feat(engine): Rust host-backend detectors + available_backends() probe

src/backends/appcontainer/common/src/dispatcher.rs

@@ -658,7 +658,7 @@ mod tests {
     }
     #[test]
     fn dispatch_t1_no_denied_paths_no_dacl() {
-        let _g = ForceTierGuard::set("base-container");
+        let _g = ForceTierGuard::set_tier(IsolationTier::BaseContainer);
         let req = test_request(empty_policy());
         let d = dispatch_with_fallback(&req).expect("T1 dispatch should succeed");
         assert!(matches!(d.tier, IsolationTier::BaseContainer));
@@ -673,7 +673,7 @@ mod tests {
         // `deniedPaths`) to BaseContainer's native API; the dispatcher
         // attaches no `DaclManager` on the T1 path regardless of the
         // `deniedPaths` contents.
-        let _g = ForceTierGuard::set("base-container");
+        let _g = ForceTierGuard::set_tier(IsolationTier::BaseContainer);
         let (policy, _tmp) = policy_with_denied_temp();
         let req = test_request(policy);
         let d = dispatch_with_fallback(&req).expect("T1+deny dispatch should succeed");
@@ -685,7 +685,7 @@ mod tests {
     }
     #[test]
     fn dispatch_t2_with_denied_paths_has_dacl() {
-        let _g = ForceTierGuard::set("appcontainer-bfs");
+        let _g = ForceTierGuard::set_tier(IsolationTier::AppContainerBfs);
         let (policy, _tmp) = policy_with_denied_temp();
         let req = test_request(policy);
         let d = dispatch_with_fallback(&req).expect("T2+deny dispatch should succeed");
@@ -694,7 +694,7 @@ mod tests {
     }
     #[test]
     fn dispatch_t3_always_has_dacl() {
-        let _g = ForceTierGuard::set("appcontainer-dacl");
+        let _g = ForceTierGuard::set_tier(IsolationTier::AppContainerDacl);
         let (policy, _tmp) = policy_with_rw_temp();
         let req = test_request(policy);
         let d = dispatch_with_fallback(&req).expect("T3 dispatch should succeed");
@@ -770,7 +770,7 @@ mod tests {
 
     #[test]
     fn dispatch_fallback_disabled_errors() {
-        let _g = ForceTierGuard::set("appcontainer-dacl");
+        let _g = ForceTierGuard::set_tier(IsolationTier::AppContainerDacl);
         let (mut policy, _tmp) = policy_with_rw_temp();
         policy.fallback.allow_dacl_mutation = false;
         let req = test_request(policy);
@@ -939,7 +939,7 @@ mod tests {
 
     #[test]
     fn select_backend_t1_builds_base_container_no_dacl() {
-        let _g = ForceTierGuard::set("base-container");
+        let _g = ForceTierGuard::set_tier(IsolationTier::BaseContainer);
         let req = test_request(empty_policy());
         let (backend, dacl, tier, _w) =
             select_backend_with_fallback(&req).expect("T1 selection should succeed");
@@ -956,7 +956,7 @@ mod tests {
 
     #[test]
     fn select_backend_t2_no_deny_builds_appcontainer_no_dacl() {
-        let _g = ForceTierGuard::set("appcontainer-bfs");
+        let _g = ForceTierGuard::set_tier(IsolationTier::AppContainerBfs);
         let req = test_request(empty_policy());
         let (backend, dacl, tier, _w) =
             select_backend_with_fallback(&req).expect("T2 selection should succeed");
@@ -970,7 +970,7 @@ mod tests {
 
     #[test]
     fn select_backend_t2_with_deny_builds_appcontainer_with_dacl() {
-        let _g = ForceTierGuard::set("appcontainer-bfs");
+        let _g = ForceTierGuard::set_tier(IsolationTier::AppContainerBfs);
         let (policy, _tmp) = policy_with_denied_temp();
         let req = test_request(policy);
         let (backend, dacl, tier, _w) =
@@ -985,7 +985,7 @@ mod tests {
 
     #[test]
     fn select_backend_t3_builds_appcontainer_with_dacl() {
-        let _g = ForceTierGuard::set("appcontainer-dacl");
+        let _g = ForceTierGuard::set_tier(IsolationTier::AppContainerDacl);
         let (policy, _tmp) = policy_with_rw_temp();
         let req = test_request(policy);
         let (backend, dacl, tier, _w) =

src/backends/appcontainer/common/src/fallback_detector.rs

@@ -21,27 +21,57 @@ use std::sync::OnceLock;
 
 use wxc_common::models::ContainerPolicy;
 
