[shanselman]

Related: #1437. The separate product-fix investigation is #1438 (fix(chat): restore the tail when switching conversations). Its current candidate is rejected, not a verified fix.

Maintainer update (2026-09-21)

Updated head: 825ecd401c70f5710a3172933d575a93e303f369. Review fixes are in 8183bfc3; current main (e7d8c05b) was merged without conflicts before exact-head validation.

• Preserve the polling description and artifact directory when an individual probe times out, retaining the original exception. Cancellation and non-timeout failures still propagate.
• Reject malformed HTTP-upgrade headers without faulting fixture shutdown. Pre-upgrade disconnects and malformed requests remain visible as metadata-only unexpected requests; the smoke assertions still fail on unexpected traffic. Valid subsequent clients continue working.
• Add 14 regression cases (six protocol and eight polling cases), include polling tests in the smoke selector, and update the usage guide. Both independent reviewers confirmed both fixes and reported no actionable findings in the local fix delta.
• Current-head native ARM64 build and non-UI validation passed, as detailed below. Desktop UI smoke was not rerun after this update. Historical x64 UI evidence is retained and is not claimed as a fresh current-head run.

What Problem This Solves

Developers need to test the populated desktop application without provisioning a real Gateway, pairing a machine, or paying for AI calls.

User Impact

Developers can launch the real app against a fictional Gateway, browse several conversations and settings pages, and run repeatable native UI smoke tests. Each run owns its profile, credentials, ports and processes, so installed pairings are not imported.

There is no change to normal installed-app behavior unless the explicit fixture mode is enabled.

Known limitation: the strict Release session-tail test can fail on existing chat behavior tracked in #1437. This PR preserves that failure rather than weakening the test or changing production scrolling.

Why This Change Was Made

This adds the missing middle tier between unit/component tests and full system E2E. The fixture speaks the normal Gateway WebSocket protocol; the app still uses its real connection manager, chat provider, history loader and renderer.

The same synthetic scenario supports interactive exploration and automation: five sessions, 240 mixed-height messages, an empty conversation, model/agent data and read-only Gateway configuration. MCP handles discovery, readiness and navigation; UI Automation operates the actual session picker and scrollbar.

The changes stay focused: test-only server/run infrastructure, narrow WSL/autostart/toast isolation guards, and passive fixture-only render metadata. No production scrolling workaround, provider replacement, new AI dependency, or Gateway installation.

CI boundary: existing unit-test jobs pick up the new tests in their projects. The real-app fixture smoke remains opt-in. This PR does not add a required desktop CI check, edit workflows relative to current main, or change branch protection. Mandatory CI promotion is a separate decision after the known runtime failure and runner reliability are addressed.

Evidence

• The original 104 new test cases cover protocol parsing, parameter/error handling, isolation, concurrent apps, native session switching, delayed history, empty state and actual final-message visibility. The maintainer update adds 14 timeout and malformed-upgrade regression cases.
• Two simultaneous app instances were verified with independent profiles, Gateway endpoints, MCP ports/tokens and preferences. Stopping one left the other usable.
• The interactive launcher was exercised with a bounded lifetime, live winnode --list-tools and app.status; it exited successfully and removed its owned profile and process.
• The delayed-history test waits for metadata from the snapshot consumed by the actual composer render. A provider/MCP snapshot alone is not treated as UI proof.
• The harness already caught a regression: a Release repeat returned to messages 1-3 instead of message 240 after A -> B -> A. The strict assertion and failure evidence remain intact. Earlier successful runs do not replace that failed result; Chat can return to the first message instead of the tail when switching back to a populated session #1437 tracks the separate investigation.

Usage: docs/GATEWAY_FIXTURE_TESTING.md.

