Repository navigation
Allow custom OpenAI-compatible endpoints for native OpenClaw - #2755
roboclaw-bot merged 16 commits into
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
sunnymodi
changed the title
clawsweeper
Bot
added
clawsweeper:intake:feature
|
Codex review: needs maintainer review before merge. What this changesThis PR allows dedicated native OpenClaw Agents to use custom HTTPS model endpoints bound to an OpenShell CredentialSource. Example: Run native OpenClaw with kimi-k3 at https://api.fireworks.ai/inference/v1.
Review scores
ProductKind: Feature · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep this PR open: it adds a useful capability still absent from main, and review found no introduced defect or remaining proof blocker. Priority: P2 Before mergeNone. FindingsNone. Agent review detailsHow this fits togetherOCC authorizes Agent deployment, Kubernetes Compute projects the native model configuration, and OpenShell releases credentials only through the source-owned endpoint profile. flowchart LR
A[Agent deployment] --> B[OCC authorization]
B --> C[Kubernetes Compute]
D[CredentialSource endpoint] --> E[OpenShell profile]
C --> F[Native OpenClaw worker]
F --> E
E --> G[Bound model endpoint]
Technical reviewBest possible solution: Land the source-owned endpoint extension while retaining OpenAI-only destinations for Secret-backed native authentication. Do we have a high-confidence way to reproduce the issue? Current-main source explicitly rejects custom native endpoints; no target code was executed during this review. Is this the best way to solve the issue? The implementation extends the existing Compute projection and Credential Gateway attachment path, reuses URL normalization, and preserves source-owned credential destinations. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 4c99bb8a38db. Provenance checked
TestingProof path: shipped entry point. SecurityNone. EvidenceWhat I checked:
Likely related people:
Review metrics
Root-cause clusterRelationship: Members:
Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything. LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment HistoryReview history (5 earlier review cycles)
Reviewed October 25, 2026, 11:43 AM ET / 15:43 UTC (Revision 6). |
|
Free's clanker here (an AI agent working on Free's behalf). First review of Credential custody
Today this is latent rather than exploitable: the OpenShell sandbox refuses Blocking CIStatic Checks is red on this head: three docs exceed the 2500-word hard limit ( Smaller points
Verified
|
|
Free's clanker here (an AI agent working on Free's behalf). I approved CI for this PR. The only failure is in Console Browser 2: |
|
Cleared the rebase conflicts by merging current Additional fixes:
Verification: 513 focused tests passed, 0 failed, 1 explicit runtime-image skip; the previously failing phone Agents-list browser case passes. Typecheck, lint, formatting, docs and independent P0–P2 review pass. Final-head live-runtime proof and the endpoint-policy decision remain merge gates; this stays draft. |
|
@clawsweeper re-review |
|
🦞👀 Re-review progress:
|
|
Moving this to "Ready for review" to get it mergeable, ty @sunnymodi |
Co-authored-by: sallyom <11166065+sallyom@users.noreply.github.com>
Co-authored-by: sallyom <11166065+sallyom@users.noreply.github.com>
Co-authored-by: sallyom <11166065+sallyom@users.noreply.github.com>
Co-authored-by: sallyom <11166065+sallyom@users.noreply.github.com>
Match the current CredentialSource contract so native endpoint preparation exercises the supported ownership path after the upstream merge. Co-authored-by: sallyom <11166065+sallyom@users.noreply.github.com>
Keep current lifecycle behavior and source-bound endpoint documentation together. Preserve older changelog entries in the existing linked history to keep the flow within its word limit. Co-authored-by: sallyom <11166065+sallyom@users.noreply.github.com>
clawsweeper
Bot
added
status: 📣 needs proof
|
Codex coordination for @stevenlee-oai's OCE 1.0 Model Primitive work: @sunnymodi, I am starting the per-Agent endpoint/manual-model work from #3050 and checked this PR at |
Restrict Codex-token exemptions to the selected native file and explicit native helper bootstrap. Keep other OpenShell workflows fail-closed. Support requirements-free exposure withdrawal, normalize expected native endpoints, and extend the existing native workflow with worker-restart coverage. Co-authored-by: sallyom <11166065+sallyom@users.noreply.github.com>
|
Fixed all three review issues in
Scope stays limited to custom base URLs and OpenAI-compatible models for the native Harness using the existing source-owned credential path. This follow-up adds no production Driver, contract, authorization or image-pin changes. 610 focused tests pass, 0 fail, 1 explicit runtime-image skip; repository checks and independent P0–P2 review pass. The new real-cluster restart assertion remains unrun here because no selected k3d/database/runtime environment exists; earlier local proof is preserved at its actual head. |
|
@clawsweeper rereview |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
rating: 🦐 gold shrimp
|
On behalf of @sallyom: confirmed that the local DeepSeek |
|
@clawsweeper rereview |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
proof: sufficient
|
Live A/B proof (2026-10-25) at
This is targeted live k3d proof with the upstream fix applied; the repository runtime pin is unchanged. |
Problem
Dedicated native OpenClaw rejects custom OpenAI-compatible endpoints even when an OpenShell CredentialSource is bound to the endpoint. This refresh rebases the existing feature onto current main and removes its standalone RFC.
Change
openaicatalog and source-owned credential path. No new primitive, public Driver contract, provider ID, model-discovery mechanism, image pin or arbitrary Secret-backed destination is introduced../scripts/k3d test|demo --harness openclaw --base-url … --model-id …. The selected endpoint is shared by the native model catalog and its OpenShell CredentialSource; explicit flags override inherited and prepared settings. Native-only preparation requires its API key without an unrelated Codex token.openaialias and normalized HTTPS port-443 endpoints ending in/v1forcredential_sourceauthentication only. Secret-backed keys remain restricted tohttps://api.openai.com/v1; every OpenShell native catalog endpoint must match its source.ea1616f3fto clear conflicts, preserving original authors, endpoint restrictions, current lifecycle behavior and prepared-Git fixture options. Publication uses an exact-head lease against the verified previous PR head.653711e5e. This extends the existing bundled Compute/OpenShell implementations under their established configuration and CredentialSource ownership contracts, rather than introducing a new Driver contract.ownerCapability: "credential_gateway"field to the native conformance fixture. Without it, the real Compute ownership check refuses the stale fixture before endpoint projection. No production ownership check was weakened.Original implementation: @sunnymodi.
Work sessions
Verification
Current candidate:
d825ca81a6ff3b36c75eff3bb4cf2e335b736190. The native k3d launcher and proof-fixture updates follow the rebase onto upstreamea1616f3f148076663aa02eb6f2b92b025820a50.Native k3d helper and worker restart proof (2026-10-25)
The native helper path requested in the latest proof review passes on
d825ca81a6ff3b36c75eff3bb4cf2e335b736190: 1 passed, 0 failed, 0 skipped, 355.0 seconds, with Fireworks Kimi K3 through the Responses API.OCC_K3D_CONTAINER_ENGINE=docker \ ./scripts/k3d test --harness openclaw \ --base-url https://api.fireworks.ai/inference/v1 \ --model-id kimi-k3The authorized
OPENAI_API_KEYwas supplied privately; no Codex credential was supplied. A read-only process observer confirmed the effective native model, endpoint and runtime selector.OCC_K3D_OPENCLAW_SOURCEselected a clean upstream OpenClaw checkout atf8386bc7df0a6c9eda7a28ae81943c5c06a414ff. The helper built that source and the current OCE controller, imported them, and prepared/migrated its owned database. The passing invocation reused that prepared cluster, database and images after the environment corrections below.This uses the helper's documented test-only OpenShell compatibility bridge, unchanged from the reviewed source. It ran on Linux/amd64 with Docker 29.1.3 in an isolated daemon/network namespace because this machine's existing web service occupies port 443. No test ports were published to the host. This qualifies the shipped helper/fixture path; the earlier Helm/API deployment proof has its separately recorded scope.
The native restart assertion stops and resumes OCC's worker, then requires
worker.harness-exposure-withdrawnfor the exact Agent/revision without another preparation pass. It passed. The two subsequent native Gateway model turns each returned HTTP 200 and the expected nonce. Ownership, mounts, privileges, raw-credential absence, native workspace access and embedded admission refusal also passed. The shared test's printed title includes Codex; this command and the observed process environment select its nativeopenclawbranch.Redacted terminal output, with teardown chatter omitted:
Verification summary and image/source receipts (the model and restart outcomes summarize assertions in the unmodified passing native branch):
{ "head": "d825ca81a6ff3b36c75eff3bb4cf2e335b736190", "completedAt": "2026-10-25T07:00:51.969Z", "architecture": "linux/amd64", "selectedHarness": "openclaw", "model": "openai/kimi-k3", "endpoint": "https://api.fireworks.ai/inference/v1", "transport": "openai-responses", "codexCredentialSupplied": false, "runtimeSource": "f8386bc7df0a6c9eda7a28ae81943c5c06a414ff", "runtimeSourceTree": "c3bfa9c71325407260c24bc9372ec89e210b6089", "bridge": "Unmodified integration-only bridge in sandbox-driver-openshell-k3d-real.test.mjs, selected by scripts/k3d test --harness openclaw.", "registeredTest": { "tests": 1, "passed": 1, "failed": 0, "skipped": 0, "durationMs": 354977.497086 }, "assertedOutcomes": { "nativeHarnessOwnershipMountsAndPrivileges": true, "rawModelCredentialAbsentFromHarnessAndGateway": true, "nativeWorkspaceFileAccess": true, "workerRestartExposureSweep": true, "gatewayModelTurns": 2, "bothHttp200AndNonceMatched": true, "embeddedOpenShellAdmissionFailsClosed": true }, "sourceHashes": { "apps/controller/src/drivers/compute/kubernetes/index.ts": "0170e5b2279d367e90527079d2a90ffcf75bd963cd36e583697425d4ab583db8", "apps/controller/src/drivers/credential-gateway/openshell.ts": "4d24bcc96bb9df6be66d53e4c34f799e84d9da2f58dae7a46c4744ee541b44d0" }, "testSourceSha256": "cc6231b98abb1e6d203d9574b029d00cce0d38b36a53fe0eb01be76a9b99a6be", "images": { "controllerImageId": "sha256:33ebd3261395eac8c72b24124274f07f90d60ba20e60c348a2fcadbe6b3d0f90", "runtimeImageId": "sha256:e6857d4b35d2a077f857e23d7d4126d1c19a4ba851799e298bceb0bb38dca7d9", "selectedController": "localhost/openclaw-ci-image-openclaw-ci-local-84a658af3922/controller@sha256:7d88029cf9e44e39f4a4133fa6765e6d43cf0098d623470373a862012102c7ec", "selectedRuntime": "localhost/openclaw-ci-image-openclaw-ci-local-84a658af3922/runtime@sha256:f306c182122369b3e514ae5e74a4363837282edf9efda2a46f77092ebd22073e" }, "environment": { "engine": "Docker 29.1.3 in an isolated daemon/network namespace", "hostPortsPublished": false, "runner": "Current-head image-provided dependencies; already installed pg 8.23.1 exposed at the workspace root; automatic dependency installation disabled", "sourceChanges": false, "productionPinsChanged": false }, "cleanup": { "helperClusterAndDatabaseRemoved": true, "isolatedDaemonAndDataVolumeRemoved": true, "privateStateRemoved": true, "temporaryDependencyLinksRemoved": true, "sourceCheckoutClean": true, "publishedHostPorts": [] } }Earlier setup failures are retained: pnpm attempted an automatic reinstall and refused without a terminal; the standard host relay could not bind the occupied port 443; and the production dependency graph exposed
pgunder the controller while the test imports it at the workspace root. The runner disabled automatic installation withpnpm_config_verify_deps_before_run=false, used an isolated daemon, and exposed the already installedpg@8.23.1at the root after checking it equals the root's pinned version. No host dependencies were installed or reconciled. The passing case also records the existing initial-route HTTP 503 retry. No production code, registered test, assertion, timeout or image pin was changed to obtain the result, and no source commit was created.The helper removed its cluster/database; the isolated daemon, data volume and private state were then removed. Temporary runner links were removed, leaving the checkout clean. Existing OCE, Mastra and the web service were preserved. DeepSeek Responses remains unqualified; this run establishes Fireworks/Kimi Responses compatibility for this helper path.
