fix(isolation-session): refuse network policy the backend cannot enforce; require the unrestricted-network acknowledgment (#682)

* Refuse dishonest network policy on the IsolationSession backend

The IsolationSession container runs on an unrestricted network (outbound
open; a process inside can listen on a localhost-reachable port) that MXC
cannot filter or deny. Previously the backend accepted the default `Block`
network policy, silently affirming a deny it cannot enforce.

Now provision (and one-shot, which runs the full lifecycle) accept ONLY the
canonical unrestricted-network acknowledgment: network.defaultPolicy=allow +
allowLocalNetwork=true, no allowed/blocked hosts, no proxy, default
enforcement. Everything else (including an absent policy, which defaults to
the unenforceable `Block`) is refused.

Post-provision phases reject any supplied network policy (fixed at provision)
via a new domain `ExecutionRequest.network_specified` flag set from wire
`network` presence in config_parser; an absent policy is inherited. This
closes the domain-model blind spot where an explicit default-valued `Block`
is indistinguishable from absent.

Reworded the network/proxy error messages and added a post-provision
"immutable" message. Updated the happy-path iso test configs to the canonical
form; post-provision and negative-path configs are intentionally unchanged.

Gates: cargo fmt --check; clippy --all-features; cargo test iso ON and OFF
(wxc_common + isolation_session_common green, 84 iso + 456 wxc_common); parser
network_specified tests; wxc_host_prep 16 passed (elevated). Pre-existing env
failures (microvm e2e staging) are identical iso ON/OFF and unrelated.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 47662115-cf22-4564-8930-370dfbee63fb

* SDK: require the unrestricted-network acknowledgment at iso provision

Mirror the Rust-side IsolationSession network fix in the TypeScript SDK.
`IsolationSessionProvisionConfig.network` is now a required field typed as
the exact literal `{ defaultPolicy: 'allow'; allowLocalNetwork: true }`, so
the caller must explicitly acknowledge that the isolation session container
runs on an unrestricted network the backend cannot filter or deny. Any other
value (or a wrong-typed one) is a compile error; the post-provision configs
intentionally expose no `network` field, so the type system enforces the
provision-only rule for SDK callers.

Tests: type-level @ts-expect-error assertions (required network; block and
allowLocalNetwork=false rejected; network rejected on post-provision configs);
provisionSandbox lifts the canonical network to the envelope top level;
updated the conformance oracle's LiftedPhaseKey and the integration test's
provision calls. npm run build + npm test green (207 tests).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 47662115-cf22-4564-8930-370dfbee63fb

* docs: IsolationSession network policy is honesty-gated, not rejected

Update the in-repo docs to match the new behavior: the backend still rejects
all filesystem policy (no host-folder-sharing primitive), but the network
policy is now honesty-gated. Provision (and one-shot) require the canonical
unrestricted-network acknowledgment (network.defaultPolicy=allow +
allowLocalNetwork=true, no host rules, no proxy, default enforcement) and
refuse anything else, including an absent policy; post-provision phases reject
any supplied network policy and inherit an absent one.

Touches: copilot-instructions iso backend row; docs/isolation-session/oneshot
(policy-validation coverage row) + state-aware-rust (prose + policy matrix) +
state-aware-typescript (provision config table gains the required `network`
field); sdk/node/README state-aware example now passes the acknowledgment.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 47662115-cf22-4564-8930-370dfbee63fb

* test: expand IsolationSession network coverage + fix E2E probe

Add end-to-end and integration tests for the new network-acknowledgment
behavior, and fix a latent bug the required-network change introduced in the
SDK E2E probe.

Fix (critical): `probeStateAwareRuntime` (the module-load skip probe in the
SDK integration suite) provisioned iso with no config. With `network` now
required at provision, that returns `policy_validation`, which the probe
rethrows — so on an iso-capable host the whole integration suite would error
at load instead of running. The probe now passes the canonical network
acknowledgment for iso.

New integration tests (sdk/node integration, real wxc-exec): the backend
refuses a provision that (a) omits the network acknowledgment, (b) sends a
non-canonical network (defaultPolicy=block), or (c) omits allowLocalNetwork —
each via an untyped call, proving the runtime guard holds even when a JS
caller bypasses the compile-time type.

