feat: add OpenClaw AI assistant stack

[akurinnoy]

Description of Changes

Adds an OpenClaw AI assistant stack to the devfile registry.

OpenClaw is a personal AI assistant that runs a Gateway service with a web Control UI and connects to 25+ messaging channels (WhatsApp, Telegram, Slack, Discord, etc.). TypeScript/Node.js, MIT license, 383K+ GitHub stars.

The stack follows the same two-container pattern as the existing AI agent stacks (hermes, picoclaw, zeroclaw):

• tools container - universal developer image for editor/terminal
• openclaw container - runs the Gateway service on port 18789

Key design decisions:

• State relocated to /opt/data via OPENCLAW_CONFIG_DIR to handle OpenShift arbitrary UIDs (the official image uses uid 1000 with 700-permission dirs)
• Gateway token auto-generated on first boot, persisted to PVC
• gateway.trustedProxies set to RFC 1918 ranges so connections through the cluster network are treated as local
• cookiesAuthEnabled: true on the Control UI endpoint
• Skipped in odo v3 tests - the gateway requires token setup before responding

First boot flow:

1. Open the Control UI endpoint
2. Run show-token command in the terminal to get the gateway token
3. Paste the token and click Connect
4. Approve device pairing (one-time per browser)
5. Run setup command to configure API keys and model provider

Related Issue(s)

None

Acceptance Criteria

• Contributing guide

Read the contributing guide and followed the stack structure conventions.

• Test automation

Schema validation passes. Stack skipped in odo v3 tests - the gateway requires onboarding before it can serve health checks within the 3-minute timeout.

• Documentation

No documentation updates needed.

• Check Tools Provider

Tested on CRC cluster with Dev Spaces. Gateway boots, Control UI accessible, WebSocket connection works after token + device pairing.

Tests Performed

1. Ran bash tests/validate_devfile_schemas.sh - all stacks pass including openclaw
2. Built the devfile registry image with the openclaw stack
3. Deployed to a CRC cluster running Dev Spaces
4. Created an openclaw DevWorkspace from the custom registry
5. Verified the gateway starts and reaches ready state
6. Accessed the Control UI via the endpoint route
7. Connected with the auto-generated gateway token

How To Test

1. Build the devfile registry image:

   podman build -t devfile-registry:openclaw -f .ci/Dockerfile .
   

2. Deploy to a cluster with Dev Spaces and create a workspace using the openclaw stack
3. Open the Control UI endpoint in a browser
4. In the workspace terminal, run the show-token command to get the gateway token
5. Paste the token into the Control UI and click Connect
6. Approve device pairing when prompted
7. Verify the dashboard loads

Notes To Reviewer

• Image docker.io/openclaw/openclaw:2026.7.1 is the latest stable release, verified via skopeo
• The gateway.auth.mode=none approach was tested but OpenClaw refuses to bind to non-loopback without auth - this is by design
• Device pairing is a one-time approval per browser. There's no config to disable it, but it's a minor friction for a dev workspace
• Image mirroring to quay.io is deferred to a follow-up (same as hermes, picoclaw, zeroclaw)

Summary by CodeRabbit

• New Features
  • Added the OpenClaw AI assistant stack (version 1.0.0), including an OpenClaw gateway with a secure web control interface over public HTTPS.
  • Cookie-based authentication is enabled and the gateway supports onboarding, health/readiness checks, diagnostics, token retrieval, and restart operations.
  • Persistent storage is provided for configuration and workspace data, with OpenShift-friendly arbitrary-UID support.
• Chores / Maintenance
  • Updated code ownership rules for the OpenClaw stacks directory.
• Tests
  • Excluded the OpenClaw stack from the ODOV3 ginkgo test matrix.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bc3854c5-752b-4543-8cb2-b3c0c89a90f8

📥 Commits

Reviewing files that changed from the base of the PR and between 65fd0f7 and bc5ba2f.

📒 Files selected for processing (1)

• stacks/openclaw/1.0.0/devfile.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• stacks/openclaw/1.0.0/devfile.yaml

---

📝 Walkthrough

Walkthrough

Adds the OpenClaw stack with version metadata, an OpenShift-compatible gateway Devfile, persistent storage, Control UI configuration, operator commands, ownership rules, and an ODOV3 test exclusion.

Changes

OpenClaw stack

Layer / File(s)	Summary
Stack metadata and ownership stacks/openclaw/stack.yaml, .github/CODEOWNERS	Registers OpenClaw version 1.0.0 as the default and assigns ownership for its stack directory.
Gateway runtime provisioning stacks/openclaw/1.0.0/devfile.yaml	Defines tools and gateway containers, persistent data storage, OpenShift-compatible environment settings, token initialization, HTTPS Control UI exposure, health checks, onboarding, diagnostics, and restart commands.
ODOV3 test handling tests/check_odov3.sh	Excludes the OpenClaw stack from the ODOV3 test matrix.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: thepetk, michael-valdron

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding the OpenClaw AI assistant stack.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/openclaw-stack

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

stacks/openclaw/1.0.0/devfile.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@stacks/openclaw/1.0.0/devfile.yaml`:
- Around line 136-141: Update the restart-gateway command so it signals the
running node process rather than PID 1, preventing the openclaw container from
terminating. Ensure the startup flow keeps node under a while-true restart loop
so the process restarts in place while the container remains running.
- Line 75: Update the TOKEN generation command to read at least 48 bytes from
/dev/urandom before base64 encoding and filtering, so the final head -c 48
operation can produce the requested 48-character alphanumeric token.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 088de722-d9a2-4bfc-8a1f-b7de97dfab60

📥 Commits

Reviewing files that changed from the base of the PR and between 9ae5025 and 65fd0f7.

📒 Files selected for processing (4)

• .github/CODEOWNERS
• stacks/openclaw/1.0.0/devfile.yaml
• stacks/openclaw/stack.yaml
• tests/check_odov3.sh

[ibuziuk]

Suggested change

	schemaVersion: 2.2.2
	schemaVersion: 2.3.0

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: akurinnoy, ibuziuk
Once this PR has been reviewed and has the lgtm label, please assign michael-valdron for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment