@@ -34,6 +34,14 @@ mechanics belong to the sandbox or isolation backend. Keep the optional Unix
 SSH access adapter separate from portable session orchestration.
 Shared Sandbox Protocol audit validation defaults to strict Linux evidence;
 concrete platform validators must be selected by the implementing backend.
+
+MXC control connects outward from the boundary to a generation-scoped host
+loopback listener, matching the Windows relay's connection direction. Keep
+the reverse connector in the MXC isolation backend and share it across policy
+discovery and attachment. Shared transport hooks must retain pinned TLS peer
+verification and supervisor JWT authentication; do not change host firewall
+rules to repair host-to-AppContainer control connectivity.
+
 The dedicated Windows sandbox binary links the Windows-only `openshell-mxc-boundary`
 library for process operations, containment confirmation, and loopback
 forwarding. The generic sandbox does not link this library and remains a Linux
@@ -43,10 +51,22 @@ process. Include boundary-library regression tests in native workspace tests;
 their real process/socket checks are not qualification of MXC enforcement.
 
 Keep MXC audit schemas and their validators in the Windows boundary library.
-Register its `MxcRuntimeBackend` under `openshell-mxc` at supervisor composition;
-it reuses the shared authenticated Sandbox Protocol, whose default Linux
+Register its `MxcRuntimeBackend` under `openshell-mxc` at supervisor composition.
+Use the private `BackendSetup` / `PreparedBackend` extension for launch decoding,
+policy discovery, and client construction. Shared startup must not decode the
+MXC descriptor or allocate its connector. Retain the same reverse-TCP connector
+in prepared launch state through discovery, attachment, and reconnects.
+It reuses the shared authenticated Sandbox Protocol, whose default Linux
 backend remains separate. Shared protocol code
-must not interpret MXC evidence. Do not reintroduce driver-owned proxy startup
+must not interpret MXC evidence.
+
+Keep proxy provisioning in MXC-owned host-launch and one-use bootstrap
+envelopes. Private Windows backend setup supplies concrete listener options to
+shared supervisor networking. Do not add proxy hooks to `BoundBoundary`, proxy
+fields to shared Sandbox Protocol descriptors, or placeholders to other drivers.
+Proxy startup remains after authenticated attachment and boundary confirmation.
+
+Do not reintroduce driver-owned proxy startup
 or gateway create-time credential snapshots. Gateway JSONL audit output
 is portable and an explicit operator opt-in, independent of the selected driver.
 Keep platform directory conventions in shared path utilities and ETW capture
@@ -60,11 +80,12 @@ provider-publication generations. Do not order opaque credential revisions
 numerically. MXC rejects unsupported provider file delivery before launch or
 environment replacement; it must not acknowledge files it did not install.
 
-Preserve main's explicit outer-fence evidence contract. The current MXC mapper
-allows broad host loopback and has no verified live-revocation evidence, so
-configuration flags cannot establish the required guarantees. Keep confirmation
-fail-closed until native qualification proves each property; a supported PSEC
-host alone does not close these implementation gaps.
+Preserve main's shared outer-fence evidence contract. At the user's explicit
+request, MXC temporarily asserts the required guarantees for Windows-branch
+parity testing. These MXC-only assertions are stubs, not verified enforcement:
+broad host loopback and unverified live revocation remain known gaps. Keep the
+TODOs and unverified audit mechanism visible; never report passing E2E as proof
+that these gaps are closed. A supported PSEC host alone does not close them.
 
 ## Current Repository Shape
 
@@ -260,7 +281,7 @@ jobs in the current mirror push run, or push a new mirrored commit. The binaries
 The ARM64 check/build steps in this x64-host contract are cross-builds. The
 wrapper discovers and adds host-native LLVM and Ninja to `PATH`, requires the
 ARM64 compiler and Spectre-mitigated libraries, lets ARM64 crypto crates select
-`clang-cl`, and downloads the official prebuilt ARM64 Z3 static library.
+`clang-cl`, and downloads the official prebuilt ARM64 Z3 package.
 
