Add Gateway system.run MXC runtime E2E proof

[TheAngryPit]

Tracking issue: #784
Stacked after: #786

Summary

This PR adds focused runtime proof for the real Gateway path:

Gateway -> node.invoke -> Windows node -> system.run -> MXC process containment.

It is intentionally stacked after #786. A focused compare for the PR3 delta is:

TheAngryPit/openclaw-windows-node@feature/mxc-26200-sdk-0-7-validation...feature/gateway-system-run-mxc-e2e

What Changed

• Adds focused Gateway MXC E2E coverage to the setup suite.
• Moves the MXC proof into its own gated E2E MXC Setup collection so non-MXC runners skip before heavy setup.
• Probes the discovered wxc-exec.exe path before deciding whether to skip, avoiding false skips when the test output itself lacks the MXC helper but the built app/SDK path has it.
• Provisions a fresh WSL Gateway, starts an isolated tray instance, prepares local exec approval, invokes system.run through openclaw gateway call node.invoke, and verifies MXC diagnostics in the tray log.
• Adds a denied-write proof that verifies MXC containment prevents writing into the tray data/settings directory.
• Asserts gateway.nodes.allowCommands includes system.run, system.run.prepare, and system.which before invoking the proof path.
• Documents the focused runtime proof command and required evidence markers in docs/WINDOWS_NODE_TESTING.md.

Validation

Final local validation for PR3 head 020d861e, stacked on PR2 head 442de02a, on Windows build 26200.8737:

• .\build.ps1 passed without setting $env:OS.
• Inherited/focused Shared MXC/system.run coverage passed: 141 passed, 0 failed, 0 skipped.
• Inherited/focused Tray settings/installer coverage passed: 28 passed, 0 failed, 0 skipped.
• dotnet build tests\OpenClaw.E2ETests\OpenClaw.E2ETests.csproj -c Debug -r win-x64 --no-restore -p:UseSharedCompilation=false passed with 0 warnings, 0 errors.
• OPENCLAW_RUN_E2E=1 dotnet test tests\OpenClaw.E2ETests\OpenClaw.E2ETests.csproj --no-build -c Debug -r win-x64 --filter "FullyQualifiedName~OpenClaw.E2ETests.Setup.MxcSetupAndConnectTests" --logger "trx;LogFileName=OpenClaw.E2ETests.pr3-current-26200-8737.trx" passed: 2 passed, 0 failed, 0 skipped.

Installed-App Runtime Proof

The top-of-stack app was built, installed, launched, and tested through the real installed Gateway/Windows Node path on the same Windows build:

• Installed executable: %LOCALAPPDATA%\OpenClawTray\OpenClaw.Tray.WinUI.exe.
• Installed product version includes Sha.020d861eb50d605afa400aa16d89e240c9c85c5d.
• Gateway CLI environment: OpenClawGateway WSL distro, OpenClaw 2026.6.10.
• Connected Windows node version: 0.6.4-tap-pr3-gateway-mxc-e2e-on-pr2-770522b.1.
• Node command count: 19.
• system.run: available.

Success proof:

• Marker: OPENCLAW_REAL_APP_MXC_26200_8737_OK_f636bbaf.
• Result: exitCode=0, timedOut=false, marker present in stdout.
• Tray log: executor=mxc-direct-appc, contained=True, wxcExec=<set>, version=0.7.0-alpha, envKeys=[], network={defaultPolicy=block,enforcementMode=capabilities}, final containment=mxc.

Denied-write proof:

• Marker: OPENCLAW_REAL_APP_MXC_26200_8737_DENIED_d1d8822f.
• Command attempted to write under %LOCALAPPDATA%\OpenClawTray.
• Result: exitCode=1, timedOut=false, marker absent from stdout, stderrLen=42.
• Target file was not created.
• Tray log: executor=mxc-direct-appc, contained=True, final containment=mxc, stdoutChars=0, stderrChars=42.

Scope Limits

• Broad full-suite green is not claimed.
• Full profile migration proof is not claimed.
• Local external autoreview was attempted for this stack earlier, but the local approval layer blocked external disclosure of local branch code; it was not bypassed, so this PR does not claim clean external autoreview proof.

