[miguelbranco80]

Human merge required. Agents must not merge this PR or enable automatic merging. A human must manually merge it.

The RFC has been extracted to #3520 for easier architectural review and discussion. This PR remains a draft implementation for reference and experimentation.

The RFC file is identical to the focused proposal. The implementation plan retains delivery details. This synchronization changes documentation only; it adds no runtime behavior or qualification claim. Documentation length, links, specification metadata, formatting, workspace, and diff checks passed.

Verification

• Before RFC synchronization, head 17340527e83e97f5bfa77220cb7f04ee6124bb65 passed local typecheck, lint, formatting, workspace, OpenAPI, documentation and focused API/proxy/browser checks. CI Required and each selected required lane passed, including PostgreSQL and Kubernetes fixture workflows. First Agent Smoke passed. CI tested synthetic merge 58d5bec339d47b5bb036eb1adf61bf8168cf75c3, not the locally reviewed pinned-base tree; native container verification was skipped. These results do not qualify a later head.
• Recorded native proof at product source 531fa5ed4, OpenClaw 90d30a1178a79dddd92e6190b66b95d89dfb3ca8, macOS arm64, passed restricted/public plugin fetch, real model turns, network denials, cutover, held-tunnel withdrawal, worker restart and policy tightening in enforcing k3d with PostgreSQL. The public-reader response was an HTTP fixture. This is historical, not current-runtime or live-provider qualification.
• Historical simulated UI proof: source 58822505a, Storybook asset efa81d40bf9fa7d1, Chromium, desktop 1440px/mobile 390px; nine Pages/Agent detail/GatewayNetwork* stories plus Access. Saved state, dirty/deploy-disabled state, mobile, 18-second walkthrough. These fixtures do not prove persistence, deployment, credential propagation or native connectivity; final-source visual proof remains unqualified.

Review and qualification holds

• RFC acceptance and design/security review remain pending; this implementation stays draft.
• Open P2: upstream accepts msteams Configuration, but bundled automatic requirements cover Slack; channelsOnly can admit no route. Assess compatibility with existing upstream behavior, not a new Teams delivery requirement.
• ClawSweeper input-admission refusal remains unresolved. Companion qualification #2074 is draft; maintainer fixture qualification and authorized hosted re-review remain required. Local admission proof is not a review verdict.
• Outstanding: current AMD64/ARM64 native controller/runtime qualification; unresolved sandbox smoke and sessions.create build timeout; fresh selected model/proxy proof; full Helm-installed production qualification; isolated live-provider and deterministic mixed-answer/rebinding proof; Protected Harness/Credential Proxy composition; inherited local OpenShell IPv6 TLS failure. Historical evidence and later reviews with no new findings do not release these holds.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review blocked

Automated review did not run, so no review verdict was produced.

Reason: The input-safety check rejected material in this revision. No detected value, path, or scanner output is reproduced here.

Automatic review is on hold, including after source changes. Request a fresh re-review after resolving the failure; maintainers can also release the hold through an intentional scanner-policy update.

Next step: If this is a genuine credential, remove and rotate it. If it is an intentional test fixture, a maintainer must review and qualify it.

View the workflow run.

[freeqaz]

Free's clanker here (an AI agent working on Free's behalf).

I review fork PR runs for CI-safety before approving them. I have not approved the runs for e2dc302 on this PR, because the PR changes CI behaviour, and a maintainer has to approve that kind of change by hand:

• scripts/ci/prepare.mjs adds a controllerImage prepare step that builds the production controller image and imports it into the lane's k3d cluster.
• scripts/ci/test-suites/checks-baseline-2.json swaps slack-proxy-tunnel/slack-proxy-reset (now deleted) for gateway-outbound-proxy. k3d-fixture-state.json adds the controller-image and NODE_BASE_IMAGE preparation. k3d-model.json turns on OCC_TEST_GATEWAY_OUTBOUND_K3D and adds an expected test.

I found nothing that reads tokens or secrets or calls outside hosts, and .github/, package.json, the lockfile and the workspace config are unchanged. This is a routing note, not a judgment of the change. A maintainer will look at these runs.

[freeqaz]

Free's clanker here (an AI agent working on Free's behalf). Heads-up about a conflict coming from main: #3111 moved the body of apps/controller/src/server.mjs unchanged into a new apps/controller/src/api-startup.mjs, as startApi(env). server.mjs is now a thin wrapper that calls startApi(process.env) and prints the same startup-error line on failure.

This PR edits the old body of server.mjs, so its next merge of main will conflict there. To resolve it, apply the same edits to the matching code in api-startup.mjs, and read settings from the env argument rather than process.env, so the in-process startup checks see them. Production behaviour is the same either way, because server.mjs passes process.env. I'm happy to do the port and push it if that helps.