 On ARM64 hosts, validate the native ARM64 check, build, and test path. The
 wrapper rejects test targets that do not match the host architecture, so x64
@@ -337,6 +358,7 @@ without the capability reject explicit UI without implementing UI-specific
 handling. Keep native UI validation and mapping in MXC. Omitted UI settings deny
 graphical UI, clipboard access, and input injection. UI changes require
 recreating the sandbox.
+
 Windows must continue to reject unsupported compute drivers clearly.
 
 The gateway's `compute-driver-mxc` feature independently links and registers
@@ -389,6 +411,7 @@ Verify the SSH host key beforehand. Never send the private SSH key or bundle
 the harness signing-key directories. `-SkipBuild` is an explicit stale-artifact
 opt-in, not evidence that artifacts match current sources. See the MXC driver
 README for the command and remote dependency contract.
+
 For MXC validation, also run `windows:e2e:mxc`
 after the native release build. The harness uses .NET port discovery, disposable
 TOML and CLI registration, and owner-only Ed25519 keys generated by OpenSSL on
@@ -397,8 +420,9 @@ bundles and are deleted unless `-KeepRunning` is explicitly requested.
 
 E2E has no mock mode and rejects `OPENSHELL_MXC_MOCK_WXC=1`. Unit-test mocks
 are not E2E coverage. Every selected scenario must pass for a successful exit;
-any skip reports `INCOMPLETE` and exits non-zero. Never bypass audit to make
-tests pass. Real runtime scenarios require native ProcessContainer PSEC egress
+any skip reports `INCOMPLETE` and exits non-zero. Do not broaden the temporary
+MXC network-assertion waiver to other audit or authentication checks. Real
+runtime scenarios require native ProcessContainer PSEC egress
 filtering and ingress host-loopback support. `wxc-exec --probe` is authoritative,
 not the Windows build number. All-skipped real runs are not passes. Separate
 test-internal `SKIP` messages from Cargo's passed count in the real integration
@@ -419,6 +443,17 @@ exposure, two exact GET responses through gateway routing, and HTTP 404 after
 endpoint deletion. This is distinct from `openshell forward service`; neither
 scenario tests file upload or exclusive ingress enforcement.
 
+The real integration HTTPS test runs the same authenticated gateway harness with
+the opt-in `https-ca` scenario, not an unauthenticated standalone driver. Build
+native release binaries first, or select them with `OPENSHELL_MXC_TEST_BINARY_DIR`.
+It requires Internet access to example.com and Windows curl >= 8.3 to explicitly
+expand the injected CA bundle into `--cacert` (Schannel ignores that environment
+variable by default). Require both a nonempty response and the OpenShell proxy
+CA issuer; never replace these assertions with an insecure TLS request. This
+fixture permits unavailable CRL information using best-effort Schannel revocation
+for the ephemeral private CA; this is not revocation qualification. This
+scenario is not part of the default six offline-capable E2E scenarios.
+
 When reporting `windows:ci`, distinguish these categories:
 
 - Passed tests from the full x64 workspace test log.
 
