feat(rust): add authenticated node sidecar bridge

[giodl73-repo]

SummaryRe-derives the authenticated sidecar runtime bridge on the current node-host stack rather than replaying the stale August implementation.This PR is stacked on #116450 at 3caea3959e64530c340c75f3a04729a38ef5d63d. Its standalone incubation and conformance source is giodl73-repo/openclaw-rust-node#16, stacked on #15.The architecture and repository-placement decision remain tracked in openclaw/rfcs#54.## ScopeThis layer contains only:- authenticated, sequence-bound framing with explicit byte ceilings;- portable version/feature/limit negotiation;- mutually authenticated handshake;- immutable secret-free configuration;- ordinary-command product-adapter bridging;- cancellation and channel-retirement cleanup;- four byte-exact TypeScript/Rust fixture corpora; and- a real separate-process configuration, manifest, admission, invocation, and result proof.Gateway authority remains with OpenClaw. The sidecar does not own endpoint selection, pairing, signing, issued-token acquisition or persistence, manifest authorization, or product policy.Product-selected IPC, protected bootstrap, executable verification, process supervision, packaging, rollout/rollback, Windows integration, worker/session hosting, workspace transfer, plugins, host statistics, system.run, PTY, MCP, and skills remain outside this PR.## Byte-exact fixture evidence- handshake: 0b22c949fa53078106f6c7196f0c07f2fa1c0504- negotiation: fad7e133a2b27c588fea72310e543f1f28452801- protocol: 5081e7321a74d427d1aac4c4de5bb691425f3ba3- runtime: 33c1435763ad9e5edb1149d56bc88ad6bab34f00## Validation- Rust workspace: 137 passed, 0 failed;- sidecar process proof: 2/2 passed;- focused TypeScript authority/integration tests: 52 passed, 0 failed;- Linux Tauri: 270 passed, 9 ignored, 0 failed;- Rustfmt, Clippy -D warnings, rustdoc -D warnings, cargo check, and git diff --check passed;- independent final code review found no significant issues.## Handler-entry authority fenceCurrent-head regression coverage proves that an invocation cancelled before task execution and a buffered invocation after session retirement is requested are rejected before the native handler is constructed. Duplex input overflow retains its specific terminal result and also suppresses handler entry.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 15, 2026, 8:03 PM ET / September 16, 2026, 00:03 UTC (Revision 16).

ClawSweeper review

What this changes

Adds reusable Rust Gateway connectivity, a bounded node runtime, and an authenticated bridge to native product commands, while moving the Linux companion onto the shared transport.

Merge readiness

⛔ Blocked before merge - 6 items remain

Keep open: this protected PR contains distinct sidecar work absent from current main and the latest release. No concrete blocking code defect was established, but the previous authority-proof gap remains unresolved.

Priority: P3
Reviewed head: 4e9753fa26d5a4d3264a4f300e7dcbc5659f22b5
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The implementation has useful boundaries and supplemental coverage, but unresolved final-effect authority evidence limits readiness.
Proof confidence	🦐 gold shrimp (3/6)	Needs stronger real behavior proof before merge: Authority-chain proof required: the reported TCP child-process pass exercises authenticated framing and configuration, but bypasses SidecarRuntimeBridge. Show allowed, locally denied, and retired-authority native effects through that owner. Redacted terminal output or logs suffice; update the PR body for automatic re-review, or ask a maintainer to comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: Authority-chain proof required: the reported TCP child-process pass exercises authenticated framing and configuration, but bypasses SidecarRuntimeBridge. Show allowed, locally denied, and retired-authority native effects through that owner. Redacted terminal output or logs suffice; update the PR body for automatic re-review, or ask a maintainer to comment @clawsweeper re-review.
Evidence reviewed	12 items	Verified introduced scope: The merge-base-to-head comparison contains the shared client, node runtime, sidecar layer, Linux consumer migration, and fixtures. The raw original head records parent 3caea39; current-main-only changes were not attributed to this branch. Main and release necessity check: Neither fetched main nor v2026.9.4 contains the crates directory. The supplied related PRs remain open prerequisites, not merged replacements. Actual authority-bearing bridge: Activation binds the runtime to a validated configuration and exact live channel. Admission and invocation wrap the product adapter with channel retirement checks, cancellation propagation, and complete-message size limits.
Findings	None	None.
Security	Needs attention	Native-effect rejection is not demonstrated: Admission and retirement cross into product adapter execution, but the process proof manually supplies decisions and results; recording-adapter tests do not establish rejection before actual native I/O.

