fix(mxc): reject unsupported foreground attachment before provisioning

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

crates/openshell-driver-mxc/README.md

@@ -39,8 +39,9 @@ branch's `MXC agent launched` acknowledgement only after native spawn succeeds.
 
 The driver resolves its gateway endpoint and TLS server-name defaults from
 generic gateway inputs. The host supervisor authenticates its gateway session
-and retains main-process attachment independently of the optional Unix SSH
-adapter. TCP readiness remains gated by authenticated session acceptance.
+and retains main-process I/O. MXC has no foreground attachment adapter; create
+command workloads with `--detach`. Preflight rejects foreground attachment
+before provisioning. TCP readiness remains gated by authenticated session acceptance.
 
 Windows boundary execution is implemented by the `openshell-mxc-boundary`
 library behind the dedicated `openshell-windows-sandbox.exe`. The compute driver does not

crates/openshell-driver-mxc/src/driver.rs

@@ -291,6 +291,15 @@ impl MxcComputeBackend {
     }
 
     pub fn validate_sandbox_create(&self, sandbox: &DriverSandbox) -> Result<(), tonic::Status> {
+        if sandbox
+            .spec
+            .as_ref()
+            .is_some_and(|spec| spec.await_main_process_attachment)
+        {
+            return Err(tonic::Status::failed_precondition(
+                "MXC does not support foreground attachment to the main process. Create the sandbox with --detach.",
+            ));
+        }
         openshell_core::resource_admission::check_sandbox_driver_config(
             self.config.allow_driver_config,
             sandbox,
@@ -1364,6 +1373,24 @@ mod tests {
         assert!(!backend.config.state_dir.exists());
     }
 
+    #[tokio::test]
+    async fn foreground_attachment_is_rejected_before_provisioning() {
+        let (backend, mut sandbox, _dir) = preflight_fixture();
+        sandbox.spec.as_mut().unwrap().command =
+            vec!["cmd.exe".into(), "/c".into(), "exit 0".into()];
+        sandbox.spec.as_mut().unwrap().await_main_process_attachment = true;
+        let error = backend.validate_sandbox_create(&sandbox).unwrap_err();
+        assert_eq!(error.code(), tonic::Code::FailedPrecondition);
+        assert!(error.message().contains("--detach"));
+        let error = backend.create_sandbox(&sandbox).await.unwrap_err();
+        assert_eq!(error.code(), tonic::Code::FailedPrecondition);
+        assert!(error.message().contains("foreground attachment"));
+        assert!(backend.get_sandbox(&sandbox.id).await.is_none());
+        assert!(!backend.config.state_dir.exists());
+        sandbox.spec.as_mut().unwrap().await_main_process_attachment = false;
+        assert!(backend.validate_sandbox_create(&sandbox).is_ok());
+    }
+
     #[test]
     fn resource_admission_is_unsupported_and_acknowledged() {
         let config = MxcComputeConfig::default();

crates/openshell-server/src/compute/mod.rs

@@ -8804,7 +8804,7 @@ mod tests {
         });
 
         let error = runtime
-            .validate_sandbox_create_with_runtime_inputs(&sandbox, &runtime_inputs)
+            .validate_sandbox_create_with_runtime_inputs(&sandbox, &runtime_inputs, false)
             .await
             .expect_err("an unsupported driver must reject the effective UI policy");
 

docs/how-it-works/gateways/configuration.mdx

@@ -1239,6 +1239,9 @@ runtime-selected profile.
 
 The MXC driver is Windows-only and opt-in. It links into the gateway and invokes Microsoft MXC through `wxc-exec.exe`. The driver starts `openshell-supervisor --role=isolation-backend` on the host and `openshell-windows-sandbox.exe` inside each ProcessContainer. The standard authenticated Sandbox Protocol and supervisor session provide lifecycle, exec, forwarding, provider refresh, and network policy.
 
+MXC does not support foreground attachment to the main process. Use `--detach`
+when creating a command workload; foreground requests fail during preflight.
+
 The dedicated `openshell-windows-sandbox.exe` uses a Windows boundary library for process operations and forwarding. It replaces the generic sandbox binary in the Windows runtime pair; the supervisor remains a separate host process, not part of the compute driver. No separate supervisor-relay executable is required. Set `wxc_exec_path` to an absolute path; configuration preflight rejects an omitted or relative path. Existing MXC configurations that explicitly select `openshell-sandbox.exe` must update `sandbox_binary_path` to the Windows executable.
 
 The Windows sandbox initiates its authenticated control connection to a generation-scoped loopback listener in the host isolation backend. This follows the Windows relay's connection direction without changing host firewall rules. TLS identity verification and supervisor bearer authentication remain required.