Model Governance Policy / Profile Floor Compatibility

Problem

The root-owned OpenClaw runtime profile reserves a minimum of 16,384 input tokens so Model Governance can cover OpenClaw-injected workspace, skills and system context before provider execution.

The staging scope policies still limited input to 16,000 tokens per request. Route selection therefore failed before reservation with:

MODEL_INPUT_TOKEN_LIMIT_DENY

This was a configuration invariant violation:

scope max_input_tokens_per_request
<
root-owned profile input_reservation_floor_tokens

The registered OpenClaw model itself supports 32,768 input tokens, so the model capability was not the blocker.

Invariant

For every Model Governance scope that allows a model/runtime whose root-owned profile declares an input reservation floor:

scope.max_input_tokens_per_request
>=
profile.model_governance.input_reservation_floor_tokens

The profile floor remains root-owned. Task payloads cannot alter it.

Staging policy

The two staging policies that allow openai/deepseek-v4-flash are updated from:

to:

This is the minimum compatible value. It intentionally remains below the model's 32,768-token technical input ceiling.

The daily token budget is unchanged.

Governance path

The live SQLite policy must be changed only through the repository bootstrap and aios_model_governance_admin.py.

The admin reconciler:

reads the governed repository config;
uses current policy revision as CAS;
calls ModelGovernanceStore.set_scope_policy;
appends normal Model Governance audit evidence;
verifies the audit chain.

Direct SQL updates remain forbidden.

Exhausted OpenClaw recovery

The fixed OpenClaw live Task has exhausted its normal three attempts.

After the governed policy candidate is officially verified and the live policy is reconciled:

attempt 3 VERIFYING/FAILED result
→ official NEEDS_REWORK
→ Task becomes FAILED 3/3
→ official bounded retry extension 3 → 4
→ same Task / same Job returns QUEUED
→ persistent OpenClaw worker auto-claims attempt 4

AR1 attempt-scoped external request identity ensures attempt 4 receives a new external request and a new Model Governance reservation.

No historical reservation is deleted or rewritten.

Acceptance

Attempt 4 must prove:

scope max_input_tokens_per_request=16384
profile input_reservation_floor_tokens=16384
reserved_estimated_input_tokens>=16384
actual input <= reserved input
settlement=SETTLED
usage_source=runtime
audit_chain_valid=true

If attempt 4 exposes a new failure, stop. No additional retry extension is authorized by this repair.

2.7 KiB Raw Blame History