admin/ComfyUI-OpenClaw
1
0
Fork 0
mirror of https://github.com/rookiestar28/ComfyUI-OpenClaw.git synced 2026-08-14 08:52:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: summarize recent hardening and host alignment

Browse Source
This commit is contained in:
rookiestar28
2026-07-31 14:25:56 +08:00
parent 7d7a1c412f
commit b6760ee595
7 changed files with 166 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+46 -29
View File
@@ -91,6 +91,40 @@ Deployment profiles and hardening references:
<details>
<summary><strong>Startup, security posture, and architecture boundaries hardened</strong></summary>
- Added an executable production dependency boundary check that detects forbidden ownership
direction, cycles, and dynamic-import drift without importing application modules.
- Startup health now exposes typed, redacted phase, readiness, retry, fatal, timing, and optional
warmup outcomes.
- Process-static deployment and security decisions now resolve once into an immutable,
secret-free posture snapshot reused across startup and authorization boundaries.
- Bootstrap lifecycle, route registration, and effective posture implementations now live in
focused owner packages while legacy import identities remain compatible.
- The public systemd environment template now follows `.env.example` conventions, while
secret-bearing deployment environment files remain excluded from version control.
</details>
<details>
<summary><strong>Host alignment, Parameter Lab, and native workflow ownership refreshed</strong></summary>
- Legacy fixed-bundle Desktop and current managed-install Comfy-Desktop are modeled separately;
current bridge presence is detected without granting privileged capability access.
- ComfyUI's `datasets` user-data root is excluded from model inventory and Model Manager
destinations.
- Parameter Lab now accepts only bounded scalar values and correlates queued runs through exact
request-ID receipts, failing explicitly on unsupported or ambiguous host queue shapes.
- Advanced 3D `result` references are recognized as bounded output links without inspecting
later metadata or rendering binary content.
- Native ComfyUI video/webcam inputs, audio and text-to-speech flows, and the Graph/Workflows
workspace remain host-owned instead of being duplicated by OpenClaw.
</details>
<details>
<summary><strong>Maintainability, scale safeguards, and verification governance strengthened</strong></summary>
- Added pinned incremental Ruff and Mypy enforcement that blocks new production-code debt in
@@ -140,33 +174,6 @@ Deployment profiles and hardening references:
</details>
<details>
<summary><strong>Package hygiene, runtime cache ownership, and tool diagnostics tightened</strong></summary>
- Moved developer-only verification helpers out of the package root and into the dedicated developer tooling area, keeping the shipped custom-node pack boundary clearer.
- The default external-tool allowlist now resolves from the package-owned `data/tools_allowlist.json`; custom allowlists should use `OPENCLAW_TOOLS_CONFIG_PATH` instead of relying on state-directory shadow files.
- Runtime cache and external-tool sandbox scratch paths are treated as state-directory-owned generated data, while repo-local `.tmp`, virtualenv, and frontend dependency folders remain regenerated local tooling artifacts.
- External-tool failures now have deterministic service-level diagnostics for missing sandbox runtime, missing executable/interpreter, timeout, workspace/path violation, and process failure, without adding Docker or broad fallback execution.
- Python formatter/import-order settings and targeted package-hygiene regressions were aligned so validation catches future root clutter, package-resource, and runtime-cache ownership drift.
</details>
<details>
<summary><strong>ComfyUI host compatibility, media outputs, model folders, and prompt attribution refreshed</strong></summary>
- Refreshed the published compatibility baseline for ComfyUI `9cf91339` (`v0.29.0-12-g9cf91339`, pyproject `0.29.0`), standalone frontend `1.49.1` (`4b3866b838`, `v1.49.1-19-g4b3866b838`), legacy Desktop `0.9.4` with fixed core `0.22.3` plus frontend `1.43.18`, and current Comfy-Desktop `1.0.32-rc.1` (`85e28b7a`, `v1.0.32-rc.1-3-g85e28b7`) whose hosted versions are installation-specific.
- Reconciled active prompt state after backend or SSE reconnects so completed prompts are not left in the active queue lane after a host recovery.
- Updated sidebar registration to prefer the current ComfyUI sidebar store API and keep the deprecated frontend facade as a compatibility fallback for older hosts.
- Aligned Model Manager and preflight diagnostics with current ComfyUI model folder names, including newer managed keys such as `gligen`, `latent_upscale_models`, `hypernetworks`, `photomaker`, `model_patches`, `geometry_estimation`, and `detection`, while retaining legacy aliases such as `clip` and `unet`.
