[freeqaz]

Problem

An Agent tool policy that allows personal_instructions with a list of actions (for example actions: ["get"]) saves, but the pinned OpenClaw fails every model turn with "Gateway tool policy requires personal_instructions to declare a top-level string action field". The tool declared its action as a union of literals, which has no top-level type: "string", so the policy cannot narrow it. openclaw/openclaw#186395 declares it as a string enum, like the other action tools. It is merged as b0961419e46.

Change

• Source. deploy/runtime/openclaw-source.json selects b0961419e46b72a7b5e0b5f3fd509b58d1bbfbfc, upstream main at the #186395 merge (49 commits after 8e328edad39). Upstream CI passed on that commit. I did not take the later upstream commits: they include a change to how same-requester steering keeps its prepared permissions (fix: same-requester guidance queues after reconnecting openclaw#186378) that needs its own review, and nothing OCE needs. The source archive SHA-256 and build timestamp are updated; two downloads gave the same hash.
• Package version 2026.10.7 -> 2026.10.8 (upstream release close-out): WORKSPACE_DEFAULTS_VERSION and the runtime README. The workspace templates did not change, so WORKSPACE_DEFAULTS_ID stays.
• Agent database schema 37 -> 38 (fix(database): split punctuation-joined tokens in PostgreSQL keyword search like SQLite FTS5 openclaw#183547, PostgreSQL keyword search; SQLite only records the new version). OPENCLAW_AGENT_DATABASE_SCHEMA_VERSION moves with it, so the startup wrappers run Doctor on agent databases at 37 before the Gateway starts, as for earlier schema moves. The shared state schema stays 35.
• Runtime patches. Five of the six patches apply unchanged, so their hashes stay. openclaw-control-ui-browser-reconnect.patch needed a context-only rebase in app-shell-view.tsx (upstream added session rows above the patched line, fix(ui): identify source sessions in approval titles openclaw#186030) and a moved hunk offset in layout.css; the patch content is the same. New hash in the Dockerfile, build-runtime-assets.mjs and the runtime image test. Upstream does none of the patches' work yet, so none is dropped.
• Pin bookkeeping. GATEWAY_TOOL_POLICY_SOURCE_COMMIT, the workspace defaults source comment and the upstream Dockerfile link move to the new commit.
• OpenShell adoption shim removed. The new agent schema version is part of the dedicated Codex workspace-node program, so the program changes. The pre-fix(runtime): prepare private node state on setgid volumes #3872 adoption shim (Adopt existing Codex workspace-node Sandboxes after the state permission fix #3888, test(openshell): cover protected and cross-admission adoption of pre-#3872 sandboxes #3894) rebuilds the old program from the current one and compares it with two pinned hashes, so after any program change nothing can match it (Image Runtime Startup 2 failed on the pinned hash). As its TODO asks, this PR removes the shim, its pins, matchesWorkspaceNodeStateUpgrade and its test case. openshell.ts, runtime-entrypoints.ts and sandbox-driver-startup.test.mjs are byte-identical to their state before Adopt existing Codex workspace-node Sandboxes after the state permission fix #3888, and the flow doc drops the adoption sentence.
• Docs. The two source links in docs/flows/configuration-driver/persistence-and-revisions.md pointed at each other's files: "the settings rules" now links configuration-settings.ts and admitGatewaySecurityDefaults links gateway-security-defaults.ts. docs/guides/deploy/breaking-changes.md gets a 2026-10-28 entry: a dedicated Codex Agent's OpenShell Sandbox created before this upgrade is refused when OCC provisions that version again, until a new version is deployed (it names the refusal message and the step).

OCE had no save-time refusal or doc caveat for personal_instructions actions, so there is nothing to remove.

Verification

• CI lanes. All 22 jobs passed on a remote test VM with CI's lanes and CPU budgets, on head be672b02b8, with no cached results: CI Required PASS (static, the baseline, browser, Postgres and Keycloak lanes, images-runtime-startup 1/2/3, images-packaging, runtime-image-fixture, the k3d lanes, logging-collector) and First Agent Smoke pass. The image build runs the patched Control UI bridge tests. GitHub CI Required is green on the same head.
• Patches. All six patches apply in Dockerfile order to the verified source of b0961419e46; the Control UI patch was rebased with a three-way apply, and its content is unchanged.
• Finding 2683, on runtime images built from this PR and from main (the real Gateway tool policy code and the real personal_instructions tool from the image's bundled OpenClaw, policy allow: ["personal_instructions"], actions: { personal_instructions: ["get"] }):

	main (8e328edad39)	This PR (b0961419e46)
Declared action schema	anyOf of two const strings	{type: "string", enum: ["get", "set"]}
Policy narrowing	throws "Gateway tool policy requires personal_instructions to declare a top-level string action field"	action.enum is ["get"]
Execution check	get allowed, set denied	get allowed, set denied
actions: []	tool withheld	tool withheld

OCE's save-time validation accepts the policy. An embedded Gateway with this policy, started by the runtime wrapper beside a stand-in model provider, answered a chat turn on both images, with and without code mode. In that check the model called tool_describe and dispatch_action for personal_instructions and got "Unknown tool id": OpenClaw adds the tool only when the Gateway has two or more user profiles, so a single-user Gateway never builds it and never reaches the failing narrowing. The failure applies to shared Agents with several users.

• OpenShell adoption. sandbox-driver-startup.test.mjs passes (123 tests) on the remote test VM with the shim removed.
• Doctor and Gateway startup measurements were not repeated for this bump.

Risks

• 49 upstream commits. The image lanes and First Agent Smoke cover the Gateway, Harness, workspace node, state migration and recovery paths.
• security.preset: src/config/security-presets.ts and merge-missing.ts did not change between the pins, so the preset fills the same keys and OCE's two filled values still apply. No new code reads the preset or the two settings.
• Tool policy qualification. I read upstream's tool-policy enforcement diff between the pins. gateway-tool-policy.ts, the Codex dynamic tool catalog and the automation caller-scope code did not change, and no core tool was added. Changes that reach OCE's allowed tools:
  • personal_instructions now declares {type: "string", enum: ["get", "set"]} (this fix).
  • automations (fix: keep conversation prompts stable across continuation turns openclaw#186338): a conversation that continues a scheduled run now keeps the full action list instead of the self-only list; the execution guard still scopes each call. The full list now also names scratch_get, scratch_set, record_result and next_check. OCE's baseline already lists next_check and does not list the other three, so the policy keeps them out. No action OCE allows changed meaning.
  • MCP tool filters (fix(mcp): stop hiding tools selected by probe name openclaw#186108) now also match a server tool's probe alias. An exclude hides every possible owner; an include selects only a unique one. This does not touch tools.gatewayPolicy.
• The models.providers.*.remote setting is new (watchdog timing only). It is an addition, so no saved Configuration changes meaning.
• Existing dedicated Codex OpenShell Sandboxes. Driver adoption requires the exact Sandbox spec, and this program change (like any OpenClaw schema move, for example build(runtime): bump openclaw to 97a1b4c0733 #3860) means a Sandbox created before the upgrade is refused when its revision is provisioned again; redeploying the Agent creates a new one. The removed shim only ever covered the fix(runtime): prepare private node state on setgid volumes #3872 transition.
• Image publication from main remains a separate step.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

Updates the bundled OpenClaw source to fix action-restricted personal instructions, advances the Agent schema gate to 38, and refreshes patch provenance and documentation links.

Example: An Agent allows personal_instructions with actions ["get"].

• Before: Every model turn fails because the tool's action schema lacks a top-level string type.
• After: The tool schema can be narrowed to get while the existing execution policy continues to deny set.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The focused pin update has clear value and no established code finding, but changed-path authorization proof and Agent-schema upgrade evidence are unfinished.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: A saved get-only personal-instructions policy prevents the Agent from completing any model turn.
Reason: The source establishes a supported-policy failure, and the collaborator-authored PR supplies the owner decision to adopt the upstream repair.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep this PR open: it carries a useful upstream fix that current main lacks, and its maintainer-authored direction is approved; no discrete introduced code defect was established.

Priority: P2
Reviewed head: 22318e86d90069d9edbaae62bdc671b1a7717710

Before merge

• Add real behavior proof - Authority-chain proof required: at head 22318e8, show the shipped runtime completing a model turn with personal_instructions restricted to get, rejecting set before mutation, and rejecting an unauthenticated caller before file access; the PR currently promises this check without supplying results, and evidence must redact credentials and non-public endpoints. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Resolve security review attention item - No concrete authorization or supply-chain regression was established, but the repaired personal-instructions path still needs final-effect authorization evidence.
• Resolve merge risk - Before merge, the author must establish that the newly usable personal-instructions path enforces the narrowed action grant and rejects an unauthenticated caller before personal-file I/O.
• Add data-model compatibility proof - The review found that existing stored data may not work after upgrade. Show that existing data still loads and works with this change.

Findings

None.

Tests

• Missing end-to-end proof: Supply the built-image model-turn and denied-action/caller scenario, required native image receipts, and retained-state upgrade results; the existing migration suite covers older released fixtures, while a failing-before/passing-after regression for this policy is not shown.

Agent review details

How this fits together

OCC validates saved Agent configuration and composes Gateway policy; runtime images supply the upstream tools, while startup wrappers migrate retained Agent databases before starting OpenClaw.

flowchart LR
  A[Saved Agent configuration] --> B[OCC policy validation]
  B --> C[Runtime startup wrapper]
  D[Retained Agent database] --> C
  C --> E[OpenClaw Doctor]
  E --> F[Gateway and Harness]
  F --> G[Personal instructions tool]

Loading

Technical review

Best possible solution:

Adopt the upstream schema repair through the existing runtime pin and migration owners after policy-boundary, upgrade and required native-image verification is complete.

Do we have a high-confidence way to reproduce the issue?

The old tool declaration and inspected Gateway narrowing code establish the reported exception for a get-only policy; the linked upstream PR also records the same before-and-after probe, but this review ran no target code.

Is this the best way to solve the issue?