New E2E tests (PowerShell VM suites): one-shot refuses block / allow-without-
allowLocalNetwork / allowedHosts; state-aware refuses a non-canonical network
at provision and refuses any network policy on the start and exec
post-provision phases (even the canonical acknowledgment, since it is
immutable post-provision).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 47662115-cf22-4564-8930-370dfbee63fb

* fix: add canonical network ack to iso TTY resize smoke config

The IsolationSession TTY resize smoke (run_isolation_session_resize_smoke.ps1) builds its wxc-exec config inline and was the one manual (-Manual-only) test not covered by the automated suite, so it was missed when the network-acknowledgment requirement landed. Without a network block the backend now rejects it with policy_validation. Add the canonical {defaultPolicy:allow, allowLocalNetwork:true} form (matching isolation_session_powershell_interactive.json) so the manual smoke provisions again.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 47662115-cf22-4564-8930-370dfbee63fb

* docs: align state-aware design + GA networking docs with iso network policy

The cross-backend state-aware design docs and the v2 GA networking scope doc still described IsolationSession as honoring filesystem (not network) at provision, and showed provision examples using network.allowedHosts -- all now rejected by the backend. Align them with shipped behavior and the SDK type: provision honors only the canonical unrestricted-network acknowledgment ({ defaultPolicy: 'allow', allowLocalNetwork: true }); filesystem policy is rejected and ui is ignored.

- networking.md: reword the IsolationSession network-scope line (requires the canonical ack; rejects everything else).

- mxc-state-aware-sandbox-api.md / -overview.md: fix the 10.3 honor matrix (iso filesystem applied->rejected, ui applied->ignored), the SDK-exposure prose, the IsolationSessionProvisionConfig type (required network literal; drop filesystem and ui), and the provision examples (drop filesystem, allowedHosts->allowLocalNetwork).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 47662115-cf22-4564-8930-370dfbee63fb

* docs: address PR review -- stale validator comment, fragile test counts, policy.ui gap

state_aware.rs: the block comment above the validate_<phase> hooks still said network policy was rejected at every phase. That stopped being true when provision started accepting the canonical unrestricted-network acknowledgment. Correct the network clause while keeping the statements that are still true (the backend has no network primitive; proxy policy is rejected at every phase).

oneshot.md: drop the Test Plan Count column and the '~31 backend-specific' / '287 total currently passing' figures. They were already stale (policy.rs has 28 tests, listed as ~24) and the rows never summed to the stated total. No other backend doc or README tracks test counts, so removing them makes this doc consistent and deletes a number that silently rots whenever a test is added. The durable Category / Location / What-it-verifies content stays.

state-aware-rust.md: policy.ui was documented as rejected at every phase, but the backend never validates it, so a supplied UI policy is silently ignored. Correct the matrix to 'ignored' (matching the runtime and the state-aware design doc) and add an explicit known-gap note -- this is the same false-guarantee shape the network honesty gate closes, so rejecting policy.ui is the intended end state, not a deliberate exemption.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 47662115-cf22-4564-8930-370dfbee63fb

* refactor: move network_specified onto ContainerPolicy

Addresses PR review feedback: the presence signal describes the content
of the policy object, not the invocation, so it belongs beside the other
parse-derived policy member (`#[serde(skip)] network_proxy`) rather than
next to ExecutionRequest's invocation flags (experimental_enabled,
testing_features_enabled, dry_run, audit).

Behavior-preserving: the flag is still captured once in the parser
(`convert_wire_config`), which is also the path `mxc_engine::build_request`
round-trips through, so the Rust SDK / FFI / C# callers are unaffected.
`#[serde(skip)]` keeps it off the wire, so the schema and generated SDK
types are unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 47662115-cf22-4564-8930-370dfbee63fb

---------

Co-authored-by: adpa-ms <>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 47662115-cf22-4564-8930-370dfbee63fb

