[freeqaz]

Problem

On a dedicated Codex Agent, a model turn started by an ordinary CLI or channel caller cannot get approval for an escalated command. The run's operator authority has operator.write but not operator.approvals. The Codex approval bridge creates the plugin approval, and the reviewer sees it. Then the bridge's plugin.approval.waitDecision call fails with "missing scope: operator.approvals". Codex then gets decline, whatever the reviewer chooses: when no verdict has arrived yet, the Gateway closes the approval as denied (approval-scope-closed) about 5 ms later. The model then tells the user that they rejected the command. Fixed upstream by openclaw/openclaw#186461, merged as ff7c37bed64.

Change

• Source. deploy/runtime/openclaw-source.json selects 762a2fe60cc37cf6b8c9d05e61c329866e0d3f6f, upstream main 102 commits after a3b12ef66cb. It includes #186461. The source archive SHA-256 is 296288aa…e5f6 (two downloads matched; the archive's file list equals the commit's tree) and the build timestamp is the commit time, 2026-10-28T10:45:30Z.
• Why not the head of upstream main. The next upstream commits need their own OCE change, so this PR stops at the last commit before them:
  • d1c8d42588a (refactor: rename Claws to Templates throughout OpenClaw openclaw#186457) moves the shared state schema from 35 to 36. OCE's startup migration constant and the dedicated Codex workspace-node program must move with it, with a breaking-changes entry for existing OpenShell Sandboxes (as for the agent schema in build(runtime): bump openclaw to b0961419e46 #3914).
  • fef5e6bfc48 (fix: remove personal and corporate security presets openclaw#186381) removes the unreleased security.preset setting. The Gateway then refuses a configuration that still sets it. OCE's console, docs and tests still describe personal and corporate, so the follow-up must refuse the setting at save and remove that text.
• Pin bookkeeping. GATEWAY_TOOL_POLICY_SOURCE_COMMIT, the workspace defaults source comment and the upstream Dockerfile link move to the new commit.
• Regression test. runtime-image-gateway-workspace.test.mjs gets a case for this: the packaged Gateway and Codex plugin, with a dedicated Agent's app-server policy (OPENSHELL_CODEX_APP_SERVER_POLICY, approvalPolicy: on-request), run against a fixture Codex peer. The peer asks to run /bin/bash -c 'touch /etc/oce-approval-probe' during a turn started by the Gateway CLI caller, which is write-scoped. A real approval client connected to the Gateway allows it once. The test checks that the reviewer receives the Codex request with that command, that the approval resolves as allow-once, that the peer gets accept, and that the run ends ok. Only the external Codex peer is a fixture. It runs in the container as one node -e program like the other Codex peer fixtures, so it does not import shared files. The test file uses the shared runtime-image helpers.
• No other change was needed:
  • The package version stays 2026.10.8. The agent and shared state schemas stay at 38 and 35, so there is no OpenShell Sandbox adoption change and no breaking-changes entry.
  • The workspace templates and upstream's Dockerfile did not change, so WORKSPACE_DEFAULTS_ID stays.
  • All six runtime patches apply unchanged, in Dockerfile order, so their hashes stay. Upstream does none of their work yet, so none is dropped. The Control UI reconnect patch still covers every caller of probeGatewayReachability. The locked Codex and Matrix crypto versions did not change.

Verification

• Regression test, red before and green after (a remote test VM, CI's images-runtime-startup lane, each image built from its own tree):
  • On main (a3b12ef66cb) with only the new test added, it fails: the reviewer receives the request and allows it once (plugin.approval.resolved, allow-once, by the approval client), but the Codex peer gets {"decision":"decline"}. The other five files of the lane pass.
  • On this PR it passes.
• CI lanes. 21 of 22 jobs passed on a remote test VM with CI's lanes and CPU budgets, on head 02b5149b0a (the later head changes only a test comment), with no cached results: static, baseline-2, the browser, Postgres and Keycloak lanes, images-runtime-startup 1/2/3, images-packaging, runtime-image-fixture, the k3d lanes, logging-collector and First Agent Smoke. checks-baseline-1 failed once in list-summaries.test.mjs ("Preset and revision lists return summaries"), an OCE-only in-memory test that does not use the runtime image; it then passed 10 of 10 runs at 2 CPUs on the same head. GitHub CI is the authority.
• Patches. All six patches apply in Dockerfile order to the source of 762a2fe60cc, unchanged.

Risks

• 102 upstream commits, 23 of them test, CI, docs or chore only. The image lanes and First Agent Smoke cover the Gateway, Harness, workspace node, state migration and recovery paths.
• Approval authority (fix: let write-only runs receive their native approval verdict openclaw#186461). A host-bridged plugin approval call from a synthetic client that is bound to the approval's owner and has write scope may now call plugin.approval.waitDecision as well as plugin.approval.request. It sees only its own run's approval: another run's wait still gets "approval expired or not found". The bridge still never gets reviewer scope or plugin.approval.resolve, and revoking the run's authority during the wait ends the wait with no decision. Runs with operator.approvals or admin scope are not affected.
• Unchanged here: compound bash -c commands (with ;&|<>) are still refused before review by the approval bridge's command binding check, with no reason shown. That is a separate upstream issue.
• security.preset and defaults. security-presets.ts and merge-missing.ts did not change between the pins. The preset fills the same keys, and OCE's admission fills still apply. No change to exec, sandbox or apply_patch defaults.
• Tool policy. The upstream files that read tools.gatewayPolicy did not change between the pins, and no core tool or action was added.
• Configuration schema. The only new settings are two optional keys of the bundled knowledge plugin (page budget, upstream ff2d7187a57). No setting OCE writes changed meaning.
• Session reads and startup. Collaboration reads (questions, reactions, typing, suggestions, process lists) now also check session membership (fix(gateway): check session membership for collaboration reads openclaw#184504). Session, board and metadata reads are served from read-only snapshots during the startup integrity check (fix(state): serve session reads during startup integrity inspection openclaw#186473). That change raises the normal SQLite worker carrier limit from three to five, which the memory-capped image lanes would show.
• Telemetry. A count-only request without identifiers can now follow a successful daily update check (feat(telemetry): count reporting installations without identifiers openclaw#186569). The Kubernetes Gateway wrapper sets OPENCLAW_NO_AUTO_UPDATE=1, which stops the daily check, so it sends neither. The Docker Compute Driver's Gateway wrapper does not set it: a Docker Gateway with internet access already sent the daily update check, and can now also send this count. telemetry.enabled: false or DO_NOT_TRACK=1 suppresses the count.
• The upstream Node engine range is wider (>=24.16.0); the runtime image's Node is unchanged.
• Image publication from main remains a separate step.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge.

What this changes

Updates the bundled OpenClaw source to restore approval verdicts for write-scoped Codex runs and adds a packaged Gateway regression case.

Example: A write-scoped Codex run requests approval for /bin/bash -c 'touch /etc/oce-approval-probe', and the reviewer selects Allow Once.

• Before: Waiting fails with missing scope: operator.approvals, and Codex receives decline.
• After: The originating run receives the allow-once verdict, and the Codex peer receives accept.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Useful approval repair with credible production-path evidence and preserved authority boundaries; required native image qualification remains incomplete.
Proof confidence	🦐 gold shrimp (3/6)	Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🐚 platinum hermit (4/6)	1 actionable review finding remain.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: A reviewer approves a command, but the Codex run receives a denial and tells the user they rejected it.
Reason: The maintainer-authored direction restores an existing approval workflow while preserving reviewer separation and live run ownership.

Merge readiness

⛔ Needs changes before merge - 1 item remains

Keep open: this maintainer-authored PR fixes a concrete approval failure still present on main; review found one small test-fixture defect and no production correctness defect.

Priority: P1
Reviewed head: 59aee9f57a76d110d10bdb15e03502dfabcaff60

Before merge

• Release the fixture's deadline timers after successful waits (P3) - When approval completes before the deadline, Promise.race leaves this referenced 60-second timer active; the earlier 30-second connection timer is retained too. Even after printing the result and closing the sockets, the node child cannot exit until those timers expire, so runDocker waits unnecessarily on every successful fast run. Cancel the losing timers or use unreferenced timers for both races.

Findings

• [P3] Release the fixture's deadline timers after successful waits — tests/fixtures/runtime-codex-command-approval.mjs:278-280

Tests

• Missing end-to-end proof: The reported red-before/green-after approval case is useful, but the required final-candidate native AMD64 and ARM64 controller/runtime build and startup evidence is missing.

