[Gudge (MGudgin)]

📖 Description

This PR adds regression coverage for identical-path deniedPaths precedence
through the published 1.0.0 MXC request JSON loader. The scenarios verify
that denied entries override readonly and readwrite grants while unrelated
grants and the deny entry survive normalization.

Details

• Cover deny versus readonly, readwrite, and both allow lists.
• Extend the existing contract request tests using existing fixture paths.

These are loader/normalization assertions. The existing ProcessContainer
filesystem-grants-denials-and-aliases workload separately exercises actual
deny-versus-readwrite enforcement on hosts with native denied-path support.

🔗 References

• Existing precedence implementation: Add filesystem policy path validation (same-path conflict, existence check) #551.
• Existing functional coverage:
  tests/scripts/run_processcontainer_policy_tests.ps1,
  filesystem-grants-denials-and-aliases.

🔍 Validation

• cargo fmt --all -- --check — passed.
• cargo check -p mxc-sdk --test mxc_contract_v1_0_0 — passed.
• cargo clippy -p mxc-sdk --test mxc_contract_v1_0_0 -- -D warnings — passed.
• cargo test -p mxc-sdk --test mxc_contract_v1_0_0 request:: — passed:
  21 tests, including the new test's three deny-conflict scenarios.
• cargo test -p mxc-sdk --lib config_parser — passed: 117 tests.

Validated on Windows x64. Linux/macOS and live backend enforcement suites
were not run for this test-only change.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see pull request builds)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See pull request builds.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See pull request builds
for the steps.

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟢 Approval recommended

The focused test-only addition checks the intended normalization behavior without changing production code, and no blocking issues were identified.

No open issues 🎉

What changed in this PR

Adds regression coverage for the denied-path precedence introduced in #551 through the published 1.0.0 MXC request JSON loader. Production behavior is unchanged.

Changes:

• Tests denied paths overriding readonly grants, readwrite grants, and both together.
• Verifies normalization preserves unrelated grants and the denied entry, using existing fixture directories.

File	Description
src/​mxc-sdk/​tests/​mxc_contract/​v1_0_0/​request.rs	Adds three denied-path conflict scenarios to the existing request tests.

_{Review effort: Balanced}