Review repairs (
d825ca81a, 2026-10-23)gpt-6.1-sol, medium), three-pass review of the complete current PR delta is scoped-clean for P0–P2. This is source review, not live-runtime qualification or formal GitHub approval.476d134de. Existing feature flows remain accurate, so no new runtime flow is added.Dedicated OpenShell Agent proof (
d825ca81a, 2026-10-24)Native OpenClaw/OpenAI and dedicated Codex/OpenAI passed. Native DeepSeek passed using chat completions, but its Responses attempt failed on the pinned runtime with an unresolved worker-transcript error. The passing rows below do not establish general compatibility with open models or qualify DeepSeek's Responses path.
These are real dedicated Agents through OpenShell, using repository runtime pin
f8386bc7df0a6c9eda7a28ae81943c5c06a414ffand Codex0.163.0-alpha.2on Linux/arm64 with Podman. The native cases use the normal Kubernetes-only Helm deployment and regular provisioning API, with no runtime source override or native fixture adapter.openai-completions; authorized provider key and source-bound private endpointgpt-6-astra;openai-responses; OpenAI API key; sourcebase_urlomittedgpt-6-astra; official OpenAI endpoint; OpenAI API keyNative deployment and verification. The current-head
occ dev upselected Podman, Kubernetes Compute, the Kubernetes-only control plane and OpenShell, with explicit existing controller/runtime images. It installed OCC and PostgreSQL through Helm and passed its network-isolation checks. The normalPOST /namespaces/:namespaceId/agents/provisionAPI created each dedicated Agent, Configuration, source grant, transport and revision. Native verification follows the existing native first-Agent workflow and its real Gateway/worker verifier.Both native cases verified the exact runtime image configuration in containerd, provider-owned Sandbox/Pod identity, source access without an underlying Secret grant, workspace reads/writes through OCC, and model-driven
execin the actual worker. Normal redeployment produced different Sandbox and Pod UIDs while retaining storage, modified workspace files, the same session ID/key, and the session-file SHA-256. Real model and worker execution passed again in each replacement. These are manual E2E checks of the deployed workflow; the full first-Agent test lane is not claimed.Codex verification. The registered test used current-head host-run OCC composition with real Kubernetes/OpenShell workloads, the pinned runtime and a fresh migrated database. Prepared kubeconfig/image/database selectors and the authorized
OPENAI_API_KEYwere supplied privately:It passed authenticated Codex WebSocket exposure, real model/shell turns, ownership/mount/privilege and credential-absence checks, filesystem/egress enforcement, policy update/revocation and recovery, credential routing, replacement, upstream/gateway outage recovery, refresh and non-model sources, live credential withdrawal, embedded fail-closed behavior and authenticated native policy scopes. This selects API-key authentication, not the Codex-PAT full CI lane.
Failures and limits retained. DeepSeek with
openai-responsesprovisioned successfully but failed its real worker turn withworker transcript commit rejected. Normal reconfiguration did not complete before that failed test Agent was stopped; recovery from that failure is not claimed. A fresh Agent usingopenai-completionspassed the complete before/after-replacement proof above. The passing DeepSeek row therefore qualifies chat completions only, not its Responses path; the root cause of the Responses failure listed below.openai-responseserror is fixed in openclaw/openclaw mainopenclaw/openclaw#170461 was absent from local tests, this is the fix for the openai-responses error. Fixes the limitation of response ID length. This is not an issue with this PR's addition of custom base-url, and it is fixed with the updated openclaw checkout that includes 170461.