Updating the pinned dependency uses the existing owner and repairs the incompatible schema without duplicating policy logic; the schema gate and patch hashes move consistently with it.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 7f9d3e849803.

Merge-risk options

Maintainer options:

1. Verify the repaired policy boundary (recommended)
   The author supplies runtime-image evidence that get succeeds, set cannot modify personal instructions under a get-only grant, and an unauthenticated caller cannot access the file.

Provenance checked

• Runtime source and tool-policy qualification pin keeps the original intent (d409e3c: build(runtime): bump openclaw to 8e328edad39 #3903 adopted an upstream Doctor startup optimization while preserving runtime patches and qualification metadata.)
• Agent schema startup gate keeps the original intent (5db2b47: The prior runtime update selected schema 37; existing startup documentation requires the constant to follow the pinned upstream schema.)
• Control UI reconnect patch keeps the original intent (110aea3: The existing bridge preserves browser reconnection after access refusal; the introduced diff changes upstream context and offsets while retaining its added behavior.)

Testing

Proof path: none.

Security

Needs attention: No concrete authorization or supply-chain regression was established, but the repaired personal-instructions path still needs final-effect authorization evidence.

Evidence

What I checked:

• Pinned PR edits: The introduced diff changes the source pin, schema constant, package-version metadata, reconnect-patch context and matching hashes; the workspace content identity remains unchanged. (deploy/runtime/openclaw-source.json:2, 22318e86d900)
• Current main still uses the affected source: Fetched main selects 8e328edad391017cca518fc32084a4064f3cbd2b, preceding the linked upstream repair. (deploy/runtime/openclaw-source.json:2, 7f9d3e849803)
• Upstream fix and dependency boundary: The runtime manifest executes this repository's source, making its tool contract applicable. fix(agents): personal_instructions fails every turn when a Gateway tool policy lists its actions openclaw#186395 replaces the literal union with stringEnum(["get", "set"]); the inspected policy rejects the old schema, and the tool retains authenticated-caller checks. (src/agents/tools/personal-instructions-tool.ts:20, b0961419e46b)
• Existing migration owner: The shared startup helper compares retained database versions against the pinned schema and invokes Doctor before runtime startup; the PR correctly advances that gate to 38. (apps/controller/src/drivers/compute/runtime-startup.ts:72, 22318e86d900)
• Verification remains unfinished: The full PR body still describes runtime-image policy verification as in progress; discussion contains only bot status comments and supplies no additional behavior or upgrade evidence. (22318e86d900)
• Image verification state: Image Runtime Startup 2 failed, other image work remained in progress, and ordinary CI skipped Native Container Verification. The failed job's log redirected to a blocked storage host, so its cause could not be attributed to this diff. (.agents/skills/local-dev/references/image-version-verification.md:3, 22318e86d900)

Likely related people:

• Free Wortley: Raw commit a01e09d adds apps/controller/src/drivers/compute/runtime-startup.ts:61 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: a01e09d5b0c5; files: apps/controller/src/drivers/compute/runtime-startup.ts)
• stevenlee-oai: Raw commit 36fb718 adds apps/controller/src/drivers/compute/gateway-tool-policy.ts:17 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 36fb7180e5d1; files: apps/controller/src/drivers/compute/gateway-tool-policy.ts)

Labels

Label changes:

• add P2: The failure breaks every model turn for an explicitly configured personal-instructions action policy, with limited configuration scope.
• add merge-risk: 🚨 security-boundary: The repaired path accesses authenticated users' personal instructions, and final-effect evidence for denied actions and callers remains outstanding.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P2: The failure breaks every model turn for an explicitly configured personal-instructions action policy, with limited configuration scope.
• merge-risk: 🚨 security-boundary: The repaired path accesses authenticated users' personal instructions, and final-effect evidence for denied actions and callers remains outstanding.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 27, 2026, 9:00 PM ET / October 28, 2026, 01:00 UTC.

[freeqaz]

Free's clanker here (an AI agent working on Free's behalf).

Independent review of this bump: no blocking issues.

• The source archive re-downloads to the pinned SHA-256, and buildTimestamp equals the commit time. All six patch hashes match the files, the Dockerfile, build-runtime-assets.mjs and the image test. The reconnect patch changes only its index lines, hunk headers and two context lines.
• Upstream's tool-policy enforcement files did not change between the pins, and neither did the set of core tool names. The new automations actions (scratch_get, scratch_set, record_result) fall outside the reviewed baseline, so the policy narrows them away and denies them. next_check was already allowed, and the self-scope guard still checks every call in a continued scheduled-run conversation.
• With the shim removed, openshell.ts, runtime-entrypoints.ts and sandbox-driver-startup.test.mjs are byte-identical to before Adopt existing Codex workspace-node Sandboxes after the state permission fix #3888. No later main commit touched them, and nothing still references the removed code.

I pushed c45fd34 (docs only). It adds a 2026-10-28 breaking-changes entry: a dedicated Codex Agent's OpenShell Sandbox created before this upgrade is refused when OCC provisions that version again, until a new version is deployed. CI Required and First Agent Smoke pass on that head.