Move tests, examples, playground under a single tests folder

.azure-pipelines/1ES.Build.yml

@@ -27,7 +27,7 @@ trigger:
   paths:
     exclude:
     - 'docs/**'
-    - 'examples/**'
+    - 'tests/examples/**'
     - '.github/ISSUE_TEMPLATE/**'
     - '.github/PULL_REQUEST_TEMPLATE.md'
     - '.github/copilot-instructions.md'
@@ -50,7 +50,7 @@ pr:
   paths:
     exclude:
     - 'docs/**'
-    - 'examples/**'
+    - 'tests/examples/**'
     - '.github/ISSUE_TEMPLATE/**'
     - '.github/PULL_REQUEST_TEMPLATE.md'
     - '.github/copilot-instructions.md'

.azure-pipelines/templates/Fuzz.Build.Job.yml

@@ -87,7 +87,7 @@ jobs:
     # Seeds are not shipped in the drop in v3 — they must live in a OneFuzz
     # storage container referenced via `OneFuzzJobs[].SeedCorpusContainer`.
     # TODO: provision containers (`onefuzz containers create mxc-seeds-<target>`),
-    # upload `test_configs/*.json` (and `src/fuzz/corpus/base64_decode/*`),
+    # upload `tests/configs/*.json` (and `src/fuzz/corpus/base64_decode/*`),
     # then add `SeedCorpusContainer` to each entry in OneFuzzConfig.json.
     - powershell: |
         $asanDir = (Get-ChildItem 'C:\Program Files\Microsoft Visual Studio' -Recurse -Filter 'clang_rt.asan_dynamic-x86_64.dll' -ErrorAction SilentlyContinue | Where-Object { $_.FullName -match 'HostX64\\x64\\clang_rt' } | Select-Object -First 1).Directory.FullName

.azure-pipelines/templates/Rust.Build.Job.yml

@@ -126,8 +126,8 @@ jobs:
           # `tier2_bfs` Cargo feature gates Tier 2 (BFS) and must NOT be
           # compiled into production binaries on Win 11 25H2 (the embedded
           # `bfscfg.exe` invocation risks an OS hang). See
-          # `.github/workflows/build.yml`, `test_scripts/T3-Workloads.ps1`,
-          # and `test_scripts/Win25H2Safe-Tests.ps1` for the safety model.
+          # `.github/workflows/build.yml`, `tests/scripts/T3-Workloads.ps1`,
+          # and `tests/scripts/Win25H2Safe-Tests.ps1` for the safety model.
           # Enumerate the production feature set explicitly so the shipped
           # binary still carries every runtime backend except `tier2_bfs`.
           # Schema reference: https://eng.ms/docs/coreai/devdiv/one-engineering-system-1es/1es-docs/1es-pipeline-templates/features/buildworkflows/rust-virtual-task

.github/copilot-instructions.md

@@ -84,12 +84,12 @@ npm run test:integration
 node --test dist/cli.test.js
 
 # Local PowerShell helpers — run from repo root, require built binaries
-test_scripts\run_test_configs.ps1            # All test configs via wxc_test_driver
-test_scripts\run_basicac_test.ps1            # Single AppContainer test
-test_scripts\run_isolation_session_tests.ps1                # IsolationSession one-shot E2E (requires host with the OS-side IsoSessionOps service)
-test_scripts\run_isolation_session_state_aware_tests.ps1    # IsolationSession state-aware lifecycle E2E (multi-invocation provision/start/exec/stop/deprovision, same host requirements)
-test_scripts\run_lxc_all_tests.sh            # All LXC tests (Linux)
-test_scripts\run_bwrap_all_tests.sh          # All Bubblewrap tests (Linux, requires bwrap)
+tests\scripts\run_test_configs.ps1            # All test configs via wxc_test_driver
+tests\scripts\run_basicac_test.ps1            # Single AppContainer test
+tests\scripts\run_isolation_session_tests.ps1                # IsolationSession one-shot E2E (requires host with the OS-side IsoSessionOps service)
+tests\scripts\run_isolation_session_state_aware_tests.ps1    # IsolationSession state-aware lifecycle E2E (multi-invocation provision/start/exec/stop/deprovision, same host requirements)
+tests\scripts\run_lxc_all_tests.sh            # All LXC tests (Linux)
+tests\scripts\run_bwrap_all_tests.sh          # All Bubblewrap tests (Linux, requires bwrap)
 
