OpenClaw 2.0 can search old conversations, move sessions onto paired workers, expose selected agents through A2A, and keep recurring jobs running with standing approval. It can also reinterpret a stale configuration, retire a plugin, reroute models, and widen what a long-lived automation can do. This is an upgrade to stage, not a package to install over lunch.
The release number hides a platform migration
OpenClaw published v2026.8.1, also called OpenClaw 2.0, on August 31, 2026. The release reaches across installation, storage, messaging, memory, models, skills, automations, browsers, credentials, plugins, mobile clients, and hosted workers.
That breadth is the story. A feature such as conversation search is easy to evaluate by itself. A new credential proxy, reusable worker workspace, or recurring approval changes the trust boundary around every job that touches it.
I would treat the first production upgrade as a controlled migration with a rollback point. Back up the current installation, copy the active configuration, list installed plugins, record model aliases, export automation definitions, and preserve the state stores that make sessions recoverable. If the upgraded system behaves differently, you need more than a memory of the old setup.
Six boundaries deserve an explicit owner
| Boundary | What changed | Pre-release evidence |
|---|---|---|
| Configuration | Retired keys and storage layouts can be migrated by Doctor | Saved backup, read-only lint output, and a reviewed migration diff |
| Models | Legacy OpenAI routes move into the openai/* namespace and allowlists are explicit | Every alias resolves to the intended model and disallowed models fail closed |
| Plugins | OpenProse is removed and plugin capabilities can reach dashboards, tools, or channels | Plugin inventory, owner, granted capabilities, and removal test |
| Credentials | Masked requests and an opt-in secret egress proxy can substitute credentials | Approved destinations, failure behavior, redaction test, and audit trail |
| Approvals | An exact recurring operation can receive a standing grant | Operation fingerprint, expiry or review date, revocation test, and change detection |
| Remote execution | Sessions can move to paired devices or cloud workers and reuse warm workspaces | Worker identity, network policy, workspace ownership, cleanup, and recovery test |
The table is deliberately operational. “We ran Doctor” is not the same as “we reviewed what Doctor changed.” A successful startup is not proof that the agent still uses the same model, credential destination, or approval scope.
Run Doctor twice, with two different intentions
The release notes distinguish advisory checks from mutation. Start with openclaw doctor --json for a read-only view. Use openclaw doctor --lint --all when you need broader advisory coverage. Save that output before allowing the fixer to write anything.
OpenClaw tells installations with retired keys to run openclaw doctor --fix before September 18, 2026. The fixer keeps canonical values when old and new settings conflict, removes settings that no longer work, and may return retired tuning values to built-in defaults. That last detail can quietly change behavior even when the file remains valid.
- Stop the owning process if the state store requires exclusive access.
- Back up configuration, databases, workspaces, plugins, automation definitions, and pairing state.
- Run the read-only checks and save the findings.
- Apply the fix in a staging copy, then review every changed key and migrated path.
- Restart with outbound access restricted and run known test jobs.
- Verify a restore on a clean target before upgrading the production instance.
OpenClaw warns that some migrations cannot be read by older JSON-only builds and that restore refuses to overwrite an existing target. A backup you have never restored is still a hypothesis.
Model routing can change without the prompt changing
OpenAI model routes using codex/* or openai-codex/* move to openai/*. Doctor can flag conflicts, but it cannot decide your intent. If two old aliases collapse onto one new route, compare the resolved provider, model ID, context limits, tool support, and billing identity.
OpenClaw 2.0 also makes model allowlists explicit. That is useful if you use it as an enforcement layer. Test the negative path: ask a staging agent to select an unapproved model and confirm that the request is blocked rather than silently substituted.
This is the same lesson behind our review of Broadcom AgentMinder’s checks before tool calls. A policy becomes real only at the execution boundary. Labels in a configuration file do not prove what the runtime sent.
Standing approval needs a stable fingerprint
A recurring automation can now receive approval for one exact operation. That can remove a daily interruption without granting a blanket permission. The useful question is what OpenClaw considers “exact.”
- The command, tool, destination, account, and working directory should be part of the grant.
- A change to parameters, schedule, recipient, or credential destination should require new approval.
- The grant should be visible, revocable, and tied to an owner.
- The execution record should show which grant authorized the run.
Build a revocation drill. Approve a harmless recurring job, let it run once, revoke the grant, then prove the next run stops before the consequential action. Our review of AI-native workflows found that fewer handoffs are useful only when the remaining control points are measurable.
The credential proxy narrows exposure, not responsibility
OpenClaw can ask for a credential through a masked prompt. An opt-in egress proxy can then substitute that secret only for approved destinations so the model does not receive the raw value. This is a stronger shape than pasting a token into chat.
It still needs a destination policy. Check exact hosts, redirects, DNS changes, ports, request methods, and whether a plugin can send the same secret through another network path. Log that a secret was used without logging the secret itself. Then rotate the credential and confirm old runs cannot recover it from history, workspaces, error traces, or cached requests.
Session mobility makes cleanup more important. A warm worker or reusable project seed can shorten setup time, but it can also preserve files and assumptions between jobs. The same privacy questions we raised about persistent Claude memory apply here in a more operational form: what persists, who can read it, and how do you erase it?
Fleet, Swarm, and A2A expand the blast radius
Fleet and Swarm add ambitious ways to host and coordinate work, but the release presents them through experimental or Labs surfaces. Do not turn a visible toggle into a production-readiness claim.
A2A 1.0 can expose selected agents to trusted external systems. Those peers can discover agents, submit authenticated tasks, poll progress, and receive artifacts. Start with one non-sensitive agent, one peer identity, tight task limits, and a network allowlist. Exercise cancellation, oversized payloads, expired credentials, repeated polling, and artifact retention before connecting a business process.
Swarm should get the same treatment. A dashboard that shows worker progress improves observability, but it does not prove isolation or bounded authority. Test how workers inherit tools, skills, models, workspace files, secrets, and stop signals. The number of workers is less important than the permissions each worker receives.
My release gate for OpenClaw 2.0
I would approve production only after six artifacts exist: a restorable backup, a reviewed Doctor diff, a model-routing map, a plugin capability register, a standing-grant register, and a credential-destination policy. Then I would run one real workflow in staging with restricted networking and compare its trace with the current production version.
The attractive parts of OpenClaw 2.0 are durable sessions, reusable workers, better progress visibility, private secret handling, and fewer approval interruptions. Those are also the places where old assumptions become persistent. Upgrade when you can explain every changed boundary and roll it back.
Read the primary material
- Read the OpenClaw v2026.8.1 release notes.
- Review the OpenClaw team’s account of how version 2.0 developed.
- Check the Doctor command documentation before allowing a migration to write.
- Inspect the A2A channel boundary and configuration before exposing an agent.
Which boundary would be hardest for your current OpenClaw setup to prove: model routing, credentials, approvals, plugins, or worker state?
