RFC 0023: Standard Hosting Profiles

[giodl73-repo]

Decision Requested

Should OpenClaw ship a small catalog of named, release-tested hosting postures over the readiness facility proposed in RFC 0018? Readiness remains independently useful without a profile.

Why

OpenClaw runs locally, in containers, behind identity proxies, and as a controller for paired execution targets, but those labels are not reproducible support contracts. Their intent is scattered across startup flags, environment, config, probes, and private checklists. A release cannot exercise or support the posture as one coherent packaged scenario.

Proposed V1

Profiles are optional compositions of RFC 0018 criteria, not another evaluator.

Profile	Supported posture	Profile-specific evidence
local	Foreground/local Gateway	Shared serving baseline
container	Directly reachable container listener	Non-loopback effective listener
reverse-proxy	Gateway behind a trusted identity proxy	Trusted-proxy auth, identity header, trusted source, and viable topology
node-mode	Gateway controlling execution targets	Approved pairing, connected target, command-policy approval, and live control channel

Every profile selects the same required serving baseline and advisory operational facts. Selection precedence is gateway argument > environment > openclaw.json; unprofiled startup remains unchanged, and operators can add criteria directly.

This PR includes the normative Standard Hosting Profile v1 sidecar.

Support And Identity Contract

A profile provides a reproducible support subset: OpenClaw names the posture, reports its unmet conditions, attributes them to RFC 0018 identities that renew with their owner lifecycles, and executes matching packaged scenarios.

Docker, Kubernetes, systemd, OCC, and downstream hosts continue to consume ordinary /readyz. Profiles observe effective state; they do not generate or repair config, add Lobster/OCC resources, encode scheduler policy, or initiate subsystems.

Operator Facilities

OpenClaw PR 114636 combines catalog inspection, live validation, and package release evidence as one ordered upstream review unit at exact head 123bae7b876.

Implementation Stack

RFC 0023 builds on RFC 0018, so its complete upstream landing order is:

1. PR 104018 provides the readiness framework and subject identity at exact head 2f131c6e220.
2. PR 113421 provides reusable core-owner conditions at exact head c1d7f394f86.
3. PR 113422 directly implements the four Standard Hosting Profiles and package scenario matrix at exact head 18c42a7f26a.
4. PR 114636 directly implements profile inspection, live validation, and package release-conformance evidence at exact head 123bae7b876.

The integrated tree passes 120 focused assertions plus formatting, lint, shell syntax, and diff checks. Exact-head package-installed Docker proof passes all 13 states on GitHub-hosted Actions, independently verifies the artifact, and uploads it as release evidence.

Deliberate V1 Boundary

This RFC does not promise custom profile inheritance, host assertions, signed attestations, config generation/repair, scheduler policy, or Lobster/OCC resources. The conformance artifact is portable release evidence, not an immutable or signed attestation.

Promotion Order

1. Accept RFC 0018 and PR 104018 independently.
2. Land reusable owner observations in PR 113421.
3. Decide whether the four named postures are the right initial support catalog.
4. Land PR 113422 with its package-installed profile matrix.
5. Land catalog inspection, live validation, and the release-conformance artifact as separable operator/release facilities.

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review published an exact durable review comment and queued an executing target-wide serialized router scan.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29405019138
• Updated: 2026-07-15T10:29:21.908Z

[clawsweeper]

Codex review: blocked before merge. Reviewed September 9, 2026, 1:16 AM ET / 05:16 UTC (Revision 75).

ClawSweeper review

What this changes

Adds an RFC and companion specification for four optional hosting profiles, their readiness conditions, operator commands, and packaged conformance scenarios.

Merge readiness

⛔ Blocked before merge - 4 items remain

The revised prose resolves both previous identity-contract findings. This remains a distinct RFC awaiting product acceptance; neither the default branch nor the still-open readiness prerequisite supersedes it.

Priority: P3
Reviewed head: 3c8a32e015761500aeab8947404afade804d6da3
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A coherent, bounded RFC with package evidence and resolved prior findings; product acceptance remains separate from patch quality.
Proof confidence	🐚 platinum hermit (4/6) ✨ media proof bonus	Sufficient (linked_artifact): The captured proposal reports package-installed Docker evidence exercising the profile readiness and validation behavior across 13 states, including recovery and unprofiled compatibility; GitHub confirms the conformance and artifact checks succeeded. This supports the proposed design, not acceptance or correctness of newer implementation heads; raw-log inspection was blocked by reviewer infrastructure.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): The captured proposal reports package-installed Docker evidence exercising the profile readiness and validation behavior across 13 states, including recovery and unprofiled compatibility; GitHub confirms the conformance and artifact checks succeeded. This supports the proposed design, not acceptance or correctness of newer implementation heads; raw-log inspection was blocked by reviewer infrastructure.
Evidence reviewed	8 items	Exact introduced scope: The pinned base-to-head comparison adds only two RFC Markdown files: 500 and 468 lines. No executable runtime, workflow, dependency, or stored-data implementation changes are introduced; diff whitespace checks pass and the checkout remains clean. Previous findings addressed: The head commit changes profile contract version to result metadata and limits OPENCLAW_INSTANCE_ID to the host-workload parent. These statements now agree with the sidecar at lines 176–198. The earlier reviewed revision was unavailable locally, so continuity was checked against current text and GitHub's exact head-commit patch. Acceptance is a repository requirement: README requires maintainer discussion, acceptance, an implementation issue, and accepted frontmatter before merging an RFC. This proposal still declares draft status and leaves its issue field blank.
Findings	None	None.
Security	None	None.

How this fits together

This repository records OpenClaw design decisions rather than implementing the runtime. The proposed profiles combine operator selection and Gateway observations into readiness results that hosting systems can consume.

flowchart TD
  A[Operator selection] --> B[Optional hosting profile]
  B --> C[Canonical readiness evaluation]
  D[Gateway and node observations] --> C
  C --> E[Readiness and status results]
  E --> F[Hosting systems]
  G[Packaged release scenarios] --> E

Loading

Decision needed

Question	Recommendation
Should OpenClaw accept the four-profile support catalog after settling RFC 0018, including its configuration home and release-conformance rollout?	Accept the bounded opt-in catalog: After settling the readiness prerequisite, approve the four profiles with named support ownership and an explicit advisory or blocking release-gate rollout.

Why: The proposal adds a lasting support promise and release obligation that technical consistency and package evidence cannot authorize.

Before merge

• Resolve merge risk (P1) - The four-profile support commitment, configuration home, and release-gate rollout remain explicit product choices.
• Resolve merge risk (P1) - The linked package run's raw logs could not be independently inspected because its download host was blocked in the reviewer environment.
• Complete next step (P2) - Record maintainer acceptance after resolving the readiness prerequisite, confirm the required discussion thread, and complete accepted status plus the implementation-issue link before merge.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Change scope	RFC documentation +968 lines; production +0; tests +0	The branch specifies a product contract without changing executable runtime behavior.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Keep profiles as opt-in compositions of canonical readiness, with explicit ownership of the catalog and release-support commitment.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Keep profiles as opt-in compositions of canonical readiness, with explicit ownership of the catalog and release-support commitment.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this proposes hosting-profile capabilities rather than reporting broken existing behavior.

Is this the best way to solve the issue?

Yes, condition composition and opt-in selection provide a coherent design without duplicating the evaluator; the support catalog still requires product acceptance.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 967d9aac7472.

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. The captured proposal reports package-installed Docker evidence exercising the profile readiness and validation behavior across 13 states, including recovery and unprofiled compatibility; GitHub confirms the conformance and artifact checks succeeded. This supports the proposed design, not acceptance or correctness of newer implementation heads; raw-log inspection was blocked by reviewer infrastructure.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The captured proposal reports package-installed Docker evidence exercising the profile readiness and validation behavior across 13 states, including recovery and unprofiled compatibility; GitHub confirms the conformance and artifact checks succeeded. This supports the proposed design, not acceptance or correctness of newer implementation heads; raw-log inspection was blocked by reviewer infrastructure.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
• remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.
• remove merge-risk: 🚨 compatibility: Current PR review selected no merge-risk labels.
• remove merge-risk: 🚨 security-boundary: Current PR review selected no merge-risk labels.

Label justifications:

• P3: This is a prospective support-contract RFC, with no demonstrated current runtime regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The captured proposal reports package-installed Docker evidence exercising the profile readiness and validation behavior across 13 states, including recovery and unprofiled compatibility; GitHub confirms the conformance and artifact checks succeeded. This supports the proposed design, not acceptance or correctness of newer implementation heads; raw-log inspection was blocked by reviewer infrastructure.
• proof: sufficient: Contributor real behavior proof is sufficient. The captured proposal reports package-installed Docker evidence exercising the profile readiness and validation behavior across 13 states, including recovery and unprofiled compatibility; GitHub confirms the conformance and artifact checks succeeded. This supports the proposed design, not acceptance or correctness of newer implementation heads; raw-log inspection was blocked by reviewer infrastructure.

