Virtualize and harden native chat timeline

.agents/skills/openclaw-proof-validation/SKILL.md

@@ -0,0 +1,80 @@
+---
+name: openclaw-proof-validation
+description: "Plan and collect OpenClaw Windows validation/proof: tests, rubber-duck review, UI evidence, MCP output, and gateway runtime proof."
+---
+
+# OpenClaw Proof and Validation
+
+Use for changes that affect tray UX, Settings, onboarding, chat/canvas, Command Center, Windows node capabilities, local MCP, gateway connection/pairing, permissions, diagnostics, or agent-facing instructions.
+
+## Rules
+
+- Required automated/focused tests are mandatory. Do not ask to skip them.
+- Prefer isolated tray data so proof does not mutate `%APPDATA%\OpenClawTray`.
+- Computer-use is usually a batched closeout proof pass, not a continuous dev-loop tool. Mid-development use is fine when explicitly requested or needed to unblock work; ask first whether to run it or provide manual screenshot/output steps.
+- Local MCP is part of every Windows node command contract: command discovery and invocation must work through `winnode` or raw MCP JSON-RPC.
+- Rubber-duck review is required before PR publication for non-trivial UI/MCP/node-command/setup/pairing/security/permissions/diagnostics work; it is also useful mid-development when extra design/testing validation is requested.
+- Report blockers explicitly. Do not turn missing UI, MCP, gateway, camera, screen, or permission proof into success-shaped wording.
+
+## Required validation
+
+```powershell
+$env:OPENCLAW_REPO_ROOT = (Get-Location).Path
+.\build.ps1
+dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore
+dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore
+```
+
+Fresh worktrees may need a first run without `--no-restore`, or a project build first, so tests do not no-op before `bin\` exists.
+
+For `winnode`, command descriptions, or new/renamed node commands, also run:
+
+```powershell
+dotnet test .\tests\OpenClaw.WinNode.Cli.Tests\OpenClaw.WinNode.Cli.Tests.csproj --no-restore
+```
+
+## Proof checklist
+
+| Surface | Proof to collect |
+|---|---|
+| UI / WinUI | Launch `.\run-app-local.ps1 -Isolated`, exercise the changed path with computer-use or developer-provided screenshots/output, and include visible evidence or blocker. If the developer captures manually, provide exact steps and confirm screenshot/artifact links resolve after updating the PR body. |
+| Local MCP | Enable **Local MCP Server**, run `winnode --list-tools`, then invoke the changed command with `winnode --command <name> --params '<json-object>'`. |
+| Raw MCP HTTP | For protocol/server-shape changes, paste JSON-RPC `tools/list` and `tools/call` responses from `http://127.0.0.1:8765/`. |
+| Gateway path | When relevant and available, prove `openclaw nodes invoke --command <name> --params '<json-object>'`; otherwise state the gateway blocker. |
+| Rubber-duck | Ask a rubber-duck reviewer to inspect the final implementation/proof plan; verify any finding before changing code. |
+
+For isolated tray runs, copy the data directory printed by `run-app-local.ps1 -Isolated` and set it before MCP proof commands:
+
+```powershell
+$env:OPENCLAW_TRAY_DATA_DIR = '<isolated-data-dir-from-run-app-local>'
+```
+
+Raw token lookup:
+
+```powershell
+$tokenPath = if ($env:OPENCLAW_TRAY_DATA_DIR) {
+    Join-Path $env:OPENCLAW_TRAY_DATA_DIR 'mcp-token.txt'
+} else {
+    Join-Path $env:APPDATA 'OpenClawTray\mcp-token.txt'
+}
+$token = Get-Content $tokenPath -Raw
+```
+
+## New Windows node command checklist
+
+1. Register the command in the same `INodeCapability` path used by the gateway node.
+2. Add/update `McpToolBridge.CommandDescriptions`.
+3. Update `src/OpenClaw.WinNode.Cli/skill.md` with input shape, output shape, side effects, permissions, and examples.
+4. Add/update capability, MCP bridge, `winnode`, and UI/gateway tests as applicable.
+5. Prove discovery and invocation with `winnode` or raw MCP JSON-RPC.
+6. Prove the gateway path when the behavior is gateway-mediated and a gateway is available.
+
+## PR proof package
+
+Before publishing or updating a PR, collect:
+
+1. `## Validation` with exact commands and pass/fail counts.
+2. `## Real behavior proof` with current-head after-change evidence that directly shows the changed behavior: copied live output, screenshot/video, developer-provided screenshot, copied UI diagnostics, `winnode`, raw MCP JSON-RPC, gateway invoke output, redacted runtime log, or linked artifact. For UI changes, prefer screenshots/video of the active changed state, not only adjacent or empty UI.
+3. PR body proof must stay in sync with current behavior: remove stale screenshots/claims after design changes and verify embedded image/artifact links resolve.
+4. Rubber-duck notes for non-trivial UI/MCP-sensitive work, or why skipped.
+5. `Not verified / blocked` notes for focused proof or unavailable dependencies.

