src/core/wxc_common/src/wire.rs:289

• These fields are now accepted by the public wire format, but convert_wire_config never reads net.egress or net.ingress (config_parser.rs:787-820). The SDK also serializes a prebuilt ContainerConfig unchanged (helper.ts:287), so a caller can request deny rules or hostLoopback: "deny" and execution succeeds under the legacy policy instead. For a security policy this is fail-open; map and enforce these fields atomically, or explicitly reject their presence until enforcement lands.

    /// Outbound policy rules.
    pub egress: Option<NetworkEgress>,
    /// Inbound policy.
    pub ingress: Option<NetworkIngress>,

src/core/wxc_common/src/wire.rs:294

• Network is the deserialization target for every supported schema version, so replacing (rather than augmenting) its legacy members makes released 0.6/0.7 configs fail with unknown-field errors. This is a breaking wire change, not just an additive GA contract. Keep the legacy fields until version-aware migration/removal is implemented.

    /// Outbound policy rules.
    pub egress: Option<NetworkEgress>,
    /// Inbound policy.
    pub ingress: Option<NetworkIngress>,

sdk/node/src/types.ts:215

• The parser does not inspect egress in this PR, and cidr is just a String, so values such as example.com deserialize successfully. The public SDK must not promise that DNS names are rejected until that validation exists; otherwise consumers receive a false guarantee about the accepted contract.

  /**
   * Outbound (egress) policy: allow/deny rules matched on destination
   * CIDR range plus port and protocol. DNS hostnames are not permitted here;
   * the parser rejects them.

src/core/wxc_common/src/wire.rs:294

• Replacing the legacy fields makes this branch uncompilable: config_parser.rs:788-819 still reads net.proxy, default_policy, enforcement_mode, allow_local_network, allowed_hosts, and blocked_hosts, all of which no longer exist. Because this object also denies unknown fields, it would break every legacy network config, contrary to the linked migration contract. Keep the legacy fields alongside egress/ingress; precedence can be implemented in the follow-up parser change.

pub struct Network {
    /// Outbound policy rules.
    pub egress: Option<NetworkEgress>,
    /// Inbound policy.
    pub ingress: Option<NetworkIngress>,

tests/configs/bubblewrap_network_proxy_builtin.json:11

• Removing proxy.builtinTestServer means run_bwrap_network_proxy_test.sh no longer starts or routes through the bundled proxy; it merely performs a direct curl and accepts PROXY_OK. This makes the named proxy E2E test vacuous. Keep the legacy proxy config until its replacement is parsed and enforced.

    "egress": {
      "default": "allow"
    }

tests/configs/bubblewrap_network_proxy_allowlist.json:11

• This removes both the built-in proxy and its allowlist from a config still executed as the “proxy allowlist” case by run_bwrap_network_proxy_test.sh:41. With direct egress, the test no longer exercises proxy filtering, and BLOCKED_OK can be produced by an unrelated network/DNS failure. Restore the policy until the GA proxy migration exists.

    "egress": {
      "default": "allow"
    }

tests/configs/bubblewrap_network_proxy_blocklist.json:11

• This config is still run as the “proxy blocklist” E2E case, but the change removes both the proxy and blockedHosts. Consequently it no longer verifies that the proxy blocks the configured host; the nonexistent evil.example.com can yield BLOCKED_OK without any policy enforcement. Retain the legacy proxy policy until a parsed replacement is available.

    "egress": {
      "default": "allow"
    }

tests/configs/lxc_network_test.json:15

• The LXC network script executes this config and expects wget https://api.github.com/zen to succeed. An empty network policy defaults to block and no longer contains the GitHub exception, so run_lxc_network_test.sh exits at this command. Preserve the legacy allow rule until GA egress parsing/enforcement is present.

