OpenClaw
OpenClaw binds approvals to execution identity
An OpenClaw proposal carries an immutable execution/context pair into approval records, while two related patches preserve transcript revision through queued sends and active-run steering. The cluster replaces inferred ownership with explicit identity at three points where retries and background work can otherwise blur who authorized what.
openclaw/openclaw PR #119902 is the inspected primary source: “feat(audit): carry execution identity into approvals.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- openclaw/openclaw PR #119902 was created 2026-08-06T09:27:37Z and was open at inspection; its title is “feat(audit): carry execution identity into approvals.” - openclaw/openclaw PR #116382 was created 2026-07-30T11:24:14Z and was open at inspection; its title is “fix: avoid false branch-switch errors after background updates.” - openclaw/openclaw PR #120083 was created 2026-08-07T00:23:37Z and was open at inspection; its title is “fix(ui): make active-run steering reliable.” - The repository reported 385389 stars, 5557 open issues, default branch main, and last push 2026-08-07T01:04:42Z. - The latest tagged-release baseline checked was v2026.7.1-2 published 2026-08-04T00:41:26Z.
What changed
openclaw/openclaw PR #119902 reports: What Problem This Solves F0 created execution identity only inside the later audit recorder. Built-in tool and approval owners therefore could not retain the same immutable execution/context pair, and a non-unique runId could not safely reconstruct that ownership afterward. When the existing default-off execution-identity collection is enabled, this change allocates or adopts one identity at the shared post-prepare continuation and carries it only through private runtime scope and the existing authenticated local Gateway connection. Exec and plugin approval creation can then persist the exact pair at their shared owner boundary. Missing, disabled, malformed, untrusted, or run-mismatched identity remains non-authoritative and unbound. AI-assisted change; the implementation and proof were reviewed directly. Why This Change Was Made Required base: 70f84286c9ae20fd47dcf775b55ebb99296794de Current head: 44d82a9152fc96df3d9203f93f3db840ee6d7cff Current tree: 7ca81da7ea0515d0b19d04abe6cb355c386ed9e1 Superseded head: 9b45e3ff95efc780ff73691d547a364368355ed6 Prior superseded head: 62edbaaf2f6c93dde73855e7fc0de544e564c397 Frozen contracts: AD-19 through AD-24. Accepted storage decision: immutable both-or-neither binding metadata lives in
openclaw/openclaw PR #116382 reports: Fixes #115700 What Problem This Solves Control UI could park a send with “This conversation switched branches” even when nobody switched branches. A hidden or background append advanced the canonical leaf after the page rendered history, so the still-active displayed ancestor looked stale. The original PR fixed that false rejection, but deep review found a second branch-safety gap: Control UI captured the leaf at submit time and later paired it with a mutable currentSessionId. Delayed, queued, or reconnect sends could therefore combine different transcript generations, and branch cloning can preserve the old event ID. Fix Gateway accepts a displayed ancestor only when the caller supplies the same current sessionId and the entry remains on the SQLite-projected active path. Generation changes, sibling/off-path entries, missing entries, null/non-empty mismatches, and clients omitting sessionId retain rejection or exact-leaf behavior. Control UI now captures { sessionId, expectedLeafEntryId } as one
openclaw/openclaw PR #120083 reports: What Problem This Solves Fixes an issue where users steering an active Control UI run during tool work could briefly see “Steered,” then have the message downgraded to the opaque “Needs review” state even though they had explicitly asked to steer. In the observed live failure, one unique steer changed from Steered to Needs review in about 3 seconds, the queue grew from 1 to 2, and no matching transcript entry appeared after 28 seconds. Why This Change Was Made The Gateway treated token streaming as the proof that an active run could accept a message. Embedded runs remain steerable while tools execute even when token streaming is false, so admission could reject valid steering after the transcript leaf advanced. The shared reply-run owner now reports actual message-injection availability, preserving the existing originating-leaf fence and rejecting stopped or different-leaf owners. The Control UI now distinguishes
Why it matters
Approval history is weak evidence if a run ID can be reused or a queued message can cross transcript generations. The changes keep identity private and default-off, but make exact binding available at the decision boundary. The operator test is whether authority, persisted state and the visible outcome still describe the same event after retries, restarts or delegation.
Current
The primary record was open when captured on 2026-08-07. The release baseline was v2026.7.1-2 published 2026-08-04T00:41:26Z. Repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts row were checked. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/openclaw/openclaw/pull/119902. Supporting records are https://github.com/openclaw/openclaw/pull/116382 and https://github.com/openclaw/openclaw/pull/120083. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Treat execution identity, transcript revision and steer intent as one admission contract; test retries, reconnects and downgrade reads before enabling collection. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.