[stevenlee-oai]

OCE automatically applies a required Gateway tool/action policy to dedicated OC and Codex deployments after ordinary Agent and plugin grants are composed. The policy comes from the saved deployment revision, is reapplied on Gateway peer restart, and cannot be widened by plugin grants. Unsupported runtimes remain unready.

The baseline keeps scoped tasks, sessions and ordinary scheduling for model turns while withholding administrative Gateway tools and command-job authority. Model choices remain session-scoped and cron scripting stays disabled. Direct human Gateway administration and native Codex tools remain available. Policy changes activate through restart or deployment replacement after affected old work ends; Harness-local configuration, credential and process protection remains separate work.

Pins OC cee236c9, including the merged Gateway policy and child setup changes plus capture repairs #181458 and #181494. Keeps Node 24.22.1, stock Codex 0.163.0-alpha.2 and client-store persistence. Configures Codex’s known workspace path before node pairing so binding does not also change the Codex plugin configuration. Implements RFC 21 items 6–7 and OCE activation in item 8; item 9 tracks qualification.

Shared OpenClaw upgrade. This PR remains draft until an embedded Gateway recovers unattended after OCE verifies the previous Gateway stopped. The replacement must reuse the same volume, wait for the Agent database to be ready, and answer its first chat with HTTP 200 and READY. If OCE cannot verify termination, an operator must confirm it before recovery. The existing test kills the old container and waits for it to exit. At 4d79fbca, the replacement failed that first chat. Restart test · CI result.

Verification

• Source/test head 40666176 passes workspace-binding, TLS and Pod-IP startup checks, plus first-Agent smoke. Full typechecking, focused lint/formatting and 54 plugin-runtime cases passed for the unchanged production code. Production code is unchanged since 3de5b569; later commits change test polling or RFC status only.
• Fresh AMD64 images from d308b55c passed the original unchanged workspace hot-load test and both TLS controls (no skips or model requests). Existing polling bounds, production readiness guards and original hot-load assertions are preserved.
• All four carried patches apply. The CEE build passed four worker-authority regressions and packaged import checks; later builds reuse those unchanged native inputs through normal cache. Actual image binaries and provenance were verified.
• CI at 40666176 and native AMD64/ARM64 verification target 40666176. Native runtime checks pass 153/154 on each architecture; the embedded unclean-restart case is the only failure. The CPU-contention probe passed on retry. Both original local API-key/OpenShell qualification cases pass on the d308b55c images: 1 pass, 0 failures/skips each (OC eight model turns; Codex seven). They cover Harness work, scheduling, refused administrative effects with human controls, restricted children and narrower-policy replacement. Frozen source/image identity and scoped cleanup were independently verified. Codex preserves OC history while reconstructing its native thread; command-conversion model coverage is schema-only. Permissions, assertions and budgets are unchanged.
• P0 integration's independent correctness and design reviews found no actionable source issues. The canonical native review runner could not initialize inside its required isolation; no completed canonical review is claimed.

The recovery drafts cover dedicated Gateways. They bind the native owner to its container and require proof that the container stopped. The Docker Engine checks passed for storage isolation, authenticated status and termination. Automatic recovery still needs a supporting runtime, trusted deployment wiring and a replacement test on each provider. OC #181813 · OCE #3355.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR applies an OCE-owned Gateway tool ceiling to dedicated deployments and restores it before Gateway startup and peer respawn.

Example: A dedicated Codex Agent receives tools.alsoAllow containing plugins and diffs.

• Before: Ordinary plugin grants have no separate OCE-owned tool ceiling.
• After: Neither tool becomes model-accessible unless the admitted Gateway policy permits it, and Gateway administrative tools remain prohibited.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The patch is coherent and no discrete defect was found, but the required deployed authority evidence is absent and existing-state compatibility is unqualified.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Product

Kind: Feature · Worth it: Yes · Fix scope: Complete
User problem: Dedicated Agents can inherit Gateway capabilities beyond the deployment owner's intended task surface.
Reason: The maintainer-authored direction and linked RFC discussion support a default dedicated-Gateway ceiling, with human administration and Harness-local policy explicitly separated.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep this PR open: it delivers a useful, owner-supported runtime boundary absent from main, and inspection found no concrete introduced defect.