  "network": {}

tests/examples/22_mac_network_allow_all.json:17

• This example declares the immutable stable 0.7 schema, which has no network.egress property, so the new block is invalid against its own $schema. It also cannot preserve allow-all behavior in this parser-only state because egress is not consumed. Keep the 0.7 defaultPolicy syntax or move the entire example to the new schema/version after parser support lands.
  tests/examples/23_mac_blocked_hosts_unsupported.json:12
• This file still points to the stable 0.7 schema, where egress is an unknown property, so schema validation must reject it. Moreover, removing blockedHosts defeats this example's stated unsupported-policy scenario and can allow echo this should not run once GA egress is implemented. Restore the legacy 0.7 policy or update the example's schema/version and equivalent deny rule together.
  tests/configs/proxy_builtin_test.json:19
• This config is the ProcessContainer proxy E2E input (e2e_windows.rs:264-273 and run_processcontainer_proxy_tests.ps1:36-52), but an empty network section no longer enables builtinTestServer. The test can now pass using direct internetClient connectivity without exercising proxy setup. Restore the proxy selector until a replacement is available.

  "network": {},

tests/configs/network_both_test.json:19

• This is the both enforcement test, but {} selects the default Capabilities mode, so neither the both path nor firewall host filtering is exercised. Because the command reports leaks only by printing text, the config can still exit successfully. Keep the explicit legacy policy until equivalent GA parsing exists.

  "network": {},

src/core/wxc_common/src/models.rs:407

• This domain shape cannot represent the GA wire contract losslessly: destinations drops each destination's except list, ports drops endPort, and separate port/protocol vectors lose each selector's pairing. It is also not populated anywhere despite the doc comment. Since parser/model work is declared out of scope, remove these unused types; otherwise model destinations and port selectors structurally before a follow-up parser starts depending on them.

pub struct EgressRule {
    /// IPv4/IPv6 CIDR ranges or bare IP addresses.
    pub destinations: Vec<String>,
    pub ports: Vec<u16>,
    pub protocols: Vec<Protocol>,

tests/examples/22_mac_network_allow_all.json:17

• This example still declares and links the immutable 0.7 schema, where network.egress is not a valid property, so editor/schema validation will reject the migrated example. Point it at the 0.8 dev schema and declare version 0.8, or retain the 0.7 network shape.
  tests/examples/23_mac_blocked_hosts_unsupported.json:12
• This example still declares and links the immutable 0.7 schema, which rejects the newly added network.egress property. Update the schema reference/version to the 0.8 dev contract (or keep the legacy 0.7 field) so the example validates against its declared schema.
  schemas/dev/mxc-config.schema.0.8.0-dev.json:143
• The PR description says dev-schema regeneration is deferred to a follow-up and that only wire.rs plus fixtures change, but this generated schema is included while the corresponding generated TypeScript oracle remains legacy. Either remove this generated artifact to match the stated scoped change, or update the PR scope and regenerate the complete artifact set together.

    "EgressDefault": {
      "description": "Egress default outbound action applied when no egress rule matches.",
      "enum": [
        "allow",
        "deny"

src/core/wxc_common/src/config_parser.rs:856

• runtimeConfig.networkProxy is independent of the top-level network object, so gating these compatibility checks on cfg.network.is_some() lets a proxy-only Bubblewrap config bypass the default-deny safety check below. Bubblewrap then omits --unshare-net for the proxy, allowing raw-socket clients direct host-network access despite the default Block policy. Run these checks whenever the proxy is enabled instead.

    if cfg.network.is_some() {

src/core/wxc_common/src/config_parser.rs:2474

• This test still expects a remote proxy to be accepted, but convert_wire_proxy now explicitly rejects every host except localhost/127.0.0.1/::1. It also supplies the obsolete object form, so the current unwrap() is guaranteed to panic. Convert this into a rejection test using the string URL, or remove it if remote proxies are no longer part of the contract.

