ZeroClaw puts one authority over agent deletion, config and Git roots

zeroclaw-labs/zeroclaw PR #10630 is the inspected primary source: “fix(config): bind degraded remediation to running executable.” The related records were inspected as supporting context rather than independent confirmation.

The facts

- zeroclaw-labs/zeroclaw PR #10630 was created 2026-09-05T00:13:25Z and was open at inspection; its title is “fix(config): bind degraded remediation to running executable.” - zeroclaw-labs/zeroclaw PR #10621 was created 2026-09-04T16:20:16Z and was open at inspection; its title is “feat(runtime): coordinate agent lifecycle mutations.” - zeroclaw-labs/zeroclaw PR #10337 was created 2026-08-25T03:19:17Z and was open at inspection; its title is “fix(tools): honor allowed roots for git operations.” - The repository reported 32732 stars, 789 open issues, default branch master, and last push 2026-09-05T00:45:04Z. - The latest tagged-release baseline checked was v0.8.4 published 2026-08-02T21:00:00Z.

What changed

zeroclaw-labs/zeroclaw PR #10630 reports: Summary Fixes #10532. Degraded-config warnings were telling users to run bare zeroclaw config migrate, which can hit a different binary from the daemon that actually rejected the config. This changes the warning to use the running daemon executable instead. It also reuses ZeroClaw's recorded launch executable when available, so the remediation path stays valid after an in-app binary replacement. A cross-platform regression test now covers the exact failure case: PATH resolves to a fake zeroclaw that accepts the config, while the real daemon rejects the same security-critical risk_profiles section. Testing Ran: cargo test --test component degraded_config_guidance_is_bound_to_running_executable_when_path_disagrees -- --nocapture Result: 1 passed, 0 failed. The same test failed before the fix because startup still pointed the operator to bare zeroclaw config migrate. Security & Privacy Impact No new permissions, network calls, credential handling, or personal data. Compatibility Backward compatible. No config schema, environment variable, or CLI syntax changes. Rollback Revert this PR.

zeroclaw-labs/zeroclaw PR #10621 reports: Summary **Base branch:** master (all contributions) **What changed and why:** Gives daemon RPC, gateway, channels, ACP admission, and CLI mutations one shared live-config authority instead of independently advancing cloned config snapshots. Coordinates agent admission, active sessions and turns, destructive mutations, detached cleanup, and daemon-generation shutdown per alias so stale work cannot publish or clean up after deletion or recreation. Routes agent create, rename, delete, and generic agent-targeting config writes through the same lifecycle authority, including daemon-aware CLI fallback and cross-process config ownership. Keeps the exhaustive RPC method dispatch future behind one fixed-size heap pointer so lifecycle handlers do not inflate transport-worker stack usage. Reconstructs the surviving lifecycle work directly on current master without #10410's obsolete #10246 dependency chain. **Scope boundary:** This is the runtime prerequisite for safe ZeroCode agent deletion. It does not add the ZeroCode single- or bulk-delete UI, redesign the full config API, make bulk deletion transactional, or change the reserved default alias. **Blast radius:** Runtime and gateway config mutation, ACP and session admission, channel and gateway turns, agent-owned-state cleanup, daemon reload ordering, local and remote RPC, and CLI agent/config mutation behavior. **Linked issue(s):** Related #10244. Supersedes #10410. **Labels:** enhancement, core, agent, channel, config, daemon, gateway, runtime, tests, distinguished contributor, channel:core, channel:telegram, channel:whatsapp, risk:high, channel:line, size:XL, channel:acp, channel:wechat, cli. What this does, simply Named agents can be changed while ZeroClaw is running. Those changes can come from the

zeroclaw-labs/zeroclaw PR #10337 reports: Summary Constrain Git repository discovery and execution to roots authorized for the requested read or write operation. Bind every Git subprocess to the validated repository worktree, clear ambient GIT_* overrides case-insensitively, and disable read-path fsmonitor, pager, external-diff, and text-conversion execution. Preserve linked-worktree support only when the physical.git, gitdir, and commondir metadata each remain inside the applicable authorized roots. Resolve the current master conflict while retaining both the Windows nul exception and fail-closed symlink resolution. **Base branch:** master **Scope boundary:** This does not solve pathname TOCTOU between validation and Git opening metadata; it does not add configuration, feature flags, or descriptor-bound subprocess support. **Blast radius:** git_operations, SecurityPolicy root selection, runtime tool registration, English tool diagnostics, and documented read/write grant semantics. **Linked issue(s):** Closes #10334. Issue #10334: https://github.com/zeroclaw-labs/zeroclaw/issues/10334 **Labels:** bug, config, docs, runtime, tool, experienced contributor, security:policy, needs-author-action, risk:high, size:XL. Testing (required) How you can test (when useful) **Reviewer testing requested?** N/A. Deterministic production-path regressions cover the authorization boundary, linked-worktree lifecycle, hostile Git configuration, and command-environment handling. How I tested **CI checks relied on and why they cover this change:** Exact-head CI is green, including the required gate, Linux, macOS, Windows, targeted Windows Clippy, test, security, format, lint, MSRV, and plugin-backend checks. **Known CI coverage gap, if any:** Read-only status and diff lack a regression that prevents repository-configured clean/process filters from executing. The Windows-specific Clippy job passed in CI. **Commands run

Why it matters

A daemon, CLI and channel cannot safely mutate the same agent from cloned snapshots, and a repair command is false guidance if PATH resolves to a different binary than the one rejecting configuration. The practical test is whether the system remains bounded and its receipts still describe the action after failure, retry or restart.

Current

The primary record was open when captured on 2026-09-05. The tagged-release baseline was v0.8.4 published 2026-08-02T21:00:00Z. Repository metadata, source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/zeroclaw-labs/zeroclaw/pull/10630. Supporting records are https://github.com/zeroclaw-labs/zeroclaw/pull/10621 and https://github.com/zeroclaw-labs/zeroclaw/pull/10337. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Lease agent names through admission and cleanup, route live mutations through the owning daemon, execute remediation with the running binary, and scrub ambient Git overrides before repository work. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.