feat(seatbelt): add system power access by caarlos0 · Pull Request #1066 · microsoft/mxc

Carlos Alexandro Becker (caarlos0) · 2026-08-28T20:08:04Z

📖 Description

Add opt-in seatbelt.systemPowerAccess support for macOS workloads that need
sleep/wake notifications or power assertions.

The capability is off by default. When enabled, the generated Seatbelt profile
allows only:

RootDomainUserClient
com.apple.PowerManagement.control
com.apple.iokit.powerdxpc

The new field is available in schema 0.9.0-alpha and later. This change wires
it through the versioned contract, parser, Rust and Node SDKs, generated
artifacts, tests, and documentation. Published 0.7 and 0.8 schemas remain
unchanged.

🔗 References

None.

🔍 Validation

Verified both macOS power APIs are denied with systemPowerAccess: false and
allowed with systemPowerAccess: true through mxc-exec-mac.
Ran targeted Seatbelt, config contract, parser, and Rust SDK tests.
Built the Node SDK and ran its wire-conformance test.
Ran schema/type codegen, schema-version, and config-validation gates.
Ran Rust formatting and Clippy checks.
Merged the latest main and reran the full PR validation.

✅ Checklist

Signed the Contributor License Agreement
Linked to an issue
Updated documentation (if applicable)
Updated Copilot instructions (if build, architecture, or conventions changed)
If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

Bug fix
Feature
Task

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See docs/pull-requests.md.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See docs/pull-requests.md
for the steps.

Microsoft Reviewers: Open in CodeFlow

Add an opt-in capability for sleep/wake notifications and power assertions while keeping the default sandbox profile restricted. Co-authored-by: Copilot <[email protected]> Copilot-Session: 342a9bf7-a27a-457f-aaac-c910b8cd5535 Signed-off-by: Carlos Alexandro Becker <[email protected]>

azure-pipelines · 2026-08-28T20:08:13Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

Copilot review overview

Review tier: Balanced
Findings: 2 · 1

New issues introduced by this change (3)

Severity	Finding
	`src/core/wxc_common/src/config_parser.rs` — `systemPowerAccess` is mapped without any schema-version check. The production loaders still…
	`src/core/mxc_engine/src/policy.rs` — This public setter bypasses schema validation because `build_request` has already parsed the…
	`docs/schema.md` — This example places `systemPowerAccess` under `experimental.seatbelt`, but the parser explicitly…

What changed in this PR

Adds opt-in macOS Seatbelt permissions for sleep/wake notifications and power assertions.

Changes:

Extends schema, parser, Rust SDK, and Node SDK contracts.
Emits narrowly scoped Seatbelt power-service rules.
Adds unit tests, generated artifacts, and documentation.

File	Description
`src/core/wxc_common/src/wire.rs`	Adds the wire field.
`src/core/wxc_common/src/models.rs`	Adds the domain setting and default.
`src/core/wxc_common/src/config_parser.rs`	Maps and tests the setting.
`src/core/wxc_common/src/config_contract_adapters/v0_8.rs`	Defaults the unavailable field.
`src/core/wxc_common/src/config_contract_adapters/v0_7.rs`	Defaults the unavailable field.
`src/core/wxc_common/src/config_contract_adapters/dev/one_shot.rs`	Adapts the 0.9 contract field.
`src/core/wxc_common/src/config_contract_adapters/dev/one_shot_tests/stable_candidate.rs`	Tests adapter mappings.
`src/core/mxc-sdk/README.md`	Documents Rust SDK usage.
`src/core/mxc_engine/src/policy.rs`	Adds the Rust SDK setter.
`src/core/mxc_config_contract/tests/version_boundaries/seatbelt.rs`	Tests 0.9 introduction.
`src/core/mxc_config_contract/tests/v0_9_0_alpha/seatbelt.rs`	Tests field typing.
`src/core/mxc_config_contract/tests/v0_9_0_alpha/optional_fields.rs`	Tests null rejection.
`src/core/mxc_config_contract/tests/v0_9_0_alpha/fixtures/one_shot/valid/seatbelt_complete.json`	Extends the valid fixture.
`src/core/mxc_config_contract/src/dev/stable.rs`	Adds the exact contract field.
`src/backends/seatbelt/common/src/profile_builder.rs`	Generates and tests power rules.
`sdk/node/src/types.ts`	Exposes the Node SDK option.
`sdk/node/src/generated/wire.ts`	Updates rolling generated types.
`sdk/node/src/generated/v0_9_0_alpha/wire.ts`	Updates exact generated types.
`sdk/node/README.md`	Documents Node SDK usage.
`schemas/dev/mxc-config.schema.0.9.0-dev.json`	Updates the rolling schema.
`schemas/dev/mxc-config.schema.0.9.0-alpha.json`	Updates the exact schema.
`docs/seatbelt/seatbelt-backend.md`	Documents backend behavior.
`docs/schema.md`	Updates the configuration example.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Copilot review overview

