feat(mxc): add Windows ETW-to-OCSF audit trail

.agents/skills/openshell-cli/SKILL.md

@@ -359,7 +359,7 @@ stopped. Delete remains the operation that removes retained state.
 
 This is the most important multi-step workflow. It enables a tight feedback cycle where sandbox policy is refined based on observed activity.
 
-**Key concept**: Policies have static fields (immutable after creation: `filesystem_policy`, `landlock`, `process`) and two dynamic fields: `network_policies` and `network_middlewares`. Both dynamic fields can be updated without recreating the sandbox.
+**Key concept**: Policies have static fields (immutable after creation: `filesystem_policy`, `landlock`, `process`) and two dynamic fields: `network_policies` and `network_middlewares`. Both dynamic fields can be updated without recreating the sandbox when the selected compute driver supports live policy updates. MXC rejects live policy replacement and merge updates; delete and recreate an MXC sandbox instead.
 
 An endpoint with omitted `protocol` retains explicit-proxy behavior. Explicit
 `protocol: tcp` requests policy DNS and transparent TCP and currently requires
@@ -429,7 +429,7 @@ Edit `current-policy.yaml` to allow the blocked actions. **For policy content au
 - Binary matching patterns
 - Ordered `network_middlewares`, host selection, HTTP and WebSocket bindings, and `fail_open` or `fail_closed` behavior
 
-`network_policies` and `network_middlewares` can be modified at runtime. If `filesystem_policy`, `landlock`, or `process` need changes, the sandbox must be recreated. Built-in middleware such as `openshell/regex` needs no gateway registration. An operator-run middleware must already be registered under `[[openshell.supervisor.middleware]]`; changing that static registration requires a gateway restart.
+`network_policies` and `network_middlewares` can be modified at runtime when the selected compute driver supports live policy updates. MXC rejects live policy replacement and merge updates; delete and recreate an MXC sandbox instead. If `filesystem_policy`, `landlock`, or `process` need changes, the sandbox must be recreated. Built-in middleware such as `openshell/regex` needs no gateway registration. An operator-run middleware must already be registered under `[[openshell.supervisor.middleware]]`; changing that static registration requires a gateway restart.
 
 Middleware can inspect parsed HTTP request bodies and complete client-to-upstream WebSocket text messages over both `ws://` and `wss://` when the implementation advertises the matching binding. The built-in `openshell/regex` advertises both bindings and applies its fixed patterns to UTF-8 text. A host-matched HTTP-only attachment can inspect the upgrade GET but does not join the WebSocket chain; look for `binding_not_selected` coverage. Binary messages pass under both `on_error` modes and active stages emit `unsupported_message_type` coverage; upstream-to-client messages remain uninspected. A broken fail-open WebSocket stage is disabled for the rest of that connection; inspect sandbox OCSF logs for `openshell.middleware.websocket_stage_disabled`.
 

.agents/skills/openshell-cli/cli-reference.md

@@ -381,7 +381,7 @@ The sandbox name defaults to the last-used sandbox.
 
 ### `openshell policy update [name]`
 
-Incrementally merge live network policy changes into the current sandbox policy. Multiple flags in one invocation are applied as one atomic batch and create at most one new revision.
+Incrementally merge live network policy changes into the current sandbox policy when the selected compute driver supports live updates. Multiple flags in one invocation are applied as one atomic batch and create at most one new revision. MXC rejects live policy merges; delete and recreate an MXC sandbox instead.
 
 | Flag | Default | Description |
 |------|---------|-------------|
@@ -411,7 +411,7 @@ Notes:
 
 ### `openshell policy set [name] --policy <PATH>`
 
-Replace the full policy on a live sandbox. Only the dynamic `network_policies` field can be changed at runtime.
+Replace the full policy on a live sandbox when the selected compute driver supports live updates. Only the dynamic `network_policies` field can be changed at runtime. MXC rejects live policy replacement; delete and recreate an MXC sandbox instead.
 
 | Flag | Default | Description |
 |------|---------|-------------|

.gitattributes

@@ -11,3 +11,6 @@ crates/openshell-core/src/proto/openshell.*.rs linguist-generated
 
 # Vendored OCSF schemas fetched from schema.ocsf.io
 crates/openshell-ocsf/schemas/** linguist-generated
+
+# TypeScript tooling and Biome require stable LF input on every host
+sdk/typescript/** text eol=lf

Cargo.toml

@@ -54,6 +54,9 @@ terminal-colorsaurus = "1.0"
 # Error handling
 miette = { version = "7", features = ["fancy"] }
 thiserror = "2"
+
+# Windows platform APIs (ETW/TDH audit consumer in openshell-driver-mxc; Windows-only)
+windows = { version = "0.62", features = ["Win32_Foundation", "Win32_System_Diagnostics_Etw", "Win32_System_Time"] }
 anyhow = "1"
 
 # Logging/Tracing

architecture/README.md

@@ -141,6 +141,10 @@ bridge networks, port mappings, NAT traversal, or bespoke tunnels. The common
 runtime requirement is narrower: the supervisor must be able to reach the
 gateway.
 