Agent review details

How this fits together

OCE packages OpenClaw into its runtime image; the Gateway host bridge connects native Harness approval requests to authorized reviewers and returns verdicts to the originating live run.

flowchart LR
  A[Write-scoped run] --> B[Host approval bridge]
  B --> C[Gateway approval owner]
  D[Authorized reviewer] --> C
  C --> E[Ownership and live authority checks]
  E --> F[Codex peer verdict]

Loading

Technical review

Best possible solution:

Use the pinned upstream repair through the existing host approval bridge and retain the packaged Gateway regression.

Do we have a high-confidence way to reproduce the issue?

The old pin's request-only scope exception explains the failure, and the PR reports the matching decline on the pre-fix image and accept after the update; this review ran no target code.

Is this the best way to solve the issue?

Updating the dependency fixes the shared host bridge rather than adding an OCE workaround, and the integration case exercises the real packaged approval path.

Full review comments:

• [P3] Release the fixture's deadline timers after successful waits — tests/fixtures/runtime-codex-command-approval.mjs:278-280
  When approval completes before the deadline, Promise.race leaves this referenced 60-second timer active; the earlier 30-second connection timer is retained too. Even after printing the result and closing the sockets, the node child cannot exit until those timers expire, so runDocker waits unnecessarily on every successful fast run. Cancel the losing timers or use unreferenced timers for both races.
  Confidence: 0.99

Overall correctness: patch is correct
Overall confidence: 0.92

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against e42edb966655.

Provenance checked

• Runtime source qualification and matching references keeps the original intent (0afb1af: The previous update qualified upstream restart and shutdown repairs while keeping source identity and runtime-policy provenance synchronized.)
• Packaged Gateway integration lane keeps the original intent (8b01c66: Long Gateway cases were separated into this file to run alongside startup coverage; the new case retains that production-image boundary.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Pinned PR changes: The introduced diff updates the source manifest and matching provenance references, registers one integration case, and adds its external Codex peer fixture. (deploy/runtime/openclaw-source.json:2, 59aee9f57a76)
• Current main retains the affected pin: Fetched main still selects a3b12ef66cb923ff2bffe36ddf2a74ec397b00da, before the upstream approval repair. (deploy/runtime/openclaw-source.json:2, e42edb966655)
• Target-native regression evidence: The PR reports a red-before/green-after run using the packaged Gateway and Codex plugin: the reviewer allows the exact command, the peer receives accept, and the run completes successfully; only the external peer is simulated. (tests/integration/runtime-image-gateway-workspace.test.mjs:306, 59aee9f57a76)
• Dependency contract and authority evidence: The runtime recipe builds this dependency, and this PR relies on its host approval contract. The repair in fix: let write-only runs receive their native approval verdict openclaw#186461 binds waits to the approval owner, excludes resolve authority, and checks liveness after waiting; its reported Docker execution withholds a late Allow after abort, while real handlers reject another run's wait. (src/agents/harness/host-capability.ts:621, ff7c37bed649)
• Existing-state compatibility: Agent and shared-state schema versions remain 38 and 35. The included telemetry change records a latest-stable upgrade and cold restart preserving stored events, cached update state, consent, and auth configuration in feat(telemetry): count reporting installations without identifiers openclaw#186569; its additive machine-state keys require no new schema. (src/state/openclaw-schema-versions.ts:10, fcd374fd1b98)
• Required native image verification: Repository policy requires controller and runtime build/startup proof on native AMD64 and ARM64. The exact-head CI run skips Native Container Verification, and no matching native container-check run was found: https://github.com/openclaw/openclaw-enterprise/actions/runs/40725609861. (.agents/skills/local-dev/references/image-version-verification.md:52, 59aee9f57a76)

Likely related people:

• stevenlee-oai: Raw commit 36fb718 adds apps/controller/src/drivers/compute/gateway-tool-policy.ts:131 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 36fb7180e5d1; files: apps/controller/src/drivers/compute/gateway-tool-policy.ts)
• Kevin: Raw commit 854b1dd adds deploy/runtime/openclaw-source.json:1 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 854b1ddf51e2; files: deploy/runtime/openclaw-source.json)

Labels

Label changes:

• add P1: Write-scoped Codex runs cannot receive reviewer approval verdicts, breaking an existing Agent command workflow.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P1: Write-scoped Codex runs cannot receive reviewer approval verdicts, breaking an existing Agent command workflow.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Complete the required native AMD64 and ARM64 image verification on the final candidate.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 28, 2026, 12:39 PM ET / 16:39 UTC.