            "runtimeConfig": {
                "networkProxy": { "url": "http://proxy.example.com:8080" }

src/core/wxc_common/src/models.rs:407

• This domain representation cannot retain the full GA wire rule added in this PR: flattening destinations to strings loses each destination’s except ranges, and Vec<u16> cannot represent endPort ranges or protocol selectors with no port. If this model is kept for the parser follow-up, represent destinations and port selectors structurally so conversion does not discard policy semantics.

    /// IPv4/IPv6 CIDR ranges or bare IP addresses.
    pub destinations: Vec<String>,
    pub ports: Vec<u16>,
    pub protocols: Vec<Protocol>,

src/core/wxc_common/src/config_parser.rs:523

• The PR description says parser changes are deferred and that only wire.rs plus fixtures change, but this introduces production parsing for runtimeConfig.networkProxy (and the branch also changes parser tests, models, generated SDK types, and schema). Either revert these out-of-scope files or update the stated scope and review/validate them as part of this PR.

fn convert_wire_proxy(url_str: String) -> Result<ProxyConfig, WxcError> {

tests/configs/bubblewrap_network_proxy_builtin.json:10

• This fixture is still run as the “builtin proxy” test and the runner only checks for PROXY_OK, but egress.default: allow now gives curl direct internet access with no proxy configured. The test will pass without exercising any proxy behavior. Remove it from the proxy suite or redesign the test around a caller-managed GA loopback proxy.

    "egress": {
      "default": "allow"

tests/configs/bubblewrap_network_proxy_allowlist.json:10

• This config is still executed as the proxy allowlist test, but it now allows all direct egress and configures no proxy. On a normal network the command reaches example.com, emits SENTINEL_BAD_LEAK, and exits 1, so the test no longer verifies the intended allowlist behavior. Update or retire the corresponding proxy test when migrating this fixture.

    "egress": {
      "default": "allow"

tests/configs/bubblewrap_network_proxy_blocklist.json:10

• With direct egress allowed and no proxy/block rule, this test reports BLOCKED_OK only because evil.example.com does not resolve. That makes the existing “proxy blocklist” test a false positive rather than evidence of filtering. Update or remove the runner entry together with this fixture.

    "egress": {
      "default": "allow"

tests/configs/proxy_builtin_test.json:19

• This file remains the input to the ProcessContainer proxy E2E test, but it no longer configures a proxy. Its Python workload catches request failures and exits successfully, while the E2E only asserts process success, so the test now passes without proving proxy startup or routing. Migrate the harness to a caller-managed GA proxy or stop running this fixture as a proxy test.

  "network": {},

src/core/wxc_common/src/config_parser.rs:2435

• RuntimeConfig.network_proxy is a string, so this migrated positive test now fails deserialization with “invalid type: map, expected a string” before exercising convert_wire_proxy. Use the GA string form so the test still verifies successful loopback parsing.

This issue also appears on line 2473 of the same file.

                "networkProxy": { "localhost": 8080 }

src/core/wxc_common/src/config_parser.rs:2583

• The new GA field is a URL string and the conversion code explicitly says the built-in server form is not part of the contract. This positive test therefore always fails during JSON deserialization and can never reach its assertions. Remove it or change it to assert that the legacy built-in object is rejected.

            "runtimeConfig": {
                "networkProxy": { "builtinTestServer": true }

tests/examples/03_network_restricted.json:12

• This migration drops 140.82.121.0/24 along with the DNS hostname, but that entry is already a valid GA CIDR and can be represented by egress.allow[].to[].cidr. Dropping it changes this “network restricted” example from allowing the GitHub range to denying all egress, contrary to the stated CIDR-only migration.

src/core/wxc_common/src/models.rs:408

• This domain model cannot represent the GA wire rules losslessly: destinations: Vec<String> drops each destination's except, ports: Vec<u16> drops omitted ports and endPort, and separate port/protocol vectors lose which protocol belongs to which range. Any future conversion would discard policy or invent combinations. Model destination and port selectors structurally, or defer this model addition to the parser follow-up.