- Made output parsing media-aware for current previewable result groups (`images`, `video`, `audio`, `3d`, and bounded `text`) while keeping image callbacks compatible, supporting optional hash-backed refs when host metadata is present, and keeping asset-only identifiers as explicit fallback states instead of silently upgrading to `/api/assets`.
- Added Job Monitor support for allowlisted text files under the host `files` output key. Previews use same-origin `/view`, a 5-second timeout, strict textual MIME and UTF-8 checks, a 64-KiB streaming cap, a 4,096-character display cap, and literal text rendering; rejected or unsupported responses keep an explicit source link.
- OpenClaw prompt submissions now include stable `comfy_usage_source` attribution when missing, without overwriting caller-provided attribution or copying prompt/tenant/trace content into that field.
- Updated public release/support/troubleshooting docs to match the refreshed host facts and avoid exposing maintainer-only planning paths or machine-local links.
</details>
See full update history: [docs/release/recent_updates.md](docs/release/recent_updates.md)
</details>
@@ -481,7 +488,12 @@ New shell/tab wiring should use the shared text-safe DOM helpers in `web/opencla
Canonical DOM/class ownership is now centered on `openclaw-*`; legacy `moltbot-*` class compatibility is still supported through shared runtime aliasing instead of duplicated markup in each tab template.
The sidebar now also resolves and stamps its active host surface (`standalone_frontend` vs legacy desktop-embedded host) and reference metadata at mount time, so Desktop `0.9.4` embedded-frontend lag against standalone frontend `1.49.1` is explicit and testable. It also publishes the current Comfy-Desktop `1.0.32-rc.1` managed-install reference without claiming fixed hosted component versions or enabling its dedicated runtime adapter early.
The sidebar now also resolves and stamps its active host surface (`standalone_frontend`, legacy
`desktop`, or current managed-install `comfy_desktop`) and reference metadata at mount time, so
Desktop `0.9.4` embedded-frontend lag against standalone frontend `1.49.1` is explicit and
testable. The current Comfy-Desktop `1.0.32-rc.1` reference keeps hosted component versions
installation-specific and recognizes `window.__comfyDesktop2` as presence metadata only; bridge
detection does not authorize privileged capability calls.
Sidebar registration prefers ComfyUI's current sidebar store API and falls back to the deprecated frontend facade when running on older host bundles. Hosts without either sidebar API use the legacy menu fallback instead of failing extension setup.
@@ -503,7 +515,7 @@ The OpenClaw sidebar includes these built-in tabs. Some tabs are capability-gate
| `Explorer` | Inventory/preflight diagnostics and snapshot/checkpoint troubleshooting workflows, including snapshot-first inventory refresh state (`snapshot_ts`, `scan_state`, `stale`, `last_error`) and suppressed inactive-branch findings. | [Operator UX Features](#operator-ux-features), [Troubleshooting](#troubleshooting) |
| `Packs` | Dedicated pack lifecycle tab for import/export/delete under admin boundary. | [API Overview](#api-overview) |
| `PNG Info` | Inspects saved generation images through drag-and-drop, file picker, or scoped paste, parses A1111 infotext plus ComfyUI `prompt` / `workflow` metadata, shows extracted prompt and generation fields when recoverable, and keeps raw metadata visible for operator inspection. | [API Overview](#api-overview), [Troubleshooting](#troubleshooting) |
| `Model Manager` | Searches model catalog/install records, queues managed downloads, monitors task lifecycle, and imports completed tasks into the managed install root with current ComfyUI folder-key normalization, including `gligen`, `latent_upscale_models`, `hypernetworks`, `photomaker`, `model_patches`, `geometry_estimation`, and `detection`, plus legacy type aliases. | [API Overview](#api-overview), [Troubleshooting](#troubleshooting) |
| `Model Manager` | Searches model catalog/install records, queues managed downloads, monitors task lifecycle, and imports completed tasks into the managed install root with current ComfyUI folder-key normalization, including `gligen`, `latent_upscale_models`, `hypernetworks`, `photomaker`, `model_patches`, `geometry_estimation`, and `detection`, plus legacy type aliases. User-managed `datasets` remain outside model inventory and install destinations. | [API Overview](#api-overview), [Troubleshooting](#troubleshooting) |
| `Parameter Lab` | Runs bounded sweep/compare experiments, stores history, and replays parameters back into the graph while preserving non-numeric host node IDs. | [Operator UX Features](#operator-ux-features) |
## Operator UX Features
@@ -540,6 +552,11 @@ Parameter Lab now supports experiment history and run replay:
- `History` lists saved experiments from local state.