Review tier: Balanced
Findings: 2 · 1

Pre-existing issues (3)

Severity	Finding
	`src/core/mxc_engine/src/policy.rs` — This public setter bypasses schema validation because `build_request` has already parsed the… View comment
	`src/core/wxc_common/src/config_parser.rs` — `systemPowerAccess` is mapped without any schema-version check. The production loaders still… View comment
	`docs/schema.md` — This example places `systemPowerAccess` under `experimental.seatbelt`, but the parser explicitly… View comment

Suppressed comments (3)

src/core/mxc_engine/src/policy.rs:688

This mutator bypasses the advertised 0.9 schema boundary: callers can build and validate a 0.7/0.8 request, then set this model field after parsing, and the Seatbelt runner applies it without checking schema_version. The new test even exercises that path with 0.7.0-alpha. Make the setter reject unsupported versions (or add an execution-time invariant covering directly constructed requests) so the Rust SDK cannot enable a 0.9-only capability under an older contract.

    pub fn set_seatbelt_system_power_access(&mut self, allow: bool) -> &mut Self {
        self.inner
            .seatbelt
            .get_or_insert_default()
            .system_power_access = allow;

docs/schema.md:209

This example places the new option under experimental.seatbelt, but the parser explicitly rejects that section with “has moved to the stable section”; the supported path is top-level seatbelt.systemPowerAccess. Move the Seatbelt example out of the experimental object so readers can copy a valid 0.9 configuration.

            "systemPowerAccess": false      // Allow sleep/wake notifications and power assertions

src/core/wxc_common/src/config_parser.rs:623

systemPowerAccess is not version-gated in the production parser. Both production loaders still deserialize the rolling wire::MxcConfig directly, and the exact-contract adapters are explicitly not reachable from production, so a request declaring schema 0.7 or 0.8 can set this field to true and reach the profile builder. The contract boundary test alone does not enforce the runtime boundary. Add a raw field-version check to both loader paths (similar to directional networking) and a production parser regression test that rejects this field before 0.9.

        system_power_access: system_power_access.unwrap_or(false),

Gate systemPowerAccess at every one-shot loader and again before Seatbelt execution so post-parse SDK mutations cannot bypass schema 0.9. Move the documented Seatbelt block to its supported top-level location. Co-authored-by: Copilot <[email protected]> Copilot-Session: 342a9bf7-a27a-457f-aaac-c910b8cd5535 Signed-off-by: Carlos Alexandro Becker <[email protected]>

Copilot

Copilot review overview

Review tier: Balanced
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	`docs/schema.md` — This “Full Schema” example still declares `"version": "0.6.0-alpha"` at line 87, but the parser…

Issues resolved since last review (3)

Severity	Finding
	`docs/schema.md` — This example places `systemPowerAccess` under `experimental.seatbelt`, but the parser explicitly… View resolved comment
	`src/core/mxc_engine/src/policy.rs` — This public setter bypasses schema validation because `build_request` has already parsed the… View resolved comment
	`src/core/wxc_common/src/config_parser.rs` — `systemPowerAccess` is mapped without any schema-version check. The production loaders still… View resolved comment

Copilot

Copilot review overview

Review tier: Balanced
Findings: 1

Pre-existing issues (1)

Severity	Finding
	`docs/schema.md` — This “Full Schema” example still declares `"version": "0.6.0-alpha"` at line 87, but the parser… View comment

Keep the full schema example consistent with its systemPowerAccess field. Co-authored-by: Copilot <[email protected]> Copilot-Session: 342a9bf7-a27a-457f-aaac-c910b8cd5535 Signed-off-by: Carlos Alexandro Becker <[email protected]>