.config/dotnet-tools.json

@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "gitversion.tool": {
-      "version": "6.7.0",
+      "version": "6.8.1",
       "commands": [
         "dotnet-gitversion"
       ],

.github/pull_request_template.md

@@ -0,0 +1,89 @@
+## Summary
+
+<!-- Describe the problem and fix in 2-5 bullets. -->
+
+- Problem:
+- Why it matters:
+- What changed:
+- User impact:
+- What did NOT change (scope boundary):
+
+## Change Type (select all)
+
+<!-- Select all that apply. -->
+
+- [ ] Bug fix
+- [ ] Feature
+- [ ] Refactor
+- [ ] Docs / instructions
+- [ ] Tests / validation
+- [ ] Security hardening
+- [ ] Chore / infra
+
+## Scope (select all touched areas)
+
+- [ ] Tray / WinUI UX
+- [ ] Windows node capability
+- [ ] Local MCP / `winnode`
+- [ ] Gateway / connection / pairing
+- [ ] Setup / onboarding
+- [ ] Permissions / privacy / security
+- [ ] Tests / CI / docs
+
+## Linked Issue/PR
+
+- Closes #
+- Related #
+- [ ] Related to a bug or regression
+
+## Validation
+
+<!-- Include exact commands and pass/fail counts. Baseline after code changes:
+- .\build.ps1
+- dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore
+- dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore
+Add focused tests when relevant, for example WinNode CLI tests for command/MCP docs changes.
+In fresh worktrees, make sure tests actually ran and report non-zero test counts.
+-->
+
+## Real behavior proof
+
+<!-- Paste at least one current-head after-change proof item that directly demonstrates the changed behavior.
+Use whatever proof best matches the change: copied live output, screenshot/video,
+developer-provided screenshot, copied UI diagnostics, winnode output, raw MCP
+JSON-RPC tools/list + tools/call, gateway invoke output, redacted runtime log,
+or linked artifact. For UI changes, prefer screenshots/video of the active
+changed state, not only adjacent or empty UI. -->
+
+- Environment tested:
+- PR head / commit tested:
+- Exact steps or command run:
+- Evidence after fix:
+- Observed result:
+- Screenshot/artifact links verified? (`Yes/No/N/A`)
+- Not verified / blocked:
+
+<!-- Optional: add rubber-duck review notes in addition to runtime proof above. -->
+
+## Security Impact (required)
+
+- New permissions/capabilities? (`Yes/No`)
+- Secrets/tokens handling changed? (`Yes/No`)
+- New/changed network calls? (`Yes/No`)
+- Command/tool execution surface changed? (`Yes/No`)
+- Data access scope changed? (`Yes/No`)
+- If any `Yes`, explain risk + mitigation:
+
+## Compatibility / Migration
+
+- Backward compatible? (`Yes/No`)
+- Config/env changes? (`Yes/No`)
+- Migration needed? (`Yes/No`)
+- If yes, exact upgrade steps:
+
+## Review Conversations
+
+- [ ] I replied to or resolved every bot review conversation I addressed in this PR.
+- [ ] I left unresolved only conversations that still need reviewer or maintainer judgment.
+
+If a bot review conversation is addressed by this PR, resolve that conversation yourself. Do not leave bot review conversation cleanup for maintainers.

