OpenClaw Main Tightens Six State-Mutation and Security Boundaries

Six OpenClaw fixes merged on main close a common class of operational mistake: a permissive fallback or ambiguous mutation crossing a boundary that should fail closed. The changes protect read-only skill mounts from conflicting user binds, expand authentication-parameter redaction, make config array deletion target exactly one entry, apply mixed chat directives atomically, reject stale or invalid recovery backups, and stop a full onboarding reset when the existing config cannot be read.

These are source corrections, not a claim that a packaged release already contains them. Operators should preserve state first, identify a containing revision and test with synthetic data.

Boundary summary

Protected skill mounts must remain authoritative

PR #93985 handles a sandbox bind whose destination collides with a protected read-only skill mount. Rather than allowing user configuration to replace the protected destination—or failing the entire sandbox startup—the merged engine normalizes destinations, skips the conflicting user bind and emits a warning that identifies it.

This is a security-boundary change with compatibility consequences. A deployment that accidentally relied on the conflicting bind will no longer see its content at that destination. That is the right failure direction, but operators must not ignore the warning: it signals that the requested sandbox filesystem differs from the effective one.

Acceptance should cover exact destinations and normalized equivalents. A path-spelling trick must not bypass the collision check, and a non-conflicting bind must continue to mount normally.

Redaction now covers signed and custom authentication parameters

PR #116957 expands network-policy redaction to sig and x-* authentication parameters in URLs and bodies. Signed query strings and vendor-specific authentication fields are credentials even when they are not named token or password.

Interpretation: allow/deny policy and observability policy are separate controls. A request can be correctly blocked while its diagnostic path still leaks the credential that made it sensitive.

After adopting a containing build, test logs, errors and audit surfaces with obvious fake markers. Never use a real signed URL as the canary. Confirm benign parameters remain useful enough for diagnosis while the fake signature value is absent from every emitted representation.

A config delete must have one mutation target

PR #116463 fixes a config patch request that could delete three array entries when asked to delete one. Even if the resulting JSON remained schema-valid, silent over-deletion can remove unrelated agents, routes, models or policy entries.

Treat affected historical patches as a data-integrity question. Compare prior configuration snapshots and audit records; do not infer the missing entries from current runtime behaviour alone. A system can continue operating with a valid but incomplete configuration.

The acceptance fixture should use adjacent and duplicate-looking values. Delete the middle target and prove the other entries retain both value and order.

Mixed directives now share one session transaction

PR #117542 fixes chat input that combines model, thinking, reasoning, queue or other directives with a normal message. The old path could write session settings twice, and a model lock acquired concurrently could still lose the race to a directive model change.

The merged path routes mixed and directive-only settings through one existing session transaction, rechecks the model lock inside it and uses touched-field compare-and-swap semantics. This matters because the message and the settings that govern it are one operator intent; persisting them through separate authorities can run the turn under a state the user never selected as a coherent whole.

Test with a disposable session by racing a model lock against a mixed model directive and harmless prompt. The acceptable results are explicit rejection or one atomic admitted state. Do not accept a message under one model while the stored session reports another.

Recovery must validate the bytes it will restore

PR #117100 prevents config recovery from stale or invalid backups. The important contract is not “a backup file exists”; it is “this exact backup is valid for the recovery decision now being made.”

Operators should keep external, versioned backups rather than treating an application-local recovery copy as the only rollback. In staging, corrupt a disposable backup, leave the live config invalid and prove recovery refuses rather than promoting another bad authority.

Do not perform that test against production state. Preserve config permissions and ownership as part of the restore evidence.

Unreadable config now blocks full reset

PR #114110 fixes a destructive guard that checked the wrong condition. The config snapshot always carried an object—even when reading failed—so openclaw onboard --reset --reset-scope full could fall through to the default workspace and move it to Trash. The merged guard checks the recorded read error and refuses the reset.

This follows the earlier fix that moved TTY preflight ahead of reset mutation. Both enforce the same operator rule: a reset must prove its target before it moves anything. Missing interaction and missing configuration authority are reasons to stop, not reasons to guess defaults.

Before any full reset, record the active profile and home, take a restorable backup, verify the config can be read by the exact service user, and inspect the target paths. Do not “fix” a permission problem by running the reset as a broader user.

Safe acceptance run

Use a disposable OpenClaw home and synthetic secrets:

1. configure one sandbox bind that exactly conflicts with a protected skill destination and one that does not;
2. prove only the conflict is skipped and the effective protected mount remains read-only;
3. send a blocked test request containing fake sig and x-test-auth markers, then search every supported diagnostic surface for the marker values;
4. delete one item from a three-entry config array and compare the complete serialized result;
5. test recovery with a valid backup, a stale backup and malformed bytes; and
6. race a harmless mixed model directive against a session model lock and prove there is no partial settings write; and
7. make the disposable config unreadable, invoke full reset and prove the workspace is unchanged.

Capture file identities and hashes before and after through your normal test harness. Keep real credentials and production paths out of fixtures.

Evidence and limits

The official merged PR and commit records in the repository packet establish the reported faults and corrections. The sandbox record includes supplied and Podman-oriented proof; the reset commit identifies the incorrect guard and replacement read-error check. Direct GitHub extraction and independent search were unavailable, so implementation details remain attributed to upstream.

OpenClaw Academy did not mount a sandbox or mutate a live configuration. The evidence establishes merged source changes, not release inclusion or the absence of other plugin-specific logging paths.

Bottom line

Fail-closed behaviour is only useful when it protects the right authority. A protected mount must beat a user bind, diagnostics must not outlive credential secrecy, one patch must have one target, a backup must be validated, and a reset must never guess which workspace to destroy.

Adopt a containing build through controlled staging, then make each refusal path prove that untouched state really stayed untouched.