.\scripts\run-gateway-fixture.ps1 -AppPath '<built OpenClaw.Tray.WinUI.exe>'
.\scripts\test-gateway-fixture.ps1 -AppPath '<built OpenClaw.Tray.WinUI.exe>' -Screenshots

Change Type

• Bug fix
• Feature
• Refactor
• Docs or instructions
• Tests or validation
• Security hardening
• Chore or infrastructure

Scope

• Tray or WinUI UX
• Windows node capability
• Local MCP or winnode
• Gateway, connection, or pairing
• Setup or onboarding
• Permissions, privacy, or security
• Tests, CI, or docs

Required proof pools

• windows-winui-interactive: populated native chat, actual picker/scrolling/navigation, isolated startup and MCP proof. Historical Windows x64 proof collected; the known Release scrolling failure is retained. No fresh desktop smoke on the maintainer-update head.
• windows-11-arm64: current-head native ARM64 build and non-UI suites passed. Native ARM64 desktop runtime proof remains not verified.

Validation

Current head: 825ecd401c70f5710a3172933d575a93e303f369

Native Windows ARM64, .NET SDK 10.0.401. Required tests used isolated settings, explicit OPENCLAW_REPO_ROOT, and no desktop/E2E opt-ins. Missing Windows SDK was installed using the repository setup script before the final runs. No --no-build shortcut was used.

Command	Result
.\build.ps1	Passed: all five projects, win-arm64, including documentation validation
dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore	4,037 passed, 35 skipped, zero failures
dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore	3,013 passed, no skips
dotnet test .\tests\OpenClaw.Tray.IntegrationTests\OpenClaw.Tray.IntegrationTests.csproj --no-restore --filter 'FullyQualifiedName~GatewayFixtureProfileTests|FullyQualifiedName~GatewayFixtureRunTests'	28 passed, no skips
Changed PowerShell smoke-script parser check and git diff --check	Passed

The focused protocol suite passed all 35 cases on the fix tree before merging main; those cases also run in the full current-head Shared suite. The initial regression-test run reproduced the two defects before the fixes.

Both independent reviewers found no actionable findings in the seven-file fix delta. The conflict-free main merge's overlapping documentation/project-file hunks were checked directly. The current-host structured helper attempt (python .\.agents\skills\autoreview\scripts\autoreview --mode local --engine codex) was blocked by missing Python and is not claimed as a successful structured-helper run.

Original publication evidence: afc3e9f7e616bde264ed78490e6738d0c1bbbd44

These are the author's historical Windows x64 results, not fresh runs on the updated head:

Command	Result
.\build.ps1	Passed, including documentation validation
Shared tests	4,034 passed, 32 skipped
Tray tests	3,006 passed, no skips
WinNode CLI tests	127 passed, no skips
Shared tests filtered to GatewayFixtureProtocolTests	29 passed, no skips
Tray Integration tests filtered to GatewayFixtureProfileTests and GatewayFixtureAppTests (--no-restore -r win-x64 -p:Platform=x64)	22 passed on publication head, no skips; real isolated apps and MCP, no UI navigation
.\scripts\test-gateway-fixture.ps1 -AppPath '<Debug app>' -Screenshots	26 passed, no skips
.\build.ps1 -Project WinUI -Configuration Release	Passed
.\scripts\test-gateway-fixture.ps1 -AppPath '<Release app>' -Configuration Release -Screenshots	Latest repeat: 25 passed, 1 failed natural-tail assertion; no skips
.\scripts\validate-docs.ps1 and git diff --check	Passed

Original structured Codex reviews completed cleanly with no accepted/actionable findings:

python .\.agents\skills\autoreview\scripts\autoreview --mode commit --commit 7def9212 --engine codex
python .\.agents\skills\autoreview\scripts\autoreview --mode branch --base 7def9212 --engine codex

The implementation and complete test/documentation range were reviewed separately to respect the helper's per-diff size limit, without truncating or omitting files. The original frozen-tree runs both exited 0.

Real behavior proof

Current-head fix coverage: real loopback TCP regression cases send blank, malformed, oversized and prematurely disconnected HTTP upgrades, verify metadata-only unexpected-request diagnostics, connect the real Gateway client afterward, and verify clean server disposal. Polling regressions cover delayed probes, original timeout preservation, ordinary exceptions, app-liveness checks, and cancellation. These tests do not launch the desktop app.