The launcher suite also passes: 27 passed, 0 failed, 0 skipped. CI-selection audit passes. The prepared images and normal deployment remain available.
Rebase verification (
653711e5e, 2026-10-23)pnpm typecheck,pnpm lint,pnpm format:check,pnpm check:workspace,pnpm openapi:check, CI-selection audit, the owning flow validator and PR-diff whitespace checks pass. Root dependencies still match; the current frozen docs dependency graph was prepared in the isolated worktree.pnpm docs:check: 290 pages / 4562 links, 511 Markdown files with no hard-limit violations, 96 specifications / 23 RFC numbers / 744 local targets. Large owning pages remain coherent single flows or Driver references (2486, 2472 and 2493 words); Manual Notes and older dated records are preserved, using the existing linked flow history.git range-diffwas inspected. The production endpoint added/removed lines are identical to the pre-rebase feature delta; upstream startup/restart behavior is retained. There is no RFC file or native-endpoint RFC index/lookup reference in the final tree.gpt-6.1-sol, medium) review of the frozen current PR delta is scoped-clean for P0–P2. It is source/diff review, not runtime qualification or a separate assessment of the RFC-removal commit.Pre-rebase live proof (
c25610c2d, 2026-10-23 UTC)A disposable Linux/amd64 Kubernetes/OpenShell stack was rebuilt from pre-rebase head
c25610c2d. This evidence is retained for that head, not relabeled as qualification of the new rebased candidate. The deployed Compute and Credential Gateway source hashes match the reviewed checkout. OpenClaw uses repository pinf8386bc7df0a6c9eda7a28ae81943c5c06a414ff; no runtime-source override, compatibility bridge, isolation bypass or timeout change was used. The registered test ran with the fresh controller image's installed dependencies, current-head tests/scripts mounted read-only, and the real CLI, Docker, kubectl and k3d binaries. Codex and Fireworks credentials were supplied privately.node --test --test-name-pattern='a local Kubernetes installer' tests/integration/local-first-agent-openshell-k3d-real.test.mjsThe passing registered workflow covers Codex startup/reuse, native Kimi guided provisioning with a source-bound custom endpoint, real model and required-worker
execturns, replacement with a different provider-owned Sandbox/Pod, retained settings and workspace files, and the exact same session ID/key and session-file SHA-256 after replacement. The original Agent keeps no underlying Secret grant.A separate native Kimi turn launched the endpoint probe: the bound Fireworks path returned HTTP 200 and the Kimi model; a sibling path outside the bound prefix returned HTTP 403 with OpenShell's explicit L7 denial. Source withdrawal then completed through the regular API. A fresh native model turn failed while the same OpenClaw PID/start time, Pod UID and zero restart counts remained unchanged. The worker process started before the API's withdrawal request. OpenShell recorded DNS and transparent-TCP policy denial after withdrawal.
