OpenClaw Main Changes Cron Failure, Delivery and DST Behaviour

OpenClaw’s cron scheduler has merged a behavioural change operators need to notice: a recurring job now auto-disables after ten consecutive run failures, records why and notifies its owning agent.

The same main-branch wave tightens private webhook policy, ambiguous announce routing, one-shot script validation and timezone handling around zoned dates and daylight-saving folds. These are not cosmetic scheduler changes; they alter when a job is admitted, where it may deliver and whether it remains enabled.

No supplied release record identifies a containing package. Treat the changes as merged source behaviour until a release explicitly includes them.

Ten failures now stop a recurring job

PR #118113 adds an automatic circuit breaker after ten consecutive failures. This prevents an unattended recurring job from failing forever, spending resources and flooding downstream systems.

The trade-off is liveness: a job can remain disabled after its external dependency recovers. Monitoring must therefore watch both failure alerts and disabled-job state. An alert that fired once is not proof that scheduling later resumed.

Interpretation: auto-disable is a safety boundary, not self-healing. The owner still needs to diagnose the cause, decide whether replay is safe, and explicitly restore service through supported controls.

A related fix, PR #118200, delivers failure alerts only after the failure outcome is durably persisted. PR #118393 scopes cancellation settlement grace to the active run. Together they reduce alerts about state that has not yet committed and prevent one cancelled execution from settling another run’s lifecycle.

Webhook exceptions become an explicit trust decision

PR #118286 adds webhook SSRF policy and a way to allow trusted private targets. The safe default is to preserve protection against destinations that can reach internal services merely because the Gateway can.

Only grant a private destination after pinning its ownership, expected addresses, redirect behaviour and authentication boundary. Do not use a broad private-network exception to make one endpoint work. Re-resolve and retest after DNS, proxy or network changes.

Ambiguous delivery is rejected instead of guessed

PR #118272 rejects announce jobs whose delivery could resolve across multiple channels without an unambiguous target. A scheduler should not infer which account or conversation deserves a notification when several are eligible.

This may turn a previously accepted but risky job definition into a validation error. Repair the canonical job by naming one intended destination; do not duplicate the same payload across channels unless duplicate delivery is explicitly desired and idempotent.

Bad scripts fail before persistence

PR #118100 validates Code Mode syntax when scheduling. A malformed one-shot script should be rejected at creation rather than stored successfully and discovered only when its scheduled instant arrives.

That moves failure earlier, but it does not prove the script’s runtime behaviour, permissions or side effects. Syntax validation is admission, not an execution test.

Zoned dates and DST folds use one canonical instant

PR #118297 follows earlier timezone work with a canonical resolution path for zoned date-only inputs and ambiguous daylight-saving folds. The upstream title specifies the first DST occurrence.

Operators should test the exact timezone and transition dates they use. During a backward clock change, one local wall time occurs twice; choosing the first occurrence is a real scheduling rule that should appear in previews, logs and incident timelines.

PR #118712 extends this from ordinary modern DST to historical timezone transitions. Upstream reports correct next/previous scheduling across 30-minute, 60-minute and two-hour changes as well as historical 23- and 24-hour jumps. Repeated civil times run exactly once, nonexistent local times do not produce invented executions, and scheduler restart or catch-up keeps the same decision.

This matters for jobs pinned to long-lived IANA zones, not only for deployments physically operating in those regions. Historical backfills, imported schedules and tests that calculate prior or next occurrences can cross transitions with offsets unlike today’s one-hour DST assumption.

Upgrade acceptance matrix

Use disposable jobs and isolated destinations:

Before enabling a formerly failing task, reconcile whether any of its prior attempts produced external side effects. Ten reported failures do not guarantee ten no-ops.

Evidence and limits

The official merged PR, commit and documentation records supplied by the repository collector establish the reported changes. Direct GitHub page extraction was blocked by HTTP 403 and the configured search backend was unavailable. OpenClaw Academy did not force ten live failures, call a private webhook or execute a job across a DST fold.

Primary collector IDs include 34225, 34114, 34196, 34755, 34645, 34710, 34554, 34447, 34563, 34456, 34546, 34229, 34119, 34397, 34287, 34917, 34807, 36216 and 36125.

Bottom line

Cron now fails safer on main, but safer does not mean quieter to operate. Inventory recurring jobs, alert on disabled state, make every delivery route explicit, keep private webhook exceptions narrow and prove local times against their actual UTC instant before rollout.