diff --git a/.github/workflows/gateway-msix.yml b/.github/workflows/gateway-msix.yml index 15d1530d..336937ef 100644 --- a/.github/workflows/gateway-msix.yml +++ b/.github/workflows/gateway-msix.yml @@ -48,6 +48,11 @@ jobs: cache: true cache-dependency-path: Directory.Packages.props + - name: Set up Node.js + uses: actions/setup-node@v6 + with: + node-version: ${{ env.NODE_VERSION }} + - name: Restore run: dotnet restore .\OpenClaw.Gateway.MSIX.slnx @@ -67,6 +72,11 @@ jobs: run: > .\scripts\Test-WorkflowPackageVersion.Tests.ps1 + - name: Test Gateway isolation plugin + shell: pwsh + run: > + .\scripts\Test-GatewayIsolationPlugin.Tests.ps1 + build-package: name: Build OpenClaw npm package runs-on: ubuntu-latest diff --git a/README.md b/README.md index f5d4df6d..11b263b7 100644 --- a/README.md +++ b/README.md @@ -41,13 +41,18 @@ copy, repair, or otherwise change package files at runtime. Every OpenClaw child process runs with `OPENCLAW_SUPERVISOR_MODE=external`, `OPENCLAW_SERVICE_REPAIR_POLICY=external`, and -`OPENCLAW_NO_AUTO_UPDATE=1`. These declare external lifecycle ownership, -prevent doctor-owned service repair, and disable configured background -auto-updates. The pinned OpenClaw `v2026.8.2` release honors external supervisor -mode by refusing native service mutation and OpenClaw self-update with guidance -to use the external supervisor's workflow. This behavior belongs to upstream -OpenClaw; the launcher does not reserve, reject, or rewrite upstream command -arguments. +`OPENCLAW_NO_AUTO_UPDATE=1`. It also reports the selected Windows Gateway +session mode through the process-stable +`CLAWCTL_GATEWAY_ISOLATION=enabled|disabled` environment variable. The current +interactive-session launch path reports `disabled`; the future isolated-session +launch path will select `enabled` when that session switch is implemented. +These values declare external lifecycle ownership, prevent doctor-owned service +repair, disable configured background auto-updates, and expose diagnostic +isolation status without claiming independent attestation. The pinned OpenClaw +`v2026.8.2` release honors external supervisor mode by refusing native service +mutation and OpenClaw self-update with guidance to use the external supervisor's +workflow. This behavior belongs to upstream OpenClaw; the launcher does not +reserve, reject, or rewrite upstream command arguments. OpenClaw inherits the terminal's working directory; the launcher does not make the read-only application directory the workspace. @@ -100,7 +105,10 @@ both: Changing only the workflow-dispatch default does not change automatic builds. For a one-time override, run **Build OpenClaw Gateway MSIX** manually and provide a tag, branch, or preferably a full 40-character commit SHA in -`openclaw_ref`. +`openclaw_ref`. Payload composition validates that the selected OpenClaw +runtime can discover and load the packaging-owned Gateway Isolation plugin +with its required read-only route shape; incompatible older refs fail instead +of producing a package without status UI. The payload artifact records the requested ref and resolved upstream commit in `payload-metadata.json`. That build-only file is not embedded in the MSIX. @@ -125,9 +133,14 @@ dotnet test .\OpenClaw.Gateway.MSIX.slnx ` ``` `scripts\Build-Payload.ps1` npm-installs an OpenClaw package into an expanded, -architecture-specific application tree. `scripts\Build-MSIX.ps1` copies that -tree into package content, rejects any Node.js executable or runtime archive, -creates a per-file inventory, and then creates an unsigned NativeAOT MSIX. +architecture-specific application tree and provisions the packaging-owned, +enabled-by-default Gateway Isolation plugin into OpenClaw's bundled plugin +directory. The plugin adds a read-only **Gateway Isolation** tab to the Control +group and serves it through an authenticated, sandboxed plugin route. It reads +only the launch-time `CLAWCTL_GATEWAY_ISOLATION` value and registers no mutation +RPC or process control. `scripts\Build-MSIX.ps1` copies that tree into package +content, rejects any Node.js executable or runtime archive, creates a per-file +inventory, and then creates an unsigned NativeAOT MSIX. `scripts\Build-LocalMSIX.ps1` can reuse a successful workflow payload or a local payload directory. The Node.js used by the payload build jobs is build infrastructure only and is not copied into the MSIX. diff --git a/docs/validation/pr-28/README.md b/docs/validation/pr-28/README.md new file mode 100644 index 00000000..f9815d0a --- /dev/null +++ b/docs/validation/pr-28/README.md @@ -0,0 +1,116 @@ +# Gateway Isolation validation + +## Why is this change being made? + +PR #28 adds launcher-reported Gateway isolation status, a read-only authenticated +Control UI tab, and payload provisioning. This evidence covers those implemented +contracts against production source `9aa1df286c2b6fd59b4c101201ddae0ae6000324`. + +## What changed? + +Added reusable validation harnesses, expanded regression tests, named test results, +HTTP/browser assertions, runtime registration output, and authentic screenshots. +Launcher and plugin production code are unchanged. + +## How was the change tested? + +### Evidence matrix + +| Implemented contract | Executed check and result | Proof | +|---|---|---| +| Interactive launcher selects `disabled` | Real NativeAOT `openclaw.exe` started the Gateway with inherited `CLAWCTL_GATEWAY_ISOLATION=enabled`. The child Gateway and authenticated Control UI reported **Disabled**, proving the launcher overrides inherited input | [Runtime matrix: launcher-disabled](runtime-matrix.json), [screenshot](launcher-disabled.png) | +| Both exact values are supported | Real Gateway processes with explicit `enabled` and `disabled` launcher-input fixtures rendered the correct state, green/warning tone, and inverse CLI command | [Runtime matrix](runtime-matrix.json), [Enabled](fixture-enabled.png), [Disabled](fixture-disabled.png) | +| Invalid or absent input fails closed | Missing, `invalid`, `ENABLED`, empty, and whitespace-padded input each returned **HTTP 503** and rendered the invalid-launcher-mode diagnostic, with no status badge, CLI command, or Copy control | [Runtime matrix](runtime-matrix.json), [missing](fixture-missing.png), [invalid](fixture-invalid.png), [uppercase](fixture-uppercase.png), [empty](fixture-empty.png), [whitespace](fixture-whitespace.png) | +| Route authentication | Each of eight Gateway runs checked GET and HEAD with no token, a wrong token, and the correct token. Unauthorized requests returned **401**; authorized requests returned **200** or **503** according to input. HEAD had an empty body | [80 HTTP case results](runtime-matrix.json) | +| Read-only route | Authenticated POST, PUT, PATCH, and DELETE returned the same read-only page bytes as GET. A subsequent GET remained identical. This handler serves status for these methods; it does not implement a mutation action | [Runtime matrix](runtime-matrix.json), [command output](runtime-checks.txt) | +| Response hardening | Successful and fail-closed responses had `Cache-Control: no-store`, `X-Content-Type-Options: nosniff`, `Referrer-Policy: no-referrer`, and CSP restricting frame ancestors to self | [Runtime assertions](../../../scripts/validation/gateway-isolation-runtime.mjs) | +| Full authenticated Control UI integration | All eight runs completed normal `hello-ok` handshakes with the matching bundled build, exposed the sidebar tab, and rendered the plugin in `sandbox="allow-scripts"` without `allow-same-origin` | [Runtime matrix](runtime-matrix.json), screenshots below | +| Copy behavior | Clicked Copy for the real launcher and both valid input fixtures. The button reported **Copied**, and browser clipboard readback equaled the exact inverse CLI command | [Runtime matrix](runtime-matrix.json) | +| Clipboard capability branches | Six browser capability fixtures exercised Clipboard API success, API denial with legacy-copy success, and both methods unavailable, for both valid states. Manual fallback kept the exact command selected and showed the manual-copy instruction | [Fixture results](copy-fixtures.json), [output](copy-checks.txt), [harness](../../../scripts/validation/gateway-isolation-copy.mjs) | +| Process-stable reporting | Seven initial inputs were each read exactly once. After plugin construction, repeated changes to the input source did not change any response, including fail-closed responses | [21 passing Node tests](plugin-tests.tap), [test source](../../../plugins/gateway-isolation/index.test.js) | +| Typed launcher selection | Enabled/Disabled mappings and invalid enum rejection passed, alongside argument forwarding, working-directory, process, and entrypoint regressions | [57 named passing .NET results](launcher-tests.json), [test source](../../../tests/OpenClaw.Launcher.Tests/GatewayLauncherTests.cs) | +| Minimal runtime surface | Real launcher-driven runtime inspection reported bundled, enabled, activated, loaded, imported; **one HTTP route**, **zero Gateway methods, tools, services, diagnostics, hooks, commands, discovery services, MCP servers, and LSP servers** | [Sanitized runtime inspection](runtime-registration.json) | +| Control descriptor | Node tests verify the exact label, Control group, order, icon, route, `operator.read` scope, gateway authentication, and exact path matching | [Node results](plugin-tests.tap) | +| Payload acceptance and rejection | **66 passed:** 33 per architecture. Six accepted cases verified exact three-file shipping content, matching hashes, metadata, excluded tests, and environment restoration. Sixty cases rejected missing/conflicting plugin directories, failed runtime inspection, and invalid/missing runtime shapes | [Payload matrix](payload-matrix.json), [transcript](payload-matrix.txt), [reusable harness](../../../scripts/validation/Test-GatewayIsolationPayloadMatrix.ps1) | +| Signing and workflow regressions | Existing signing-input and workflow package-version checks passed | [Command output](policy-checks.txt) | + +### Screenshots + +**Real NativeAOT launcher, inherited input `enabled`, actual reported state Disabled:** + +![Real launcher reports Disabled and copies the enable command](launcher-disabled.png) + +**Real Gateway with explicit `enabled` launcher-input fixture:** + +![Enabled input fixture displays Enabled and copies the disable command](fixture-enabled.png) + +**Real Gateway with missing launcher-input fixture:** + +![Missing input fails closed in the authenticated Control UI](fixture-missing.png) + +**Real Gateway with invalid launcher-input fixture:** + +![Invalid input fails closed in the authenticated Control UI](fixture-invalid.png) + +The valid-state fixtures set the process input directly while running the real +Gateway, plugin, authentication, and Control UI. The launcher case runs the actual +published executable. All screenshots are captured after clicking Gateway +Isolation through the normal Control UI. The same browser context is reused +across the matrix, including valid-to-invalid transitions. + +### Test environment and provenance + +Windows x64 build `10.0.26687.0`, .NET SDK `10.0.401`, Node.js `24.16.0`, and +Microsoft Edge `152.0.4191.66` through Playwright. The application uses an expanded +package layout: the NativeAOT launcher beside `app\openclaw.mjs`. + +The pinned OpenClaw `2026.8.2` runtime, commit +`0965053fe6b9341776df147a6934b7485c60b5ca`, came from +[workflow run 34546297901](https://github.com/openclaw/openclaw-windows-packaging/actions/runs/34546297901), +artifact `openclaw-gateway-payload-x64` (`10179486438`). That artifact's packaging +commit was `52f2a53fb62b13499ba2692d81870413fcaf943a`. The three PR-owned plugin +files were provisioned into `app\dist\extensions\gateway-isolation`. + +The bundled Control UI was built from unmodified source at the same pinned +OpenClaw commit, with its frozen lockfile and declared pnpm `12.1.0`. +The supported build inputs used the Gateway's canonical build timestamp: + +```powershell +$env:GIT_COMMIT = '0965053fe6b9341776df147a6934b7485c60b5ca' +$env:OPENCLAW_BUILD_TIMESTAMP = '2026-09-11T00:24:39.157Z' +$env:OPENCLAW_CONTROL_UI_RELEASE_BUILD = '1' +pnpm install --frozen-lockfile --ignore-scripts +pnpm --dir ui build +``` + +Gateway and UI reported +`2026.8.2-release-0965053fe6b9-2026-09-11T00-24-39.157Z`. +Served JavaScript matched the rebuilt output hash. Authentication and bundled +build-admission checks ran normally. [SHA-256 fingerprints](hashes.json) identify +the exact launcher, Node runtime, plugin, runtime entrypoint, build metadata, +and UI assets. The runtime matrix also records the tested executable hashes. + +### Reproduction + +From the repository root, with a published launcher/application layout and the +compatible Node executable available: + +```powershell +dotnet test .\OpenClaw.Gateway.MSIX.slnx --configuration Release --no-restore +node --test --test-reporter=tap .\plugins\gateway-isolation\index.test.js +node .\scripts\validation\gateway-isolation-runtime.mjs ` + +node .\scripts\validation\gateway-isolation-copy.mjs ` + +pwsh -NoProfile -File .\scripts\validation\Test-GatewayIsolationPayloadMatrix.ps1 ` + -TestRoot .\.validation-payload-matrix ` + -EvidenceDirectory .\docs\validation\pr-28 ` + -ProductionSourceCommit 9aa1df286c2b6fd59b4c101201ddae0ae6000324 +.\scripts\Test-SigningInputs.Tests.ps1 +.\scripts\Test-WorkflowPackageVersion.Tests.ps1 +``` + +The runtime harness creates isolated profiles and random test credentials, checks +that its loopback port is free before starting, and stops only the process trees +it started. After each case it verifies the port is free. Public results contain +assertions, versions, and hashes rather than tokens or machine-local paths. diff --git a/docs/validation/pr-28/copy-checks.txt b/docs/validation/pr-28/copy-checks.txt new file mode 100644 index 00000000..7f2fa31f --- /dev/null +++ b/docs/validation/pr-28/copy-checks.txt @@ -0,0 +1,6 @@ +PASS enabled/clipboard-api: copy success +PASS enabled/legacy-fallback: copy success +PASS enabled/manual-selection: manual text remains selected +PASS disabled/clipboard-api: copy success +PASS disabled/legacy-fallback: copy success +PASS disabled/manual-selection: manual text remains selected diff --git a/docs/validation/pr-28/copy-fixtures.json b/docs/validation/pr-28/copy-fixtures.json new file mode 100644 index 00000000..c9f65a56 --- /dev/null +++ b/docs/validation/pr-28/copy-fixtures.json @@ -0,0 +1,104 @@ +{ + "kind": "Browser capability fixtures against the actual rendered plugin page", + "completedAt": "2026-09-11T03:55:15.070Z", + "cases": [ + { + "mode": "enabled", + "capabilityFixture": "clipboard-api", + "command": "clawctl gateway-isolation disable", + "label": "Copied", + "calls": [ + { + "method": "clipboard.writeText", + "value": "clawctl gateway-isolation disable" + } + ], + "passed": true + }, + { + "mode": "enabled", + "capabilityFixture": "legacy-fallback", + "command": "clawctl gateway-isolation disable", + "label": "Copied", + "calls": [ + { + "method": "clipboard.writeText", + "value": "clawctl gateway-isolation disable" + }, + { + "method": "execCommand", + "command": "copy", + "selection": "clawctl gateway-isolation disable" + } + ], + "passed": true + }, + { + "mode": "enabled", + "capabilityFixture": "manual-selection", + "command": "clawctl gateway-isolation disable", + "label": "Selected", + "calls": [ + { + "method": "clipboard.writeText", + "value": "clawctl gateway-isolation disable" + }, + { + "method": "execCommand", + "command": "copy", + "selection": "clawctl gateway-isolation disable" + } + ], + "passed": true + }, + { + "mode": "disabled", + "capabilityFixture": "clipboard-api", + "command": "clawctl gateway-isolation enable", + "label": "Copied", + "calls": [ + { + "method": "clipboard.writeText", + "value": "clawctl gateway-isolation enable" + } + ], + "passed": true + }, + { + "mode": "disabled", + "capabilityFixture": "legacy-fallback", + "command": "clawctl gateway-isolation enable", + "label": "Copied", + "calls": [ + { + "method": "clipboard.writeText", + "value": "clawctl gateway-isolation enable" + }, + { + "method": "execCommand", + "command": "copy", + "selection": "clawctl gateway-isolation enable" + } + ], + "passed": true + }, + { + "mode": "disabled", + "capabilityFixture": "manual-selection", + "command": "clawctl gateway-isolation enable", + "label": "Selected", + "calls": [ + { + "method": "clipboard.writeText", + "value": "clawctl gateway-isolation enable" + }, + { + "method": "execCommand", + "command": "copy", + "selection": "clawctl gateway-isolation enable" + } + ], + "passed": true + } + ] +} diff --git a/docs/validation/pr-28/e2e-results.json b/docs/validation/pr-28/e2e-results.json new file mode 100644 index 00000000..c52a82f7 --- /dev/null +++ b/docs/validation/pr-28/e2e-results.json @@ -0,0 +1,33 @@ +{ + "timestamp": "2026-09-11T02:45:20.860Z", + "browser": "152.0.4191.66", + "browserEngine": "Microsoft Edge (headless Chromium)", + "launcher": "NativeAOT win-x64, unpackaged app layout", + "admissionBypasses": false, + "events": [ + { + "event": "route-auth-check", + "anonymous": 401, + "authenticated": 200, + "cacheControl": "no-store", + "csp": "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; frame-ancestors 'self'" + }, + { + "event": "authenticated-hello-ok", + "version": "2026.8.2", + "buildId": "2026.8.2-release-0965053fe6b9-2026-09-11T00-24-39.157Z", + "controlUiBuildSource": "bundled" + }, + { + "event": "control-ui-plugin-tab", + "state": "Disabled", + "sandbox": "allow-scripts", + "command": "clawctl gateway-isolation enable", + "realLauncherMode": true + }, + { + "event": "copy-affordance", + "result": "Copied" + } + ] +} \ No newline at end of file diff --git a/docs/validation/pr-28/fixture-disabled.png b/docs/validation/pr-28/fixture-disabled.png new file mode 100644 index 00000000..e3be96a0 Binary files /dev/null and b/docs/validation/pr-28/fixture-disabled.png differ diff --git a/docs/validation/pr-28/fixture-empty.png b/docs/validation/pr-28/fixture-empty.png new file mode 100644 index 00000000..0b4559fd Binary files /dev/null and b/docs/validation/pr-28/fixture-empty.png differ diff --git a/docs/validation/pr-28/fixture-enabled.png b/docs/validation/pr-28/fixture-enabled.png new file mode 100644 index 00000000..d0518d6f Binary files /dev/null and b/docs/validation/pr-28/fixture-enabled.png differ diff --git a/docs/validation/pr-28/fixture-invalid.png b/docs/validation/pr-28/fixture-invalid.png new file mode 100644 index 00000000..0b4559fd Binary files /dev/null and b/docs/validation/pr-28/fixture-invalid.png differ diff --git a/docs/validation/pr-28/fixture-missing.png b/docs/validation/pr-28/fixture-missing.png new file mode 100644 index 00000000..0b4559fd Binary files /dev/null and b/docs/validation/pr-28/fixture-missing.png differ diff --git a/docs/validation/pr-28/fixture-uppercase.png b/docs/validation/pr-28/fixture-uppercase.png new file mode 100644 index 00000000..0b4559fd Binary files /dev/null and b/docs/validation/pr-28/fixture-uppercase.png differ diff --git a/docs/validation/pr-28/fixture-whitespace.png b/docs/validation/pr-28/fixture-whitespace.png new file mode 100644 index 00000000..0b4559fd Binary files /dev/null and b/docs/validation/pr-28/fixture-whitespace.png differ diff --git a/docs/validation/pr-28/gateway-isolation-e2e.png b/docs/validation/pr-28/gateway-isolation-e2e.png new file mode 100644 index 00000000..e6c27a9b Binary files /dev/null and b/docs/validation/pr-28/gateway-isolation-e2e.png differ diff --git a/docs/validation/pr-28/hashes.json b/docs/validation/pr-28/hashes.json new file mode 100644 index 00000000..886d2af6 --- /dev/null +++ b/docs/validation/pr-28/hashes.json @@ -0,0 +1,27 @@ +{ + "algorithm": "SHA-256", + "packagingSource": "9aa1df286c2b6fd59b4c101201ddae0ae6000324", + "upstreamSource": "0965053fe6b9341776df147a6934b7485c60b5ca", + "files": { + "launcher": "a85063b9caedf346444db4da72fa3ab62a0bf913b6a4b6056b8d0b6d4a476def", + "node": "b3094d0b49f9ad602262a9921551737bb97637c05dd357a06ae98188d7290aa3", + "upstreamNpmArtifact": "d0d5b0a0a2ace6c0a957b785929af6c0c0d69fe5dc5fb47e995db25ec700548f", + "runtimeEntry": "4f4d29770da4f86dbd0e07cbd4d46deab785905dd89ac719033fcfd866fb5d17", + "gatewayBuildInfo": "b5bbc98a27a81d41261ca7984a36126ccad982e3fb1ea46e67234cc007038648", + "plugin": "7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd", + "controlUiIndex": "73ac0e6f38896c9d491b45a6c3d23b4990dae139d8ff3cb93da7a33e640bb1e7", + "controlUiEntry": "1430574e4d89d8c43b303057d918fdba41a4a940d436d7feaf8e0122a533e4f6", + "screenshot": "1dd7153742614febf8d00aa08c50f3c3465cdd8a7a3b4cf87e8fa585177a0142" + }, + "evidenceFiles": { + "fixture-disabled.png": "9445d0a982b921b77113fa3889278c129b31ba2de50ea591caf2e5af40cd13b4", + "fixture-empty.png": "5b64cdc293b6fa1e6be4d04d5c37c7d0403293e9e8aaaf1576c3b55dcfc2a940", + "fixture-enabled.png": "6912ea4e768ae4a2f8fceff4a64c4f371eb44184b99b061ec6a9fe5599aa4fea", + "fixture-invalid.png": "5b64cdc293b6fa1e6be4d04d5c37c7d0403293e9e8aaaf1576c3b55dcfc2a940", + "fixture-missing.png": "5b64cdc293b6fa1e6be4d04d5c37c7d0403293e9e8aaaf1576c3b55dcfc2a940", + "fixture-uppercase.png": "5b64cdc293b6fa1e6be4d04d5c37c7d0403293e9e8aaaf1576c3b55dcfc2a940", + "fixture-whitespace.png": "5b64cdc293b6fa1e6be4d04d5c37c7d0403293e9e8aaaf1576c3b55dcfc2a940", + "gateway-isolation-e2e.png": "1dd7153742614febf8d00aa08c50f3c3465cdd8a7a3b4cf87e8fa585177a0142", + "launcher-disabled.png": "9445d0a982b921b77113fa3889278c129b31ba2de50ea591caf2e5af40cd13b4" + } +} diff --git a/docs/validation/pr-28/launcher-disabled.png b/docs/validation/pr-28/launcher-disabled.png new file mode 100644 index 00000000..e3be96a0 Binary files /dev/null and b/docs/validation/pr-28/launcher-disabled.png differ diff --git a/docs/validation/pr-28/launcher-tests.json b/docs/validation/pr-28/launcher-tests.json new file mode 100644 index 00000000..de169c25 --- /dev/null +++ b/docs/validation/pr-28/launcher-tests.json @@ -0,0 +1,234 @@ +{ + "command": "dotnet test .\\OpenClaw.Gateway.MSIX.slnx --configuration Release --no-restore", + "total": 57, + "results": [ + { + "name": "OpenClaw.Launcher.Tests.HostEntrypointResolverTests.OnlyArgvZeroSelectsTheEntrypoint", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.ProgramTests.SetupChecksNodeAndPackagedApplicationWithoutMutation", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.HostDiagnosticLogTests.WritePersistsTimestampedProcessDiagnostics", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.GatewayLauncherTests.CreateStartInfoRejectsInvalidGatewayIsolationMode(mode: -1)", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.ProgramTests.AgentResolvesNodeBeforeReportingMissingApplication", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.NodeRuntimeResolverTests.SupportedVersionsMatchPackagedOpenClawRequirement(major: 25, minor: 8, build: 99, expected: False)", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.ClawCtlCommandTests.ParseRejectsCommandsOutsideThePublicManagementSurface(args: [\"doctor\"])", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.WindowsKillOnCloseJobTests.FastExitRetainsExitCodeAfterDelayedObservation", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.ClawCtlCommandTests.ParseAcceptsOnlyThePublicManagementSurface(expected: Help, args: [])", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.HostOptionsTests.ParseForwardsAllArgumentsUnchanged", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.GatewayLauncherTests.CreateStartInfoPreservesExplicitArguments", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.ProgramTests.AgentLaunchResolvesNodeAndRunsPackagedApplication", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.NodeRuntimeResolverTests.SupportedVersionsMatchPackagedOpenClawRequirement(major: 23, minor: 99, build: 0, expected: False)", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.HostOptionsTests.ParseReportsMissingPackagedApplication", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.GatewayLauncherTests.CreateStartInfoForwardsCommandsWithoutInterpretation(arguments: [\"--update\"])", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.ClawCtlCommandTests.ParseAcceptsOnlyThePublicManagementSurface(expected: Setup, args: [\"setup\"])", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.ClawCtlConsoleTests.WriteReadinessSummaryDescribesPackagedApplication", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.GatewayLauncherTests.CreateStartInfoForwardsCommandsWithoutInterpretation(arguments: [\"update\", \"--yes\"])", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.NodeRuntimeResolverTests.SupportedVersionsMatchPackagedOpenClawRequirement(major: 26, minor: 0, build: 0, expected: True)", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.GatewayLauncherTests.CreateStartInfoForwardsNoArgumentsUnchanged", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.ClawCtlCommandTests.ParseRejectsCommandsOutsideThePublicManagementSurface(args: [\"verify\"])", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.NodeRuntimeResolverTests.SupportedVersionsMatchPackagedOpenClawRequirement(major: 24, minor: 14, build: 99, expected: False)", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.ClawCtlCommandTests.ParseAcceptsOnlyThePublicManagementSurface(expected: Version, args: [\"--version\"])", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.GatewayLauncherTests.CreateStartInfoForwardsCommandsWithoutInterpretation(arguments: [\"onboard\", \"--mode\", \"local\"])", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.GatewayLauncherTests.CreateStartInfoRejectsInvalidGatewayIsolationMode(mode: 2147483647)", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.HostEntrypointResolverTests.UnknownOrMalformedInvocationDefaultsToAgent", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.GatewayLauncherTests.CreateStartInfoForwardsCommandsWithoutInterpretation(arguments: [\"setup\", \"--install-daemon\"])", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.ClawCtlCommandTests.ParseRejectsCommandsOutsideThePublicManagementSurface(args: [\"gateway\", \"status\"])", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.NodeRuntimeResolverTests.ResolveAcceptsCompatibleRuntime", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.NodeRuntimeResolverTests.ResolveRejectsPrereleaseVersion", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.ClawCtlCommandTests.ParseRejectsCommandsOutsideThePublicManagementSurface(args: [\"update-package\"])", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.GatewayLauncherTests.CreateStartInfoDefaultsToCurrentWorkingDirectory", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.ProgramTests.SetupResolvesNodeBeforeReportingMissingApplication", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.GatewayLauncherTests.CreateStartInfoRejectsInvalidGatewayIsolationMode(mode: 2)", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.ClawCtlCommandTests.ParseRejectsCommandsOutsideThePublicManagementSurface(args: [\"setup\", \"--force\"])", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.NodeRuntimeResolverTests.ResolveRejectsIncompatibleArchitecture", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.WindowsKillOnCloseJobTests.DisposingJobTerminatesAssignedProcess", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.NodeRuntimeResolverTests.ResolveRejectsMalformedVersion", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.ClawCtlConsoleTests.WriteHelpListsOnlyThePublicCommands", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.ClawCtlCommandTests.ParseRejectsCommandsOutsideThePublicManagementSurface(args: [\"prepare\"])", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.NodeRuntimeResolverTests.ResolveReportsVersionQueryFailure", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.HostOptionsTests.ParseResolvesPackagedApplicationWhenEntryPointExists", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.PackageManifestTests.ManifestRegistersBothAliasesToTheSingleExecutable", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.GatewayLauncherTests.CreateStartInfoReportsExactGatewayIsolationMode(mode: Disabled, expected: \"disabled\")", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.HostEntrypointResolverTests.AgentAliasSelectsThePassthroughEntrypoint", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.NodeRuntimeResolverTests.SupportedVersionsMatchPackagedOpenClawRequirement(major: 22, minor: 22, build: 2, expected: False)", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.ClawCtlCommandTests.ParseRejectsCommandsOutsideThePublicManagementSurface(args: [\"repair\"])", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.NodeRuntimeResolverTests.SupportedVersionsMatchPackagedOpenClawRequirement(major: 25, minor: 9, build: 0, expected: True)", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.NodeRuntimeResolverTests.ResolveRejectsOutdatedRuntime", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.NodeRuntimeResolverTests.SupportedVersionsMatchPackagedOpenClawRequirement(major: 24, minor: 15, build: 0, expected: True)", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.GatewayLauncherTests.CreateStartInfoForwardsCommandsWithoutInterpretation(arguments: [\"gateway\", \"call\", \"update.run\"])", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.NodeRuntimeResolverTests.ResolveReportsInstallCommandWhenRuntimeIsMissing", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.GatewayLauncherTests.CreateStartInfoForwardsCommandsWithoutInterpretation(arguments: [\"gateway\", \"install\"])", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.NodeRuntimeResolverTests.SupportedVersionsMatchPackagedOpenClawRequirement(major: 22, minor: 22, build: 3, expected: True)", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.HostDiagnosticLogTests.ConcurrentInvocationsSerializeCompleteLogRecords", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.HostEntrypointResolverTests.ControlAliasSelectsTheManagementEntrypoint", + "outcome": "Passed" + }, + { + "name": "OpenClaw.Launcher.Tests.GatewayLauncherTests.CreateStartInfoReportsExactGatewayIsolationMode(mode: Enabled, expected: \"enabled\")", + "outcome": "Passed" + } + ] +} diff --git a/docs/validation/pr-28/payload-matrix.json b/docs/validation/pr-28/payload-matrix.json new file mode 100644 index 00000000..7f14d09c --- /dev/null +++ b/docs/validation/pr-28/payload-matrix.json @@ -0,0 +1,3656 @@ +{ + "schemaVersion": 1, + "fixtureType": "synthetic-local-npm-packages-and-synthetic-runtime-inspection-responses", + "scope": "Actual Build-Payload.ps1 x64 and ARM64 composition contract with controlled runtime-inspection fixtures.", + "productionSourceCommit": "9aa1df286c2b6fd59b4c101201ddae0ae6000324", + "evidenceCheckoutHead": "2ce86d5bf4b54809ab1b4dcf5930db74d36b6d84", + "verifiedSourceFiles": [ + { + "path": "scripts/Build-Payload.ps1", + "sha256": "7dbdc5b23b0b325a8338de26c8e00cb9b7c4475404c78090884c93ba7ae60691" + }, + { + "path": "plugins/gateway-isolation/package.json", + "sha256": "5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142" + }, + { + "path": "plugins/gateway-isolation/openclaw.plugin.json", + "sha256": "a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651" + }, + { + "path": "plugins/gateway-isolation/index.js", + "sha256": "7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd" + } + ], + "harness": "scripts/validation/Test-GatewayIsolationPayloadMatrix.ps1", + "harnessSha256": "a538e627a1eda0737557e052a68b44d5e591c1923fb4223b7eb52084481f86d9", + "environment": { + "powershell": "7.6.6", + "node": "v24.16.0", + "npm": "11.13.0", + "host": "Windows x64", + "npmOffline": true + }, + "command": "pwsh -NoProfile -File .