Refs #784

[clawsweeper]

Codex review: found issues before merge. Reviewed June 26, 2026, 7:30 AM ET / 11:30 UTC.

Summary
The branch adds gated Gateway-to-Windows-node system.run MXC E2E success and denied-write coverage, updates setup-connect CI/docs, and changes MXC config generation to omit backend deniedPaths while preserving local deny-list filtering.

Reproducibility: yes. for the docs mismatch by source inspection: the documented command filters only the success test while the same section expects denied-write proof markers. I did not run Windows E2E from this read-only Linux checkout.

Review metrics: 3 noteworthy metrics.

• Changed files: 12 files, +790/-118. The PR spans CI, docs, E2E tests, and MXC config generation, so review must cover both proof automation and sandbox behavior.
• MXC proof tests: 2 added. The branch adds both positive Gateway system.run and denied-write containment E2E coverage.
• Workflow touched: 1 workflow changed. The setup-connect shard timeout and TRX parsing become part of required CI behavior after merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #784
Summary: This PR is the PR3 proof candidate for the open MXC validation tracking issue; merged prerequisite PRs cover adjacent pieces but do not supersede this Gateway runtime proof.

Members:

• canonical: Track Windows 25H2 build 26200.8728 MXC validation #784 - The open tracking issue explicitly says PR3 is the real Gateway runtime proof slice and should remain until maintainers decide the stack and policy.
• partial_overlap: Validate MXC SDK 0.7.0 on Windows build 26200.8728 #786 - The merged PR2 implemented the MXC SDK/runtime-policy slice that this PR proves through Gateway, but it intentionally left full Gateway installed-app proof to this PR.
• adjacent_distinct: Fix locale-sensitive Windows tests and technical token formatting #785 - The merged PR1 handled locale-safe tests and formatting baseline work, not the MXC runtime proof.
• adjacent_distinct: Fix Windows build detection without OS env var #822 - The merged build detection fix supports the validation environment but does not cover the Gateway MXC proof behavior.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Correct the docs filter so the manual command runs both MXC proof methods.
• [P2] Have a maintainer explicitly accept or reject the backend deniedPaths omission before merge.

Risk before merge

• [P1] Merging changes the sandbox boundary by omitting backend filesystem.deniedPaths; exact-head proof shows denied-write containment, but maintainers still need to accept relying on AppContainer default-deny plus local grant filtering.
• [P2] The setup-connect CI shard now treats MXC proof tests as must-be-reported passed or skipped and extends its timeout; maintainers should explicitly accept that unsupported runners can skip while supported hosts provide the real proof.
• [P1] The manual docs command currently runs only the success proof while the surrounding text expects denied-write markers too.

Maintainer options:

1. Accept the AppContainer-default-deny model
   A maintainer can merge after explicitly accepting that omitted backend deniedPaths is covered by local grant filtering plus AppContainer default deny, based on the exact-head installed proof.
2. Require a backend-deny contract first
   If maintainers want explicit backend deny semantics, pause merge until the PR restores a supported backend mechanism or adds stronger vendor-backed proof for the omission.
3. Accept the CI proof shape
   A maintainer can accept the workflow path where unsupported hosts report explicit MXC skips while supported hosts run the two proof tests.

Next step before merge

• [P2] A maintainer needs to decide the security-boundary and CI-proof contract; automation can fix the docs mismatch, but it cannot accept the sandbox model for the project.

Security
Needs attention: The patch has strong exact-head proof, but it intentionally changes the sandbox enforcement model by omitting backend deniedPaths, so maintainer security acceptance is still needed.

Review findings

• [P3] Run both MXC proof tests from the documented command — docs/WINDOWS_NODE_TESTING.md:143

Review details

Best possible solution:

Land this after a maintainer explicitly accepts the MXC security model and CI proof contract, with the docs filter corrected to run both proof methods.

Do we have a high-confidence way to reproduce the issue?

Yes for the docs mismatch by source inspection: the documented command filters only the success test while the same section expects denied-write proof markers. I did not run Windows E2E from this read-only Linux checkout.

Is this the best way to solve the issue?

Yes for the gated E2E proof shape; it is a focused way to preserve the real Gateway path. The runtime deniedPaths omission is technically supported by exact-head proof, but final acceptance is a maintainer security-model decision.

