@jonathangu/openclawbrain 0.3.0

package/docs/evidence/2026-03-16/7f8dbcb27e741abdeefd5656c210639d0acdd440/status.json

@@ -0,0 +1,200 @@
+{
+  "command": "openclaw",
+  "args": [
+    "status",
+    "--json",
+    "--timeout",
+    "10000"
+  ],
+  "cwd": "/Users/cormorantai/openclawbrain",
+  "exitCode": 0,
+  "signal": null,
+  "ok": true,
+  "stdout": "{\n  \"heartbeat\": {\n    \"defaultAgentId\": \"main\",\n    \"agents\": [\n      {\n        \"agentId\": \"main\",\n        \"enabled\": true,\n        \"every\": \"30m\",\n        \"everyMs\": 1800000\n      }\n    ]\n  },\n  \"channelSummary\": [],\n  \"queuedSystemEvents\": [],\n  \"sessions\": {\n    \"paths\": [\n      \"/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/agents/main/sessions/sessions.json\"\n    ],\n    \"count\": 0,\n    \"defaults\": {\n      \"model\": \"claude-opus-4-6\",\n      \"contextTokens\": 200000\n    },\n    \"recent\": [],\n    \"byAgent\": [\n      {\n        \"agentId\": \"main\",\n        \"path\": \"/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/agents/main/sessions/sessions.json\",\n        \"count\": 0,\n        \"recent\": []\n      }\n    ]\n  },\n  \"os\": {\n    \"platform\": \"darwin\",\n    \"arch\": \"arm64\",\n    \"release\": \"25.3.0\",\n    \"label\": \"macos 26.3 (arm64)\"\n  },\n  \"update\": {\n    \"root\": \"/Users/cormorantai/openclawbrain/node_modules/openclaw\",\n    \"installKind\": \"package\",\n    \"packageManager\": \"pnpm\",\n    \"deps\": {\n      \"manager\": \"pnpm\",\n      \"status\": \"unknown\",\n      \"lockfilePath\": \"/Users/cormorantai/openclawbrain/node_modules/openclaw/pnpm-lock.yaml\",\n      \"markerPath\": \"/Users/cormorantai/openclawbrain/node_modules/openclaw/node_modules/.modules.yaml\",\n      \"reason\": \"lockfile missing\"\n    },\n    \"registry\": {\n      \"latestVersion\": \"2026.3.13\"\n    }\n  },\n  \"updateChannel\": \"stable\",\n  \"updateChannelSource\": \"default\",\n  \"memory\": {\n    \"agentId\": \"main\",\n    \"backend\": \"builtin\",\n    \"files\": 0,\n    \"chunks\": 0,\n    \"dirty\": true,\n    \"workspaceDir\": \"/Users/cormorantai/.openclaw/workspace\",\n    \"dbPath\": \"/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/memory/main.sqlite\",\n    \"provider\": \"gemini\",\n    \"model\": \"gemini-embedding-001\",\n    \"requestedProvider\": \"auto\",\n    \"sources\": [\n      \"memory\"\n    ],\n    \"extraPaths\": [],\n    \"sourceCounts\": [\n      {\n        \"source\": \"memory\",\n        \"files\": 0,\n        \"chunks\": 0\n      }\n    ],\n    \"cache\": {\n      \"enabled\": true,\n      \"entries\": 0\n    },\n    \"fts\": {\n      \"enabled\": true,\n      \"available\": true\n    },\n    \"vector\": {\n      \"enabled\": true,\n      \"available\": true,\n      \"extensionPath\": \"/Users/cormorantai/openclawbrain/node_modules/sqlite-vec-darwin-arm64/vec0.dylib\"\n    },\n    \"batch\": {\n      \"enabled\": false,\n      \"failures\": 0,\n      \"limit\": 2,\n      \"wait\": true,\n      \"concurrency\": 2,\n      \"pollIntervalMs\": 2000,\n      \"timeoutMs\": 3600000\n    },\n    \"custom\": {\n      \"searchMode\": \"hybrid\"\n    }\n  },\n  \"memoryPlugin\": {\n    \"enabled\": true,\n    \"slot\": \"memory-core\"\n  },\n  \"gateway\": {\n    \"mode\": \"local\",\n    \"url\": \"ws://127.0.0.1:18789\",\n    \"urlSource\": \"local loopback\",\n    \"misconfigured\": false,\n    \"reachable\": false,\n    \"connectLatencyMs\": null,\n    \"self\": null,\n    \"error\": \"connect failed: unauthorized: gateway token missing (provide gateway auth token)\"\n  },\n  \"gatewayService\": {\n    \"label\": \"LaunchAgent\",\n    \"installed\": false,\n    \"loadedText\": \"not loaded\",\n    \"runtimeShort\": \"unknown\"\n  },\n  \"nodeService\": {\n    \"label\": \"LaunchAgent\",\n    \"installed\": false,\n    \"loadedText\": \"not loaded\",\n    \"runtimeShort\": \"unknown\"\n  },\n  \"agents\": {\n    \"defaultId\": \"main\",\n    \"agents\": [\n      {\n        \"id\": \"main\",\n        \"workspaceDir\": \"/Users/cormorantai/.openclaw/workspace\",\n        \"bootstrapPending\": true,\n        \"sessionsPath\": \"/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/agents/main/sessions/sessions.json\",\n        \"sessionsCount\": 0,\n        \"lastUpdatedAt\": null,\n        \"lastActiveAgeMs\": null\n      }\n    ],\n    \"totalSessions\": 0,\n    \"bootstrapPendingCount\": 1\n  },\n  \"securityAudit\": {\n    \"ts\": 1773636068494,\n    \"summary\": {\n      \"critical\": 2,\n      \"warn\": 1,\n      \"info\": 1\n    },\n    \"findings\": [\n      {\n        \"checkId\": \"summary.attack_surface\",\n        \"severity\": \"info\",\n        \"title\": \"Attack surface summary\",\n        \"detail\": \"groups: open=0, allowlist=0\\ntools.elevated: enabled\\nhooks.webhooks: disabled\\nhooks.internal: disabled\\nbrowser control: enabled\"\n      },\n      {\n        \"checkId\": \"gateway.trusted_proxies_missing\",\n        \"severity\": \"warn\",\n        \"title\": \"Reverse proxy headers are not trusted\",\n        \"detail\": \"gateway.bind is loopback and gateway.trustedProxies is empty. If you expose the Control UI through a reverse proxy, configure trusted proxies so local-client checks cannot be spoofed.\",\n        \"remediation\": \"Set gateway.trustedProxies to your proxy IPs or keep the Control UI local-only.\"\n      },\n      {\n        \"checkId\": \"gateway.loopback_no_auth\",\n        \"severity\": \"critical\",\n        \"title\": \"Gateway auth missing on loopback\",\n        \"detail\": \"gateway.bind is loopback but no gateway auth secret is configured. If the Control UI is exposed through a reverse proxy, unauthenticated access is possible.\",\n        \"remediation\": \"Set gateway.auth (token recommended) or keep the Control UI local-only.\"\n      },\n      {\n        \"checkId\": \"browser.control_no_auth\",\n        \"severity\": \"critical\",\n        \"title\": \"Browser control has no auth\",\n        \"detail\": \"Browser control HTTP routes are enabled but no gateway.auth token/password is configured. Any local process (or SSRF to loopback) can call browser control endpoints.\",\n        \"remediation\": \"Set gateway.auth.token (recommended) or gateway.auth.password so browser control HTTP routes require authentication. Restarting the gateway will auto-generate gateway.auth.token when browser control is enabled.\"\n      }\n    ]\n  }\n}\n",
+  "stderr": "Invalid config at /Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.json:\\n- plugins.slots: Unrecognized key: \"contextEngine\"\nConfig invalid\nFile: ~/.openclaw-ocbphase1-short-static/preflight/openclaw.json\nProblem:\n  - plugins.slots: Unrecognized key: \"contextEngine\"\n\nRun: openclaw doctor --fix\nInvalid config at /Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.json:\\n- plugins.slots: Unrecognized key: \"contextEngine\"\n",
+  "error": null,
+  "parsed": {
+    "heartbeat": {
+      "defaultAgentId": "main",
+      "agents": [
+        {
+          "agentId": "main",
+          "enabled": true,
+          "every": "30m",
+          "everyMs": 1800000
+        }
+      ]
+    },
+    "channelSummary": [],
+    "queuedSystemEvents": [],
+    "sessions": {
+      "paths": [
+        "/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/agents/main/sessions/sessions.json"
+      ],
+      "count": 0,
+      "defaults": {
+        "model": "claude-opus-4-6",
+        "contextTokens": 200000
+      },
+      "recent": [],
+      "byAgent": [
+        {
+          "agentId": "main",
+          "path": "/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/agents/main/sessions/sessions.json",
+          "count": 0,
+          "recent": []
+        }
+      ]
+    },
+    "os": {
+      "platform": "darwin",
+      "arch": "arm64",
+      "release": "25.3.0",
+      "label": "macos 26.3 (arm64)"
+    },
+    "update": {
+      "root": "/Users/cormorantai/openclawbrain/node_modules/openclaw",
+      "installKind": "package",
+      "packageManager": "pnpm",
+      "deps": {
+        "manager": "pnpm",
+        "status": "unknown",
+        "lockfilePath": "/Users/cormorantai/openclawbrain/node_modules/openclaw/pnpm-lock.yaml",
+        "markerPath": "/Users/cormorantai/openclawbrain/node_modules/openclaw/node_modules/.modules.yaml",
+        "reason": "lockfile missing"
+      },
+      "registry": {
+        "latestVersion": "2026.3.13"
+      }
+    },
+    "updateChannel": "stable",
+    "updateChannelSource": "default",
+    "memory": {
+      "agentId": "main",
+      "backend": "builtin",
+      "files": 0,
+      "chunks": 0,
+      "dirty": true,
+      "workspaceDir": "/Users/cormorantai/.openclaw/workspace",
+      "dbPath": "/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/memory/main.sqlite",
+      "provider": "gemini",
+      "model": "gemini-embedding-001",
+      "requestedProvider": "auto",
+      "sources": [
+        "memory"
+      ],
+      "extraPaths": [],
+      "sourceCounts": [
+        {
+          "source": "memory",
+          "files": 0,
+          "chunks": 0
+        }
+      ],
+      "cache": {
+        "enabled": true,
+        "entries": 0
+      },
+      "fts": {
+        "enabled": true,
+        "available": true
+      },
+      "vector": {
+        "enabled": true,
+        "available": true,
+        "extensionPath": "/Users/cormorantai/openclawbrain/node_modules/sqlite-vec-darwin-arm64/vec0.dylib"
+      },
+      "batch": {
+        "enabled": false,
+        "failures": 0,
+        "limit": 2,
+        "wait": true,
+        "concurrency": 2,
+        "pollIntervalMs": 2000,
+        "timeoutMs": 3600000
+      },
+      "custom": {
+        "searchMode": "hybrid"
+      }
+    },
+    "memoryPlugin": {
+      "enabled": true,
+      "slot": "memory-core"
+    },
+    "gateway": {
+      "mode": "local",
+      "url": "ws://127.0.0.1:18789",
+      "urlSource": "local loopback",
+      "misconfigured": false,
+      "reachable": false,
+      "connectLatencyMs": null,
+      "self": null,
+      "error": "connect failed: unauthorized: gateway token missing (provide gateway auth token)"
+    },
+    "gatewayService": {
+      "label": "LaunchAgent",
+      "installed": false,
+      "loadedText": "not loaded",
+      "runtimeShort": "unknown"
+    },
+    "nodeService": {
+      "label": "LaunchAgent",
+      "installed": false,
+      "loadedText": "not loaded",
+      "runtimeShort": "unknown"
+    },
+    "agents": {
+      "defaultId": "main",
+      "agents": [
+        {
+          "id": "main",
+          "workspaceDir": "/Users/cormorantai/.openclaw/workspace",
+          "bootstrapPending": true,
+          "sessionsPath": "/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/agents/main/sessions/sessions.json",
+          "sessionsCount": 0,
+          "lastUpdatedAt": null,
+          "lastActiveAgeMs": null
+        }
+      ],
+      "totalSessions": 0,
+      "bootstrapPendingCount": 1
+    },
+    "securityAudit": {
+      "ts": 1773636068494,
+      "summary": {
+        "critical": 2,
+        "warn": 1,
+        "info": 1
+      },
+      "findings": [
+        {
+          "checkId": "summary.attack_surface",
+          "severity": "info",
+          "title": "Attack surface summary",
+          "detail": "groups: open=0, allowlist=0\ntools.elevated: enabled\nhooks.webhooks: disabled\nhooks.internal: disabled\nbrowser control: enabled"
+        },
+        {
+          "checkId": "gateway.trusted_proxies_missing",
+          "severity": "warn",
+          "title": "Reverse proxy headers are not trusted",
+          "detail": "gateway.bind is loopback and gateway.trustedProxies is empty. If you expose the Control UI through a reverse proxy, configure trusted proxies so local-client checks cannot be spoofed.",
+          "remediation": "Set gateway.trustedProxies to your proxy IPs or keep the Control UI local-only."