- `Load` opens stored experiment details and run statuses.
- `Replay` applies a selected run's parameter values back into the active workflow graph without coercing string or non-numeric host node IDs.
- Sweep and compare inputs accept bounded strings, booleans, and finite numbers; structured values
and unsupported sweep strategies fail validation instead of being guessed or silently coerced.
- Queued runs use request-ID-correlated receipts to bind the exact host prompt ID. Unsupported,
malformed, busy, or ambiguous host queue boundaries fail explicitly rather than borrowing a
globally recent prompt.
This makes iterative tuning and backtracking faster without manually retyping prior parameter sets.
docs/frontend_ux_walkthrough.md
+20 -6
View File
@@ -20,7 +20,9 @@ This document summarizes the current OpenClaw sidebar UI structure and how to ve
- Settings: `web/tabs/settings_tab.js` composes status, LLM, secrets, logs, and DOM owner modules.
Its lifecycle owner invalidates stale async generations and clears scheduled work when the tab
is disposed, preventing late responses from mutating a remounted pane.
- Host surface: `web/openclaw_host_surface.js` resolves the active frontend host surface and stamps explicit metadata so standalone frontend vs desktop-embedded behavior stays testable.
- Host surface: `web/openclaw_host_surface.js` resolves standalone frontend, legacy fixed-bundle
Desktop, and current managed-install Comfy-Desktop separately, then stamps explicit metadata so
generation-specific behavior stays testable.
- Output refs: `web/openclaw_asset_refs.js` normalizes classic history refs, optional `asset_hash`/`hash` refs when host metadata is present, and current previewable media groups (`images`, `video`, `audio`, `3d`, bounded inline or file-backed `text`) onto one media-aware contract. Allowlisted text files under the host `files` key stay on same-origin `/view` and use a 5-second, 64-KiB streaming, strict textual-MIME/UTF-8 reader with a 4,096-character display cap. HDR `.exr` / `.hdr` image refs show source-preview fallback links instead of normal thumbnails, text reaches the DOM only as literal text, and asset-service-only refs remain explicit fallback states instead of silently auto-fetching `/api/assets`.
- Styles: `web/openclaw.css` provides shared design tokens and component classes.
- Errors and compatibility helpers: `web/openclaw_utils.js` provides `showError()` / `clearError()` plus runtime legacy-class alias helpers used to keep canonical `openclaw-*` markup compatible with existing `moltbot-*` selectors.
@@ -36,6 +38,9 @@ Refactor note:
- New host sidebar registration changes should stay in `web/openclaw_sidebar_registration.js` rather than duplicating ComfyUI frontend API detection inside the extension entrypoint.
- Host-sensitive behaviors should consume the shared host-surface helper rather than inferring desktop vs standalone frontend from ad-hoc globals.
- Graph/widget flows should preserve host-shaped promoted-widget source metadata and non-numeric node IDs, including Parameter Lab replay/apply paths.
- Parameter Lab flows should keep scalar/count/byte validation aligned with the backend policy and
use exact request-ID queue receipts; they must not infer prompt ownership from a globally recent
prompt when the host request boundary is unsupported or ambiguous.
- Output preview flows should consume the shared asset-ref normalizer rather than assembling `/view` URLs independently in each tab, treating non-image or HDR media as broken images, or silently widening runtime behavior to direct `/api/assets` fetches.
- Explorer/preflight consumers should treat inventory diagnostics as snapshot-first and surface `snapshot_ts`, `scan_state`, `stale`, and `last_error` instead of blocking the UI on full rescans.
- Explorer/preflight rendering should keep actionable missing-node/model failures separate from suppressed inactive-branch findings returned by the backend.
@@ -56,9 +61,15 @@ If `assist_streaming` is unavailable or the stream transport degrades, Planner/R
## Host-Surface Contract
- OpenClaw treats standalone `ComfyUI_frontend` and `desktop` as distinct frontend host surfaces.
- OpenClaw treats standalone `ComfyUI_frontend`, legacy fixed-bundle `desktop`, and current
managed-install `comfy_desktop` as distinct frontend host surfaces.
- The sidebar stamps its resolved host surface and refreshed host-reference metadata at mount time so desktop bundle drift is explicit in diagnostics and regression tests.
