You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
… schema
Route provision, start, exec, stop, and deprovision through explicit CLI and SDK operations, with sandbox identity supplied separately from operation-neutral request JSON.
Moves state-aware lifecycle operations and sandbox IDs out of JSON configuration and into SDK/CLI API parameters, making the 0.9 schema operation-neutral.
Changes:
Introduces operation-specific Rust, Node, .NET, CLI, engine, and FFI APIs.
Consolidates lifecycle schemas into one request contract and updates validation.
Migrates documentation, examples, tests, and fixtures to the new API.
The reason will be displayed to describe this comment to others. Learn more.
[AgentAssisted] Two more statements in this file are now inaccurate for the same reason: the bullet saying process on non-exec phases is "structurally rejected" (it is now a semantic check in the operation adapter), and the error-table row saying "fields excluded by an exact request root fail earlier as malformed_request" (there is one shared root now).
Provision filesystem and network also reach IsolationSession policy validation and surface policy_validation, not malformed_request.
This backend list omits wslc, even though the immediately preceding lifecycle example and provision settings document WSLc and the dispatcher supports it. Include wslc so the schema guide does not incorrectly tell API consumers that its lifecycle operations are unsupported.
"description": "Optional identifier for the calling application.\n\n**A packaged application must supply its Package Family Name in the form `PFN:<packageFamilyName>`** (for example `PFN:Contoso.App_8wekyb3d8bbwe`). An unpackaged application may pass any string. Carried inside the `sandboxId` so later lifecycle phases can recover it without the caller re-supplying it.",
* Optional identifier for the calling application.
*
* **A packaged application must supply its Package Family Name in the form `PFN:<packageFamilyName>`** (for example `PFN:Contoso.App_8wekyb3d8bbwe`). An unpackaged application may pass any string. Carried inside the `sandboxId` so later lifecycle phases can recover it without the caller re-supplying it.
The reason will be displayed to describe this comment to others. Learn more.
Copilot review overview
🔵 Needs a closer look
The rolling oracle is unintentionally narrowed, the Rust replacement API drops documented dry-run functionality, and lifecycle documentation remains inconsistent.
Replacement Rust API removes dry-run lifecycle support
src/core/mxc-sdk/src/sandbox_operations.rs:16
The replacement Rust API hardcodes dry_run to false for every lifecycle method, while the removed public run_state_aware_json supported dry-running all phases and the CLI/.NET surfaces still preserve that capability. Add explicit dry-run methods or an operation options parameter before retiring the old entry point so Rust callers do not lose validation-only execution.
Keep legacy routing fields in rolling wire artifacts
src/core/wxc_common/src/wire.rs:59
This changes the rolling wxc_common::wire artifact, not just the authoritative 0.9-alpha contract. docs/versioning.md:88-105 and docs/schema-codegen.md:36-47 define mxc-config.schema.0.9.0-dev.json and generated/wire.ts as rolling differential oracles generated from this model, but these new skips remove historical routing fields from those artifacts while the rolling parser still accepts them. Keep the rolling fields schema-visible (including the analogous sandboxId and legacy provision fields below) and remove them only from mxc_config_contract::dev, then regenerate both artifact sets.
Update documentation for the single-root contract
docs/schema.md:412
The canonical versioning documentation was not updated with this new single-root contract: docs/versioning.md:103-104 still says 0.9-alpha has eight one-shot/state-aware roots, and docs/schema-codegen.md:64-65 still documents dispatch by the JSON phase field. Update those references alongside this section; otherwise contributors will regenerate or extend the schema using the removed model.
Document WSLc as a supported state-aware lifecycle
docs/schema.md:442
This paragraph still lists only IsolationSession and Windows Sandbox, even though this PR keeps WSLc lifecycle provisioning and the engine explicitly treats WSLc as state-aware. Include wslc so the updated lifecycle documentation does not incorrectly tell users that its operations are unsupported.
Clarify provision is for rolling-parser compatibility only
docs/wsl/wslc-state-aware.md:58
This documentation still describes provision as schema/type-oracle input, but the new schemars(skip) removes that field and WslcProvisionPhase from both generated artifacts. Describe it as rolling-parser differential compatibility only so the subsystem guide matches the generated schema and TypeScript wire type.
`experimental.wslc`. Engine-side checked binding preserves an absent
config, a present empty config, and supplied `image`/`imageTarPath` values
without reparsing JSON. An omitted image remains `None` until the backend
chooses its default. The separate rolling `wire::WslcProvisionPhase` survives
only as schema/type-oracle input and test characterization, not the backend's
Include WSLc in the supported lifecycle list
docs/schema.md:442
WSLc also implements this lifecycle and is used by the commands immediately above, so this list is now incomplete. Include wslc; otherwise readers are told that a documented supported route has not opted in.