How this fits together

The Gateway authorizes node commands; the Rust runtime receives them and applies local admission, execution limits, and cancellation before calling a product adapter. An authenticated sidecar channel supplies the bridge’s immutable configuration and retirement signal.

flowchart TD
  A[Gateway authorized commands] --> B[Shared Rust connection]
  B --> C[Bounded node runtime]
  D[Authenticated sidecar configuration] --> C
  C --> E[Local admission and live authority]
  E --> F[Native product adapter]
  F --> G[Bounded results to Gateway]

Loading

Decision needed

Question	Recommendation
Should the unpublished Rust crates and authenticated bridge be accepted for bounded in-repository incubation under the linked RFC?	Accept bounded incubation: Accept the unstable workspace scope after authority proof and prerequisite review, leaving publication and production adoption to later decisions.

Why: The RFC expressly reserves this ownership decision; implementation review cannot establish product acceptance.

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: Authority-chain proof required: the reported TCP child-process pass exercises authenticated framing and configuration, but bypasses SidecarRuntimeBridge. Show allowed, locally denied, and retired-authority native effects through that owner. Redacted terminal output or logs suffice; update the PR body for automatic re-review, or ask a maintainer to comment @clawsweeper re-review.
• Resolve security concern: Native-effect rejection is not demonstrated - Admission and retirement cross into product adapter execution, but the process proof manually supplies decisions and results; recording-adapter tests do not establish rejection before actual native I/O.
• Resolve merge risk (P1) - The supplied proof does not establish that the actual bridge prevents native effects for locally denied commands or authority retired during awaited adapter work.
• Resolve merge risk (P1) - Repository adoption of the unpublished Rust runtime remains an explicit, unresolved RFC decision; production IPC, bootstrap, packaging, and rollout are outside this patch.
• Complete next step (P2) - Resolve the RFC’s bounded incubation decision and provide the actual bridge’s allowed, denied, and retired-authority final-effect evidence before landing the stacked series.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

• [medium] Native-effect rejection is not demonstrated — crates/openclaw-node-host/tests/sidecar_process.rs:190

Agent review details

Security

Needs attention: No concrete exploit or supply-chain regression was established, but native-effect authority proof remains incomplete.

PR surface

Tests +3117, Docs +229, Other +13572. Total +16918 across 34 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	0	0	0	0
Tests	11	3117	0	+3117
Docs	1	229	0	+229
Config	0	0	0	0
Generated	0	0	0	0
Other	22	14177	605	+13572
Total	34	17523	605	+16918

Review metrics

Metric	Value	Why it matters
Production versus test growth	Production source +8,341 lines; tests and fixtures +7,111 lines	The cumulative stack justifies growth through reusable native execution; this count separates embedded Rust test modules and excludes manifests, lockfiles, and prose.

Merge-risk options

Maintainer options:

1. Complete bridge authority evidence (recommended)
   Show an allowed native effect and the absence of effects for local denial and retirement during awaited work through the actual bridge.
2. Retain the draft during incubation
   Pause landing while the bounded adoption decision and authority evidence remain unresolved.

Technical review

Best possible solution:

Keep one Gateway authority owner and one bounded Rust execution owner, with explicitly accepted incubation scope and demonstrated rejection before native effects.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR proposes a native-runtime capability rather than reporting an existing-behavior bug; no target code was executed during this read-only review.

Is this the best way to solve the issue?

Yes for the proposed bounded scope: the bridge composes the existing command runtime and leaves Gateway policy authoritative. Whether that scope belongs in the repository remains the RFC’s adoption decision.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 60c24d7192c1.