- The standalone Remote Admin Console now stamps the same host-surface metadata on its document root, including legacy Desktop `0.9.4`, fixed core `0.22.3`, embedded frontend `1.43.18`, and lagging parity relative to standalone frontend `1.49.1`. It also exposes the current Comfy-Desktop `1.0.32-rc.1` managed-install reference with `installation_specific` hosted versions, without activating its dedicated runtime adapter.
- The standalone Remote Admin Console stamps the same host-surface metadata on its document root,
including legacy Desktop `0.9.4`, fixed core `0.22.3`, embedded frontend `1.43.18`, and lagging
parity relative to standalone frontend `1.49.1`. It also exposes current Comfy-Desktop
`1.0.32-rc.1` with `installation_specific` hosted versions. Presence of
`window.__comfyDesktop2` identifies that host generation only; it does not authorize privileged
capability calls or inspect bridge members.
- Graph/widget compatibility code should route through shared host helpers to keep nested-subgraph and promoted-widget behavior aligned with current upstream host semantics, including preserving source metadata and string-shaped node IDs.
## Standalone Remote Admin Console
@@ -96,9 +107,12 @@ If `assist_streaming` is unavailable or the stream transport degrades, Planner/R
4. Planner: click **Plan Generation** with minimal input and confirm either live preview/stage updates appear (when streaming is supported) or a readable fallback result/error appears.
5. Refiner: click **Refine Prompts** (with or without image) and confirm either live preview/stage updates appear (when streaming is supported) or a readable fallback result/error appears.
6. Jobs: verify output previews still resolve for classic history refs, optional hash-backed refs when host metadata is present, and supported media-aware refs (`images`, `video`, `audio`, `3d`, bounded inline/file-backed `text`); allowlisted text files should show literal bounded content or a deterministic source-link fallback, HDR `.exr` / `.hdr` image refs should render as explicit source-preview fallback links, asset-service-only refs should stay explicit as a bounded fallback state, and repeated polls should not duplicate rows after reconnect/resume.
7. Explorer: verify preflight inventory can show `refreshing` / `stale` / `error` state without freezing the tab while deep scan work continues, and verify inactive-branch suppressed findings render separately from actionable failures.
8. Library/Approvals: if backend endpoints are not enabled, confirm the UI shows a clear error state (no crashes).
9. If you simulate/fake a stream failure in dev tools, confirm Planner/Refiner retry through the classic non-stream path without duplicate submits or broken loading state.
7. Parameter Lab: verify bounded scalar sweep/compare values queue with an exact request receipt,
and verify unsupported structured values or unknown host queue-event shapes fail visibly without
assigning another prompt's lifecycle.
8. Explorer: verify preflight inventory can show `refreshing` / `stale` / `error` state without freezing the tab while deep scan work continues, and verify inactive-branch suppressed findings render separately from actionable failures.
9. Library/Approvals: if backend endpoints are not enabled, confirm the UI shows a clear error state (no crashes).
10. If you simulate/fake a stream failure in dev tools, confirm Planner/Refiner retry through the classic non-stream path without duplicate submits or broken loading state.
## E2E (Playwright) Checks
docs/release/api_contract.md
+1 -1
View File
@@ -181,7 +181,7 @@ Model-manager contract notes:
- `/models/downloads` supports `since_seq` cursor polling and may return deterministic delta metadata (`requested_since_seq`, `effective_since_seq`, `next_since_seq`, truncation/reset hints) alongside the task list
- `model_type` values SHOULD use current ComfyUI folder keys where applicable, including `text_encoders`, `diffusion_models`, `clip_vision`, `style_models`, `upscale_models`, `vae_approx`, `gligen`, `latent_upscale_models`, `hypernetworks`, `photomaker`, `model_patches`, `audio_encoders`, `background_removal`, `frame_interpolation`, `geometry_estimation`, `optical_flow`, and `detection`
- legacy aliases such as `ckpt`, `checkpoints`, `loras`, `controlnets`, `clip`, `text_encoder`, `unet`, `diffusion_model`, `upscale_model`, `latent_upscale_model`, `hypernetwork`, `model_patch`, and `audio_encoder` are normalized before filtering or import destination resolution
- current ComfyUI folder keys that are not managed model-file destinations fail closed for download creation: `configs` (configuration YAML), `diffusers` (folder-valued trees), `classifiers` (extensionless classifier artifacts), and `custom_nodes` (executable plugin code)
- current ComfyUI folder keys that are not managed model-file destinations fail closed for download creation: `configs` (configuration YAML), `diffusers` (folder-valued trees), `classifiers` (extensionless classifier artifacts), `custom_nodes` (executable plugin code), and `datasets` (user-managed training data)
- download creation requires structured provenance metadata (`publisher`, `license`, `source_url`) and a 64-char `expected_sha256`
- import keeps fail-closed destination/filename validation and re-checks the staged file hash before activation
docs/release/ci_regression_policy.md
+1
View File
@@ -8,6 +8,7 @@ All pull requests must pass the repository SOP gate before merge.