Full review comments:

• [P3] Run both MXC proof tests from the documented command — docs/WINDOWS_NODE_TESTING.md:143
  The section says this command verifies both allowed execution and denied writes, and the expected markers include the denied-write proof, but the filter only runs RealGateway_SystemRun_ExecutesThroughWindowsNodeMxcSandbox. A reader following the docs will not produce the denied-write evidence unless the filter targets the whole MxcSetupAndConnectTests class or includes both method names.
  Confidence: 0.88

Overall correctness: patch is correct
Overall confidence: 0.84

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 6c56a83f43a6.

Label changes

Label changes:

• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (live_output): The PR comments include exact-head installed-app proof for Gateway -> Windows Node -> system.run -> MXC success and denied-write containment, plus a broader 24 passed / 0 failed live matrix.
• remove status: 👀 ready for maintainer look: Current PR status label is status: ⏳ waiting on author.

Label justifications:

• P2: This is normal-priority MXC runtime proof and security-boundary validation work with limited blast radius but real maintainer review value.
• merge-risk: 🚨 security-boundary: The PR changes how sensitive denied paths are enforced by omitting backend deniedPaths and relying on AppContainer default deny plus local filtering.
• merge-risk: 🚨 automation: The PR changes the setup-connect E2E workflow timeout, filter, and TRX proof parsing behavior.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (live_output): The PR comments include exact-head installed-app proof for Gateway -> Windows Node -> system.run -> MXC success and denied-write containment, plus a broader 24 passed / 0 failed live matrix.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR comments include exact-head installed-app proof for Gateway -> Windows Node -> system.run -> MXC success and denied-write containment, plus a broader 24 passed / 0 failed live matrix.

Evidence reviewed

Security concerns:

• [medium] Accept deniedPaths omission security boundary — src/OpenClaw.Shared/Mxc/MxcConfigBuilder.cs:188
MxcConfigBuilder now sends no backend deniedPaths because wxc-exec rejects that field; the PR proves a denied tray-data write is blocked, but maintainers should explicitly accept AppContainer default-deny plus local grant filtering as the permanent boundary.
  Confidence: 0.82

What I checked:

• Repository policy read: AGENTS.md was read fully; its Gateway/MCP context and validation expectations were applied, while the ClawSweeper read-only contract prevented build/test execution. (AGENTS.md:1, 6c56a83f43a6)
• Current main lacks this proof layer: A current-main search found no MxcSetupAndConnectTests, OPENCLAW_GATEWAY_SYSTEM_RUN_MXC_OK, or denied-write E2E proof symbols, so the central PR3 test coverage is not already implemented on main. (6c56a83f43a6)
• PR head adds the focused Gateway MXC proof tests: The PR head defines two [MxcE2EFact] tests for real Gateway node.invoke -> system.run success and denied-write containment, with allowCommands assertions and tray-log MXC diagnostics. (tests/OpenClaw.E2ETests/Setup/MxcSetupAndConnectTests.cs:26, 5d695ab060ec)
• PR head changes the MXC security boundary: The latest branch keeps denied paths for local allow-list filtering but sets backend DeniedPaths to null because Windows MXC 0.7 rejects filesystem.deniedPaths; that is a maintainer security-model choice, not only test coverage. (src/OpenClaw.Shared/Mxc/MxcConfigBuilder.cs:108, 5d695ab060ec)
• PR head changes CI proof behavior: The setup-connect E2E shard timeout is increased to 45 minutes, includes both normal setup/connect and MXC proof classes, and fails if each MXC proof test is not reported as passed or explicitly skipped. (.github/workflows/ci.yml:292, 5d695ab060ec)
• Exact-head real behavior proof is present: Recent PR comments report exact head 5d695ab060ec1e2e960ce502acfaefba1beed1ae installed-app proof through Gateway -> Windows Node -> system.run -> MXC, including success, denied-write non-creation, and a broader 24 passed / 0 failed live matrix. (5d695ab060ec)

Likely related people:

• TheAngryPit: Authored the merged MXC SDK 0.7/runtime-policy slice on current main, including the denied-path filtering behavior this PR now adjusts. (role: recent MXC runtime contributor; confidence: high; commits: ce3294d40624, 0faa8217de00; files: src/OpenClaw.Shared/Mxc/MxcConfigBuilder.cs, tests/OpenClaw.Shared.Tests/Mxc/MxcConfigBuilderTests.cs)
• shanselman: Has recent main history around sandbox toggle/MXC support and authored the PR-head commits that changed setup-connect timeout and omitted backend deniedPaths. (role: recent adjacent contributor; confidence: high; commits: cd02defd9942, f52b829a6f3c, 4f34d1087400; files: src/OpenClaw.Shared/Mxc/MxcConfigBuilder.cs, .github/workflows/ci.yml)
• Barbara Kudiess: Recent history shows she added AppContainer sandboxing and direct wxc-exec work that underpins the current system.run MXC path. (role: MXC feature introducer and adjacent owner; confidence: medium; commits: 62533e2901bd, cf611d4ab59f, 9f4d23804122; files: src/OpenClaw.Shared/Mxc/MxcConfigBuilder.cs, src/OpenClaw.Shared/Mxc/MxcAvailability.cs, tests/OpenClaw.Shared.Tests/Mxc/MxcConfigBuilderTests.cs)
• Vincent Koc: Current-main blame shows the E2E setup fixture and much of the older MXC config builder scaffold date to his earlier commit. (role: E2E fixture and original scaffold contributor; confidence: medium; commits: d392f7d4ea0d; files: tests/OpenClaw.E2ETests/Setup/E2ESetupFixture.cs, src/OpenClaw.Shared/Mxc/MxcConfigBuilder.cs)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8f55454a5e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[TheAngryPit]

@clawsweeper re-review

Addressed the review stack in 1392d01.

• Preserved the ClawSweeper-requested compatibility fallback path by default: SystemRunSandboxEnabled=true still attempts MXC first and falls back to host execution when MXC is unavailable.
• Added explicit strict opt-in: SystemRunBlockHostFallbackWhenMxcUnavailable=false by default. When enabled, unavailable/runtime-lost MXC denies instead of using host fallback.
• Closed the custom-env bypass class:
  equest.Env is rejected before any MXC-unavailable fallback while sandboxing remains enabled.
• Fixed pwsh launch resolution: shell="pwsh" resolves to an absolute pwsh.exe from PATH before process.env is cleared.
• Gated the MXC-only E2E proof with MxcE2EFact so normal E2E shards skip when MXC is unavailable or wxc-exec.exe is not resolvable.

Autoreview note: scoped autoreview was rerun on a native WSL clean copy of only this PR diff. It reports one remaining P1 preferring fail-closed-by-default for MXC unavailable. I am intentionally not taking that change because it conflicts with the ClawSweeper request to preserve the fallback path; the strict setting above is the bounded opt-in fail-closed path.

Proof run:

• dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore --filter "FullyQualifiedNameMxcCommandRunner|FullyQualifiedNameMxcConfigBuilder" -> passed 62, skipped 4, total 66.
• dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore --filter "FullyQualifiedName~SettingsRoundTripTests" -> passed 16.
• dotnet build .\src\OpenClaw.Tray.WinUI\OpenClaw.Tray.WinUI.csproj --no-restore --configuration Debug --runtime win-x64 -> succeeded.
• MXC E2E gate off -> skipped 1.
• MXC real E2E on Windows 10.0.26200.8728 -> passed 1. Latest run 52cd7959 logged OPENCLAW_GATEWAY_SYSTEM_RUN_MXC_OK, �xecutor=mxc-direct-appc, contained=True, systemRunBlockHostFallbackWhenMxcUnavailable=false, �xitCode=0, and containment=mxc.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[TheAngryPit]

Status update after latest push (1763f84):

• Fixed the MXC E2E gating issue: the MXC-only proof now runs in its own E2E MXC Setup collection with a fixture-level MXC gate, so method-level skip is no longer the only guard before heavy setup.
• Updated the CI setup-connect shard filter to include both normal setup/connect tests and MxcSetupAndConnectTests, so the MXC proof still runs when available.
• Local CI-equivalent proof after building Tray/MXC output: setup-connect+MXC shard executed 16/passed 16/failed 0/skipped 0.
• Runtime diagnostic proof from the TRX: OPENCLAW_GATEWAY_SYSTEM_RUN_MXC_OK, �xecutor=mxc-direct-appc, contained=True, shell=cmd, �xitCode=0, containment=mxc, stderrChars=0.
• Autoreview rerun after the gating fix: clean, no accepted/actionable findings.
• PR2 was also updated/resolved so this stack now composes cleanly with the MXC SDK 0.7 support branch.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[TheAngryPit]

