Add fail-closed Windows Node + MXC sandbox

[yikkuro (yikkuro)]

Summary

Closes #202.

This experimental Windows-only path packages a pinned, headless Windows Node capability host alongside MicroClaw and routes agent-controlled system.run requests through the managed OpenClaw Gateway into MXC (MxcCommandRunner -> DirectAppContainerExecutor -> bundled wxc-exec.exe). MicroClaw's Electron UI and Gateway remain outside MXC; only node command payloads enter the container.

Security model

• Fails closed with strict host fallback disabled whenever the exact node disconnects, pairing or command declarations drift, the Gateway tool policy is not effective, readiness fails, or the activation lease is missing or stale.
• Removes Gateway-native filesystem/process bypass tools for the MXC agent route and binds execution to one explicitly selected local Windows node.
• Canonicalizes CWD against a global RO/RW folder policy, rejects non-local, sensitive, and reparse-point paths, and includes CWD semantics in command approval identity.
• Preserves one visible prompt for ordinary commands. One-use Gateway proofs bind the exact node, executable/hash, argv, CWD, declarations, agent/session, policy fingerprint, and Gateway generation.
• Supports revocable durable approvals scoped to the same exact command, CWD, declarations, policy, agent, and session.
• Uses a separate short-lived, one-use HMAC authorization contract for only the fixed internal hostname and PowerShell readiness probes. These probes never enter the renderer approval queue, while an identical agent-originated command still requires normal attended approval.

Lifecycle and readiness

Remembered MXC selection is restored at startup. When enabled, chat ingress remains blocked on the loading screen while one serialized transition:

1. starts a locked Gateway generation;
2. connects and attests the exact bundled node and CWD policy;
3. runs contained hostname, PowerShell, and protected-CWD checks;
4. starts an active generation and repeats readiness checks;
5. verifies effective Gateway tools and policy;
6. issues a generation-bound activation lease; and
7. releases ingress only after final attestation.

Toggling MXC on or off follows the same serialized, fail-closed loading transition. Restarts, disconnects, policy/tool drift, invalid probes, or stale leases revoke readiness and keep ingress closed. The cold compatibility-preload readiness budget is finite but allows up to five minutes for known slow Windows starts.

User experience

The Security page keeps the MXC toggle, concise Protected / Starting / Action required / Off state, actionable errors, global RO/RW folders, and remembered-command revocation visible. Node identity, lifecycle/generation, Gateway policy, activation lease, containment tier, contracts, fingerprints, attestation, declared commands, pairing, and smoke evidence are grouped in an accessible Technical details disclosure that starts collapsed.

Runtime and provenance

• Reuses the upstream openclaw/openclaw-windows-node baseline at fc9add75eda78daf548d80a55ffb64e63b159961 rather than copying its large subsystems.
• Vendors the pinned MXC 0.7 runtime with provenance/integrity metadata.
• Includes only a target-specific host-preparation helper; it does not silently perform elevation or unrelated host-wide setup.

Validation

Completed focused validation across the Electron main process, renderer, compatibility/proof boundary, and Windows host:

• Desktop MXC suites: 121 passing.
• Renderer MXC suites: 19 passing; latest Security UX/i18n suite: 27 passing.
• Windows host suites: 66 passing.
• Cross-language proof/prompt subset: 10 passing.
• Live readiness plan-shape regression: 12 passing.
• Desktop and renderer TypeScript/build validation passed.
• Live remembered-MXC startup completed one locked/active transition with four internal probes, zero startup permission dialogs, exact node/policy/lease healthy, and chat ingress released.
• A normal agent command was separately verified to produce one attended approval prompt.

No full installer packaging run was performed after the latest renderer-only Security UX changes.

Manual testing

1. Start the normal desktop dev runtime with remembered MXC enabled; confirm the loading page remains fail-closed until the automatic locked/active checks complete with no readiness approval dialog.
2. Open Settings -> Security; confirm the state is Protected, folder and remembered-command controls are visible, and Technical details starts collapsed and can be toggled by keyboard.
3. Send a normal command such as hostname; confirm exactly one attended prompt appears and deny or allow it explicitly.
4. Exercise Allow always, rerun the exact command, then revoke that remembered approval from Security settings.
5. Stage and apply an RO/RW folder change; confirm ingress locks during re-attestation and only reopens after the route returns to Protected.
6. Toggle MXC off and on; confirm both transitions use the loading gate and never expose an old or unsandboxed route.

Known constraints

This is an experimental Windows-only feature, not a claim of a fully mature production security boundary. MXC 0.7 is preview technology. Machines limited to appcontainer-dacl are accepted but prominently reported as degraded containment, and PowerShell currently requires allowWindowsUi=true as an MXC compatibility relaxation without enabling screen/input or other UI capabilities. Cold compatibility preload and Gateway startup can take several minutes.