Add read-only Gateway isolation status plugin

[ChazGo]

What Problem This Solves

The packaged Windows Gateway needs to report the session mode selected by its launcher without giving the Gateway any ability to change, disable, or escape that isolation boundary. It also needs an obvious Control UI surface rather than relying on the generic plugin inventory.

Why This Change Was Made

• The launcher now reports its process-stable launch selection through CLAWCTL_GATEWAY_ISOLATION, with the exact values enabled and disabled.
• A Windows-packaging-owned bundled plugin reads that value once, exposes one authenticated read-only HTTP route, and contributes a sandboxed Gateway Isolation tab in the Control group.
• The plugin registers no Gateway methods, tools, services, mutation RPCs, broker, state store, or enable/disable control. Missing or invalid launcher values fail closed with HTTP 503.
• Payload composition provisions the plugin into OpenClaw's supported dist/extensions directory and asks the selected OpenClaw runtime to verify that the bundled plugin loads with exactly one HTTP route and no capability surfaces. This also rejects incompatible manual openclaw_ref overrides.
• The wording, inverse CLI command, status tones, and copy affordance follow feat(ui): show reported Gateway isolation openclaw#144243. The session-switch command and immediate restart behavior remain intentionally out of scope for this status/reporting change.

User Impact

The Control sidebar shows Gateway Isolation with Reported Gateway Isolation: Enabled or Disabled, plus the approved Change with CLI guidance. The current interactive-user-session launcher path truthfully reports disabled; a future isolated agent-session launcher can pass the typed Enabled mode without changing the plugin.

This is diagnostic reporting only. It does not claim cryptographic attestation or independently verify the security boundary.

Evidence

Validated the implemented launcher, plugin, authenticated Control UI, and payload composition contracts on this Windows machine. Production source is 9aa1df286c2b6fd59b4c101201ddae0ae6000324; validation commit 084f6d6303ed97a93f66aded8cddb614c6c0b51b adds reproducible harnesses, regression tests, sanitized results, hashes, and screenshots without changing production code.

Coverage	Observed result	Proof
Real launcher -> Gateway -> authenticated Control UI	NativeAOT launcher overrode inherited enabled input and reported Disabled in the sidebar-selected sandboxed tab	Runtime matrix
Input and HTTP matrix	8 Gateway/browser scenarios passed, with 80 HTTP checks. Explicit launcher-input fixtures covered enabled, disabled, missing, invalid, uppercase, empty, and whitespace. GET/HEAD authentication returned 401 for anonymous/wrong tokens and 200/503 for correct tokens. POST/PUT/PATCH/DELETE returned identical read-only content, with subsequent GET unchanged	Results and output
Control UI and Copy	Matching bundled hello-ok in every scenario; sandbox="allow-scripts"; exact state, tone, inverse command, and real clipboard readback for valid states. Invalid inputs displayed the diagnostic without stale status or controls. 6 additional browser capability fixtures passed for Clipboard API, legacy-copy fallback, and manual selection	Copy fixture results
Launcher and plugin regressions	57 .NET tests and 21 Node tests passed, including typed mode validation, exact descriptor registration, fail-closed rendering, and read-once behavior across seven initial inputs	.NET results, Node TAP
Real runtime registration	Bundled, enabled, activated, loaded, imported; one HTTP route, zero Gateway methods, tools, services, diagnostics, hooks, commands, discovery services, MCP servers, or LSP servers	Runtime inspection
Payload composition	66 fixture cases passed, 33 each for x64/ARM64. Six accepted cases verified exact shipping files/hashes, metadata, test exclusion, and environment restoration. Sixty incompatible directory/runtime cases were rejected as expected by the real build script	Payload matrix, transcript
Existing policy checks	Signing-input and workflow package-version checks passed	Output

Environment: Windows x64, .NET SDK 10.0.401, Node 24.16.0, Edge 152.0.4191.66. Expanded application layout with the published NativeAOT launcher, pinned OpenClaw 2026.8.2 (0965053fe6b9341776df147a6934b7485c60b5ca), and bundled UI built from the same unmodified source using the Gateway's canonical timestamp 2026-09-11T00:24:39.157Z. Authentication and build-admission checks ran normally. Launcher-input fixtures supply process input explicitly while retaining the real Gateway, plugin, and Control UI. Each run used an isolated profile; validation-owned processes were stopped and the port verified free.

Contract-to-proof matrix, reproducible commands, and source provenance · SHA-256 fingerprints

Real launcher: Disabled, inherited input overridden, exact command copied

Enabled launcher-input fixture: exact status and inverse command copied

Invalid launcher-input fixture: fail-closed diagnostic in the authenticated Control UI

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 11, 2026, 6:32 PM ET / 22:32 UTC (Revision 4).

ClawSweeper review

What this changes

Adds a bundled Gateway Isolation status tab, supplies its reported mode from the Windows launcher, and validates plugin loading during payload construction.