@clawsweeper re-review

Status update after latest push cad71667:

• Reconciled PR3 with the current PR2 head 0c1fd1c2; git diff local-pr2/feature-mxc-26200-sdk-0-7-validation..HEAD is now limited to workflow/docs/E2E files.
• PR3 now inherits PR2's fail-closed default: SystemRunSandboxEnabled=true blocks when MXC is unavailable unless a versioned settings file explicitly opts into fallback.
• The PR3-only behavior remains the Gateway runtime proof and its E2E gating/allowlist assertions.

Final-head validation on Windows build 26200.8728:

• dotnet test tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --filter "FullyQualifiedName~MxcCommandRunnerTests|FullyQualifiedName~MxcConfigBuilderTests" --no-restore --verbosity minimal -> 66 passed, 0 failed.
• dotnet test tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --filter "FullyQualifiedName~SettingsRoundTripTests" --no-restore --verbosity minimal -> 18 passed, 0 failed.
• dotnet test tests\OpenClaw.E2ETests\OpenClaw.E2ETests.csproj --no-restore --list-tests --verbosity minimal -> compiled/listed the E2E suite including MxcSetupAndConnectTests.RealGateway_SystemRun_ExecutesThroughWindowsNodeMxcSandbox.
• dotnet restore src\OpenClaw.Tray.WinUI\OpenClaw.Tray.WinUI.csproj -r win-x64 + dotnet build src\OpenClaw.Tray.WinUI\OpenClaw.Tray.WinUI.csproj --no-restore --configuration Debug --runtime win-x64 --verbosity minimal -> succeeded with 0 warnings, 0 errors.
• Real MXC Gateway E2E on final head:
  • $env:OPENCLAW_REPO_ROOT=(Get-Location).Path
  • $env:OPENCLAW_RUN_E2E="1"
  • dotnet test .\tests\OpenClaw.E2ETests\OpenClaw.E2ETests.csproj --no-restore --configuration Debug --filter "FullyQualifiedName~RealGateway_SystemRun_ExecutesThroughWindowsNodeMxcSandbox" --logger "trx;LogFileName=pr3-mxc-e2e-final.trx" --verbosity minimal
  • Result: 1 passed, 0 failed, 0 skipped.
• TRX proof markers: gateway.nodes.allowCommands includes system.run/system.run.prepare/system.which, OPENCLAW_GATEWAY_SYSTEM_RUN_MXC_OK, exitCode=0, executor=mxc-direct-appc, contained=True, shell=cmd, systemRunBlockHostFallbackWhenMxcUnavailable=true, containment=mxc, stderrChars=0.
• openclaw-autoreview --mode branch --base local-pr2/feature-mxc-26200-sdk-0-7-validation --engine codex --model gpt-5.5 --thinking high -> clean, no accepted/actionable findings, overall patch is correct.

The PR body was updated with this final-head proof and current stack contract.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[TheAngryPit]

@shanselman thanks for the follow-up on the MXC deniedPaths behavior. I pulled the current PR head and validated the exact head after your change.

Current PR3 head validated: 5d695ab060ec1e2e960ce502acfaefba1beed1ae

Local host:

• Windows display version: 25H2
• Build: 26200.8737
• Edition: Professional
• Installation type: Client
• Gateway CLI/runtime: OpenClaw 2026.6.10 in the local OpenClawGateway WSL distro

Validation run on that exact head:

• git diff --check origin/main..HEAD passed.
• ./build.ps1 passed across Shared, Cli, WinNodeCli, SetupEngine, and WinUI.
• Focused Shared/MXC tests passed: 111 passed / 0 failed / 0 skipped.
• dotnet build ./tests/OpenClaw.E2ETests/OpenClaw.E2ETests.csproj -c Debug -r win-x64 --no-restore -p:UseSharedCompilation=false passed with 0 warnings and 0 errors.
• Focused PR3 MXC E2E passed: 2 passed / 0 failed / 0 skipped.