Priority: P2
Reviewed head: a58d72e4d226ec2c5671ddad2b4e82c6d891f475

Before merge

• Add real behavior proof - Authority-chain proof required: the body reports native startup, validation and peer-recovery success, but explicitly leaves live Agent-turn execution pending. Provide redacted terminal output or logs showing allowed Harness tasks and schedules, denied foreign or command-job effects, and retained callbacks or queued authority invalidated before I/O after tightening or reassignment. Also demonstrate upgrade from the prior supported runtime with settings and session/transcript state intact; fresh startup does not establish that compatibility. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Resolve security concern: Qualify retained authority at the final effect - The change adopts policy checks spanning model callbacks, automation grants and queued mutations. Source checks and focused dependency tests support the design, but supplied evidence does not yet show deployed OCE rejection after authority is tightened or reassigned before the final effect.
• Resolve merge risk - The adopted authority boundary remains unqualified at final tool effects and when retained automation authority encounters policy tightening or ownership changes.
• Add data-model compatibility proof - The review found that existing stored data may not work after upgrade. Show that existing data still loads and works with this change.

Findings

• [medium] Qualify retained authority at the final effect — apps/controller/src/drivers/compute/gateway-tool-policy.ts:260

Tests

• Missing end-to-end proof: The added deployed Agent scenario has not been shown passing for both Harnesses, and retained-authority invalidation plus an existing-state runtime upgrade remain unproved.

Agent review details

How this fits together

Compute takes an admitted AgentRevision, composes plugin configuration, and launches the Gateway; the pinned OpenClaw runtime enforces the resulting tool and automation restrictions.

flowchart LR
  Revision[Admitted AgentRevision] --> Compute[Compute Driver]
  Compute --> Plugins[Plugin composition]
  Plugins --> Policy[Gateway policy ceiling]
  Policy --> Gateway[Native Gateway]
  Gateway --> Dispatch[Tool and automation authorization]
  Dispatch --> Effect[Permitted task effects]

Loading

Technical review

Best possible solution:

Land the scoped policy through the existing Compute and upstream enforcement owners after qualifying final-effect authorization and existing-state upgrades.

Do we have a high-confidence way to reproduce the issue?

Current main source establishes the missing shared ceiling: it has dedicated-Codex exclusions but no OCE-admitted Gateway policy applied across the selected launchers; no runtime reproduction was executed during this review.

Is this the best way to solve the issue?

The implementation uses the existing Compute lifecycle and upstream dispatch owners, preserves narrower restrictions, and keeps native Codex capabilities separate; this is a coherent solution for the stated Gateway scope.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 40aff8f1d1ac.

Merge-risk options

Maintainer options:

1. Qualify the enforcement boundary (recommended)
   Provide allowed and nearest-forbidden final-effect evidence through dedicated OCE Agents, including retained authority invalidated before execution after policy tightening or ownership reassignment.
2. Keep the implementation in draft
   Retain the scoped work while deployment qualification and existing-state compatibility evidence are completed.

Provenance checked

• Dedicated Codex Gateway-local exclusions keeps the original intent (7e831ba: Keep filesystem and shell tools in the Harness rather than executing against Gateway-local state; later work also excluded Gateway administration and memory flush.)
• Writable peer recovery keeps the original intent (fix(compute): retain writable Gateway peer recovery across restarts #1993: Recover generated peer configuration from the admitted snapshot while preserving unrelated native human edits across peer and container restarts.)
• Runtime source and packaging changes intended behavior with a stated reason (48909e7: Pin the runtime contract needed for dedicated Codex children and align archive provenance, packaging and startup assertions; this PR explains the replacement pin as required for Gateway enforcement.)
• Codex plugin defaults and dependency pin keeps the original intent (5d616f9: Default native plugins off and enable successful selections using stock Codex; the refreshed patch retains the selected alpha.2 version across the renamed patch history.)
• MCP on-request preservation backport keeps the original intent (f795e48: Preserve named approval policy identity for managed requirements; the selected upstream implementation now contains that behavior.)
• Provider full-access and expired setup-code bridges keeps the original intent (fix(openshell): select explicit Codex full-access permissions #2515: Use the outer Sandbox's explicit permissions while honoring native refusal; the separate reconnect bridge retains saved-token-first recovery after setup-code expiry.)

Testing

Proof path: in-process harness.

Security

Needs attention: No concrete authorization bypass was found, but final-effect qualification of the new policy boundary remains outstanding.

