refactor(runtime): extract driver-independent MXC foundations

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

crates/openshell-core/README.md

@@ -58,6 +58,19 @@ configuration validation live in `openshell_core::middleware`. Policy admission
 and the supervisor runtime consume the same contract without introducing a
 dependency from the policy crate to the supervisor implementation.
 
+## Extension Capabilities
+
+Extensions advertise namespaced string capabilities through `PeerMetadata`.
+Use shared constants in `extension_protocol` and pass optional capabilities to
+`extension_metadata`; do not add per-driver booleans for policy features.
+Negotiation validates and retains the extension's supported capability list.
+
+`POLICY_UI_V1` (`openshell.policy.ui.v1`) declares complete startup UI-policy
+support. The gateway checks the effective policy before driver validation or
+creation and rejects any explicit UI section when the capability is absent.
+Supporting drivers validate and enforce the concrete settings. Omitted UI
+preserves existing driver behavior; changing UI requires sandbox recreation.
+
 ## Protobuf Struct Conversion
 
 Use `openshell_core::proto_struct` when crossing between `serde_json` values and

crates/openshell-core/src/extension_protocol.rs

@@ -19,6 +19,10 @@ pub const PROTOCOL_MINOR: u32 = 0;
 /// configured signer before accepting sandbox creation.
 pub const COMPUTE_LAUNCH_AUTHENTICATION: &str = "openshell.compute.launch-authentication";
 
+/// Compute drivers advertising this capability enforce the complete startup UI
+/// policy contract. Absence means explicit UI policy must be rejected.
+pub const POLICY_UI_V1: &str = "openshell.policy.ui.v1";
+
 const MAX_IMPLEMENTATION_NAME_BYTES: usize = 128;
 const MAX_IMPLEMENTATION_VERSION_BYTES: usize = 128;
 const MAX_CAPABILITY_BYTES: usize = 128;
@@ -398,6 +402,36 @@ mod tests {
         );
     }
 
+    #[test]
+    fn ui_policy_capability_uses_existing_optional_negotiation() {
+        let gateway = gateway_metadata(ExtensionFamily::Compute);
+        let extension = extension_metadata(
+            ExtensionFamily::Compute,
+            "openshell/test-ui-driver",
+            "test",
+            [POLICY_UI_V1.to_string()],
+        );
+        let result = negotiate(
+            ExtensionFamily::Compute,
+            "test-ui-driver",
+            &gateway,
+            Some(extension),
+        )
+        .unwrap();
+        assert!(
+            result
+                .supported_capabilities
+                .iter()
+                .any(|value| value == POLICY_UI_V1)
+        );
+        assert!(
+            !result
+                .required_capabilities
+                .iter()
+                .any(|value| value == POLICY_UI_V1)
+        );
+    }
+
     #[test]
     fn missing_metadata_and_major_skew_are_actionable() {
         let (gateway, mut extension) = compatible();

crates/openshell-core/src/paths.rs

@@ -57,6 +57,24 @@ pub fn openshell_state_dir() -> Result<PathBuf> {
     Ok(xdg_state_dir()?.join("openshell"))
 }
 
+/// Platform default for gateway audit files. Sink configuration and writing
+/// remain portable; only the directory convention depends on the host.
+pub fn gateway_audit_log_dir() -> PathBuf {
+    #[cfg(target_os = "windows")]
+    {
+        if let Some(directory) = std::env::var_os("ProgramData") {
+            return PathBuf::from(directory).join("OpenShell").join("logs");
+        }
+        std::env::temp_dir().join("openshell").join("logs")
+    }
+    #[cfg(not(target_os = "windows"))]
+    {
+        openshell_state_dir()
+            .unwrap_or_else(|_| std::env::temp_dir().join("openshell"))
+            .join("logs")
+    }
+}
+
 /// Resolve the XDG data base directory.
 ///
 /// Returns `$XDG_DATA_HOME` if set, otherwise `$HOME/.local/share`.

crates/openshell-core/src/policy.rs

@@ -113,6 +113,10 @@ impl TryFrom<ProtoSandboxPolicy> for SandboxPolicy {
     type Error = miette::Report;
 
     fn try_from(proto: ProtoSandboxPolicy) -> Result<Self, Self::Error> {
+        // UI capabilities are intentionally absent from the portable supervisor
+        // runtime. Non-Windows compute paths do not expose them, so even a
+        // schema-level UI allowance cannot grant a UI surface there. A capable
+        // compute driver consumes the typed proto directly.
         // In cluster mode we always run with proxy networking so all egress
         // can be evaluated by OPA.
         let network = NetworkPolicy {
@@ -192,6 +196,7 @@ impl From<ProtoProcessPolicy> for ProcessPolicy {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::proto::{UiClipboardAccess, UiPolicy};
 