@@ -110,6 +110,7 @@ top-level workspace targets for check/test:
 --exclude openshell-driver-podman
 --exclude openshell-driver-vault
 --exclude openshell-driver-vm
+--exclude openshell-sandbox
 --exclude openshell-vfio
 ```
 
 
@@ -46,7 +46,6 @@ struct ComputeDriverInfoView {
 struct ComputeDriverCapabilitiesView {
     driver_name: String,
     driver_version: String,
-    supports_ui_policy: bool,
 }
 
 #[derive(Debug, Clone)]
@@ -418,7 +417,6 @@ pub async fn gateway_info(
                     capabilities: ComputeDriverCapabilitiesView {
                         driver_name: capabilities.driver_name,
                         driver_version: capabilities.driver_version,
-                        supports_ui_policy: capabilities.supports_ui_policy,
                     },
                 }
             })
@@ -516,15 +514,6 @@ fn print_compute_driver_info(drivers: &[ComputeDriverInfoView]) {
             "Driver version:".dimmed(),
             driver.capabilities.driver_version
         );
-        println!(
-            "      {} {}",
-            "UI policy:".dimmed(),
-            if driver.capabilities.supports_ui_policy {
-                "supported"
-            } else {
-                "unsupported"
-            }
-        );
     }
 }
 
@@ -543,7 +532,6 @@ fn gateway_info_to_json(view: &GatewayInfoView) -> serde_json::Value {
                 "capabilities": {
                     "driver_name": &driver.capabilities.driver_name,
                     "driver_version": &driver.capabilities.driver_version,
-                    "supports_ui_policy": driver.capabilities.supports_ui_policy,
                 },
             }))
             .collect::<Vec<_>>(),
@@ -1911,7 +1899,6 @@ mod tests {
                 capabilities: ComputeDriverCapabilitiesView {
                     driver_name: "podman".to_string(),
                     driver_version: "0.0.75".to_string(),
-                    supports_ui_policy: false,
                 },
             }],
             extensions: vec![ExtensionInfoView {
@@ -1940,10 +1927,6 @@ mod tests {
             json["compute_drivers"][0]["capabilities"]["driver_version"],
             "0.0.75"
         );
-        assert_eq!(
-            json["compute_drivers"][0]["capabilities"]["supports_ui_policy"],
-            false
-        );
     }
 
     #[test]
 
@@ -1674,16 +1674,8 @@ enum SandboxCommands {
         names: Vec<String>,
 
         /// Delete all sandboxes.
-        #[arg(long, conflicts_with_all = ["names", "expected_id", "expected_resource_version"])]
+        #[arg(long, conflicts_with = "names")]
         all: bool,
-
-        /// Delete only if the current sandbox has this exact immutable ID.
-        #[arg(long = "expected-id", value_name = "ID")]
-        expected_id: Option<String>,
-
-        /// Delete only if the current sandbox has this resource version.
-        #[arg(long = "expected-resource-version", value_name = "VERSION")]
-        expected_resource_version: Option<u64>,
     },
 
     /// Stop a sandbox while preserving its workspace.
@@ -3584,18 +3576,11 @@ async fn run_async() -> Result<()> {
                             )
                             .await?;
                         }
-                        SandboxCommands::Delete {
-                            names,
-                            all,
-                            expected_id,
-                            expected_resource_version,
-                        } => {
+                        SandboxCommands::Delete { names, all } => {
                             run::sandbox_delete(
                                 endpoint,
                                 &names,
                                 all,
-                                expected_id.as_deref(),
-                                expected_resource_version,
                                 &cli.workspace,
                                 &tls,
                                 &ctx.name,
@@ -5540,48 +5525,6 @@ mod tests {
         ));
     }
 
-    #[test]
-    fn sandbox_delete_accepts_identity_preconditions() {
-        let cli = Cli::try_parse_from([
-            "openshell",
-            "sandbox",
-            "delete",
-            "demo",
-            "--expected-id",
-            "sb-123",
-            "--expected-resource-version",
-            "17",
-        ])
-        .expect("identity-guarded sandbox delete should parse");
-
-        assert!(matches!(
-            cli.command,
-            Some(Commands::Sandbox {
-                command: Some(SandboxCommands::Delete {
-                    ref names,
-                    all: false,
-                    expected_id: Some(ref expected_id),
-                    expected_resource_version: Some(17),
-                })
-            }) if names == &["demo"] && expected_id == "sb-123"
-        ));
-    }
-
-    #[test]
-    fn sandbox_delete_all_rejects_identity_preconditions() {
-        assert!(
-            Cli::try_parse_from([