pub struct EgressRule {
    /// IPv4/IPv6 CIDR ranges or bare IP addresses.
    pub destinations: Vec<String>,
    pub ports: Vec<u16>,
    pub protocols: Vec<Protocol>,
    pub action: RuleAction,

src/core/wxc_common/src/config_parser.rs:563

• Url::port() accepts an explicit port 0, so runtimeConfig.networkProxy: "http://127.0.0.1:0" currently passes even though the GA contract requires ports 1–65535. Reject zero after parsing; the existing proxy_rejects_port_zero test should also use the new string form so it reaches this validation instead of failing during deserialization.

    let port = parsed.port().ok_or_else(|| {
        WxcError::ConfigParse(format!(
            "runtimeConfig.networkProxy must include a port (e.g., http://127.0.0.1:8080), got: {url_str}"
        ))
    })?;

src/core/wxc_common/src/config_parser.rs:527

• The PR description says parser/model changes and regenerated schema/SDK artifacts are excluded follow-ups, but this branch adds runtime proxy parsing, domain types, generated outputs, and numerous ignored tests. It also says wxc_common is expected not to compile, which no longer describes this diff. Either revert these out-of-scope changes or update the PR scope and complete their validation so reviewers and CI evaluate the actual change set.

fn convert_wire_proxy(url_str: String) -> Result<ProxyConfig, WxcError> {
    // GA `runtimeConfig.networkProxy` is a bare proxy URL string (e.g.
    // "http://127.0.0.1:8080"), restricted to an http(s) proxy on the local
    // loopback. The structured object / builtin test server form is not part of
    // the GA wire contract.

src/core/wxc_common/src/config_parser.rs:938

• This remediation names runtimeConfig.networkProxy.builtinTestServer, but networkProxy is now a string and the built-in-server variant was removed from the GA wire contract. A user cannot apply the suggested fix; update the error to recommend only valid GA fields/actions.

                       'runtimeConfig.networkProxy.builtinTestServer: true' (testing only) for \

src/core/wxc_common/src/config_parser.rs:856

• runtimeConfig is independent of network, so this condition lets a proxy-only Bubblewrap request skip every safeguard below. Bubblewrap then receives a proxy address, omits --unshare-net (bwrap_command.rs:151-164), and relies only on proxy environment variables; raw-socket code can use the shared host network even though the domain policy defaults to Block. Run the proxy safety checks based on policy.network_proxy.is_enabled(), not on whether the optional network object was present.

    if cfg.network.is_some() {

sdk/node/tests/unit/wire-conformance.test.ts:235

• This key-only assertion does not depend on the legacy network value shape. Disabling it removes the CI guard against every future root wire field being omitted from the public SDK. Keep it enabled and explicitly allow-list the newly deferred runtimeConfig key.

// AB#62830582: root wire-only key check embeds the GA network schema; deferred.
// type _RootWireKeys = AssertTrue<
//   Equivalent<
//     OnlyInWire<ContainerConfig, WireMxcConfig>,
//     '$schema' | '_comment' | 'phase' | 'sandboxId' | 'correlationVector' | 'fallback'
//   >
// >;

src/core/wxc_common/src/models.rs:408

• This newly added domain representation cannot retain the GA wire semantics it claims the parser will populate: destinations drops each destination's except ranges, while ports drops endPort and the distinction between an omitted port and a numeric selector. Any conversion from the full wire contract would therefore lose policy information. Use structured destination and port-selector domain types, or defer this type until the follow-up can model the contract losslessly.