 # E2E test crate — Rust executor integration tests (from src/)
 cargo test -p wxc_e2e_tests                 # Invokes MXC binaries directly
@@ -142,7 +142,7 @@ Core references:
 - `docs/schema.md` — full JSON configuration schema reference
 - `docs/versioning.md` — schema versioning design, experimental feature lifecycle, and promotion process
 - `docs/authoring-a-new-feature.md` — step-by-step guide for adding experimental features (which files to touch, in what order)
-- `docs/examples.md` — annotated configuration examples (see also `examples/` and `test_configs/`)
+- `docs/examples.md` — annotated configuration examples (see also `tests/examples/` and `tests/configs/`)
 - `docs/diagnostics.md` — diagnostic logging knobs (env vars, log file format)
 - `docs/host-prep.md` — `wxc-host-prep.exe` host setup binary (`prepare-system-drive` / `unprepare-system-drive` for the AppContainer ACEs on the system-drive root, plus `prepare-null-device` / `verify-null-device` / `dump-null-device` for the `\Device\Null` security descriptor that AppContainer-based backends require). Owns elevation via embedded `requireAdministrator` manifest — `wxc-exec.exe` no longer self-elevates.
 - `docs/sandbox-policy/v1/policy.md` — sandbox policy v1 specification

CONTRIBUTING.md

@@ -107,9 +107,7 @@ Once you've discussed your proposed change with a team member and agreed on an a
 src/                Rust workspace (wxc-exec, lxc-exec, mxc-exec-mac, wxc_common, etc.)
 sdk/                TypeScript SDK (@microsoft/mxc-sdk)
 docs/               Schema and configuration documentation
-examples/           Example JSON configurations
-test_configs/       Test JSON configurations
-test_scripts/       Test scripts that exercise the built binaries
+tests/              Test collateral (examples, configs, scripts)
 schemas/            JSON schemas (stable + dev)
 .azure-pipelines/   1ES Pipeline Templates configuration
 ```
@@ -191,7 +189,7 @@ cargo test -p wxc_e2e_tests                 # Invokes MXC binaries directly
 cargo test -p wxc_e2e_tests -- --ignored    # Include stress tests
 ```
 
-PowerShell and shell helper scripts that drive the executor end-to-end live under `test_scripts/` and require a local build. See the [README](./README.md) and the [SDK README](./sdk/README.md) for more.
+PowerShell and shell helper scripts that drive the executor end-to-end live under `tests/scripts/` and require a local build. See the [README](./README.md) and the [SDK README](./sdk/README.md) for more.
 
