[freeqaz]

Problem

OpenClaw's Doctor (openclaw doctor --fix) copied memory-core's state-operation code into a private generation directory every time it loaded a plugin doctor contract, four times per run, and could never use the copy. Doctor runs before a Gateway starts on migrated state and takes about a quarter of the images-runtime-startup-3 lane. openclaw/openclaw#186274 skips the copy for the doctor-contract loaders. It is merged as 8e328edad39.

Change

• Source. deploy/runtime/openclaw-source.json selects 8e328edad391017cca518fc32084a4064f3cbd2b, upstream main at the #186274 merge (350 commits after 97a1b4c0733; the only later upstream commit is a Control UI test). The package version stays 2026.10.7. The source archive SHA-256 and build timestamp are updated to match.
• Runtime patches. Five of the six patches apply to the new source unchanged, so their hashes do not change. Upstream does not yet do what any of them does, so none is dropped. The Codex dependency pin still holds Codex at 0.163.0-alpha.2.
• openclaw-control-ui-browser-reconnect.patch needed two changes:
  • One hunk is rebased onto upstream's new early-Gateway store (perf(ui): overlap chat startup with Gateway connection openclaw#185683).
  • fix(ui): recover quickly when spotty connections return openclaw#186325 added a second caller of probeGatewayReachability(): page-activation recovery, which replaces a stalled transport when the probe finds the Gateway. It reads the result as a boolean. The patch changes the result to "live" | "access-denied" | "unavailable", and every value is truthy. Unchanged, the page would replace its connection every 2-3 seconds during an outage. The patch now compares the result with "live" there too and adds a test that a refused probe (401) does not count as a live Gateway.
  • The image build now also runs gateway-page-activation.test.ts with the other bridge tests, so a later caller like this one fails the build.
• Pin bookkeeping. GATEWAY_TOOL_POLICY_SOURCE_COMMIT, the workspace defaults source comment and the upstream Dockerfile link move to the new commit. Between the two pins, upstream's tool-policy enforcement code changes only in ways OCE's policy does not depend on (listed under Risks). The OpenClaw schema versions (agent 37, shared state 35), the workspace templates and the files the runtime assembly packages do not change.

Security preset defaults: OCE keeps the earlier values

openclaw/openclaw#185477 adds security.preset (personal, the default, or corporate). The preset fills settings a configuration leaves unset, and an explicit setting overrides it (mergeMissing in src/config/security-presets.ts, applied by materializeRuntimeConfig). OCE set none of these settings, so two defaults would have changed for every OCE Gateway:

Setting	Before the bump	Personal preset	OCE now, when the Configuration leaves it unset
messages.queue.allowCollaborativeSteering	false: another participant's message during a running turn is refused	true: it steers the running turn, which keeps the first requester's authority	false
tools.exec.applyPatch.workspaceOnly	true	false	true
messages.queue.collaborativeSteeringFallback (new)	not applicable (refusal)	queue: with steering off, the message runs as its own turn under its sender	unset, so queue

• Where. Deployment admission (agentRuntimeConfiguration in packages/occ) now runs admitGatewaySecurityDefaults after the Sandbox Driver's configureAgent and before logging admission. It fills each setting only when it is unset. Every Compute Driver (Kubernetes, Docker, SSH) renders the Gateway document for both embedded and dedicated Gateways from this AgentRevision snapshot, and dedicated composition (managedGatewayConfiguration) keeps both settings. So one helper (packages/occ/src/gateway-security-defaults.ts) covers every path; no Driver has a copy. The first-Agent helper uses the same function to check the revision it deployed.
• Explicit values win. Like the preset, admission fills only unset settings: a value the Configuration sets is kept, and so is a non-object on the setting's path. The Gateway refuses a non-boolean value or a non-object there at startup, so neither can loosen the setting.
• Not set: security.preset (OCE keeps personal; corporate needs per-session Docker sandboxing, which OCE Gateways do not have) and collaborativeSteeringFallback (with steering off, upstream's default is queue; the earlier behaviour was a refusal, which "reject" restores). The other preset values match the earlier defaults.
• Why at admission, not in each Driver's rendering. Kubernetes ConfigMaps, Docker's configuration-hash label and SSH snapshots are immutable per revision, and maintenance re-prepares the active revision. Changing the rendering would refuse every revision prepared before the upgrade until its next deployment.
• Existing Agents. A revision deployed before the upgrade keeps its document, so its Gateway uses the preset defaults until the Agent is deployed again. docs/guides/deploy/breaking-changes.md has the notice and the step (deploy each Agent again). The Configuration reference and the revision flow say what admission adds.
• Decision. Keep the earlier behaviour (option 2 of the earlier draft): a dependency bump does not loosen these settings silently. A maintainer can still choose upstream's defaults instead.

