_version=$(sed -n 's/^[[:space:]]*version[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' "$manifest" | head -1)
             [ "$package_version" = "$VERSION" ] || {
@@ -126,7 +126,7 @@ jobs:
           }
 
           manifest_version=$(jq -r 'if .version == null then "null" else (.version | strings) end' nix/prebuilt.json)
-          expected_keys='["d2b","d2b-activation-helper","d2b-priv-broker","d2b-unsafe-local-helper","d2b-wayland-proxy","d2bd"]'
+          expected_keys='["d2b","d2b-activation-helper","d2b-broker","d2b-unsafe-local-helper","d2b-wayland-proxy","d2bd"]'
           if [ "$manifest_version" = "null" ]; then
             jq -e '.version == null and .system == "x86_64-linux" and .binaries == {}' \
               nix/prebuilt.json >/dev/null || {
@@ -145,7 +145,7 @@ jobs:
             for binary in \
               d2b \
               d2b-activation-helper \
-              d2b-priv-broker \
+              d2b-broker \
               d2b-unsafe-local-helper \
               d2b-wayland-proxy \
               d2bd
@@ -246,7 +246,7 @@ jobs:
             packages/d2b-wayland-proxy/Cargo.toml \
             packages/d2b-unsafe-local-helper/Cargo.toml \
             packages/d2b-host/Cargo.toml \
-            packages/d2b-priv-broker/Cargo.toml
+            packages/d2b-broker/Cargo.toml
           do
             package_version=$(sed -n 's/^[[:space:]]*version[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' "$manifest" | head -1)
             [ "$package_version" = "$VERSION" ] || {
@@ -341,7 +341,7 @@ jobs:
             --package d2b-host --bin d2b-activation-helper
           rustup run "$PINNED" cargo build --release --locked \
             --manifest-path Cargo.toml \
-            --package d2b-priv-broker --bin d2b-priv-broker --no-default-features
+            --package d2b-broker --bin d2b-broker --no-default-features
 
           rm -rf dist
           mkdir -p dist/bin
@@ -350,12 +350,12 @@ jobs:
           cp target/release/d2b-wayland-proxy dist/bin/
           cp target/release/d2b-unsafe-local-helper dist/bin/
           cp target/release/d2b-activation-helper dist/bin/
-          cp target/release/d2b-priv-broker dist/bin/
+          cp target/release/d2b-broker dist/bin/
 
           for binary in \
             d2b \
             d2b-activation-helper \
-            d2b-priv-broker \
+            d2b-broker \
             d2b-unsafe-local-helper \
             d2b-wayland-proxy \
             d2bd
@@ -461,7 +461,7 @@ jobs:
             packages/d2b-wayland-proxy/Cargo.toml \
             packages/d2b-unsafe-local-helper/Cargo.toml \
             packages/d2b-host/Cargo.toml \
-            packages/d2b-priv-broker/Cargo.toml
+            packages/d2b-broker/Cargo.toml
           do
             package_version=$(sed -n 's/^[[:space:]]*version[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' "$manifest" | head -1)
             [ "$package_version" = "$VERSION" ] || {
@@ -473,7 +473,7 @@ jobs:
           flake_versions=$(sed -n 's/^[[:space:]]*version[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' flake.nix | sort -u)
           [ "$(printf '%s\n' "$flake_versions" | awk -v expected="$VERSION" '$0 != expected && NF { count++ } END { print count + 0 }')" -eq 0 ]
 
