feat(driver-mxc): native Windows MXC compute driver + server wiring

.agents/skills/openshell-cli/SKILL.md

@@ -359,7 +359,7 @@ stopped. Delete remains the operation that removes retained state.
 
 This is the most important multi-step workflow. It enables a tight feedback cycle where sandbox policy is refined based on observed activity.
 
-**Key concept**: Policies have static fields (immutable after creation: `filesystem_policy`, `landlock`, `process`) and two dynamic fields: `network_policies` and `network_middlewares`. Both dynamic fields can be updated without recreating the sandbox.
+**Key concept**: Policies have static fields (immutable after creation: `filesystem_policy`, `landlock`, `process`) and two dynamic fields: `network_policies` and `network_middlewares`. Both dynamic fields can be updated without recreating the sandbox when the selected compute driver supports live policy updates. MXC rejects live policy replacement and merge updates; delete and recreate an MXC sandbox instead.
 
 An endpoint with omitted `protocol` retains explicit-proxy behavior. Explicit
 `protocol: tcp` requests policy DNS and transparent TCP and currently requires
@@ -429,7 +429,7 @@ Edit `current-policy.yaml` to allow the blocked actions. **For policy content au
 - Binary matching patterns
 - Ordered `network_middlewares`, host selection, HTTP and WebSocket bindings, and `fail_open` or `fail_closed` behavior
 
-`network_policies` and `network_middlewares` can be modified at runtime. If `filesystem_policy`, `landlock`, or `process` need changes, the sandbox must be recreated. Built-in middleware such as `openshell/regex` needs no gateway registration. An operator-run middleware must already be registered under `[[openshell.supervisor.middleware]]`; changing that static registration requires a gateway restart.
+`network_policies` and `network_middlewares` can be modified at runtime when the selected compute driver supports live policy updates. MXC rejects live policy replacement and merge updates; delete and recreate an MXC sandbox instead. If `filesystem_policy`, `landlock`, or `process` need changes, the sandbox must be recreated. Built-in middleware such as `openshell/regex` needs no gateway registration. An operator-run middleware must already be registered under `[[openshell.supervisor.middleware]]`; changing that static registration requires a gateway restart.
 
 Middleware can inspect parsed HTTP request bodies and complete client-to-upstream WebSocket text messages over both `ws://` and `wss://` when the implementation advertises the matching binding. The built-in `openshell/regex` advertises both bindings and applies its fixed patterns to UTF-8 text. A host-matched HTTP-only attachment can inspect the upgrade GET but does not join the WebSocket chain; look for `binding_not_selected` coverage. Binary messages pass under both `on_error` modes and active stages emit `unsupported_message_type` coverage; upstream-to-client messages remain uninspected. A broken fail-open WebSocket stage is disabled for the rest of that connection; inspect sandbox OCSF logs for `openshell.middleware.websocket_stage_disabled`.
 

.agents/skills/openshell-cli/cli-reference.md

@@ -381,7 +381,7 @@ The sandbox name defaults to the last-used sandbox.
 
 ### `openshell policy update [name]`
 
-Incrementally merge live network policy changes into the current sandbox policy. Multiple flags in one invocation are applied as one atomic batch and create at most one new revision.
+Incrementally merge live network policy changes into the current sandbox policy when the selected compute driver supports live updates. Multiple flags in one invocation are applied as one atomic batch and create at most one new revision. MXC rejects live policy merges; delete and recreate an MXC sandbox instead.
 
 | Flag | Default | Description |
 |------|---------|-------------|
@@ -411,7 +411,7 @@ Notes:
 
 ### `openshell policy set [name] --policy <PATH>`
 
-Replace the full policy on a live sandbox. Only the dynamic `network_policies` field can be changed at runtime.
+Replace the full policy on a live sandbox when the selected compute driver supports live updates. Only the dynamic `network_policies` field can be changed at runtime. MXC rejects live policy replacement; delete and recreate an MXC sandbox instead.
 