Verification

• CI lanes. All 22 jobs passed on a remote test VM with CI's lanes and CPU budgets, on head ebecc731c5, with no cached results: CI Required, the browser lanes, images-runtime-startup 1/2/3, images-packaging, runtime-image-fixture, the k3d lanes and First Agent Smoke. The image build ran the bridge tests, including the four Control UI files (98 tests).
• Security defaults: tests. A new configuration-occ test deploys embedded OpenClaw and dedicated Codex Agents through real OCC admission: with both settings unset, the revision holds allowCollaborativeSteering: false and workspaceOnly: true; explicit true/false in either combination are kept; a non-boolean value and a non-object tools are kept as written. The admission expectations in the conformance, integration and Postgres helpers now include the two settings, plugin-runtime-policy checks that dedicated composition keeps both, and first-agent-startup checks that the first-Agent helper expects them. With the fill removed, 10 tests fail.
• Security defaults: running Gateway. On a remote test VM, the OCE runtime image (images-runtime-startup-2 prepare) ran an embedded Gateway through the Docker Compute Driver, and openclaw config get inside the container read the effective values:

Revision document	allowCollaborativeSteering	collaborativeSteeringFallback	applyPatch.workspaceOnly	security.preset
Admitted, Configuration leaves both unset	false	queue	true	personal
Same Configuration without the fill (before this change)	true	queue	false	personal
Admitted, Configuration sets true / false	true	queue	false	personal

• Patch fix proof. On the patched upstream source, the four Control UI bridge files pass (98 tests), and oxfmt --check and the two UI type-check graphs pass. Without the page-activation hunk, four page-activation tests fail: three upstream tests and the new 401 test.
• Doctor, old pin 97a1b4c0733 against 8e328edad39. These used upstream images built from each commit's verified archive with upstream's Dockerfile. openclaw doctor --fix ran on the released-state fixture on 4 dedicated CPUs, with old and new interleaved. Each value is the median of 3. CPU is the container cgroup's usage_usec.

Doctor on the released-state fixture	Old pin	This PR
First run: CPU-s	66.7	58.7 (−12%)
First run: wall time	49.4 s	41.9 s
Second run (already migrated): CPU-s	67.0	57.0 (−15%)
Second run: wall time	52.3 s	45.6 s

• Gateway startup, main at this PR's base (3669dc9890) against this PR. Both used OCE runtime images built by the images-runtime-startup-2 prepare step. They ran at the same time on separate sets of 8 CPUs. Each value is the median of 3.

Scenario	Old pin	This PR
Smoke Gateway: CPU-s to /readyz	25.39	25.40
Smoke Gateway: ready wall time	14.5 s	14.4 s
Smoke Gateway: memory at ready	1.19 GiB	1.21 GiB
Smoke Gateway: CPU-s in the 30 s after ready	7.9	9.4
Startup probe, 1 CPU: ready wall time	27.8 s	28.9 s
Startup probe, 1 CPU: memory at ready	1.14 GiB	1.21 GiB
Startup probe: first turn wall time	24.3 s	27.4 s
Startup probe: peak memory through the first turn	2.26 GiB	2.31 GiB

Gateway startup cost does not change. After ready, the Gateway's worker threads use about 1.5 CPU-s more in the first 30 s, in all 3 runs. The 1-CPU ready time and the first turn are slightly slower, but the runs overlap (first turn 22.1-24.9 s before, 24.3-27.6 s after).

Risks

• About 350 upstream commits since 97a1b4c0733. The image lanes and First Agent Smoke exercise the Gateway, Harness, workspace node, state migration and recovery paths. A real-model dedicated deployment was not repeated.
• Agents deployed before the upgrade run with the personal preset values until they are deployed again (breaking-change notice). With steering off, another participant's message now runs as its own turn instead of being refused.
• The Gateway tool policy source qualification moves with the pin. I read upstream's enforcement diff, not the whole range. Three changes reach OCE's allowed tools. None adds a tool or an action, so the allowlists and the action-tool list do not change:
  • process sessions are scoped to the session that started them. A spawned child session can also manage its ancestor sessions' processes in the same agent; unrelated session trees cannot (fix: child sessions cannot access ancestor process handles openclaw#185832).
  • Operator tools.invoke calls no longer run agent loop detection (fix(gateway): prevent tools.invoke calls from creating false agent loop warnings openclaw#186104).
  • The configuration reload plan includes security.preset.
• The extra worker-thread CPU after ready and the slower first turn on 1 CPU are small, but CI's CPU-limited image lanes will show them if they persist.
• Image publication from main remains a separate step.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR updates the bundled OpenClaw source and adapts the reconnect patch to its new page-activation caller.

Example: Page-activation recovery receives HTTP 401 from the Gateway health probe.

• Before: Applying the old bridge unchanged would treat its truthy access-denied result as live and replace the connection.
• After: Recovery replaces the connection only when the probe returns "live".

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The introduced reconnect repair is coherent, but authority qualification and the expressly unresolved default policy prevent a merge-ready assessment.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Product

Kind: Performance · Worth it: Yes · Fix scope: Complete
User problem: Doctor performs unnecessary plugin-code copying during runtime state preparation.
Reason: The maintainer-authored optimization has measured upstream value; the separately reserved security-default choice still needs resolution.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep this maintainer-authored draft open: the Doctor optimization is useful, but adoption of the upstream security defaults remains explicitly undecided.

Priority: P2
Reviewed head: 30d7ca09ba921d958a6b048cbb80444eb66b2ac5
Owner decision: Required. See Decision needed.

Decision needed

• Question: Should OCE adopt upstream's personal-preset steering and apply-patch defaults, preserve its earlier defaults, or defer this source bump?
• Recommendation: Preserve the earlier defaults: Fill only unset values with collaborative steering disabled, fallback rejection and workspace-only apply-patch behavior in both runtime topologies.
• Why: The maintainer-authored draft explicitly leaves this narrower choice unresolved, and dedicated-only composition cannot settle the embedded Gateway behavior.

Before merge

• Add real behavior proof - Authority-chain proof required: exercise the selected OCE image through embedded and dedicated Gateway ingress, showing allowed collaboration and rejection of an unauthorized participant before provider or tool effects, including revocation while input is queued or awaiting adoption; upstream evidence does not qualify OCE's composition, and the required native image checks are skipped. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Resolve security review attention item - The source bump changes steering authority and filesystem defaults without a settled OCE adoption decision.
• Resolve merge risk - OCE's effective tool policy is not yet qualified for cross-participant steering that retains the incumbent requester's authority.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

None.

Provenance

• Gateway tool-policy qualification: original intent not found (36fb718: feat(runtime): apply Gateway tool policy to dedicated OCE deployments #2633 constrains dedicated Gateway tools and actions; updating the qualification marker does not itself establish the new collaborative-authority behavior.)

Tests

• Missing end-to-end proof: Supply OCE allowed, forbidden and revoked-participant final-effect evidence, stable-settings upgrade coverage and native image receipts; execution of the new regression red before and green after is not shown.

Agent review details

How this fits together

The runtime build combines pinned OpenClaw source with OCE patches; deployed Gateways consume Agent configuration and persistent state to serve conversations and execute tools.

flowchart TB
  A[Pinned OpenClaw source] --> C[Runtime image build]
  B[OCE runtime patches] --> C
  C --> D[Embedded or dedicated Gateway]
  E[Agent configuration and state] --> D
  D --> F[Conversation and tool execution]

Loading

Technical review

Best possible solution:

Keep the Doctor optimization while preserving OCE's earlier defaults through existing composition owners in both topologies, retaining explicit authored overrides.

Do we have a high-confidence way to reproduce the issue?

The upstream diff identifies the unused Doctor capture and the preset materialization path; upstream records runtime measurements, while this review ran no target code.

Is this the best way to solve the issue?

The reconnect adaptation is focused, but a broad source update needs an explicit OCE default policy rather than implicitly absorbing the personal preset.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against f23078f220f8.

Merge-risk options

Maintainer options:

1. Preserve OCE defaults before landing (recommended)
   Have the runtime owner retain the prior unset-value behavior across embedded and dedicated Gateways.
2. Accept the upstream trust posture
   Have the runtime owner explicitly accept the changed defaults after OCE authority qualification.
3. Hold the source update
   Defer this draft while retaining the current runtime pin.

Provenance checked

• Runtime source pin and provenance bookkeeping keeps the original intent (5db2b47: build(runtime): bump openclaw to 97a1b4c0733 #3860 updated the runtime for startup savings while retaining explicit source and patch provenance.)
• Browser reconnect bridge keeps the original intent (e45c5a9: Help an open Gateway tab reconnect after sign-in expires #3044 offers browser navigation after an established connection encounters access refusal.)

Testing

Proof path: unit tests only.

Security

Needs attention: The source bump changes steering authority and filesystem defaults without a settled OCE adoption decision.

Evidence

What I checked:

• Verified introduced change: The pinned introduction changes the runtime source, reconnect bridge, bridge-test selection and matching provenance values; the three base-only paths are outside this PR's edits. (deploy/runtime/openclaw-source.json:2, 30d7ca09ba92)
• Explicitly unresolved direction: The complete REST-read body retains VERIFICATION_NOTE and RISKS_NOTE placeholders and expressly asks maintainers to accept, override or defer the personal-preset defaults; the discussion contains no decision resolving that choice. (30d7ca09ba92)
• Dependency contract and changed defaults: OCE builds and executes this pinned dependency, making its runtime contract applicable. security-presets.ts defaults collaborative steering on and applyPatch.workspaceOnly off; materialize.ts applies these defaults, while mergeMissing preserves explicit authored values. (src/config/security-presets.ts:7, 8e328edad391)
• Upstream authority semantics and evidence: feat: make busy-session messages automatic with coherent security presets openclaw#185477 explicitly describes collaborative input retaining incumbent execution authority and records real Gateway authority, revocation and stable-upgrade scenarios; this supports the upstream design but does not establish OCE runtime qualification. (src/sessions/session-controller.message-join.ts, 25da76e48174)
• Doctor optimization has concrete value: improve(doctor): stop copying bundled plugin operation code on every Doctor contract load openclaw#186274 scopes the skipped operation-source capture to Doctor loaders and reports lower CPU consumption across fresh and released-state scenarios, including a 2026.10.8 upgrade. (src/plugins/doctor-contract-registry.ts, 8e328edad391)
• Reconnect adaptation preserves the existing owner: The added comparison handles the new upstream caller without adding a recovery owner; its focused 401 regression uses the existing page-activation setup and real browser-client implementation with simulated transport. (deploy/runtime/openclaw-control-ui-browser-reconnect.patch:227, 30d7ca09ba92)

Likely related people:

• stevenlee-oai: Raw commit 36fb718 adds apps/controller/src/drivers/compute/gateway-tool-policy.ts:143 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 36fb7180e5d1; files: apps/controller/src/drivers/compute/gateway-tool-policy.ts)
• Kevin: Raw commit 854b1dd adds deploy/runtime/openclaw-source.json:1 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 854b1ddf51e2; files: deploy/runtime/openclaw-source.json)

Labels

Label changes:

• add P2: This is a useful runtime performance update with a deliberate security-default choice, rather than an established urgent production regression.
• add merge-risk: 🚨 compatibility: Configurations that omit these settings receive different runtime behavior after the source update.
• add merge-risk: 🚨 security-boundary: The pinned preset enables cross-participant steering under incumbent execution authority and widens the default apply-patch filesystem scope.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P2: This is a useful runtime performance update with a deliberate security-default choice, rather than an established urgent production regression.
• merge-risk: 🚨 security-boundary: The pinned preset enables cross-participant steering under incumbent execution authority and widens the default apply-patch filesystem scope.
• merge-risk: 🚨 compatibility: Configurations that omit these settings receive different runtime behavior after the source update.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Prove an unauthorized or revoked participant cannot reach provider or tool I/O through queued or collaborative input in the selected OCE runtime.
• Complete the required native AMD64 and ARM64 image verification on the reviewed head.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 27, 2026, 7:12 PM ET / 23:12 UTC.

[freeqaz]

Free's clanker here (an AI agent working on Free's behalf). Independent review of head ebecc73: no blocking issues.

• The security defaults fill runs once in deployment admission, after the Sandbox Driver's configureAgent. It is the only source of AgentRevision.configuration, so every Compute path (Kubernetes embedded and dedicated, Docker, SSH) renders the filled document. At 8e328edad39 the preset fills only undefined keys at materialization, so the explicit values hold. Doctor and config writes do not rewrite them.
• Both callers of probeGatewayReachability() at the pin now compare against "live".
• No new core tools or action changes between the two pins. Archive and patch hashes match.
• Nit: docs/flows/configuration-driver/persistence-and-revisions.md has two swapped links. Line 25 ("the settings rules") should point at configuration-settings.ts, and line 125 (admitGatewaySecurityDefaults) at gateway-security-defaults.ts.