-/// Selected isolation tier. The variant order corresponds to descending
-/// security strength.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum IsolationTier {
+/// Declares [`IsolationTier`] together with its variant↔string mapping in one
+/// place, so [`ALL`](IsolationTier::ALL), [`as_str`](IsolationTier::as_str), and
+/// the [`FromStr`] impl are all generated from the same tier list and cannot
+/// drift. Adding a tier is a single line in the invocation below; the compiler
+/// then forces `as_str`, `from_str`, and `ALL` to cover it.
+macro_rules! isolation_tiers {
+    ($($(#[$variant_doc:meta])* $variant:ident => $name:literal),+ $(,)?) => {
+        /// Selected isolation tier. The variant order corresponds to descending
+        /// security strength.
+        #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+        pub enum IsolationTier {
+            $($(#[$variant_doc])* $variant,)+
+        }
+
+        impl IsolationTier {
+            /// Every tier, ordered strongest-first (matching the variant order).
+            pub const ALL: [IsolationTier; [$(isolation_tiers!(@count $variant)),+].len()] =
+                [$(IsolationTier::$variant),+];
+
+            /// Stable kebab-case identifier for serialization.
+            pub fn as_str(self) -> &'static str {
+                match self {
+                    $(IsolationTier::$variant => $name,)+
+                }
+            }
+        }
+
+        impl std::str::FromStr for IsolationTier {
+            type Err = ();
+
+            /// Inverse of [`as_str`](Self::as_str). Generated from the same tier
+            /// list via an exhaustive match, so the two directions cannot drift.
+            fn from_str(s: &str) -> Result<Self, Self::Err> {
+                match s {
+                    $($name => Ok(IsolationTier::$variant),)+
+                    _ => Err(()),
+                }
+            }
+        }
+    };
+    // Counts each variant as one array element so `ALL`'s length tracks the list.
+    (@count $variant:ident) => { () };
+}
+
+isolation_tiers! {
     /// Tier 1 — a supported BaseContainer contract from `processmodel.dll`.
-    BaseContainer,
+    BaseContainer => "base-container",
     /// Tier 2 — AppContainer + `bfscfg.exe` BFS filesystem policy.
-    AppContainerBfs,
+    AppContainerBfs => "appcontainer-bfs",
     /// Tier 3 — AppContainer + DACL-based filesystem policy on host paths.
-    AppContainerDacl,
-}
-
-impl IsolationTier {
-    /// Stable kebab-case identifier for serialization.
-    pub fn as_str(self) -> &'static str {
-        match self {
-            IsolationTier::BaseContainer => "base-container",
-            IsolationTier::AppContainerBfs => "appcontainer-bfs",
-            IsolationTier::AppContainerDacl => "appcontainer-dacl",
-        }
-    }
+    AppContainerDacl => "appcontainer-dacl",
 }
 
 /// Outcome of [`detect`]: the chosen tier plus any operator-visible warnings
@@ -173,7 +203,7 @@ pub(crate) fn detect_with_base_container_capabilities(
     // the tests silently no-op'd).
     #[cfg(test)]
     if let Ok(forced) = std::env::var("MXC_FORCE_TIER") {
-        if let Some(tier) = parse_force_tier(&forced) {
+        if let Ok(tier) = forced.parse::<IsolationTier>() {
             return forced_decision(tier, policy, denied);
         }
     }
@@ -435,16 +465,6 @@ fn check_write_dac_path(path: &Path) -> Result<(), FallbackError> {
     }
 }
 