-          expected_keys='["d2b","d2b-activation-helper","d2b-priv-broker","d2b-unsafe-local-helper","d2b-wayland-proxy","d2bd"]'
+          expected_keys='["d2b","d2b-activation-helper","d2b-broker","d2b-unsafe-local-helper","d2b-wayland-proxy","d2bd"]'
           manifest_version=$(jq -r 'if .version == null then "null" else (.version | strings) end' nix/prebuilt.json)
           if [ "$manifest_version" = "null" ]; then
             jq -e '.version == null and .system == "x86_64-linux" and .binaries == {}' nix/prebuilt.json >/dev/null
@@ -492,7 +492,7 @@ jobs:
           for binary in \
             d2b \
             d2b-activation-helper \
-            d2b-priv-broker \
+            d2b-broker \
             d2b-unsafe-local-helper \
             d2b-wayland-proxy \
             d2bd
@@ -612,7 +612,7 @@ jobs:
           asset_names=(
             "d2b-${VERSION}-x86_64-linux.tar.gz"
             "d2b-activation-helper-${VERSION}-x86_64-linux.tar.gz"
-            "d2b-priv-broker-${VERSION}-x86_64-linux.tar.gz"
+            "d2b-broker-${VERSION}-x86_64-linux.tar.gz"
             "d2b-unsafe-local-helper-${VERSION}-x86_64-linux.tar.gz"
             "d2b-wayland-proxy-${VERSION}-x86_64-linux.tar.gz"
             "d2bd-${VERSION}-x86_64-linux.tar.gz"
@@ -703,7 +703,7 @@ jobs:
             case "$1" in
               "d2b-${VERSION}-x86_64-linux.tar.gz" \
                 | "d2b-activation-helper-${VERSION}-x86_64-linux.tar.gz" \
-                | "d2b-priv-broker-${VERSION}-x86_64-linux.tar.gz" \
+                | "d2b-broker-${VERSION}-x86_64-linux.tar.gz" \
                 | "d2b-unsafe-local-helper-${VERSION}-x86_64-linux.tar.gz" \
                 | "d2b-wayland-proxy-${VERSION}-x86_64-linux.tar.gz" \
                 | "d2bd-${VERSION}-x86_64-linux.tar.gz" \

AGENTS.md

@@ -6,7 +6,7 @@ configuration, start with [`README.md`](README.md).
 
 d2b is an opinionated NixOS desktop microVM framework for a single trusted
 Wayland host and untrusted, isolated workloads. Its daemon-only control plane
-is `d2bd` plus `d2b-priv-broker`; its declarative modules own networking,
+is `d2bd` plus `d2b-broker`; its declarative modules own networking,
 per-VM store views, mediated devices, and versioned bundle contracts.
 Product direction is in [`STRATEGY.md`](./STRATEGY.md); the threat model is
 in [`docs/explanation/design.md`](./docs/explanation/design.md). Binding
@@ -205,7 +205,7 @@ Read the relevant section before changing any of these:
 ## Daemon-only end-state (P6 onward)
 
 d2b declares exactly three root-visible units: `d2bd.service`,
-`d2b-priv-broker.socket`, and `d2b-priv-broker.service`. The binding decision
+`d2b-broker.socket`, and `d2b-broker.service`. The binding decision
 is [ADR 0015](./docs/adr/0015-daemon-only-clean-break.md).
 