 ### Code review
 

README.md

@@ -35,9 +35,7 @@ A copy of Python 3.x is needed for executing test scripts.
 src/            Rust workspace (wxc-exec native binary + wxc_common library)
 sdk/            TypeScript SDK (@microsoft/mxc-sdk npm package)
 docs/           Schema and configuration documentation
-examples/       Example configurations
-test_configs/   Test JSON configurations
-test_scripts/   Test scripts for exercising MXC
+tests/          Test collateral (configs, scripts, examples)
 ```
 
 ### Building WXC
@@ -181,7 +179,7 @@ This will:
 
 ### LXC Example Configurations
 
-See `examples/11_lxc_hello_world.json`, `examples/12_lxc_filesystem_access.json`, and `examples/13_lxc_network_restricted.json` for LXC-specific examples.
+See `tests/examples/11_lxc_hello_world.json`, `tests/examples/12_lxc_filesystem_access.json`, and `tests/examples/13_lxc_network_restricted.json` for LXC-specific examples.
 
 ### Running on Linux
 
@@ -220,7 +218,7 @@ This will:
 
 ### macOS Example Configurations
 
-See `examples/15_mac_hello_world.json` and `examples/21_mac_python_info.json` for macOS-specific examples.
+See `tests/examples/15_mac_hello_world.json` and `tests/examples/21_mac_python_info.json` for macOS-specific examples.
 
 ### Running on macOS
 

docs/authoring-a-new-feature.md

@@ -107,7 +107,7 @@ Adding a feature may touch these files:
 | `src/wxc_common/src/models.rs` | Add `GpuIsolationConfig` struct, add field to `ExperimentalConfig` |
 | `src/wxc_common/src/config_parser.rs` | Add `gpuIsolation` field to `RawExperimental` |
 | Runner (`appcontainer.rs` or `lxc_runner.rs`) | Feature logic, guarded behind `experimental_enabled` |
-| `test_configs/` | Test config exercising your feature |
+| `tests/configs/` | Test config exercising your feature |
 
 ## Step 1: Update the schema
 
@@ -333,10 +333,10 @@ Run it with and without the flag to verify:
 
 ```bash
 # With flag — experimental feature is active
-wxc-exec.exe test_configs/experimental_gpu_isolation.json --experimental --debug
+wxc-exec.exe tests/configs/experimental_gpu_isolation.json --experimental --debug
 
 # Without flag — experimental section silently ignored, normal execution
-wxc-exec.exe test_configs/experimental_gpu_isolation.json --debug
+wxc-exec.exe tests/configs/experimental_gpu_isolation.json --debug
 ```
 
 Verify three things:

docs/bwrap-support/bubblewrap-backend-plan.md

@@ -295,9 +295,9 @@ the LXC runner: apply rules before execution, remove rules after.
 ### 9. Test Additions
 
 - Unit tests in `bwrap_common/src/bwrap_runner.rs` (command-line generation, policy mapping)
-- Test config files in `test_configs/` (e.g., `bubblewrap_basic.json`)
+- Test config files in `tests/configs/` (e.g., `bubblewrap_basic.json`)
 - E2E test in `wxc_e2e_tests` if applicable
-- Script in `test_scripts/run_bwrap_tests.sh`
+- Script in `tests/scripts/run_bwrap_tests.sh`
 
 ### 10. Documentation
 
@@ -354,5 +354,5 @@ policy gap is a design decision, not an implementation challenge.
 - `.github/copilot-instructions.md` (modify — add to backend table)
 
 ### Tests (new)
-- `test_configs/bubblewrap_basic.json`
-- `test_scripts/run_bwrap_tests.sh`
+- `tests/configs/bubblewrap_basic.json`
+- `tests/scripts/run_bwrap_tests.sh`

docs/bwrap-support/bubblewrap-backend.md

@@ -273,13 +273,13 @@ resolution.
 
 ```bash
 # Single basic test
-test_scripts/run_bwrap_basic_test.sh
+tests/scripts/run_bwrap_basic_test.sh
 