Installed-app proof on the same head:

• Built the x64 Release installer from 5d695ab.
• Installed and launched it locally.
• Installed product version included Sha.5d695ab060ec1e2e960ce502acfaefba1beed1ae.
• Gateway state after install: pending=0, paired=1.
• Connected node version: 0.6.4-tap-pr3-current-head-5d695ab-runtime.1.
• Node capabilities available: browser, canvas, device, screen, system.

Runtime proof through the real path:

• Path exercised: Gateway -> node.invoke -> Windows Node -> system.run -> MXC.
• Positive command marker: OPENCLAW_PR3_5D695_LIVE_OK.
• Positive result: exitCode=0, timedOut=false, marker present in stdout.
• Tray log for the same invocation reported executor=mxc-direct-appc, contained=True, and containment=mxc.

Denied-write proof after the deniedPaths backend omission:

• Attempted to write under the tray local app-data area using the installed app.
• Result: exitCode=1, stderr="Access is denied.", timedOut=false.
• Target file was not created: fileExistsAfter=False.
• Tray log for the same invocation again reported executor=mxc-direct-appc, contained=True, and containment=mxc.

Additional operational smokes after install:

• device.status returned ok=true for ANGRYDESKTOP.
• system.which resolved cmd, Windows PowerShell, and pwsh.
• canvas.caps returned ok=true with the same current renderer state as before (renderer=none, navigation/A2UI available).

Safe claim: the current 5d695ab head is build/test/E2E proven and installed-app runtime proven for the PR3 scope, including the MXC deniedPaths omission path. I am not claiming unrelated full-product coverage such as camera/location/STT/TTS/MCP server behavior here.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[TheAngryPit]

Follow-up installed-app runtime proof on the same current PR head.

No code changes were made after the previous validation comment. I kept the installed build from the exact PR head and ran a broader live Companion/Windows Node feature matrix to verify the app is operational beyond the PR3-specific system.run MXC path.

Validated head:

• PR head: 5d695ab060ec1e2e960ce502acfaefba1beed1ae
• Installed Windows app version: 0.6.4-tap-pr3-current-head-5d695ab-runtime.1
• Windows display version: 25H2
• Windows build: 26200.8737
• Edition / installation type: Professional / Client
• Gateway runtime: OpenClaw 2026.6.10

Full installed-app live matrix:

• Result: 24 passed / 0 failed
• Path exercised for node commands: Gateway -> node.invoke -> installed Windows Node -> capability implementation.

Commands/capabilities covered:

• device.info
• device.status
• system.notify
• system.which
• system.run.prepare
• system.run positive MXC path
• system.run denied-write MXC containment path
• browser.proxy
• screen.snapshot
• screen.record
• canvas.present
• canvas.eval
• canvas.snapshot
• canvas.navigate
• canvas.hide
• canvas.a2ui.reset
• canvas.a2ui.push
• canvas.caps
• canvas.a2ui.dump
• canvas.a2ui.pushJSONL

MXC-specific runtime proof from the same matrix:

• Positive marker: OPENCLAW_MXC_FULL_APP_OK
• Positive system.run: exitCode=0, timedOut=false, marker present in stdout.
• Denied-write system.run: returned non-zero (exitCode=1), timedOut=false, and the denied target file was not created.
• This was exercised through the installed app and real Gateway path, not only through unit tests.

Browser/canvas/screen notes:

• browser.proxy passed after starting the local browser-control host on the documented Gateway + 2 port (127.0.0.1:18791) and using the current /tabs endpoint.
• screen.snapshot and screen.record both returned image/video payload metadata successfully.
• Canvas HTML, JavaScript eval, snapshot, navigation, hide, and A2UI push/dump/update/reset all passed through the installed app.

Safe claim:

• The current PR head is build/test/E2E proven for the PR3 MXC scope and now also full installed-app runtime proven for the Windows Node advertised command surface exercised above.
• I am still not claiming unrelated surfaces that are outside this PR/runtime matrix, such as camera, location, STT/TTS, full profile migration, or MCP server behavior.

@clawsweeper re-review