Author: 2 people

.github/copilot-instructions.md

@@ -113,7 +113,7 @@ The Rust workspace (`src/`) implements multiple sandboxing backends behind the `
 | Windows Sandbox | `wxc-exec.exe` | Windows | `backends/windows_sandbox/lifecycle/src/` (live transient one-shot `WindowsSandboxRunner` + state-aware `StatefulSandboxBackend`). Experimental — requires `--experimental`. Supports both **one-shot** (a fresh, disposable VM per invocation with guaranteed teardown, via `ScriptRunner`) and **state-aware** (multi-invocation provision/start/exec/stop/deprovision, via `StatefulSandboxBackend`) modes. State-aware holds a single live VM across separate `wxc-exec` phase processes behind a persistent detached host-side daemon (`backends/windows_sandbox/daemon/`); the OS enforces a single running Windows Sandbox VM per host, so the daemon owns it and reclaims an orphaned VM on restart only via positive process-identity proof. The shared boot sequence (write per-launch nonce, launch VM, capture ownership proof, wait rendezvous, connect) lives in `backends/windows_sandbox/lifecycle/src/vm.rs::launch_managed_vm`; each mode plugs in its own `LaunchObserver` for the per-caller ownership / proof bookkeeping. Honors `readwritePaths`/`readonlyPaths`/`deniedPaths` (HOST paths) at provision via `.wsb` `<MappedFolder>` entries (mapped at the same absolute host path inside the guest; rejects `deniedPaths` equal-to or nested-within a mapped share since `.wsb` has no Deny primitive); filesystem policy is immutable post-provision. Network isolation is enforced unconditionally by the in-guest agent; `network`/`ui` and the Entra `user` bundle are not honored. ID prefix `wsb` (strict `wsb:<8-hex>` grammar). Per-launch handshake: 32-byte `Nonce` + 1-byte `ChannelRole` tag on every TCP connection (boot + reconnect); the guest pairs accepted sockets by declared role, not by accept order. The guest agent binary `wxc-windows-sandbox-guest.exe` (`backends/windows_sandbox/guest/`) is injected into the VM. |
 | MicroVM (NanVix) | `wxc-exec.exe` | Windows | `backends/nanvix/runner/src/lib.rs` — feature-gated behind `microvm` |
 | Hyperlight | `wxc-exec.exe` | Windows | `backends/hyperlight/common/src/lib.rs` — Hyperlight + Unikraft micro-VM backend |
-| IsolationSession | `wxc-exec.exe` | Windows | `backends/isolation_session/common/src/` — feature-gated behind `isolation_session`, experimental, uses the in-proc `Windows.AI.IsolationSession.Preview` `IsoSessionOps` API. Supports both one-shot (single-invocation lifecycle, via `ScriptRunner`) and state-aware (multi-invocation provision/start/exec/stop/deprovision, via `StatefulSandboxBackend`) modes. Rejects all filesystem policy (`readwritePaths`/`readonlyPaths`/`deniedPaths`) plus network and proxy policy at every phase with `policy_validation` — the backend has no host-folder-sharing, network, or proxy primitive. State-aware additionally accepts an optional `user` bundle (`upn`, `wamToken`) at provision and start to provision Entra cloud-agent sandboxes; one-shot rejects the bundle, and hosts that don't support Entra agents surface `backend_unavailable`. Streams stdout/stderr, forwards stdin, and switches to ConPTY mode when wxc-exec's stdout is a TTY for `spawnSandbox` parity. |
+| IsolationSession | `wxc-exec.exe` | Windows | `backends/isolation_session/common/src/` — feature-gated behind `isolation_session`, experimental, uses the in-proc `Windows.AI.IsolationSession.Preview` `IsoSessionOps` API. Supports both one-shot (single-invocation lifecycle, via `ScriptRunner`) and state-aware (multi-invocation provision/start/exec/stop/deprovision, via `StatefulSandboxBackend`) modes. Rejects all filesystem policy (`readwritePaths`/`readonlyPaths`/`deniedPaths`) at every phase with `policy_validation` — the backend has no host-folder-sharing primitive. The container's network is unrestricted (outbound open; a process inside can listen on a localhost-reachable port) and MXC has no primitive to filter or deny it, so provision (and one-shot) accept ONLY the canonical unrestricted-network acknowledgment — `network.defaultPolicy=allow` + `network.allowLocalNetwork=true`, no host rules, no proxy, default enforcement — and refuse anything else (including an absent policy, which defaults to the unenforceable deny) with `policy_validation`; post-provision phases reject any supplied network policy (fixed at provision, tracked via `ExecutionRequest.network_specified`) and inherit an absent one. State-aware additionally accepts an optional `user` bundle (`upn`, `wamToken`) at provision and start to provision Entra cloud-agent sandboxes; one-shot rejects the bundle, and hosts that don't support Entra agents surface `backend_unavailable`. Streams stdout/stderr, forwards stdin, and switches to ConPTY mode when wxc-exec's stdout is a TTY for `spawnSandbox` parity. |
 | LXC | `lxc-exec` | Linux | `core/lxc/src/main.rs` + `backends/lxc/common/` |
 | Seatbelt | `mxc-exec-mac` | macOS | `core/mxc_darwin/src/main.rs` + `backends/seatbelt/common/` — uses macOS App Sandbox (Seatbelt) profiles for process containment. Requires schema `0.7.0-alpha`+. Supports `network.proxy` via the same cooperative env-var model as Bubblewrap (injects `HTTP_PROXY`/`HTTPS_PROXY` into the sandbox, reusing `wxc_common::unix_proxy_coordinator`; `builtinTestServer` spawns the shared `unix-test-proxy`). See `docs/macos-support/seatbelt-backend.md`. |
 | Bubblewrap | `lxc-exec` | Linux | `backends/bubblewrap/common/src/bwrap_runner.rs` — unprivileged sandboxing via Linux user namespaces and `bwrap`. Experimental — requires `--experimental`. Uses shared filesystem/network policy fields; per-host network filtering via `NetworkIptablesManager` from `backends/lxc/common`. See `docs/bwrap-support/bubblewrap-backend.md`. |

