fix(mxc): repair Windows inference demos (NVBug 6782874)

[prekshivyas]

Summary

Fix both shipped MXC Windows inference demos for NVBug 6782874 and restore their authoritative source under crates/openshell-driver-mxc/examples.

The shared failure was chained configuration drift, not a permissive policy default:

• copied/package-only demos retained the pre-v2 gateway shape after their repository source was removed;
• both selected isolation_session while also supplying filesystem policy, which that backend cannot enforce;
• workload fields had moved from gateway-global config to sandbox creation;
• fixed machine paths and a fixed gateway port made the runners non-portable.

This change makes both demos use schema v2 and the fail-closed process_container backend, passes workload settings at sandbox creation, and keeps the checked-in templates portable.

Base: origin/windows at fb2980e077288b61ef03a2e6187e162d158526aa.

Related Issue

• NVIDIA NVBug 6782874 — [OpenShell MXC] shipped Hello World and Cloud inference defaults cannot create a sandbox.
• Internal bug only; no public GitHub issue was created or modified.

Changes

• Restore the authoritative local Ollama and cloud T1 assets to the MXC crate so packaging cannot silently diverge again.
• Upgrade both gateway templates to schema v2 and process_container.
• Resolve gateway, CLI, and wxc-exec portably; use an ephemeral gateway port and per-run temporary share.
• Pass command/cwd through --driver-config-json; pass NV_API_KEY through --env-from without putting it in argv, config, or result artifacts.
• Render narrow per-run filesystem/network policy and preserve enforced cloud CONNECT proxying.
• Add cross-platform asset/schema/policy drift tests plus a Windows fixture-driven sandbox lifecycle test for both exact example configs.
• Package-list validation confirms all seven demo assets are included in the crate package.

Before / After Evidence

Environment: Yukon Windows ARM64, Windows build 28000, Rust 1.95, native ARM64 wxc-exec; all evidence used binaries built from the base SHA above.

Before, with the unmodified shipped defaults and only the documented -WxcExecPath override:

• Local demo, against a controlled Ollama-compatible loopback prerequisite: exit 1 in about 3.4s, before CreateSandbox: gateway config schema version is required; add [openshell] and version = 2.
• Cloud demo, with a deliberately invalid redacted key: exit 1 in about 5s, before CreateSandbox, with the same schema-v2 diagnostic.
• The initial regression guard failed with exit 101 because examples/mxc-ollama.toml was absent.
• The NVBug's captured next failure after schema parsing is the common backend mismatch: filesystem policy is unsupported by isolation_session.

After, using the same base-built binaries and the repaired shipped runners:

• Local demo: exit 0; CreateSandbox succeeded with backend=process_container, the in-sandbox request returned a completion, and summary.txt reported verdict=PASS. Gateway start through sandbox deletion took 1.37s.
• Cloud demo with the same deliberately invalid key: CreateSandbox succeeded with backend=process_container, governed TLS egress reached the active NVIDIA endpoint, and the script then failed usefully with the expected redacted HTTP 403 Authorization failed. Sandbox creation-to-delete took 0.87s.
• Both checked-in TOMLs pass openshell-gateway config preflight.
• The synthetic key is absent from all retained text artifacts.

Testing

Passed:

• cargo fmt --all -- --check
• uv run --no-project python scripts/update_license_headers.py --check
• cargo test --release --target aarch64-pc-windows-msvc -p openshell-driver-mxc --test demo_examples — 5 passed
• cargo test --release --target aarch64-pc-windows-msvc -p openshell-driver-mxc --lib — 94 passed
• focused Clippy for all MXC targets with only the three pre-existing base-tip lints allowed — passed
• cargo package --list -p openshell-driver-mxc --allow-dirty — all demo assets present
• PowerShell 5.1 parser validation for both runners
• real ARM64 local demo lifecycle and cloud sandbox/TLS-egress lifecycle described above

Known base/environment limitations observed:

• Strict Clippy also reports three pre-existing warnings in unchanged base lines (unused_self and two needless_update findings); the changed code is clean when those base findings are allowed.
• mise run pre-commit is blocked on Windows ARM64 by grpcio-tools 1.78.0 building under Python 3.14 with incompatible MSVC /std:c++17 and /std:c11; the relevant format, license, PowerShell, Clippy, and Rust tests were run directly.
• The real-MXC lane passed eight dry-run contract cases and the skip-safe isolation-session case, then the existing unrelated pc_https_egress_reads_injected_ca_bundle test hung in its raw wxc-exec proxy probe and was terminated after more than five minutes.
• The repository-wide unsupported-driver lane was started but not completed because concurrent Windows qualification exhausted local disk; no changed code is in that gateway-only surface.

Security Impact

The repair preserves fail-closed behavior. Each sandbox receives only its unique temporary share and one requested network endpoint; no broad AppContainer network capability is granted. Cloud traffic remains behind the enforcing CONNECT proxy. The cloud credential is forwarded by name at sandbox creation, never written to a template/result file, and never printed.

For local Ollama only, curl bypasses proxy variables for the explicitly requested loopback host because the proxy rejects loopback SSRF. MXC still restricts direct traffic to host loopback, but the existing driver limitation means this is host-loopback scope rather than per-service isolation; the README calls this out.

Residual Risk / Platform Limits

• Native runtime proof is ARM64 only; no native x64 host was available.
• MXC runtime tests are Windows-only. The schema/policy/package drift tests remain cross-platform so Linux/macOS builds continue to validate the examples without attempting MXC execution.
• A valid NVIDIA credential was not available, so cloud proof stops at successful sandbox creation, governed TLS egress, and the expected endpoint-authentication 403 rather than an HTTP 200 completion.
• Local proof used an Ollama-compatible controlled endpoint because Ollama itself was not installed on this host.

Checklist

• Based on the latest origin/windows tip
• Focused source fix with no generated/copied example noise
• Tests cover both shipped demos and negative drift
• No machine paths, ports, credentials, or artifact locations are hard-coded
• Security boundaries and credential redaction reviewed
• Commit is DCO-signed

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[prekshivyas]

Qualification before/after summary

NVBug: 6782874 — shipped Windows inference demos cannot create a sandbox

Before: Both shipped demos failed before CreateSandbox because their templates lacked schema v2; the next common failure was filesystem policy combined with unsupported isolation_session. The authoritative source asset was also missing.

After: Both demos use schema v2 and process_container. The local controlled Ollama-compatible flow created a sandbox and completed with verdict=PASS. The cloud flow created a sandbox, exercised governed TLS egress, reached NVIDIA, and produced the expected redacted HTTP 403 with an intentionally invalid credential. Both configs pass preflight; 5 demo tests and 94 MXC library tests passed, with focused Clippy/format/license/package checks passing.

Qualification status: Local demo scenario PASS; cloud transport/sandbox scenario PASS, full authenticated cloud completion pending. No valid NVIDIA credential was available, so an HTTP 200 inference result is not claimed. The unrelated raw proxy probe hang and disk-exhausted repository-wide lane remain outside this focused proof; hosted CI still needs /ok to test.