-#[cfg(test)]
-fn parse_force_tier(s: &str) -> Option<IsolationTier> {
-    match s {
-        "base-container" => Some(IsolationTier::BaseContainer),
-        "appcontainer-bfs" => Some(IsolationTier::AppContainerBfs),
-        "appcontainer-dacl" => Some(IsolationTier::AppContainerDacl),
-        _ => None,
-    }
-}
-
 #[cfg(test)]
 fn forced_decision(
     tier: IsolationTier,
@@ -705,7 +725,7 @@ mod tests {
     }
     #[test]
     fn empty_policy_t1_when_bc_present_and_preferred() {
-        let _g = ForceTierGuard::set("base-container");
+        let _g = ForceTierGuard::set_tier(IsolationTier::BaseContainer);
         let policy = empty_policy();
         let d = detect(&policy, true).expect("forced base-container should succeed");
         assert!(matches!(d.tier, IsolationTier::BaseContainer));
@@ -714,15 +734,15 @@ mod tests {
     }
     #[test]
     fn empty_policy_no_filesystem_t2_path() {
-        let _g = ForceTierGuard::set("appcontainer-bfs");
+        let _g = ForceTierGuard::set_tier(IsolationTier::AppContainerBfs);
         let policy = empty_policy();
         let d = detect(&policy, true).expect("forced bfs should succeed");
         assert!(matches!(d.tier, IsolationTier::AppContainerBfs));
         assert!(!d.needs_dacl_augmentation);
     }
     #[test]
     fn denied_paths_disabled_blocks_t1() {
-        let _g = ForceTierGuard::set("base-container");
+        let _g = ForceTierGuard::set_tier(IsolationTier::BaseContainer);
         let mut policy = policy_with_denied();
         policy.fallback.allow_dacl_mutation = false;
         assert!(matches!(
@@ -732,7 +752,7 @@ mod tests {
     }
     #[test]
     fn denied_paths_disabled_blocks_t2() {
-        let _g = ForceTierGuard::set("appcontainer-bfs");
+        let _g = ForceTierGuard::set_tier(IsolationTier::AppContainerBfs);
         let mut policy = policy_with_denied();
         policy.fallback.allow_dacl_mutation = false;
         assert!(matches!(
@@ -742,7 +762,7 @@ mod tests {
     }
     #[test]
     fn denied_paths_disabled_blocks_t3() {
-        let _g = ForceTierGuard::set("appcontainer-dacl");
+        let _g = ForceTierGuard::set_tier(IsolationTier::AppContainerDacl);
         let mut policy = policy_with_denied();
         policy.fallback.allow_dacl_mutation = false;
         assert!(matches!(
@@ -818,20 +838,30 @@ mod tests {
             d.warnings
         );
     }
+    #[test]
+    fn tier_name_round_trips_through_from_str() {
+        // `FromStr` is derived from `as_str` via `ALL`, so every tier must
+        // round-trip and the set stays in sync automatically.
+        for tier in IsolationTier::ALL {
+            assert_eq!(tier.as_str().parse::<IsolationTier>(), Ok(tier));
+        }
+    }
+
     #[test]
     fn force_tier_env_var_parses_all_three_values() {
-        assert!(matches!(
-            parse_force_tier("base-container"),
-            Some(IsolationTier::BaseContainer)
-        ));
-        assert!(matches!(
-            parse_force_tier("appcontainer-bfs"),
-            Some(IsolationTier::AppContainerBfs)
-        ));
-        assert!(matches!(
-            parse_force_tier("appcontainer-dacl"),
-            Some(IsolationTier::AppContainerDacl)
-        ));
+        assert_eq!(
+            "base-container".parse::<IsolationTier>(),
+            Ok(IsolationTier::BaseContainer)
+        );
+        assert_eq!(
+            "appcontainer-bfs".parse::<IsolationTier>(),
+            Ok(IsolationTier::AppContainerBfs)
+        );
+        assert_eq!(
+            "appcontainer-dacl".parse::<IsolationTier>(),
+            Ok(IsolationTier::AppContainerDacl)
+        );
+        assert!("not-a-real-tier".parse::<IsolationTier>().is_err());
     }
     #[test]
     fn force_tier_env_var_invalid_value_falls_through_to_real_probes() {
@@ -989,7 +1019,7 @@ mod tests {
     }
     #[test]
     fn compute_decision_with_force_tier_carries_warnings_empty() {
-        let _g = ForceTierGuard::set("appcontainer-dacl");
+        let _g = ForceTierGuard::set_tier(IsolationTier::AppContainerDacl);
         let mut policy = empty_policy();
         policy.fallback.allow_dacl_mutation = true;
         let d = detect(&policy, true).expect("forced dacl with allow_dacl_mutation=true");

src/backends/appcontainer/common/src/probe.rs

@@ -270,7 +270,7 @@ mod tests {
 
     #[test]
     fn run_probe_with_force_tier() {
-        let _g = ForceTierGuard::set("appcontainer-bfs");
+        let _g = ForceTierGuard::set_tier(IsolationTier::AppContainerBfs);
         let policy = ContainerPolicy::default();
         let out = run_probe(&policy);
         assert_eq!(out.tier, Some("appcontainer-bfs"));
@@ -280,7 +280,7 @@ mod tests {
 
     #[test]
     fn run_probe_handles_dacl_disabled_error() {
-        let _g = ForceTierGuard::set("appcontainer-dacl");
+        let _g = ForceTierGuard::set_tier(IsolationTier::AppContainerDacl);
         let mut policy = ContainerPolicy::default();
         policy.fallback.allow_dacl_mutation = false;
         let out = run_probe(&policy);
@@ -296,7 +296,7 @@ mod tests {
 
     #[test]
     fn omitted_fields_when_error() {
-        let _g = ForceTierGuard::set("appcontainer-dacl");
+        let _g = ForceTierGuard::set_tier(IsolationTier::AppContainerDacl);
         let mut policy = ContainerPolicy::default();
         policy.fallback.allow_dacl_mutation = false;
         let out = run_probe(&policy);

src/backends/appcontainer/common/src/test_env.rs

@@ -53,6 +53,13 @@ impl ForceTierGuard {
         }
         ForceTierGuard { _lock: guard }
     }
+
+    /// Typed variant: forces a real tier by its canonical serialized name, so
+    /// call-sites don't hardcode the string. Prefer this over [`set`](Self::set),
+    /// which remains for negative tests that need an intentionally invalid value.
+    pub(crate) fn set_tier(tier: crate::fallback_detector::IsolationTier) -> Self {
+        Self::set(tier.as_str())
+    }
 }
 
 impl Drop for ForceTierGuard {