docs/isolation-session/oneshot.md

@@ -239,16 +239,16 @@ versions and stating that the bindings must be regenerated.
 
 **Automated (`cargo test`, runs on any machine including CI):**
 
-| Category | Count | Location | What it verifies |
-|---|---:|---|---|
-| Config parsing | ~8 | `config_parser.rs` | `"isolation_session"` containment value and `experimental.isolation_session` section parsing |
-| Policy validation | ~15 | `policy.rs` | Every filesystem field (`readwritePaths` / `readonlyPaths` / `deniedPaths`), network, and proxy policy is rejected at every phase |
-| Option building | ~6 | `isolation_session_runner.rs` | `ExecutionRequest` → `ProcessOptions` mapping (timeout, cwd, env vars, redirect flags) |
-| Feature unavailable | 1 | `isolation_session_runner.rs` | Runner returns a clean error on machines without the IsolationSession feature enabled, so the test passes everywhere |
-
-These ~22 backend-specific tests run alongside the existing workspace tests
-(287 total currently passing). The feature-unavailable test is what runs in
-CI, since CI machines do not have a Windows build with the IsolationSession feature enabled.
+| Category | Location | What it verifies |
+|---|---|---|
+| Config parsing | `config_parser.rs` | `"isolation_session"` containment value and `experimental.isolation_session` section parsing |
+| Policy validation | `policy.rs` | Filesystem fields (`readwritePaths` / `readonlyPaths` / `deniedPaths`) are rejected at every phase; the network policy must be the canonical unrestricted-network acknowledgment (`defaultPolicy=allow` + `allowLocalNetwork=true`, no host rules or proxy) at provision, and any supplied network policy is rejected post-provision |
+| Option building | `isolation_session_runner.rs` | `ExecutionRequest` → `ProcessOptions` mapping (timeout, cwd, env vars, redirect flags) |
+| Feature unavailable | `isolation_session_runner.rs` | Runner returns a clean error on machines without the IsolationSession feature enabled, so the test passes everywhere |
+
+These backend-specific tests run alongside the existing workspace tests. The
+feature-unavailable test is what runs in CI, since CI machines do not have a
+Windows build with the IsolationSession feature enabled.
 
