feat: add the pinned MXC isolation backend

[paulcam206]

What Problem This Solves

The session lifecycle needs an isolation backend before it can create an agent session, but the intended Microsoft.Mxc.Sdk is unreleased.

User Impact

There is no user-visible session command yet. Contributors gain a pinned, inspectable MXC transport and runtime acquisition path that later lifecycle work can call.

Why This Change Was Made

The MXC runtime is a pinned CLI backfill standing in for the unreleased Microsoft.Mxc.Sdk; IMxcSessionClient is the seam that the official SDK will replace. mxc-runtime.lock.json and Get-MxcRuntime.ps1 acquire the runtime with provenance rather than accepting an ambient tool.

Build-MSIX.ps1 stages the pinned files into content\mxc\<architecture>, and the launcher project packages them as mxc\<architecture>. In the installed package, MxcRuntimeLocator resolves that directory and supplies wxc-exec.exe to MxcCliSessionClient.

The transport carries the MXC wire protocol and readiness probing needed by later provisioning code. PR #46 is the first consumer: SessionRuntime.Create constructs this client for provisioning, start, stop, deprovision, and attached execution. This layer deliberately does not create a session or expose lifecycle commands.

It adds a third-party runtime to package content and to signing/trust inputs. The official SDK must replace the backfill through IMxcSessionClient, not by spreading CLI assumptions through the lifecycle.

Review fixes addressed

Buffered executor calls now receive stdin EOF, reject pre-cancelled requests before spawning, and kill and await the owned process tree before returning cancellation. Real-process regressions prove EOF, no-spawn cancellation, and no surviving PID. Clean MSIX composition now stages and verifies the pinned architecture-specific MXC runtime before MSBuild; a missing-runtime reproduction completed NativeAOT and produced the unsigned x64 MSIX. Attached calls initialize UTF-8 inside console capture, fixing the observed ΓÇö output while restoring the caller codepage.

Current validation

Current layer head: c1fa8f0765850bdec24075c90c7d25a9f8b72b73. This layer is included in the final integrated stack tip cce2b02f3acd5791654b7a6b1a5a9c27db5ff63b rebased onto 685ee93b7ebbec1e784205a3544c460bea740e11.

Integrated local gates: exact .NET SDK 10.0.100; Test-DotNetQuality.ps1 with 0 warnings/errors; full solution tests 642/642; NativeAOT x64 and ARM64 publishes for both launcher and session host; NativeAOT CLI, deployment, MXC, signing, runtime-input, release-identity, bundle, isolation-plugin, and packaging-relevance policy suites.

Live x64 MXC evidence: final-tip Developer Mode deployment registered OpenClaw.Gateway_0.1.2451.40134_x64__kaa03rpbbqef6 from workflow payload run 35191206689; openclaw --version returned OpenClaw 2026.9.4 (3a9d69d); clawctl status confirmed the isolated session was running. Earlier final-tip validation also exercised setup, Node.js 24.20.0 reuse, package-qualified activation, detached gateway launch, and redacted diagnostics collection.

Signed package evidence: local NativeAOT x64 and ARM64 packages and a multi-architecture bundle were composed and test-signed. Elevated upgrade validation passed all four proof-release transitions (v0.0.0.0 and v0.0.0.1, standalone and bundle), retained package-family LocalState in every transition, and accepted fresh standalone and bundle installs. The temporary certificate and test package were removed, then the Developer Mode registration was restored.

Layer 2 of 12. Parent: #43 - improve/session-console-environment

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 17, 2026, 4:01 PM ET / 20:01 UTC (Revision 16).

ClawSweeper review

What this changes

Adds a pinned Microsoft isolation runtime to Windows packages, an internal session transport, readiness checks, and packaging integrity validation.

Merge readiness

✅ Ready for maintainer review

This remains a useful, distinct backend layer absent from the default branch. The reviewed changes address the earlier executor and packaging problems, and no actionable introduced defect remains.

Priority: P2
Reviewed head: c1fa8f0765850bdec24075c90c7d25a9f8b72b73

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A coherent backend layer with verified dependency pins, focused regression coverage, and no remaining actionable finding.
Proof confidence	🌊 off-meta tidepool	Not applicable: The collaborator-authored layer is exempt from ordinary contributor proof. Its body reports integrated x64 MXC operation and signed install/upgrade results; source inspection connects those claims to runtime staging and dispatch, without treating version output alone as isolation proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The collaborator-authored layer is exempt from ordinary contributor proof. Its body reports integrated x64 MXC operation and signed install/upgrade results; source inspection connects those claims to runtime staging and dispatch, without treating version output alone as isolation proof.
Evidence reviewed	8 items	Introduced scope verified: The pinned parent-to-head diff contains 22 files and 3,302 additions. The full introduced implementation and tests were inspected beyond the truncated supplied patches. The stale test merge was not used to attribute changes or infer removal of default-branch behavior. Default branch and release still lack this backend: The default-branch tree has no MXC implementation or runtime lock. Its GatewayLauncher starts the packaged OpenClaw entrypoint through Node. The latest release, v2026.9.4-msix.0, targets that same default-branch revision. Dependency contract and production boundary: MxcCliSessionClient explicitly implements the @microsoft/mxc-sdk executor protocol, establishing an affirmative dependency signal. It uses an explicit executable, ArgumentList, and no shell. Current production references remain inside the new MXC subsystem; persisted ownership and command routing belong to the open consumer #46.
Findings	None	None.
Security	None	None.

