OpenClaw Safe Change Flow

Goal: avoid outages, keep rollback ready, verify every change.
Use single-instance mode by default. Secondary-instance checks are optional.

Scope

Default (recommended): single instance

• - Main config: INLINECODE0

Optional (advanced): dual instance

• - Secondary config: ~/.openclaw-secondary/openclaw.json (or your custom path)

If you do not need high-availability validation, single-instance flow is enough.

Required single-instance flow

1. 1. Backup first

1. 2. Make minimal edits

1. 3. Validate immediately

1. 4. Auto rollback on failure

1. 5. Confirm availability

Agent execution convention (default behavior)

After this skill is installed, treat this as default policy for config changes:

• - Default entrypoint: run config changes through INLINECODE4
• Avoid direct edits + bare restart
• If user explicitly asks to bypass: allow it, but warn about risk

Mental model:

• - Before: edit config directly
• Now: create a small edit script and run INLINECODE5

Optional dual-instance enhancement

On top of single-instance flow, you may also verify a secondary instance:

• - INLINECODE6
• If either instance validation fails, rollback

Use this only when change risk is high or HA checks are required.

Automation script (v1.0.2+)

This skill includes safe-change.sh to enforce:

backup → change → validate → rollback on failure

Recommended: single-instance usage

CODEBLOCK0

Optional: dual-instance usage

CODEBLOCK1

When secondary checks are enabled, set SECONDARY_TOKEN as an environment variable.

Safety rules

• - Never hardcode tokens or secrets
• Validate before announcing success
• Restore service first, investigate later
• Always keep a recent known-good backup in production

Manual quick template (single instance)

CODEBLOCK2

If validation fails:

CODEBLOCK3