Experimental: evaluate Microsoft MXC sandbox

[yikkuro (yikkuro)]

Summary

Experimental Windows-native sandbox POC using Microsoft MXC for agent-controlled file and process tools.

Related: #202

Warning

MXC 0.7.0 is a public preview and explicitly is not a production security boundary. This PR is evidence for the P0 decision, not a production security claim.

Architecture

• Pins @microsoft/mxc-sdk@0.7.0, upstream tag commit 34d7fe2b4b3226bd4d11dc4a32419b7ec198a88b, and policy schema 0.7.0-alpha.
• Keeps Electron and the OpenClaw Gateway as the trusted control plane.
• Registers only mxc_read, mxc_write, mxc_edit, and bounded mxc_exec for model use.
• Launches a dedicated secret-stripped Node worker through hash-verified wxc-exec; child processes remain in the contained process tree.
• Enforces least privilege, network denied, UI denied, an isolated writable per-agent workspace, and explicit canonicalized RO/RW folders.
• Restricts Gateway plugin load paths and plugin IDs to the application-owned MXC plugin plus required GitHub Copilot and WeChat control-plane plugins.

Fail-closed behavior

• Removes AppContainer launcher/preload packaging and disables AppContainer provisioning, ACL mutation, permission UX, and uninstall cleanup as active paths.
• Forces OpenClaw Docker sandbox mode off globally and removes per-agent Docker/tool overrides.
• Does not spawn or attach to a Gateway unless MXC package version, native hash, Windows tier, folder policy, and worker proof all succeed.
• Invalidates MXC readiness and disconnects WebSocket state when the managed Gateway exits.
• Keeps Settings/Security available as a control-plane-only UI when MXC is blocked; chat/tool execution remains unavailable.
• Never runs wxc-host-prep, requests UAC, changes system ACLs, or falls back to unrestricted host execution.

UX and packaging

• Replaces AppContainer security UI with honest MXC package/tier/host-prep/policy/worker status.
• Adds per-agent native-folder RO/RW policies with canonical path validation, overlap rejection, sensitive/system/credential root blocks, desired/effective status, retry, and cleanup.
• Adds English and Chinese localization and direct preview/host-preparation documentation.
• Packages the plugin, MXC SDK/native binaries, node-pty, and semver in EXE and MSIX outputs; AppContainer payloads are absent.

Validation

• Desktop: 800 tests passed.
• Renderer: 259 tests passed.
• Installer/upgrade: 135 focused tests passed.
• Desktop TypeScript + renderer production build passed.
• Changed-file desktop ESLint, renderer lint, Ruff, Prettier, and git diff --check passed.
• Final unpacked EXE package contains Electron, Node, pinned OpenClaw, MXC plugin/SDK/native executor, node-pty, and semver.
• Final MicroClawDesktop-1.0.0-x64.msix passed manifest/resource validation with safe test identity defaults.
• Generated OpenClaw configuration passed openclaw config validate; cold plugin inspection loaded with zero tools when MICROCLAW_MXC_READY=0.

Live Windows result / blocker

The signed x64 executor hash matches the pinned package (2wo0Ir6eGzlswbJUfHD/FrJ0EkOKMcEKRavzcMrIauI=), but this host selects appcontainer-dacl: BaseContainer is unavailable and BFS is not compiled into the release binary. The benign worker probe therefore failed closed because fallback.allowDaclMutation=false.

Microsoft documents elevated wxc-host-prep prepare-system-drive and prepare-null-device for this tier, and Tier 3 still requires explicit DACL-mutation consent. This PR intentionally performed neither. The full live RW/RO/unapproved-path/child/network/junction containment matrix remains pending a BaseContainer-capable host or separately approved Tier-3 evaluation.