$ the-wire · showcase
Windows node hardens signing; Crabbox adds recovery and pond mesh
By RepoJournal · Filed · About OpenClaw
Windows node release signing is now scoped to OpenClaw-owned EXEs with a verifier, while Crabbox can recover from AWS security group rule exhaustion and introduces a new pond grouping primitive.
The Windows node tightened its release pipeline: the repo now verifies a release payload executable signer and stops recursively signing every `.exe` [1]. Only `OpenClaw.Tray.WinUI.exe` and `SetupEngine\OpenClaw.SetupEngine.UI.exe` are staged for Azure Trusted Signing, and `tools\mxc\<arch>\wxc-exec.exe` is explicitly classified as third-party and excluded. Hardlinks are staged only for those OpenClaw-owned executables before signing. This is a breaking change for any release automation that relied on the previous recursive signing behavior [1]. Separately, the local dev setup now detects missing Node.js or npm before invoking the tray build, with an actionable hint pointing to the nodejs.org installer, and the "open log" hyperlink is wired up in the SetupEngine UI [2].
OpenClaw added Claude Opus 4.8 support across the Anthropic API, Claude CLI, Anthropic Vertex, Amazon Bedrock, QA fixtures, docs, and workflow defaults [3]. Thinking stays off by default, while explicit high/xhigh/max adaptive effort is preserved where the provider supports it. Also, the ingress channel policy conformance layer now reports findings when the configured workspace does not satisfy the authored policy. It checks "per-channel-peer" DM scope and allows DM policies such as pairing, allowlist, or disabled, with deny-open-group options [4]. This is config-level conformance only; it does not add runtime channel enforcement [4]. Additionally, a gateway fix clears completed session active runs [5], and manual git fetches in CI are now bounded with a 30-second timeout to prevent hangs [6].
Crabbox now recovers from AWS security group rule exhaustion by compacting stale rules and retrying SSH ingress authorization when EC2 reports `RulesPerSecurityGroupLimitExceeded` [7]. Legacy unlabeled SSH ingress is reclaimed only on Crabbox-managed groups while active and requested CIDRs are preserved. Separately, the new pond feature introduces a peer discovery and mesh transport grouping primitive with `--pond`, reserved pond labels, Tailscale ACL bootstrap, bridge-provider discovery, and SSH-mesh forwarding [8]. Pond metadata persists through local claims, coordinator requests, worker lease records, and provider labels.
Across the docs and tools, a security fix hardens HTML text extraction [9], and Crabbox addresses CodeQL alerts, suppresses an SSH CodeQL boundary [10], and recovers from security group rule exhaustion [11]. The docs assistant now stays closed by default [12].
Action items
- → Review Windows node release pipelines for the new signing verifier and scoped executable list before next release openclaw/openclaw-windows-node [immediate]
- → Test Claude Opus 4.8 in staging, keeping thinking features off by default openclaw/openclaw [monitor]
- → Verify AWS Crabbox environments handle rule exhaustion with the new recovery logic before incidents hit openclaw/crabbox [plan]
- → Assess the new pond grouping primitive for any planned network changes openclaw/crabbox [monitor]
References
- [1] Guard release executable signing ↗ openclaw/openclaw-windows-node
- [2] Fix local dev setup: Node.js prereq, log link, WSL diagnostics ↗ openclaw/openclaw-windows-node
- [3] feat: add Claude Opus 4.8 support ↗ openclaw/openclaw
- [4] Policy: add ingress channel conformance checks ↗ openclaw/openclaw
- [5] fix(gateway): clear completed session active runs ↗ openclaw/openclaw
- [6] fix(ci): bound manual git fetches ↗ openclaw/openclaw
- [7] fix(aws): recover from security group rule exhaustion ↗ openclaw/crabbox
- [8] feat: introduce pond (peer discovery + bridge + ssh-mesh) (#129) ↗ openclaw/crabbox
- [9] fix(security): harden docs HTML text extraction ↗ openclaw/docs
- [10] fix(security): suppress SSH CodeQL boundary ↗ openclaw/crabbox
- [11] fix(aws): recover from security group rule exhaustion ↗ openclaw/crabbox
- [12] fix: keep docs assistant closed by default ↗ openclaw/docs
