OpenClaw v2026.3.23: Channel auth, operator field notes

The source record for v2026.3.23 names a provider, model, voice, or context change. This is an operator's reading of that record, with the exact source facts kept next to a bounded experiment rather than a generic feature list.

Treat this as a stable maintenance checkpoint and keep the release record beside the backup and rollback evidence. A release tag describes the project change. Your Gateway's provider, channel, platform, and account support should be recorded separately.

A small field test

01 / ModelStudio/Qwen

Source signal. add standard (pay-as-you-go) DashScope endpoints for China and global Qwen API keys alongside the existing Coding Plan endpoints, and relabel the provider group to Qwen (Alibaba Cloud Model Studio).

A catalog label for ModelStudio/Qwen is only the first signal. Confirm the account, endpoint, context limit, and tool policy that the running Gateway actually selected.

02 / UI/clarity

Source signal. consolidate button primitives (btn--icon, btn--ghost, btn--xs), refine the Knot theme to a black-and-red palette with WCAG 2.1 AA contrast, add config icons for Diagnostics/CLI/Secrets/ACP/MCP sections, replace the roundness slider with discrete stops, and improve accessibility with aria-labels across usage filters.

Read UI/clarity as an authorization checkpoint: prove who may act, what the action can reach, and how the rejected attempt is surfaced to the operator.

03 / CSP/Control UI

Source signal. compute SHA-256 hashes for inline <script> blocks in the served index.html and include them in the script-src CSP directive, keeping inline scripts blocked by default while allowing explicitly hashed bootstrap code.

Test CSP/Control UI at the edges of the interface: clean start, reload, reconnect, and a refused or unavailable action. Keep the final screen and error message with the release note.

04 / Plugins/bundled runtimes

Source signal. ship bundled plugin runtime sidecars like WhatsApp light-runtime-api.js, Matrix runtime-api.js, and other plugin runtime entry files in the npm package again, so global installs stop failing on missing bundled plugin runtime surfaces.

Use Plugins/bundled runtimes as a routing test: capture the destination before the send, interrupt the transport, and verify that retry logic did not duplicate or redirect the response.

The details that affect a runbook

CLI/channel auth

auto-select the single configured login-capable channel for channels login/logout, harden channel ids against prototype-chain and control-character abuse, and fall back cleanly to catalog-backed channel installs, so channel auth works again for single-channel setups and on-demand channel installs.

Treat CLI/channel auth as a boundary change. Exercise one permitted request and one refused request with a test identity, then keep both decisions in the log.

Operator checklist before rollout

1. Before touching persistent state, capture the version, host, provider, and workspace for ModelStudio/Qwen.
2. Read the linked release record and verify a backup whenever the change can alter configuration or session data.
3. Interrupt one delivery after admission, reconnect the transport, and compare the final reply with the original conversation.
4. Force a short transport interruption and verify that retry or recovery preserves the original thread and sender.
5. Close the test with the evidence attached, and do not widen the rollout while a behavior remains unexplained.

openclaw --version
openclaw gateway status
openclaw security audit

Keep the source trail attached

Close the loop with an explicit next action: keep the candidate isolated, proceed with the staged upgrade, or stop and investigate. Do not treat a green install as proof that the runtime path is correct.

Regression cases from the source

Plugins/bundled runtimes. ship bundled plugin runtime sidecars like WhatsApp light-runtime-api.js, Matrix runtime-api.js, and other plugin runtime entry files in the npm package again, so global installs stop failing on missing bundled plugin runtime surfaces. Treat the fix as a boundary condition and retain the source wording beside your local result.

CLI/channel auth. auto-select the single configured login-capable channel for channels login/logout, harden channel ids against prototype-chain and control-character abuse, and fall back cleanly to catalog-backed channel installs, so channel auth works again for single-channel setups and on-demand channel installs. Keep the reproduction and the post-fix result together in the acceptance record.

This page is a practical reading of the v2026.3.23 source record; the release index and model provider reference remain the references to use for migrations and support boundaries.