[Huzaifa Danish (huzaifa-d)]

📖 Description

Prevent legacy network host lists from silently changing or bypassing the selected network.defaultPolicy across shared validation, backend lowering, and SDK-generated requests.

• Enforce the valid legacy defaultPolicy/host-list matrix in shared wxc_common validation while keeping policy models as raw data.
• Make NanVix and Hyperlight lower the same validated legacy semantics, retaining backend-specific rejection when a microVM filter cannot represent both lists.
• Make Node and Rust SDK builders emit a block default whenever an allowlist narrows outbound access; reject blocklist-only policies unless outbound is otherwise allowed. The C# SDK inherits the corrected Rust builder behavior through mxc_ffi.
• Migrate affected Bubblewrap and LXC fixtures to equivalent valid shapes and update the LXC CIDR harness to assert its new default-DROP posture.
• Keep Seatbelt backend tests on shared-valid inputs so they continue exercising backend representability, and correct their remediation guidance.
• Correct Seatbelt, Bubblewrap, and cross-SDK documentation to distinguish shared validity, SDK construction, and backend representability.

🔗 References

Resolves #787

🔍 Validation

• node scripts/versioning/validate-configs.js
• npm test and npm run typecheck from sdk/node
• cargo fmt --all -- --check
• cargo test -p wxc_common
• cargo test -p mxc_engine policy
• cargo test -p mxc-sdk --test sdk_helpers
• cargo test -p seatbelt_common --lib
• cargo check -p seatbelt_common --tests --target aarch64-apple-darwin
• cargo clippy -p seatbelt_common --tests --target aarch64-apple-darwin -- -D warnings
• cargo test -p nanvix_runner
• cargo test -p hyperlight_common --features hyperlight
• cargo clippy -p wxc_common -p nanvix_runner --all-targets -- -D warnings
• cargo clippy -p hyperlight_common --all-targets --features hyperlight -- -D warnings
• cargo clippy -p mxc_engine -p mxc-sdk --all-targets -- -D warnings

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (not applicable; this correction does not change repository build commands, architecture, or contributor conventions)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (not applicable; Cargo.lock is unchanged)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See docs/pull-requests.md.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See docs/pull-requests.md
for the steps.

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Copilot review overview

Review tier: Balanced
Findings: None

What changed in this PR

Fixes NanVix networking so blockedHosts cannot widen block-default policies.

Changes:

• Rejects blocklists unless defaultPolicy is allow.
• Makes network enablement fail-safe and adds regression tests.
• Documents supported policy combinations.

File	Description
src/​backends/​nanvix/​runner/​src/​lib.rs	Implements validation, fail-safe enablement, and tests.
docs/​nanvix-microvm/​nanvix.md	Documents the network-policy matrix.
docs/​superpowers/​specs/​2026-08-31-nanvix-blocked-hosts-default-policy-design.md	Records the fix design.
docs/​superpowers/​plans/​2026-08-31-nanvix-blocked-hosts-default-policy.md	Records the implementation plan.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Copilot review overview

Review tier: Balanced
Findings: None

[Copilot]

Copilot review overview

Review tier: Balanced
Findings: None

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Jeff Whiteside (jsidewhite)]

Per-host egress filtering

This is policy that applies equally to all backends. Can we unify the documentation on this in the backend-agnostic location?

---

Refers to: docs/nanvix-microvm/nanvix.md:164 in f900351. [](commit_id = f900351, deletion_comment = False)

[Jeff Whiteside (jsidewhite)]

🕐

[Copilot]

Copilot review overview

🟢 Approval recommended

Shared validation, SDK projection, backend behavior, fixtures, tests, and documentation are consistently aligned.

Review effort: Balanced
Findings: 1

Open (1)

• Update stale firewall policy and rule-order test documentation

Resolved since last review (2)

• Preserve allowOutbound for Windows Node allowlist requests
• Split unrelated validation-fleet changes from the host-list fix

[Jeff Whiteside (jsidewhite)]

fn validate_policies(request: &ExecutionRequest) -> Result<(), RunnerError> {

todo future: remove this

---

Refers to: src/backends/hyperlight/common/src/lib.rs:476 in 6f0a5ef. [](commit_id = 6f0a5ef, deletion_comment = False)

[Jeff Whiteside (jsidewhite)]

    }

remove this? you already put it in validator.rs

fn validate_legacy_host_lists(request: &ExecutionRequest) -> Result<(), ScriptResponse> {
    let policy = &request.policy;

    if policy.default_network_policy == NetworkPolicy::Block
        && policy.allowed_hosts.is_empty()
        && !policy.blocked_hosts.is_empty()
    {
        return Err(ScriptResponse::error(
            "blockedHosts requires allowedHosts when network.defaultPolicy='block'",
        ));
    }

    if policy.default_network_policy == NetworkPolicy::Allow && !policy.allowed_hosts.is_empty() {
        return Err(ScriptResponse::error(
            "allowedHosts requires network.defaultPolicy='block'",
        ));
    }

    Ok(())
}

---

Refers to: src/backends/hyperlight/common/src/lib.rs:490 in 6f0a5ef. [](commit_id = 6f0a5ef, deletion_comment = False)

[Jeff Whiteside (jsidewhite)]

🕐

[Copilot]

Copilot review overview

🔵 Needs a closer look

It changes security-boundary networking semantics across several platform backends and SDK request paths, requiring final human validation.

Review effort: Balanced
Findings: 1

Open (1)

• Update stale firewall policy and rule-order test documentation

[Copilot]

Copilot review overview

🔵 Needs a closer look

Node and Rust builders still accept invalid blocklist-only authoring on Unix instead of enforcing the documented SDK contract.

Review effort: Balanced
Findings: 1

Open (1)

• Update stale firewall policy and rule-order test documentation

Previously missed (2)

In code that hasn't changed since last review

Do not defer blocklist-only validation on Unix

sdk/​node/​src/​sandbox.ts:544

This Unix exception still applies to both host lists, so blockedHosts with neither allowedHosts nor allowOutbound is emitted as defaultPolicy: 'block' and only fails later during backend execution. That contradicts the SDK contract documented in this PR that blocklist-only authoring is rejected unless outbound is otherwise allowed. Reject that shape before applying the backend-specific exception; only bare allowlists should be deferred.

Reject blocklist-only policies during request authoring

src/​core/​mxc-sdk/​tests/​sdk_helpers.rs:183

The Unix branch codifies the opposite of the stated Rust SDK contract: build_request succeeds for a blocklist-only policy even though the generated block-default request is invalid under the new shared matrix. Add an authoring check for blocked_hosts non-empty with both allowed_hosts empty and allow_outbound == false, then require this case to fail on every platform rather than deferring it to execution.

[Jeff Whiteside (jsidewhite)]