 # All Bubblewrap tests
-test_scripts/run_bwrap_all_tests.sh
+tests/scripts/run_bwrap_all_tests.sh
 ```
 
-Test configs are in `test_configs/bubblewrap_*.json`.
+Test configs are in `tests/configs/bubblewrap_*.json`.
 
 ## Limitations
 

docs/fuzzing.md

@@ -17,7 +17,7 @@ exercising the attacker-influenced config surface consumed by `wxc-exec` and
 | `validator`      | parse + `validate_common` on a one-shot request          |
 
 Seed corpora for `config_parser` and `validator` targets come directly from
-`test_configs/*.json`. The `base64_decode` target uses pre-encoded seeds in
+`tests/configs/*.json`. The `base64_decode` target uses pre-encoded seeds in
 `src/fuzz/corpus/base64_decode/`. OneFuzz dedups by coverage server-side and
 grows the corpus across daily runs, so we keep the in-repo seeds small.
 
@@ -44,9 +44,9 @@ $asanDir = (Get-ChildItem 'C:\Program Files\Microsoft Visual Studio' -Recurse `
     | Where-Object FullName -Match 'HostX64\\x64\\clang_rt' | Select-Object -First 1).Directory.FullName
 $env:PATH = "$asanDir;$env:PATH"
 
-# Run a target for 30 seconds (uses test_configs/ as the seed corpus)
+# Run a target for 30 seconds (uses tests/configs/ as the seed corpus)
 cd src\fuzz
-cargo +nightly fuzz run config_parser ..\..\test_configs -- -max_total_time=30
+cargo +nightly fuzz run config_parser ..\..\tests\configs -- -max_total_time=30
 ```
 
 Discovered crashes are written to `artifacts/<target>/` (relative to `src/fuzz/`)

docs/hyperlight-integration-plan.md

@@ -117,7 +117,7 @@ mxc/src/wxc_common/
 mxc/src/wxc/
 └── src/main.rs                # + ContainmentBackend::Hyperlight dispatch arm
 
-mxc/test_configs/
+mxc/tests/configs/
 ├── hyperlight_hello.json      # NEW — hello from Python
 └── hyperlight_pandas.json     # NEW — exercises pre-imported numpy/pandas
 

docs/isolation-session/initial-bringup-plan.md

@@ -262,7 +262,7 @@ CI, since CI machines do not have a Windows build with the IsolationSession feat
 
 **Integration tests (require a Windows host with the IsolationSession feature enabled):**
 
-Two end-to-end configs live under `test_configs/`:
+Two end-to-end configs live under `tests/configs/`:
 
 - `isolation_session_hello.json` — happy path. Prints `USERNAME`,
   `MYVAR`, `CWD`, and `whoami` from inside the session. Validates the
@@ -272,7 +272,7 @@ Two end-to-end configs live under `test_configs/`:
 - `isolation_session_exit42.json` — runs `exit 42` and validates that
   exit code 42 propagates to `ScriptResponse.exit_code`.
 
-A test runner at `test_scripts/run_isolation_session_tests.ps1` invokes
+A test runner at `tests/scripts/run_isolation_session_tests.ps1` invokes
 both configs via `wxc-exec.exe --experimental`, validates exit codes and
 expected output substrings, and reports a pass/fail summary. Pattern
 follows the existing per-backend integration scripts (e.g.

docs/isolation-session/state-aware-typescript-initial-plan.md

@@ -182,7 +182,7 @@ describe('IsolationSession state-aware lifecycle E2E', { skip: skipReason }, ()
 ```
 
 The Entra path can't be exercised in CI without WAM credentials; the Rust-side
-[state-aware test runner](../../test_scripts/run_isolation_session_state_aware_tests.ps1)
+[state-aware test runner](../../tests/scripts/run_isolation_session_state_aware_tests.ps1)
 covers the validation rejections.
 
 ## References

docs/macos-support/seatbelt-backend.md

@@ -122,7 +122,7 @@ After setup, verify the build works end-to-end:
 ./build-mac.sh --rust-only
 
 # Run a quick smoke test
-./src/target/aarch64-apple-darwin/release/mxc-exec-mac --debug examples/15_mac_hello_world.json
+./src/target/aarch64-apple-darwin/release/mxc-exec-mac --debug tests/examples/15_mac_hello_world.json
 ```
 
 You should see sandbox profile generation output followed by

docs/nanvix-microvm/nanvix-integration-plan.md

@@ -129,7 +129,7 @@ mxc/src/
 mxc/docs/nanvix-microvm/
 └── nanvix-integration-plan.md        # NEW — this document
 
