AgentFixboard
UnverifiedLast checked OpenClaw#setup#error-messages

openclaw update fails candidate-doctor-lint with policy/attestation-hash-mismatch

openclaw update stops in validating at candidate-doctor-lint with policy/attestation-hash-mismatch. The candidate names a hash that openclaw policy check on the installed CLI does not compute from the same config.

From GitHub

openclaw/openclaw

IssuePull request

Difficulty
Easy
Time
~5 min
Steps
2
Fixed in
—
Last checked

Unverified: we could not confirm from the sources that a fix shipped. Source: PR #180505 merged. Last checked 2026-10-22.

Symptom

openclaw update stops in validating at candidate-doctor-lint with policy/attestation-hash-mismatch. The candidate names a hash that openclaw policy check on the installed CLI does not compute from the same config.

Evidence what you'll see

  • Two failed runs (565706b1, 22ffd390) finished with reason doctor-failed and one error policy/attestation-hash-mismatch. The lint fixHint named sha256:4c7e96ca….
  • The same config on the installed CLI printed "attestationHash":"sha256:c606efbe…" from openclaw policy check --agent sarah --json.
  • Pinning plugins.entries.policy.config.expectedAttestationHash to 4c7e96ca… let validation pass; the installed checker then reported the pin stale (ok:false). Reverting the pin to c606efbe… restored ok:true.

Why it happens

Update rehearsal changed Gateway settings used by the policy attestation (including Control UI forced off) before the candidate doctor lint ran, so validation hashed a config the install does not run. Pull request 180505 checks the real deployment settings and applies isolation only when the rehearsal Gateway starts.

Affected versions

Reported on 2026.10.10-beta.3 (15dffe5) after starting from 2026.10.10-beta.2 (2b85c4c), Linux WSL2, user-scope systemd unit openclaw-gateway.service, npm install. The issue names local dist overrides (openclaw-local-overrides) on that box.

Fix steps

0 of 2 done

Your check marks stay in this browser only.

How to check it worked

  • A later openclaw update completes candidate-doctor-lint without policy/attestation-hash-mismatch, and openclaw policy check on the installed CLI still reports the same attestationHash.

If it still fails

  • No published release tag contains pull request 180505. Tags v2026.10.6 and v2026.10.5 were compared against merge 74c27c7657 and do not contain it (diverged).
  • The maintainer comment says a newer candidate cannot reconstruct deployment settings already overwritten by an older updater. If the next update still asks for the rehearsal hash, flip the pin for that one run, then set it back to the installed openclaw policy check value.

Sources and credit

Summarized in our own words from these public reports. Credit goes to their authors.

Provided as is, without warranty. Try changes in a non-production environment and back up first. Security-related steps: verify against the official docs. Terms · Request removal or attribution change

Hit an error we don't cover? Submit it