Restore reviewed capabilities under MXC containment

[yikkuro (yikkuro)]

Summary

Integrates the reviewed MXC capability stack onto the latest main and adapts its fail-closed compatibility layer to OpenClaw 2026.10.2.

The change adds explicit Off, Full, and Limited (DACL) modes, compact containment controls, capability-disclosure consent, lifecycle attestation, and transition hardening. Upstream local-model and provider-selection behavior is preserved.

Containment modes

• Off: runs without MXC containment.
• Full: requires the exact MXC backend and validated readiness/attestation before capability release.
• Limited (DACL): uses the explicitly acknowledged DACL fallback with a reduced, clearly disclosed security boundary.

Capability release fails closed when policy generation, host preparation, readiness proof, attestation, pinned OpenClaw compatibility, or transition checks fail.

OpenClaw 2026.10.2 compatibility

The guarded compatibility layer is pinned to the exact OpenClaw 2026.10.2 Web, Cron, Hooks, and Canvas generated modules and hashes.

The integration adapts to the current 2026.10.2 APIs and implementation structure, including:

• Cron startup catch-up control through deferAgentWork
• Current scoped Cron handler signatures and response APIs
• Removal of obsolete duplicate schedule publication
• Current Hooks server and internal-hooks bundles
• Split Canvas tool and node-eligibility modules
• Canvas invocation results returned as { node, result }

Restored capabilities

• Web: contained public outbound access, subject to the Windows internetClient capability. This does not claim access to every LAN or private-network destination.
• WeChat: allowlisted text ingress and broker-approved local media. Empty MXC sender allowlists deny all ingress. Execution approvals can only be approved or denied locally in the desktop app. Agent-controlled remote HTTP(S) media is rejected before host network access.
• Canvas Phase 1: contained Canvas invocation through the native broker/host boundary with node eligibility and result handling adapted for OpenClaw 2026.10.2.

Paused and restored capabilities

• Cron: paused while required by the containment policy, restored without catch-up execution, and hardened across mode transitions.
• Hooks/Webhooks: paused under containment and restored without replay, with route and transition hardening.

Intentionally disabled capabilities

• Native Gateway filesystem tools
• Browser automation
• MCP
• Screen, Camera, Location, TTS, and STT
• Default memory slot
• Remote WeChat approval

The excluded remote-approval experiment is not present: there is no phone/plain-text approval flow, approval pipe/token contract, plugin interceptor, audit path, or unavailable Settings card. WeChat-triggered execution decisions remain local-desktop-only.

Security invariants

• Fail-closed lifecycle, readiness proof, and attestation
• Exact OpenClaw 2026.10.2 generated-module hashes and guarded patch points
• Native host enforcement for system and Canvas capabilities
• Native Gateway filesystem denial
• Explicit sender authorization for MXC WeChat ingress
• Empty MXC sender allowlists deny all ingress
• Local broker validation for WeChat media
• Agent-controlled remote media URLs are rejected before host network access
• Execution approval decisions remain local to the PC desktop
• No Cron catch-up and no Hooks/Webhooks replay after restoration
• Capability disclosure and explicit Limited-mode acknowledgement

Explicit exclusions

The following remote WeChat approval experiment commits are intentionally excluded:

• dbbc56bd135087ac5ea36dc2aafea5778967502e
• 77fccd34b570d9a2790373246dd36071829bcf10
• cf2f3ce7aae064cb0633ce693c937b30c75bd396
• fa2231aa7bdd2602f30026f0e9803c6f8cc400bd

All four are non-ancestors of this integration and none is patch-equivalent to a commit in this branch. Searches confirmed the absence of the experiment's remote-approval runtime/test files, server/interceptor, pipe and token names, environment contract, Settings keys and copy, plugin prompt contract, and audit implementation. The historical design document already present on main is unchanged by this branch.

Validation

• Desktop suite: 64 files passed, 4 skipped; 1,455 tests passed, 12 skipped
• Renderer suite: 40 files and 498 tests passed
• Official OpenClaw 2026.10.2 compatibility suite: 41/41 passed
• WeChat MXC policy: 7/7 passed
• Staged WeChat runtime compatibility: 5/5 passed
• Windows Node host: 119/119 passed
• WeChat lint: zero errors (seven existing warnings in untouched files)
• Diff-scoped desktop and renderer ESLint: zero errors
• Desktop and renderer production build: passed
• Windows Node and Canvas x64 resource preparation: passed
• Full release packaging produced:
  • microclaw-portable.zip — 307.01 MB
  • MicroClawInstaller.zip — 331.36 MB
  • MicroClawSetup.exe — 327.33 MB
• Remote-approval exclusion and commit-ancestry checks: passed
• Worktree, submodule, generated-artifact, and git diff --check checks: clean

The full desktop lint command retains two unrelated errors already present unchanged on origin/main: the control-character regular expression in chat-attachments.ts and an unused helper in openclaw-upgrade-recovery.ts.

Known environmental limitations

• The exact Full MXC backend was unavailable on this machine; see [Blocker] Provision an exact-containment backend before enabling MXC #228. Full-mode policy, readiness, compatibility, and native-host behavior are covered by automated tests, while Limited mode was the locally available backend.
• The development renderer-port issue remains tracked in Use one negotiated renderer port for Vite and Electron dev startup #231; production renderer and release builds pass.
• The repository-pinned root Prettier dependency could not be retrieved because registry TLS/dependency availability failed. Diff checks and package-local ESLint completed successfully.
• PowerShell Compress-Archive exhausted memory while creating the large release ZIP on this machine. The final validation reran the same release pipeline with tar.exe -a for archive creation only; all seven stages and final artifacts completed successfully.