-mxc/test_configs/
+mxc/tests/configs/
 └── microvm_hello.json                # NEW — example microvm config
 ```
 

docs/schema.md

@@ -184,4 +184,4 @@ changes require a major bump.
 | 0.3.0-alpha | Initial versioned schema. Added `process`, `lifecycle`, `containerId`, `wslc` alias. Dual-read fallbacks for legacy fields. |
 | 0.4.0-alpha | Removed legacy fields (`script`, `workingDirectory`, `processContainer.name`, etc.). `process` section now required. |
 
-See the `examples/` directory for complete configuration examples.
+See the `tests/examples/` directory for complete configuration examples.

docs/windows-sandbox/windows-sandbox-reference.md

@@ -161,7 +161,7 @@ Get-Process | Where-Object { $_.ProcessName -match "vmmem|vmwp|sandbox" }
 # Run daemon manually (visible logs)
 src\target\release\wxc-windows-sandbox-daemon.exe wxc-windows-sandbox 300000
 # In another terminal:
-src\target\release\wxc-exec.exe --debug test_configs\basic_windows_sandbox.json
+src\target\release\wxc-exec.exe --debug tests\configs\basic_windows_sandbox.json
 
 # Clean slate
 Get-Process -Name "wxc-windows-sandbox-daemon","WindowsSandbox*" -ErrorAction SilentlyContinue |
@@ -193,7 +193,7 @@ Manual-only — requires Hyper-V + Windows Sandbox feature (cannot run in GitHub
 ### Running
 
 ```powershell
-cd test_scripts
+cd tests\scripts
 .\run_windows_sandbox_tests.ps1 -Release
 ```
 

docs/wsl/wsl-container-getting-started.md

@@ -246,10 +246,10 @@ the container.
 
 ## Example Configs
 
-- [`examples/wslc_hello_world.json`](../../examples/wslc_hello_world.json) — Hello world with Alpine
-- [`test_configs/wslc_network_isolated.json`](../../test_configs/wslc_network_isolated.json) — Network isolation
-- [`test_configs/wslc_custom_registry_ghcr.json`](../../test_configs/wslc_custom_registry_ghcr.json) — Pull from GitHub Container Registry
-- [`test_configs/wslc_custom_registry_quay.json`](../../test_configs/wslc_custom_registry_quay.json) — Pull from Quay.io
-- [`test_configs/wslc_tar_import_rootfs.json`](../../test_configs/wslc_tar_import_rootfs.json) — Import rootfs tar
-- [`test_configs/wslc_tar_import_docker_save.json`](../../test_configs/wslc_tar_import_docker_save.json) — Import Docker save archive
-- [`test_configs/wslc_timeout.json`](../../test_configs/wslc_timeout.json) — Execution timeout enforcement
+- [`tests/examples/wslc_hello_world.json`](../../tests/examples/wslc_hello_world.json) — Hello world with Alpine
+- [`tests/configs/wslc_network_isolated.json`](../../tests/configs/wslc_network_isolated.json) — Network isolation
+- [`tests/configs/wslc_custom_registry_ghcr.json`](../../tests/configs/wslc_custom_registry_ghcr.json) — Pull from GitHub Container Registry
+- [`tests/configs/wslc_custom_registry_quay.json`](../../tests/configs/wslc_custom_registry_quay.json) — Pull from Quay.io
+- [`tests/configs/wslc_tar_import_rootfs.json`](../../tests/configs/wslc_tar_import_rootfs.json) — Import rootfs tar
+- [`tests/configs/wslc_tar_import_docker_save.json`](../../tests/configs/wslc_tar_import_docker_save.json) — Import Docker save archive
+- [`tests/configs/wslc_timeout.json`](../../tests/configs/wslc_timeout.json) — Execution timeout enforcement

scripts/setup-wslc.ps1

@@ -22,7 +22,7 @@
     One or more image references to pre-pull. Defaults to a small
     starter set (alpine:latest, python:3.12-alpine) suitable for a quick
     smoke test. To populate the cache for the full WSLC test suite, run
-    test_scripts\run_wslc_all_tests.ps1, which invokes this script with
+    tests\scripts\run_wslc_all_tests.ps1, which invokes this script with
     the complete image list.
 
 .PARAMETER WxcExecPath

src/fuzz/README.md

@@ -24,9 +24,9 @@ cargo +nightly install cargo-fuzz
 $asanDir = 'C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\<ver>\bin\HostX64\x64'
 $env:PATH = "$asanDir;$env:PATH"
 
-# Run a target for 30 seconds (uses test_configs/ as the seed corpus)
+# Run a target for 30 seconds (uses tests/configs/ as the seed corpus)
 cd src\fuzz
-cargo +nightly fuzz run config_parser ..\..\test_configs -- -max_total_time=30
+cargo +nightly fuzz run config_parser ..\..\tests\configs -- -max_total_time=30
 ```
 