| --- | --- | --- |
| Secret detection | `pre-commit run detect-secrets --all-files` | Prevent secret leakage |
| Pre-commit hooks | `pre-commit run --all-files --show-diff-on-failure` | Enforce formatting and static checks |
| Production dependency boundary | `python scripts/verify_production_dependencies.py` | Parse tracked production imports without importing modules; block ownership, direction, cycle, and dynamic-import drift |
| Frontend dependency audit | `npm audit --production` | Fail on production dependency vulnerabilities in the shipped Node dependency surface |
| Backend dependency audit | `pip-audit -r requirements.txt` | Audit declared Python project dependencies without scanning unrelated CI runner/toolchain packages |
| GitHub CodeQL analysis | `.github/workflows/codeql.yml` | Run repository-native static security analysis for Python, JavaScript/TypeScript, and GitHub Actions on push, pull request, and weekly schedule |
docs/release/operator_ux_contracts.md
+22 -8
View File
@@ -122,7 +122,7 @@ interface ContextAction {
}
```
## 3. Parameter Lab (F52)
## 3. Parameter Lab
Contracts for bounded parameter sweeps and experiment orchestration.
@@ -135,17 +135,15 @@ Contracts for bounded parameter sweeps and experiment orchestration.
{
"node_id": "10",
"widget_name": "cfg",
"values": [6.0, 7.0, 8.0]
"values": [6.0, 7.0, 8.0],
"strategy": "grid"
},
{
"node_id": "3",
"node_id": "loader-alpha",
"widget_name": "seed",
"strategy": "random",
"count": 3
"values": [41, 42]
}
],
"max_runs": 20,
"batch_size": 1
]
}
```
@@ -153,6 +151,22 @@ Contract notes:
- `node_id` is a string-preserving host graph identifier. It may be numeric text such as `"10"` or a non-numeric host ID, and clients must not coerce it to a number when storing, comparing, or replaying experiment parameters.
- Experiment parameter keys such as `"10.cfg"` are display/storage keys derived from the original `node_id` plus `widget_name`; they are not a separate numeric node contract.
- Sweep values are limited to bounded strings, booleans, integers, and finite numbers. Null,
arrays, objects, non-finite numbers, overlong strings, presentation-ambiguous duplicates, and
unsupported strategies fail validation instead of being coerced.
- Sweep creation supports `grid` strategy only. The backend policy is authoritative and limits a
request to 5 MiB, workflow text to 4 MiB, eight dimensions, 50 values per dimension, and 50
generated combinations. Compare creation accepts at most eight scalar items.
### Queue ownership receipt
- The coordinator observes the host's reviewed `promptQueueing` and `promptQueued` request
boundaries, correlating their integer `requestId` and `batchCount` fields.
- It writes a transient UUID receipt only into the matching serialized workflow and returns the
exact `promptId` / `requestId` pair used to route bounded lifecycle event metadata.
- Unsupported event APIs, malformed or missing boundaries, pre-existing unobserved host queue
activity, receipt collisions, timeouts, and ambiguous batch ownership fail explicitly. There is
no fallback to a globally recent prompt ID.
### Experiment Result Schema (JSON)
docs/release/recent_updates.md
+40
View File
@@ -7,6 +7,46 @@ Newest entries appear first.
<details>
<summary><strong>Startup, security posture, and architecture boundaries hardened</strong></summary>
- Added a dependency-light production source verifier to pre-commit. It parses tracked Python
imports without importing application modules and fails on unknown ownership, forbidden
dependency direction, cycles, and unreviewed dynamic imports.
- Replaced coarse startup reporting with typed, redacted phase and state outcomes, bounded retry
and timing metadata, and explicit optional warmup results.
- Consolidated process-static deployment and security decisions into one immutable, secret-free
effective posture snapshot reused by startup, control-plane, and surface guards.
- Moved startup lifecycle, route registration, and effective posture implementations into focused
service-domain owner packages while preserving legacy module identity aliases.
- Replaced the public systemd environment file with an `.env.example`-style template and retained
a hard version-control boundary around secret-bearing environment files.