+The Windows MXC driver is an explicit exception. It launches and monitors a
+one-shot workload in the driver, self-reports readiness, and does not expose a
+supervisor session, interactive connect, live policy delivery, or governed egress.
+
 The gateway delivers desired state; the sandbox applies it locally. Policy,
 settings, credentials, and inference routes flow from the gateway to the
 supervisor. The supervisor validates and applies what can change at runtime,

architecture/windows-msvc-build.md

@@ -1,14 +1,15 @@
 # Windows MSVC Build Design
 
 This page records the design decisions for the native Windows MSVC build lane.
-It is intentionally build-only. It does not make Windows a Docker, Kubernetes,
-Podman, or VM runtime host.
+It provides the native build lane and validates the in-process MXC compute
+driver. It does not make Windows a Docker, Kubernetes, Podman, or VM runtime host.
 
 ## Goals
 
 - Compile the OpenShell gateway and CLI for `x86_64-pc-windows-msvc` and `aarch64-pc-windows-msvc`.
 - Keep the Linux and macOS build paths unchanged.
 - Preserve gateway configuration parsing for all existing compute driver names.
+- Build and test the in-process MXC driver on supported Windows hosts.
 - Return clear unsupported errors when a Windows gateway is configured to use Docker, Kubernetes, Podman, or VM.
 - Keep dedicated `windows:*` validation tasks while allowing the repository-wide
   `pre-commit` task to delegate compiler-bearing Rust checks to the native
@@ -18,7 +19,7 @@ Podman, or VM runtime host.
 
 - Do not support Docker Desktop, WSL, Hyper-V, Podman machine, Podman Desktop, Kubernetes, or VM-backed sandbox execution on Windows.
 - Do not ship Windows standalone binaries for Docker, Kubernetes, Podman, or VM drivers.
-- Do not implement named-pipe driver IPC, Windows services, MSI packaging, Credential Manager integration, DPAPI integration, or MXC policy translation in this build lane.
+- Do not implement named-pipe driver IPC, Windows services, MSI packaging, Credential Manager integration, or DPAPI integration in this lane.
 
 ## Unsupported Driver Strategy
 
@@ -42,6 +43,7 @@ on Windows.
 | Kubernetes | Driver crate excluded; server config contract retained. | Gateway construction returns unsupported. |
 | Podman | Driver crate excluded; server config contract retained. | Gateway construction returns unsupported. |
 | VM | Driver crate excluded from workspace validation. | Gateway construction returns unsupported. |
+| MXC | Driver links into the native gateway and runs in Windows validation. | `process_container` is default-deny; grant-only `isolation_session` requires explicit configuration. |
 
 This keeps Windows behavior explicit without carrying runtime dependencies or
 creating misleading Windows driver artifacts.
@@ -62,7 +64,7 @@ Windows validation is exposed through `tasks/windows.toml`:
 | `windows:check:arm64` | Check the ARM64 MSVC gateway/CLI build graph. |
 | `windows:build:x64` | Build release x64 `openshell-gateway.exe` and `openshell.exe`. |
 | `windows:build:arm64` | Build release ARM64 `openshell-gateway.exe` and `openshell.exe`. |
-| `windows:test:x64` | Run native x64 workspace tests, excluding unsupported Windows packages as top-level test targets. |
+| `windows:test:x64` | Run native x64 workspace tests, including MXC mapper and lifecycle tests, while excluding unsupported Windows packages as top-level test targets. |
 | `windows:test:arm64` | Run native ARM64 workspace tests with the same package exclusions. |
 | `windows:test:unsupported:x64` | Run focused server/runtime tests for unsupported driver contracts. |
 | `windows:test:unsupported:arm64` | Run the same focused contracts natively on ARM64. |
@@ -159,5 +161,5 @@ A successful Windows build report should include:
 - Focused unsupported-driver contract test status.
 - Artifact size and SHA256 for each Windows binary.
 
