[miguelbranco80]

Ordinary Console draft creation can save inherited Configuration Secret bindings without granting the Agent access, causing deployment admission to fail. Enumerate the accepted saved Configuration’s same-Namespace environment Secret bindings, deduplicate their sources, and create exact operate grants through the existing IAM operation.

Installation-admin delegation remains required. A failed grant retains the saved Agent and Configuration for explicit retry without duplicate writes. Supported queued provisioning keeps its worker-owned path. The existing live integration test also covers denied grant writes and revocation before worker delivery.

Upstream: openclaw/openclaw-enterprise#2255, addressing issue #2254. Both PRs use this exact fork repository and head branch. This fork PR targets codex/configuration-secret-upstream-base at a7aa9219f; fork main and codex/raw-integration remain outside this change.

Verification — October 21 refresh

Tested head: b8814936a1bfec46612031f30d223c9e6ee691be, incorporating upstream main at a7aa9219ff14c248df0c183b8b48d9283d26c2f6 (67 upstream commits since the previous base). Normal fast-forward publication preserves history. Both PRs stay open, non-draft, with auto-merge off.

Preserved upstream's Console changes, including the member recovery-copy fix in openclaw#3028, and both consolidated changelog inventories and Manual Notes. The parent Console flow, credential-access helper, and Console IAM fixture match this exact main. The remaining feature diff is nine files, +396/-50.

Addressed the two non-blocking review nits:

• The creation reference now names a model Secret or Credential Source, matching the actual grant target. Surrounding upstream wording remains intact. Its 2,142 words cover one coherent creation/recovery workflow and remain below the hard limit.
• Restored a focused Codex Preset with a prebound model Secret case alongside the Embedded inherited-Secret regression. The real Console saves the original source, creates no replacement Secret, persists one exact Agent binding, and Native IAM confirms operate. The existing picker and uncertain-response tests remain unchanged. This case selects the ordinary draft capability; it does not claim queued provisioning or runtime execution.

Local verification used the already installed matching dependency graph; no dependencies were installed or reconciled:

• 244 browser cases passed, zero failures/skips, including all Preset tests, member creation, ordinary/dedicated creation, OAuth, retained drafts, Namespace readiness/rechecks, mobile drawers, navigation and draft guards.
• 130 API cases passed, zero failures/skips: Console, Presets, creation validation, OCC, and Secret APIs.
• The new Codex case fails as expected when the prebound-model grant fallback is removed: zero bindings instead of one. The inherited-Secret regression still fails on exact unpatched upstream a7aa9219f because its tool Secret grant is absent. Candidate bytes were restored before broad validation.
• Lint, formatting, typecheck, workspace isolation, OpenAPI, docs/link/length checks, CI suite audit, flow validation, rebuilt Storybook, and diff checks passed.
• Independent isolated local GPT-6 Astra, high reasoning review completed both passes over the frozen branch diff and related authorization source: no actionable P0–P2 findings (scoped-clean). GPT-6.1 Sol and its automatic access fallback were rejected by the account and produced no review; Astra completed on the same local host. Source review and executed tests are separate evidence.

Fresh hosted CI run 39617608135 is queued for this exact head; CodeQL and hosted Storybook are also queued. Maintainer approval remains pending. No live PostgreSQL/Kubernetes procedures were repeated; earlier evidence below retains its original revision scope.

Current Storybook evidence

Rebuilt and exercised Pages/Create Agent → Preset Secret access retry (pages-create-agent--create-bound-secrets-grant-denied) on b8814936a, macOS ARM64, Node.js 24.3.0. Denial keeps the saved Agent and Configuration; the actual retry opens that same draft. Both uploaded screenshots opened at 1265×712, and the H.264 recording decoded and played to completion (8.12 seconds). This is simulated UI proof, not backend persistence, credential delivery, runtime readiness, or model execution.

retry-walkthrough.mp4

Historical refresh 7917bb951: 239 browser and 130 API cases passed; CI Required, CodeQL and hosted Storybook passed. Its denial screenshot, recovery screenshot, and video remain historical.

Historical refresh 81ce5d06: 220 browser and 37 API cases passed; hosted CI passed. Its denial screenshot, recovery screenshot, and video remain historical.

Earlier refresh 3cc28047: 119 browser and 37 API cases passed locally; its inherited-Secret regression failed against unpatched f3a74292. Its denial screenshot, recovery screenshot, and video remain historical.

Earlier live Console creation and admission

The remaining review request was exercised on 1d7772d11b2874ae7fb1f5253a998bd0463395b2 using the actual loopback Console and HTTP listener, PostgreSQL application role, Native IAM, Kubernetes Configuration/Secret Drivers and controller worker. Setup provisioned a Namespace, a saved Embedded OpenClaw Preset and distinct synthetic model/tool Secrets. It did not seed an Agent or Agent Secret grant. The browser signed in, selected the Preset, entered name/model, selected Use Preset, Create Agent, then Deploy new version. No UI responses, State or IAM were mocked.

