[Soham Das (SohamDas2021)]

📖 Description

Prevents unresponsive filesystem-policy paths from hanging sandbox startup. Probes now fail closed after five seconds, with a 16-worker cap, preserved Windows caller identity, and native-library lifetime protection.

Covers Bubblewrap, LXC, WSLC, and shared parser checks. The deadline is per probe, not total startup. Retires the outdated June 2026 roadmap; no public API or schema changes.

🔗 References

ADO 63911175; original report: #604, closed after moving tracking to ADO.

No separate design/API spec: this fixes bounded I/O in existing launch checks without adding an API, schema field, or backend.

🔍 Validation

Passed: 270 targeted Windows tests, 213 Ubuntu/WSL tests, native-library unload regression on both, formatting, and strict Clippy. Native macOS and full backend E2E validation remain for CI; live unreachable NFS/FUSE scenarios were not run.

Exact commands and results (from src)

Platform	Command	Result
Windows	cargo test --locked --quiet -p mxc-sdk --lib --features wslc,isolation_session -- filesystem_ policy_mapping owned_thread config_parser module_lifetime backend_modules::wslc::common::sandbox::tests	270 passed
Ubuntu/WSL	cargo test --locked --quiet -p mxc-sdk --lib -- filesystem_ bwrap_runner policy_mapping config_parser module_lifetime	213 passed
Both	cargo build --locked --quiet -p mxc-sdk --example module_lifetime_fixture	Passed
Both	cargo test --locked --quiet -p mxc-sdk --test module_lifetime	1 passed per host
Windows	cargo fmt --all -- --check	Passed
Windows	cargo clippy --locked --quiet -p mxc-sdk --lib --tests --examples --features wslc,isolation_session -- -D warnings	Passed
Ubuntu/WSL	cargo clippy --locked --quiet -p mxc-sdk --lib --tests --examples -- -D warnings	Passed

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• For features or changes requiring a spec: linked the issue with maintainer-applied feature-accepted
• For implementation: linked the required approved and merged design/API spec, or explained why no spec is required
• Feature issue remains open unless this PR completes all agreed implementation, validation, and documentation
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see pull request builds)

Cargo.lock is unchanged. CLA status is for the author to confirm; feature-specific and instruction-update items are not applicable.

📋 Issue Type

• Bug fix
• Feature
• Task

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

Regression coverage is incomplete: Linux CI skips the unload fixture and test, while stalled policy paths lack end-to-end SDK/CLI checks for bounded rejection without workload execution, including WSLC provisioning.

2 open issues

• Add bounded stalled-policy rejection tests for SDK and CLI paths · New
• Add module lifetime fixture to Linux CI regression coverage · New

What changed in this PR

Bounds filesystem-policy checks in MXC’s shared parser and Bubblewrap, LXC, and WSLC startup paths, addressing hangs caused by unresponsive filesystems without changing public APIs or schemas.

Changes:

• Adds five-second per-probe deadlines and a shared 16-worker limit, rejecting startup on timeout or worker failure.
• Preserves Windows caller identity and protects detached workers from native-library unloading.
• Adds timeout and library-lifetime tests, documents behavior and limitations, and retires the outdated roadmap.

