Process container: clipboard restrictions are not enforced on the prerelease Windows build

[theelliotm]

Relevant area(s)

Windows

Brief description of your issue

Clipboard restrictions are not enforced on the prerelease Windows build. A config that asks for clipboard access to be blocked is accepted, the run succeeds, and the sandboxed process can still read and write the clipboard.

The same config and the same MXC build enforce the restriction correctly on every GA host, so this is a behavior difference on the prerelease build rather than a config or parsing problem.

This is 6 failing assertions, only on prerelease process-t1 in the 2026-09-23 nightly run. The other three jobs pass these:

• 25h2 process-t1
• 24h2 process-t1
• 23h2 process-t3

All three T1 jobs log the same process security environment spec built (PSEC 1.0, 144 bytes) line, so MXC is handing the OS an identical policy in each case.

Flagging this as security relevant: a restriction the caller explicitly asked for is silently not applied, and nothing in the output says so.

Steps to reproduce

1. On a prerelease Windows host, run tests/scripts/run_processcontainer_ui_mitigations_test.ps1 and tests/scripts/run_processcontainer_ui_policy_matrix_test.ps1.
2. Watch phases P4b and P4e.

The failing config is ui: { disable: false, clipboard: "none", injection: false } with processContainer.ui: { isolation: "container", desktopSystemControl: false, systemSettings: "none", ime: false }.

Expected behavior

ui.clipboard: "none" blocks both clipboard read and write. ui.clipboard: "read" blocks write. ui.clipboard: "write" blocks read.

Actual behavior

Both directions stay allowed:

P4b :: scenarioA: READCLIPBOARD (expected=blocked; got=allowed)
P4b :: scenarioA: WRITECLIPBOARD (expected=blocked; got=allowed)
P4e :: ui.clipboard=none -> READCLIPBOARD=blocked (expected=blocked; got=allowed)
P4e :: ui.clipboard=none -> WRITECLIPBOARD=blocked (expected=blocked; got=allowed)
P4e :: ui.clipboard=read -> WRITECLIPBOARD=blocked (expected=blocked; got=allowed)
P4e :: ui.clipboard=write -> READCLIPBOARD=blocked (expected=blocked; got=allowed)

Note this is the mirror image of #1245: on GA hosts the clipboard is always blocked regardless of config, and on the prerelease host it is always allowed regardless of config. Taken together it looks like ui.clipboard is not actually wired to enforcement on any host.