Decide pinned OpenClaw source patch or integration seam for M9-A0

[shenjiecode]

Context

M9-A0 rerun #114 stopped again at source/type/contract inspection. Result PR #115 contains direct evidence.

The revised design requires two trusted seams:

• TrustedModelCallBoundary: a Tiangong-owned pre-provider boundary that verifies immutable Package/bootstrap/authority/session input and prevents the provider request on failure;
• TrustedToolExecutionBoundary: a wrapper around every allowed top-level tool executor that synchronously closes ToolResult to control spool before ordinary result release.

Pinned source facts

Against OpenClaw 2026.4.14:

• provider/session execution reaches activeSession.prompt(effectivePrompt, ...);
• no Trusted boundary implementation or plugin contract exists;
• before_prompt_build failure continues to the model path;
• before_model_resolve has no block result;
• tool_result_persist is synchronous-only and default fail-open;
• no native before_tool_call timeout enforcement exists;
• current Tiangong capture remains native hook plus local append.

Decision required

Choose exactly one reviewed path:

1. an explicit, versioned OpenClaw source patch against the pinned upstream tag that exposes/proves both seams; or
2. a different public, version-pinned integration seam with the same direct machine contract; or
3. revise the M9 design to reject this pinned OpenClaw integration.

Any patch must record the exact upstream tag, patch ref/digest, license, source inspection, and security impact. No silent upgrade, prompt/Skill workaround, or native observation-hook promotion is allowed.

Exit criteria

• decision reviewed before implementation;
• a source/type/contract rerun passes layer 1;
• only then may layers 2–4 run serially;
• M9-A formal implementation remains blocked until all four layers pass.

Refs #114
Related: #115

[shenjiecode]

Research-only source-seam prototype is in PR #117.

• Exact patch candidate against OpenClaw 2026.4.14 is recorded with SHA-256 and MIT upstream identity.
• Lower-level fail-closed model hook, tool-result release, and handler-deadline tests pass.
• Real runEmbeddedAttempt harness remains blocked by a timeout reproducible on the clean image.
• A0 layers 2–4 and all M9-A implementation remain blocked until that readiness issue is resolved.

[shenjiecode]

Follow-up execution completed in commit c8b9011 / PR #117. Layer 1 passes (10/10 boundary/provider, 156/156 adjacent regression). Layer 2 is blocked: real plugin loader and direct AgentSession readiness pass, but patched and unpatched runEmbeddedAttempt both fail to reach the loopback provider before readiness timeout. No Layer 3/4 or Matrix was started. See smoke-testing/runs/2026-08-22-m9-a0-trusted-native-boundaries/result.md.

[shenjiecode]

Layer 2 continuation completed in 8bb697a. Main, normalized tool-error, capture-failure, and persisted follow-up cases pass. The separately created OpenClaw compaction session remains a hard stop: pinned pi-coding-agent invokes completeSimple directly, bypassing agent.onPayload; direct provider evidence shows one request with no trusted marker and zero trusted model-handler events. Per A0 stop condition, Layer 3/4 and M9-A implementation remain blocked. See smoke-testing/runs/2026-08-22-m9-a0-trusted-native-boundaries/result.md.

[shenjiecode]

Layer 3 is now complete in beba37c as a disposable control-handler prototype. It reuses the existing ToolResultStore/capture contract, proves immutable bootstrap corruption denial (0 provider requests), success/error capture (2 spool records), and recovery-required on spool failure with no next provider request. No Worker runtime, DB, Matrix, or external provider changed. Layer 4 Basic Matrix remains unauthorized; see the updated M9-A0 result.

[shenjiecode]

Layer 4 Basic Matrix is RED in 33c21d3 and A0 stops. The official Matrix path produced one target response while the final trusted model handler observed zero events; a same-image lower-level plugin loader probe independently showed exactly one required model and ToolResult handler, isolating the failure to the real OpenClaw Matrix model path. Exact disposable resources and the derived research image were cleaned. No further Matrix attempt or formal M9-A implementation is authorized pending a reviewed seam correction.

[shenjiecode]

Corrected Layer 4 Basic Matrix canary passes in 14a56e6. The stale-dist historical verdict is invalidated. The full pinned unified graph exercised the candidate: one Matrix request/response, one trusted model-handler event, exact immutable bootstrap digests, object payload, runner exit 0, and exact-resource cleanup. Two prior corrected attempts exposed/fixed only test-driver digest and cleanup retry defects. A0 is ready for review; formal M9-A remains unstarted pending separate review/authorization.

[shenjiecode]

决策已完成：采用 pinned OpenClaw 2026.4.14 (2f35b6f) 的 research source patch，patch SHA-256 3c81b8333aa23772989763a2328396e3132d424ce438f81e841f9e3bfc6019eb，并使用官方 unified tsdown graph（SHA-256 3b3fae95354fd32692692ca7da4051e850c7a75885cb2f34a99f1dda3828da38）。M9-A0 四层通过，required-mode compaction 继续 fail closed/disabled；session rollover 与上游 compaction payload seam 已拆为新 issue。本 issue 关闭。