Redacted terminal evidence (synthetic test identifiers; no credentials, IPs, private endpoints, machine paths or model transcripts):
{ "head": "c25610c2d1699deb38ceece86941e4eda663cb62", "architecture": "linux/amd64", "openclawSourcePin": "f8386bc7df0a6c9eda7a28ae81943c5c06a414ff", "sourceHashes": { "apps/controller/src/drivers/compute/kubernetes/index.ts": "b0377e7c57bdd6ad0b68964b22cdb15b837d1e8122900cd0a97b096a508e01d8", "apps/controller/src/drivers/credential-gateway/openshell.ts": "4d24bcc96bb9df6be66d53e4c34f799e84d9da2f58dae7a46c4744ee541b44d0" }, "images": [ "docker.io/library/openclaw-enterprise-runtime@sha256:a1ee87b97c1428bc9dddcef15ddb0bb5b521a2bda1e1dfc0a5d47d590a662f2e", "docker.io/openclaw-development/openshell-supervisor@sha256:f55a8de4e520721ebee5bfa7d9dfe2daeedad10b918591810308afea16bc2f24", "docker.io/library/openclaw-enterprise-controller@sha256:bce74876aac49f6d869a4d413f7dbc2080ec80f061194234b0e9cab65fb9f73e", "docker.io/openclaw-development/openshell-gateway@sha256:da60351c19329a22e4077d214cc11b73fc5c0f70610f1fc00b16261b912080d4" ], "registeredTest": { "passed": 2, "failed": 0, "skipped": 0 }, "nativeRedeployment": { "beforeHostname": "os-78691e419a1b0101", "afterHostname": "os-d863868ad5650ee4", "sameSessionId": "a7a90614-bc13-4a2d-aef9-d08a6daf9f87", "sameSessionKey": "agent:main:first-agent-native-aeaf4339-0f60-4845-ba24-5b38dc1abb7a", "retainedSessionFile": ".first-agent-native-07158802-7fe6-4f58-aa9f-89118582b771.txt", "retainedSessionFileSha256": "312fe7d8e3ebf7db22ffebf060d672c32b6824534870105315156377d819021b" }, "credentialBoundary": { "allowed": { "status": "200", "exit": "0", "model": "accounts/fireworks/models/kimi-k3", "endpointMismatch": false, "credentialRevoked": false, "credentialNotFound": false, "credentialUnavailable": false }, "denied": { "status": "403", "exit": "0", "model": null, "endpointMismatch": false, "credentialRevoked": false, "credentialNotFound": false, "credentialUnavailable": false, "policyDenied": true }, "withdrawal": { "state": "revoked", "reason": "CREDENTIALS_WITHDRAWN", "requestedAt": "2026-10-23T01:20:26.186Z", "completedAt": "2026-10-23T01:20:27.710Z" }, "after": { "status": "000", "model": null }, "sameProbePid": false, "samePodAndRestarts": true, "sameWorkerProcess": true, "workerProcessPredatesWithdrawal": true, "workerProcess": "189 Fri Oct 23 01:17:54 2026 openclaw", "probeLimitation": "The waiting shell ended while the collector was paused. The withdrawn-endpoint probe uses a new process in the same sandbox; the native OpenClaw worker started before withdrawal and remains running. The separate native model turn recorded below failed." }, "postWithdrawalModelTurn": { "attempted": true, "runId": "425737d0-fe4f-447f-bae5-34b45e73a933", "status": "error", "assistantErrors": 1, "startedAt": "2026-10-23T01:24:22.447Z", "endedAt": "2026-10-23T01:24:36.870Z", "sameWorkerProcessAfterModelTurn": true, "samePodAndRestartsAfterModelTurn": true }, "previousAttempt": { "head": "c25610c2d1699deb38ceece86941e4eda663cb62", "result": "failed", "cause": { "code": "RUNTIME_MODEL_PROBE_FAILED", "kind": "PROBE_STATUS", "detail": "unknown" }, "initialNativeProof": true, "networkPolicyAllowedRequest": true, "providerHttpRejectionObserved": false, "diagnosticAfterFailure": "credential delivery removed after failed deployment; separate diagnostic timed out", "recorded": "2026-10-23T01:04:13.401Z" }, "withdrawalPolicy": { "denialReasons": [ "policy_dns_ineligible", "transparent_tcp_policy_denied" ] } }The disposable cluster and its credential state were removed after verification. The pre-existing OCE/Mastra installation remains running, and prior Docker quickstart tags were restored. The source checkout is unchanged.
Failures and collection limits are retained: the first current-head registered attempt failed at replacement startup with
RUNTIME_MODEL_PROBE_FAILED / PROBE_STATUS: unknown; its initial native proof passed, and OpenShell permitted the outbound request. The cause remains unclassified. After deleting only that attempt's disposable Agents, one unchanged retry passed all assertions. The supplementary collector initially expected an older HTTP-form denial log and was corrected to match the observed HTTPS line. During that pause the waiting shell ended, so the same shell PID is not claimed: the post-withdrawal endpoint request used a new process in the same sandbox. The separately verified, unchanged native OpenClaw process and its failed new model turn establish withdrawal from the running worker. No production or registered-test source was changed for these checks.Previous local checks (
c25610c2d)node --test tests/conformance/kubernetes-compute.test.mjs tests/integration/credential-source-api.test.mjs tests/integration/sandbox-driver-startup.test.mjs: 513 passed, 0 failed, 1 skipped. The skipped native initializer requires an explicitly selectedOCC_TEST_RUNTIME_IMAGE; it was not run here.node --test --test-name-pattern="On a phone the Agents list" tests/browser/console-agents-list-return.test.mjs: 1 passed, 0 failed, 0 skipped, using headless Chromium and the supported console fixture. This addresses the latest review's failing case; it is not deployed-runtime proof.pnpm typecheck,pnpm lint,pnpm format:check,pnpm check:workspaceandpnpm openapi:checkpass. Frozen root/docs dependencies were explicitly prepared in the isolated worktree; manifests and lockfiles are unchanged.pnpm docs:check: 289 pages / 4545 links, 509 Markdown files with no hard-limit violations, 97 specifications / 24 RFC numbers / 746 local targets. The three large owning pages remain single coherent flow or Driver references: 2500, 2472 and 2469 words. Manual Notes and historical records are preserved.node scripts/ci/run-tests.mjs auditandgit diff 9063f24f3 --checkpass. The owning flow validator passed during conflict resolution.Independent Codex (
gpt-6.1-sol, medium) review of the frozen final branch against9063f24f3: scoped-clean for P0–P2, with no actionable findings. A previous attempt invalidated by changing local verification output was discarded.Risks
Current-head source/helper checks and independent review pass. The native k3d helper and worker restart proof now pass with the documented fixture bridge. The separately recorded three dedicated Helm/API scenarios pass on the repository-pinned runtime without that adapter. Native DeepSeek is qualified with chat completions; its Responses turn failed at worker transcript commit, and recovery from that failure remains unqualified. Earlier dated evidence remains limited to its recorded heads. The local E2E results do not establish production-environment or published-image qualification.
Fresh CI and the required eligible GitHub review must be checked at the published head before merge. No merge, deployment, default-image publication or change to the human-selected ready-for-review state is performed by this update. The RFC stays removed; this work does not add a broader endpoint-authority mechanism.
Earlier risk/status notes (historical)
Risks
Pre-rebase live proof at
c25610c2dis recorded above, including the failed first attempt and the passing unchanged retry. The first replacement's model-probe failure remains unclassified; the successful retry proves the supported workflow but does not establish that startup failures cannot recur.Pre-rebase CI, CodeQL and Observability checks pass. The QA Matrix Advisory workflow still requires maintainer approval and is not included in the live qualification above. Keep this PR draft. The standalone RFC is removed as requested; broader merge-blocker assessment will follow separately. This rebase does not automatically clear existing review findings or establish new-head runtime qualification. No production, ARM64, default-image or full protected-QA qualification is claimed. No database schema or persisted OCC resource format change is introduced.
Earlier implementation and runtime evidence (predates this refresh)
Dedicated native OpenClaw rejects custom OpenAI-compatible model endpoints even when an OpenShell CredentialSource is already bound to that endpoint. This change supports the existing
openaialias with a configured HTTPS endpoint on port 443 ending in/v1, including nested prefixes, forcredential_sourceauthentication only. Secret-backed API keys remain restricted tohttps://api.openai.com/v1.Kubernetes Compute reuses the existing URL normalizer, preserves model-level URLs, and enforces the authentication boundary at admission and preparation. OpenShell requires every native catalog endpoint to match the bound source endpoint, including its path. The source profile continues to own credential-substitution authority; Agent configuration cannot move the key to another endpoint.
RFC-0023 was submitted at
dea6916aabefore implementation continued and remains proposed. It was renumbered from RFC-0021 after upstream assigned that number to another proposal. Maintainer feedback is requested on this bounded extension. Existing provider IDs, API selectors, tool permissions, default image pins and publication policy are unchanged.Review fixes and simplification
7eebfc12cwith the expected missing-refusal assertion and passes with the fix.team/model, checks normalized per-model URL projection and completions transport, and uses a genuine credential-source delivery context rather than a raw-key context.defaultenvironment provider; the prior undefinedmodelalias caused an actual HTTP 400 during guided provisioning. The one-word fix passes formatting, lint and isolated P0–P2 review.20fa2f8fawithout rewriting published history. Resolved the documentation conflicts while preserving upstream lifecycle requirements, kept the owning pages within the 2500-word cap, and reconciled the RFC index and numbering.Verification
Current head:
88df65bada94a85fff7fd50eb0728423b58dbb31, merged with upstream20fa2f8fa.Conflict-resolution checks pass: documentation validation (269 pages / 4255 links), Markdown length validation (478 files, no violations), specification validation (90 documents / 23 RFC numbers / 699 local targets), the owning flow validator, workspace boundaries, CI selection audit, and
git diff --check. The documentation changes add no runtime behavior. Full code validation belongs to fresh CI with the updated dependency graph; local dependencies were not installed or reconciled for this refresh.The following proof predates this merge and is not final-head runtime qualification:
46b68a44f0f5ec13eff7cd5fccf33d1c51e445d7contained the one-word provider-file environment fix. Its preceding production candidate passed 493 tests, 0 failed, 1 skipped across Kubernetes Compute conformance, CredentialSource API integration and Sandbox startup.Prior live Fireworks proof (
46b68a44f)A separate loopback-only Kubernetes/OpenShell stack used candidate
46b68a44f's images. Rebuilding after the test-only commit produced identical image IDs. Runtime source is the repository pinf8386bc7df0a6c9eda7a28ae81943c5c06a414ff; no compatibility bridge or runtime source override was used.execturns, replacement with a different provider-owned Sandbox/Pod, retained settings and files, and the exact same session ID/key and session-file SHA-256 after replacement.openaiCredentialSource. The required-worker assertions pass before and after replacement.accounts/fireworks/models/kimi-k3. A sibling path outside/inference/v1returned 403, corroborated by OpenShell'sL7_REQUEST ... not permitted by policyevent.revoked/CREDENTIALS_WITHDRAWN. A subsequent model turn failed; OpenShell recorded DNS and transparent-TCP policy denial for Fireworks. The native worker PID/start time remained identical, predated withdrawal, and its Pod had zero restarts. No deployment or process replacement was used to establish withdrawal.Immutable images used:
docker.io/library/openclaw-enterprise-controller@sha256:298aa866bfb9f7897850e27cd9a17684f72163e99be022045c30a75915d78ff7docker.io/library/openclaw-enterprise-runtime@sha256:5341e06369b1cceffff3f5cef9e3c66714633391d0a2cc6dd0c5d329f5077475Failures retained and remaining gates
Keep this PR draft:
RUNTIME_MODEL_PROBE_FAILED(PROBE_STATUS: unknown) on the replacement. Repeating the exact probe inside that same Sandbox succeeded without changing the credential or configuration; a normal recovery deployment also succeeded. The original cause remains unclassified.action_required). The successful prior-head CI run tested46b68a44f, not this merge commit. Credentialed native/OpenShell proof has not been repeated after the upstream merge.No database schema or persisted OCC resource format changes are introduced. Existing default-endpoint admission/delivery remains covered; the live recovery proof additionally verifies retained session data across replacement. No credentials, private endpoints, transcripts or machine paths are included here.