/// Parsed egress rule (internal domain model). Populated by the config
/// parser from the wire `NetworkRules`; not yet consumed by enforcement.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct EgressRule {
    /// IPv4/IPv6 CIDR ranges or bare IP addresses.
    pub destinations: Vec<String>,
    pub ports: Vec<u16>,
    pub protocols: Vec<Protocol>,
    pub action: RuleAction,

src/core/wxc_common/src/config_parser.rs:523

• The PR description says config_parser.rs, generated schema/SDK files, and conformance updates are excluded and that only wire.rs plus fixtures change, but this diff adds runtime proxy parsing and changes all of those excluded artifacts. Either revert these changes to the stated contract-only scope or update the PR description and readiness claims so reviewers and CI evaluate the actual change set.

fn convert_wire_proxy(url_str: String) -> Result<ProxyConfig, WxcError> {

src/core/wxc_common/src/config_parser.rs:563

• url::Url accepts an explicit :0, and parsed.port() returns Some(0), so this now accepts an unusable proxy endpoint. Preserve the previous nonzero-port invariant for the GA string form.

    let port = parsed.port().ok_or_else(|| {
        WxcError::ConfigParse(format!(
            "runtimeConfig.networkProxy must include a port (e.g., http://127.0.0.1:8080), got: {url_str}"
        ))
    })?;

sdk/node/tests/unit/wire-conformance.test.ts:216

• This is also a key-only drift assertion, so the new nested value shape does not require disabling it. Leaving it commented out means another processContainer wire field can be added later without the conformance gate noticing; retain the check and add network to the intentional wire-only set.

This issue also appears on line 229 of the same file.

// AB#62830582: GA wire processContainer gained a `network` (allowedPeers) field
// the SDK does not yet mirror; re-enable after the types.ts migration.
// type _ProcessContainerWireKeys = AssertTrue<
//   Equivalent<OnlyInWire<ProcessContainerConfig, WireProcessContainer>, 'captureDenials'>
// >;

src/core/wxc_common/src/config_parser.rs:528

• There is no active success-path test for this new string parser: the positive proxy tests below remain ignored and still pass obsolete object values such as { "url": ... }. As a result, valid loopback URLs, accepted schemes, and the produced ProxyAddress are unverified while malformed-object tests can pass during deserialization without exercising this function. Migrate and re-enable at least the loopback URL tests with a string networkProxy.

fn convert_wire_proxy(url_str: String) -> Result<ProxyConfig, WxcError> {
    // GA `runtimeConfig.networkProxy` is a bare proxy URL string (e.g.
    // "http://127.0.0.1:8080"), restricted to an http(s) proxy on the local
    // loopback. The structured object / builtin test server form is not part of
    // the GA wire contract.
    let parsed = url::Url::parse(&url_str).map_err(|e| {

src/core/wxc_common/src/models.rs:408

• This domain shape cannot retain the GA wire semantics it claims to model: separate ports and protocols vectors lose each selector's protocol/port association, there is no endPort, and flattened destination strings lose per-CIDR except lists. A rule such as TCP/80 plus UDP/53 becomes ambiguous. Model destination and port selectors as structured values mirroring the wire fields before the parser starts populating this type.

    /// IPv4/IPv6 CIDR ranges or bare IP addresses.
    pub destinations: Vec<String>,
    pub ports: Vec<u16>,
    pub protocols: Vec<Protocol>,
    pub action: RuleAction,

src/core/wxc_common/src/config_parser.rs:527

• The PR description says parser/model updates and regenerated schema/SDK artifacts are deferred and that only wire.rs plus fixtures change, but this diff adds runtime proxy parsing here and also changes those deferred files. Please either split these changes back out or update the PR scope and validation expectations; the current description cannot be used to assess what is intended to land.

fn convert_wire_proxy(url_str: String) -> Result<ProxyConfig, WxcError> {
    // GA `runtimeConfig.networkProxy` is a bare proxy URL string (e.g.
    // "http://127.0.0.1:8080"), restricted to an http(s) proxy on the local
    // loopback. The structured object / builtin test server form is not part of
    // the GA wire contract.

src/core/wxc_common/src/config_parser.rs:2564

• This test still sends the removed object form, so it succeeds on a type error before exercising the port-zero validation it names. Use the new string contract so the test detects whether convert_wire_proxy rejects port 0.

        let json =
            r#"{"process":{"commandLine":"x"},"runtimeConfig":{"networkProxy":{"localhost":0}}}"#;

tests/configs/bubblewrap_network_proxy_builtin.json:11

• This fixture is still executed as the “builtin proxy” case by run_bwrap_network_proxy_test.sh:40, but it no longer configures any proxy. Direct internet access now produces PROXY_OK, turning the test into a false positive. Disable the case until a GA-compatible proxy test exists, or rewrite the fixture and runner to provide an external loopback proxy.