 **Integration tests (require a Windows host with the IsolationSession feature enabled):**
 

docs/isolation-session/state-aware-rust.md

@@ -111,19 +111,28 @@ described in [Idempotence](#idempotence-per-phase).
 ## Cross-cutting policy honor matrix
 
 IsolationSession rejects every `policy.filesystem` field (`readwritePaths`,
-`readonlyPaths`, `deniedPaths`), all `policy.network` policy, and
-`policy.network.proxy` at every phase — provision included. The backend has
-no host-folder-sharing, network, or proxy primitive, so there is nothing to
-honor. The only caller-supplied knob it accepts is the optional Entra `user`
-bundle, at provision and start.
+`readonlyPaths`, `deniedPaths`) at every phase — provision included. The
+backend has no host-folder-sharing primitive, so there is nothing to honor.
+
+The container's network is unrestricted (outbound open; a process inside can
+listen on a port reachable from outside via localhost) and MXC has no
+primitive to filter or deny it. So the network policy is honesty-gated rather
+than silently accepted: **provision** (and one-shot) accept only the canonical
+unrestricted-network acknowledgment — `defaultPolicy=allow` +
+`allowLocalNetwork=true`, no `allowedHosts`/`blockedHosts`, no proxy, default
+enforcement — and refuse anything else, including an absent policy (which
+defaults to the unenforceable `block`). On the **post-provision** phases the
+network posture is fixed at provision, so any supplied network policy is
+rejected and an absent one is inherited. The only other caller-supplied knob
+it accepts is the optional Entra `user` bundle, at provision and start.
 
 | Field | provision | start | exec | stop | deprovision |
 |---|---|---|---|---|---|
 | `policy.filesystem.{readwritePaths,readonlyPaths}` | rejected | rejected | rejected | rejected | rejected |
 | `policy.filesystem.deniedPaths` | rejected | rejected | rejected | rejected | rejected |
-| `policy.network.{allowedHosts,blockedHosts,defaultPolicy}` | rejected | rejected | rejected | rejected | rejected |
-| `policy.network.proxy` | rejected | rejected | rejected | rejected | rejected |
-| `policy.ui` | rejected | rejected | rejected | rejected | rejected |
+| `policy.network` — canonical `allow` acknowledgment (`defaultPolicy=allow` + `allowLocalNetwork=true`, no host rules, no proxy, default enforcement) | **required** | rejected | rejected | rejected | rejected |
+| `policy.network` — any other value (incl. absent → `block`, host rules, proxy) | rejected | rejected | rejected | rejected | rejected |
+| `policy.ui` — see the known gap below | ignored | ignored | ignored | ignored | ignored |
 | `experimental.isolation_session.{provision,start}.user` | **honored** | **honored** | n/a | n/a | n/a |
 
 Rejection of `policy.*` fields surfaces as `error.code = "policy_validation"`.
@@ -146,11 +155,20 @@ user it assigned at provision.
 ### Policy fields and mode parity
 
 Both modes share the same policy matrix above. Every `policy.filesystem`
-field (`readwritePaths`, `readonlyPaths`, `deniedPaths`), all `policy.network`
-policy, `policy.network.proxy`, and `policy.ui` are rejected at every phase —
-the backend has no host-folder-sharing, network, or proxy primitive. One-shot
-enforces this via `validate_runner`; state-aware enforces it via the
-`validate_<phase>` hooks.
+field (`readwritePaths`, `readonlyPaths`, `deniedPaths`) is rejected at every
+phase (no host-folder-sharing primitive). The network policy is honesty-gated
+per the matrix — provision requires the canonical unrestricted-network
+acknowledgment and post-provision rejects any supplied network policy
+(inheriting an absent one). One-shot enforces this via `validate_runner`;
+state-aware enforces it via the `validate_<phase>` hooks.
+
+**Known gap — `policy.ui` is silently ignored.** The backend has no
+UI-restriction primitive, and it does not validate `policy.ui`, so a supplied
+UI policy is accepted and then dropped rather than refused. That is the same
+false-guarantee shape the network honesty gate closes: a caller asking for a
+UI restriction gets no error and no enforcement. Rejecting `policy.ui` is the
+intended end state, not a deliberate exemption — the matrix records `ignored`
+because that is the current behavior, not the desired one.
 