 Findings are written to `artifacts/<target>/`. Reproduce a finding with:

src/wxc_e2e_tests/src/lib.rs

@@ -28,14 +28,14 @@ pub fn repo_root() -> PathBuf {
         .to_path_buf()
 }
 
-/// Return the repository `test_configs/` directory.
+/// Return the repository `tests/configs/` directory.
 pub fn test_configs_dir() -> PathBuf {
-    repo_root().join("test_configs")
+    repo_root().join("tests").join("configs")
 }
 
-/// Return the repository `examples/` directory.
+/// Return the repository `tests/examples/` directory.
 pub fn examples_dir() -> PathBuf {
-    repo_root().join("examples")
+    repo_root().join("tests").join("examples")
 }
 
 fn src_dir() -> PathBuf {

test_scripts/README.md → tests/scripts/README.md

@@ -50,7 +50,7 @@ and the operator observes the output to confirm healthy behavior.
 Invoke from `cmd.exe`:
 
 ```cmd
-powershell -ExecutionPolicy Bypass -File test_scripts\run_isolation_session_resize_smoke.ps1
+powershell -ExecutionPolicy Bypass -File tests\scripts\run_isolation_session_resize_smoke.ps1
 ```
 
 ### Deployment helpers
@@ -63,7 +63,7 @@ itself and takes a `-ComputerName` / `-VMName` plus `-Credential`.
 | Script | Copies | Transport |
 |--------|--------|-----------|
 | `push_exes_to_vm.ps1` | Native Rust binaries (Debug + Release) | TShell (active `Open-Device` session) |
-| `push_batch_and_config_files_to_vm.ps1` | `test_configs\`, `examples\`, runner batch files, helper scripts | TShell (active `Open-Device` session) |
+| `push_batch_and_config_files_to_vm.ps1` | `tests\configs\`, `examples\`, runner batch files, helper scripts | TShell (active `Open-Device` session) |
 | `push_sdk_integration_tests_to_vm.ps1` | SDK integration test artifacts (`sdk\bin\x64`, compiled tests, `node_modules`, `package.json`, `run-tests.js`) | PowerShell Remoting (`-ComputerName`/`-VMName` + `-Credential`) |
 
 CI currently runs the MicroVM Rust E2E suite when WHP is available. Other
@@ -113,7 +113,7 @@ Run them explicitly on capable machines with
 | `test_filesystem_bfs_readonly` | Requires velocity key 61714527 (BFS deadlock fix) |
 | `test_filesystem_bfs_spaces` | Requires velocity key 61714527 (BFS deadlock fix) |
 | `test_pwsh_setlocation` | Requires velocity key 61714527 (BFS deadlock fix) |
-| `test_test_configs` | Requires velocity key 61714527 (BFS deadlock fix) |
+| `test_tests\configs` | Requires velocity key 61714527 (BFS deadlock fix) |
 | `test_examples` | Requires velocity key 61714527 (BFS deadlock fix) |
 | `test_appcontainer_proxy` | Requires velocity key 61714527 (BFS deadlock fix) and elevation |
 | `test_on_repeat` | Stress test (loops BFS tests) |