Skip to content

Harsh critic pass: getting started, architecture, security, first 7 days - #153

Merged
melvincarvalho merged 5 commits into
gh-pagesfrom
critic/a
Oct 18, 2026
Merged

melvincarvalho merged 5 commits into
gh-pagesfrom
critic/a

Conversation

@melvincarvalho

Copy link
Copy Markdown
Contributor

Harsh critic pass over getting started, architecture, contributing, security and the first-7-days guides, checked against OpenClaw 2026.10.4.

Broken or misleading examples fixed

  • Day 7: the daily self-check job could not run unattended. It had no --tools exec, and the ask approvals the page sets denied it.
  • Day 6: the disk check gave the model exec; it is now a command job, as Day 3 advises.
  • Days 3 and 6 now agree on delivery: the default is --channel last. Jobs created in chat run in that conversation, so they are not isolated by default.
  • Day 1: openclaw agent reuses the main session, so the step that shows the new SOUL.md loading has been corrected.
  • Day 2: the backup tarball step contradicted Day 7, and the no-approval warning came after the destructive prompts. Both fixed.
  • clawhub uninstall now passes --workdir (hardening, Day 4).
  • openclaw triage is only non-interactive with --non-interactive (Day 7).
  • Skill verification no longer contradicts itself about installing pending-scan releases.

Cut

  • Four security checklists, merged into one canonical list on security/hardening.
  • Repeated ClawHub study numbers, an unsourced Gartner quote, and duplicated SOUL.md examples.

The snippet gate is at 0 failures and the build passes.

…naccuracies

- introduction: heartbeat is on by default, not optional; replace the
  six-step safety list and cost table with links to the canonical
  checklist and cost pages
- quick-start: openclaw chat "hi" fails rather than being read silently;
  collapse three link tables into one next-steps list
- core-concepts: automations command is openclaw cron (automations alias);
  drop the duplicate SOUL.md example
- installation: the Docker entrypoint runs doctor --fix on every start;
  shorten the onboarding section that repeated the Quick Start
- brain-and-hands: drop an unrelated advisory note and the bootstrap
  limits repeated from the overview; shorten the naming note
- contributing/openclaw: CONTRIBUTING.md asks for build, check and test
  before review, not focused tests only
- overview: replace the third checklist, the unreviewed tools table and
  the dated Gartner quote with links to their canonical pages
- hardening: clawhub uninstall needs --workdir; link the overview's
  baseline instead of repeating it; split the redaction paragraph
- skill-verification: drop the study table duplicated from Known
  Vulnerabilities
- day 1: openclaw agent reuses the main session; use --session-key for a
  fresh one
- day 2: move the no-approval warning above the file prompts; stop
  suggesting a hand-rolled ~/.openclaw backup; cut repeated prompts
- day 3: CLI jobs default to --channel last, they do not require a route;
  chat-created jobs run in the creating conversation; command jobs bypass
  exec approvals but need operator.admin
- day 4: clawhub uninstall with --workdir; add time estimate
- day 6: positional schedules accept intervals; replace the exec disk
  check with a pointer to command jobs; explain automation approvals
- day 7: self-check job needs --tools exec and a standing grant under ask
- index: Telegram is a bundled plugin; cut filler
@melvincarvalho
melvincarvalho merged commit bdc9cc0 into gh-pages Oct 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant