feat(greenfield): close OpenClaw operations and media parity

greenfield/docs/architecture/greenfield-rewrite/application-architecture.md

@@ -450,8 +450,16 @@ Browser reads are session-only; writes require recent MFA again after fail-close
 and at the actual post-handshake pre-dispatch boundary. The web process serializes these controls
 through a sixteen-operation active-plus-waiting ceiling; aborted waiters are removed from the FIFO
 immediately instead of retaining unbounded work behind a slow Gateway operation.
-Configuration export and Gateway restart deliberately remain separate later boundaries: the former
-needs an actor-bound no-store raw ticket, while the latter needs a durable worker-owned action.
+Configuration export and Gateway restart remain separate privileged boundaries. Export reads only
+the exact descriptor-anchored `openclaw.json` source after recent-MFA reauthorization, copies it
+into a short-lived capacity-bounded actor/authenticator ticket, and serves it once through a
+same-origin private/no-store raw `GET`; `HEAD` inspects metadata without consuming the ticket.
+Stored and in-flight secret bytes are erased on expiry, consumption, cancellation, or shutdown and
+never enter tRPC, Query cache, audit, logs, or durable records. Restart instead enqueues the fixed
+`openclaw.gateway.restart` action after fail-closed audit and dispatch-time authorization. The job
+is exclusive, caller-idempotent, single-attempt, non-retry-safe, and non-cancellable; only the
+worker owns its fixed no-shell lifecycle command. Ambiguous enqueue or terminal settlement is
+reconciled by durable run identity and never blindly dispatches a second restart.
 
 ### Current-protocol Control UI projections
 
@@ -721,6 +729,22 @@ per-session/process concurrency, per-actor rolling rate admission, reset superse
 errors. OpenClaw background tasks remain a separate bounded provider projection invalidated through
 `openclaw.tasks`; neither companion exchanges nor task payloads become durable chat events.
 
+The same `GET`/`HEAD /api/chat/media/:attachmentId` proxy also securely narrows legacy local-history
+media without restoring a path-query API or adding a browser route. The hash-pinned OpenClaw adapter
+recognizes bounded canonical `__openclaw.media` entries plus the reviewed legacy path, URL, type, and
+`MEDIA:` carriers. Recognized directives are removed from projected text even when their candidates
+are rejected, so a local locator never becomes browser content. Valid local candidates register a
+stable opaque reference bound to the exact session, message, source slot, and normalized server-only
+locator; the reference exposes neither a host path nor directory-listing authority.
+
+Media delivery resolves that reference only after principal authentication, `chat:read`, and
+an exact `chat.message.get` reauthorization prove that the same projected message still contains the
+same attachment URL. Local bytes are opened only afterward through a descriptor-rooted reader fixed
+to `<MIRA_DASHBOARD_OPENCLAW_ROOT>/media`. Managed outgoing media keeps its existing Gateway source;
+both sources share the raw handler's range, preview, timeout, response-header, and work-admission
+policies. Local files are limited to 16 MiB, bounded text preview is limited to 1 MiB, and the server
+determines final MIME and disposition rather than trusting transcript hints.
+
 Chat voice is another raw protocol edge, not a second REST domain. An optional
 `ELEVENLABS_API_KEY` remains redacted in the web process and is never sent to the browser, SQLite,
 or logs. The authenticated capability probe reports each control only when the provider is

