Expose ProcessContainer config in Rust SDK

[Branden Bonaby (bbonaby)]

📖 Description

Superseded by a more modular v3 design.

🔗 References

Parent: #887.

🔍 Validation

• Rust SDK tests and Clippy.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

• Bug fix
• Feature
• Task

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Exposes explicit Windows ProcessContainer configuration through the Rust SDK.

Changes:

• Adds ProcessContainer settings for capabilities and least privilege.
• Maps settings through shared wire validation.
• Re-exports the new public SDK type and adds tests.

Show a summary per file

File	Description
src/core/mxc-sdk/src/lib.rs	Exposes and references ProcessContainer.
src/core/mxc_engine/src/policy.rs	Implements configuration mapping and tests.
src/core/mxc_engine/src/lib.rs	Re-exports the configuration type.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (1)

src/core/mxc_engine/src/process_container_config.rs:15

• The public config still cannot represent all ProcessContainer-specific settings: ui is part of both stable contracts (for example schemas/stable/mxc-config.schema.0.7.0-alpha.json:231), but it is omitted here and the factory always substitutes ProcessContainerUi::default(); the 0.8 learningMode setting is also absent. Rust SDK callers therefore cannot configure those supported backend fields, leaving the linked ProcessContainer-config task only partially implemented. Add version-aware public UI/learning-mode fields and serialize the caller's values while retaining the current defaults.

pub struct ProcessContainer {
    /// Enforce least-privilege mode.
    pub least_privilege: bool,
    /// Additional AppContainer capabilities, such as `registryRead`.
    pub capabilities: Vec<String>,

• Files reviewed: 5/6 changed files
• Comments generated: 1
• Review effort level: Balanced

[Branden Bonaby (bbonaby)]

Closing in favor of a more modular v3 implementation.