refactor(runtime): defer UI policy support to MXC integration

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

crates/openshell-core/README.md

@@ -58,19 +58,6 @@ configuration validation live in `openshell_core::middleware`. Policy admission
 and the supervisor runtime consume the same contract without introducing a
 dependency from the policy crate to the supervisor implementation.
 
-## Extension Capabilities
-
-Extensions advertise namespaced string capabilities through `PeerMetadata`.
-Use shared constants in `extension_protocol` and pass optional capabilities to
-`extension_metadata`; do not add per-driver booleans for policy features.
-Negotiation validates and retains the extension's supported capability list.
-
-`POLICY_UI_V1` (`openshell.policy.ui.v1`) declares complete startup UI-policy
-support. The gateway checks the effective policy before driver validation or
-creation and rejects any explicit UI section when the capability is absent.
-Supporting drivers validate and enforce the concrete settings. Omitted UI
-preserves existing driver behavior; changing UI requires sandbox recreation.
-
 ## Protobuf Struct Conversion
 
 Use `openshell_core::proto_struct` when crossing between `serde_json` values and

crates/openshell-core/src/extension_protocol.rs

@@ -19,10 +19,6 @@ pub const PROTOCOL_MINOR: u32 = 0;
 /// configured signer before accepting sandbox creation.
 pub const COMPUTE_LAUNCH_AUTHENTICATION: &str = "openshell.compute.launch-authentication";
 
-/// Compute drivers advertising this capability enforce the complete startup UI
-/// policy contract. Absence means explicit UI policy must be rejected.
-pub const POLICY_UI_V1: &str = "openshell.policy.ui.v1";
-
 const MAX_IMPLEMENTATION_NAME_BYTES: usize = 128;
 const MAX_IMPLEMENTATION_VERSION_BYTES: usize = 128;
 const MAX_CAPABILITY_BYTES: usize = 128;
@@ -402,36 +398,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn ui_policy_capability_uses_existing_optional_negotiation() {
-        let gateway = gateway_metadata(ExtensionFamily::Compute);
-        let extension = extension_metadata(
-            ExtensionFamily::Compute,
-            "openshell/test-ui-driver",
-            "test",
-            [POLICY_UI_V1.to_string()],
-        );
-        let result = negotiate(
-            ExtensionFamily::Compute,
-            "test-ui-driver",
-            &gateway,
-            Some(extension),
-        )
-        .unwrap();
-        assert!(
-            result
-                .supported_capabilities
-                .iter()
-                .any(|value| value == POLICY_UI_V1)
-        );
-        assert!(
-            !result
-                .required_capabilities
-                .iter()
-                .any(|value| value == POLICY_UI_V1)
-        );
-    }
-
     #[test]
     fn missing_metadata_and_major_skew_are_actionable() {
         let (gateway, mut extension) = compatible();

crates/openshell-core/src/policy.rs

@@ -113,10 +113,6 @@ impl TryFrom<ProtoSandboxPolicy> for SandboxPolicy {
     type Error = miette::Report;
 
     fn try_from(proto: ProtoSandboxPolicy) -> Result<Self, Self::Error> {
-        // UI capabilities are intentionally absent from the portable supervisor
-        // runtime. Non-Windows compute paths do not expose them, so even a
-        // schema-level UI allowance cannot grant a UI surface there. A capable
-        // compute driver consumes the typed proto directly.
         // In cluster mode we always run with proxy networking so all egress
         // can be evaluated by OPA.
         let network = NetworkPolicy {
@@ -196,7 +192,6 @@ impl From<ProtoProcessPolicy> for ProcessPolicy {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::proto::{UiClipboardAccess, UiPolicy};
 