Copilot

Copilot review overview

Review tier: Balanced
Findings: None

Issues resolved since last review (1)

Severity	Finding
	`docs/schema.md` — This “Full Schema” example still declares `"version": "0.6.0-alpha"` at line 87, but the parser… View resolved comment

Resolve the Seatbelt policy move by keeping execution invariants in the backend and raw schema-version gates in wxc_common. Co-authored-by: Copilot <[email protected]> Copilot-Session: 342a9bf7-a27a-457f-aaac-c910b8cd5535 Signed-off-by: Carlos Alexandro Becker <[email protected]>

Copilot

Copilot review overview

Review tier: Balanced
Findings: None

Copilot

Copilot review overview

Review tier: Balanced
Findings: None

Carlos Alexandro Becker (caarlos0) requested review from a team and a balanced review from Copilot August 28, 2026 20:08

Carlos Alexandro Becker (caarlos0) requested a review from a team as a code owner August 28, 2026 20:08

Copilot started reviewing on behalf of Carlos Alexandro Becker (caarlos0) August 28, 2026 20:08 View session

Merge remote-tracking branch 'origin/main' into macos-bazel

ddbaacd

Copilot AI reviewed Aug 28, 2026

View reviewed changes

Comment thread src/core/wxc_common/src/config_parser.rs

Comment thread src/core/mxc_engine/src/policy.rs

Comment thread docs/schema.md Outdated

Copilot AI review requested due to automatic review settings August 28, 2026 20:13

Copilot started reviewing on behalf of Carlos Alexandro Becker (caarlos0) August 28, 2026 20:14 View session

Copilot AI reviewed Aug 28, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 29, 2026 16:39

Copilot started reviewing on behalf of Carlos Alexandro Becker (caarlos0) August 29, 2026 16:39 View session

Merge remote-tracking branch 'origin/main' into macos-bazel

1a5bc5d

Copilot AI reviewed Aug 29, 2026

View reviewed changes

Comment thread docs/schema.md Outdated

Copilot AI review requested due to automatic review settings August 29, 2026 16:43

Copilot started reviewing on behalf of Carlos Alexandro Becker (caarlos0) August 29, 2026 16:43 View session

Copilot AI reviewed Aug 29, 2026

View reviewed changes

docs(schema): use version 0.9 in full example

fc97809

Keep the full schema example consistent with its systemPowerAccess field. Co-authored-by: Copilot <[email protected]> Copilot-Session: 342a9bf7-a27a-457f-aaac-c910b8cd5535 Signed-off-by: Carlos Alexandro Becker <[email protected]>

Copilot AI review requested due to automatic review settings August 29, 2026 17:05

Copilot started reviewing on behalf of Carlos Alexandro Becker (caarlos0) August 29, 2026 17:06 View session

Copilot AI reviewed Aug 29, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 31, 2026 12:04

microsoft-github-policy-service Bot added the Copilot-Instructions PR modifies Copilot instruction files (.github/copilot-instructions.md or .github/instructions/) label Aug 31, 2026

Copilot started reviewing on behalf of Carlos Alexandro Becker (caarlos0) August 31, 2026 12:05 View session

Copilot AI reviewed Aug 31, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into macos-bazel

9f0d93e

Copilot AI review requested due to automatic review settings August 31, 2026 17:35

Copilot started reviewing on behalf of Carlos Alexandro Becker (caarlos0) August 31, 2026 17:36 View session

Copilot AI reviewed Aug 31, 2026

View reviewed changes

Navigation Menu

Uh oh!

feat(seatbelt): add system power access - #1066

feat(seatbelt): add system power access#1066
Carlos Alexandro Becker (caarlos0) wants to merge 7 commits into
mainfrom
macos-bazel

Carlos Alexandro Becker (caarlos0) commented Aug 28, 2026 •

edited

Loading

Uh oh!

azure-pipelines Bot commented Aug 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Carlos Alexandro Becker (caarlos0) commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📖 Description

🔗 References

🔍 Validation

✅ Checklist

📋 Issue Type

Microsoft Reviewers: Open in CodeFlow

Uh oh!

azure-pipelines Bot commented Aug 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Carlos Alexandro Becker (caarlos0) commented Aug 28, 2026 •

edited

Loading