OpenClaw PR #119115 exact-head real Gateway and Control UI evidence (a8d8aa95)

00-real-labs-owner-ack.png

01-real-guarded-save.png

README.md

OpenClaw PR #119115 real Gateway evidence

This bundle publishes independently downloadable proof for:

• Pull request: openclaw/openclaw#119115
• Exact signed head: a8d8aa95157d74297271ced259b6267ed72f2b99
• Exact tree: a19f455ce45e87006a5b1de345f755cc74f29b6b
• Hosted exact-head CI: https://github.com/openclaw/openclaw/actions/runs/31307802527
• ClawSweeper review: openclaw/openclaw#119115 (comment)

Proof scope

The execution used the repository's real in-process Gateway server, exact-head Vite Control UI source, Chromium, an isolated temporary state directory, and a dummy loopback token. No provider, channel, or external-service credentials were used.

The receipt and trace show:

• the real config.patch acknowledgement included authoritative config;
• the only instrumented explicit runtimeConfig.refresh() caller was app-shell-gateway;
• labs-page issued no explicit refresh;
• the later guarded config.set used the runtime owner's final hash;
• the browser recorded no page errors.

The mocked-Gateway test is separate supplemental proof. This bundle contains the independently inspectable real-Gateway/browser evidence requested by the August 9, 2026 ClawSweeper review.

Files

File	SHA-256
real-gateway-proof.json	dd84cdd8b6330b7be6495f419159195499fa48988510a586091edfeaf3e03895
00-real-labs-owner-ack.png	906e849b14f734b237c0fc382be337ccd7d5c71ebac77a4a92bb1d343e8a4158
01-real-guarded-save.png	df527e1c88438efa31f71fbd25ebf84b8475dda099ca9539577c341cd717b82f

real-gateway-trace.txt is a human-readable rendering of the JSON receipt. manifest.json records publication provenance and redaction scope.

Redaction

The bundle contains no personal filesystem paths, private IP addresses, provider or channel credentials, API keys, authorization headers, session cookies, or secrets. Screenshot version text is deterministic test-fixture content.

manifest.json

{
  "schemaVersion": 1,
  "artifactId": "openclaw-pr-119115-real-gateway-a8d8aa95",
  "publishedAt": "2026-08-09T10:49:54Z",
  "repository": "openclaw/openclaw",
  "pullRequest": 119115,
  "exactHead": "a8d8aa95157d74297271ced259b6267ed72f2b99",
  "exactTree": "a19f455ce45e87006a5b1de345f755cc74f29b6b",
  "execution": {
    "kind": "real in-process Gateway + exact-head Vite Control UI + Chromium",
    "hosted": false,
    "isolatedState": true,
    "receipt": "real-gateway-proof.json",
    "trace": "real-gateway-trace.txt"
  },
  "supportingHostedCI": {
    "runId": 31307802527,
    "url": "https://github.com/openclaw/openclaw/actions/runs/31307802527",
    "conclusion": "success",
    "jobs": 73
  },
  "review": {
    "reviewedAt": "2026-08-09T10:42:47.689Z",
    "reviewedHead": "a8d8aa95157d74297271ced259b6267ed72f2b99",
    "url": "https://github.com/openclaw/openclaw/pull/119115#issuecomment-5174856796"
  },
  "files": [
    {
      "name": "real-gateway-proof.json",
      "sha256": "dd84cdd8b6330b7be6495f419159195499fa48988510a586091edfeaf3e03895"
    },
    {
      "name": "00-real-labs-owner-ack.png",
      "sha256": "906e849b14f734b237c0fc382be337ccd7d5c71ebac77a4a92bb1d343e8a4158"
    },
    {
      "name": "01-real-guarded-save.png",
      "sha256": "df527e1c88438efa31f71fbd25ebf84b8475dda099ca9539577c341cd717b82f"
    }
  ],
  "redaction": {
    "personalFilesystemPaths": false,
    "privateIpAddresses": false,
    "providerOrChannelCredentials": false,
    "apiKeysOrAuthorizationHeaders": false,
    "sessionCookies": false,
    "secrets": false
  }
}

real-gateway-proof.json

{
  "exactHead": "a8d8aa95157d74297271ced259b6267ed72f2b99",
  "proofKind": "real Gateway + exact-head Vite Control UI + Chromium",
  "isolatedState": true,
  "credentials": "dummy loopback token; no provider or channel credentials",
  "gateway": {
    "implementation": "src/gateway/server.ts via startGatewayWithClient",
    "patchAckIncludedConfig": true
  },
  "controlUi": {
    "source": "exact-head ui/ source through Vite",
    "labsVisibleOutcome": "Using default: Enabled",
    "postPatchLifecycleConfigGets": 2,
    "explicitRefreshCallers": [
      "app-shell-gateway"
    ],
    "labsIssuedExplicitRefresh": false,
    "guardedSetBaseHashMatchedOwner": true,
    "guardedSaveVisibleOutcome": "Code Mode override disabled",
    "pageErrors": []
  },
  "requestSequenceAfterLabsReady": [
    "config.patch",
    "config.get",
    "agents.list",
    "config.get",
    "config.set",
    "config.get",
    "config.get",
    "agents.list"
  ],
  "artifacts": {
    "labsScreenshot": ".artifacts/control-ui-e2e/config-safe-write/real-gateway/00-real-labs-owner-ack.png",
    "labsScreenshotSha256": "906e849b14f734b237c0fc382be337ccd7d5c71ebac77a4a92bb1d343e8a4158",
    "saveScreenshot": ".artifacts/control-ui-e2e/config-safe-write/real-gateway/01-real-guarded-save.png",
    "saveScreenshotSha256": "df527e1c88438efa31f71fbd25ebf84b8475dda099ca9539577c341cd717b82f"
  }
}

real-gateway-trace.txt

OpenClaw PR #119115 real Gateway / Control UI trace
exactHead=a8d8aa95157d74297271ced259b6267ed72f2b99
proofKind=real Gateway + exact-head Vite Control UI + Chromium
isolatedState=true
gatewayImplementation=src/gateway/server.ts via startGatewayWithClient
patchAckIncludedConfig=true
labsVisibleOutcome=Using default: Enabled
postPatchLifecycleConfigGets=2
explicitRefreshCallers=app-shell-gateway
labsIssuedExplicitRefresh=false
guardedSetBaseHashMatchedOwner=true
guardedSaveVisibleOutcome=Code Mode override disabled
pageErrors=[]
requestSequenceAfterLabsReady=config.patch -> config.get -> agents.list -> config.get -> config.set -> config.get -> config.get -> agents.list