 ### Fields valid in state-aware only
 

docs/isolation-session/state-aware-typescript.md

@@ -47,6 +47,7 @@ contract (including fields not yet exposed via the SDK).
 | Field | Type | Default | Description |
 |---|---|---|---|
 | `version` | string | SDK `SUPPORTED_VERSION` | Schema-version override. |
+| `network` | `{ defaultPolicy: 'allow'; allowLocalNetwork: true }` | — (**required**) | Unrestricted-network acknowledgment. The container runs on a network MXC cannot filter or deny (outbound open; a process inside can listen on a port reachable from outside via localhost), so the caller must explicitly acknowledge it. This exact value is the only one accepted; any other network policy (or omission) is rejected at provision, and `network` is not accepted on the post-provision phases (the posture is fixed at provision). |
 | `user` | `IsolationSessionUserConfig` | absent | Optional Entra credentials (see below). |
 
 **Metadata (`IsolationSessionProvisionMetadata`):**

docs/sandbox-policy/v2/networking.md

@@ -317,7 +317,7 @@ Same model and enforcement as WSLc (model 2 achievable; iptables/nftables on the
 ### Other backends
 
 - **Windows Sandbox:** Guest-side firewall only, with hardcoded rules. In GA for development/testing scenarios where network isolation is not critical.
-- **Isolation Session:** No network configuration support (all network/proxy fields rejected at validation time). In GA for process isolation only (filesystem, identity, lifecycle).
+- **Isolation Session:** No network filtering or denial is possible — outbound is open and a process inside can listen on a localhost-reachable port. Provision therefore requires the canonical unrestricted-network acknowledgment (`network.defaultPolicy=allow` + `network.allowLocalNetwork=true`) and rejects every other network/proxy policy at validation time. In GA for process isolation only (identity, lifecycle).
 - **Hyperlight, Nanvix:** Not in this GA scope doc. Additional follow up is needed to confirm their capabilities and whether they align with this doc.
 
 ## Gaps and limitations

docs/state-aware-lifecycle/mxc-state-aware-sandbox-api-overview.md

@@ -290,8 +290,7 @@ Provision and exec — the two most distinctive shapes. Reference §7.4 has all
 
 ```typescript
 const config: IsolationSessionProvisionConfig = {
-  filesystem: { readwritePaths: ['C:\\workspace'] },
-  network: { defaultPolicy: 'allow', allowedHosts: ['api.anthropic.com'] },
+  network: { defaultPolicy: 'allow', allowLocalNetwork: true },
 };
 const { sandboxId } = await provisionSandbox(
   'isolation_session',
@@ -306,8 +305,7 @@ const { sandboxId } = await provisionSandbox(
   "version": "0.6.0-alpha",
   "containment": "isolation_session",
   "phase": "provision",
-  "filesystem": { "readwritePaths": ["C:\\workspace"] },
-  "network": { "defaultPolicy": "allow", "allowedHosts": ["api.anthropic.com"] }
+  "network": { "defaultPolicy": "allow", "allowLocalNetwork": true }
 }
 ```
 
@@ -370,8 +368,9 @@ Cross-backend exec fields flow through top-level `process`. Cross-cutting fields
 (`filesystem` / `network` / `ui`) on the per-(backend, phase) Config map directly to
 top-level wire fields (backend declares per-phase honor per reference §10.3). The
 SDK Config exposes only the cross-cutting fields the runtime currently honors —
-for IsolationSession at provision today that's `filesystem`; `network` and `ui` are
-added when the runtime honors them.
+for IsolationSession at provision that's `network` — the required unrestricted-network
+acknowledgment (`{ defaultPolicy: 'allow', allowLocalNetwork: true }`); `filesystem` is
+rejected.
 
 ## Error codes
 

docs/state-aware-lifecycle/mxc-state-aware-sandbox-api.md

@@ -268,9 +268,10 @@ type StateAwareContainmentBackend = Extract<ContainmentBackend, 'isolation_sessi
 
 interface IsolationSessionProvisionConfig {
   version?: string;
-  filesystem?: FilesystemConfig;
-  network?: NetworkConfig;
-  ui?: UiConfig;
+  // IsolationSession cannot filter or deny the container network, so provision
+  // requires the canonical unrestricted-network acknowledgment — the only accepted
+  // value. filesystem policy is rejected by this backend (§10.3).
+  network: { defaultPolicy: 'allow'; allowLocalNetwork: true };
 }
 
 interface IsolationSessionStartConfig {
@@ -500,18 +501,14 @@ import {
   execInSandboxAsync,
   stopSandbox,
   deprovisionSandbox,
-  getAvailableToolsPolicy,
   IsolationSessionProvisionConfig,
   SandboxSpawnOptions,
 } from '@microsoft/mxc-sdk';
 