+        },
+        {
+          "checkId": "gateway.loopback_no_auth",
+          "severity": "critical",
+          "title": "Gateway auth missing on loopback",
+          "detail": "gateway.bind is loopback but no gateway auth secret is configured. If the Control UI is exposed through a reverse proxy, unauthenticated access is possible.",
+          "remediation": "Set gateway.auth (token recommended) or keep the Control UI local-only."
+        },
+        {
+          "checkId": "browser.control_no_auth",
+          "severity": "critical",
+          "title": "Browser control has no auth",
+          "detail": "Browser control HTTP routes are enabled but no gateway.auth token/password is configured. Any local process (or SSRF to loopback) can call browser control endpoints.",
+          "remediation": "Set gateway.auth.token (recommended) or gateway.auth.password so browser control HTTP routes require authentication. Restarting the gateway will auto-generate gateway.auth.token when browser control is enabled."
+        }
+      ]
+    }
+  }
+}

package/docs/evidence/2026-03-16/7f8dbcb27e741abdeefd5656c210639d0acdd440/summary.md

@@ -0,0 +1,13 @@
+# OpenClawBrain validation summary
+
+- commit: `7f8dbcb27e741abdeefd5656c210639d0acdd440`
+- validation mode: sterile-lane
+- config path: `/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.json`
+- state dir: `/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight`
+- workspace: `/Users/cormorantai/.openclaw/workspace-ocbphase1`
+- artifact dir: `/Users/cormorantai/openclawbrain/docs/evidence/2026-03-16/7f8dbcb27e741abdeefd5656c210639d0acdd440`
+
+## Assertions
+
+## Skipped
+- init-and-agent-checks: --setup-only was requested.

package/docs/evidence/2026-03-16/7f8dbcb27e741abdeefd5656c210639d0acdd440/trace.json

@@ -0,0 +1,4 @@
+{
+  "skipped": true,
+  "reason": "No trace snapshot captured."
+}

package/docs/evidence/2026-03-16/7f8dbcb27e741abdeefd5656c210639d0acdd440/validation-report.json

@@ -0,0 +1,311 @@
+{
+  "validationRoot": "/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight",
+  "validationHome": "/Users/cormorantai",
+  "validationStateDir": "/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight",
+  "fixtureWorkspace": "/Users/cormorantai/.openclaw/workspace-ocbphase1",
+  "configPath": "/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.json",
+  "artifactDir": "/Users/cormorantai/openclawbrain/docs/evidence/2026-03-16/7f8dbcb27e741abdeefd5656c210639d0acdd440",
+  "gitSha": "7f8dbcb27e741abdeefd5656c210639d0acdd440",
+  "diagnostics": {
+    "status": {
+      "command": "openclaw",
+      "args": [
+        "status",
+        "--json",
+        "--timeout",
+        "10000"
+      ],
+      "cwd": "/Users/cormorantai/openclawbrain",
+      "exitCode": 0,
+      "signal": null,
+      "ok": true,
+      "stdout": "{\n  \"heartbeat\": {\n    \"defaultAgentId\": \"main\",\n    \"agents\": [\n      {\n        \"agentId\": \"main\",\n        \"enabled\": true,\n        \"every\": \"30m\",\n        \"everyMs\": 1800000\n      }\n    ]\n  },\n  \"channelSummary\": [],\n  \"queuedSystemEvents\": [],\n  \"sessions\": {\n    \"paths\": [\n      \"/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/agents/main/sessions/sessions.json\"\n    ],\n    \"count\": 0,\n    \"defaults\": {\n      \"model\": \"claude-opus-4-6\",\n      \"contextTokens\": 200000\n    },\n    \"recent\": [],\n    \"byAgent\": [\n      {\n        \"agentId\": \"main\",\n        \"path\": \"/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/agents/main/sessions/sessions.json\",\n        \"count\": 0,\n        \"recent\": []\n      }\n    ]\n  },\n  \"os\": {\n    \"platform\": \"darwin\",\n    \"arch\": \"arm64\",\n    \"release\": \"25.3.0\",\n    \"label\": \"macos 26.3 (arm64)\"\n  },\n  \"update\": {\n    \"root\": \"/Users/cormorantai/openclawbrain/node_modules/openclaw\",\n    \"installKind\": \"package\",\n    \"packageManager\": \"pnpm\",\n    \"deps\": {\n      \"manager\": \"pnpm\",\n      \"status\": \"unknown\",\n      \"lockfilePath\": \"/Users/cormorantai/openclawbrain/node_modules/openclaw/pnpm-lock.yaml\",\n      \"markerPath\": \"/Users/cormorantai/openclawbrain/node_modules/openclaw/node_modules/.modules.yaml\",\n      \"reason\": \"lockfile missing\"\n    },\n    \"registry\": {\n      \"latestVersion\": \"2026.3.13\"\n    }\n  },\n  \"updateChannel\": \"stable\",\n  \"updateChannelSource\": \"default\",\n  \"memory\": {\n    \"agentId\": \"main\",\n    \"backend\": \"builtin\",\n    \"files\": 0,\n    \"chunks\": 0,\n    \"dirty\": true,\n    \"workspaceDir\": \"/Users/cormorantai/.openclaw/workspace\",\n    \"dbPath\": \"/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/memory/main.sqlite\",\n    \"provider\": \"gemini\",\n    \"model\": \"gemini-embedding-001\",\n    \"requestedProvider\": \"auto\",\n    \"sources\": [\n      \"memory\"\n    ],\n    \"extraPaths\": [],\n    \"sourceCounts\": [\n      {\n        \"source\": \"memory\",\n        \"files\": 0,\n        \"chunks\": 0\n      }\n    ],\n    \"cache\": {\n      \"enabled\": true,\n      \"entries\": 0\n    },\n    \"fts\": {\n      \"enabled\": true,\n      \"available\": true\n    },\n    \"vector\": {\n      \"enabled\": true,\n      \"available\": true,\n      \"extensionPath\": \"/Users/cormorantai/openclawbrain/node_modules/sqlite-vec-darwin-arm64/vec0.dylib\"\n    },\n    \"batch\": {\n      \"enabled\": false,\n      \"failures\": 0,\n      \"limit\": 2,\n      \"wait\": true,\n      \"concurrency\": 2,\n      \"pollIntervalMs\": 2000,\n      \"timeoutMs\": 3600000\n    },\n    \"custom\": {\n      \"searchMode\": \"hybrid\"\n    }\n  },\n  \"memoryPlugin\": {\n    \"enabled\": true,\n    \"slot\": \"memory-core\"\n  },\n  \"gateway\": {\n    \"mode\": \"local\",\n    \"url\": \"ws://127.0.0.1:18789\",\n    \"urlSource\": \"local loopback\",\n    \"misconfigured\": false,\n    \"reachable\": false,\n    \"connectLatencyMs\": null,\n    \"self\": null,\n    \"error\": \"connect failed: unauthorized: gateway token missing (provide gateway auth token)\"\n  },\n  \"gatewayService\": {\n    \"label\": \"LaunchAgent\",\n    \"installed\": false,\n    \"loadedText\": \"not loaded\",\n    \"runtimeShort\": \"unknown\"\n  },\n  \"nodeService\": {\n    \"label\": \"LaunchAgent\",\n    \"installed\": false,\n    \"loadedText\": \"not loaded\",\n    \"runtimeShort\": \"unknown\"\n  },\n  \"agents\": {\n    \"defaultId\": \"main\",\n    \"agents\": [\n      {\n        \"id\": \"main\",\n        \"workspaceDir\": \"/Users/cormorantai/.openclaw/workspace\",\n        \"bootstrapPending\": true,\n        \"sessionsPath\": \"/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/agents/main/sessions/sessions.json\",\n        \"sessionsCount\": 0,\n        \"lastUpdatedAt\": null,\n        \"lastActiveAgeMs\": null\n      }\n    ],\n    \"totalSessions\": 0,\n    \"bootstrapPendingCount\": 1\n  },\n  \"securityAudit\": {\n    \"ts\": 1773636068494,\n    \"summary\": {\n      \"critical\": 2,\n      \"warn\": 1,\n      \"info\": 1\n    },\n    \"findings\": [\n      {\n        \"checkId\": \"summary.attack_surface\",\n        \"severity\": \"info\",\n        \"title\": \"Attack surface summary\",\n        \"detail\": \"groups: open=0, allowlist=0\\ntools.elevated: enabled\\nhooks.webhooks: disabled\\nhooks.internal: disabled\\nbrowser control: enabled\"\n      },\n      {\n        \"checkId\": \"gateway.trusted_proxies_missing\",\n        \"severity\": \"warn\",\n        \"title\": \"Reverse proxy headers are not trusted\",\n        \"detail\": \"gateway.bind is loopback and gateway.trustedProxies is empty. If you expose the Control UI through a reverse proxy, configure trusted proxies so local-client checks cannot be spoofed.\",\n        \"remediation\": \"Set gateway.trustedProxies to your proxy IPs or keep the Control UI local-only.\"\n      },\n      {\n        \"checkId\": \"gateway.loopback_no_auth\",\n        \"severity\": \"critical\",\n        \"title\": \"Gateway auth missing on loopback\",\n        \"detail\": \"gateway.bind is loopback but no gateway auth secret is configured. If the Control UI is exposed through a reverse proxy, unauthenticated access is possible.\",\n        \"remediation\": \"Set gateway.auth (token recommended) or keep the Control UI local-only.\"\n      },\n      {\n        \"checkId\": \"browser.control_no_auth\",\n        \"severity\": \"critical\",\n        \"title\": \"Browser control has no auth\",\n        \"detail\": \"Browser control HTTP routes are enabled but no gateway.auth token/password is configured. Any local process (or SSRF to loopback) can call browser control endpoints.\",\n        \"remediation\": \"Set gateway.auth.token (recommended) or gateway.auth.password so browser control HTTP routes require authentication. Restarting the gateway will auto-generate gateway.auth.token when browser control is enabled.\"\n      }\n    ]\n  }\n}\n",
+      "stderr": "Invalid config at /Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.json:\\n- plugins.slots: Unrecognized key: \"contextEngine\"\nConfig invalid\nFile: ~/.openclaw-ocbphase1-short-static/preflight/openclaw.json\nProblem:\n  - plugins.slots: Unrecognized key: \"contextEngine\"\n\nRun: openclaw doctor --fix\nInvalid config at /Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.json:\\n- plugins.slots: Unrecognized key: \"contextEngine\"\n",
+      "error": null,
+      "parsed": {
+        "heartbeat": {
+          "defaultAgentId": "main",
+          "agents": [
+            {
+              "agentId": "main",
+              "enabled": true,
+              "every": "30m",
+              "everyMs": 1800000
+            }
+          ]
+        },
+        "channelSummary": [],
+        "queuedSystemEvents": [],
+        "sessions": {
+          "paths": [
+            "/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/agents/main/sessions/sessions.json"
+          ],
+          "count": 0,
+          "defaults": {
+            "model": "claude-opus-4-6",
+            "contextTokens": 200000
+          },
+          "recent": [],
+          "byAgent": [
+            {
+              "agentId": "main",
+              "path": "/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/agents/main/sessions/sessions.json",
+              "count": 0,
+              "recent": []
+            }
+          ]
+        },
+        "os": {
+          "platform": "darwin",
+          "arch": "arm64",
+          "release": "25.3.0",
+          "label": "macos 26.3 (arm64)"
+        },
+        "update": {
+          "root": "/Users/cormorantai/openclawbrain/node_modules/openclaw",
+          "installKind": "package",
+          "packageManager": "pnpm",
+          "deps": {
+            "manager": "pnpm",
+            "status": "unknown",
+            "lockfilePath": "/Users/cormorantai/openclawbrain/node_modules/openclaw/pnpm-lock.yaml",
+            "markerPath": "/Users/cormorantai/openclawbrain/node_modules/openclaw/node_modules/.modules.yaml",
+            "reason": "lockfile missing"
+          },
+          "registry": {
+            "latestVersion": "2026.3.13"
+          }
+        },
+        "updateChannel": "stable",
+        "updateChannelSource": "default",
+        "memory": {
+          "agentId": "main",
+          "backend": "builtin",
+          "files": 0,
+          "chunks": 0,
+          "dirty": true,
+          "workspaceDir": "/Users/cormorantai/.openclaw/workspace",
+          "dbPath": "/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/memory/main.sqlite",
+          "provider": "gemini",
+          "model": "gemini-embedding-001",
+          "requestedProvider": "auto",
+          "sources": [
+            "memory"
+          ],
+          "extraPaths": [],
+          "sourceCounts": [
+            {
+              "source": "memory",
+              "files": 0,
+              "chunks": 0
+            }
+          ],
+          "cache": {
+            "enabled": true,
+            "entries": 0
+          },
+          "fts": {
+            "enabled": true,
+            "available": true
+          },
+          "vector": {
+            "enabled": true,
+            "available": true,
+            "extensionPath": "/Users/cormorantai/openclawbrain/node_modules/sqlite-vec-darwin-arm64/vec0.dylib"
+          },
+          "batch": {
+            "enabled": false,
+            "failures": 0,
+            "limit": 2,
+            "wait": true,
+            "concurrency": 2,
+            "pollIntervalMs": 2000,
+            "timeoutMs": 3600000
+          },
+          "custom": {
+            "searchMode": "hybrid"
+          }
+        },
+        "memoryPlugin": {
+          "enabled": true,
+          "slot": "memory-core"
+        },
+        "gateway": {
+          "mode": "local",
+          "url": "ws://127.0.0.1:18789",
+          "urlSource": "local loopback",
+          "misconfigured": false,
+          "reachable": false,
+          "connectLatencyMs": null,
+          "self": null,
+          "error": "connect failed: unauthorized: gateway token missing (provide gateway auth token)"
+        },
+        "gatewayService": {
+          "label": "LaunchAgent",
+          "installed": false,
+          "loadedText": "not loaded",
+          "runtimeShort": "unknown"