\\scripts\\validation\\Test-GatewayIsolationPayloadMatrix.ps1", + "summary": { + "total": 66, + "passed": 66, + "failed": 0, + "accepted": 6, + "rejected": 60, + "architectures": [ + "x64", + "arm64" + ] + }, + "harnessEnvironmentRestored": true, + "harnessWorkingDirectoryRestored": true, + "generatedFixtureDirectoryRemoved": true, + "cases": [ + { + "id": "x64-accepted-existing-environment", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "accepted", + "field": null, + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "accepted", + "actual": "accepted", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-accepted-existing-environment\\package -Architecture x64 -OutputDirectory \\x64-accepted-existing-environment\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + }, + { + "command": "version-smoke", + "args": [ + "--version" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "matrix-original-CLAWCTL_GATEWAY_ISOLATION", + "stateDirectoryMatchesExpected": false + } + ], + "content": { + "shippingFileCount": 3, + "files": [ + { + "file": "index.js", + "sourceSha256": "7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd", + "payloadSha256": "7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd", + "identical": true + }, + { + "file": "openclaw.plugin.json", + "sourceSha256": "a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651", + "payloadSha256": "a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651", + "identical": true + }, + { + "file": "package.json", + "sourceSha256": "5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142", + "payloadSha256": "5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142", + "identical": true + } + ], + "noTestFile": true, + "metadataArchitecture": "x64", + "metadataLayout": "expanded-directory", + "metadataNodeVersion": "v24.16.0", + "metadataNpmVersion": "11.13.0" + }, + "rejectedOutputAbsent": false + }, + { + "id": "x64-accepted-absent-environment", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "accepted", + "field": null, + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "accepted", + "actual": "accepted", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-accepted-absent-environment\\package -Architecture x64 -OutputDirectory \\x64-accepted-absent-environment\\payload", + "environmentBefore": "absent", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + }, + { + "command": "version-smoke", + "args": [ + "--version" + ], + "nodeVersion": "v24.16.0", + "isolationMode": null, + "stateDirectoryMatchesExpected": false + } + ], + "content": { + "shippingFileCount": 3, + "files": [ + { + "file": "index.js", + "sourceSha256": "7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd", + "payloadSha256": "7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd", + "identical": true + }, + { + "file": "openclaw.plugin.json", + "sourceSha256": "a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651", + "payloadSha256": "a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651", + "identical": true + }, + { + "file": "package.json", + "sourceSha256": "5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142", + "payloadSha256": "5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142", + "identical": true + } + ], + "noTestFile": true, + "metadataArchitecture": "x64", + "metadataLayout": "expanded-directory", + "metadataNodeVersion": "v24.16.0", + "metadataNpmVersion": "11.13.0" + }, + "rejectedOutputAbsent": false + }, + { + "id": "x64-accepted-empty-environment", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "accepted", + "field": null, + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "accepted", + "actual": "accepted", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-accepted-empty-environment\\package -Architecture x64 -OutputDirectory \\x64-accepted-empty-environment\\payload", + "environmentBefore": "empty", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + }, + { + "command": "version-smoke", + "args": [ + "--version" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "", + "stateDirectoryMatchesExpected": false + } + ], + "content": { + "shippingFileCount": 3, + "files": [ + { + "file": "index.js", + "sourceSha256": "7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd", + "payloadSha256": "7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd", + "identical": true + }, + { + "file": "openclaw.plugin.json", + "sourceSha256": "a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651", + "payloadSha256": "a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651", + "identical": true + }, + { + "file": "package.json", + "sourceSha256": "5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142", + "payloadSha256": "5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142", + "identical": true + } + ], + "noTestFile": true, + "metadataArchitecture": "x64", + "metadataLayout": "expanded-directory", + "metadataNodeVersion": "v24.16.0", + "metadataNpmVersion": "11.13.0" + }, + "rejectedOutputAbsent": false + }, + { + "id": "x64-missing-extensions", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing-extensions", + "field": null, + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The pinned OpenClaw payload does not expose the supported bundled plugin directory: \\x64-missing-extensions\\runner\\openclaw-stage-x64\\node_modules\\openclaw\\dist\\extensions", + "actual": "The pinned OpenClaw payload does not expose the supported bundled plugin directory: \\x64-missing-extensions\\runner\\openclaw-stage-x64\\node_modules\\openclaw\\dist\\extensions", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-missing-extensions\\package -Architecture x64 -OutputDirectory \\x64-missing-extensions\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-preexisting-plugin", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "preexisting-plugin", + "field": null, + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The OpenClaw payload already contains a gateway-isolation plugin; refusing to replace upstream content.", + "actual": "The OpenClaw payload already contains a gateway-isolation plugin; refusing to replace upstream content.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-preexisting-plugin\\package -Architecture x64 -OutputDirectory \\x64-preexisting-plugin\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-inspection-exit-23", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "exit", + "field": null, + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload cannot load the Gateway isolation plugin. Exit code: 23.", + "actual": "The selected OpenClaw payload cannot load the Gateway isolation plugin. Exit code: 23.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-inspection-exit-23\\package -Architecture x64 -OutputDirectory \\x64-inspection-exit-23\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-wrong-plugin-id", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "plugin.id", + "fixtureInspection": { + "plugin": { + "enabled": true, + "activated": true, + "id": "unexpected-plugin", + "imported": true, + "status": "loaded", + "httpRoutes": 1, + "origin": "bundled" + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-wrong-plugin-id\\package -Architecture x64 -OutputDirectory \\x64-wrong-plugin-id\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-missing-plugin-id", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "plugin.id", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-missing-plugin-id\\package -Architecture x64 -OutputDirectory \\x64-missing-plugin-id\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-wrong-plugin-origin", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "plugin.origin", + "fixtureInspection": { + "plugin": { + "enabled": true, + "activated": true, + "id": "gateway-isolation", + "imported": true, + "status": "loaded", + "httpRoutes": 1, + "origin": "global" + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-wrong-plugin-origin\\package -Architecture x64 -OutputDirectory \\x64-wrong-plugin-origin\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-missing-plugin-origin", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "plugin.origin", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-missing-plugin-origin\\package -Architecture x64 -OutputDirectory \\x64-missing-plugin-origin\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-wrong-plugin-enabled", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "plugin.enabled", + "fixtureInspection": { + "plugin": { + "enabled": false, + "activated": true, + "id": "gateway-isolation", + "imported": true, + "status": "loaded", + "httpRoutes": 1, + "origin": "bundled" + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-wrong-plugin-enabled\\package -Architecture x64 -OutputDirectory \\x64-wrong-plugin-enabled\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-missing-plugin-enabled", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "plugin.enabled", + "fixtureInspection": { + "plugin": { + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-missing-plugin-enabled\\package -Architecture x64 -OutputDirectory \\x64-missing-plugin-enabled\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-wrong-plugin-activated", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "plugin.activated", + "fixtureInspection": { + "plugin": { + "enabled": true, + "activated": false, + "id": "gateway-isolation", + "imported": true, + "status": "loaded", + "httpRoutes": 1, + "origin": "bundled" + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-wrong-plugin-activated\\package -Architecture x64 -OutputDirectory \\x64-wrong-plugin-activated\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-missing-plugin-activated", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "plugin.activated", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1 + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-missing-plugin-activated\\package -Architecture x64 -OutputDirectory \\x64-missing-plugin-activated\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-wrong-plugin-status", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "plugin.status", + "fixtureInspection": { + "plugin": { + "enabled": true, + "activated": true, + "id": "gateway-isolation", + "imported": true, + "status": "error", + "httpRoutes": 1, + "origin": "bundled" + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-wrong-plugin-status\\package -Architecture x64 -OutputDirectory \\x64-wrong-plugin-status\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-missing-plugin-status", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "plugin.status", + "fixtureInspection": { + "plugin": { + "enabled": true, + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-missing-plugin-status\\package -Architecture x64 -OutputDirectory \\x64-missing-plugin-status\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-wrong-plugin-imported", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "plugin.imported", + "fixtureInspection": { + "plugin": { + "enabled": true, + "activated": true, + "id": "gateway-isolation", + "imported": false, + "status": "loaded", + "httpRoutes": 1, + "origin": "bundled" + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-wrong-plugin-imported\\package -Architecture x64 -OutputDirectory \\x64-wrong-plugin-imported\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-missing-plugin-imported", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "plugin.imported", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-missing-plugin-imported\\package -Architecture x64 -OutputDirectory \\x64-missing-plugin-imported\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-wrong-plugin-httpRoutes", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "plugin.httpRoutes", + "fixtureInspection": { + "plugin": { + "enabled": true, + "activated": true, + "id": "gateway-isolation", + "imported": true, + "status": "loaded", + "httpRoutes": 0, + "origin": "bundled" + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-wrong-plugin-httpRoutes\\package -Architecture x64 -OutputDirectory \\x64-wrong-plugin-httpRoutes\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-missing-plugin-httpRoutes", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "plugin.httpRoutes", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-missing-plugin-httpRoutes\\package -Architecture x64 -OutputDirectory \\x64-missing-plugin-httpRoutes\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-wrong-httpRouteCount", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "httpRouteCount", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 0, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-wrong-httpRouteCount\\package -Architecture x64 -OutputDirectory \\x64-wrong-httpRouteCount\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-missing-httpRouteCount", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "httpRouteCount", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-missing-httpRouteCount\\package -Architecture x64 -OutputDirectory \\x64-missing-httpRouteCount\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-wrong-gatewayMethods", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "gatewayMethods", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [ + "fixture.method" + ], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-wrong-gatewayMethods\\package -Architecture x64 -OutputDirectory \\x64-wrong-gatewayMethods\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-missing-gatewayMethods", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "gatewayMethods", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-missing-gatewayMethods\\package -Architecture x64 -OutputDirectory \\x64-missing-gatewayMethods\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-wrong-tools", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "tools", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [ + "fixture.tool" + ], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-wrong-tools\\package -Architecture x64 -OutputDirectory \\x64-wrong-tools\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-missing-tools", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "tools", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-missing-tools\\package -Architecture x64 -OutputDirectory \\x64-missing-tools\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-wrong-services", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "services", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [ + "fixture.service" + ], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-wrong-services\\package -Architecture x64 -OutputDirectory \\x64-wrong-services\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-missing-services", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "services", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-missing-services\\package -Architecture x64 -OutputDirectory \\x64-missing-services\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-wrong-diagnostics", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "diagnostics", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [ + "fixture diagnostic" + ] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-wrong-diagnostics\\package -Architecture x64 -OutputDirectory \\x64-wrong-diagnostics\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-missing-diagnostics", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "diagnostics", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-missing-diagnostics\\package -Architecture x64 -OutputDirectory \\x64-missing-diagnostics\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-excess-plugin-httpRoutes", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "plugin.httpRoutes", + "fixtureInspection": { + "plugin": { + "enabled": true, + "activated": true, + "id": "gateway-isolation", + "imported": true, + "status": "loaded", + "httpRoutes": 2, + "origin": "bundled" + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-excess-plugin-httpRoutes\\package -Architecture x64 -OutputDirectory \\x64-excess-plugin-httpRoutes\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-excess-httpRouteCount", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "httpRouteCount", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 2, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-excess-httpRouteCount\\package -Architecture x64 -OutputDirectory \\x64-excess-httpRouteCount\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "x64-missing-plugin-object", + "architecture": "x64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "plugin", + "fixtureInspection": { + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\x64-missing-plugin-object\\package -Architecture x64 -OutputDirectory \\x64-missing-plugin-object\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-accepted-existing-environment", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "accepted", + "field": null, + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "accepted", + "actual": "accepted", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-accepted-existing-environment\\package -Architecture arm64 -OutputDirectory \\arm64-accepted-existing-environment\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": { + "shippingFileCount": 3, + "files": [ + { + "file": "index.js", + "sourceSha256": "7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd", + "payloadSha256": "7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd", + "identical": true + }, + { + "file": "openclaw.plugin.json", + "sourceSha256": "a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651", + "payloadSha256": "a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651", + "identical": true + }, + { + "file": "package.json", + "sourceSha256": "5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142", + "payloadSha256": "5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142", + "identical": true + } + ], + "noTestFile": true, + "metadataArchitecture": "arm64", + "metadataLayout": "expanded-directory", + "metadataNodeVersion": "v24.16.0", + "metadataNpmVersion": "11.13.0" + }, + "rejectedOutputAbsent": false + }, + { + "id": "arm64-accepted-absent-environment", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "accepted", + "field": null, + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "accepted", + "actual": "accepted", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-accepted-absent-environment\\package -Architecture arm64 -OutputDirectory \\arm64-accepted-absent-environment\\payload", + "environmentBefore": "absent", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": { + "shippingFileCount": 3, + "files": [ + { + "file": "index.js", + "sourceSha256": "7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd", + "payloadSha256": "7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd", + "identical": true + }, + { + "file": "openclaw.plugin.json", + "sourceSha256": "a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651", + "payloadSha256": "a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651", + "identical": true + }, + { + "file": "package.json", + "sourceSha256": "5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142", + "payloadSha256": "5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142", + "identical": true + } + ], + "noTestFile": true, + "metadataArchitecture": "arm64", + "metadataLayout": "expanded-directory", + "metadataNodeVersion": "v24.16.0", + "metadataNpmVersion": "11.13.0" + }, + "rejectedOutputAbsent": false + }, + { + "id": "arm64-accepted-empty-environment", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "accepted", + "field": null, + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "accepted", + "actual": "accepted", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-accepted-empty-environment\\package -Architecture arm64 -OutputDirectory \\arm64-accepted-empty-environment\\payload", + "environmentBefore": "empty", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": { + "shippingFileCount": 3, + "files": [ + { + "file": "index.js", + "sourceSha256": "7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd", + "payloadSha256": "7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd", + "identical": true + }, + { + "file": "openclaw.plugin.json", + "sourceSha256": "a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651", + "payloadSha256": "a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651", + "identical": true + }, + { + "file": "package.json", + "sourceSha256": "5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142", + "payloadSha256": "5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142", + "identical": true + } + ], + "noTestFile": true, + "metadataArchitecture": "arm64", + "metadataLayout": "expanded-directory", + "metadataNodeVersion": "v24.16.0", + "metadataNpmVersion": "11.13.0" + }, + "rejectedOutputAbsent": false + }, + { + "id": "arm64-missing-extensions", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing-extensions", + "field": null, + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The pinned OpenClaw payload does not expose the supported bundled plugin directory: \\arm64-missing-extensions\\runner\\openclaw-stage-arm64\\node_modules\\openclaw\\dist\\extensions", + "actual": "The pinned OpenClaw payload does not expose the supported bundled plugin directory: \\arm64-missing-extensions\\runner\\openclaw-stage-arm64\\node_modules\\openclaw\\dist\\extensions", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-missing-extensions\\package -Architecture arm64 -OutputDirectory \\arm64-missing-extensions\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-preexisting-plugin", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "preexisting-plugin", + "field": null, + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The OpenClaw payload already contains a gateway-isolation plugin; refusing to replace upstream content.", + "actual": "The OpenClaw payload already contains a gateway-isolation plugin; refusing to replace upstream content.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-preexisting-plugin\\package -Architecture arm64 -OutputDirectory \\arm64-preexisting-plugin\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-inspection-exit-23", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "exit", + "field": null, + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload cannot load the Gateway isolation plugin. Exit code: 23.", + "actual": "The selected OpenClaw payload cannot load the Gateway isolation plugin. Exit code: 23.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-inspection-exit-23\\package -Architecture arm64 -OutputDirectory \\arm64-inspection-exit-23\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-wrong-plugin-id", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "plugin.id", + "fixtureInspection": { + "plugin": { + "enabled": true, + "activated": true, + "id": "unexpected-plugin", + "imported": true, + "status": "loaded", + "httpRoutes": 1, + "origin": "bundled" + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-wrong-plugin-id\\package -Architecture arm64 -OutputDirectory \\arm64-wrong-plugin-id\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-missing-plugin-id", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "plugin.id", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-missing-plugin-id\\package -Architecture arm64 -OutputDirectory \\arm64-missing-plugin-id\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-wrong-plugin-origin", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "plugin.origin", + "fixtureInspection": { + "plugin": { + "enabled": true, + "activated": true, + "id": "gateway-isolation", + "imported": true, + "status": "loaded", + "httpRoutes": 1, + "origin": "global" + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-wrong-plugin-origin\\package -Architecture arm64 -OutputDirectory \\arm64-wrong-plugin-origin\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-missing-plugin-origin", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "plugin.origin", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-missing-plugin-origin\\package -Architecture arm64 -OutputDirectory \\arm64-missing-plugin-origin\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-wrong-plugin-enabled", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "plugin.enabled", + "fixtureInspection": { + "plugin": { + "enabled": false, + "activated": true, + "id": "gateway-isolation", + "imported": true, + "status": "loaded", + "httpRoutes": 1, + "origin": "bundled" + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-wrong-plugin-enabled\\package -Architecture arm64 -OutputDirectory \\arm64-wrong-plugin-enabled\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-missing-plugin-enabled", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "plugin.enabled", + "fixtureInspection": { + "plugin": { + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-missing-plugin-enabled\\package -Architecture arm64 -OutputDirectory \\arm64-missing-plugin-enabled\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-wrong-plugin-activated", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "plugin.activated", + "fixtureInspection": { + "plugin": { + "enabled": true, + "activated": false, + "id": "gateway-isolation", + "imported": true, + "status": "loaded", + "httpRoutes": 1, + "origin": "bundled" + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-wrong-plugin-activated\\package -Architecture arm64 -OutputDirectory \\arm64-wrong-plugin-activated\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-missing-plugin-activated", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "plugin.activated", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1 + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-missing-plugin-activated\\package -Architecture arm64 -OutputDirectory \\arm64-missing-plugin-activated\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-wrong-plugin-status", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "plugin.status", + "fixtureInspection": { + "plugin": { + "enabled": true, + "activated": true, + "id": "gateway-isolation", + "imported": true, + "status": "error", + "httpRoutes": 1, + "origin": "bundled" + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-wrong-plugin-status\\package -Architecture arm64 -OutputDirectory \\arm64-wrong-plugin-status\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-missing-plugin-status", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "plugin.status", + "fixtureInspection": { + "plugin": { + "enabled": true, + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-missing-plugin-status\\package -Architecture arm64 -OutputDirectory \\arm64-missing-plugin-status\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-wrong-plugin-imported", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "plugin.imported", + "fixtureInspection": { + "plugin": { + "enabled": true, + "activated": true, + "id": "gateway-isolation", + "imported": false, + "status": "loaded", + "httpRoutes": 1, + "origin": "bundled" + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-wrong-plugin-imported\\package -Architecture arm64 -OutputDirectory \\arm64-wrong-plugin-imported\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-missing-plugin-imported", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "plugin.imported", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-missing-plugin-imported\\package -Architecture arm64 -OutputDirectory \\arm64-missing-plugin-imported\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-wrong-plugin-httpRoutes", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "plugin.httpRoutes", + "fixtureInspection": { + "plugin": { + "enabled": true, + "activated": true, + "id": "gateway-isolation", + "imported": true, + "status": "loaded", + "httpRoutes": 0, + "origin": "bundled" + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-wrong-plugin-httpRoutes\\package -Architecture arm64 -OutputDirectory \\arm64-wrong-plugin-httpRoutes\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-missing-plugin-httpRoutes", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "plugin.httpRoutes", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-missing-plugin-httpRoutes\\package -Architecture arm64 -OutputDirectory \\arm64-missing-plugin-httpRoutes\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-wrong-httpRouteCount", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "httpRouteCount", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 0, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-wrong-httpRouteCount\\package -Architecture arm64 -OutputDirectory \\arm64-wrong-httpRouteCount\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-missing-httpRouteCount", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "httpRouteCount", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-missing-httpRouteCount\\package -Architecture arm64 -OutputDirectory \\arm64-missing-httpRouteCount\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-wrong-gatewayMethods", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "gatewayMethods", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [ + "fixture.method" + ], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-wrong-gatewayMethods\\package -Architecture arm64 -OutputDirectory \\arm64-wrong-gatewayMethods\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-missing-gatewayMethods", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "gatewayMethods", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-missing-gatewayMethods\\package -Architecture arm64 -OutputDirectory \\arm64-missing-gatewayMethods\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-wrong-tools", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "tools", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [ + "fixture.tool" + ], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-wrong-tools\\package -Architecture arm64 -OutputDirectory \\arm64-wrong-tools\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-missing-tools", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "tools", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-missing-tools\\package -Architecture arm64 -OutputDirectory \\arm64-missing-tools\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-wrong-services", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "services", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [ + "fixture.service" + ], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-wrong-services\\package -Architecture arm64 -OutputDirectory \\arm64-wrong-services\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-missing-services", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "services", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-missing-services\\package -Architecture arm64 -OutputDirectory \\arm64-missing-services\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-wrong-diagnostics", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "diagnostics", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [ + "fixture diagnostic" + ] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-wrong-diagnostics\\package -Architecture arm64 -OutputDirectory \\arm64-wrong-diagnostics\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-missing-diagnostics", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "diagnostics", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-missing-diagnostics\\package -Architecture arm64 -OutputDirectory \\arm64-missing-diagnostics\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-excess-plugin-httpRoutes", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "plugin.httpRoutes", + "fixtureInspection": { + "plugin": { + "enabled": true, + "activated": true, + "id": "gateway-isolation", + "imported": true, + "status": "loaded", + "httpRoutes": 2, + "origin": "bundled" + }, + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-excess-plugin-httpRoutes\\package -Architecture arm64 -OutputDirectory \\arm64-excess-plugin-httpRoutes\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-excess-httpRouteCount", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "wrong", + "field": "httpRouteCount", + "fixtureInspection": { + "plugin": { + "enabled": true, + "status": "loaded", + "imported": true, + "origin": "bundled", + "id": "gateway-isolation", + "httpRoutes": 1, + "activated": true + }, + "httpRouteCount": 2, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-excess-httpRouteCount\\package -Architecture arm64 -OutputDirectory \\arm64-excess-httpRouteCount\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + }, + { + "id": "arm64-missing-plugin-object", + "architecture": "arm64", + "outcome": "PASS", + "fixtureType": "synthetic-local-npm-package-and-runtime-inspection", + "mutation": "missing", + "field": "plugin", + "fixtureInspection": { + "httpRouteCount": 1, + "gatewayMethods": [], + "tools": [], + "services": [], + "diagnostics": [] + }, + "expected": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "actual": "The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape.", + "command": "& .\\scripts\\Build-Payload.ps1 -PackageDirectory \\arm64-missing-plugin-object\\package -Architecture arm64 -OutputDirectory \\arm64-missing-plugin-object\\payload", + "environmentBefore": "existing sentinels", + "environmentRestored": { + "npm_config_arch": true, + "npm_config_target_arch": true, + "OPENCLAW_STATE_DIR": true, + "CLAWCTL_GATEWAY_ISOLATION": true, + "RUNNER_TEMP": true + }, + "workingDirectoryRestored": true, + "runtimeObservations": [ + { + "command": "runtime-inspection", + "args": [ + "plugins", + "inspect", + "gateway-isolation", + "--runtime", + "--json" + ], + "nodeVersion": "v24.16.0", + "isolationMode": "disabled", + "stateDirectoryMatchesExpected": true + } + ], + "content": null, + "rejectedOutputAbsent": true + } + ] +} diff --git a/docs/validation/pr-28/payload-matrix.txt b/docs/validation/pr-28/payload-matrix.txt new file mode 100644 index 00000000..12a960ca --- /dev/null +++ b/docs/validation/pr-28/payload-matrix.txt @@ -0,0 +1,625 @@ +Gateway isolation payload composition matrix +Fixture type: synthetic local npm packages and synthetic runtime-inspection responses. +Real operations: npm pack, npm install, scripts\Build-Payload.ps1, file copy, runtime command invocation, payload metadata. +This matrix tests the x64 and ARM64 composition contract with controlled runtime-inspection fixtures. +Production source: 9aa1df286c2b6fd59b4c101201ddae0ae6000324 +Evidence checkout HEAD: 2ce86d5bf4b54809ab1b4dcf5930db74d36b6d84 +Runtime: pwsh 7.6.6; Node.js v24.16.0; npm 11.13.0; Windows x64 host +Command: $env:PATH = ";" + $env:PATH +Command: pwsh -NoProfile -File .\scripts\validation\Test-GatewayIsolationPayloadMatrix.ps1 +All npm operations use an isolated generated cache and npm_config_offline=true; packages have no dependencies or lifecycle scripts. + +CASE x64-accepted-existing-environment PASS +Command (from \x64-accepted-existing-environment\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-accepted-existing-environment\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-accepted-existing-environment\package -Architecture x64 -OutputDirectory \x64-accepted-existing-environment\payload +Expected: accepted +Actual: accepted +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection, version-smoke +Shipping plugin files: 3; all source/payload SHA-256 hashes identical; index.test.js absent; metadata architecture: x64 +SHA256 index.js 7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd +SHA256 openclaw.plugin.json a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651 +SHA256 package.json 5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142 + +CASE x64-accepted-absent-environment PASS +Command (from \x64-accepted-absent-environment\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-accepted-absent-environment\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-accepted-absent-environment\package -Architecture x64 -OutputDirectory \x64-accepted-absent-environment\payload +Expected: accepted +Actual: accepted +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection, version-smoke +Shipping plugin files: 3; all source/payload SHA-256 hashes identical; index.test.js absent; metadata architecture: x64 +SHA256 index.js 7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd +SHA256 openclaw.plugin.json a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651 +SHA256 package.json 5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142 + +CASE x64-accepted-empty-environment PASS +Command (from \x64-accepted-empty-environment\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-accepted-empty-environment\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-accepted-empty-environment\package -Architecture x64 -OutputDirectory \x64-accepted-empty-environment\payload +Expected: accepted +Actual: accepted +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection, version-smoke +Shipping plugin files: 3; all source/payload SHA-256 hashes identical; index.test.js absent; metadata architecture: x64 +SHA256 index.js 7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd +SHA256 openclaw.plugin.json a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651 +SHA256 package.json 5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142 + +CASE x64-missing-extensions PASS +Command (from \x64-missing-extensions\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-missing-extensions\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-missing-extensions\package -Architecture x64 -OutputDirectory \x64-missing-extensions\payload +Expected: The pinned OpenClaw payload does not expose the supported bundled plugin directory: \x64-missing-extensions\runner\openclaw-stage-x64\node_modules\openclaw\dist\extensions +Actual: The pinned OpenClaw payload does not expose the supported bundled plugin directory: \x64-missing-extensions\runner\openclaw-stage-x64\node_modules\openclaw\dist\extensions +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: +Rejected application and payload metadata absent. + +CASE x64-preexisting-plugin PASS +Command (from \x64-preexisting-plugin\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-preexisting-plugin\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-preexisting-plugin\package -Architecture x64 -OutputDirectory \x64-preexisting-plugin\payload +Expected: The OpenClaw payload already contains a gateway-isolation plugin; refusing to replace upstream content. +Actual: The OpenClaw payload already contains a gateway-isolation plugin; refusing to replace upstream content. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: +Rejected application and payload metadata absent. + +CASE x64-inspection-exit-23 PASS +Command (from \x64-inspection-exit-23\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-inspection-exit-23\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-inspection-exit-23\package -Architecture x64 -OutputDirectory \x64-inspection-exit-23\payload +Expected: The selected OpenClaw payload cannot load the Gateway isolation plugin. Exit code: 23. +Actual: The selected OpenClaw payload cannot load the Gateway isolation plugin. Exit code: 23. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-wrong-plugin-id PASS +Command (from \x64-wrong-plugin-id\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-wrong-plugin-id\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-wrong-plugin-id\package -Architecture x64 -OutputDirectory \x64-wrong-plugin-id\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-missing-plugin-id PASS +Command (from \x64-missing-plugin-id\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-missing-plugin-id\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-missing-plugin-id\package -Architecture x64 -OutputDirectory \x64-missing-plugin-id\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-wrong-plugin-origin PASS +Command (from \x64-wrong-plugin-origin\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-wrong-plugin-origin\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-wrong-plugin-origin\package -Architecture x64 -OutputDirectory \x64-wrong-plugin-origin\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-missing-plugin-origin PASS +Command (from \x64-missing-plugin-origin\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-missing-plugin-origin\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-missing-plugin-origin\package -Architecture x64 -OutputDirectory \x64-missing-plugin-origin\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-wrong-plugin-enabled PASS +Command (from \x64-wrong-plugin-enabled\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-wrong-plugin-enabled\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-wrong-plugin-enabled\package -Architecture x64 -OutputDirectory \x64-wrong-plugin-enabled\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-missing-plugin-enabled PASS +Command (from \x64-missing-plugin-enabled\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-missing-plugin-enabled\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-missing-plugin-enabled\package -Architecture x64 -OutputDirectory \x64-missing-plugin-enabled\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-wrong-plugin-activated PASS +Command (from \x64-wrong-plugin-activated\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-wrong-plugin-activated\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-wrong-plugin-activated\package -Architecture x64 -OutputDirectory \x64-wrong-plugin-activated\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-missing-plugin-activated PASS +Command (from \x64-missing-plugin-activated\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-missing-plugin-activated\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-missing-plugin-activated\package -Architecture x64 -OutputDirectory \x64-missing-plugin-activated\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-wrong-plugin-status PASS +Command (from \x64-wrong-plugin-status\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-wrong-plugin-status\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-wrong-plugin-status\package -Architecture x64 -OutputDirectory \x64-wrong-plugin-status\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-missing-plugin-status PASS +Command (from \x64-missing-plugin-status\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-missing-plugin-status\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-missing-plugin-status\package -Architecture x64 -OutputDirectory \x64-missing-plugin-status\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-wrong-plugin-imported PASS +Command (from \x64-wrong-plugin-imported\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-wrong-plugin-imported\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-wrong-plugin-imported\package -Architecture x64 -OutputDirectory \x64-wrong-plugin-imported\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-missing-plugin-imported PASS +Command (from \x64-missing-plugin-imported\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-missing-plugin-imported\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-missing-plugin-imported\package -Architecture x64 -OutputDirectory \x64-missing-plugin-imported\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-wrong-plugin-httpRoutes PASS +Command (from \x64-wrong-plugin-httpRoutes\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-wrong-plugin-httpRoutes\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-wrong-plugin-httpRoutes\package -Architecture x64 -OutputDirectory \x64-wrong-plugin-httpRoutes\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-missing-plugin-httpRoutes PASS +Command (from \x64-missing-plugin-httpRoutes\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-missing-plugin-httpRoutes\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-missing-plugin-httpRoutes\package -Architecture x64 -OutputDirectory \x64-missing-plugin-httpRoutes\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-wrong-httpRouteCount PASS +Command (from \x64-wrong-httpRouteCount\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-wrong-httpRouteCount\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-wrong-httpRouteCount\package -Architecture x64 -OutputDirectory \x64-wrong-httpRouteCount\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-missing-httpRouteCount PASS +Command (from \x64-missing-httpRouteCount\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-missing-httpRouteCount\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-missing-httpRouteCount\package -Architecture x64 -OutputDirectory \x64-missing-httpRouteCount\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-wrong-gatewayMethods