File	Description
src/​mxc-sdk/​tests/​module_lifetime.rs	Adds subprocess-based library-unload regression coverage.
src/​mxc-sdk/​tests/​fixtures/​module_lifetime.rs	Provides the detached-worker library fixture.
src/​mxc-sdk/​src/​core/​mxc_common/​process_util.rs	Shares Windows impersonation-token duplication.
src/​mxc-sdk/​src/​core/​mxc_common/​module_lifetime.rs	Adds cross-platform native-module lifetime protection.
src/​mxc-sdk/​src/​core/​mxc_common/​mod.rs	Registers the new internal modules.
src/​mxc-sdk/​src/​core/​mxc_common/​filesystem_probe.rs	Implements bounded workers, deadlines, and identity handling.
src/​mxc-sdk/​src/​core/​mxc_common/​filesystem_object.rs	Bounds filesystem-object identity checks.
src/​mxc-sdk/​src/​core/​mxc_common/​filesystem_access.rs	Bounds delegation checks.
src/​mxc-sdk/​src/​core/​mxc_common/​config_parser.rs	Bounds existence probes and propagates probe failures.
src/​mxc-sdk/​src/​backends/​wslc/​common/​sandbox.rs	Reuses shared module protection for stream pumps.
src/​mxc-sdk/​src/​backends/​wslc/​common/​policy_mapping.rs	Bounds denied-path overlap resolution.
src/​mxc-sdk/​src/​backends/​lxc/​common/​filesystem_mounts.rs	Bounds mount-path resolution and mask classification.
src/​mxc-sdk/​src/​backends/​isolation_session/​common/​owned_thread.rs	Reuses shared token duplication.
src/​mxc-sdk/​src/​backends/​bubblewrap/​common/​bwrap_runner.rs	Bounds denied-path resolution and classification.
src/​mxc-sdk/​Cargo.toml	Registers the library fixture and test dependency.
docs/​schema.md	Documents deadlines, failure behavior, and resource limits.
docs/​development/​README.md	Removes the retired roadmap link.
docs/​development/​plans/​linux-wsl-roadmap-june-2026.md	Deletes the outdated roadmap.
docs/​development/​build-and-test/​pull-requests.md	Documents the library-unload regression commands.
docs/​backends/​wslc/​wsl-container-getting-started.md	Explains provisioning probe deadlines.
docs/​backends/​lxc/​lxc-backend.md	Links filesystem timeout guidance.
docs/​backends/​bwrap/​bubblewrap-backend.md	Links filesystem timeout guidance.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Runtime validation on macOS and a genuinely stalled filesystem remains missing, leaving detached-worker safety across native-library unloads and full backend startup unconfirmed.

2 open issues

• Add module lifetime fixture to Linux CI regression coverage
• Add bounded stalled-policy rejection tests for SDK and CLI paths

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

SDK/FFI unload safety needs further confirmation because native macOS validation is pending and reported testing excludes live unreachable NFS/FUSE paths and full backend E2E.

2 open issues

• Add module lifetime fixture to Linux CI regression coverage
• Add bounded stalled-policy rejection tests for SDK and CLI paths

_{Review effort: Balanced}

[Gudge (MGudgin)]

Summary

Reviewed this revision across 11 axes. The two retained findings concern regression coverage for behavior introduced by this PR, not confirmed runtime or containment failures. Please address the High backend-probe coverage gap before merging.

Source inspection found that the changed callers propagate probe errors and that FilesystemProbe::submit pins its containing module before spawning a worker. Independent Windows runs during this review passed:

• cargo test --locked --offline -p mxc-sdk --lib filesystem_probe::tests -- --nocapture: 9 passed.
• cargo build --locked --offline -p mxc-sdk --example module_lifetime_fixture: passed.
• cargo test --locked --offline -p mxc-sdk --test module_lifetime: 1 passed.
• cargo test --locked --offline -p mxc-sdk --lib --features wslc,isolation_session filesystem_probe::launch_tests:: -- --ignored: 2 passed.

Commands ran from src. Linux runtime verification was blocked by local WSL access denial; native macOS and full backend E2E were not run. A separate CI-script test attempt was blocked in setup by local sandbox access to toolchain settings.

The head is unchanged from the reviewed revision. The branch is behind main; attribution was rechecked against the merge-base diff displayed by GitHub. Both inline anchors are added lines, and the local diff matches GitHub after ignoring index hash abbreviation lengths.

Verified pre-existing - not attributed to this PR

None among the two retained findings. Both were verified as introduced_by_change; neither treats a pre-existing runtime bug as an additional merge condition.

[Copilot]

🔵 Needs a closer look

Library-unload safety and Windows caller impersonation changes require human review of outstanding native macOS and backend E2E CI results.

No open issues 🎉

2 resolved since last review

• Add module lifetime fixture to Linux CI regression coverage
• Add bounded stalled-policy rejection tests for SDK and CLI paths

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Detached-worker lifetime and native-library unload safety depend on platform-specific behavior, with macOS unload and full LXC/WSLC backend validation still pending.

No open issues 🎉

_{Review effort: Balanced}