test: prototype M9-A0 OpenClaw trusted seams

[shenjiecode]

Summary

• records the research-only source-seam prototype for issue Decide pinned OpenClaw source patch or integration seam for M9-A0 #116;
• provides an exact patch candidate against OpenClaw 2026.4.14;
• adds fail-closed before_model_call and before_tool_result_release seams only in the disposable prototype;
• proves lower-level hook runner, wrapper, and handler-deadline behavior with focused tests;
• records the existing runEmbeddedAttempt harness readiness blocker and does not advance A0 layers 2–4.

Direct result

• OpenClaw: 2026.4.14 (2f35b6f), MIT
• patch dry run: pass
• patch SHA-256: ff58803f3497c4aa67f40c32cf72a63508dfb992aa87d037eda8b85146d3723f
• focused patched tests: 7 files / 54 tests passed
• actual attempt/provider gate: blocked by harness timeout; the same baseline timeout reproduces on the unpatched image

Scope boundary

The patch is an evidence artifact only. It is not copied into Tiangong runtime, not accepted as a dependency, and does not authorize an OpenClaw upgrade. No fake provider layer, deterministic integration, Matrix turn, or external resource was started.

Verification

• git diff --check
• run-plan local-link check
• run-plan/evidence whitespace check
• patch dry-run
• disposable container with network disabled
• exact cleanup after evidence generation

Refs #116
Related: #114, #115

[shenjiecode]

Follow-up plan execution is now recorded in smoke-testing/runs/2026-08-22-m9-a0-trusted-native-boundaries/result.md (commit c8b9011).

• Layer 1: pass — boundary/provider 10/10, adjacent OpenClaw regressions 156/156, targeted typecheck/format/patch dry-run/cleanup pass.
• Layer 2: blocked at readiness — exact plugin loader succeeds and direct real AgentSession reaches one loopback fake-provider request, but patched and unpatched runEmbeddedAttempt do not reach the provider before the readiness deadline.
• Layers 2 tool/retry/compaction, Layer 3, and Matrix were not started.

This is classified as an OpenClaw attempt/adapter-host readiness issue, not trusted-boundary pass evidence. No runtime code or external provider/Matrix resource was changed.

[shenjiecode]

Layer 2 continuation is recorded in commit 8bb697a and smoke-testing/runs/2026-08-22-m9-a0-trusted-native-boundaries/result.md.

• Layer 1 rerun after the tool-error seam correction: 10/10 boundary/provider, 156/156 adjacent regressions.
• Main path: pass — 2 provider requests, 1 tool execution, correct event order.
• Normalized tool error: pass — isError=true, follow-up request observed.
• Capture failure: pass — 1 request only, no ToolResult callback/message, no next request.
• Persisted follow-up: pass — two actual attempts on the same session, both trusted model-handler events.
• Compaction: stop condition red — pinned pi-coding-agent calls completeSimple directly; the compaction provider request had no trusted marker and zero before_model_call handler events.

A0 stops at the supported model-emitting path bypass. Layer 3/4 and M9-A formal implementation remain blocked; no Matrix or external resource was created.

[shenjiecode]

Layer 3 disposable Tiangong control-handler prototype completed in beba37c.

• Real OpenClaw loader registry: exactly one tiangong-control, one required model handler, one required ToolResult-release handler.
• Valid immutable AGENTS.md/SOUL.md bootstrap: 3 provider requests; success/error tool executions captured into the existing ToolResultStore as 2 records (success, error) before follow-up requests.
• Bootstrap corruption: 0 provider requests, 0 model-handler events.
• Spool write failure: 1 provider request, 1 recovery-required signal (TOOL_RESULT_CAPTURE_FAILED/EEXIST), 0 capture-closed records, no next provider request.
• run-layer3-control-handler.sh: 3/3 tests passed in tg-worker:dev, --network none; exact runner container was removed and owned-prefix inspection was empty.

Layer 4 Basic Matrix remains unauthorized; M9-A formal implementation remains blocked pending A0 review/Matrix authorization. Evidence: smoke-testing/runs/2026-08-22-m9-a0-trusted-native-boundaries/result.md.

[shenjiecode]

Layer 4 Basic Matrix was explicitly authorized and executed in 33c21d3, but A0 correctly stops RED.

Direct facts from the final attempt:

• one disposable Admin Human source event and one target Worker Matrix response; sender preserved; body not recorded (bounded length/digest only);
• research plugin registered and before_prompt_build observed;
• trusted before_model_call events: 0; trusted ToolResult-release events: 0;
• same-image lower-level loader probe passed with exactly one required model handler and one required ToolResult handler;
• therefore the real OpenClaw Matrix model-emitting path bypassed the final trusted handler. This is the supported-path stop condition, not a timeout or pass.

All exact Team/Workers/containers/storage/research image resources were cleaned and verified absent. No further Matrix attempt or M9-A implementation should start until a reviewed real-path seam correction. Evidence is in smoke-testing/runs/2026-08-22-m9-a0-trusted-native-boundaries/.

[shenjiecode]

Corrected Layer 4 Basic Matrix canary now passes in 14a56e6.

• Full pinned unified OpenClaw graph: 1 PI runner, 1 stable runtime reference, patched trusted install selected; OpenClaw remains 2026.4.14 (2f35b6f).
• Accepted canary: 1 bounded Matrix request, 1 target response, 1 trusted before_model_call, exact immutable AGENTS.md/SOUL.md bundle digests, object payload. Tool-release count was 0 as the prompt explicitly prohibited tools.
• Runner exit: 0; Team/Workers/containers/research image/storage and owned prefix all absent.
• Two earlier corrected attempts found and fixed a digest-oracle newline bug and a cleanup retry bug; their sanitized diagnostics are preserved. No further Matrix attempt is needed.

A0 is ready for review. Formal M9-A implementation has not started.