     #[test]
     fn try_from_maps_known_compatibility_values() {
@@ -233,4 +238,26 @@ mod tests {
         assert!(!is_valid_landlock_compatibility("nope"));
         assert!(!is_valid_landlock_compatibility("BestEffort"));
     }
+
+    #[test]
+    fn portable_runtime_does_not_activate_ui_allowances() {
+        let converted = SandboxPolicy::try_from(ProtoSandboxPolicy {
+            version: 1,
+            ui: Some(UiPolicy {
+                allow_graphical_ui: true,
+                clipboard: UiClipboardAccess::All as i32,
+                allow_input_injection: true,
+            }),
+            ..Default::default()
+        })
+        .expect("portable policy conversion succeeds");
+
+        assert_eq!(converted.version, 1);
+        assert!(matches!(converted.network.mode, NetworkMode::Proxy));
+        assert!(converted.network.proxy.is_some());
+        assert!(converted.filesystem.read_only.is_empty());
+        assert!(converted.filesystem.read_write.is_empty());
+        assert!(converted.process.run_as_user.is_none());
+        assert!(converted.process.run_as_group.is_none());
+    }
 }

crates/openshell-core/src/provider_credentials.rs

@@ -399,6 +399,18 @@ impl ProviderCredentialState {
             .revision
     }
 
+    /// Whether this snapshot contains endpoint-bound material that must be
+    /// resolved by a network proxy rather than exposed to the child process.
+    #[must_use]
+    pub fn requires_proxy_resolution(&self) -> bool {
+        let inner = self
+            .inner
+            .read()
+            .expect("provider credential state poisoned");
+        !inner.static_credential_bindings.is_empty()
+            || !inner.current.dynamic_credentials.is_empty()
+    }
+
     /// Remove a key from the credential snapshot's child env.
     ///
     /// Used when a sandbox-side service (e.g., metadata server) fails to start

crates/openshell-driver-mxc/tests/policy_mapper_matrix.rs

@@ -1109,6 +1109,7 @@ fn handled_fields_inventory() {
     // ── (1) Top-level keys: serialize a SandboxPolicy with every section
     // present-but-minimal, then collect YAML keys. ──────────────────────────
     let full_toplevel_policy = SandboxPolicy {
+        ui: None,
         version: 1,
         filesystem: Some(FilesystemPolicy {
             include_workdir: false,

crates/openshell-isolation-interface/src/contract.rs

@@ -857,7 +857,7 @@ pub trait BoundaryLoopbackConnector: Send + Sync {
 /// that owns a connection or one of its executable ancestors. A missing digest
 /// is `None`, never an empty value; binary-scoped policy cannot authorize an
 /// executable whose digest is unavailable.
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct ExecutableIdentity {
     /// Absolute executable path in the workload filesystem namespace.
     pub path: PathBuf,
@@ -871,7 +871,7 @@ pub struct ExecutableIdentity {
 ///
 /// How a backend resolves identity is private to that backend; the shape and
 /// fail-closed semantics do not change.
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct BinaryIdentity {
     /// Executable that owns the accepted connection.
     pub executable: ExecutableIdentity,

crates/openshell-policy-schema/src/lib.rs

@@ -193,6 +193,12 @@ pub struct PolicyDocument {
         skip_serializing_if = "Option::is_none"
     )]
     pub process: Option<ProcessPolicy>,
+    #[serde(
+        default,
+        deserialize_with = "deserialize_non_null_optional_field",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub ui: Option<UiPolicy>,
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
     pub network_policies: BTreeMap<String, NetworkPolicyRule>,
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
@@ -234,6 +240,34 @@ pub struct ProcessPolicy {
     pub run_as_group: String,
 }
 
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UiPolicy {
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub allow_graphical_ui: bool,
+    #[serde(default, skip_serializing_if = "UiClipboardAccess::is_none")]
+    pub clipboard: UiClipboardAccess,
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub allow_input_injection: bool,
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UiClipboardAccess {
+    #[default]
+    None,
+    Read,
+    Write,
+    All,
+}
+
+impl UiClipboardAccess {
+    #[must_use]
+    pub const fn is_none(&self) -> bool {
+        matches!(self, Self::None)
+    }
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct NetworkPolicyRule {
@@ -698,6 +732,7 @@ fn inspect_document(root: &serde_yml::Value) -> InspectionResult {
             "filesystem_policy",
             "landlock",
             "process",
+            "ui",
             "network_policies",
             "network_middlewares",
         ],
@@ -717,6 +752,11 @@ fn inspect_document(root: &serde_yml::Value) -> InspectionResult {
         "process",
         &["run_as_user", "run_as_group"],
     )?;
+    inspect_named(
+        root.get("ui"),
+        "ui",
+        &["allow_graphical_ui", "clipboard", "allow_input_injection"],
+    )?;
 
     for (name, rule) in open_map(root.get("network_policies")) {
         let path = join("network_policies", name);
@@ -1176,6 +1216,7 @@ mod tests {
         for source in [
             "version: 1\nfilesystem_policy: null\n",
             "version: 1\nprocess: null\n",
+            "version: 1\nui: null\n",
             "version: 1\nmetadata: null\n",
             "version: 1\nnetwork_policies:\n  x:\n    endpoints:\n      - host: x\n        port: 443\n        mcp: null\n",
         ] {
@@ -1212,6 +1253,7 @@ mod tests {
                 "landlock.future",
             ),
             ("version: 1\nprocess: { future: true }\n", "process.future"),
+            ("version: 1\nui: { future: true }\n", "ui.future"),
             (
                 "version: 1\nnetwork_policies: { api: { future: true } }\n",
                 "network_policies.api.future",