    "egress": {
      "default": "allow"
    }

tests/configs/bubblewrap_network_proxy_allowlist.json:11

• run_bwrap_network_proxy_test.sh:41 still runs this as an allowlist test, but the migrated fixture has neither a proxy nor an allow rule. example.com is therefore reachable under egress.default: allow, causing SENTINEL_BAD_LEAK; this test can no longer pass for the behavior it asserts. Disable or redesign the runner case until the GA CIDR/external-proxy path is available.

    "egress": {
      "default": "allow"
    }

tests/configs/bubblewrap_network_proxy_blocklist.json:11

• run_bwrap_network_proxy_test.sh:42 still labels this a proxy blocklist test, but the fixture now permits all egress and configures no proxy or deny rule. The case can report BLOCKED_OK merely because evil.example.com does not resolve, so it no longer proves blocklist enforcement. Disable or redesign this runner case with a GA-expressible destination.

    "egress": {
      "default": "allow"
    }

src/core/wxc_common/src/config_parser.rs:856

• runtimeConfig is independent of network, so a proxy config may legitimately omit the top-level network object. This guard then skips every Bubblewrap compatibility check. With the default block policy, Bubblewrap sees the proxy and omits --unshare-net (bwrap_command.rs:159-162), allowing raw-socket egress despite default-deny. Run these checks based on policy.network_proxy.is_enabled() rather than cfg.network.is_some().

    if cfg.network.is_some() {

src/core/wxc_common/src/config_parser.rs:563

• url::Url::port() can return Some(0), so the new string form accepts http://localhost:0 even though a usable proxy port must be 1–65535. The migrated proxy_rejects_port_zero test still sends the old object shape, so it passes during deserialization and does not catch this path.

    let port = parsed.port().ok_or_else(|| {
        WxcError::ConfigParse(format!(
            "runtimeConfig.networkProxy must include a port (e.g., http://127.0.0.1:8080), got: {url_str}"
        ))
    })?;

src/core/wxc_common/src/config_parser.rs:2461

• The parser now implements the GA string form, but the only positive URL parsing test remains ignored and still supplies the removed object form. Consequently the new success path has no active regression test. Convert this input to a string and re-enable the test.

This issue also appears on line 2563 of the same file.

    #[ignore = "AB#62830582: legacy network/proxy schema, re-enable after parser/SDK test migration"]

sdk/node/tests/unit/wire-conformance.test.ts:229

• This key-only root assertion does not depend on the nested network value shape. Disabling it means any unrelated new wire root field can now land without the conformance gate noticing it. Keep the assertion active and add runtimeConfig to the explicit wire-only allow-list; likewise, the process-container key check can remain active by adding network to its expected divergence.

// AB#62830582: root wire-only key check embeds the GA network schema; deferred.

src/core/wxc_common/src/wire.rs:346

• Replacing the legacy fields here breaks every still-supported 0.6/0.7 configuration before version validation can preserve its semantics: both immutable stable schemas define network.defaultPolicy, enforcementMode, and host lists, while SUPPORTED_VERSION remains >=0.6, <=0.8. Because this closed struct now rejects those fields, previously valid released configs fail deserialization. The parser needs version-aware legacy/GA decoding (or equivalent compatibility fields) rather than globally replacing the stable contract.