</details>
<details>
<summary><strong>Host alignment, Parameter Lab, and native workflow ownership refreshed</strong></summary>
- Split host metadata between legacy fixed-bundle Desktop and current managed-install
Comfy-Desktop. Presence of `window.__comfyDesktop2` identifies the current host generation but
never authorizes privileged bridge capability calls.
- Excluded ComfyUI's `datasets` user-data root from model inventory and Model Manager destination
handling so training data is not treated as managed model weights.
- Bounded Parameter Lab creation and persistence to string, boolean, integer, and finite-number
values, with byte/count limits, grid-only sweep validation, and explicit rejection of nested or
ambiguous values.
- Correlated Parameter Lab queue ownership through reviewed `promptQueueing` / `promptQueued`
request IDs and transient workflow receipts, failing closed on unsupported, malformed, busy, or
ambiguous host queue boundaries.
- Recognized advanced 3D `result` references as bounded source links without consuming later
metadata or rendering binary content.
- Documented native ComfyUI ownership for video/webcam inputs, audio and text-to-speech flows, and
the Graph/Workflows workspace instead of introducing duplicate OpenClaw node or workspace stacks.
</details>
<details>
<summary><strong>Maintainability, scale safeguards, and verification governance strengthened</strong></summary>
- Added a pinned incremental Ruff/Mypy policy to local, pre-commit, and CI validation. Existing
docs/runtime_hardening_and_startup.md
+36 -4
View File
@@ -6,6 +6,8 @@ This guide explains the startup security model and bridge compatibility behavior
- Runtime profile selection
- Hardened startup enforcement behavior
- Typed startup lifecycle diagnostics
- Process-static effective security posture
- External tool sandbox diagnostics
- Module startup boundaries
- Bridge protocol handshake compatibility
@@ -53,18 +55,48 @@ If a critical startup gate fails, initialization aborts deterministically instea
The health response includes a `startup` diagnostic object with:
- `state`: `starting`, `ready`, `degraded-warmup`, or `fatal-startup`
- `schema_version`: diagnostic schema version
- `phase`: `package_import`, `required_initialization`, `host_wait`,
`route_registration`, `complete`, or `optional_warmup`
- `state`: `starting`, `initializing`, `waiting_for_host`, `registering_routes`, `ready`,
`degraded`, or `fatal`
- `reason_code`: stable, content-free transition reason
- `ready`: whether required route/service startup completed
- `fatal`: bounded fatal-startup details when required startup fails
- `warmups`: bounded status for optional background warmups
- `degraded` and `fatal`: explicit terminal posture flags
- `attempt` and `max_attempts`: bounded host-wait retry progress
- `elapsed_ms`, `phase_elapsed_ms`, and `ready_elapsed_ms`: bounded lifecycle timing
- `warmups`: bounded optional warmup entries with name, state, reason, timeout, and duration
Required startup work still fails closed. Optional warmups such as model inventory refresh run after route registration and do not block baseline API availability. Their failures or timeouts are reported as `degraded-warmup`.
Required startup work still fails closed. Optional warmups such as model inventory refresh run after
route registration and do not block baseline API availability. A failed or timed-out optional
warmup changes the startup state to `degraded`; individual warmup states are `pending`, `running`,
`succeeded`, `failed`, or `timed_out`.
Optional warmup timeout can be tuned with:
- `OPENCLAW_STARTUP_WARMUP_TIMEOUT_SEC`
- legacy alias: `MOLTBOT_STARTUP_WARMUP_TIMEOUT_SEC`
### Effective security posture snapshot
During the process-wide route bootstrap, OpenClaw resolves deployment, runtime, connector,
control-plane, and surface decisions once into an immutable `EffectiveSecurityPosture` snapshot.
The snapshot records configuration presence and stable decision codes, not secret values.
Startup gates, control-plane policy, and surface authorization reuse this same object identity so
process-static security decisions cannot drift between modules. Request-dynamic controls such as
authentication, replay checks, and rate limiting still evaluate each request using their normal
runtime inputs.
The owner modules are:
- `services/bootstrap/lifecycle.py`
- `services/bootstrap/registration.py`
- `services/posture/effective.py`
Legacy imports remain identity-preserving aliases. See
[Service Domain Packages](architecture/service_domain_packages.md) for the ownership contract.
## Public deployment shared-surface acknowledgement
When running deployment profile checks for public posture (`OPENCLAW_DEPLOYMENT_PROFILE=public`),