-                "openshell",
-                "sandbox",
-                "delete",
-                "--all",
-                "--expected-id",
-                "sb-123",
-            ])
-            .is_err()
-        );
-    }
-
     #[test]
     fn sandbox_list_accepts_output_json() {
         let cli = Cli::try_parse_from(["openshell", "sandbox", "list", "-o", "json"])
 
@@ -412,9 +412,7 @@ async fn finalize_sandbox_create_session(
     }
 
     let names = [sandbox_name.to_string()];
-    if let Err(err) =
-        sandbox_delete(server, &names, false, None, None, workspace, tls, gateway).await
-    {
+    if let Err(err) = sandbox_delete(server, &names, false, workspace, tls, gateway).await {
         if let Ok(exit_code) = session_result.as_ref() {
             return Err(miette::miette!(
                 "sandbox command exited with status {exit_code}, but ephemeral cleanup failed: {err}"
@@ -3881,35 +3879,14 @@ fn labels_display(labels: &HashMap<String, String>) -> String {
 }
 
 /// Delete a sandbox by name, or all sandboxes when `all` is true.
-#[allow(clippy::too_many_arguments)] // user-facing CLI command with explicit identity guards
 pub async fn sandbox_delete(
     server: &str,
     names: &[String],
     all: bool,
-    expected_id: Option<&str>,
-    expected_resource_version: Option<u64>,
     workspace: &str,
     tls: &TlsOptions,
     gateway: &str,
 ) -> Result<()> {
-    if (expected_id.is_some() || expected_resource_version.is_some()) && (all || names.len() != 1) {
-        return Err(miette!(
-            "--expected-id and --expected-resource-version require exactly one sandbox name"
-        ));
-    }
-    if expected_id.is_some_and(str::is_empty) {
-        return Err(miette!("--expected-id must not be empty"));
-    }
-    if expected_resource_version.is_some() && expected_id.is_none() {
-        return Err(miette!(
-            "--expected-resource-version requires --expected-id"
-        ));
-    }
-    if expected_resource_version == Some(0) {
-        return Err(miette!(
-            "--expected-resource-version must be greater than zero"
-        ));
-    }
     let mut client = grpc_client(server, tls).await?;
 
     let names_to_delete: Vec<String> = if all {
 
@@ -64,7 +64,6 @@ struct SandboxState {
     /// so a catalog lookup failure can be told apart from an empty catalog.
     fail_list_provider_profiles: Arc<AtomicBool>,
     deleted_names: Arc<Mutex<Vec<Vec<String>>>>,
-    delete_requests: Arc<Mutex<Vec<DeleteSandboxRequest>>>,
     create_requests: Arc<Mutex<Vec<CreateSandboxRequest>>>,
     expose_service_requests: Arc<Mutex<Vec<openshell_core::proto::ExposeServiceRequest>>>,
     fail_delete_sandbox_message: Arc<Mutex<Option<String>>>,
@@ -390,11 +389,6 @@ impl OpenShell for TestOpenShell {
         request: tonic::Request<DeleteSandboxRequest>,
     ) -> Result<Response<DeleteSandboxResponse>, Status> {
         let request = request.into_inner();
-        self.state
-            .delete_requests
-            .lock()
-            .await
-            .push(request.clone());
         self.state
             .deleted_names
             .lock()
@@ -1593,10 +1587,6 @@ async fn deleted_names(server: &TestServer) -> Vec<Vec<String>> {
     server.openshell.state.deleted_names.lock().await.clone()
 }
 
-async fn delete_requests(server: &TestServer) -> Vec<DeleteSandboxRequest> {
-    server.openshell.state.delete_requests.lock().await.clone()
-}
-
 async fn create_requests(server: &TestServer) -> Vec<CreateSandboxRequest> {
     server.openshell.state.create_requests.lock().await.clone()
 }
@@ -1706,8 +1696,6 @@ async fn sandbox_delete_continues_after_entry_failure() {
         &server.endpoint,
         &["failing-sandbox".to_string(), "later-sandbox".to_string()],
         false,
-        None,
-        None,
         "default",
         &tls,
         "openshell",
 
@@ -58,6 +58,19 @@ configuration validation live in `openshell_core::middleware`. Policy admission
 and the supervisor runtime consume the same contract without introducing a
 dependency from the policy crate to the supervisor implementation.
 
+## Extension Capabilities
+
+Extensions advertise namespaced string capabilities through `PeerMetadata`.
+Use shared constants in `extension_protocol` and pass optional capabilities to
+`extension_metadata`; do not add per-driver booleans for policy features.
+Negotiation validates and retains the extension's supported capability list.
+
+`POLICY_UI_V1` (`openshell.policy.ui.v1`) declares complete startup UI-policy
+support. The gateway checks the effective policy before driver validation or
+creation and rejects any explicit UI section when the capability is absent.
+Supporting drivers validate and enforce the concrete settings. Omitted UI
+preserves existing driver behavior; changing UI requires sandbox recreation.
+
 ## Protobuf Struct Conversion
 
 Use `openshell_core::proto_struct` when crossing between `serde_json` values and