2026 OpenClaw Plugins: Fail-Closed Defaults and Mandatory Manifests on a Remote Physical Mac 24/7 Gateway—openclaw doctor Audit Checklist, ACP Dispatch Switches, and a Controlled Rollback Runbook (grep Snippets + FAQ)

Pain points

1. Constraint: implicit powers and “it runs, ship it.” Capabilities such as fs, network, or subprocess left out of the manifest are often silently allowed in fail-open mode, so audits cannot prove what was permitted.
2. Hidden cost: doctor green ≠ policy live. openclaw doctor may cover runtime and ports while hot reload never picked up new manifest enforcement flags—externally you still see legacy behavior.
3. Stability and audit: rollback without paired snapshots is fiction. Aggressive fail-closed breaks legitimate automation overnight; without config + plugin bundle snapshots you end up hand-editing JSON under pager duty, violating 7×24 SLOs.

Fail-closed × manifest decision matrices

The first table answers “how hard should we be?” The second maps change signals to verification.

openclaw doctor audit checklist

Treat doctor as proof that policy actually loaded—tick each item on your change ticket (map keys to openclaw.json or env vars per your distribution docs).

• Runtime and PATH: Matches the launchd user; which openclaw equals the plist binary path.
• Manifest resolution: Prints effective plugin roots; rejects directories without a manifest when enforcement is on.
• Fail-closed flags: Doctor prints the boolean and originating file; WARN is a release blocker.
• ACP dispatch: Switch state plus allow-list cardinality; empty allow list with dispatch on should warn “no clients can enter.”
• External health: Pair localhost curl with /ready (if present) so you do not get “self-check green, reverse proxy red.”

ACP dispatch switches

ACP dispatch here means whether requests from agent clients (IDEs, CLIs, external orchestrators) may enter the plugin scheduler. With fail-closed, order operations as validate the plugin set via manifest first, then use dispatch to guard the front door so a compromised client cannot jump straight into a high-risk hook.

Illustrative JSON (replace keys with your release schema before production):

{
  "plugins": {
    "requireManifest": true,
    "failClosed": true,
    "manifestSchemaVersion": "2026-05"
  },
  "acp": {
    "dispatchEnabled": true,
    "allowedClientIds": ["ci-runner-prod", "vscode-workspace-ops"],
    "denyByDefault": true
  }
}

Align allowedClientIds with internal OAuth or mTLS subjects, and log the Cartesian product of clientId × pluginId in JSONL for forensics.

Acceptance grep snippets

Run from your archive or live workspace (adjust paths):

# Explicit fail-closed / requireManifest flags
grep -RniE 'failClosed|fail_closed|requireManifest|require_manifest' \
  ~/.config/openclaw ./openclaw.json 2>/dev/null

# Every plugin directory should carry a manifest (missing = should not load)
find "$OPENCLAW_PLUGIN_ROOT" -maxdepth 2 -type f \( -name 'manifest.json' -o -name 'plugin.yaml' \) | wc -l

# ACP dispatch allow list must be non-empty in production
grep -Rni 'dispatchEnabled|allowedClientIds|denyByDefault' ~/.config/openclaw ./openclaw.json 2>/dev/null

If the first grep returns nothing, you are likely still on implicit fail-open—do not sign off on production from muscle memory alone.

Seven-step controlled rollback runbook

1. Freeze: Post maintenance; pause cron jobs that widen the call surface.
2. Snapshot: Tar openclaw.json, plugin trees, launchd plists, and doctor stdout.
3. Mandatory manifests on: Reload, grep-verify, watch “refused load” counters.
4. Fail-closed on: Uniform error codes for undeclared capabilities; keep a five-minute JSONL baseline.
5. Tighten ACP dispatch: Shadow (log-only) first, then deny-by-default.
6. Rollback trigger: If SLO breaks, restore paired snapshots, launchctl kickstart, rerun doctor.
7. RCA: Update the grep checklist and ticket; schedule the next canary.

Cite-ready facts

• Observation window: Watch at least a five-minute sliding window after policy edits before deciding stay/rollback—startup spikes are not incidents.
• Snapshot retention: Keep three restorable config revisions in production, each with a plugin tarball checksum.
• Audit retention: Store full doctor output plus grep captures with the ticket for ≥30 days to satisfy typical internal compliance spot checks.

FAQ

Chinese edition: OpenClaw 插件 fail-closed 与 manifest（简体）.

Summary and why Mac mini fits this workload

Plugin governance moves trust from tribal knowledge to machine-verifiable policy: manifests bound capabilities, fail-closed defines failure posture, ACP dispatch shrinks the ingress surface, and doctor plus grep supply the evidence chain auditors expect.

On macOS that stacks cleanly with launchd, Unified Logging, Gatekeeper, and SIP. Apple Silicon Mac mini M4 idles on the order of 4W, which is ideal for always-on gateways and sidecar probes; compared with generic mini-PCs at the same price, you usually see smoother long-session behavior when OpenClaw, health exporters, and a light CI runner share one remote physical machine.

If you want this runbook on a dedicated hosted node instead of self-racking hardware, Mac mini M4 remains one of the best-value starting points in 2026—get a remote physical Mac and turn manifest enforcement plus rollback into a repeatable procedure.