+        },
+        "nodeService": {
+          "label": "LaunchAgent",
+          "installed": false,
+          "loadedText": "not loaded",
+          "runtimeShort": "unknown"
+        },
+        "agents": {
+          "defaultId": "main",
+          "agents": [
+            {
+              "id": "main",
+              "workspaceDir": "/Users/cormorantai/.openclaw/workspace",
+              "bootstrapPending": true,
+              "sessionsPath": "/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/agents/main/sessions/sessions.json",
+              "sessionsCount": 0,
+              "lastUpdatedAt": null,
+              "lastActiveAgeMs": null
+            }
+          ],
+          "totalSessions": 0,
+          "bootstrapPendingCount": 1
+        },
+        "securityAudit": {
+          "ts": 1773636068494,
+          "summary": {
+            "critical": 2,
+            "warn": 1,
+            "info": 1
+          },
+          "findings": [
+            {
+              "checkId": "summary.attack_surface",
+              "severity": "info",
+              "title": "Attack surface summary",
+              "detail": "groups: open=0, allowlist=0\ntools.elevated: enabled\nhooks.webhooks: disabled\nhooks.internal: disabled\nbrowser control: enabled"
+            },
+            {
+              "checkId": "gateway.trusted_proxies_missing",
+              "severity": "warn",
+              "title": "Reverse proxy headers are not trusted",
+              "detail": "gateway.bind is loopback and gateway.trustedProxies is empty. If you expose the Control UI through a reverse proxy, configure trusted proxies so local-client checks cannot be spoofed.",
+              "remediation": "Set gateway.trustedProxies to your proxy IPs or keep the Control UI local-only."
+            },
+            {
+              "checkId": "gateway.loopback_no_auth",
+              "severity": "critical",
+              "title": "Gateway auth missing on loopback",
+              "detail": "gateway.bind is loopback but no gateway auth secret is configured. If the Control UI is exposed through a reverse proxy, unauthenticated access is possible.",
+              "remediation": "Set gateway.auth (token recommended) or keep the Control UI local-only."
+            },
+            {
+              "checkId": "browser.control_no_auth",
+              "severity": "critical",
+              "title": "Browser control has no auth",
+              "detail": "Browser control HTTP routes are enabled but no gateway.auth token/password is configured. Any local process (or SSRF to loopback) can call browser control endpoints.",
+              "remediation": "Set gateway.auth.token (recommended) or gateway.auth.password so browser control HTTP routes require authentication. Restarting the gateway will auto-generate gateway.auth.token when browser control is enabled."
+            }
+          ]
+        }
+      }
+    },
+    "statusAll": {
+      "command": "openclaw",
+      "args": [
+        "status",
+        "--all",
+        "--timeout",
+        "10000"
+      ],
+      "cwd": "/Users/cormorantai/openclawbrain",
+      "exitCode": 0,
+      "signal": null,
+      "ok": true,
+      "stdout": "OpenClaw status --all\n\nOverview\n┌─────────────────┬───────────────────────────────────────────────────────────────────────────────────────────────────┐\n│ Item            │ Value                                                                                             │\n├─────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────┤\n│ Version         │ 2026.2.17                                                                                         │\n│ OS              │ macos 26.3 (arm64)                                                                                │\n│ Node            │ 22.22.0                                                                                           │\n│ Config          │ ~/.openclaw-ocbphase1-short-static/preflight/openclaw.json                                        │\n│ Dashboard       │ http://127.0.0.1:18789/                                                                           │\n│ Tailscale       │ off · Running · cormorantais-mac-mini.tail499c70.ts.net                                           │\n│ Channel         │ stable (default)                                                                                  │\n│ Update          │ pnpm · npm update 2026.3.13                                                                       │\n│ Gateway         │ local · ws://127.0.0.1:18789 (local loopback) · unreachable (connect failed: unauthorized:        │\n│                 │ gateway token missing (provide gateway auth token))                                               │\n│ Security        │ Run: openclaw security audit --deep                                                               │\n│ Gateway self    │ unknown                                                                                           │\n│ Gateway service │ LaunchAgent not installed                                                                         │\n│ Node service    │ LaunchAgent not installed                                                                         │\n│ Agents          │ 1 total · 1 bootstrapping · 0 active · 0 sessions                                                 │\n└─────────────────┴───────────────────────────────────────────────────────────────────────────────────────────────────┘\n\nChannels\n┌──────────┬─────────┬────────┬───────────────────────────────────────────────────────────────────────────────────────┐\n│ Channel  │ Enabled │ State  │ Detail                                                                                │\n├──────────┼─────────┼────────┼───────────────────────────────────────────────────────────────────────────────────────┤\n└──────────┴─────────┴────────┴───────────────────────────────────────────────────────────────────────────────────────┘\n\nAgents\n┌────────────┬───────────┬──────────┬──────────┬──────────────────────────────────────────────────────────────────────┐\n│ Agent      │ Bootstrap │ Sessions │ Active   │ Store                                                                │\n├────────────┼───────────┼──────────┼──────────┼──────────────────────────────────────────────────────────────────────┤\n│ main       │ PENDING   │        0 │ unknown  │ ~/.openclaw-ocbphase1-short-static/preflight/agents/main/sessions/   │\n│            │           │          │          │ sessions.json                                                        │\n└────────────┴───────────┴──────────┴──────────┴──────────────────────────────────────────────────────────────────────┘\n\nDiagnosis (read-only)\n\nGateway connection details:\n  Gateway target: ws://127.0.0.1:18789\n  Source: local loopback\n  Config: /Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.json\n  Bind: loopback\n\n! Config: /Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.json\n  - plugins.slots: Unrecognized key: \"contextEngine\"\n✓ Restart sentinel: none\n! Port 18789\n  Port 18789 is already in use.