 | Flag | Default | Description |
 |------|---------|-------------|

.gitattributes

@@ -11,3 +11,6 @@ crates/openshell-core/src/proto/openshell.*.rs linguist-generated
 
 # Vendored OCSF schemas fetched from schema.ocsf.io
 crates/openshell-ocsf/schemas/** linguist-generated
+
+# TypeScript tooling and Biome require stable LF input on every host
+sdk/typescript/** text eol=lf

architecture/README.md

@@ -141,6 +141,10 @@ bridge networks, port mappings, NAT traversal, or bespoke tunnels. The common
 runtime requirement is narrower: the supervisor must be able to reach the
 gateway.
 
+The Windows MXC driver is an explicit exception. It launches and monitors a
+one-shot workload in the driver, self-reports readiness, and does not expose a
+supervisor session, interactive connect, live policy delivery, or governed egress.
+
 The gateway delivers desired state; the sandbox applies it locally. Policy,
 settings, credentials, and inference routes flow from the gateway to the
 supervisor. The supervisor validates and applies what can change at runtime,

architecture/windows-msvc-build.md

@@ -1,14 +1,15 @@
 # Windows MSVC Build Design
 
 This page records the design decisions for the native Windows MSVC build lane.
-It is intentionally build-only. It does not make Windows a Docker, Kubernetes,
-Podman, or VM runtime host.
+It provides the native build lane and validates the in-process MXC compute
+driver. It does not make Windows a Docker, Kubernetes, Podman, or VM runtime host.
 
 ## Goals
 
 - Compile the OpenShell gateway and CLI for `x86_64-pc-windows-msvc` and `aarch64-pc-windows-msvc`.
 - Keep the Linux and macOS build paths unchanged.
 - Preserve gateway configuration parsing for all existing compute driver names.
+- Build and test the in-process MXC driver on supported Windows hosts.
 - Return clear unsupported errors when a Windows gateway is configured to use Docker, Kubernetes, Podman, or VM.
 - Keep dedicated `windows:*` validation tasks while allowing the repository-wide
   `pre-commit` task to delegate compiler-bearing Rust checks to the native
@@ -18,7 +19,7 @@ Podman, or VM runtime host.
 
 - Do not support Docker Desktop, WSL, Hyper-V, Podman machine, Podman Desktop, Kubernetes, or VM-backed sandbox execution on Windows.
 - Do not ship Windows standalone binaries for Docker, Kubernetes, Podman, or VM drivers.
-- Do not implement named-pipe driver IPC, Windows services, MSI packaging, Credential Manager integration, DPAPI integration, or MXC policy translation in this build lane.
+- Do not implement named-pipe driver IPC, Windows services, MSI packaging, Credential Manager integration, or DPAPI integration in this lane.
 
 ## Unsupported Driver Strategy
 
@@ -42,6 +43,7 @@ on Windows.
 | Kubernetes | Driver crate excluded; server config contract retained. | Gateway construction returns unsupported. |
 | Podman | Driver crate excluded; server config contract retained. | Gateway construction returns unsupported. |
 | VM | Driver crate excluded from workspace validation. | Gateway construction returns unsupported. |
+| MXC | Driver links into the native gateway and runs in Windows validation. | `process_container` is default-deny; grant-only `isolation_session` requires explicit configuration. |
 
