[Chaz Gordish (ChazGo)]

📖 Description

Propose one resolveToolRequirements operation that returns suggested container requirements and the original input indexes not completely resolved.

The API spec covers inputs, outputs, matching, errors, TypeScript/Rust/.NET signatures, and one Zava Agent example. The developer spec defines catalog authoring, dependency composition, validation, packaging, and the implementation test plan.

This is a documentation-only proposal for API review before implementation. It includes no SDK implementation or API stubs. It is not part of MXC 1.0; no later release is committed.

🔗 References

Supersedes #1309 for a fresh review of the resolver-only proposal. The earlier discussion remains there for reference.

🔍 Validation

• Strict TypeScript compilation of the declarations and example against the current SDK request types.
• Declaration parity with the local resolver-only review stubs, including Rust/.NET signature excerpts.
• Example caller-flow checks using fake SDK/application hooks, covering saved settings, restrictions, absent and empty results, error propagation, and explicit working directory.
• JSON example preservation, 57 relative links/anchors, and git diff --check.

These are document, type, and example checks. The resolver is not implemented; native resolution and containment were not tested.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see pull request builds)

No issue is linked. Implementation instructions and Cargo.lock are unchanged.

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See pull request builds.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See pull request builds
for the steps.

Microsoft Reviewers: Open in CodeFlow

[Copilot]

🔵 Needs a closer look

Security-sensitive policy composition and unresolved cross-SDK and platform-context semantics require designated human API review.

3 open findings

• Define Rust and .NET declarations for new public types · New
• Specify behavior for non-host platform resolution · New
• Fix broken pinned Node V1 reference link · New

What changed in this PR

Proposes a documentation-only Policy Store resolver API and its catalog, validation, packaging, and testing design.

Changes:

• Defines resolveToolRequirements behavior and cross-SDK signatures.
• Specifies catalog matching, composition, governance, and validation.
• Adds proposal links to the root README.

File	Description
README.md	Links the proposal documents.
docs/​mxc-policy-store.md	Defines catalog and implementation requirements.
docs/​mxc-policy-store-api.md	Defines the proposed public API contract and example.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.