.github/workflows/ci.yml

@@ -91,7 +91,7 @@ jobs:
 
     - name: Cache NuGet packages
       continue-on-error: true
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       with:
         path: ~/.nuget/packages
         key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj', '**/Directory.Packages.props') }}
@@ -275,7 +275,55 @@ jobs:
         -r win-x64
         --verbosity normal
         --results-directory TestResults\TrayUI
-        --logger trx;LogFileName=OpenClaw.Tray.UITests.trx"
+        --logger trx;LogFileName=OpenClaw.Tray.UITests.trx
+        --filter Category!=Accessibility"
+
+    # Accessibility Insights CI pass: scans each page in the real app process.
+    - name: Run Accessibility Tests (Axe.Windows)
+      id: a11y
+      run: >
+        dotnet test tests/OpenClaw.Tray.UITests
+        --no-build
+        -c Debug
+        -r win-x64
+        --verbosity normal
+        --results-directory TestResults\Accessibility
+        --logger "trx;LogFileName=Accessibility.trx"
+        --filter Category=Accessibility
+
+    - name: Accessibility test summary
+      if: always() && steps.a11y.outcome != 'skipped'
+      shell: pwsh
+      run: |
+        if ("${{ steps.a11y.outcome }}" -eq "failure") {
+          "### :x: Accessibility violations detected" >> $env:GITHUB_STEP_SUMMARY
+          "" >> $env:GITHUB_STEP_SUMMARY
+          "Axe.Windows scans found WCAG violations in one or more pages." >> $env:GITHUB_STEP_SUMMARY
+          "See the `Accessibility.trx` artifact for details." >> $env:GITHUB_STEP_SUMMARY
+        } else {
+          "### :white_check_mark: Accessibility scans passed" >> $env:GITHUB_STEP_SUMMARY
+          "" >> $env:GITHUB_STEP_SUMMARY
+          "All pages passed Axe.Windows accessibility validation." >> $env:GITHUB_STEP_SUMMARY
+        }
+
+    - name: Verify DevBuild identity marker
+      shell: pwsh
+      run: |
+        dotnet build src/OpenClaw.Tray.WinUI -c Debug -r win-x64 -p:DevBuild=true --no-restore
+        $marker = Get-ChildItem -Path src\OpenClaw.Tray.WinUI\bin\Debug -Recurse -Filter app-identity.txt |
+          Where-Object { $_.FullName -like '*\win-x64\app-identity.txt' } |
+          Sort-Object LastWriteTimeUtc -Descending |
+          Select-Object -First 1
+        if ($null -eq $marker) {
+          throw "Dev identity marker was not produced by the DevBuild."
+        }
+
+        $identity = (Get-Content -LiteralPath $marker.FullName -Raw).Trim()
+        if ($identity -ne "dev") {
+          throw "Expected DevBuild identity marker 'dev' but found '$identity' at $($marker.FullName)."
+        }
+
+        Write-Host "DevBuild identity marker verified at $($marker.FullName): $identity"
 