-const tools = getAvailableToolsPolicy();
 const provisionConfig: IsolationSessionProvisionConfig = {
-  filesystem: {
-    readwritePaths: ['C:\\workspace', ...tools.readwritePaths],
-    readonlyPaths: tools.readonlyPaths,
-  },
-  network: { defaultPolicy: 'allow', allowedHosts: ['api.anthropic.com'] },
+  // IsolationSession cannot filter or deny the container network, so provision
+  // requires the canonical unrestricted-network acknowledgment (the only accepted value).
+  network: { defaultPolicy: 'allow', allowLocalNetwork: true },
 };
 
 // IsolationSession is experimental, so every call carries `experimental: true`.
@@ -570,8 +567,10 @@ The existing policy-discovery helpers (`getAvailableToolsPolicy`,
 `getUserProfilePolicy`, `getTemporaryFilesPolicy`) compose with state-aware Configs
 unchanged. They produce `FilesystemPolicyResult` fragments — `{ readonlyPaths,
 readwritePaths }` — whose shape matches `FilesystemConfig`'s readonly / readwrite path
-arrays. Consumers merge the fragments directly into a state-aware Config's `filesystem`
-field, as in the §6.3 example.
+arrays. Consumers merge the fragments directly into the `filesystem` field of a
+state-aware Config for a backend that honors filesystem policy at provision (e.g.
+WindowsSandbox); IsolationSession rejects filesystem policy, so its provision Config
+omits it.
 
 ## 7. Wire contract
 
@@ -795,8 +794,7 @@ shape, across all five phases.
 
 ```typescript
 const config: IsolationSessionProvisionConfig = {
-  filesystem: { readwritePaths: ['C:\\workspace'] },
-  network: { defaultPolicy: 'allow', allowedHosts: ['api.anthropic.com'] },
+  network: { defaultPolicy: 'allow', allowLocalNetwork: true },
 };
 const { sandboxId } = await provisionSandbox(
   'isolation_session',
@@ -811,8 +809,7 @@ const { sandboxId } = await provisionSandbox(
   "version": "0.6.0-alpha",
   "containment": "isolation_session",
   "phase": "provision",
-  "filesystem": { "readwritePaths": ["C:\\workspace"] },
-  "network": { "defaultPolicy": "allow", "allowedHosts": ["api.anthropic.com"] }
+  "network": { "defaultPolicy": "allow", "allowLocalNetwork": true }
 }
 ```
 
@@ -1560,9 +1557,9 @@ documented in the backend's plan doc):
 
 | Field | provision | start | exec | stop | deprovision |
 |---|---|---|---|---|---|
-| `filesystem` | applied | rejected | rejected | rejected | rejected |
+| `filesystem` | rejected | rejected | rejected | rejected | rejected |
 | `network` | applied | rejected | rejected | rejected | rejected |
-| `ui` | applied | rejected | rejected | rejected | rejected |
+| `ui` | ignored | ignored | ignored | ignored | ignored |
 
 For WindowsSandbox, filesystem policy (readwrite/readonly/denied HOST paths) is
 applied at provision and frozen for the life of the sandbox; later phases reject it.
@@ -1586,8 +1583,9 @@ unconditionally by the in-guest agent). WindowsSandbox has no Entra `user` bundl
   the backend does not honor at that phase, and also fields the matrix would mark as
   `applied` but the runtime does not yet implement. For IsolationSession's matrix
   above, `IsolationSessionProvisionConfig` is the only Config that carries any
-  cross-cutting fields. The SDK currently exposes `filesystem` only; `network` and
-  `ui` will be added at provision when the IsolationSession runtime honors them.
+  cross-cutting fields. The SDK exposes `network` at provision — the required
+  unrestricted-network acknowledgment (`{ defaultPolicy: 'allow', allowLocalNetwork:
+  true }`), the only value the backend accepts; `filesystem` is rejected.
   The start, exec, stop, and deprovision Configs carry none of these fields. Callers
   cannot accidentally pass them.
 - **Runtime enforcement at Rust.** The backend's `validate_<phase>` hooks reject