 This keeps Windows behavior explicit without carrying runtime dependencies or
 creating misleading Windows driver artifacts.
@@ -62,7 +64,7 @@ Windows validation is exposed through `tasks/windows.toml`:
 | `windows:check:arm64` | Check the ARM64 MSVC gateway/CLI build graph. |
 | `windows:build:x64` | Build release x64 `openshell-gateway.exe` and `openshell.exe`. |
 | `windows:build:arm64` | Build release ARM64 `openshell-gateway.exe` and `openshell.exe`. |
-| `windows:test:x64` | Run native x64 workspace tests, excluding unsupported Windows packages as top-level test targets. |
+| `windows:test:x64` | Run native x64 workspace tests, including MXC mapper and lifecycle tests, while excluding unsupported Windows packages as top-level test targets. |
 | `windows:test:arm64` | Run native ARM64 workspace tests with the same package exclusions. |
 | `windows:test:unsupported:x64` | Run focused server/runtime tests for unsupported driver contracts. |
 | `windows:test:unsupported:arm64` | Run the same focused contracts natively on ARM64. |
@@ -159,5 +161,5 @@ A successful Windows build report should include:
 - Focused unsupported-driver contract test status.
 - Artifact size and SHA256 for each Windows binary.
 
-Warnings from Linux-only dead code are acceptable in this build-only phase when
+Warnings from Linux-only dead code are acceptable in the native Windows lane when
 they come from code paths intentionally disabled on Windows.

crates/openshell-core/src/config.rs

@@ -125,6 +125,8 @@ pub enum ComputeDriverKind {
     Vm,
     Docker,
     Podman,
+    /// Microsoft MXC isolation session (Windows only).
+    Mxc,
 }
 
 impl ComputeDriverKind {
@@ -135,6 +137,7 @@ impl ComputeDriverKind {
             Self::Vm => "vm",
             Self::Docker => "docker",
             Self::Podman => "podman",
+            Self::Mxc => "mxc",
         }
     }
 }
@@ -175,8 +178,9 @@ impl FromStr for ComputeDriverKind {
             "vm" => Ok(Self::Vm),
             "docker" => Ok(Self::Docker),
             "podman" => Ok(Self::Podman),
+            "mxc" => Ok(Self::Mxc),
             other => Err(format!(
-                "unsupported compute driver '{other}'. expected one of: kubernetes, vm, docker, podman"
+                "unsupported compute driver '{other}'. expected one of: kubernetes, vm, docker, podman, mxc"
             )),
         }
     }

crates/openshell-core/src/telemetry.rs

@@ -165,6 +165,7 @@ pub enum TelemetryComputeDriver {
     Kubernetes,
     Podman,
     Vm,
+    Mxc,
     Unknown,
 }
 
@@ -176,6 +177,7 @@ impl TelemetryComputeDriver {
             Self::Kubernetes => "kubernetes",
             Self::Podman => "podman",
             Self::Vm => "vm",
+            Self::Mxc => "mxc",
             Self::Unknown => "unknown",
         }
     }
@@ -187,6 +189,7 @@ impl TelemetryComputeDriver {
             "k8s" | "kubernetes" => Self::Kubernetes,
             "podman" => Self::Podman,
             "vm" => Self::Vm,
+            "mxc" => Self::Mxc,
             _ => Self::Unknown,
         }
     }
@@ -198,6 +201,7 @@ impl TelemetryComputeDriver {
             Some(crate::ComputeDriverKind::Kubernetes) => Self::Kubernetes,
             Some(crate::ComputeDriverKind::Podman) => Self::Podman,
             Some(crate::ComputeDriverKind::Vm) => Self::Vm,
+            Some(crate::ComputeDriverKind::Mxc) => Self::Mxc,
             None => Self::Unknown,
         }
     }

