docs(mxc): correct isolation filesystem support (#3760)

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

architecture/windows.md

@@ -72,7 +72,7 @@ sandbox request.
 |---|---|---|
 | Runtime model | One-shot AppContainer process; default backend | Persistent MXC session used to run one configured process |
 | Driver lifecycle | Launch and monitor `wxc-exec` | `provision` -> `start` -> `exec`; stop/delete issue `stop` and `deprovision` |
-| Filesystem | Read-only/read-write grants with default-deny behavior | Explicit grant-only compatibility mode; not equivalent to ProcessContainer default deny |
+| Filesystem | Read-only/read-write grants with default-deny behavior | OpenShell filesystem-policy grants are unsupported; MXC rejects non-empty read-only/read-write grants |
 | Portable UI policy | Supported completely | Every explicit `ui` section is rejected before provisioning |
 | Governed network policy | Supported through the host proxy when enabled | Rejected because the backend cannot enforce the loopback-only proxy path; without an explicit network policy, the backend retains MXC's default-allow egress |
 | Supervisor relay and dynamic forwarding | Optional | Optional |
@@ -111,7 +111,7 @@ The production mapping in
 
 | Policy area | Windows enforcement |
 |---|---|
-| Filesystem | `read_only` and `read_write` become MXC path grants. `include_workdir` adds the resolved working directory as read-write. The mapper normalizes separators but does not translate Linux-rooted locations into Windows paths. ProcessContainer supplies the default-deny boundary; IsolationSession supplies only the requested grants. |
+| Filesystem | On ProcessContainer, `read_only` and `read_write` become MXC path grants, and `include_workdir` adds the resolved working directory as read-write. The mapper normalizes separators but does not translate Linux-rooted locations into Windows paths. ProcessContainer supplies the default-deny boundary. IsolationSession cannot accept non-empty filesystem grants; without them, its backend defaults determine filesystem visibility. |
 | Network | An explicit network policy requires governed egress on ProcessContainer. The mapper gives MXC loopback-only egress and returns the complete network policy to a per-sandbox host CONNECT proxy. MXC denies direct Internet access; the proxy evaluates destinations, ports, TLS/L7 rules, credential bindings, and binary rules against the configured agent command as its static process identity. Network middleware configuration is rejected because the host proxy does not receive the gateway middleware registry. IsolationSession rejects explicit network policy; without one, it retains MXC's default-allow egress. |
 | UI | ProcessContainer maps graphical UI, directional clipboard access, and input injection into MXC's top-level `ui` object. An absent section maps to the restrictive UI posture. Within an explicit section, omitted fields deny. IsolationSession rejects even an empty explicit section. |
 | Process | MXC supplies the Windows process-isolation boundary, but the mapper has no portable equivalent for `run_as_user` or `run_as_group`; callers must not treat those fields as enforced Windows identity controls. The canonical command, environment, and working directory are launch inputs rather than process-policy grants. |

crates/openshell-driver-mxc/README.md

@@ -21,7 +21,7 @@ it does not implement the Linux `ConnectSupervisor` protocol.
 
 | Capability | MXC driver |
 |---|---|
-| Filesystem policy | Read-only/read-write grants come only from `SandboxPolicy`. `process_container` enforces default-deny; `isolation_session` is an explicit grant-only compatibility mode. |
+| Filesystem policy | Read-only/read-write grants come only from `SandboxPolicy`. `process_container` enforces them with default-deny behavior. `isolation_session` does not support OpenShell filesystem-policy grants; MXC rejects non-empty grants during provisioning. |
 | UI policy | `process_container` advertises complete support and maps portable graphical UI, clipboard-direction, and input-injection controls to MXC; omitted fields inside an explicit section deny. `isolation_session` advertises no support, so the gateway rejects any explicit section before provisioning. |
 | Network policy | With `egress_proxy = true` on `process_container`, an explicit `network_policies` rule activates MXC 0.8 loopback-only egress plus the full policy enforced by a per-sandbox OpenShell host CONNECT proxy. The driver injects proxy environment variables for proxy-aware clients; direct Internet access remains denied by MXC. A policy without network rules does not activate the proxy. Otherwise rejected synchronously. `isolation_session` remains fail-closed. |
 | Provider credentials | The child receives revision-scoped placeholders and non-secret provider environment only. The per-sandbox host proxy retains the resolver and substitutes credentials only for their bound endpoints. |
@@ -44,7 +44,8 @@ Gateway configuration contains only host runtime settings:
 ```toml
 [openshell.drivers.mxc]
 wxc_exec_path = "C:\\path\\to\\wxc-exec.exe"
-# Default: process_container. isolation_session is grant-only and opt-in.
+# Default: process_container. isolation_session is opt-in and does not support
+# OpenShell filesystem-policy grants.
 backend = "process_container"
 default_configuration_id = "composable"
 pc_least_privilege = false

crates/openshell-driver-mxc/examples/mxc-gateway.toml

@@ -16,8 +16,8 @@ version = 2
 wxc_exec_path = "C:\\mxc\\wxc-exec.exe"
 
 # process_container is the default because AppContainer enforces default-deny
-# filesystem access. isolation_session is an explicit grant-only compatibility
-# mode and does not deny access to paths omitted from the sandbox policy.
+# filesystem access. isolation_session does not support OpenShell filesystem-
+# policy grants; MXC rejects non-empty grants during provisioning.
 backend = "process_container"
 
 # process_container only: request a Less-Privileged AppContainer.

crates/openshell-driver-mxc/src/driver.rs

@@ -150,8 +150,8 @@ async fn wait_for_target_listener(port: u16) -> std::io::Result<()> {
 /// Which MXC backend the driver targets.
 ///
 /// - `IsolationSession`: persistent, attachable session
-///   (provision → start → exec → stop → deprovision). Grant-only filesystem
-///   policy — it has no deny primitive and is NOT default-deny.
+///   (provision → start → exec → stop → deprovision). Does not support
+///   OpenShell filesystem-policy grants; backend defaults determine visibility.
 /// - `ProcessContainer` (default): one-shot `AppContainer`. Genuinely default-deny: a
 ///   write to any ungranted path is denied by the OS. No persistent session.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]

crates/openshell-driver-mxc/src/mxc.rs

@@ -53,10 +53,10 @@ fn mock_grants() -> &'static Mutex<HashMap<String, Vec<String>>> {
 
 /// Filesystem shares for the sandbox.
 ///
-/// `isolation_session` honors `readwrite`/`readonly` (grant-only — it has no
-/// deny primitive). `processContainer` additionally honors `denied_paths`
-/// because the `AppContainer` backend can stamp deny ACEs; it is also genuinely
-/// default-deny, so anything not granted is already inaccessible.
+/// `processContainer` honors `readwrite`/`readonly` and `denied_paths`. The
+/// `AppContainer` backend is genuinely default-deny, so anything not granted is
+/// already inaccessible. `isolation_session` rejects non-empty filesystem
+/// grants; its backend defaults determine visibility when no grants are present.
 #[derive(Debug, Default)]
 #[allow(clippy::struct_field_names)]
 pub struct MxcFilesystem {