$ cat openclaw/month/2026-08-01.log
the month in review · August 2026
2026.8.1-beta.2 binds secrets to exact HTTPS hosts
Crabbox reaches v0.44.0 with credential-free provider discovery, while the beta release hardens secret egress.
OpenClaw 2026.8.1-beta.2 openclaw/openclaw
Shared-store secrets now bind to exact HTTPS destination hosts across CLI, Gateway RPC, and Control UI, so unbound sentinel substitution fails closed before plaintext egress. The release also adds GPT-5.6 Ultra support with runtime switching. Breaking changes apply, so check the migration notes.
v0.44.0 openclaw/crabbox
Adds credential-free `crabbox providers describe` for canonical provider-scoped run flags, and supports versioned `go install` as a CLI-only installation channel with clean module semantics. Hardened provisioning recovery follows the prior runpod SSH key fix.
improve(update): reuse dev preflight build cache openclaw/openclaw
Source-checkout operators updating on the dev channel previously waited for the same expensive TypeScript declaration build twice, once in the preflight worktree and again after the live checkout moved. Dev preflight now reuses the build cache, cutting update time for that workflow.
fix(google): preserve canonical replay and provider error ownership openclaw/openclaw
Repairs the Google/Vertex provider so the exact provider Part owning every thought signature is preserved across streamed text, thinking, tools, standalone signature carriers, and next-turn replay; SDK failures now surface actionable errors instead of losing ownership. Callers relying on Gemini signatures should upgrade.
fix(talk): bound durable transcript persistence openclaw/openclaw
Durable Talk transcript persistence could retain an unbounded backlog when the Gateway persistence path stalled, increasing memory use in long-running voice sessions. A single bounded serial queue now caps the backlog.
fix(worker): harden provider reconciliation openclaw/crabbox
Crabbox now quarantines exact coordinator-owned AWS and Azure orphan candidates only after consecutive successful inventories before deletion, and preserves provider-tag-only and `keep=true` resources as report-only. Bounded per-provider-scope circuit backoff follows inventory failures, and quarantine state persists in the store.
fix(runpod): make new pods accept the configured SSH key openclaw/crabbox
Users provisioning RunPod leases with a configured `ssh.key` previously got a running pod with an exposed SSH port but no matching authorized key, with `PUBLIC_KEY` possibly reporting `null`. New pods now accept the configured SSH key.
fix(ui): eliminate core contract drift openclaw/openclaw
The Control UI carried drifted copies of security policy and gateway/core wire types, so sensitive config keys and dozens of credential families were not masked in browser-rendered tool details. Eliminating the drift means UI task, channel, and thinking declarations can no longer silently diverge from runtime contracts.
$ ls openclaw/month/ # the briefings behind this review