OpenClaw 2026.10.10 Stays Untagged Through a Night of Bun and Clock Repairs as Main Keeps PostgreSQL Credentials Out of Agent Shells

Follow-Up: 2026.10.10 Is Still Untagged After a Night of Candidate Repairs

Yesterday we reported that OpenClaw had replaced its first frozen 2026.10.10 stable candidate. As of about 6:20 AM Pacific on Sunday, the release still has not shipped. The OpenClaw releases page on GitHub still lists 2026.10.10-beta.5 as the newest build, there is no v2026.10.10 tag, and npm still reads latest 2026.10.9, extended-stable 2026.9.36 and beta 2026.10.10-beta.5. The docs page for 2026.10.10 release notes still returns a 404.

The release branch kept moving all night. It is now 171 commits ahead of beta.5, up from 97 when we checked Saturday morning, and 28 of those commits are titled as attestation or provenance records. At 8:19 PM Pacific on Saturday, maintainer Dallin Romney recorded what the branch called an attestation of the "final repaired candidate", signed with the maintainer identity registered for GitHub signature verification. It did not stay final. Within half an hour the branch added WebKit to the Control UI end-to-end test shards and attested again. Later rounds cleared static lint and file-size blockers, pinned a repaired release evaluator, and fixed final validation regressions. The managed Codex pin on the branch is still 0.164.0, and the package version is still 2026.10.10.

The two most recent repairs are the interesting ones, and both are about the release machinery rather than the product. At 3:15 AM Pacific Standard Time, the RoboClaw release bot committed a repair of the Bun 1.4.4 launcher lifecycle. Its new test is named "accepts Bun 1.4.4's generated postinstall PATH layout only for recovery." The fix teaches OpenClaw's package runtime check to recognize the PATH layout that Bun 1.4.4 generates for postinstall scripts, and a code comment says that relaxed layout "is accepted only by packaged postinstall recovery." It follows a Saturday afternoon commit titled "repair Bun launcher without Node." The Bun 1.4.4 requirement itself joined the candidate on Friday night, as we reported yesterday. The other repair was a clock bug, covered in the next section. We still don't have a release date. It is TBD until a tag appears.

A Clock Bug on the Night the Clocks Changed

One overnight blocker involved timestamps. Pull request #190166, which makes release admission tolerate DST-skewed artifact timestamps, explains that Full Release Validation checks that the retained qualification artifact was produced by the exact successful job and upload step that should have made it. According to the PR, "GitHub Actions can report the upload step timestamps in a DST-skewed/local-time fallback" while the artifact's creation time and the job's timestamps stay in UTC. A valid artifact then looked as if it had been created outside its upload step, and admission blocked the run "before any validation children were dispatched."

The fix widens the check from the upload step's interval to the interval of the whole successful producer job. It keeps the exact workflow, run, attempt, artifact name, commit, upload-step success, archive digest and authority checks. The PR's evidence shows the same verifier rejecting the artifact on the old code and accepting it on the new code, rejecting an artifact taken from a different producer run, and rejecting a request after the operator's permission was revoked. Romney cherry-picked the change onto the release branch at 1:03 AM Pacific Standard Time and attested the candidate a minute later. That was the second 1 AM of the night, because US clocks fell back at 2 AM. The PR merged to main at 1:45 AM.

The PR does not say the switch to standard time caused the skew. It only describes a DST-skewed or local-time fallback in GitHub's step timestamps. Still, the timing is a good reminder for anyone who builds their own release or audit checks on top of CI metadata.

Main Fixes Three Credential Handling Problems

Since Saturday morning, 692 pull requests have merged across the repository, according to a GitHub search at about 6:20 AM Pacific. Three of them change how OpenClaw handles credentials. None of the three appears in the 2026.10.10 candidate's commit list, so expect them in a later release.

The most important is pull request #189532, which keeps PostgreSQL credentials out of child environments. It merged at 12:39 PM Pacific on Saturday. When the Gateway read its PostgreSQL connection string from an environment variable, including a custom-named one, that variable was inherited by host exec and sandbox child processes. In other words, a shell command an agent ran could see the Gateway's database credential. The fix records where the credential came from and uses the existing Gateway credential owner to filter it out of inherited environments for both host exec and sandboxes. Explicit command overrides and operator-configured sandbox environment values still work. The PR adds that "changing the credential source requires a process restart." Its evidence ran real host and SSH-sandbox shells and showed the variable missing from each. The change ports the credential-isolation part of a commit by contributor Galin Iliev.

Pull request #189546, which stops OAuth callback pages from claiming success too early, merged at 9:35 AM. Callback pages for OpenAI, Chutes and Google Meet said authentication succeeded as soon as an authorization code arrived, even if the token exchange that followed then failed. The pages now report that authorization was received, and the terminal flow still reports completion or failure after the exchange. The PR notes "no credential, storage, or authorization changes."

Pull request #189482, which lets Doctor repair quoted macOS service credentials, merged at 8:32 AM. Some generated env files for macOS Gateway and node services contain an unintended pair of outer double quotes around a value, which makes the credential unusable. Interactive openclaw doctor now names the affected keys without displaying their values, keeps a private backup at mode 0600, and removes one outer quote pair after you confirm. Because quotes can be real data, --yes and noninteractive runs can't approve this repair. The PR says the original source of the quotes is still unconfirmed and that native macOS startup was not exercised.

Decision Models: joey-1 Lands and the Decisions Refactor Finishes

OpenClaw's decision models are a separate model role for typed answers, not chat. On October 22 we covered a draft adding Baseten's elephant-1 and mammoth-1. The smallest model in that family has now joined them. Pull request #188208, adding Baseten's joey-1 decision model, merged at 7:42 AM Pacific on Friday, after our Friday post. The PR says users can select baseten/decision-models/baseten-joey-2b-latest for "text/JSON Boolean probabilities, choices, and rubric scores," that the primary chat model is unchanged, and that "probabilities are estimates, not safety or action-authorization guarantees." The adapter doesn't support images. An authenticated Baseten live test passed, with joey answering in 667 ms. The OpenClaw Baseten provider documentation now lists joey-1 (2B), elephant-1 (9B) and mammoth-1 (27B) as decision-only models served through Baseten's System One API. joey-1 is on main but not on the 2026.10.10 release branch.

Vincent Koc also finished a 14-part Decision ownership refactor on Saturday. Its last layer, pull request #189105 documenting decision capability and execution ownership, merged at 11:45 AM. The PR says existing SDK exports, provider contracts, evaluation calls and configuration "remain compatible." The PR updates the decision models concept page in the OpenClaw docs to explain which responsibilities stay with providers and which, such as authority, provenance and usage recording, belong to the host.

Plugin authors got one more addition. Pull request #189652, letting policy hooks list authorized tool names, adds an optional toolAuthority.list() method. It returns a frozen, sorted list of the tool names the current turn is allowed to use, with no descriptions, schemas or execution handles. Ordinary hooks don't receive it, and existing plugins need no changes.

Skill Card: The Bundled 1Password Skill Has Moved Past Its ClawHub Listing

What to Watch Next

First, the v2026.10.10 tag and the npm latest move. Codex 0.164.0, the Bun 1.4.4 requirement and the Claude ACP brotli fix all ride on that release. Second, whether the PostgreSQL credential isolation, OAuth callback wording and Doctor quote repair are backported or wait for the next train. Third, joey-1 and the toolAuthority hook API, which are on main only for now. We'll recheck the tag on our next run.