\n  - pid 40240 cormorantai: openclaw-gateway (127.0.0.1:18789)\n  - Gateway already running locally. Stop it (openclaw gateway stop) or use a different port.\n✓ Tailscale: off · Running · cormorantais-mac-mini.tail499c70.ts.net\n  ips: 100.73.247.26, fd7a:115c:a1e0::e932:f71a\n✓ Skills: 8 eligible · 0 missing · /Users/cormorantai/.openclaw/workspace\n! Channel issues skipped (gateway unreachable)\n\nGateway health:\n  connect failed: unauthorized: gateway token missing (provide gateway auth token)\n\nPasteable debug report. Auth tokens redacted.\nTroubleshooting: https://docs.openclaw.ai/troubleshooting\n\n",
+      "stderr": "Invalid config at /Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.json:\\n- plugins.slots: Unrecognized key: \"contextEngine\"\nConfig invalid\nFile: ~/.openclaw-ocbphase1-short-static/preflight/openclaw.json\nProblem:\n  - plugins.slots: Unrecognized key: \"contextEngine\"\n\nRun: openclaw doctor --fix\nInvalid config at /Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.json:\\n- plugins.slots: Unrecognized key: \"contextEngine\"\n",
+      "error": null
+    },
+    "gatewayProbe": {
+      "command": "openclaw",
+      "args": [
+        "gateway",
+        "probe"
+      ],
+      "cwd": "/Users/cormorantai/openclawbrain",
+      "exitCode": 1,
+      "signal": null,
+      "ok": false,
+      "stdout": "│\n◇  Config ───────────────────────────────────────────────────╮\n│                                                            │\n│  Config invalid; doctor will run with best-effort config.  │\n│                                                            │\n├────────────────────────────────────────────────────────────╯\n│\n◇  Doctor changes ──────────────────────────────╮\n│                                               │\n│  Telegram configured, enabled automatically.  │\n│                                               │\n├───────────────────────────────────────────────╯\n│\n◇  Unknown config keys ───────────╮\n│                                 │\n│  - plugins.slots.contextEngine  │\n│                                 │\n├─────────────────────────────────╯\n│\n◇  Doctor ──────────────────────────────────────────────╮\n│                                                       │\n│  Run \"openclaw doctor --fix\" to apply these changes.  │\n│  Run \"openclaw doctor --fix\" to remove these keys.    │\n│                                                       │\n├───────────────────────────────────────────────────────╯\nGateway Status\nReachable: no\nProbe budget: 3000ms\n\nDiscovery (this machine)\nFound 4 gateway(s) via Bonjour (local.)\n\nTargets\nLocal loopback ws://127.0.0.1:18789\n  Connect: failed - connect failed: unauthorized: gateway token missing (provide gateway auth token)\n\n",
+      "stderr": "Invalid config at /Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.json:\\n- plugins.slots: Unrecognized key: \"contextEngine\"\nConfig invalid\nFile: ~/.openclaw-ocbphase1-short-static/preflight/openclaw.json\nProblem:\n  - plugins.slots: Unrecognized key: \"contextEngine\"\n\nRun: openclaw doctor --fix\n",
+      "error": null
+    },
+    "gatewayStatus": {
+      "command": "openclaw",
+      "args": [
+        "gateway",
+        "status"
+      ],
+      "cwd": "/Users/cormorantai/openclawbrain",
+      "exitCode": 0,
+      "signal": null,
+      "ok": true,
+      "stdout": "│\n◇  Config ───────────────────────────────────────────────────╮\n│                                                            │\n│  Config invalid; doctor will run with best-effort config.  │\n│                                                            │\n├────────────────────────────────────────────────────────────╯\n│\n◇  Doctor changes ──────────────────────────────╮\n│                                               │\n│  Telegram configured, enabled automatically.  │\n│                                               │\n├───────────────────────────────────────────────╯\n│\n◇  Unknown config keys ───────────╮\n│                                 │\n│  - plugins.slots.contextEngine  │\n│                                 │\n├─────────────────────────────────╯\n│\n◇  Doctor ──────────────────────────────────────────────╮\n│                                                       │\n│  Run \"openclaw doctor --fix\" to apply these changes.  │\n│  Run \"openclaw doctor --fix\" to remove these keys.    │\n│                                                       │\n├───────────────────────────────────────────────────────╯\nService: LaunchAgent (not loaded)\nFile logs: /tmp/openclaw/openclaw-2026-03-15.log\n\nConfig (cli): ~/.openclaw-ocbphase1-short-static/preflight/openclaw.json (invalid)\nConfig (service): ~/.openclaw-ocbphase1-short-static/preflight/openclaw.json (invalid)\n\nGateway: bind=loopback (127.0.0.1), port=18789 (env/config)\nProbe target: ws://127.0.0.1:18789\nDashboard: http://127.0.0.1:18789/\nProbe note: Loopback-only gateway; only local clients can connect.\n\nRuntime: unknown (Bad request.\nCould not find service \"ai.openclaw.gateway\" in domain for user gui: 501)\n\nListening: 127.0.0.1:18789\n\n\nTroubles: run openclaw status\nTroubleshooting: https://docs.openclaw.ai/troubleshooting\n",
+      "stderr": "Invalid config at /Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.json:\\n- plugins.slots: Unrecognized key: \"contextEngine\"\nConfig invalid\nFile: ~/.openclaw-ocbphase1-short-static/preflight/openclaw.json\nProblem:\n  - plugins.slots: Unrecognized key: \"contextEngine\"\n\nRun: openclaw doctor --fix\nService config looks out of date or non-standard.\nService config issue: Gateway service PATH is not set; the daemon should use a minimal PATH.\nRecommendation: run \"openclaw doctor\" (or \"openclaw doctor --repair\").\nConfig issue: plugins.slots: Unrecognized key: \"contextEngine\"\nService config issue: plugins.slots: Unrecognized key: \"contextEngine\"\nRPC probe: failed\nRPC target: ws://127.0.0.1:18789\n  gateway url override requires explicit credentials\n  Fix: pass --token or --password (or gatewayToken in tools).\n  Config: /Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.json\nService unit not found.