OpenClaw Main Tightens Feishu, Google Chat, Signal and Teams Channel Boundaries

OpenClaw has merged a channel-boundary wave covering four different failure classes: signed requests accepted at the wrong target, webhook accounts advertised healthy without usable authentication, permanent media errors poisoning a durable conversation lane, and sender or owner identity represented by inconsistent aliases.

The fixes affect Feishu, Google Chat, Signal and Microsoft Teams on main. No supplied release identifies a containing package. Operators should retest negative authorization and failure paths—not merely send one successful message—before adopting a containing build.

Feishu signatures now bind to the exact request target

PR #118758 requires the configured Feishu webhook target and supported POST method before signed callback processing. The upstream tests cover mismatched query parameters, prefix collisions, foreign authorities, traversal forms, encoded separators, fragments and malformed raw targets.

A valid signature should authenticate the intended request, not grant access to every path that can be normalized into something similar. Explicitly configured query-bearing targets remain supported, while unsupported methods and non-canonical targets are denied.

If Doctor migrates a legacy callback path, compare the resulting canonical path and query with the reverse proxy route before reopening ingress.

Google Chat no longer reports impossible setup as healthy

PR #118968 validates the effective Google Chat audience and audience type before registering the inbound route. Previously, token-only or incomplete setup could produce a connected-looking account even though every webhook request would fail JWT audience verification.

The repaired lifecycle is blocked, with an actionable error and unhealthy Gateway status. No unusable route is registered. Valid app-URL and project-number audience modes remain supported.

This is operationally important: configuration presence is not proof that the external identity provider can authenticate the route.

Oversized media releases the durable conversation lane

PR #118986 fixes a separate Google Chat liveness failure. An attachment exceeding the configured byte limit could be treated as retryable forever, blocking later messages in the same durable per-space lane until the dead-letter horizon.

The media owner now classifies both oversized Content-Length and streamed-body overflow as the known permanent max_bytes condition. After authorization checks, OpenClaw preserves the caption and a safe unavailable-media notice, adopts the permanent result and releases later messages. Transient network and auth failures still retry.

Interpretation: durable FIFO queues need typed failure ownership. Retrying a permanent event is not resilience if it starves every valid event behind it.

Signal deduplication uses canonical sender identity

PR #118970 deduplicates durable Signal ingress across sender identity aliases. The same sender may be represented through different valid identifiers; deduplication tied to the raw alias can admit the same event twice.

Test duplicate delivery across each configured alias as well as two genuinely distinct senders. Canonicalization must collapse the former without merging the latter.

Teams owner approval uses documented AAD principals

PR #118967 enforces the documented Microsoft Teams AAD principal boundary for owner approvals. Transport-visible display names or inconsistent identity fields must not substitute for the configured owner principal on management or approval paths.

Exercise owner, admitted non-owner and unrelated tenant identities. A denial must be visible and leave approval or durable state unchanged.

Rollout matrix

Run the tests through the actual reverse proxy and channel account configuration. Use synthetic content and non-production identities where the platform permits; never log signing secrets, JWTs or tenant credentials.

Evidence and limits

Official GitHub API records confirm the Feishu and Google Chat PRs merged and include raw-request, lifecycle and SQLite durable-queue proof. API extraction for the Signal and Teams PRs was rate-limited, so their identity-boundary claims remain attributed to the official collector’s merged PR and commit records. OpenClaw Academy did not connect live channel tenants.

Relevant collector IDs are 36822/36708/36804, 36833/36719, 37047/36931, 36832/36718, and 36836/36722.

Bottom line

Channel security is not a signature checkbox. The request target, audience, media failure class, sender identity and owner principal must all remain exact. Require those negative proofs from the containing build before treating a channel as healthy or authorized.