Evidence

What I checked:

• Exact introduced scope: The pinned base-to-head comparison adds only two RFC Markdown files: 500 and 468 lines. No executable runtime, workflow, dependency, or stored-data implementation changes are introduced; diff whitespace checks pass and the checkout remains clean. (rfcs/0023-standard-hosting-profiles.md:1, 3c8a32e01576)
• Previous findings addressed: The head commit changes profile contract version to result metadata and limits OPENCLAW_INSTANCE_ID to the host-workload parent. These statements now agree with the sidecar at lines 176–198. The earlier reviewed revision was unavailable locally, so continuity was checked against current text and GitHub's exact head-commit patch. (rfcs/0023-standard-hosting-profiles.md:257, 3c8a32e01576)
• Acceptance is a repository requirement: README requires maintainer discussion, acceptance, an implementation issue, and accepted frontmatter before merging an RFC. This proposal still declares draft status and leaves its issue field blank. (README.md:80, 967d9aac7472)
• Default branch and release check: The default-branch tree does not contain RFC 0023 or its sidecar. Searches of existing proposals found adjacent readiness concepts, not this four-profile catalog; the repository release endpoint returned no releases. (967d9aac7472)
• Explicit prerequisite remains separate: The proposal explicitly depends on RFC 0018: Readiness Conditions and Providers #33. Its supplied body separates canonical readiness from hosting-profile product acceptance, and GitHub confirms it remains open and unmerged. (rfcs/0023/hosting-profile-v1-spec.md:25, 3c8a32e01576)
• Linked package behavior evidence: The captured body and RFC link https://github.com/giodl73-repo/openclaw/actions/runs/30289122192 and report 13 package-installed Docker states covering unprofiled compatibility, all four profiles, expected failures, node approval, workspace recovery, and identity renewal. GitHub confirms successful package-conformance and artifact-verification steps. The run belongs to proof head 679cb8ca0ddd7995622aefe8df1fd3591badd515; it is not the RFC head. Raw log retrieval redirected to a host blocked by the reviewer environment, limiting independent transcript inspection without invalidating the supplied evidence. (679cb8ca0ddd)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)
• RomneyDa: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Record the support-catalog decision and complete the repository's RFC acceptance lifecycle before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (74 earlier review cycles; latest 8 shown)

• reviewed 2026-08-08T12:39:21.123Z sha e931e8d :: needs real behavior proof before merge. :: [P2] Keep profile version out of subject generation | [P2] Give OPENCLAW_INSTANCE_ID one identity role
• reviewed 2026-08-08T14:23:02.354Z sha e931e8d :: needs real behavior proof before merge. :: [P2] Keep profile version out of subject generation | [P2] Give OPENCLAW_INSTANCE_ID one identity role | [P2] Make workspace writability a common criterion
• reviewed 2026-08-08T16:20:17.027Z sha e931e8d :: needs real behavior proof before merge. :: [P2] Keep profile version out of subject generation | [P2] Give OPENCLAW_INSTANCE_ID one identity role | [P2] Make workspace writability common in the catalog
• reviewed 2026-08-08T19:03:11.574Z sha e931e8d :: needs real behavior proof before merge. :: [P2] Keep profile version out of subject generation | [P2] Give OPENCLAW_INSTANCE_ID one identity role | [P2] Make workspace writability common in the catalog
• reviewed 2026-08-08T19:50:09.415Z sha e931e8d :: needs real behavior proof before merge. :: none
• reviewed 2026-08-08T21:01:44.094Z sha e931e8d :: needs real behavior proof before merge. :: [P2] Make workspace writability a common criterion | [P2] Keep the profile contract version out of subject generation | [P2] Give OPENCLAW_INSTANCE_ID the documented host-workload role
• reviewed 2026-08-08T21:29:01.275Z sha e931e8d :: needs real behavior proof before merge. :: [P2] Keep profile version as result metadata | [P2] Give OPENCLAW_INSTANCE_ID one identity role
• reviewed 2026-08-12T01:54:35.831Z sha e931e8d :: needs real behavior proof before merge. :: [P2] Align profile version with the normative sidecar | [P2] Assign OPENCLAW_INSTANCE_ID one identity role

[giodl73-repo]

RFC 0023 now makes standard hosting profiles explicitly opt-in. An upgrade with no profile selected preserves RFC 0018's existing readiness baseline; selecting local, container, reverse-proxy, or node-mode adds the named support posture and its required conditions.

The implementation stack is rebased onto readiness head 17b34f792d8 and the exact package-installed proof is recorded on openclaw/openclaw#107765. It begins with an unprofiled 200 compatibility case, then exercises all four explicit profiles and their failure/recovery transitions.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The durable review comment was published and its verdict was queued for target-serialized routing.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29481347753
• Updated: 2026-07-16T07:54:35.104Z

[giodl73-repo]

Refreshed onto current main at 3c8a32e and resolved both identity-contract findings. The RFC now matches the normative sidecar: profile contract version is result metadata, and OPENCLAW_INSTANCE_ID identifies only the optional host-workload parent without overriding generated process or Gateway identities. git diff --check passes. @clawsweeper re-review