feat(rust): add the embeddable node runtime lifecycle

[giodl73-repo]

Depends on #116050.

Summary

Adds the bounded embeddable Rust node lifecycle on refreshed #116050 and current OpenClaw authority behavior. It does not replay the August node schemas or generated native models: current main already owns cancellation and protocol generation.

The generic incubation source is giodl73-repo/openclaw-rust-node#15.

What this adds

• platform-owned Ed25519 challenge signing through a redacted DeviceSigningRequest;
• typed, owned, attempt-bound issued device-token delivery;
• fresh endpoint, credentials, signing material, and connection manifest for every attempt;
• bounded lifecycle supervision, reconnect/backoff, terminal pause, runtime restart, graceful shutdown, and readiness;
• ordered duplex input, bounded UTF-8 progress/heartbeats, wire cancellation, deadline/disconnect cleanup, and connection-scoped active work;
• deterministic per-connection manifests and COMMAND_NOT_ADVERTISED rejection;
• fail-closed local admission after Gateway-authorized delivery; and
• shared current-authority fixtures consumed independently by TypeScript and Rust.

Current authority contract

The fixture's TypeScript consumer calls current resolveRequiredNodeCommandAuthority and resolveNodeCommandAllowlist. It covers invocable, pending-approval, undeclared, policy-withheld, widening/reapproval, revocation/reconciliation, pairing-generation retirement, and cancellation/deadline/disconnect cleanup behavior.

Gateway remains authoritative for durable approvals, committed-policy reconciliation, allowlists, pairing-generation leases, runner declarations, and cancellation delivery. Rust owns deterministic advertisement, post-delivery local narrowing, handler lifecycle, and cleanup.

Position in the series

1. #116050 is the merged shared client/Tauri foundation at f9a7f104c22a581b004400b0a7313fff34774016.
2. This PR adds the embeddable lifecycle and conformance layer.
3. #116863 adds the authenticated bounded sidecar bridge on this exact head.

Boundaries

Worker/session hosting, workspace transfer, plugin duplex, host statistics, system.run, PTY, MCP, skills, product IPC, credential persistence, and sidecar deployment remain outside bounded v1.

Validation

• current proof head: e188700cfe35c2e08a1a9344d71912b5731a802d;
• merged feat(rust): add shared gateway client and node host #116050 commit: f9a7f104c22a581b004400b0a7313fff34774016;
• Rust workspace: 89 passed, 0 failed;
• Rustfmt, Clippy -D warnings, rustdoc -D warnings, and git diff --check passed; and
• independent runtime-delta review found no findings.

Authority proof

The public CommandRuntime::run path proves that a wire-delivered cancellation while local admission is awaiting returns INVOCATION_CANCELLED without constructing the native handler. Allowed completion and cancellation-driven native-effect suppression are also covered end to end; buffered retired-session and duplex-overflow paths remain fail-closed.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 16, 2026, 2:20 PM ET / 18:20 UTC (Revision 29).

ClawSweeper review

What this changes

Adds reusable Rust node connection supervision, platform-owned signing, local command admission, and bounded streaming input/output with cancellation.

Merge readiness

✅ Ready for maintainer review

This remains a useful, distinct follow-up to the now-merged Rust foundation. No blocking introduced defect was found; the foundation merge also resolves the previous concern about introducing these unpublished workspace crates.

Priority: P2
Reviewed head: e188700cfe35c2e08a1a9344d71912b5731a802d

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A coherent extension of the merged runtime with meaningful transport-boundary evidence and no blocking finding.
Proof confidence	🐚 platinum hermit (4/6) ✨ media proof bonus	Sufficient (linked_artifact): The reported exact-head run covers the public Rust runtime over real loopback WebSockets, including allowed effects, wire cancellation during awaited admission, retired-session rejection, and duplex recovery boundaries; source inspection confirms those scenarios reach the production owners.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): The reported exact-head run covers the public Rust runtime over real loopback WebSockets, including allowed effects, wire cancellation during awaited admission, retired-session rejection, and duplex recovery boundaries; source inspection confirms those scenarios reach the production owners.
Evidence reviewed	9 items	Pinned change ownership: The complete local merge-base-to-head delta contains the lifecycle, node-host changes, and conformance tests. Cargo manifests, Cargo.lock, and the shared Gateway transport are not introduced changes in this PR; the Socket dependency comments concern a broader earlier comparison. Foundation merged since the previous review: GitHub verifies #116050 merged at 2026-09-16T18:11:18Z. Its accepted scope includes the two unpublished workspace crates, so their initial repository placement is no longer an outstanding prerequisite for this bounded follow-up. Current main still lacks the reusable lifecycle: The fetched main contains the earlier host implementation but no lifecycle.rs. The merged foundation therefore does not supersede this PR’s central contribution.
Findings	None	None.
Security	None	None.

How this fits together

The Rust node runtime connects native hosts to OpenClaw’s Gateway and dispatches authorized commands to embedding-owned handlers. It returns progress and results while managing reconnects, deadlines, and session cleanup.

flowchart TD
  A[Native host configuration and signing] --> B[Connection lifecycle]
  B --> C[Gateway session]
  C --> D[Command manifest and local admission]
  D --> E[Native command handler]
  E --> F[Progress and final results]
  C --> G[Cancellation and session retirement]
  G --> E
  F --> C

Loading

Before merge

None.

Agent review details

Security

None.

PR surface

Tests +1278, Other +2081. Total +3359 across 13 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	0	0	0	0
Tests	5	1299	21	+1278
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	8	2477	396	+2081
Total	13	3776	417	+3359

Review metrics

Metric	Value	Why it matters
Production versus test growth	Production +1,325 lines; tests and fixtures +2,034 lines	Net physical-line counts separate inline Rust tests from production; the stated lifecycle, admission, signing, and duplex scope explains the production growth.