Evidence

Security concerns:

• [medium] Qualify retained authority at the final effect — apps/controller/src/drivers/compute/gateway-tool-policy.ts:260
  The change adopts policy checks spanning model callbacks, automation grants and queued mutations. Source checks and focused dependency tests support the design, but supplied evidence does not yet show deployed OCE rejection after authority is tightened or reassigned before the final effect.
  Confidence: 0.94

What I checked:

• Current main lacks this integration: Fetched main still pins OpenClaw 90d30a1178a79dddd92e6190b66b95d89dfb3ca8 and retains the earlier dedicated-Codex exclusions rather than the new shared Gateway ceiling. (deploy/runtime/Dockerfile:1, 40aff8f1d1ac)
• Introduced policy and lifecycle integration: The pinned introduced diff intersects effective policy with admitted policy, forces caller-scoped automation, excludes Gateway-local Codex tools, and validates runtime support before startup and peer respawn. (apps/controller/src/drivers/compute/gateway-tool-policy.ts:226, a58d72e4d226)
• Owner direction and bounded scope: Discussion on RFC-0021: Define the runtime contract for OCE-managed deployments #2367 supports default restrictions for dedicated Harnesses while preserving human experimentation; this maintainer-authored PR explicitly limits delivery to Gateway capabilities and intentionally refuses unsupported runtime images.
• Qualification exists but execution remains pending: The new real-runtime scenario exercises authenticated chat, Harness shell execution, owned schedules, foreign-job denial, command-job denial and human positive controls; the complete PR body explicitly states that live Agent-turn qualification remains pending. (tests/integration/sandbox-driver-openshell-k3d-real.test.mjs:6058, a58d72e4d226)
• Dependency contract and policy apply: The runtime recipe builds this exact dependency commit, establishing applicability of its repository policy. Its Gateway assertion checks captured and active policy, and the Codex callback validates final arguments before execution. (src/agents/gateway-tool-policy.ts:123, 22fab2739047)
• Automation authority reaches commit guards: The adopted runtime checks model command-job restrictions before enqueueing and carries a mutation guard into reservation; focused dependency tests cover policy tightening and retained authority, but do not establish deployed OCE qualification. (src/gateway/server-methods/cron-run.ts:40, 22fab2739047)

Likely related people:

• Steven Lee: Raw commit 5d616f9 adds deploy/runtime/stock-codex-0.163.0-alpha.1-dependency-pin.patch:1 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 5d616f90e808; files: deploy/runtime/stock-codex-0.163.0-alpha.1-dependency-pin.patch)
• freeqaz: Raw commit 7e831ba adds apps/controller/src/drivers/compute/kubernetes/runtime-entrypoints.ts:2019 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 7e831ba3779e; files: apps/controller/src/drivers/compute/kubernetes/runtime-entrypoints.ts)
• Kevin: Raw commit 12fddc4 adds apps/controller/src/drivers/compute/kubernetes/runtime-entrypoints.ts:49 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 12fddc4805a1; files: apps/controller/src/drivers/compute/kubernetes/runtime-entrypoints.ts)

Labels

Label changes:

• add P2: This is a meaningful runtime-policy improvement without evidence of a current emergency or urgent shipped regression.
• add merge-risk: 🚨 compatibility: The new ceiling changes available tools and startup requirements while upgrading the native runtime; rejecting unsupported images is intentional, but existing-state upgrade behavior remains unverified.
• add merge-risk: 🚨 security-boundary: The change alters model tool and automation authority, with final-effect qualification still pending.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P2: This is a meaningful runtime-policy improvement without evidence of a current emergency or urgent shipped regression.
• merge-risk: 🚨 security-boundary: The change alters model tool and automation authority, with final-effect qualification still pending.
• merge-risk: 🚨 compatibility: The new ceiling changes available tools and startup requirements while upgrading the native runtime; rejecting unsupported images is intentional, but existing-state upgrade behavior remains unverified.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Attach final-effect evidence for permitted work, the nearest forbidden caller, and retained authority after tightening or reassignment.
• Demonstrate the native runtime upgrade preserves existing settings and session/transcript state.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 16, 2026, 4:31 PM ET / 20:31 UTC.

[freeqaz-openai]

One concrete test-oracle issue to fix before an expensive live run: the human command positive control can pass even when the Gateway says it did not run. Reproduction and a bounded fix are inline. This was a focused review of the OpenShell qualification test and pinned Gateway response contract, not a whole-PR security verdict; the existing final-effect and upgrade requirements remain open. No cluster, model call, credential, command job or CI rerun was used for the reproduction.

Withdrawing only my stale change request: the author corrected the positive-control attribution in 39e8f8e and I verified it in discussion_r4299217046. This is not whole-PR approval; live authority, upgrade, and independent review requirements remain.