OpenClaw Memory Search Tightens SecretRef Resolution So Embedding Credentials Stay Bound to Their Destination

Operators who point OpenClaw memory-search embeddings at custom or remote endpoints got a merged security-boundary repair worth understanding, because it changes which credentials may travel with a request.

What was wrong

Configuring memory-search embedding credentials through SecretRefs, environment shorthand, or custom remote endpoints could bypass configured secret-provider policy in three ways: stale credentials could be reused after a provider destination changed, and provider-owned credentials or tenant headers could ride along to a different embedding destination. The sharpest edge: selecting a separate memory remote endpoint — or even the same host and path with a different tenant query parameter — no longer being distinguished meant configured API keys, Authorization values, and tenant headers could be sent somewhere they were not scoped for.

What the fix enforces

Gateway runtime snapshot preparation is now the exclusive owner of memory SecretRef materialization and policy enforcement:

• Memory consumers take already-resolved values literally and reject unresolved structured references before any network egress;
• stale snapshots are invalidated when a manifest-declared credential owner’s destination or auth contract changes;
• provider credentials and headers are inherited only for their own normalized destination, including its URL query — localhost, 127.0.0.1, IPv6 loopback, and query-distinct tenants are distinct credential principals;
• explicit remote Authorization wins over API keys case-insensitively; unauthenticated generic endpoints still work; bearer-provider paths missing destination-owned credentials fail before egress; and
• the redundant private SecretRef parser was deleted, leaving one canonical resolution path.

Operator guidance

• After upgrading, re-run your memory search against each configured remote endpoint. Valid configurations behave identically; configurations that depended on credential carry-over to a second endpoint will start failing before egress — deliberately, and with the missing-credential failure naming the destination.
• If you operate multi-tenant embedding proxies, verify tenants are distinguished by query parameter as you expect; the fix treats query-distinct tenants as separate principals, so per-tenant credentials now stay per-tenant.
• Prefer explicit per-destination credentials over shared ambient ones; the new enforcement model rewards exactly the configs you should have had anyway.

Interpretation: treat this as a credential-scoping contract, not just a bug fix: destination identity (host, path, and query) defines the credential envelope, and nothing provider-owned crosses it.