2026 OpenClaw Inbound Channel Governance: Slack/Discord DM Pairing and groupPolicy on a Remote Physical Mac—A Reproducible Runbook for Dropped Messages, Expired Pairing, and Per-Channel Model Overrides (openclaw.json + FAQ)

2. Pain points (why “nothing happens”)

1. Treating chat delivery as “proof” the agent saw the message. Vendors can accept a webhook, return 200, and still not reach your app if the signing secret is wrong or a duplicate endpoint stole the event. You need verifiable HMAC or equivalent plus one active app URL on the public edge.
2. Assuming a DM is authorized without pairing. DM pairing exists to map user id ↔ internal policy subject. If pairing expired, was never completed, or a workspace reinstall invalidated bot membership, the gateway is right to drop or no-op.
3. Forgetting the group allowlist and model matrix interact. A channel can be allowed for chat while a stricter model policy routes that traffic to a cheaper or stub profile—so operators see “wrong model” instead of a hard deny. The fix is a defined precedence and an explicit override table per id.

3. Decision matrix: Slack vs Discord surfaces

Use this when choosing defaults for the same remote physical Mac gateway.

4. openclaw.json snippets (illustrative)

Structural example only: key names and nesting must follow your OpenClaw build. Use SecretRef / env indirection in production, merge with an existing gateway block, and back up before apply.

4.1 Slack: signing + DM pairing + groupPolicy

{
  "channels": {
    "slack": {
      "enabled": true,
      "appIdRef": "env:SLACK_APP_ID",
      "clientIdRef": "env:SLACK_CLIENT_ID",
      "clientSecretRef": "env:SLACK_CLIENT_SECRET",
      "botTokenRef": "env:SLACK_BOT_TOKEN",
      "signingSecretRef": "env:SLACK_SIGNING_SECRET",
      "inbound": {
        "urlPath": "/openclaw/slack/events",
        "verifyRequestSigning": true
      },
      "dmPairing": {
        "mode": "inline-code",
        "codeTtlMinutes": 15,
        "requireNewPairingOnWorkspaceReinstall": true
      },
      "groupPolicy": {
        "default": "deny",
        "allowChannelIds": ["C0123456789"],
        "allowThreadOnlyChannelIds": []
      },
      "modelByConversation": {
        "C0123456789": "anthropic:claude-3-5-sonnet",
        "DMBIND:U0ABCDEF": "openai:gpt-4.1-mini"
      }
    }
  }
}

4.2 Discord: bot token + intents + allowlist

{
  "channels": {
    "discord": {
      "enabled": true,
      "botTokenRef": "env:DISCORD_BOT_TOKEN",
      "applicationIdRef": "env:DISCORD_APP_ID",
      "gateway": {
        "intents": ["GUILDS", "GUILD_MESSAGES", "DIRECT_MESSAGES", "MESSAGE_CONTENT"]
      },
      "groupPolicy": {
        "default": "deny",
        "allowGuildIds": ["9876543210"],
        "allowChannelIds": ["111122223333444455"]
      },
      "dmPairing": {
        "mode": "dm-code",
        "codeTtlMinutes": 15
      }
    }
  }
}

Align codeTtlMinutes with the message you show users; when they see pairing expired, increase clarity before you increase TTL. Map modelByConversation keys to your build’s canonical id format (channel, DM, or thread), and avoid double-defining the same id under different spellings. For router-level model chains (failover) instead of per-chat overrides, align the same gateway’s upstream router and channel policy so rules do not fight across layers.

5. Seven-step runbook (remote physical Mac)

1. Snapshot and freeze config. cp openclaw.json openclaw.json.bak.$(date +%Y%m%d%H%M); record OpenClaw build id and the chat app’s app id in your ticket.
2. Prove public ingress to this Mac. From the internet, hit the vendor challenge URL; confirm the reverse proxy forwards to the same loopback port your gateway binds (e.g. 127.0.0.1:18789).
3. Reconcile signing and secrets. Slack: request signature. Discord: intents + bot auth. A single wrong secret looks like total silence in user chat.
4. Complete (or re-do) DM pairing. Issue a fresh code; if your pair store lives on disk, back it up before you wipe. Confirm the mapping appears in info-level logs or a local bind table.
5. Tighten groupPolicy, then test deny → allow. Start in default: deny for new installs; add one known channel id, send a test, then add more.
6. Check model override precedence. Send the same text in DM vs channel: you should see different upstream profiles if your matrix requires it. If not, the override key is wrong, not the model name.
7. Hand off to metrics + audit. Export the allowlist, pairing TTL, and the reverse-proxy vhost. On-call can load the next shift without re-deriving ids from screenshots.

6. Triage: silence, expired pairing, wrong model

7. Citable numbers & checklist items

• Pairing code TTL (example): 15 minutes in the snippets—tune with your org’s SLO, but always document changes next to the OpenClaw version number.
• Default deny on groupPolicy: Treat default: "deny" as the 2026 baseline for any bot that can run tools; widen allowlists in small batches.
• Local listener: Binding the gateway to 127.0.0.1 and terminating TLS at the edge matches the common ZoneMac SSH + reverse proxy pattern and limits lateral exposure on the host.

8. FAQ

9. Summary & why Mac mini fits this stack

Getting Slack/Discord inbounds right on the first try is less about product hype than about a boring sequence: verify signatures, prove pairing, and lock down groupPolicy before you widen tools. A ZoneMac remote physical Mac—especially a Mac mini M4 class node—is a strong match: Apple Silicon idle power on the order of a few watts, a Unix toolchain that matches openssh, launchd, and Homebrew workflows, and a low-crash desktop stack for unattended services.

Security and stability matter for long-lived webhooks: macOS ships Gatekeeper, SIP, and FileVault, which most commodity Windows utility hosts do not offer in the same integrated package. A quiet metal box in the corner beats chasing flaky VMs when your pair codes and allowlists must be correct at 3 a.m.

If you want a remote Mac to host OpenClaw, reverse proxies, and the observability in this runbook, Mac mini M4 is a sensible starting point. Get a dedicated physical node through ZoneMac and run this play on real hardware—then your Slack and Discord inbounds stay predictable, auditable, and on-policy.