fix(mxc): reject cpu/memory limits instead of silently discarding them

crates/openshell-driver-mxc/README.md

@@ -26,6 +26,7 @@ it does not implement the Linux `ConnectSupervisor` protocol.
 | Network policy | With `egress_proxy = true` on `process_container`, an explicit `network_policies` rule activates MXC 0.8 loopback-only egress plus the full policy enforced by a per-sandbox OpenShell host CONNECT proxy. The driver injects proxy environment variables for proxy-aware clients; direct Internet access remains denied by MXC. A policy without network rules does not activate the proxy. Otherwise rejected synchronously. `isolation_session` remains fail-closed. |
 | Provider credentials | The child receives revision-scoped placeholders and non-secret provider environment only. The per-sandbox host proxy retains the resolver and substitutes credentials only for their bound endpoints. |
 | Process policy | Unsupported; MXC supplies OS isolation only. |
+| Resource limits | Unsupported; MXC exposes no CPU rate control or memory limiting to non-WSLC backends. `CreateSandbox` rejects any request carrying `cpu_limit`, `cpu_request`, `memory_limit`, or `memory_request` synchronously rather than silently discarding them. |
 | Dynamic forwarding | Supported through `openshell-supervisor-relay`; interactive exec/connect remain unsupported. |
 | Network middleware | Rejected before launch until the host proxy receives the gateway middleware registry. |
 | ETW/OCSF audit | Optional Windows Sandboxing ETW consumer attributes host events to OpenShell sandboxes and emits OCSF records. |

crates/openshell-driver-mxc/src/driver.rs

@@ -961,12 +961,22 @@ impl MxcComputeBackend {
                     "mxc driver does not support GPU sandboxes",
                 ));
             }
-            if let Some(tmpl) = &spec.template
-                && !tmpl.agent_socket_path.is_empty()
-            {
-                return Err(tonic::Status::invalid_argument(
-                    "mxc driver does not support agent_socket_path (no in-sandbox supervisor)",
-                ));
+            if let Some(tmpl) = &spec.template {
+                if !tmpl.agent_socket_path.is_empty() {
+                    return Err(tonic::Status::invalid_argument(
+                        "mxc driver does not support agent_socket_path (no in-sandbox supervisor)",
+                    ));
+                }
+                if let Some(resources) = &tmpl.resources
+                    && (!resources.cpu_limit.is_empty()
+                        || !resources.cpu_request.is_empty()
+                        || !resources.memory_limit.is_empty()
+                        || !resources.memory_request.is_empty())
+                {
+                    return Err(tonic::Status::invalid_argument(
+                        "mxc driver does not support cpu/memory resource limits (no Job Object enforcement); omit --cpu/--memory or use a driver that supports them",
+                    ));
+                }
             }
         }
         sandbox_config(sandbox)?;
@@ -2533,7 +2543,9 @@ fn make_sandbox_with_condition(
 mod lifecycle_tests {
     use super::*;
     use futures::StreamExt;
-    use openshell_core::proto::compute::v1::{DriverSandboxSpec, DriverSandboxTemplate};
+    use openshell_core::proto::compute::v1::{
+        DriverResourceRequirements, DriverSandboxSpec, DriverSandboxTemplate,
+    };
     use openshell_core::proto::{
         FilesystemPolicy, MiddlewareEndpointSelector, NetworkBinary, NetworkEndpoint,
         NetworkMiddlewareConfig, NetworkPolicyRule, SandboxPolicy, StaticCredentialBinding,
@@ -3625,6 +3637,30 @@ mod lifecycle_tests {
         assert!(error.message().contains("unrestricted egress fallback"));
     }
 
+    #[test]
+    fn cpu_and_memory_limits_are_rejected_fail_closed() {
+        let backend = MxcComputeBackend::new_mocked(MxcComputeConfig::default());
+        let mut sandbox = driver_sandbox("sb-cpu-memory-limits");
+        sandbox
+            .spec
+            .as_mut()
+            .unwrap()
+            .template
+            .as_mut()
+            .unwrap()
+            .resources = Some(DriverResourceRequirements {
+            cpu_limit: "1".into(),
+            memory_limit: "512Mi".into(),
+            ..Default::default()
+        });
+
+        let error = backend
+            .validate_sandbox_create(&sandbox)
+            .expect_err("cpu/memory limits are not enforceable on mxc and must fail closed");
+        assert_eq!(error.code(), tonic::Code::InvalidArgument);
+        assert!(error.message().contains("cpu/memory"));
+    }
+
     #[tokio::test]
     async fn processcontainer_live_config_carries_explicit_ui_policy() {
         let backend = MxcComputeBackend::new_mocked(MxcComputeConfig::default());