PASS +Command (from \x64-wrong-gatewayMethods\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-wrong-gatewayMethods\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-wrong-gatewayMethods\package -Architecture x64 -OutputDirectory \x64-wrong-gatewayMethods\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-missing-gatewayMethods PASS +Command (from \x64-missing-gatewayMethods\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-missing-gatewayMethods\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-missing-gatewayMethods\package -Architecture x64 -OutputDirectory \x64-missing-gatewayMethods\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-wrong-tools PASS +Command (from \x64-wrong-tools\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-wrong-tools\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-wrong-tools\package -Architecture x64 -OutputDirectory \x64-wrong-tools\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-missing-tools PASS +Command (from \x64-missing-tools\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-missing-tools\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-missing-tools\package -Architecture x64 -OutputDirectory \x64-missing-tools\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-wrong-services PASS +Command (from \x64-wrong-services\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-wrong-services\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-wrong-services\package -Architecture x64 -OutputDirectory \x64-wrong-services\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-missing-services PASS +Command (from \x64-missing-services\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-missing-services\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-missing-services\package -Architecture x64 -OutputDirectory \x64-missing-services\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-wrong-diagnostics PASS +Command (from \x64-wrong-diagnostics\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-wrong-diagnostics\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-wrong-diagnostics\package -Architecture x64 -OutputDirectory \x64-wrong-diagnostics\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-missing-diagnostics PASS +Command (from \x64-missing-diagnostics\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-missing-diagnostics\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-missing-diagnostics\package -Architecture x64 -OutputDirectory \x64-missing-diagnostics\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-excess-plugin-httpRoutes PASS +Command (from \x64-excess-plugin-httpRoutes\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-excess-plugin-httpRoutes\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-excess-plugin-httpRoutes\package -Architecture x64 -OutputDirectory \x64-excess-plugin-httpRoutes\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-excess-httpRouteCount PASS +Command (from \x64-excess-httpRouteCount\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-excess-httpRouteCount\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-excess-httpRouteCount\package -Architecture x64 -OutputDirectory \x64-excess-httpRouteCount\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE x64-missing-plugin-object PASS +Command (from \x64-missing-plugin-object\package-source): npm pack --offline --ignore-scripts --pack-destination \x64-missing-plugin-object\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \x64-missing-plugin-object\package -Architecture x64 -OutputDirectory \x64-missing-plugin-object\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-accepted-existing-environment PASS +Command (from \arm64-accepted-existing-environment\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-accepted-existing-environment\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-accepted-existing-environment\package -Architecture arm64 -OutputDirectory \arm64-accepted-existing-environment\payload +Expected: accepted +Actual: accepted +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Shipping plugin files: 3; all source/payload SHA-256 hashes identical; index.test.js absent; metadata architecture: arm64 +SHA256 index.js 7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd +SHA256 openclaw.plugin.json a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651 +SHA256 package.json 5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142 + +CASE arm64-accepted-absent-environment PASS +Command (from \arm64-accepted-absent-environment\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-accepted-absent-environment\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-accepted-absent-environment\package -Architecture arm64 -OutputDirectory \arm64-accepted-absent-environment\payload +Expected: accepted +Actual: accepted +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Shipping plugin files: 3; all source/payload SHA-256 hashes identical; index.test.js absent; metadata architecture: arm64 +SHA256 index.js 7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd +SHA256 openclaw.plugin.json a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651 +SHA256 package.json 5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142 + +CASE arm64-accepted-empty-environment PASS +Command (from \arm64-accepted-empty-environment\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-accepted-empty-environment\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-accepted-empty-environment\package -Architecture arm64 -OutputDirectory \arm64-accepted-empty-environment\payload +Expected: accepted +Actual: accepted +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Shipping plugin files: 3; all source/payload SHA-256 hashes identical; index.test.js absent; metadata architecture: arm64 +SHA256 index.js 7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd +SHA256 openclaw.plugin.json a1359e966e39d799f400a7250a4366cd1ef0b0bb8be954100285a2c1da298651 +SHA256 package.json 5a4c1c3966c782455e6505dedc9427c8096917f520ca6486f169fc4db5e50142 + +CASE arm64-missing-extensions PASS +Command (from \arm64-missing-extensions\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-missing-extensions\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-missing-extensions\package -Architecture arm64 -OutputDirectory \arm64-missing-extensions\payload +Expected: The pinned OpenClaw payload does not expose the supported bundled plugin directory: \arm64-missing-extensions\runner\openclaw-stage-arm64\node_modules\openclaw\dist\extensions +Actual: The pinned OpenClaw payload does not expose the supported bundled plugin directory: \arm64-missing-extensions\runner\openclaw-stage-arm64\node_modules\openclaw\dist\extensions +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: +Rejected application and payload metadata absent. + +CASE arm64-preexisting-plugin PASS +Command (from \arm64-preexisting-plugin\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-preexisting-plugin\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-preexisting-plugin\package -Architecture arm64 -OutputDirectory \arm64-preexisting-plugin\payload +Expected: The OpenClaw payload already contains a gateway-isolation plugin; refusing to replace upstream content. +Actual: The OpenClaw payload already contains a gateway-isolation plugin; refusing to replace upstream content. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: +Rejected application and payload metadata absent. + +CASE arm64-inspection-exit-23 PASS +Command (from \arm64-inspection-exit-23\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-inspection-exit-23\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-inspection-exit-23\package -Architecture arm64 -OutputDirectory \arm64-inspection-exit-23\payload +Expected: The selected OpenClaw payload cannot load the Gateway isolation plugin. Exit code: 23. +Actual: The selected OpenClaw payload cannot load the Gateway isolation plugin. Exit code: 23. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-wrong-plugin-id PASS +Command (from \arm64-wrong-plugin-id\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-wrong-plugin-id\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-wrong-plugin-id\package -Architecture arm64 -OutputDirectory \arm64-wrong-plugin-id\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-missing-plugin-id PASS +Command (from \arm64-missing-plugin-id\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-missing-plugin-id\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-missing-plugin-id\package -Architecture arm64 -OutputDirectory \arm64-missing-plugin-id\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-wrong-plugin-origin PASS +Command (from \arm64-wrong-plugin-origin\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-wrong-plugin-origin\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-wrong-plugin-origin\package -Architecture arm64 -OutputDirectory \arm64-wrong-plugin-origin\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-missing-plugin-origin PASS +Command (from \arm64-missing-plugin-origin\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-missing-plugin-origin\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-missing-plugin-origin\package -Architecture arm64 -OutputDirectory \arm64-missing-plugin-origin\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-wrong-plugin-enabled PASS +Command (from \arm64-wrong-plugin-enabled\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-wrong-plugin-enabled\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-wrong-plugin-enabled\package -Architecture arm64 -OutputDirectory \arm64-wrong-plugin-enabled\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-missing-plugin-enabled PASS +Command (from \arm64-missing-plugin-enabled\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-missing-plugin-enabled\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-missing-plugin-enabled\package -Architecture arm64 -OutputDirectory \arm64-missing-plugin-enabled\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-wrong-plugin-activated PASS +Command (from \arm64-wrong-plugin-activated\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-wrong-plugin-activated\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-wrong-plugin-activated\package -Architecture arm64 -OutputDirectory \arm64-wrong-plugin-activated\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-missing-plugin-activated PASS +Command (from \arm64-missing-plugin-activated\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-missing-plugin-activated\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-missing-plugin-activated\package -Architecture arm64 -OutputDirectory \arm64-missing-plugin-activated\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-wrong-plugin-status PASS +Command (from \arm64-wrong-plugin-status\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-wrong-plugin-status\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-wrong-plugin-status\package -Architecture arm64 -OutputDirectory \arm64-wrong-plugin-status\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-missing-plugin-status PASS +Command (from \arm64-missing-plugin-status\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-missing-plugin-status\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-missing-plugin-status\package -Architecture arm64 -OutputDirectory \arm64-missing-plugin-status\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-wrong-plugin-imported PASS +Command (from \arm64-wrong-plugin-imported\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-wrong-plugin-imported\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-wrong-plugin-imported\package -Architecture arm64 -OutputDirectory \arm64-wrong-plugin-imported\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-missing-plugin-imported PASS +Command (from \arm64-missing-plugin-imported\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-missing-plugin-imported\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-missing-plugin-imported\package -Architecture arm64 -OutputDirectory \arm64-missing-plugin-imported\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-wrong-plugin-httpRoutes PASS +Command (from \arm64-wrong-plugin-httpRoutes\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-wrong-plugin-httpRoutes\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-wrong-plugin-httpRoutes\package -Architecture arm64 -OutputDirectory \arm64-wrong-plugin-httpRoutes\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-missing-plugin-httpRoutes PASS +Command (from \arm64-missing-plugin-httpRoutes\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-missing-plugin-httpRoutes\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-missing-plugin-httpRoutes\package -Architecture arm64 -OutputDirectory \arm64-missing-plugin-httpRoutes\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-wrong-httpRouteCount PASS +Command (from \arm64-wrong-httpRouteCount\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-wrong-httpRouteCount\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-wrong-httpRouteCount\package -Architecture arm64 -OutputDirectory \arm64-wrong-httpRouteCount\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-missing-httpRouteCount PASS +Command (from \arm64-missing-httpRouteCount\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-missing-httpRouteCount\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-missing-httpRouteCount\package -Architecture arm64 -OutputDirectory \arm64-missing-httpRouteCount\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-wrong-gatewayMethods PASS +Command (from \arm64-wrong-gatewayMethods\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-wrong-gatewayMethods\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-wrong-gatewayMethods\package -Architecture arm64 -OutputDirectory \arm64-wrong-gatewayMethods\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-missing-gatewayMethods PASS +Command (from \arm64-missing-gatewayMethods\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-missing-gatewayMethods\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-missing-gatewayMethods\package -Architecture arm64 -OutputDirectory \arm64-missing-gatewayMethods\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-wrong-tools PASS +Command (from \arm64-wrong-tools\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-wrong-tools\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-wrong-tools\package -Architecture arm64 -OutputDirectory \arm64-wrong-tools\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-missing-tools PASS +Command (from \arm64-missing-tools\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-missing-tools\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-missing-tools\package -Architecture arm64 -OutputDirectory \arm64-missing-tools\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-wrong-services PASS +Command (from \arm64-wrong-services\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-wrong-services\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-wrong-services\package -Architecture arm64 -OutputDirectory \arm64-wrong-services\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-missing-services PASS +Command (from \arm64-missing-services\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-missing-services\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-missing-services\package -Architecture arm64 -OutputDirectory \arm64-missing-services\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-wrong-diagnostics PASS +Command (from \arm64-wrong-diagnostics\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-wrong-diagnostics\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-wrong-diagnostics\package -Architecture arm64 -OutputDirectory \arm64-wrong-diagnostics\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-missing-diagnostics PASS +Command (from \arm64-missing-diagnostics\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-missing-diagnostics\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-missing-diagnostics\package -Architecture arm64 -OutputDirectory \arm64-missing-diagnostics\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-excess-plugin-httpRoutes PASS +Command (from \arm64-excess-plugin-httpRoutes\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-excess-plugin-httpRoutes\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-excess-plugin-httpRoutes\package -Architecture arm64 -OutputDirectory \arm64-excess-plugin-httpRoutes\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-excess-httpRouteCount PASS +Command (from \arm64-excess-httpRouteCount\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-excess-httpRouteCount\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-excess-httpRouteCount\package -Architecture arm64 -OutputDirectory \arm64-excess-httpRouteCount\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +CASE arm64-missing-plugin-object PASS +Command (from \arm64-missing-plugin-object\package-source): npm pack --offline --ignore-scripts --pack-destination \arm64-missing-plugin-object\package --silent +Command: & .