Labels

Label justifications:

• P3: This is bounded native-runtime incubation without an established urgent user regression.
• merge-risk: 🚨 security-boundary: The bridge carries admission and retirement authority to native adapters, while final-effect rejection remains unproven.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Authority-chain proof required: the reported TCP child-process pass exercises authenticated framing and configuration, but bypasses SidecarRuntimeBridge. Show allowed, locally denied, and retired-authority native effects through that owner. Redacted terminal output or logs suffice; update the PR body for automatic re-review, or ask a maintainer to comment @clawsweeper re-review.

Evidence

Security concerns:

• [medium] Native-effect rejection is not demonstrated — crates/openclaw-node-host/tests/sidecar_process.rs:190
  Admission and retirement cross into product adapter execution, but the process proof manually supplies decisions and results; recording-adapter tests do not establish rejection before actual native I/O.
  Confidence: 0.96

What I checked:

• Verified introduced scope: The merge-base-to-head comparison contains the shared client, node runtime, sidecar layer, Linux consumer migration, and fixtures. The raw original head records parent 3caea39; current-main-only changes were not attributed to this branch. (4e9753fa26d5)
• Main and release necessity check: Neither fetched main nor v2026.9.4 contains the crates directory. The supplied related PRs remain open prerequisites, not merged replacements. (crates/Cargo.toml:1, 60c24d7192c1)
• Actual authority-bearing bridge: Activation binds the runtime to a validated configuration and exact live channel. Admission and invocation wrap the product adapter with channel retirement checks, cancellation propagation, and complete-message size limits. (crates/openclaw-node-host/src/sidecar_runtime.rs:690, 4e9753fa26d5)
• Process proof exercises framing rather than bridge authority: The reported separate-process test uses real TCP and authenticated configuration, then manually constructs Allow and success messages. It never activates SidecarRuntimeBridge or observes a native effect denied by local policy or retired authority. (crates/openclaw-node-host/tests/sidecar_process.rs:190, 4e9753fa26d5)
• Useful supplemental authority coverage: Recording-adapter tests cover local denial without invocation; cancellation-adapter tests cover retirement and drop. These call the test-only evaluation entrypoint and observe counters or notifications rather than final native I/O. (crates/openclaw-node-host/src/sidecar_runtime.rs:1484, 4e9753fa26d5)
• Prior review continuity: The retained previous review requested allowed, locally denied, and retired-authority effects through the actual bridge. Current handler-entry fences preserve cancellation, session retirement, and duplex overflow rejection, but do not supply that proof. The older reviewed commit was unavailable locally, so no unchanged-code or late-finding attribution is made. (crates/openclaw-node-host/src/runtime.rs:698, 4e9753fa26d5)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add redacted evidence through the actual bridge showing an allowed native effect and rejection before I/O for local denial and authority retirement during awaited work.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (15 earlier review cycles; latest 8 shown)

• reviewed 2026-08-01T21:15:32.061Z sha 8d0a1b0 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-02T06:27:57.125Z sha 8d0a1b0 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-02T13:17:01.539Z sha 8d0a1b0 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-03T22:18:57.166Z sha 8d0a1b0 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-12T19:18:46.617Z sha 8ead00ab024b6c2cd76df7efb32eb633e6864f76 :: found issues before merge. :: [P1] Preserve the generated paramsJSON string contract
• reviewed 2026-08-12T20:17:39.029Z sha 71c1c8c :: found issues before merge. :: [P1] Rebase and regenerate the native protocol models
• reviewed 2026-09-15T23:24:24.617Z sha 68a7c7a :: needs real behavior proof before merge. :: none
• reviewed 2026-09-15T23:47:22.752Z sha bd7659f :: needs real behavior proof before merge. :: none

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35036062535
• Updated: 2026-09-15T23:32:15.681Z

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​thiserror@​2.0.19
	cargo/​futures-util@​0.3.33

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo writeable is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: crates/Cargo.lock → cargo/url@2.5.8 → cargo/writeable@0.6.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/writeable@0.6.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35037310822
• Updated: 2026-09-15T23:48:57.659Z

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35038530839
• Updated: 2026-09-16T00:06:14.117Z