greenfield/docs/architecture/greenfield-rewrite/data-and-security.md

@@ -510,19 +510,36 @@ proxy mode names exact proxies and requires them to overwrite forwarded identity
 - File and media operations resolve against named allowlisted roots, reject traversal, verify
   containment after symlink resolution, avoid following unsafe links, and enforce size/MIME
   limits before parsing or preview.
+- Local-history media does not restore the legacy browser-supplied path boundary. Hash-pinned
+  projection recognizes the bounded canonical and reviewed legacy transcript carriers, strips each
+  recognized `MEDIA:` directive before browser delivery, and registers only an opaque non-path
+  reference bound to the exact session, message, source slot, and normalized server-only locator.
+  The identifier is not a capability: every `GET` or `HEAD /api/chat/media/:attachmentId` request
+  requires an authenticated principal with `chat:read`, reprojects the exact message through
+  `chat.message.get`, verifies the same attachment URL, and opens no file until that authorization
+  succeeds. A bounded history refresh can reconstruct the same association after process-local
+  reference loss, but cannot widen it to another session or message.
+- The local reader is descriptor-rooted beneath the exact
+  `<MIRA_DASHBOARD_OPENCLAW_ROOT>/media` directory. It rejects traversal, network locations,
+  symlinks, hardlinks, special files, cross-device nodes, unsafe ownership or modes, and file
+  identity changes; it never returns a locator in browser data, response headers, errors, audit, or
+  logs. Local bodies are capped at 16 MiB, text preview at 1 MiB, and SVG, HTML, unknown, or other
+  active content remains download-only. The existing Chat media concurrency and in-flight-byte
+  admission applies to both managed and local sources, with private/no-store responses and no
+  listing or path-query operation.
 - The Files and Terminal surfaces may share the explicit `MIRA_DASHBOARD_WORKSPACE_ROOT`. Files
   keeps descriptor-anchored containment for each operation. Terminal uses the same named root only
   to select the interactive shell's initial working directory: it is not a filesystem sandbox, and
   the shell may leave it wherever the worker's OS identity has access.
 - Files' separate web-and-worker `MIRA_DASHBOARD_OPENCLAW_ROOT` is not a general recursive browser.
   Its descriptor adapter synthesizes only the directory prefixes needed to reach the exact reviewed
   `openclaw.json` and `hooks/transforms/agentmail.ts` manifest entries, verifies
-  same-owner/same-device regular files, rejects links, world-writable nodes, traversal, and
-  oversized content, and redacts valid configuration JSON before default ticket creation or range
-  selection. The two reviewed full-redaction/replacement entries have a 2 MiB bound, while text
-  preview remains capped at 1 MiB and larger admitted text is download-only. Legacy configuration
-  GET parity therefore remains planned: legacy lists unbounded source sizes and returns a bounded
-  prefix for oversized files, which this stricter manifest does not claim to reproduce. Invalid JSON
+  same-owner/same-device regular files, rejects links, world-writable nodes, and traversal, and
+  redacts valid configuration JSON before default ticket creation or range selection. The two
+  reviewed full-redaction/replacement entries have a 2 MiB write bound, while text preview remains
+  capped at 1 MiB. An oversized reviewed source remains listable but read-only and exposes only a
+  revision-stable prefix of at most 1 MiB with explicit truncation and source-size metadata; an
+  oversized masked configuration prefix stays fail-closed until recent-MFA reveal. Invalid JSON
   publishes only safe listing metadata so the reviewed entry stays selectable; its masked preview
   fails closed without returning bytes. Raw configuration is available only through an explicit
   recent-MFA mutation and a short-lived actor-bound no-store ticket, which lets the operator inspect
@@ -542,6 +559,18 @@ proxy mode names exact proxies and requires them to overwrite forwarded identity
   stage file beside the target, so the worker unit deliberately retains its prior writable OpenClaw
   namespace rather than claiming an exact-file systemd exception that Linux VFS cannot enforce; the
   descriptor manifest is the write boundary.
+- The exact OpenClaw configuration export is not a database or host backup. A session-only,
+  recent-MFA procedure reads only descriptor-anchored `openclaw.json` and returns an opaque
+  actor/authenticator-bound ticket, never the secret bytes. Its same-origin raw route is
+  private/no-store, permits metadata-only `HEAD`, consumes `GET` once, and applies both stored-byte
+  capacity and live transfer concurrency/byte admission. Ticket expiry, transfer completion or
+  cancellation, and shutdown zero retained byte buffers. Raw configuration is excluded from tRPC,
+  browser caches, audit, logs, provider errors, and job state.
+- Gateway restart is a distinct durable worker action. Fail-closed audit and recent-MFA/session
+  authority must both succeed before enqueue; an idempotency-key readback reconciles ambiguous
+  repository settlement. The action holds the exclusive resource class, has one attempt, is not
+  retry-safe or cancellable, and invokes a fixed argv without a shell or captured output. Unknown
+  enqueue or process completion never causes an automatic second restart.
 - Dashboard's worker-owned rotation engine uses an exact reviewed per-file manifest for Dashboard,
   OpenClaw, and managed application/container logs rather than treating a directory as a recursive
   wildcard. Ubuntu system logrotate remains responsible only for the exact `rsyslog`, `apport`,