Historical native application evidence:

• Environment tested: real unpackaged Windows x64 app, .NET 10.0.12, Windows App SDK 2.4.0, native Reactor chat. Release uses DevBuild=false, System.Diagnostics.Debugger.IsSupported=false, and no attached debugger.
• Commit tested: afc3e9f7e616bde264ed78490e6738d0c1bbbd44. Full build/required tests, 22 real app/profile/MCP checks and final source review ran on that committed tree. Native UI evidence was collected from the identical production source in implementation commit 7def9212; subsequent original-publication commits added tests/documentation and equivalent test-only cancellation argument formatting.
• Exact steps: start an isolated fixture; discover MCP tools; verify the connected operator and five sessions; use the real picker for A/B/A; check natural message-240 visibility before any manual scrolling; exercise two measured window widths, page navigation, an empty session and controlled delayed history.
• Observed result: Debug completed all 26 cases. Earlier Release runs completed all 26; the latest Release repeat completed 25 and retained one genuine failed assertion with a screenshot showing the selected long conversation at its beginning. The product failure is not claimed fixed by this PR.
• Interactive proof: run-gateway-fixture.ps1 -DurationSeconds 90 exited 0; the generated profile and app process were both gone afterward. The same running app returned:

{
  "connectionStatus": "Connected",
  "overallState": "Ready",
  "operatorState": "Connected",
  "nodeState": "Disabled",
  "gatewayVersion": "fixture-1",
  "sessionCount": 5,
  "nodeCount": 0,
  "operatorScopes": ["operator.read"]
}

• Screenshot links: Original successful and failed native UI captures. These are historical captures, not screenshots from the updated head. Local logs/TRX from the maintainer validation are retained in the coordinating session.
• Not verified / blocked: fresh current-head desktop smoke; the intermittent native scrolling bug; native ARM64 desktop behavior; real Gateway pairing, WSL/MXC and installer/MSIX behavior. Fixture evidence is not a substitute for full system E2E. CI promotion, canned streaming, and multiple saved Gateways within one app are not part of this first version.

Security Impact

• New permissions or capabilities? No. No new remote node command or app MCP command is added.
• Secrets or tokens handling changed? Yes, in test infrastructure. Each run generates its own fixture credential and uses the app's isolated MCP token. No installed settings, identity files or credentials are copied.
• New or changed network calls? Yes. A per-run authenticated numeric-loopback WebSocket server supplies synthetic data; existing local MCP drives the app. There is no live proxy or AI/provider fallback.
• Command or tool execution surface changed? Yes, developer tooling. The launcher starts only an explicitly selected built app and rejects binaries without the fixture-isolation capability marker. It does not expose shell execution through the fake Gateway.
• Data access scope changed? Yes, test-owned state. Runs create owned temporary profiles and separate setup/Local AI roots, and clean up only their own process trees/directories. Published artifacts exclude profile/registry/identity files.

The explicit fixture guards suppress WSL keepalive/stale cleanup, Windows autostart writes and toast registration. Auto-start changes through local MCP also fail explicitly before saving. Normal isolated runs without the fixture flag retain their existing behavior. The supported workflow is browsing and safe local preferences, not a general OS sandbox.

Compatibility and Migration

• Backward compatible? Yes. Existing MCP-only integration defaults and normal credential precedence are unchanged.
• Config or environment changes? Yes, opt-in developer controls. The launcher supplies OPENCLAW_GATEWAY_FIXTURE=1, isolated tray/setup roots, a dedicated MCP port, and safe fixture settings in the child process only. The app advertises OpenClaw.GatewayFixtureIsolationVersion=1 for preflight.
• Migration needed? No. No user settings or pairing migration and no installer changes.

Review Conversations

• No inline review comments or formal change-request reviews were returned by the pre-landing API check.
• Both locally accepted findings are fixed with regression coverage. The existing product scrolling issue remains explicitly separate.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge. Reviewed September 21, 2026, 6:56 PM ET / 22:56 UTC (Revision 3).