     - name: Upload Test Results
       if: always()
@@ -293,16 +341,19 @@ jobs:
     needs: repo-hygiene
     if: ${{ !cancelled() }}
     runs-on: windows-latest
-    timeout-minutes: 25
+    timeout-minutes: ${{ matrix.timeout_minutes }}
     strategy:
       fail-fast: false
       matrix:
         include:
           - name: setup-connect
-            filter: FullyQualifiedName~OpenClaw.E2ETests.Setup.SetupAndConnectTests
+            timeout_minutes: 45
+            filter: "FullyQualifiedName~OpenClaw.E2ETests.Setup.SetupAndConnectTests|FullyQualifiedName~OpenClaw.E2ETests.Setup.MxcSetupAndConnectTests"
           - name: revocation-recovery
+            timeout_minutes: 25
             filter: FullyQualifiedName~OpenClaw.E2ETests.Setup.RevocationAndRecoveryTests
           - name: network-recovery
+            timeout_minutes: 25
             filter: FullyQualifiedName~OpenClaw.E2ETests.Setup.NetworkRecoveryTests
     steps:
     - name: Fail if repo hygiene failed
@@ -323,7 +374,7 @@ jobs:
 
     - name: Cache NuGet packages
       continue-on-error: true
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       with:
         path: ~/.nuget/packages
         key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj', '**/Directory.Packages.props') }}
@@ -366,6 +417,36 @@ jobs:
           Write-Error "E2E shard '${{ matrix.name }}' executed zero tests. Check OPENCLAW_RUN_E2E gating/filter before merging."
           exit 1
         }
+        if ("${{ matrix.name }}" -eq "setup-connect") {
+          $mxcProofNames = @(
+            "RealGateway_SystemRun_ExecutesThroughWindowsNodeMxcSandbox",
+            "RealGateway_SystemRun_BlocksWritesToTrayDataDirectoryInMxcSandbox"
+          )
+
+          foreach ($mxcProofName in $mxcProofNames) {
+            $mxcProof = @($trx.TestRun.Results.UnitTestResult | Where-Object { $_.testName -like "*$mxcProofName*" }) | Select-Object -First 1
+            if ($null -eq $mxcProof) {
+              Write-Error "E2E shard '${{ matrix.name }}' did not report the MXC proof test '$mxcProofName'. Check the setup-connect filter before merging."
+              exit 1
+            }
+
+            $mxcOutcome = [string]$mxcProof.outcome
+            if ($mxcOutcome -eq "Passed") {
+              Write-Host "MXC E2E proof passed: $mxcProofName"
+            } elseif ($mxcOutcome -eq "NotExecuted" -or $mxcOutcome -eq "Skipped") {
+              $mxcSkipReason = @($mxcProof.Output.ErrorInfo.Message, $mxcProof.Output.StdOut) |
+                Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
+                Select-Object -First 1
+              if ([string]::IsNullOrWhiteSpace($mxcSkipReason)) {
+                $mxcSkipReason = "skip reason was not present in the trx output"
+              }
+              Write-Warning "MXC E2E proof skipped: $mxcProofName; $mxcSkipReason"
+            } else {
+              Write-Error "MXC E2E proof '$mxcProofName' had unexpected outcome '$mxcOutcome'."
+              exit 1
+            }
+          }
+        }
 
     - name: Upload E2E Test Results & Logs
       if: always()
@@ -395,7 +476,7 @@ jobs:
 
     - name: Cache NuGet packages
       continue-on-error: true
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       with:
         path: ~/.nuget/packages
         key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj', '**/Directory.Packages.props') }}
@@ -479,7 +560,7 @@ jobs:
 
     - name: Cache NuGet packages
       continue-on-error: true
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       with:
         path: ~/.nuget/packages
         key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj', '**/Directory.Packages.props') }}

.github/workflows/copilot-setup-steps.yml

@@ -21,6 +21,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
       - name: Install gh-aw extension
-        uses: github/gh-aw-actions/setup-cli@bee9622162d2319e68ef2594442f58c815f28d7f # v0.80.8
+        uses: github/gh-aw-actions/setup-cli@3fac1cfa7a5a375a6a5eb9839178f6dad7adb60a # v0.82.2
         with:
           version: v0.72.1