Recorded real Console creation/admission output confirms:

• The accepted Configuration retains TOOL_TOKEN and SECOND_TOOL_TOKEN bound to the tool Secret.
• An independent PostgreSQL query finds exactly two Agent Secret operate bindings: one distinct model source and one inherited tool source, deduplicated across both destinations.
• Real browser HTTP writes return Configuration 201, Agent 201, two exact binding writes 201, and deployment admission 202. This exercises create.mjs enumeration through the ordinary draft path; queued provisioning was not substituted.
• The unchanged Console source SHA-256 is recorded with the tested commit.

Created draft (real Console/State/IAM):

UI-admitted revision (real deployment record):

9.4-second recording of actual UI deployment admission:

live-console-deployment.mp4

Limit: An extra activation probe timed out; the worker recorded DEPENDENCY_UNAVAILABLE before workload creation, and its cause was not diagnosed. This trace proves Console creation, exact inherited grants and admission; it does not establish runtime readiness. The separate four-case live fixture authority/delivery proof below remains passing. No genuine model turn or Helm-installed production deployment is claimed. The trace retains the activation failure, and only inspected, credential-free logs/media were uploaded. Owned fixtures have been removed. No repository/source changes were made for this follow-up.

Earlier real-runtime verification

Tested head: 1d7772d11b2874ae7fb1f5253a998bd0463395b2. macOS ARM64, Node.js 24.3.0, pnpm 11.15.1, matching prepared dependencies, owned disposable PostgreSQL and loopback K3s fixtures with enforcing NetworkPolicies.

All four live Kubernetes fixture cases passed, with zero failures/skips. Recorded authority proof and test output:

• A real cookie-authenticated Installation reader’s grant POST returns 403. An independent PostgreSQL query observes zero exact Agent/Secret bindings. The authorized administrator then persists the grant through the same API.
• Stop the real worker, admit deployment (202), revoke the Agent’s generic Configuration Secret grant (204), and independently confirm the work remains queued. Restart the worker: work fails permanently with AUTHORIZATION_DENIED; the Agent has no active revision, Deployments or Pods, and no new Agent-owned Secrets are delivered in either execution or gateway placement.
• Restore only the exact grant, deploy again, and observe the original synthetic BOUND_SENTINEL value inside the ready real gateway Pod. This includes the existing immutable revision, identity, isolation and teardown workflow.
• Companion cases cover Driver lifecycle/isolation, externally managed Namespace preservation, and API/worker provisioning handoff.

Commands: node --env-file=<owned-fixture.env> --test tests/integration/kubernetes-compute-real.test.mjs and node --env-file=<owned-provisioning.env> --test tests/integration/kubernetes-compute-provisioning-real.test.mjs tests/integration/kubernetes-compute-driver-real.test.mjs. Repository CI preparation migrates owned databases as occ_migrator; API/worker execution uses occ_app. The migrator seeds only the reader’s initial Role. Owned resources were cleaned up.

These tests exercise actual Fastify routes through injection, OCC, Native IAM, PostgreSQL, the controller worker, and Kubernetes Drivers/API using development composition and a fixture gateway/Harness image. Synthetic values establish Secret delivery and refusal; they do not prove a genuine model turn, Slack connection or Helm-installed production deployment.

At the preceding head e0ec6627, 93 Console browser and 54 API/OCC cases passed without failures/skips. The inherited-Secret regression failed against exact unpatched upstream Console and passed with the fix. This follow-up changes only the existing Kubernetes test; all application, browser-test, documentation and Storybook source is unchanged. Typecheck, OpenAPI and docs checks passed at that preceding head. Lint, formatting, workspace isolation and diff checks also pass at the new head. Existing reference/flow documentation remains accurate; no new runtime behavior or image version was introduced.

Earlier UI evidence

Rebuilt and inspected Pages/Create Agent → Preset Secret access retry (pages-create-agent--create-bound-secrets-grant-denied). The captures use UI source byte-identical to the tested head. Denial retains saved IDs and locks fields; selecting Retry credential access opens the same saved Agent draft. This is simulated Storybook UI proof, separate from the live authority proof above.

Denied grant and saved-resource recovery:

Recovered retained Agent:

10-second recording of the live browser interaction; uploaded H.264 MP4 decoded and played successfully:

retry-walkthrough.mp4

The earlier evidence addresses the grant-persistence, post-admission revocation and media requests. Independent review comments are retained in the PR discussion. Keep both PRs open and auto-merge disabled; neither PR has been merged.