feat(sdk): probe denial capture support

[Carlos Alexandro Becker (caarlos0)]

📖 Description

Expose captureDenials through the Rust SDK's existing available_backends() host-capability probe.

ProcessContainer reports BackendCapability::CaptureDenials only after the host successfully creates a minimal PSEC environment and starts a Learning Mode trace. The probe session is immediately discarded. This remains advisory; launch still returns ErrorCode::BackendUnavailable if support changes before execution.

🔗 References

No linked issue.

🔍 Validation

• cargo test -p mxc_engine -p mxc-sdk
• cargo clippy -p mxc_engine -p mxc-sdk --all-targets -- -D warnings
• cargo test -p mxc_engine probe::tests
• cargo clippy -p mxc_engine --all-targets -- -D warnings

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See docs/pull-requests.md.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See docs/pull-requests.md
for the steps.

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Exposes denial-capture availability through the Rust SDK’s backend capability probe.

Changes:

• Adds and re-exports BackendCapability.
• Probes Windows denial-capture support.
• Documents capability discovery and schema requirements.

Show a summary per file

File	Description
src/backends/appcontainer/common/src/base_container_runner.rs	Adds the denial-capture host probe.
src/core/mxc_engine/src/probe.rs	Reports backend capabilities.
src/core/mxc_engine/src/lib.rs	Exports capability types.
src/core/mxc-sdk/src/lib.rs	Re-exports capabilities publicly.
src/core/mxc-sdk/README.md	Documents capability probing.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (1)

src/backends/appcontainer/common/src/base_container_runner.rs:509

• This still makes the new capability probe depend on is_process_security_environment_usable(), whose OnceLock<bool> permanently caches a failed CreateProcessSecurityEnvironment call. A transient PSEC creation failure therefore suppresses CaptureDenials for every later available_backends() call, even though the capture-specific probe is now retried and the public probe says it is not cached. Please avoid caching negative PSEC results (while keeping tier and capability probing consistent), so a later call can recover.

        if !Self::is_process_security_environment_usable() {
            return false;
        }

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (1)

src/core/mxc_engine/src/probe.rs:342

• This assertion runs a second independent, uncached StartLearningModeTrace probe. A transient failure between the call inside available_backends() and this call can therefore make the values differ even though the production behavior is correct (and the probe is intentionally retried on later calls). Please test this mapping with an injected/fixed probe result instead of comparing two live host probes.

        assert_eq!(
            process_container
                .capabilities
                .contains(&BackendCapability::CaptureDenials),
            BaseContainerRunner::is_capture_denials_usable()
        );

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Balanced