OpenClaw Manager

Overview

Build and operate OpenClaw with production-safe defaults across both local and hosted environments. This skill is optimized for operators with limited platform expertise and enforces hard security gates before rollout completion.

Primary references:

• Docs map: references/openclaw-doc-map.md
• Security gates checklist: references/openclaw-security-checklist.md
• Mode matrix: references/openclaw-mode-matrix.md
• OS matrix: references/openclaw-os-matrix.md
• Integrations playbook: references/openclaw-integrations-playbook.md
• Ops ledger schema: references/openclaw-ops-ledger-schema.md

Automation helpers:

• scripts/plan_openclaw_rollout.py
• scripts/validate_openclaw_env.py
• scripts/update_openclaw_ops_ledger.py

Default ops ledger path:

• ./openclaw-manager-operations-ledger.md (or operator specified)

Hard-Stop Rules (Never Bypass)

Stop and block deployment/install progression if any condition is true:

1. Required secrets profile fails validation.
2. Security checklist mandatory gates are not all passing.
3. Rollback path is not documented and owned.
4. Ops ledger was not updated for the current phase.
5. Public exposure requested without auth boundary and token controls.

Workflow

1) Intake and Scope Lock

Collect and confirm:

• mode: local or hosted
• provider: local, fly, render, railway, hetzner, gcp
• os: macos, linux, windows-wsl2
• channels: subset of telegram, discord, slack
• integrations: subset of email, calendar
• environment: dev, staging, prod
• exposure: private or public

Before proceeding, write a scope_lock ledger entry:

python3 scripts/update_openclaw_ops_ledger.py \
  --ledger-file ./openclaw-manager-operations-ledger.md \
  --event scope_lock \
  --operator codex \
  --mode hosted \
  --provider fly \
  --os linux \
  --environment prod \
  --secrets-profile hosted-fly \
  --channels telegram,slack \
  --integrations email,calendar \
  --security-status pending \
  --rollback-tested no \
  --blocking-issues "none" \
  --next-owner operator \
  --next-action-date 2026-02-20

2) Generate a Decision-Complete Plan

Always generate a plan first:

python3 scripts/plan_openclaw_rollout.py \
  --mode hosted \
  --provider fly \
  --os linux \
  --channels telegram,slack \
  --integrations email,calendar \
  --environment prod \
  --exposure public \
  --ledger-file ./openclaw-manager-operations-ledger.md \
  --output /tmp/openclaw-rollout.md

The plan output is the execution contract. Do not skip sections.

3) Validate Secrets and Config Profile Before Any Infra Change

Validate environment using profile-aware gates:

python3 scripts/validate_openclaw_env.py \
  --env-file .env \
  --profile hosted-fly \
  --json