Update network policy docs with clarifications and examples

.github/copilot-instructions.md

@@ -155,7 +155,7 @@ Core references:
 - `docs/examples.md` — annotated configuration examples (see also `tests/examples/` and `tests/configs/`)
 - `docs/diagnostics.md` — diagnostic logging knobs (env vars, log file format)
 - `docs/host-prep.md` — `wxc-host-prep.exe` host setup binary (`prepare-system-drive` / `unprepare-system-drive` for the AppContainer ACEs on the system-drive root, plus `prepare-null-device` / `verify-null-device` / `dump-null-device` for the `\Device\Null` security descriptor that AppContainer-based backends require). Owns elevation via embedded `requireAdministrator` manifest — `wxc-exec.exe` no longer self-elevates.
-- `docs/sandbox-policy/v1/policy.md` — sandbox policy v1 specification
+- `docs/sandbox-policy/0.7.0/policy.md` — sandbox policy 0.7.0 specification
 
 Per-backend guides:
 

README.md

@@ -269,7 +269,7 @@ Privacy information can be found at https://privacy.microsoft.com and in the Mic
 | [docs/examples.md](docs/examples.md) | Annotated configuration examples |
 | [docs/host-prep.md](docs/host-prep.md) | Windows host preparation (`wxc-host-prep.exe`) |
 | [docs/diagnostics.md](docs/diagnostics.md) | Diagnostic logging and ETW |
-| [docs/sandbox-policy/v1/policy.md](docs/sandbox-policy/v1/policy.md) | Sandbox policy v1 specification |
+| [docs/sandbox-policy/0.7.0/policy.md](docs/sandbox-policy/0.7.0/policy.md) | Sandbox policy 0.7.0 specification |
 | [docs/process-container/guide.md](docs/process-container/guide.md) | Windows AppContainer / BaseContainer guide |
 | [docs/lxc-support/lxc-backend.md](docs/lxc-support/lxc-backend.md) | LXC backend (Linux) |
 | [docs/bwrap-support/bubblewrap-backend.md](docs/bwrap-support/bubblewrap-backend.md) | Bubblewrap backend (Linux) |

docs/authoring-a-new-feature.md

@@ -18,7 +18,7 @@
 
 Read these in order:
 
-1. [Sandbox Policy spec](sandbox-policy/v1/policy.md): what
+1. [Sandbox Policy spec](sandbox-policy/0.7.0/policy.md): what
 Policy and ContainerConfig are, design principles.
 2. [Versioning Design](versioning.md): how policy/schema/SDK
 versions relate and when to bump.
@@ -101,7 +101,7 @@ If your feature touches SandboxPolicy, update
 If your feature adds policy or config fields, you will need
 to plumb them through `createConfigFromPolicy()` in
 `sdk/node/src/sandbox.ts`. See the
-[worked example in the Sandbox Policy spec](sandbox-policy/v1/policy.md#10-worked-example-ui-policy)
+[worked example in the Sandbox Policy spec](sandbox-policy/0.7.0/policy.md#10-worked-example-ui-policy)
 for a walkthrough.
 
 ---

docs/process-container/examples/0.8.0-schema.md

@@ -0,0 +1,48 @@
+# Planned ProcessContainer schema 0.8 configuration
+
+See the shared [0.7-to-0.8 network schema comparison](../../sandbox-policy/0.8.0/networking/schema-updates.md)
+for egress, ingress, and proxy endpoint changes. This page covers the
+ProcessContainer-specific proxy peer.
+
+## Contained proxy
+
+`allowedProxyPeer` identifies either an installed package or an unpackaged AppContainer profile that hosts the proxy.
+Package identity can scope a packaged proxy whether or not that proxy uses AppContainer isolation.
+
+```jsonc
+{
+  "version": "0.8.0-alpha",
+  "containment": "processcontainer",
+  "process": {
+    "commandLine": "cmd.exe /c echo replace-with-client-command"
+  },
+  "network": {
+    "egress": {
+      "default": "deny"
+    },
+    "ingress": {
+      "default": "allow",
+      "hostLoopback": "deny"
+    }
+  },
+  "runtimeConfig": {
+    "networkProxy": "http://127.0.0.1:8080"
+  },
+  "processContainer": {
+    "network": {
+      "allowedProxyPeer": "<installed-package-family-name-or-appcontainer-profile-name>"
+    }
+  }
+}
+```
+
+| Field | Value |
+|---|---|
+| `runtimeConfig.networkProxy` | HTTP/S loopback URL with an explicit port |
+| `processContainer.network.allowedProxyPeer` | Package family name or AppContainer profile name |
+
+ProcessContainer requires `ingress.default: "allow"` for private-network communication with an identity-scoped proxy.
+Windows implements this with the bidirectional `privateNetworkClientServer` capability, so the setting also permits
+private-network server traffic. `egress.default: "deny"` continues to block direct internet traffic.
+
+See [Process Container Networking Configuration](../networking.md) for Windows enforcement details.

docs/process-container/guide.md

@@ -11,7 +11,7 @@ For which policy aspects this backend can enforce on each Windows 11 release
 ## Prerequisites
 
 1. Read the
-[Sandbox Policy spec](../sandbox-policy/v1/policy.md) to
+[Sandbox Policy spec](../sandbox-policy/0.7.0/policy.md) to
 understand how SandboxPolicy maps to ContainerConfig.
 2. Read
 [authoring-a-new-feature.md](../authoring-a-new-feature.md),