    /// Outbound policy rules.
    pub egress: Option<NetworkEgress>,
    /// Inbound policy.
    pub ingress: Option<NetworkIngress>,

src/core/wxc_common/src/config_parser.rs:616

• url::Url accepts an explicit port 0, so this now accepts runtimeConfig.networkProxy: "http://127.0.0.1:0" even though port zero cannot identify a usable proxy and the old parser explicitly rejected it. Validate port != 0; the current proxy_rejects_port_zero test uses the obsolete object form and therefore never exercises this check.

    let port = parsed.port().ok_or_else(|| {
        WxcError::ConfigParse(format!(
            "runtimeConfig.networkProxy must include a port (e.g., http://127.0.0.1:8080), got: {url_str}"
        ))
    })?;

src/core/wxc_common/src/wire.rs:120

• The PR description says runtimeConfig.networkProxy and parser/model/generated-schema changes are deferred and that only wire.rs plus fixtures change, but this field is added here and the diff also implements parser logic, changes models/generated artifacts, and disables tests. Align the implementation and description so reviewers and follow-up PRs have an accurate scope boundary.

    /// Runtime configuration applied to the launched container.
    pub runtime_config: Option<RuntimeConfig>,

tests/configs/bubblewrap_network_proxy_builtin.json:11

• This fixture is still executed by run_bwrap_network_proxy_test.sh, but it no longer configures any proxy. With default: "allow", the curl goes directly to GitHub and prints PROXY_OK, so the proxy test becomes a false positive. Disable the case until it can supply a real runtimeConfig.networkProxy, or migrate the harness and fixture together.

  "network": {
    "egress": {
      "default": "allow"
    }

tests/configs/bubblewrap_network_proxy_allowlist.json:11

• This remains an active allowlist test, but the migrated policy is now allow-all with no proxy or allow rule. Once GA egress parsing lands, the probe to example.com will succeed, emit SENTINEL_BAD_LEAK, and fail the test. Disable this case or migrate the harness to an external proxy that can enforce the hostname allowlist; the parser follow-up alone cannot restore its semantics.

  "network": {
    "egress": {
      "default": "allow"
    }

tests/configs/bubblewrap_network_proxy_blocklist.json:11

• This active blocklist test now has allow-all egress and no proxy/block rule. Its evil.example.com request will normally fail DNS and print BLOCKED_OK anyway, so the script reports success without exercising policy enforcement. Disable it or migrate it with a proxy harness that actually enforces the hostname blocklist.

  "network": {
    "egress": {
      "default": "allow"
    }

tests/configs/proxy_builtin_test.json:19

• processcontainer_proxy() and run_processcontainer_proxy_tests.ps1 still execute this as the proxy fixture, but the proxy configuration has been removed. The Python command catches connection errors and exits successfully, and wxc-test-driver ignores the scripts' --proxy argument, so this test can pass without a proxy or even a successful request. Disable it or migrate the fixture and harness together instead of leaving a false-positive proxy test.

  "network": {},

src/core/wxc_common/src/config_parser.rs:576

• This new parser path has no active success test using the actual bare-string contract. All success cases below still pass object forms such as { "url": ... } and are ignored, while the active rejection tests fail during deserialization before reaching this function. Add active tests for valid localhost/IPv4/IPv6 strings and each validation branch so regressions in this conversion are observable.

This issue also appears on line 612 of the same file.

fn convert_wire_proxy(url_str: String) -> Result<ProxyConfig, WxcError> {

src/core/wxc_common/src/config_parser.rs:988

• This remediation names runtimeConfig.networkProxy.builtinTestServer, but networkProxy is now a string and has no such field. This reachable Bubblewrap error therefore instructs users to create an invalid configuration; direct them to remove the conflicting host policy or configure the external proxy to enforce it.