crates/openshell-driver-mxc/Cargo.toml

@@ -0,0 +1,47 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+[package]
+name = "openshell-driver-mxc"
+description = "MXC (Windows isolation session) compute driver for OpenShell"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[lib]
+name = "openshell_driver_mxc"
+
+[dependencies]
+openshell-core = { path = "../openshell-core" }
+tokio = { workspace = true }
+tonic = { workspace = true }
+futures = { workspace = true }
+tokio-stream = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+base64 = { workspace = true }
+tracing = { workspace = true }
+thiserror = { workspace = true }
+uuid = { workspace = true }
+
+[dev-dependencies]
+tokio = { workspace = true }
+# tempfile is not a workspace dependency; 3.27 is already resolved in Cargo.lock.
+tempfile = "3"
+# Used by Windows-only integration tests to parse policy YAML into the typed
+# proto. Inert on non-Windows.
+openshell-policy = { path = "../openshell-policy" }
+# Needed by the real-wxc integration test (wxc_exec_real.rs) which builds
+# --config-base64 payloads without going through the async WxcExecInvoker.
+# base64 and serde_json are already [dependencies] but dev-dependency resolution
+# is independent; explicit entries make them visible to integration tests.
+base64 = { workspace = true }
+serde_json = { workspace = true }
+# Used by the drift guard test (handled_fields_inventory) to parse YAML into a
+# generic serde_json::Value for key enumeration.
+serde_yml = { workspace = true }
+
+[lints]
+workspace = true