Root-cause cluster

Relationship: canonical
Canonical: #116450
Summary: This PR owns the lifecycle layer between the merged transport foundation and the separate proposed sidecar bridge.

Members:

• adjacent_distinct: feat(rust): add shared gateway client and node host #116050 - Merged foundation dependency; it does not supply this reusable lifecycle layer.
• adjacent_distinct: feat(rust): add authenticated node sidecar bridge #116863 - Open downstream sidecar bridge that depends on this lifecycle work rather than replacing it.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

Keep lifecycle supervision in the existing Rust node-host owner while leaving durable authorization, platform permissions, and credential persistence with their established owners.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction: this adds an embedding capability, and the inspected socket harnesses exercise its lifecycle and authority boundaries.

Is this the best way to solve the issue?

Yes. Extending the merged node-host crate and moving the foreground host onto the same lifecycle avoids competing supervision owners without changing shipped configuration or publishing a stable Rust API.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 89b85fd7c733.

Labels

Label justifications:

• P2: This is a bounded native-runtime capability improvement without evidence of an urgent user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The reported exact-head run covers the public Rust runtime over real loopback WebSockets, including allowed effects, wire cancellation during awaited admission, retired-session rejection, and duplex recovery boundaries; source inspection confirms those scenarios reach the production owners.
• proof: sufficient: Contributor real behavior proof is sufficient. The reported exact-head run covers the public Rust runtime over real loopback WebSockets, including allowed effects, wire cancellation during awaited admission, retired-session rejection, and duplex recovery boundaries; source inspection confirms those scenarios reach the production owners.

Evidence

What I checked:

• Pinned change ownership: The complete local merge-base-to-head delta contains the lifecycle, node-host changes, and conformance tests. Cargo manifests, Cargo.lock, and the shared Gateway transport are not introduced changes in this PR; the Socket dependency comments concern a broader earlier comparison. (e188700cfe35)
• Foundation merged since the previous review: GitHub verifies feat(rust): add shared gateway client and node host #116050 merged at 2026-09-16T18:11:18Z. Its accepted scope includes the two unpublished workspace crates, so their initial repository placement is no longer an outstanding prerequisite for this bounded follow-up. (f9a7f104c22a)
• Current main still lacks the reusable lifecycle: The fetched main contains the earlier host implementation but no lifecycle.rs. The merged foundation therefore does not supersede this PR’s central contribution. (crates/openclaw-node-host/src/host.rs, 89b85fd7c733)
• Release boundary: The supplied latest release, v2026.9.4, has no crates tree; this lifecycle is not an already-shipped implementation. (3a9d69db306c)
• Authority checks survive awaited admission: After admission, evaluation checks overflow, cancellation, and session retirement before constructing the handler. The existing shared transport marks a close request as retirement immediately. This addresses the concrete historical cancellation and retirement findings. (crates/openclaw-node-host/src/runtime.rs:699, e188700cfe35)
• Production-boundary authority proof: The captured PR body reports 89 passing Rust tests at the reviewed head. Inspection confirms public CommandRuntime::run tests use real loopback WebSockets: allowed work records one effect, wire cancellation suppresses a subsequent effect, cancellation during admission prevents handler construction, and buffered retired-session work is rejected. These checks were inspected, not rerun in this read-only review. (crates/openclaw-node-host/tests/node_session.rs:244, e188700cfe35)

Likely related people:

• Gio Della-Libera: Raw commit f9a7f10 adds crates/openclaw-node-host/src/node.rs:816 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: f9a7f104c22a; files: crates/openclaw-node-host/src/node.rs)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (28 earlier review cycles; latest 8 shown)

• reviewed 2026-09-15T23:03:05.795Z sha ec494eb :: needs real behavior proof before merge. :: [P1] [P1] Reject cancelled or retired work before constructing the handler
• reviewed 2026-09-15T23:46:45.426Z sha 5dc4841 :: needs real behavior proof before merge. :: [P1] [P1] Retire handler authority when session close is requested
• reviewed 2026-09-15T23:53:47.057Z sha 5dc4841 :: needs real behavior proof before merge. :: [P1] Retire handler authority when session close is requested
• reviewed 2026-09-16T00:02:56.787Z sha 3caea39 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-16T05:29:40.980Z sha 43108dd :: needs real behavior proof before merge. :: none
• reviewed 2026-09-16T06:03:37.489Z sha 0aaf017 :: blocked before merge. :: none
• reviewed 2026-09-16T16:57:03.641Z sha 5665723 :: blocked before merge. :: none
• reviewed 2026-09-16T17:42:20.678Z sha 83c1354 :: blocked before merge. :: none

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35125276559
• Updated: 2026-09-16T16:59:21.458Z

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review blocked

Automated review did not run, so no review verdict was produced.

Reason: The input-safety check could not safely complete for this revision.

ClawSweeper will not retry this unchanged revision.

Next step: No contributor action is requested. Maintainers should inspect the linked workflow run.

View the workflow run.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​thiserror@​2.0.19
	cargo/​rustls@​0.23.43
	cargo/​futures-util@​0.3.33

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo writeable is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: crates/Cargo.lock → cargo/url@2.5.8 → cargo/writeable@0.6.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/writeable@0.6.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Failed
• Detail: The input scanner could not safely complete review. The durable queue will not retry this unchanged revision. Maintainers should inspect the linked workflow run.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35127290760
• Updated: 2026-09-16T17:21:28.009Z

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35130005869
• Updated: 2026-09-16T17:44:22.939Z

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35133902476
• Updated: 2026-09-16T18:21:52.653Z