How this fits together

The Windows launcher packages and starts OpenClaw. This layer supplies the native isolation runtime and translates future session lifecycle requests into its protocol; user-facing lifecycle commands arrive in a later PR.

flowchart LR
  A[Pinned npm archive] --> B[Integrity and architecture checks]
  B --> C[Windows package]
  C --> D[Runtime locator]
  E[Session lifecycle requests] --> F[Internal protocol adapter]
  D --> F
  F --> G[Native isolation runtime]
  G --> H[Results and readiness]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test growth	Production/build/config +2,034; tests +1,268; 0 removed	The growth has a stated purpose: an isolated replacement seam for the unavailable SDK plus pinned runtime acquisition and validation.

Technical review

Best possible solution:

Keep the preview CLI protocol behind the internal session interface so the official SDK can replace it without changing lifecycle callers.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR adds backend infrastructure rather than reporting a remaining existing-behavior bug; no blocking defect was established by source review.

Is this the best way to solve the issue?

Yes: the internal adapter follows the pinned dependency contract and keeps preview protocol details out of future lifecycle callers.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 685ee93b7ebb.

Labels

Label justifications:

• P2: This is bounded infrastructure for the planned Windows isolation lifecycle, with no urgent existing-user regression established.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The collaborator-authored layer is exempt from ordinary contributor proof. Its body reports integrated x64 MXC operation and signed install/upgrade results; source inspection connects those claims to runtime staging and dispatch, without treating version output alone as isolation proof.

Evidence

What I checked:

• Introduced scope verified: The pinned parent-to-head diff contains 22 files and 3,302 additions. The full introduced implementation and tests were inspected beyond the truncated supplied patches. The stale test merge was not used to attribute changes or infer removal of default-branch behavior. (c1fa8f076585)
• Default branch and release still lack this backend: The default-branch tree has no MXC implementation or runtime lock. Its GatewayLauncher starts the packaged OpenClaw entrypoint through Node. The latest release, v2026.9.4-msix.0, targets that same default-branch revision. (src/OpenClaw.Launcher/GatewayLauncher.cs:7, 685ee93b7ebb)
• Dependency contract and production boundary: MxcCliSessionClient explicitly implements the @microsoft/mxc-sdk executor protocol, establishing an affirmative dependency signal. It uses an explicit executable, ArgumentList, and no shell. Current production references remain inside the new MXC subsystem; persisted ownership and command routing belong to the open consumer feat: run OpenClaw in an owned isolated agent session #46. (src/OpenClaw.Launcher/Mxc/MxcCliSessionClient.cs:44, c1fa8f076585)
• Pinned dependency independently inspected: Read https://registry.npmjs.org/@microsoft/mxc-sdk/-/mxc-sdk-0.8.0.tgz in memory without extracting or executing it. Archive SHA-512 matches the lock; all four native files and LICENSE.md match their pinned lengths and SHA-256 values, and both architectures match their PE machine types. Published dist/state-aware-helper.js confirms IsolationSession schema 0.6.0-alpha and the envelope/error conventions; dist/state-aware-types.d.ts confirms the required unrestricted-network acknowledgement. Package metadata supplies no source repository, so repository ownership is left unknown.
• Executor fixes and regression coverage: Buffered execution closes stdin, checks cancellation before spawning, reads both output streams concurrently, and registers process-tree termination before awaiting exit. Real-process tests cover EOF, explicit cancellation with PID disappearance, and pre-cancelled no-spawn behavior. These tests were read, not executed during this read-only review. (src/OpenClaw.Launcher/Mxc/MxcCliSessionClient.cs:260, c1fa8f076585)
• Packaging trust chain: Acquisition verifies the pinned archive before allowlisted extraction and verifies file hashes and machine types before staging. Build-MSIX stages the runtime before MSBuild and inventories packaged content; signing validation checks inventory paths, hashes, lengths, and completeness. The workflow change adds a test step without broadening signing permissions. (scripts/Get-MxcRuntime.ps1:272, c1fa8f076585)

Likely related people:

• xlinush: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• RomneyDa: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• paulcam206: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (15 earlier review cycles; latest 8 shown)

• reviewed 2026-09-17T01:53:33.116Z sha 1975cc7 :: needs maintainer review before merge. :: none
• reviewed 2026-09-17T16:11:09.949Z sha c1fa8f0 :: needs maintainer review before merge. :: none
• reviewed 2026-09-17T16:23:37.481Z sha c1fa8f0 :: needs maintainer review before merge. :: none
• reviewed 2026-09-17T17:05:39.863Z sha c1fa8f0 :: needs maintainer review before merge. :: none
• reviewed 2026-09-17T18:19:07.797Z sha c1fa8f0 :: needs maintainer review before merge. :: none
• reviewed 2026-09-17T19:01:23.090Z sha c1fa8f0 :: needs maintainer review before merge. :: none
• reviewed 2026-09-17T19:23:24.054Z sha c1fa8f0 :: needs maintainer review before merge. :: none
• reviewed 2026-09-17T19:40:13.051Z sha c1fa8f0 :: needs maintainer review before merge. :: none

[paulcam206]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.