\scripts\Build-Payload.ps1 -PackageDirectory \arm64-missing-plugin-object\package -Architecture arm64 -OutputDirectory \arm64-missing-plugin-object\payload +Expected: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Actual: The selected OpenClaw payload did not load the Gateway isolation plugin with the required read-only runtime shape. +Environment restored: npm_config_arch, npm_config_target_arch, OPENCLAW_STATE_DIR, CLAWCTL_GATEWAY_ISOLATION, RUNNER_TEMP; working directory restored: true +Runtime calls: runtime-inspection +Rejected application and payload metadata absent. + +RESULT: 66 passed; 6 accepted; 60 rejected as expected; 0 failed. +Harness environment and working directory restored. Generated TestRoot removed. No preexisting directories were removed. diff --git a/docs/validation/pr-28/plugin-tests.tap b/docs/validation/pr-28/plugin-tests.tap new file mode 100644 index 00000000..1d0ce224 --- /dev/null +++ b/docs/validation/pr-28/plugin-tests.tap @@ -0,0 +1,136 @@ +TAP version 13 +# Subtest: accepts only the exact launcher isolation values +ok 1 - accepts only the exact launcher isolation values + --- + duration_ms: 1.4354 + type: 'test' + ... +# Subtest: renders the exact enabled read-only status +ok 2 - renders the exact enabled read-only status + --- + duration_ms: 0.4472 + type: 'test' + ... +# Subtest: renders the exact disabled read-only status +ok 3 - renders the exact disabled read-only status + --- + duration_ms: 0.1477 + type: 'test' + ... +# Subtest: registers one read-only Control tab and one authenticated sandbox route +ok 4 - registers one read-only Control tab and one authenticated sandbox route + --- + duration_ms: 1.2608 + type: 'test' + ... +# Subtest: reads "enabled" exactly once and keeps every response stable +ok 5 - reads "enabled" exactly once and keeps every response stable + --- + duration_ms: 0.4925 + type: 'test' + ... +# Subtest: reads "disabled" exactly once and keeps every response stable +ok 6 - reads "disabled" exactly once and keeps every response stable + --- + duration_ms: 0.6573 + type: 'test' + ... +# Subtest: reads missing exactly once and keeps every response stable +ok 7 - reads missing exactly once and keeps every response stable + --- + duration_ms: 0.4355 + type: 'test' + ... +# Subtest: reads "" exactly once and keeps every response stable +ok 8 - reads "" exactly once and keeps every response stable + --- + duration_ms: 0.2525 + type: 'test' + ... +# Subtest: reads "invalid" exactly once and keeps every response stable +ok 9 - reads "invalid" exactly once and keeps every response stable + --- + duration_ms: 0.3347 + type: 'test' + ... +# Subtest: reads "ENABLED" exactly once and keeps every response stable +ok 10 - reads "ENABLED" exactly once and keeps every response stable + --- + duration_ms: 0.3578 + type: 'test' + ... +# Subtest: reads " enabled " exactly once and keeps every response stable +ok 11 - reads " enabled " exactly once and keeps every response stable + --- + duration_ms: 0.2516 + type: 'test' + ... +# Subtest: fails closed for missing with no status, command, or copy control +ok 12 - fails closed for missing with no status, command, or copy control + --- + duration_ms: 1.206 + type: 'test' + ... +# Subtest: renderer rejects missing +ok 13 - renderer rejects missing + --- + duration_ms: 0.7585 + type: 'test' + ... +# Subtest: fails closed for "" with no status, command, or copy control +ok 14 - fails closed for "" with no status, command, or copy control + --- + duration_ms: 0.2382 + type: 'test' + ... +# Subtest: renderer rejects "" +ok 15 - renderer rejects "" + --- + duration_ms: 0.08 + type: 'test' + ... +# Subtest: fails closed for "invalid" with no status, command, or copy control +ok 16 - fails closed for "invalid" with no status, command, or copy control + --- + duration_ms: 0.1374 + type: 'test' + ... +# Subtest: renderer rejects "invalid" +ok 17 - renderer rejects "invalid" + --- + duration_ms: 0.0748 + type: 'test' + ... +# Subtest: fails closed for "ENABLED" with no status, command, or copy control +ok 18 - fails closed for "ENABLED" with no status, command, or copy control + --- + duration_ms: 0.1684 + type: 'test' + ... +# Subtest: renderer rejects "ENABLED" +ok 19 - renderer rejects "ENABLED" + --- + duration_ms: 0.1728 + type: 'test' + ... +# Subtest: fails closed for " enabled " with no status, command, or copy control +ok 20 - fails closed for " enabled " with no status, command, or copy control + --- + duration_ms: 0.0809 + type: 'test' + ... +# Subtest: renderer rejects " enabled " +ok 21 - renderer rejects " enabled " + --- + duration_ms: 0.0741 + type: 'test' + ... +1..21 +# tests 21 +# suites 0 +# pass 21 +# fail 0 +# cancelled 0 +# skipped 0 +# todo 0 +# duration_ms 172.9231 diff --git a/docs/validation/pr-28/policy-checks.txt b/docs/validation/pr-28/policy-checks.txt new file mode 100644 index 00000000..7a9a3383 --- /dev/null +++ b/docs/validation/pr-28/policy-checks.txt @@ -0,0 +1,4 @@ +Authorized official signing for OpenClaw commit 0965053fe6b9341776df147a6934b7485c60b5ca and Gateway MSIX version 0.1.1.0. +Authorized official signing for OpenClaw commit 0965053fe6b9341776df147a6934b7485c60b5ca and Gateway MSIX version 0.1.1.0. +Gateway MSIX signing policy tests passed. +Workflow package-version tests passed. diff --git a/docs/validation/pr-28/runtime-checks.txt b/docs/validation/pr-28/runtime-checks.txt new file mode 100644 index 00000000..313b6390 --- /dev/null +++ b/docs/validation/pr-28/runtime-checks.txt @@ -0,0 +1,8 @@ +PASS launcher-disabled: 10 HTTP assertions; GET/HEAD auth denial and valid auth; response hardening headers; write-method probes leave status unchanged; visible sidebar tab; sandboxed iframe; exact status/tone/inverse CLI; Copy writes exact command to clipboard +PASS fixture-enabled: 10 HTTP assertions; GET/HEAD auth denial and valid auth; response hardening headers; write-method probes leave status unchanged; visible sidebar tab; sandboxed iframe; exact status/tone/inverse CLI; Copy writes exact command to clipboard +PASS fixture-disabled: 10 HTTP assertions; GET/HEAD auth denial and valid auth; response hardening headers; write-method probes leave status unchanged; visible sidebar tab; sandboxed iframe; exact status/tone/inverse CLI; Copy writes exact command to clipboard +PASS fixture-missing: 10 HTTP assertions; GET/HEAD auth denial and valid auth; response hardening headers; write-method probes leave status unchanged; HTTP 503 fails closed; Control UI error without stale status or command +PASS fixture-invalid: 10 HTTP assertions; GET/HEAD auth denial and valid auth; response hardening headers; write-method probes leave status unchanged; HTTP 503 fails closed; Control UI error without stale status or command +PASS fixture-uppercase: 10 HTTP assertions; GET/HEAD auth denial and valid auth; response hardening headers; write-method probes leave status unchanged; HTTP 503 fails closed; Control UI error without stale status or command +PASS fixture-empty: 10 HTTP assertions; GET/HEAD auth denial and valid auth; response hardening headers; write-method probes leave status unchanged; HTTP 503 fails closed; Control UI error without stale status or command +PASS fixture-whitespace: 10 HTTP assertions; GET/HEAD auth denial and valid auth; response hardening headers; write-method probes leave status unchanged; HTTP 503 fails closed; Control UI error without stale status or command diff --git a/docs/validation/pr-28/runtime-matrix.json b/docs/validation/pr-28/runtime-matrix.json new file mode 100644 index 00000000..e97d3f08 --- /dev/null +++ b/docs/validation/pr-28/runtime-matrix.json @@ -0,0 +1,686 @@ +{ + "source": "9aa1df286c2b6fd59b4c101201ddae0ae6000324", + "build": { + "version": "2026.8.2", + "commit": "0965053fe6b9341776df147a6934b7485c60b5ca", + "builtAt": "2026-09-11T00:24:39.157Z", + "buildId": "2026.8.2-release-0965053fe6b9-2026-09-11T00-24-39.157Z" + }, + "environment": { + "os": "Windows x64", + "node": "v24.16.0", + "layout": "expanded application", + "port": 19428, + "browser": "152.0.4191.66" + }, + "cases": [ + { + "id": "launcher-disabled", + "launch": "NativeAOT launcher", + "input": "enabled", + "expectedMode": "disabled", + "http": [ + { + "method": "GET", + "access": "anonymous", + "status": 401 + }, + { + "method": "GET", + "access": "wrong-token", + "status": 401 + }, + { + "method": "GET", + "access": "authenticated", + "status": 200 + }, + { + "method": "HEAD", + "access": "anonymous", + "status": 401 + }, + { + "method": "HEAD", + "access": "wrong-token", + "status": 401 + }, + { + "method": "HEAD", + "access": "authenticated", + "status": 200 + }, + { + "method": "POST", + "access": "authenticated", + "status": 200, + "effect": "same read-only response" + }, + { + "method": "PUT", + "access": "authenticated", + "status": 200, + "effect": "same read-only response" + }, + { + "method": "PATCH", + "access": "authenticated", + "status": 200, + "effect": "same read-only response" + }, + { + "method": "DELETE", + "access": "authenticated", + "status": 200, + "effect": "same read-only response" + } + ], + "assertions": [ + "GET/HEAD auth denial and valid auth", + "response hardening headers", + "write-method probes leave status unchanged", + "visible sidebar tab", + "sandboxed iframe", + "exact status/tone/inverse CLI", + "Copy writes exact command to clipboard" + ], + "ui": { + "state": "Disabled", + "tone": "warn", + "command": "clawctl gateway-isolation enable", + "sandbox": "allow-scripts", + "copy": "exact clipboard text verified" + }, + "hello": { + "version": "2026.8.2", + "buildId": "2026.8.2-release-0965053fe6b9-2026-09-11T00-24-39.157Z", + "controlUiBuildSource": "bundled" + }, + "screenshot": "launcher-disabled.png", + "passed": true + }, + { + "id": "fixture-enabled", + "launch": "Node with launcher-input fixture", + "input": "enabled", + "expectedMode": "enabled", + "http": [ + { + "method": "GET", + "access": "anonymous", + "status": 401 + }, + { + "method": "GET", + "access": "wrong-token", + "status": 401 + }, + { + "method": "GET", + "access": "authenticated", + "status": 200 + }, + { + "method": "HEAD", + "access": "anonymous", + "status": 401 + }, + { + "method": "HEAD", + "access": "wrong-token", + "status": 401 + }, + { + "method": "HEAD", + "access": "authenticated", + "status": 200 + }, + { + "method": "POST", + "access": "authenticated", + "status": 200, + "effect": "same read-only response" + }, + { + "method": "PUT", + "access": "authenticated", + "status": 200, + "effect": "same read-only response" + }, + { + "method": "PATCH", + "access": "authenticated", + "status": 200, + "effect": "same read-only response" + }, + { + "method": "DELETE", + "access": "authenticated", + "status": 200, + "effect": "same read-only response" + } + ], + "assertions": [ + "GET/HEAD auth denial and valid auth", + "response hardening headers", + "write-method probes leave status unchanged", + "visible sidebar tab", + "sandboxed iframe", + "exact status/tone/inverse CLI", + "Copy writes exact command to clipboard" + ], + "ui": { + "state": "Enabled", + "tone": "ok", + "command": "clawctl gateway-isolation disable", + "sandbox": "allow-scripts", + "copy": "exact clipboard text verified" + }, + "hello": { + "version": "2026.8.2", + "buildId": "2026.8.2-release-0965053fe6b9-2026-09-11T00-24-39.157Z", + "controlUiBuildSource": "bundled" + }, + "screenshot": "fixture-enabled.png", + "passed": true + }, + { + "id": "fixture-disabled", + "launch": "Node with launcher-input fixture", + "input": "disabled", + "expectedMode": "disabled", + "http": [ + { + "method": "GET", + "access": "anonymous", + "status": 401 + }, + { + "method": "GET", + "access": "wrong-token", + "status": 401 + }, + { + "method": "GET", + "access": "authenticated", + "status": 200 + }, + { + "method": "HEAD", + "access": "anonymous", + "status": 401 + }, + { + "method": "HEAD", + "access": "wrong-token", + "status": 401 + }, + { + "method": "HEAD", + "access": "authenticated", + "status": 200 + }, + { + "method": "POST", + "access": "authenticated", + "status": 200, + "effect": "same read-only response" + }, + { + "method": "PUT", + "access": "authenticated", + "status": 200, + "effect": "same read-only response" + }, + { + "method": "PATCH", + "access": "authenticated", + "status": 200, + "effect": "same read-only response" + }, + { + "method": "DELETE", + "access": "authenticated", + "status": 200, + "effect": "same read-only response" + } + ], + "assertions": [ + "GET/HEAD auth denial and valid auth", + "response hardening headers", + "write-method probes leave status unchanged", + "visible sidebar tab", + "sandboxed iframe", + "exact status/tone/inverse CLI", + "Copy writes exact command to clipboard" + ], + "ui": { + "state": "Disabled", + "tone": "warn", + "command": "clawctl gateway-isolation enable", + "sandbox": "allow-scripts", + "copy": "exact clipboard text verified" + }, + "hello": { + "version": "2026.8.2", + "buildId": "2026.8.2-release-0965053fe6b9-2026-09-11T00-24-39.157Z", + "controlUiBuildSource": "bundled" + }, + "screenshot": "fixture-disabled.png", + "passed": true + }, + { + "id": "fixture-missing", + "launch": "Node with launcher-input fixture", + "input": "(missing)", + "expectedMode": null, + "http": [ + { + "method": "GET", + "access": "anonymous", + "status": 401 + }, + { + "method": "GET", + "access": "wrong-token", + "status": 401 + }, + { + "method": "GET", + "access": "authenticated", + "status": 503 + }, + { + "method": "HEAD", + "access": "anonymous", + "status": 401 + }, + { + "method": "HEAD", + "access": "wrong-token", + "status": 401 + }, + { + "method": "HEAD", + "access": "authenticated", + "status": 503 + }, + { + "method": "POST", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + }, + { + "method": "PUT", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + }, + { + "method": "PATCH", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + }, + { + "method": "DELETE", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + } + ], + "assertions": [ + "GET/HEAD auth denial and valid auth", + "response hardening headers", + "write-method probes leave status unchanged", + "HTTP 503 fails closed", + "Control UI error without stale status or command" + ], + "ui": { + "status": "invalid launcher mode message", + "staleStatus": false, + "sandbox": "allow-scripts" + }, + "hello": { + "version": "2026.8.2", + "buildId": "2026.8.2-release-0965053fe6b9-2026-09-11T00-24-39.157Z", + "controlUiBuildSource": "bundled" + }, + "screenshot": "fixture-missing.png", + "passed": true + }, + { + "id": "fixture-invalid", + "launch": "Node with launcher-input fixture", + "input": "invalid", + "expectedMode": null, + "http": [ + { + "method": "GET", + "access": "anonymous", + "status": 401 + }, + { + "method": "GET", + "access": "wrong-token", + "status": 401 + }, + { + "method": "GET", + "access": "authenticated", + "status": 503 + }, + { + "method": "HEAD", + "access": "anonymous", + "status": 401 + }, + { + "method": "HEAD", + "access": "wrong-token", + "status": 401 + }, + { + "method": "HEAD", + "access": "authenticated", + "status": 503 + }, + { + "method": "POST", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + }, + { + "method": "PUT", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + }, + { + "method": "PATCH", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + }, + { + "method": "DELETE", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + } + ], + "assertions": [ + "GET/HEAD auth denial and valid auth", + "response hardening headers", + "write-method probes leave status unchanged", + "HTTP 503 fails closed", + "Control UI error without stale status or command" + ], + "ui": { + "status": "invalid launcher mode message", + "staleStatus": false, + "sandbox": "allow-scripts" + }, + "hello": { + "version": "2026.8.2", + "buildId": "2026.8.2-release-0965053fe6b9-2026-09-11T00-24-39.157Z", + "controlUiBuildSource": "bundled" + }, + "screenshot": "fixture-invalid.png", + "passed": true + }, + { + "id": "fixture-uppercase", + "launch": "Node with launcher-input fixture", + "input": "ENABLED", + "expectedMode": null, + "http": [ + { + "method": "GET", + "access": "anonymous", + "status": 401 + }, + { + "method": "GET", + "access": "wrong-token", + "status": 401 + }, + { + "method": "GET", + "access": "authenticated", + "status": 503 + }, + { + "method": "HEAD", + "access": "anonymous", + "status": 401 + }, + { + "method": "HEAD", + "access": "wrong-token", + "status": 401 + }, + { + "method": "HEAD", + "access": "authenticated", + "status": 503 + }, + { + "method": "POST", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + }, + { + "method": "PUT", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + }, + { + "method": "PATCH", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + }, + { + "method": "DELETE", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + } + ], + "assertions": [ + "GET/HEAD auth denial and valid auth", + "response hardening headers", + "write-method probes leave status unchanged", + "HTTP 503 fails closed", + "Control UI error without stale status or command" + ], + "ui": { + "status": "invalid launcher mode message", + "staleStatus": false, + "sandbox": "allow-scripts" + }, + "hello": { + "version": "2026.8.2", + "buildId": "2026.8.2-release-0965053fe6b9-2026-09-11T00-24-39.157Z", + "controlUiBuildSource": "bundled" + }, + "screenshot": "fixture-uppercase.png", + "passed": true + }, + { + "id": "fixture-empty", + "launch": "Node with launcher-input fixture", + "input": "", + "expectedMode": null, + "http": [ + { + "method": "GET", + "access": "anonymous", + "status": 401 + }, + { + "method": "GET", + "access": "wrong-token", + "status": 401 + }, + { + "method": "GET", + "access": "authenticated", + "status": 503 + }, + { + "method": "HEAD", + "access": "anonymous", + "status": 401 + }, + { + "method": "HEAD", + "access": "wrong-token", + "status": 401 + }, + { + "method": "HEAD", + "access": "authenticated", + "status": 503 + }, + { + "method": "POST", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + }, + { + "method": "PUT", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + }, + { + "method": "PATCH", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + }, + { + "method": "DELETE", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + } + ], + "assertions": [ + "GET/HEAD auth denial and valid auth", + "response hardening headers", + "write-method probes leave status unchanged", + "HTTP 503 fails closed", + "Control UI error without stale status or command" + ], + "ui": { + "status": "invalid launcher mode message", + "staleStatus": false, + "sandbox": "allow-scripts" + }, + "hello": { + "version": "2026.8.2", + "buildId": "2026.8.2-release-0965053fe6b9-2026-09-11T00-24-39.157Z", + "controlUiBuildSource": "bundled" + }, + "screenshot": "fixture-empty.png", + "passed": true + }, + { + "id": "fixture-whitespace", + "launch": "Node with launcher-input fixture", + "input": " enabled ", + "expectedMode": null, + "http": [ + { + "method": "GET", + "access": "anonymous", + "status": 401 + }, + { + "method": "GET", + "access": "wrong-token", + "status": 401 + }, + { + "method": "GET", + "access": "authenticated", + "status": 503 + }, + { + "method": "HEAD", + "access": "anonymous", + "status": 401 + }, + { + "method": "HEAD", + "access": "wrong-token", + "status": 401 + }, + { + "method": "HEAD", + "access": "authenticated", + "status": 503 + }, + { + "method": "POST", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + }, + { + "method": "PUT", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + }, + { + "method": "PATCH", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + }, + { + "method": "DELETE", + "access": "authenticated", + "status": 503, + "effect": "same read-only response" + } + ], + "assertions": [ + "GET/HEAD auth denial and valid auth", + "response hardening headers", + "write-method probes leave status unchanged", + "HTTP 503 fails closed", + "Control UI error without stale status or command" + ], + "ui": { + "status": "invalid launcher mode message", + "staleStatus": false, + "sandbox": "allow-scripts" + }, + "hello": { + "version": "2026.8.2", + "buildId": "2026.8.2-release-0965053fe6b9-2026-09-11T00-24-39.157Z", + "controlUiBuildSource": "bundled" + }, + "screenshot": "fixture-whitespace.png", + "passed": true + } + ], + "sha256": { + "launcher": "a85063b9caedf346444db4da72fa3ab62a0bf913b6a4b6056b8d0b6d4a476def", + "node": "b3094d0b49f9ad602262a9921551737bb97637c05dd357a06ae98188d7290aa3", + "runtimeEntry": "4f4d29770da4f86dbd0e07cbd4d46deab785905dd89ac719033fcfd866fb5d17", + "plugin": "7f98aed21bf7773f78a25c94c47d4f0f4efd6998c314201869307b798f25d1cd" + }, + "completedAt": "2026-09-11T03:52:53.074Z", + "cleanup": "All validation-owned process trees stopped; port verified free" +} diff --git a/docs/validation/pr-28/runtime-registration.json b/docs/validation/pr-28/runtime-registration.json new file mode 100644 index 00000000..dd92ab42 --- /dev/null +++ b/docs/validation/pr-28/runtime-registration.json @@ -0,0 +1,28 @@ +{ + "command": "openclaw.exe plugins inspect gateway-isolation --runtime --json", + "plugin": { + "id": "gateway-isolation", + "origin": "bundled", + "enabled": true, + "activated": true, + "status": "loaded", + "imported": true, + "httpRoutes": 1 + }, + "capabilities": { + "httpRouteCount": 1, + "gatewayMethods": 0, + "tools": 0, + "services": 0, + "diagnostics": 0, + "typedHooks": 0, + "customHooks": 0, + "commands": 0, + "cliCommands": 0, + "gatewayDiscoveryServices": 0, + "mcpServers": 0, + "lspServers": 0 + }, + "shape": "non-capability", + "capabilityMode": "none" +} diff --git a/plugins/gateway-isolation/index.js b/plugins/gateway-isolation/index.js new file mode 100644 index 00000000..7690e828 --- /dev/null +++ b/plugins/gateway-isolation/index.js @@ -0,0 +1,265 @@ +const ISOLATION_ENVIRONMENT_VARIABLE = "CLAWCTL_GATEWAY_ISOLATION"; +const STATUS_PATH = "/plugins/gateway-isolation/status"; + +export function readGatewayIsolationMode(env) { + const value = env[ISOLATION_ENVIRONMENT_VARIABLE]; + return value === "enabled" || value === "disabled" ? value : null; +} + +export function renderGatewayIsolationPage(mode) { + if (mode !== "enabled" && mode !== "disabled") { + throw new TypeError("Gateway isolation mode must be enabled or disabled."); + } + + const enabled = mode === "enabled"; + const status = enabled ? "Enabled" : "Disabled"; + const command = `clawctl gateway-isolation ${enabled ? "disable" : "enable"}`; + const tone = enabled ? "ok" : "warn"; + + return ` + + + + + Gateway Isolation + + + +
+

Gateway Isolation

+

Diagnostic launch mode reported by the Windows launcher.

+
+
+
Reported Gateway Isolation
+
+ ${status} +
+
+
+
+
Change with CLI
+
Run from the signed-in user session on the Gateway host.
+
+
+ ${command} + +
+
+
+
+
+ + +`; +} + +function writeHtmlResponse(response, statusCode, html) { + response.writeHead(statusCode, { + "Cache-Control": "no-store", + "Content-Security-Policy": + "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; frame-ancestors 'self'", + "Content-Type": "text/html; charset=utf-8", + "Referrer-Policy": "no-referrer", + "X-Content-Type-Options": "nosniff", + }); + response.end(html); +} + +export function createGatewayIsolationPlugin(env = process.env) { + const launchMode = readGatewayIsolationMode(env); + + return { + id: "gateway-isolation", + name: "Gateway Isolation", + description: "Reports the Windows launch mode selected for the running Gateway.", + register(api) { + api.session.controls.registerControlUiDescriptor({ + surface: "tab", + id: "gateway-isolation", + label: "Gateway Isolation", + description: "Read-only Windows Gateway isolation status.", + icon: "shield-check", + group: "control", + order: 20, + path: STATUS_PATH, + requiredScopes: ["operator.read"], + }); + api.registerHttpRoute({ + path: STATUS_PATH, + auth: "gateway", + match: "exact", + handler(_request, response) { + if (!launchMode) { + writeHtmlResponse( + response, + 503, + "Gateway Isolation unavailable

The Windows launcher did not provide a valid Gateway isolation mode.

", + ); + return true; + } + writeHtmlResponse(response, 200, renderGatewayIsolationPage(launchMode)); + return true; + }, + }); + }, + }; +} + +export default createGatewayIsolationPlugin(); diff --git a/plugins/gateway-isolation/index.test.js b/plugins/gateway-isolation/index.test.js new file mode 100644 index 00000000..c8f35830 --- /dev/null +++ b/plugins/gateway-isolation/index.test.js @@ -0,0 +1,162 @@ +import assert from "node:assert/strict"; +import test from "node:test"; +import { + createGatewayIsolationPlugin, + readGatewayIsolationMode, + renderGatewayIsolationPage, +} from "./index.js"; + +function registerPlugin(mode) { + const descriptors = []; + const routes = []; + const plugin = createGatewayIsolationPlugin({ + CLAWCTL_GATEWAY_ISOLATION: mode, + }); + plugin.register({ + session: { + controls: { + registerControlUiDescriptor(descriptor) { + descriptors.push(descriptor); + }, + }, + }, + registerHttpRoute(route) { + routes.push(route); + }, + }); + assert.equal(descriptors.length, 1); + assert.equal(routes.length, 1); + return { descriptors, routes }; +} + +function invokeRoute(route) { + const result = { + body: "", + headers: {}, + statusCode: 0, + }; + const handled = route.handler( + {}, + { + writeHead(statusCode, headers) { + result.statusCode = statusCode; + result.headers = headers; + }, + end(body) { + result.body = body; + }, + }, + ); + assert.equal(handled, true); + return result; +} + +test("accepts only the exact launcher isolation values", () => { + assert.equal(readGatewayIsolationMode({ CLAWCTL_GATEWAY_ISOLATION: "enabled" }), "enabled"); + assert.equal(readGatewayIsolationMode({ CLAWCTL_GATEWAY_ISOLATION: "disabled" }), "disabled"); + for (const value of [undefined, "", "ENABLED", "unknown"]) { + assert.equal(readGatewayIsolationMode({ CLAWCTL_GATEWAY_ISOLATION: value }), null); + } +}); + +for (const expected of [ + { + mode: "enabled", + status: "Enabled", + command: "clawctl gateway-isolation disable", + tone: "status--ok", + }, + { + mode: "disabled", + status: "Disabled", + command: "clawctl gateway-isolation enable", + tone: "status--warn", + }, +]) { + test(`renders the exact ${expected.mode} read-only status`, () => { + const html = renderGatewayIsolationPage(expected.mode); + assert.match(html, /Gateway Isolation/); + assert.match(html, /Reported Gateway Isolation/); + assert.match(html, new RegExp(`>${expected.status}<`)); + assert.match(html, /Change with CLI/); + assert.match(html, /Run from the signed-in user session on the Gateway host\./); + assert.match(html, new RegExp(expected.command)); + assert.match(html, new RegExp(expected.tone)); + assert.match(html, /aria-label="Copy command"/); + assert.match(html, /Copy the selected command manually\./); + assert.match(html, /copied = document\.execCommand\("copy"\)/); + assert.doesNotMatch(html, /next manual Gateway restart/i); + }); +} + +test("registers one read-only Control tab and one authenticated sandbox route", () => { + const { descriptors, routes } = registerPlugin("enabled"); + assert.deepEqual(descriptors[0], { + surface: "tab", + id: "gateway-isolation", + label: "Gateway Isolation", + description: "Read-only Windows Gateway isolation status.", + icon: "shield-check", + group: "control", + order: 20, + path: "/plugins/gateway-isolation/status", + requiredScopes: ["operator.read"], + }); + assert.equal(routes[0].path, descriptors[0].path); + assert.equal(routes[0].auth, "gateway"); + assert.equal(routes[0].match, "exact"); + + const response = invokeRoute(routes[0]); + assert.equal(response.statusCode, 200); + assert.equal(response.headers["Cache-Control"], "no-store"); + assert.match(response.headers["Content-Security-Policy"], /frame-ancestors 'self'/); + assert.match(response.body, />Enabled { + let reads = 0; + let value = initial; + const plugin = createGatewayIsolationPlugin({ + get CLAWCTL_GATEWAY_ISOLATION() { + reads++; + return value; + }, + }); + assert.equal(reads, 1); + value = initial === "enabled" ? "disabled" : "enabled"; + const routes = []; + plugin.register({ + session: { controls: { registerControlUiDescriptor() {} } }, + registerHttpRoute(route) { + routes.push(route); + }, + }); + + const first = invokeRoute(routes[0]); + assert.equal(first.statusCode, initial === "enabled" || initial === "disabled" ? 200 : 503); + if (initial === "enabled") assert.match(first.body, />EnabledDisabled { + const { routes } = registerPlugin(mode); + const response = invokeRoute(routes[0]); + assert.equal(response.statusCode, 503); + assert.match(response.body, /did not provide a valid Gateway isolation mode/); + assert.doesNotMatch(response.body, /status--(?:ok|warn)|isolation-command|