\nService not installed. Run: openclaw gateway install\nFile logs: /tmp/openclaw/openclaw-2026-03-15.log\nPort 18789 is already in use.\n- pid 40240 cormorantai: openclaw-gateway (127.0.0.1:18789)\n- Gateway already running locally. Stop it (openclaw gateway stop) or use a different port.\nOther gateway-like services detected (best effort):\n- com.openclawbrain.daemon.activation.0ec88212fa7d (user, plist: /Users/cormorantai/Library/LaunchAgents/com.openclawbrain.daemon.activation.0ec88212fa7d.plist)\n- com.openclawbrain.daemon.activation.546e84bf06ac (user, plist: /Users/cormorantai/Library/LaunchAgents/com.openclawbrain.daemon.activation.546e84bf06ac.plist)\n- com.openclawbrain.daemon.activation.b3eeb450ca08 (user, plist: /Users/cormorantai/Library/LaunchAgents/com.openclawbrain.daemon.activation.b3eeb450ca08.plist)\nCleanup hint: launchctl bootout gui/$UID/ai.openclaw.gateway\nCleanup hint: rm ~/Library/LaunchAgents/ai.openclaw.gateway.plist\nRecommendation: run a single gateway per machine for most setups. One gateway supports multiple agents (see docs: /gateway#multiple-gateways-same-host).\nIf you need multiple gateways (e.g., a rescue bot on the same host), isolate ports + config/state (see docs: /gateway#multiple-gateways-same-host).\n",
+      "error": null
+    },
+    "doctor": {
+      "command": "openclaw",
+      "args": [
+        "doctor",
+        "--non-interactive"
+      ],
+      "cwd": "/Users/cormorantai/openclawbrain",
+      "exitCode": 0,
+      "signal": null,
+      "ok": true,
+      "stdout": "▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄\n██░▄▄▄░██░▄▄░██░▄▄▄██░▀██░██░▄▄▀██░████░▄▄▀██░███░██\n██░███░██░▀▀░██░▄▄▄██░█░█░██░█████░████░▀▀░██░█░█░██\n██░▀▀▀░██░█████░▀▀▀██░██▄░██░▀▀▄██░▀▀░█░██░██▄▀▄▀▄██\n▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀\n                  🦞 OPENCLAW 🦞                    \n \n┌  OpenClaw doctor\n│\n◇  Config ───────────────────────────────────────────────────╮\n│                                                            │\n│  Config invalid; doctor will run with best-effort config.  │\n│                                                            │\n├────────────────────────────────────────────────────────────╯\n│\n◇  Doctor changes ──────────────────────────────╮\n│                                               │\n│  Telegram configured, enabled automatically.  │\n│                                               │\n├───────────────────────────────────────────────╯\n│\n◇  Unknown config keys ───────────╮\n│                                 │\n│  - plugins.slots.contextEngine  │\n│                                 │\n├─────────────────────────────────╯\n│\n◇  Doctor ──────────────────────────────────────────────╮\n│                                                       │\n│  Run \"openclaw doctor --fix\" to apply these changes.  │\n│  Run \"openclaw doctor --fix\" to remove these keys.    │\n│                                                       │\n├───────────────────────────────────────────────────────╯\n│\n◇  Gateway auth ──────────────────────────────────────────────────╮\n│                                                                 │\n│  Gateway auth is off or missing a token. Token auth is now the  │\n│  recommended default (including loopback).                      │\n│                                                                 │\n├─────────────────────────────────────────────────────────────────╯\n│\n◇  State integrity ────────────────────────────────────────────────────────╮\n│                                                                          │\n│  - CRITICAL: Session store dir missing                                   │\n│    (~/.openclaw-ocbphase1-short-static/preflight/agents/main/sessions).  │\n│  - CRITICAL: OAuth dir missing                                           │\n│    (~/.openclaw-ocbphase1-short-static/preflight/credentials).           │\n│  - Multiple state directories detected. This can split session history.  │\n│    - ~/.openclaw                                                         │\n│    Active state dir: ~/.openclaw-ocbphase1-short-static/preflight        │\n│                                                                          │\n├──────────────────────────────────────────────────────────────────────────╯\n│\n◇  Other gateway-like services detected ───────────────────────────────────────╮\n│                                                                              │\n│  - com.openclawbrain.daemon.activation.0ec88212fa7d (user, plist:            │\n│    /Users/cormorantai/Library/LaunchAgents/com.openclawbrain.daemon.activat  │\n│  ion.0ec88212fa7d.plist)                                                     │\n│  - com.openclawbrain.daemon.activation.546e84bf06ac (user, plist:            │\n│    /Users/cormorantai/Library/LaunchAgents/com.openclawbrain.daemon.activat  │\n│  ion.546e84bf06ac.plist)                                                     │\n│  - com.openclawbrain.daemon.activation.b3eeb450ca08 (user, plist:            │\n│    /Users/cormorantai/Library/LaunchAgents/com.openclawbrain.daemon.activat  │\n│  ion.b3eeb450ca08.plist)                                                     │\n│                                                                              │\n├──────────────────────────────────────────────────────────────────────────────╯\n│\n◇  Cleanup hints ─────────────────────────────────────────╮\n│                                                         │\n│  - launchctl bootout gui/$UID/ai.openclaw.gateway       │\n│  - rm ~/Library/LaunchAgents/ai.openclaw.gateway.plist  │\n│                                                         │\n├─────────────────────────────────────────────────────────╯\n│\n◇  Gateway recommendation ───────────────────────────────────────────────╮\n│                                                                        │\n│  Recommendation: run a single gateway per machine for most setups.     │\n│  One gateway supports multiple agents.                                 │\n│  If you need multiple gateways (e.g., a rescue bot on the same host),  │\n│  isolate ports + config/state (see docs:                               │\n│  /gateway#multiple-gateways-same-host).                                │\n│                                                                        │\n├────────────────────────────────────────────────────────────────────────╯\n│\n◇  Security ─────────────────────────────────╮\n│                                            │\n│  - No channel security warnings detected.  │\n│  - Run: openclaw security audit --deep     │\n│                                            │\n├────────────────────────────────────────────╯\n│\n◇  Skills status ────────────╮\n│                            │\n│  Eligible: 8               │\n│  Missing requirements: 42  │\n│  Blocked by allowlist: 0   │\n│                            │\n├────────────────────────────╯\n│\n◇  Plugins ─────────╮\n│                   │\n│  Loaded: 4        │\n│  Disabled: 32     │\n│  Errors: 1        │\n│  - openclawbrain  │\n│                   │\n├───────────────────╯\n│\n◇  Plugin diagnostics ───────────────────────────────────────────────╮\n│                                                                    │\n│  - ERROR openclawbrain: plugin failed during register: TypeError:  │\n│    api.registerContextEngine is not a function                     │\n│    (/Users/cormorantai/openclawbrain/index.ts)                     │\n│                                                                    │\n├────────────────────────────────────────────────────────────────────╯\n│\n◇  Shell completion ────────────────────────────────────────────────────╮\n│                                                                       │\n│  Shell completion is configured in your zsh profile but the cache is  │\n│  missing.                                                             │\n│  Regenerating cache...                                                │\n│                                                                       │\n├───────────────────────────────────────────────────────────────────────╯\n│\n◇  Shell completion ───────────────────────────────────────────────────────────╮\n│                                                                              │\n│  Completion cache regenerated at                                             │\n│  /Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/completions/  │\n│  openclaw.zsh                                                                │\n│                                                                              │\n├──────────────────────────────────────────────────────────────────────────────╯\n│\n◇  Gateway ──────────────╮\n│                        │\n│  Gateway not running.  │\n│                        │\n├────────────────────────╯\n│\n◇  Gateway connection ─────────────────────────────────────────────────────────╮\n│                                                                              │\n│  Gateway target: ws://127.0.0.1:19130                                        │\n│  Source: local loopback                                                      │\n│  Config:                                                                     │\n│  /Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.jso  │\n│  n                                                                           │\n│  Bind: loopback                                                              │\n│                                                                              │\n├──────────────────────────────────────────────────────────────────────────────╯\n│\n◇  Gateway ────────────────────────╮\n│                                  │\n│  Gateway service not installed.  │\n│                                  │\n├──────────────────────────────────╯\nRun \"openclaw doctor --fix\" to apply changes.\n│\n└  Doctor complete.\n\n",
+      "stderr": "Invalid config at /Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.json:\\n- plugins.slots: Unrecognized key: \"contextEngine\"\nInvalid config at /Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.json:\\n- plugins.slots: Unrecognized key: \"contextEngine\"\nInvalid config:\n- plugins.slots: Unrecognized key: \"contextEngine\"\n",
+      "error": null
+    },
+    "channelsStatus": {
+      "command": "openclaw",
+      "args": [
+        "channels",
+        "status",
+        "--probe"
+      ],
+      "cwd": "/Users/cormorantai/openclawbrain",
+      "exitCode": 1,
+      "signal": null,
+      "ok": false,
+      "stdout": "│\n◇  Config ───────────────────────────────────────────────────╮\n│                                                            │\n│  Config invalid; doctor will run with best-effort config.  │\n│                                                            │\n├────────────────────────────────────────────────────────────╯\n│\n◇  Doctor changes ──────────────────────────────╮\n│                                               │\n│  Telegram configured, enabled automatically.  │\n│                                               │\n├───────────────────────────────────────────────╯\n│\n◇  Unknown config keys ───────────╮\n│                                 │\n│  - plugins.slots.contextEngine  │\n│                                 │\n├─────────────────────────────────╯\n│\n◇  Doctor ──────────────────────────────────────────────╮\n│                                                       │\n│  Run \"openclaw doctor --fix\" to apply these changes.  │\n│  Run \"openclaw doctor --fix\" to remove these keys.    │\n│                                                       │\n├───────────────────────────────────────────────────────╯\n",
+      "stderr": "Invalid config at /Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclaw.json:\\n- plugins.slots: Unrecognized key: \"contextEngine\"\nConfig invalid\nFile: ~/.openclaw-ocbphase1-short-static/preflight/openclaw.json\nProblem:\n  - plugins.slots: Unrecognized key: \"contextEngine\"\n\nRun: openclaw doctor --fix\n",
+      "error": null
+    }
+  },
+  "trace": null,
+  "setup": {
+    "linkedPlugin": "/Users/cormorantai/openclawbrain",
+    "lcmDbPath": "/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/lcm.db",
+    "brainRoot": "/Users/cormorantai/.openclaw-ocbphase1-short-static/preflight/openclawbrain",
+    "contextEngineSlot": "openclawbrain",
+    "validationMode": "sterile-lane",
+    "validationLaneName": "ocbphase1",
+    "validationGatewayPort": 19130,
+    "validationModel": "ollama/qwen2.5:7b-instruct",
+    "workerMode": "child",
+    "embeddingProvider": "ollama",
+    "embeddingModel": "bge-large:latest",
+    "agentTimeoutMs": 120000
+  },
+  "init": null,
+  "doctor": null,
+  "status": null,
+  "runtime": null,
+  "agent": {},
+  "assertions": {},
+  "skipped": [
+    {
+      "phase": "init-and-agent-checks",
+      "reason": "--setup-only was requested."
+    }
+  ]
+}

package/docs/evidence/README.md

@@ -0,0 +1,16 @@
+# Evidence bundles
+
+Store proof artifacts under dated commit directories:
+
+```text
+YYYY-MM-DD/<git-sha>/
+```
+
+Each bundle should include the files described in `../EVIDENCE.md`.
+
+For host-install validation runs, also keep the pre-run diagnostic ladder beside the report bundle:
+
+- `status-all.txt`
+- `gateway-probe.txt`
+- `gateway-status.txt`
+- `channels-status.txt`