                       'runtimeConfig.networkProxy.builtinTestServer: true' (testing only) for \
                       MXC-enforced host filtering, or remove the host policy.";

src/core/wxc_common/src/models.rs:408

• This domain shape cannot retain the full wire contract introduced in the same PR: destinations: Vec<String> drops each destination's except list, and ports: Vec<u16> drops endPort ranges and portless protocol selectors. Since the type is documented as the parser's representation of NetworkRules, using it in the follow-up would silently lose valid GA policy. Model destinations and port selectors structurally, or remove this premature type until the complete mapping lands.

pub struct EgressRule {
    /// IPv4/IPv6 CIDR ranges or bare IP addresses.
    pub destinations: Vec<String>,
    pub ports: Vec<u16>,
    pub protocols: Vec<Protocol>,
    pub action: RuleAction,

src/core/wxc_common/src/config_parser.rs:906

• Proxy compatibility validation now depends on an unrelated optional field. A config with runtimeConfig.networkProxy and no top-level network skips every guard below, while adding network: {} runs them; on Bubblewrap this changes acceptance and can skip policy-weakening checks without changing the effective default-deny policy. Run these guards whenever the runtime proxy is enabled, independent of whether network was present.

    // Backend compatibility guards for the network proxy. The proxy is read above
    // from `runtimeConfig.networkProxy`; these guards reject proxy + enforcement
    // combinations a backend cannot honor.
    if cfg.network.is_some() {

src/core/wxc_common/src/models.rs:408

• This domain model cannot retain the GA rule represented by the new wire types: destinations drops each destination's except, ports drops endPort, and separate ports/protocols vectors lose which protocol belongs to which selector. A follow-up parser therefore cannot faithfully map valid GA policies into this type. Model destinations and port selectors as structured values (or retain the validated wire-equivalent structure).

    /// IPv4/IPv6 CIDR ranges or bare IP addresses.
    pub destinations: Vec<String>,
    pub ports: Vec<u16>,
    pub protocols: Vec<Protocol>,
    pub action: RuleAction,

src/core/wxc_common/src/wire.rs:346

• The main configuration reference still documents the removed network.defaultPolicy, enforcementMode, and structured network.proxy fields (docs/schema.md:52-58) and omits egress, ingress, runtimeConfig.networkProxy, and processContainer.network.allowedPeers. Updating the schema source without the documented public contract leaves users authoring configurations that this closed wire type rejects; update docs/schema.md with this change.

    /// Outbound policy rules.
    pub egress: Option<NetworkEgress>,
    /// Inbound policy.
    pub ingress: Option<NetworkIngress>,

src/core/wxc_common/src/config_parser.rs:987

• This recovery advice names a wire shape that no longer exists. runtimeConfig.networkProxy is now a string, and convert_wire_proxy always sets builtin_test_server to false, so users receiving this error cannot apply the suggested networkProxy.builtinTestServer fix. Recommend a valid GA configuration instead.

                "Bubblewrap: an external runtimeConfig.networkProxy (url/localhost) cannot be \
                       combined with allowedHosts, blockedHosts, or defaultPolicy='block'. \
                       The external proxy is expected to enforce its own host policy; \
                       MXC does not forward host lists to it. Use \
                       'runtimeConfig.networkProxy.builtinTestServer: true' (testing only) for \

tests/examples/03_network_restricted.json:12

• The prior fixture included 140.82.121.0/24, which is already a GA-compatible CIDR, but the migration drops it together with the unsupported DNS hostname. This turns the “network restricted” example into deny-all and no longer demonstrates an allowed destination. Preserve the representable CIDR in an egress.allow[].to[] rule, or redesign the workload around literal IP/CIDR traffic.
  sdk/node/tests/unit/wire-conformance.test.ts:235
• This key-only assertion does not depend on the nested network value shape, so it need not be disabled. Update its expected wire-only root set to include the intentional new runtimeConfig divergence and keep the assertion active; otherwise any unrelated future root wire field can be added without the conformance gate noticing.

// AB#62830582: root wire-only key check embeds the GA network schema; deferred.
// type _RootWireKeys = AssertTrue<
//   Equivalent<
//     OnlyInWire<ContainerConfig, WireMxcConfig>,
//     '$schema' | '_comment' | 'phase' | 'sandboxId' | 'correlationVector' | 'fallback'
//   >
// >;