Publish update manifest endpoint for manual update checker

[angnuoli]

Background

PR #45 adds the MicroClaw Desktop client-side manual update checker in Settings > About. The client expects a public update manifest at:

https://microclaw.microsoftol.com/releases/latest.json

That remote endpoint is not available yet, so the checker currently fails safely with the "Could not check for updates" state until the web/CDN side is published.

Scope

• Publish latest.json at the expected URL, or confirm the final manifest URL and update the client constant if it changes.
• Point downloadUrl to the current release artifact, initially likely MicroClawInstaller.zip until a formal MicroClawSetup.exe exists.
• Ensure the manifest is served as JSON over HTTPS.
• Keep the manifest format compatible with the client validation in PR Add manual update checker #45.

Expected manifest shape

{
  "version": "1.0.1",
  "releasedAt": "2026-07-15",
  "downloadUrl": "https://microclaw.microsoftol.com/downloads/MicroClawInstaller.zip",
  "sha256": "<artifact sha256>",
  "openclawVersion": "2026.3.12",
  "releaseNotes": [
    "Add manual update checker"
  ]
}

Acceptance criteria

• GET https://microclaw.microsoftol.com/releases/latest.json returns HTTP 200 with valid JSON.
• version is a numeric dotted version string, for example 1.0.1.
• downloadUrl is HTTPS and points to a downloadable release artifact.
• MicroClaw Desktop Settings > About > Check for updates can show either "up to date" or "update available" instead of failing due to a missing endpoint.

Related

• PR Add manual update checker #45

[angnuoli]

Implementation progress:

• Client companion PR: Fix update manifest domain #215
  • switches UPDATE_MANIFEST_URL from the obsolete microclaw.microsoftol.com host to canonical microclaw.microsoft.com
  • targeted update-checker tests pass (8/8)
• Web/deployment PR: https://github.com/angnuoli_microsoft/MicroClawWeb/pull/4
  • adds fail-closed manifest validation, Azure Web App deployment workflow, IIS web.config, and deployment documentation
  • rejects the stale aka.ms/MicroClaw-Installer target because it resolves to HTML
  • rejects SHA-256 mismatches and invalid Authenticode signatures

Verified live status on 2026-08-19:

• https://microclaw.microsoft.com/ -> Azure China Front Door HTTP 403 CONFIG_NOCACHE
• https://microclaw.microsoft.com/releases/latest.json -> HTTP 403
• legacy https://microclaw.microsoftol.com/releases/latest.json -> IIS HTTP 404

Remaining external blockers before the issue's live acceptance criteria can pass:

1. Enable a GitHub Actions runner for MicroClawWeb.
2. Add AZURE_WEBAPP_PUBLISH_PROFILE.
3. Publish a public, Authenticode-signed MicroClawSetup.exe release asset and update the manifest URL/SHA-256.
4. Repair the Azure China Front Door route/origin/WAF configuration for microclaw.microsoft.com.

The current Actions installer was not used because it is authenticated-only and unsigned. The deployment path remains fail-closed rather than publishing an invalid update manifest.