-Warnings from Linux-only dead code are acceptable in this build-only phase when
+Warnings from Linux-only dead code are acceptable in the native Windows lane when
 they come from code paths intentionally disabled on Windows.

crates/openshell-core/src/config.rs

@@ -125,6 +125,8 @@ pub enum ComputeDriverKind {
     Vm,
     Docker,
     Podman,
+    /// Microsoft MXC isolation session (Windows only).
+    Mxc,
 }
 
 impl ComputeDriverKind {
@@ -135,6 +137,7 @@ impl ComputeDriverKind {
             Self::Vm => "vm",
             Self::Docker => "docker",
             Self::Podman => "podman",
+            Self::Mxc => "mxc",
         }
     }
 }
@@ -175,8 +178,9 @@ impl FromStr for ComputeDriverKind {
             "vm" => Ok(Self::Vm),
             "docker" => Ok(Self::Docker),
             "podman" => Ok(Self::Podman),
+            "mxc" => Ok(Self::Mxc),
             other => Err(format!(
-                "unsupported compute driver '{other}'. expected one of: kubernetes, vm, docker, podman"
+                "unsupported compute driver '{other}'. expected one of: kubernetes, vm, docker, podman, mxc"
             )),
         }
     }

crates/openshell-core/src/telemetry.rs

@@ -165,6 +165,7 @@ pub enum TelemetryComputeDriver {
     Kubernetes,
     Podman,
     Vm,
+    Mxc,
     Unknown,
 }
 
@@ -176,6 +177,7 @@ impl TelemetryComputeDriver {
             Self::Kubernetes => "kubernetes",
             Self::Podman => "podman",
             Self::Vm => "vm",
+            Self::Mxc => "mxc",
             Self::Unknown => "unknown",
         }
     }
@@ -187,6 +189,7 @@ impl TelemetryComputeDriver {
             "k8s" | "kubernetes" => Self::Kubernetes,
             "podman" => Self::Podman,
             "vm" => Self::Vm,
+            "mxc" => Self::Mxc,
             _ => Self::Unknown,
         }
     }
@@ -198,6 +201,7 @@ impl TelemetryComputeDriver {
             Some(crate::ComputeDriverKind::Kubernetes) => Self::Kubernetes,
             Some(crate::ComputeDriverKind::Podman) => Self::Podman,
             Some(crate::ComputeDriverKind::Vm) => Self::Vm,
+            Some(crate::ComputeDriverKind::Mxc) => Self::Mxc,
             None => Self::Unknown,
         }
     }

crates/openshell-driver-mxc/Cargo.toml

@@ -0,0 +1,56 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+[package]
+name = "openshell-driver-mxc"
+description = "MXC (Windows isolation session) compute driver for OpenShell"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[lib]
+name = "openshell_driver_mxc"
+
+[dependencies]
+openshell-core = { path = "../openshell-core" }
+# OCSF builders + emit target used by the Windows ETW audit consumer. OS-agnostic
+# crate (no windows deps), so safe to depend on from all targets; only the
+# windows-gated `etw_consumer` module actually uses it.
+openshell-ocsf = { path = "../openshell-ocsf" }
+tokio = { workspace = true }
+tonic = { workspace = true }
+futures = { workspace = true }
+tokio-stream = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+base64 = { workspace = true }
+tracing = { workspace = true }
+thiserror = { workspace = true }
+uuid = { workspace = true }
+
+# ETW/TDH real-time consumer (Plane A audit). Windows-only so the Linux/WSL
+# build stays an empty stub.
+[target.'cfg(target_os = "windows")'.dependencies]
+windows = { workspace = true }
+
+[dev-dependencies]
+tokio = { workspace = true }
+# tempfile is not a workspace dependency; 3.27 is already resolved in Cargo.lock.
+tempfile = "3"
+# Used by Windows-only integration tests to parse policy YAML into the typed
+# proto. Inert on non-Windows.
+openshell-policy = { path = "../openshell-policy" }
+# Needed by the real-wxc integration test (wxc_exec_real.rs) which builds
+# --config-base64 payloads without going through the async WxcExecInvoker.
+# base64 and serde_json are already [dependencies] but dev-dependency resolution
+# is independent; explicit entries make them visible to integration tests.
+base64 = { workspace = true }
+serde_json = { workspace = true }
+# Used by the drift guard test (handled_fields_inventory) to parse YAML into a
+# generic serde_json::Value for key enumeration.
+serde_yml = { workspace = true }
+
+[lints]
+workspace = true