OpenClaw Pins Codex Runtime 0.149 and Reworks Approval-Policy Migration

A wave of Codex-related changes merged to main on August 21, 2026. The center of gravity is PR #127026, which pins the managed @openai/codex runtime and its minimum app-server version to 0.149.0 on the frozen beta candidate. Two operator-visible consequences follow: the retired untrusted approval policy is now migrated to on-request by Doctor alone, and same-channel async Codex messages gain durable outbound custody before acknowledgment.

The approval-policy migration is Doctor’s job now

Configurations carrying the retired untrusted approval policy input were previously at risk of being passed through as an invalid current policy. After #127026, Doctor owns migrating that input to the canonical on-request value.

Operator action: before upgrading a fleet that uses Codex runtimes, run Doctor once per deployment rather than hand-editing config files. If you have scripts that grep for or set untrusted, retire them — the string is no longer valid input anywhere else.

Same-channel async delivery becomes durable

The PR also fixes a dispatch ownership gap: stable deliveryIntentId blocks only entered the durable route path when a reply crossed channels, so same-channel Codex async updates fell through to the in-memory dispatcher — letting the app-server callback settle before any durable custody existed. Core dispatch now loads the route runtime for stable intents even when the channel is unchanged, fails closed when no durable route exists, and preserves source-account-specific reply policy so a non-default account cannot fall back to the channel default.

Rejections are returned to Codex for retry under the same stable intent, and pending/completed intents stay deduplicated across restarts and replay. Operators running Codex agents that post progress into the channel they work in should observe fewer duplicated or vanished mid-turn updates after restarts.

Three release-branch backports land the same day

Three smaller merges extend the pinned release line rather than main semantics:

• PR #127269 stops the pinned branch from rejecting every Codex app-server newer than its bundled version; older versions and prereleases remain rejected. This unblocks adopting stable app-server point releases without leaving the pinned branch.
• PR #127337 backports native discovery of newly available first-party models (#127322) so an existing authenticated Codex account can use new models without waiting for an OpenClaw catalog update — applying only when Codex is explicitly selected and no authored endpoint, transport override, or forwarded credential conflicts.
• Together they mean operators no longer choose between staying pinned and using current OpenAI model availability.

Restricted turns keep workspace instructions

PR #126891 separates workspace instruction delivery from native tool authority. Previously, ordinary Codex-harness turns under a restricted tool policy silently lost their workspace AGENTS.md: the restriction correctly removed native tool and MCP access but also disabled project-document discovery, while OpenClaw’s own instruction carrier excluded the same file — leaving the model with neither copy of the workspace contract.

Now ordinary restricted turns receive a bounded AGENTS.md snapshot through the frozen thread-level developer-instruction path while keeping every capability restriction fail-closed. Ring-zero (explicitly tool-disabled) turns still suppress project documents, with explicit precedence over overlapping policy restrictions. Upstream validated this with A/B hosted runs showing markers present in both session types post-fix, zero tool calls in restricted sessions, and a ring-zero security regression demonstrating the boundary holds.

Operator action: if you restrict Codex tool policies for safety, re-verify agent behavior after upgrade — instructions that were silently missing will now be present, which can change outputs. That is the fix working, not a restriction leak.

What upstream validated

#127026 reports exact-tag verification against openai/codex rust-v0.149.0 (781 generated protocol files matched), 188/188 focused Codex contract tests, restart/replay dedupe coverage, and signed commits binding the candidate diff and approval bindings. #126891 reports reproduction and fixed A/B runs plus ring-zero regression coverage. These are upstream-reported results reviewed against the official merged records; OpenClaw Academy did not independently execute them.

Upgrade checklist

1. Inventory managed Codex deployments and record current runtime/app-server versions before touching anything.
2. Run Doctor to migrate any untrusted approval policy inputs; confirm configs show on-request.
3. Upgrade the managed runtime to 0.149.0 and validate one representative agent end-to-end, including a restart during an active turn.
4. If you rely on pinned release branches, confirm you have #127269/#127337 before expecting newer app-server versions or newly released models to work.
5. Re-test any security-restricted Codex sessions to confirm restrictions still hold with project instructions restored.