crates/openshell-driver-mxc/README.md

@@ -0,0 +1,118 @@
+# openshell-driver-mxc
+
+OpenShell compute driver backed by **Microsoft MXC** (`wxc-exec`) on Windows.
+
+## Design
+
+This driver implements the gateway's `ComputeDriver` contract as an in-process
+library linked into `openshell-gateway`. `process_container` launches a one-shot
+AppContainer and is the default. The opt-in `isolation_session` backend uses the
+state-aware `provision` → `start` → `exec` → `stop` → `deprovision` lifecycle.
+The driver launches and monitors the configured workload itself and self-reports
+readiness; there is no in-sandbox supervisor or `ConnectSupervisor` relay.
+
+## Capability Matrix
+
+| Capability | MXC driver |
+|---|---|
+| Filesystem policy | Read-only/read-write grants come only from `SandboxPolicy`. `process_container` enforces default-deny; `isolation_session` is an explicit grant-only compatibility mode. |
+| Network policy | Rejected synchronously during sandbox creation until an enforcing egress path is bound. |
+| Process policy | Unsupported; MXC supplies OS isolation only. |
+| Interactive exec/connect/forward | Unsupported; the configured workload runs in-driver. |
+| Restart durability | Unsupported; the in-memory registry cannot recover live sessions. |
+
+The filesystem enforcement proof has two paths:
+
+- A write to a path granted by the sandbox policy succeeds.
+- A `process_container` write outside the sandbox policy fails with Windows access denied, and the driver reports the failed workload.
+
+## Configuration (`[openshell.drivers.mxc]`)
+
+Gateway configuration contains only host runtime settings:
+
+```toml
+[openshell.drivers.mxc]
+wxc_exec_path = "C:\\path\\to\\wxc-exec.exe"
+# Default: process_container. isolation_session is grant-only and opt-in.
+backend = "process_container"
+default_configuration_id = "composable"
+pc_least_privilege = false
+pc_capabilities = []
+debug = false
+```
+
+Supply workload settings for each sandbox. The public config is keyed by driver name; the gateway forwards only the inner `mxc` object to the driver:
+
+```powershell
+$config = '{"mxc":{"command":["cmd","/c","echo hello > C:\\\\work\\\\demo\\\\hello.txt"],"cwd":"C:\\\\work\\\\demo"}}'
+openshell sandbox create --name mxc-demo --policy demo.yaml `
+  --driver-config-json $config --env MODE=demo --no-tty
+```
+
+The `command` array is required and preserves Windows argument boundaries. `cwd` is optional. Environment variables come from the standard sandbox and template environment maps; the driver never copies values from the gateway host environment.
+
+Network policy and live policy replacement or merge updates are rejected while the gateway uses MXC. Delete and recreate the sandbox to apply a different filesystem policy.
+
+## Prerequisites (live runs)
+
+- Windows 11 Insider build ≥ 26300.8553
+- `IsoSessionApp.dll` present and registered
+- `wxc-exec.exe` built with `--features isolation_session`
+
+For off-box smoke tests against the in-process mock shim (no `wxc-exec`,
+no isolation session needed), set `OPENSHELL_MXC_MOCK_WXC=1`.
+
+## Policy mapping
+
+The production driver maps the typed `SandboxPolicy` to MXC configuration before it inserts a registry entry or invokes `wxc-exec`. Mapping failure therefore returns from `CreateSandbox` without leaving a partial sandbox.
+
+`EmbeddedPolicyMapper` calls the embedded [`policy_map`](src/policy_map/) module directly and normalizes filesystem paths to Windows form. It does not add gateway-configured host paths. The policy supplied for the sandbox is the only source of filesystem grants.
+
+The mapper retains an internal policy-splitting seam for future development, but the runtime exposes no governed-egress switch. Any network rule fails closed until an enforcing proxy is implemented and bound to the sandbox lifecycle.
+
+Parity and matrix tests under [`tests/`](tests/) cover the mapper on the Windows MSVC lane. The driver performs this mapping automatically; there is no separate policy-export command or example.
+
+## Packaging the demo for the demo box
+
+Use [`examples/package-demo.ps1`](examples/package-demo.ps1) to assemble
+the gateway EXE, CLI EXE, runtime DLLs (`libz3.dll`), `demo.yaml`, the
+gateway config, and the runbook into one folder, then copy that folder to
+the demo Windows host and follow `mxc-demo-runbook.md` inside it. The
+script prints a SHA256 manifest so the operator can sanity-check what
+landed before moving it.
+
+## Real-MXC test lane
+
+Three tasks drive real `wxc-exec.exe` hardware; all are **skip-safe** — any test
+or scenario that requires an absent binary or backend prints a SKIP reason and
+exits 0 rather than failing.
+
+| Task | What it runs | When to use |
+|---|---|---|
+| `windows:test:mxc-real:x64` | `tests/wxc_exec_real.rs` — Tier-2 invoker tests with `--ignored --test-threads=1` | Pre-merge on any Windows host that has `wxc-exec`; dry-run tests always pass; enforcement tests probe-gate themselves |
+| `windows:e2e:mxc` | `examples/run-mxc-e2e.ps1` — Tier-3 scenario runner, real binary, probe-gated | Demo box / nightly; needs the gateway + CLI binaries in the script directory |
+| `windows:e2e:mxc:mock` | Same runner with `-Mock` — wiring-only, no real `wxc-exec` needed | Any Windows host (CI, dev machine); validates wiring and the network-reject scenario |
+
+**Probe script:** `examples/probe-mxc-host.ps1` is an operator/CI preflight that emits a JSON capability report
+(OS build, wxc-exec path/version, dry-run exit code, per-backend trial result,
+and a `verdicts` object). Run it before the real-MXC lane to understand what
+will PASS vs SKIP on a given host:
+
+```powershell
+powershell -NoProfile -ExecutionPolicy Bypass `
+  -File crates/openshell-driver-mxc/examples/probe-mxc-host.ps1
+```
+
+**Skip semantics:** tests in `wxc_exec_real.rs` are marked
+`#[ignore = "requires real wxc-exec"]` — the standard `windows:test:x64` suite
+never runs them. `OPENSHELL_WXC_EXEC_PATH` overrides the default
+`C:\mxc\wxc-exec.exe` lookup. See `docs4gtb/mxc-box-capabilities.md` for the
+empirical capability snapshot of the development box (build 26200, processcontainer
+velocity keys not enabled, isolation_session absent).
+
+## Deferred work
+
+- **Interactive exec/connect/forward** → `adapt-openshell-gateway-windows`
+- **Governed egress** remains fail-closed until an enforcing proxy is implemented and bound to sandbox lifecycle.
+- **Restart durability** (deprovision orphaned sessions on startup) → follow-on
+- **GPU passthrough** → not pursued in host-side-governance design