     #[test]
     fn try_from_maps_known_compatibility_values() {
@@ -238,26 +233,4 @@ mod tests {
         assert!(!is_valid_landlock_compatibility("nope"));
         assert!(!is_valid_landlock_compatibility("BestEffort"));
     }
-
-    #[test]
-    fn portable_runtime_does_not_activate_ui_allowances() {
-        let converted = SandboxPolicy::try_from(ProtoSandboxPolicy {
-            version: 1,
-            ui: Some(UiPolicy {
-                allow_graphical_ui: true,
-                clipboard: UiClipboardAccess::All as i32,
-                allow_input_injection: true,
-            }),
-            ..Default::default()
-        })
-        .expect("portable policy conversion succeeds");
-
-        assert_eq!(converted.version, 1);
-        assert!(matches!(converted.network.mode, NetworkMode::Proxy));
-        assert!(converted.network.proxy.is_some());
-        assert!(converted.filesystem.read_only.is_empty());
-        assert!(converted.filesystem.read_write.is_empty());
-        assert!(converted.process.run_as_user.is_none());
-        assert!(converted.process.run_as_group.is_none());
-    }
 }

crates/openshell-driver-mxc/tests/policy_mapper_matrix.rs

@@ -1109,7 +1109,6 @@ fn handled_fields_inventory() {
     // ── (1) Top-level keys: serialize a SandboxPolicy with every section
     // present-but-minimal, then collect YAML keys. ──────────────────────────
     let full_toplevel_policy = SandboxPolicy {
-        ui: None,
         version: 1,
         filesystem: Some(FilesystemPolicy {
             include_workdir: false,

crates/openshell-policy-schema/src/lib.rs

@@ -193,12 +193,6 @@ pub struct PolicyDocument {
         skip_serializing_if = "Option::is_none"
     )]
     pub process: Option<ProcessPolicy>,
-    #[serde(
-        default,
-        deserialize_with = "deserialize_non_null_optional_field",
-        skip_serializing_if = "Option::is_none"
-    )]
-    pub ui: Option<UiPolicy>,
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
     pub network_policies: BTreeMap<String, NetworkPolicyRule>,
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
@@ -240,34 +234,6 @@ pub struct ProcessPolicy {
     pub run_as_group: String,
 }
 
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct UiPolicy {
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub allow_graphical_ui: bool,
-    #[serde(default, skip_serializing_if = "UiClipboardAccess::is_none")]
-    pub clipboard: UiClipboardAccess,
-    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
-    pub allow_input_injection: bool,
-}
-
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum UiClipboardAccess {
-    #[default]
-    None,
-    Read,
-    Write,
-    All,
-}
-
-impl UiClipboardAccess {
-    #[must_use]
-    pub const fn is_none(&self) -> bool {
-        matches!(self, Self::None)
-    }
-}
-
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct NetworkPolicyRule {
@@ -732,7 +698,6 @@ fn inspect_document(root: &serde_yml::Value) -> InspectionResult {
             "filesystem_policy",
             "landlock",
             "process",
-            "ui",
             "network_policies",
             "network_middlewares",
         ],
@@ -752,11 +717,6 @@ fn inspect_document(root: &serde_yml::Value) -> InspectionResult {
         "process",
         &["run_as_user", "run_as_group"],
     )?;
-    inspect_named(
-        root.get("ui"),
-        "ui",
-        &["allow_graphical_ui", "clipboard", "allow_input_injection"],
-    )?;
 
     for (name, rule) in open_map(root.get("network_policies")) {
         let path = join("network_policies", name);
@@ -1216,7 +1176,6 @@ mod tests {
         for source in [
             "version: 1\nfilesystem_policy: null\n",
             "version: 1\nprocess: null\n",
-            "version: 1\nui: null\n",
             "version: 1\nmetadata: null\n",
             "version: 1\nnetwork_policies:\n  x:\n    endpoints:\n      - host: x\n        port: 443\n        mcp: null\n",
         ] {
@@ -1253,7 +1212,6 @@ mod tests {
                 "landlock.future",
             ),
             ("version: 1\nprocess: { future: true }\n", "process.future"),
-            ("version: 1\nui: { future: true }\n", "ui.future"),
             (
                 "version: 1\nnetwork_policies: { api: { future: true } }\n",
                 "network_policies.api.future",