Merge readiness

⛔ Blocked before merge - 6 items remain

The reporting feature remains absent from main, and related discussion now points to this PR as the packaging-owned implementation. The prior unsupported-command finding and package upgrade proof gap remain unresolved.

Priority: P3
Reviewed head: 084f6d6303ed97a93f66aded8cddb614c6c0b51b

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Useful implementation and substantial real runtime evidence remain limited by misleading CLI guidance and incomplete package compatibility proof.
Proof confidence	🦐 gold shrimp (3/6)	Needs stronger real behavior proof before merge: The pinned Windows traces and inspected screenshots convincingly cover launcher reporting, real Gateway authentication, sandboxed rendering, invalid inputs, and clipboard readback. The remaining gap is delivered-package fresh-install and upgrade behavior: expanded-layout runs and synthetic composition fixtures do not establish activation with retained user plugin settings. Add redacted package evidence, then update the PR body for automatic re-review; if needed, ask a maintainer to comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: The pinned Windows traces and inspected screenshots convincingly cover launcher reporting, real Gateway authentication, sandboxed rendering, invalid inputs, and clipboard readback. The remaining gap is delivered-package fresh-install and upgrade behavior: expanded-layout runs and synthetic composition fixtures do not establish activation with retained user plugin settings. Add redacted package evidence, then update the PR body for automatic re-review; if needed, ask a maintainer to comment @clawsweeper re-review.
Evidence reviewed	10 items	Policy and introduction boundary: No AGENTS.md or applicable maintainer-notes directory was found. Read current-main CONTRIBUTING.md. Reviewed the pinned merge-base-to-head changes separately from base-branch drift; no pinned test merge is available, so no claim is made that this branch removes newer main behavior. Unsupported CLI guidance remains: The introduced page offers copyable isolation enable/disable commands. Current-main ClawCtlCommandParser accepts only help, version, and setup; other commands return an unknown-command error. The relevant plugin production code is unchanged from the original implementation and earlier reviews. Current-main necessity and release check: Main has no isolation plugin or launcher mode projection; its README describes isolated sessions as future work. The GitHub releases endpoint returned no releases. No merged fixing PR was established.
Findings	1 actionable finding	[P2] Withhold CLI guidance until the packaged command exists
Security	None	None.

How this fits together

The Windows launcher starts the packaged OpenClaw Gateway and supplies its selected session mode. A bundled plugin reads that value once and displays diagnostic status through an authenticated Control UI page.

flowchart LR
  A[Windows launcher] --> B[Launch-time session mode]
  B --> C[Bundled status plugin]
  C --> D{Recognized value?}
  D -->|Yes| E[Reported isolation status]
  D -->|No| F[Unavailable diagnostic]
  E --> G[Authenticated Control UI tab]
  F --> G

Loading

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: The pinned Windows traces and inspected screenshots convincingly cover launcher reporting, real Gateway authentication, sandboxed rendering, invalid inputs, and clipboard readback. The remaining gap is delivered-package fresh-install and upgrade behavior: expanded-layout runs and synthetic composition fixtures do not establish activation with retained user plugin settings. Add redacted package evidence, then update the PR body for automatic re-review; if needed, ask a maintainer to comment @clawsweeper re-review.
• Withhold CLI guidance until the packaged command exists (P2) - The page instructs users to run clawctl gateway-isolation enable or disable, but the packaged parser only supports help, version, and setup, so both instructions fail as unknown commands. The related controls proposal is closed unmerged. Hide this action or explicitly mark it unavailable until command support lands; the prior finding remains unresolved.
• Resolve merge risk (P1) - Default-enabled plugin delivery has not been demonstrated through an installed-package upgrade; existing allowlists or disabled-plugin settings can legitimately suppress the tab and must remain respected.
• Resolve merge risk (P1) - The new payload gate intentionally makes previously selectable upstream refs fail to build when their plugin directory or runtime inspection contract is incompatible.
• Resolve merge risk (P1) - GitHub reports merge conflicts, and integration with current main has not been validated.
• Complete next step (P2) - Resolve the current merge conflicts against main and refresh validation on the reconciled head.

Findings

• [P2] Withhold CLI guidance until the packaged command exists — plugins/gateway-isolation/index.js:168-173

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and validation growth	Production +427 net lines; tests and validation harnesses +1050 net lines	Production growth supports the stated reporting and provisioning feature; most additional executable code supplies validation.
Recorded runtime coverage	8 Windows scenarios; 80 HTTP checks	These exercise the real reporting path, while installed-package upgrade coverage remains separate.

Root-cause cluster

Relationship: canonical
Canonical: #28
Summary: Related package-controls discussion explicitly redirects to this PR; the closed proposal does not supply its unfinished command implementation.