Mark provision schema as a legacy rolling-parser representation
src/core/wxc_common/src/wire.rs:673
The comment still presents this as the current experimental.wslc.provision schema surface, although the added schemars(skip) deliberately removes it from generated schemas and exact 0.9 now uses the flat fields. Mark it as the legacy rolling-parser representation to avoid documenting a rejected configuration shape.
This backend list omits wslc, even though the lifecycle API and the examples immediately above support the wslc: route. That makes the updated lifecycle documentation incorrectly tell users that only two backends are available.
The reason will be displayed to describe this comment to others. Learn more.
[AgentAssisted] development_network_migration keys its backend-specific guidance on the contract labels "IsolationSession provision" and "WSLC provision", but deserialize_development_root is now only ever called with "lifecycle operation" or "one-shot", so 6 of its 10 arms are unreachable.
The effect is a wrong instruction: an isolation_session config using network.allowedHosts now gets use network.egress.allow/deny CIDR rules, which IsolationSession cannot satisfy — it accepts only the all-allow posture, which is what the previous message named.
exact_development_network_migration_guidance_is_contract_aware was updated to assert the message no longer contains IsolationSession requires, so the test now pins this under a name claiming the opposite.
Suggest keying the lookup on the selected containment so the backend-specific arms stay reachable.
The reason will be displayed to describe this comment to others. Learn more.
[AgentAssisted] This function now owns all per-operation validation that the deleted per-phase contract roots enforced structurally, including IsolationSession provision. The #[cfg(test)] #[path = "state_aware_tests/mod.rs"] mod tests; declaration was removed here, but the 7 files (16 #[test]) remain on disk and are compiled by nothing; one_shot.rs keeps its equivalent declaration.
They also cannot just be re-linked — state_aware_tests/common.rs uses adapt_request and AdaptedWireRequest::StateAware, both removed in this change.
Either port them to operation_into_input(request, phase, sandbox_id) and restore the declaration, or delete them. As it stands the new validation has no unit coverage beside it.
The reason will be displayed to describe this comment to others. Learn more.
[AgentAssisted] This branch prints the diagnostic and envelope then exits without calling log_request_parse_rejection, so lifecycle parse rejections no longer emit the mxc.ConfigRejected audit record — log_state_aware_dispatch_error only writes a diagnostic line. One-shot parse failures still emit it via the Err arm below, and state-aware failures did too before this change, since both went through that path.
Suggest emitting the structured rejection before printing the envelope.
The reason will be displayed to describe this comment to others. Learn more.
[AgentAssisted] take_experimental runs only in provision_operation, so on exec/start/stop/deprovision common.experimental survives into StateAwareInput::new and is rejected as State-aware common input must not contain operation or one-shot field(s): experimental. That reads as though experimental is one-shot-only, but it is accepted on provision.
"experimental":{} was valid on all four of these operations before this change — the cases covering it were dropped from public_preflight_duplicate_experimental_fields_follow_the_selected_request_kind and from the policy_identity phase loop rather than re-asserted. If rejecting it is intended, reject_non_exec_policy is the natural place, with a message matching the others.
The reason will be displayed to describe this comment to others. Learn more.
[AgentAssisted] Sandbox IDs now cross the ABI as raw NUL-terminated strings and ToNullTerminatedUtf8 does not reject an embedded NUL, so CStr::from_ptr truncates at it — iso:<valid>\0suffix addresses iso:<valid>. Previously the ID travelled inside the JSON envelope, where \u0000 survived to reach validation and be rejected.
Low likelihood while IDs only originate from ProvisionSandbox, but the failure is a silent wrong target. Suggest rejecting embedded NUL in SandboxId or in the marshalling helper.
Add WSLc to supported state-aware operation capabilities
docs/schema.md:435
This section now documents WSLc lifecycle provisioning, but the capability list immediately below still says only IsolationSession and Windows Sandbox support state-aware operations. Include wslc so readers are not told that the documented operation is unsupported.
Update WSLc guide for new operation-neutral wire contract
docs/wsl/wslc-state-aware.md:54
This path update leaves the rest of the WSLc guide describing the removed wire contract. Lines 63–65 still say sandboxId is carried in JSON, lines 114–118 describe phase-specific request roots, and lines 180–195 instruct users to substitute IDs into post-provision fixture files that this PR deletes. Update those sections to use operation-neutral JSON plus --operation/--sandbox-id; line 57 should also stop calling the skipped WslcProvisionPhase a schema/type-oracle input.
State-aware-capable backends today: `isolation_session` and `windows_sandbox`
(both Windows-only, both still experimental). The dispatcher rejects
state-aware envelopes for backends that have not opted in.
lifecycle operations for backends that have not opted in.
This branch has not been deployed
No deployments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Copilot-InstructionsPR modifies Copilot instruction files (.github/copilot-instructions.md or .github/instructions/)
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
microsoft-github-policy-service
Bot
added
the
Copilot-Instructions
Rust mxc_sdk example
Closes #1218
Microsoft Reviewers: Open in CodeFlow