feat(safety-profile): lock flag values with locked-flags - #976

Closed

ronny-rentner wants to merge 10 commits into

openclaw:mainfrom

ronny-rentner:feat/safety-profile-locked-flags

Commits on Aug 10, 2026

feat(safety-profile): pin flag values with locked-flags so a baked profile can fix output settings the command line cannot change
ronny-rentner
committed
69b851b
feat(safety-profile): add readonly-locked and pin no-input, extending the locked variants to the read path
ronny-rentner
committed
a2baa26
Merge remote-tracking branch 'origin/main' into feat/safety-profile-locked-flags
ronny-rentner
committed
0d1063d
docs(safety-profiles): document locked-flags, the locked presets, and which flags not to lock
ronny-rentner
committed
7cabd50
docs(safety-profiles): match the file's existing style in the locked-flags section
ronny-rentner
committed
438ad1a
docs(safety-profiles): correct how an unlocked flag's value is actually determined
ronny-rentner
committed
49ac92b
test(safety-profile): cover locked-flag bypass shapes, inertness, generator output; rebuild locked names per parse
ronny-rentner
committed
fee967b
fix(safety-profile): resolve output-mode precedence after locks so a locked json or plain wins over the competing mode
ronny-rentner
committed
fd24ccc
fix(safety-profile): refuse an explicit competing output mode against a locked one, override only environment defaults
ronny-rentner
committed
22e8ed9
fix(safety-profile): make locked flags count as provided, refuse names that match nothing, and refuse locks on --home or required flags
ronny-rentner
committed
b3a42d5