ClawSweeper review

What this changes

Adds a disposable, authenticated simulated Gateway, launch scripts, native application tests, and fixture-only isolation guards so developers can explore populated conversations without a live Gateway.

Merge readiness

⛔ Needs changes before merge - 1 item remains

This remains useful work beyond main’s existing test fixtures. No actionable patch defect was found; current-head native desktop proof remains outstanding under the repository’s scoped validation policy.

Priority: P2
Reviewed head: 825ecd401c70f5710a3172933d575a93e303f369

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The implementation and historical evidence are solid, but current-head native validation remains incomplete.
Proof confidence	🦐 gold shrimp (3/6)	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Evidence reviewed	9 items	Pinned production changes: The introduced production delta adds explicit fixture guards around startup validation, autostart, toast registration, and WSL keepalive, plus passive composer metadata. It does not replace the connection manager, chat provider, or scrolling implementation. Profile and authority isolation: The launcher creates fresh settings and Gateway records, clears inherited OPENCLAW overrides, disables sensitive node capabilities, and requires an isolation-capable executable. The loopback server authenticates each connection and rejects writes without forwarding requests; protocol and app tests exercise cross-run token rejection. Complete captured proof body recovered: The GitHub body matches the supplied snapshot: 13,805 characters, SHA-256 252d982f0b857c99b21a4e9c48e261ed7457a90fe6d0033f579b1c7d4a9f637f. Its omitted portion explicitly identifies historical native proof and lists fresh current-head desktop smoke and ARM64 desktop behavior as unverified.
Findings	None	None.
Security	None	None.

How this fits together

The fixture supplies synthetic Gateway responses to the Windows app’s real connection manager, chat provider, and renderer. Separate profiles and restricted host effects let MCP and native UI tests exercise browsing without importing installed pairings.

flowchart TD
  A[Developer launcher] --> B[Disposable profile and credentials]
  B --> C[Real Windows app]
  D[Authenticated loopback Gateway] --> C
  C --> E[Native chat and settings]
  F[MCP and UI automation] --> E
  E --> G[Assertions and redacted artifacts]

Loading

Before merge

• Complete next step (P2) - Attach current-head native fixture smoke evidence, retaining the separately tracked scrolling failure if it recurs.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Net line growth	production +224; tests and test infrastructure +3,234; scripts +94	Production growth is justified by explicit isolation guards and passive render observation; most additions implement the reusable fixture and its coverage.

Technical review

Best possible solution:

Keep the fixture opt-in, reuse the production connection and rendering paths, and preserve strict failing assertions while the separate scrolling investigation proceeds.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR adds a development fixture. Its historical native runs demonstrate the capability; the scrolling failure they exposed is tracked separately.

Is this the best way to solve the issue?

Yes: testing through the real Gateway client and renderer fills a gap left by MCP-only and component fixtures, while keeping simulation code outside the application.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against e7d8c05b51b5.

Labels

Label changes:

• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• remove rating: 🐚 platinum hermit: Current PR rating is rating: 🦐 gold shrimp, so this older rating label is no longer current.
• remove proof: sufficient: Current real behavior proof status is not_applicable, not sufficient.

Label justifications:

• P2: This is a bounded developer-testing improvement with useful native regression coverage and no demonstrated urgent production regression introduced by the patch.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Evidence

What I checked:

• Pinned production changes: The introduced production delta adds explicit fixture guards around startup validation, autostart, toast registration, and WSL keepalive, plus passive composer metadata. It does not replace the connection manager, chat provider, or scrolling implementation. (src/OpenClaw.Shared/GatewayFixtureIsolation.cs:28, 825ecd401c70)
• Profile and authority isolation: The launcher creates fresh settings and Gateway records, clears inherited OPENCLAW overrides, disables sensitive node capabilities, and requires an isolation-capable executable. The loopback server authenticates each connection and rejects writes without forwarding requests; protocol and app tests exercise cross-run token rejection. (tests/OpenClaw.GatewayFixtureHost/GatewayFixtureProfile.cs:81, 825ecd401c70)
• Complete captured proof body recovered: The GitHub body matches the supplied snapshot: 13,805 characters, SHA-256 252d982f0b857c99b21a4e9c48e261ed7457a90fe6d0033f579b1c7d4a9f637f. Its omitted portion explicitly identifies historical native proof and lists fresh current-head desktop smoke and ARM64 desktop behavior as unverified. (825ecd401c70)
• Native evidence inspected: Both downloaded screenshots were inspected. One shows the connected native app displaying FIXTURE LONG END 240; the other shows the selected long conversation at messages 1–3. The accompanying discussion attributes these to historical x64 runs and preserves the failed assertion: feat: explore and test the app without a live Gateway #1439 (comment). (afc3e9f7e616)
• Current-head validation and follow-up fixes: The captured body reports a successful native ARM64 build, 4,037 Shared tests, 3,013 Tray tests, and 28 focused profile/polling tests. Source inspection confirms malformed-upgrade recovery through real TCP and the real Gateway client, and preservation of polling timeout context. These results do not exercise the desktop renderer. This read-only review ran no builds, tests, or bundled review helpers. (tests/OpenClaw.Shared.Tests/GatewayFixtureProtocolTests.cs:358, 825ecd401c70)
• Scoped proof requirement: Root AGENTS.md and the proof-validation skill require current-head evidence for changed UI behavior. The proof-pool document distinguishes native desktop proof from automated coverage and permits unavailable pools to be declared blocked, without treating them as completed. (docs/PROOF_POOLS.md:21, 825ecd401c70)

Likely related people:

• shanselman: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Sebastien Tardif: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Refresh native fixture evidence on the reviewed head, preserving any session-tail failure instead of retrying or weakening the assertion.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-09-17T17:49:56.032Z sha afc3e9f :: needs maintainer review before merge. :: none
• reviewed 2026-09-17T17:56:04.233Z sha afc3e9f :: needs maintainer review before merge. :: none

[shanselman]

Native UI evidence from the fixture harness

Successful Debug example: the real app displays the actual final message of the 240-message synthetic conversation. This is a harness demonstration, not an "after" screenshot for the separate scrolling fix.

Known Release failure retained: after returning to the long conversation, the selected session is correct but the viewport is at messages 1-3. The harness failed its natural-tail assertion rather than repairing the scroll position or reporting success. This is tracked in #1437; the separate draft product fix is #1438 (fix(chat): restore the tail when switching conversations).

Both captures contain only the fictional scenario and the target app window. The PR description preserves the latest Release result: 25 passing cases and one failed assertion.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: feat: explore and test the app without a live Gateway This is item 1/1 in the current shard. Shard 0/1.

This temporary status tracks the active review worker. The completed review will appear in the durable ClawSweeper review comment.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

[bkudiess]

Maintainer landing review for 825ecd401c70f5710a3172933d575a93e303f369:

• The two accepted review findings are fixed in 8183bfc3, with 14 regression cases. Both independent rereviews found no actionable issues.
• After merging current main, the native ARM64 build passed; Shared: 4,037 passed / 35 skipped; Tray: 3,013 passed; fixture profile/polling: 28 passed. Exact-head GitHub CI, including the required CI Gate, is green.
• Disposition of the bot's proof-freshness observation: fresh desktop smoke remains unverified, as explicitly documented in the PR body. The production fixture isolation guards and composer/render-observation files are unchanged from the original native-proof head; this was checked directly. The maintainer fixes are test-infrastructure-only, with current-head real-TCP/client and polling regression coverage. No fresh UI pass is being inferred from unit tests or CI.
• The existing session-tail failure remains tracked separately in Chat can return to the first message instead of the tail when switching back to a populated session #1437. This merge neither fixes it nor weakens its assertion. Historical screenshots remain historical evidence.

Proceeding with the authorized merge of the reviewed harness and fixes, without bypassing required checks.