Publish 0.6.0-alpha as the new stable schema (strict surface)

[MGudgin]

📖 Description

Promotes dev content into schemas/stable/mxc-config.schema.0.6.0-alpha.json, mints 0.7.0-dev as the next dev iteration, and adopts a strict policy: stable schemas document only the non-experimental surface. Experimental backends, the experimental.* block, and state-aware sandbox lifecycle live in 0.7.0-dev only.

Runtime is unchanged. The parser still accepts experimental backends and the experimental.* block when paired with --experimental, regardless of which schema validated the config. Schema choice affects editor validation, not runtime behavior.

Schema:

• 0.6.0-alpha (NEW): processContainer, fallback.allowDaclMutation, network.allowLocalNetwork; deny-by-default defaultPolicy; containment enum ['process', 'processcontainer', 'lxc', 'bubblewrap'], default 'process'. process is the cross-platform abstract intent — resolves to processcontainer on Windows, bubblewrap on Linux, and (in the future, when seatbelt graduates) seatbelt on macOS. No experimental.* block.
• 0.5.0-alpha-strict.json (NEW): strict sibling of 0.5.0-alpha. Same wire version, containment ['appcontainer', 'lxc']. The original 0.5.0-alpha.json is preserved unmodified per the immutability rule.
• Dev schema renamed 0.6.0-dev → 0.7.0-dev.

Wire version (Step A of the dev-mint pattern from #265):

• Parser SUPPORTED_VERSION <=0.6 → <=0.7; SDK SUPPORTED_VERSION 0.6.0-alpha → 0.7.0-alpha.
• Dev schema and 13 macOS examples declare 0.7.0-alpha as the wire version.

Bubblewrap reclassification:

• Bubblewrap is no longer experimental as of [Bubblewrap] Make Bubblewrap the default Linux backend #368 (runtime gate removed; it's the default Linux backend). This PR drops it from the SDK ExperimentalBackends list, adds it to the strict 0.6.0-alpha enum, removes it from the dev schema's "experimental backends" note, and updates the README backend table to show it as the Linux default.

SDK:

• windows_sandbox and isolation_session added to ExperimentalBackends so the validator errors in-process.
• bubblewrap removed from ExperimentalBackends ([Bubblewrap] Make Bubblewrap the default Linux backend #368 already removed the runtime gate).
• README backend table: Linux default = bubblewrap, other = lxc. macOS x64 / ARM64 → ARM64. Windows narrowed to 24H2+ (verified on 25H2). Hyperlight is a build-flavor footnote.

Docs:

• authoring-a-new-feature.md and versioning.md document the strict policy.

🔗 References

• Seatbelt: Honor allowLocalNetwork to permit inbound binds #422 (allowLocalNetwork), Seatbelt: Add extraMachLookups escape hatch for additional Mach services #437 (extraMachLookups), #256 / Set schema network default to deny by default #427 (deny-by-default defaultPolicy)
• [Bubblewrap] Make Bubblewrap the default Linux backend #368 (bubblewrap default + de-experimentalisation)
• Builds on Align 0.6.0-dev schema with what the parser accepts today #451 (dev-schema/parser alignment)
• Step A precedent: [IsolationSession] Add state-aware lifecycle support to TypeScript SDK #265 (6fcd9c0)

🔍 Validation

• 164/164 SDK unit tests pass
• 11/11 parser schema_version tests pass
• Runtime behavior unchanged (verified against the wire-version range and the --experimental runtime gate)

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)

📋 Issue Type

• Feature

Follow-ups (out of scope for this PR)

• docs/schema.md content sync (#285)
• The new strict 0.6.0-alpha could pick up a stable-subset of the allOf single-backend-section constraint added to the dev schema in Enforce single containment backend section per config #426; left for a follow-up

🤖 Generated with Claude Code

[MGudgin]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Promotes the 0.6.0 schema content into a new shipped stable schema (0.6.0-alpha), updates the SDK to treat additional backends as experimental for validation, and refreshes documentation to reflect the new stable/dev schema split and the “stable schemas may include experimental shapes” policy.

Changes:

• Add new stable schema file schemas/stable/mxc-config.schema.0.6.0-alpha.json reflecting the current accepted config shape.
• Update SDK experimental backend validation list to include windows_sandbox and isolation_session.
• Update SDK/docs guidance to list 0.6.0-alpha as the current stable schema and clarify the stable-vs-dev schema model.

Show a summary per file

File	Description
sdk/src/types.ts	Expands ExperimentalBackends so the SDK validator gates windows_sandbox and isolation_session behind experimental mode.
sdk/README.md	Updates schema/version guidance and backend tables to include 0.6.0-alpha and new/experimental backends.
schemas/stable/mxc-config.schema.0.6.0-alpha.json	Introduces the new stable 0.6.0-alpha JSON schema, including experimental sections for editor validation.
schemas/dev/mxc-config.schema.0.6.0-dev.json	Tweaks containment description to correctly label microvm as experimental.
docs/versioning.md	Documents 0.6.0-alpha as current stable and clarifies the policy that stable schemas may include experimental shapes.
docs/authoring-a-new-feature.md	Updates contributor guidance around schema immutability and promotion, aligned with the clarified versioning model.

Copilot's findings

• Files reviewed: 6/6 changed files
• Comments generated: 5

[MGudgin]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[SohamDas2021]

Sorry, one more thing I noticed, there are bubblewrap test configs in tests/configs/ that are using "version": "0.6.0-alpha" and containment: "bubblewrap". We will have to switch these to the dev json- 0.7.0?

Same comment for tests/configs/linux_process_default.json and tests/configs/linux_process_abstract.json

[bbonaby]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[MGudgin]

Sorry, one more thing I noticed, there are bubblewrap test configs in tests/configs/ that are using "version": "0.6.0-alpha" and containment: "bubblewrap". We will have to switch these to the dev json- 0.7.0?

Same comment for tests/configs/linux_process_default.json and tests/configs/linux_process_abstract.json

See the latest, bubblewrap is now in 0.6.0-alpha, so configs are OK.

[MGudgin]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

Comments addressed. Most recent changes reviewed by other team members.