Members:

• superseded: draft: add package-owned gateway isolation controls #26 - Closed unmerged with a collaborator comment pointing to the current packaging-owned implementation.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Verify delivery and preserve plugin policy (recommended)
   Demonstrate fresh installation and upgrade with existing plugin settings, retaining explicit disablement and allowlists and documenting incompatible upstream-ref rejection.

Technical review

Best possible solution:

Deliver packaging-owned diagnostic status with truthful availability guidance, preserved plugin preferences, and verified fresh-install and upgrade behavior.

Do we have a high-confidence way to reproduce the issue?

Yes for the remaining finding: following either displayed isolation command reaches the packaged parser's unknown-command branch. This is source-proven; no target code was executed during review.

Is this the best way to solve the issue?

The packaging-owned plugin is a suitable boundary, but the proposed UI should not present unfinished commands as usable instructions.

Full review comments:

• [P2] Withhold CLI guidance until the packaged command exists — plugins/gateway-isolation/index.js:168-173
  The page instructs users to run clawctl gateway-isolation enable or disable, but the packaged parser only supports help, version, and setup, so both instructions fail as unknown commands. The related controls proposal is closed unmerged. Hide this action or explicitly mark it unavailable until command support lands; the prior finding remains unresolved.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.96

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 52f2a53fb62b.

Labels

Label justifications:

• P3: This adds diagnostic visibility for a future isolation capability rather than repairing an urgent shipped workflow.
• merge-risk: 🚨 compatibility: Bundled default activation and stricter upstream payload acceptance need fresh-install and upgrade compatibility evidence.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The pinned Windows traces and inspected screenshots convincingly cover launcher reporting, real Gateway authentication, sandboxed rendering, invalid inputs, and clipboard readback. The remaining gap is delivered-package fresh-install and upgrade behavior: expanded-layout runs and synthetic composition fixtures do not establish activation with retained user plugin settings. Add redacted package evidence, then update the PR body for automatic re-review; if needed, ask a maintainer to comment @clawsweeper re-review.

Evidence

What I checked:

• Policy and introduction boundary: No AGENTS.md or applicable maintainer-notes directory was found. Read current-main CONTRIBUTING.md. Reviewed the pinned merge-base-to-head changes separately from base-branch drift; no pinned test merge is available, so no claim is made that this branch removes newer main behavior. (084f6d6303ed)
• Unsupported CLI guidance remains: The introduced page offers copyable isolation enable/disable commands. Current-main ClawCtlCommandParser accepts only help, version, and setup; other commands return an unknown-command error. The relevant plugin production code is unchanged from the original implementation and earlier reviews. (plugins/gateway-isolation/index.js:168, 084f6d6303ed)
• Current-main necessity and release check: Main has no isolation plugin or launcher mode projection; its README describes isolated sessions as future work. The GitHub releases endpoint returned no releases. No merged fixing PR was established. (README.md:188, 52f2a53fb62b)
• Real Windows reporting proof: Inspected all three prepared screenshots, runtime results, and the production-path harness. Recorded Windows NativeAOT-to-Gateway-to-Control-UI execution covers inherited enabled input being overridden to disabled, seven direct-input fixtures, 80 HTTP checks, authenticated handshakes, sandbox attributes, and actual clipboard readback. Evidence identifies production source 9aa1df2; the production files remain unchanged at the reviewed head. (docs/validation/pr-28/runtime-matrix.json:1, 084f6d6303ed)
• Package compatibility coverage boundary: The runtime harness uses an expanded application layout and newly generated profiles. The 66 payload cases explicitly use synthetic npm packages and synthetic inspection responses. These provide useful composition coverage but do not exercise installed-MSIX fresh installation or upgrade with existing plugin preferences. (scripts/validation/Test-GatewayIsolationPayloadMatrix.ps1:192, 084f6d6303ed)
• Affirmative upstream dependency: The plugin calls OpenClaw's existing Control UI descriptor and authenticated HTTP-route registration APIs. Build-Payload.ps1 installs it into dist/extensions and invokes the selected OpenClaw runtime for inspection, making upstream discovery and activation behavior directly relevant. (plugins/gateway-isolation/index.js:228, 084f6d6303ed)

Likely related people:

• anna-dingler: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• MythiliMur: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Hide or clearly mark the unavailable isolation commands.
• Add redacted installed-package fresh-install and upgrade evidence showing tab activation and respected plugin preferences.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (3 earlier review cycles)

• reviewed 2026-09-11T01:13:12.690Z sha 9aa1df2 :: needs real behavior proof before merge. :: [P2] Withhold CLI guidance until the packaged command exists
• reviewed 2026-09-11T02:53:21.940Z sha 2ce86d5 :: needs real behavior proof before merge. :: [P2] Withhold CLI guidance until the packaged command exists
• reviewed 2026-09-11T04:20:26.156Z sha 084f6d6 :: needs real behavior proof before merge. :: [P2] Withhold CLI guidance until the packaged command exists