 - `d2bd` supervises every per-VM DAG. The broker dispatches audited host

BUILD.bazel

@@ -102,7 +102,6 @@ exports_files([
     "docs/explanation/design.md",
     "docs/how-to/migrate-d2b-v1-0-to-v1-1.md",
     "docs/reference/cli-contract.md",
-    "nixos-modules/guest-control-token-materialize.py",
     "docs/reference/cli-output/list.schema.json",
     "docs/reference/cli-output/status.schema.json",
     "docs/reference/components-usbip.md",
@@ -145,8 +144,7 @@ exports_files([
     "nixos-modules/generated/options-zones-Zone.nix",
     "nixos-modules/generated/options-zones-ZoneLink.nix",
     "nixos-modules/gateway-vm.nix",
-    "nixos-modules/guest-control.nix",
-    "nixos-modules/guest-control-host.nix",
+    "nixos-modules/component-session.nix",
     "nixos-modules/host-activation.d/state-dir-acl.sh",
     "nixos-modules/host-activation.nix",
     "nixos-modules/host-daemon.nix",
@@ -296,21 +294,19 @@ filegroup(
         "//packages/d2b-core:cargo_workspace_sources",
         "//packages/d2b-core-controller:cargo_workspace_sources",
         "//packages/d2b-core/fuzz:BUILD.bazel",
-        "//packages/d2b-cutover:cargo_workspace_sources",
-        "//packages/d2b-exec-runner:cargo_workspace_sources",
         "//packages/d2b-gateway:cargo_workspace_sources",
         "//packages/d2b-gateway-runtime:cargo_workspace_sources",
         "//packages/d2b-guest-shell-runner:cargo_workspace_sources",
-        "//packages/d2b-guestd:cargo_workspace_sources",
         "//packages/d2b-host:cargo_workspace_sources",
         "//packages/d2b-host-activation-helper:cargo_workspace_sources",
-        "//packages/d2b-priv-broker:cargo_workspace_sources",
+        "//packages/d2b-broker:cargo_workspace_sources",
         "//packages/d2b-process:cargo_workspace_sources",
         "//packages/d2b-process-conformance:cargo_workspace_sources",
         "//packages/d2b-provider:cargo_workspace_sources",
         "//packages/d2b-provider-activation-nixos:cargo_workspace_sources",
         "//packages/d2b-provider-audio-pipewire:cargo_workspace_sources",
         "//packages/d2b-provider-clipboard-wayland:cargo_workspace_sources",
+        "//packages/d2b-provider-config-nixos:cargo_workspace_sources",
         "//packages/d2b-provider-credential-entra:cargo_workspace_sources",
         "//packages/d2b-provider-credential-managed-identity:cargo_workspace_sources",
         "//packages/d2b-provider-credential-secret-service:cargo_workspace_sources",

CHANGELOG.md

@@ -290,8 +290,7 @@ deprecations ship one minor release before removal.
   with CLI projections, Guest-resident Entrablau identity custody, fast hermetic
   tests with integration-only slow coverage, and Noise-protected
   ComponentSession/d2b-bus channels on the `d2bus.org` public namespace,
-  together with the security/threat-model, reset/cutover, feasibility,
-  reset, cutover, and feasibility contracts. No crates, services,
+  together with the security/threat-model and feasibility contracts. No crates, services,
   controllers, or Providers are created.
 
 
@@ -481,8 +480,7 @@ deprecations ship one minor release before removal.
 - Added macvtap-backed external network attachment for env net VMs, including
   independent egress NAT, port forwards, and mDNS/`.local` reflection.
 - Added generated storage and synchronization contracts, read-only startup
-  validation, `d2b host doctor --read-only`, and
-  `d2b host migrate-storage --dry-run`.
+  validation, and `d2b host doctor --read-only`.
 - Added provider-aware graceful VM shutdown with configurable global and per-VM
   timeouts, plus explicit `--force` lifecycle overrides.
 - Added experimental remote full-host and provider-managed Azure Container Apps
@@ -796,7 +794,7 @@ deprecations ship one minor release before removal.
   no-orphan; a `setsid`/double-fork escapee is a documented trusted-root
   limitation). Interactive detached exec remains unsupported; use
   non-TTY `d2b vm exec -d` for detached commands. See
-  [`docs/reference/guest-control-exec-interactive-tty.md`](docs/reference/guest-control-exec-interactive-tty.md)
+  [`docs/reference/cli-contract.md`](docs/reference/cli-contract.md#exec)
   and the interactive-exec section of
   [ADR 0028](docs/adr/0028-guest-control-plane-over-vsock.md). The
   guest-control wire contract is unchanged (the TTY surface was already

CONTRIBUTING.md

@@ -116,7 +116,7 @@ When docs disagree with committed, passing code, the code wins. Update the docs
 ## Host-prepare gates
 
 Contributors touching anything in `packages/d2b-host/`,
-`packages/d2b-priv-broker/src/ops/`, or the host-prepare
+`packages/d2b-broker/src/ops/`, or the host-prepare
 docs (`docs/how-to/host-prepare.md`,
 `docs/how-to/host-prepare.d/*.md`,
 `docs/reference/{cgroup-delegation,inet-d2b-chains,privileges,support-matrix}.md`)