OpenClaw merged PR #116795, "refactor(agents): bind tool policy to execution attribution", a P1 security-boundary change in the multi-step execution identity stack.
The problem was subtle and serious. Tool policy, approvals, diagnostics, and replay correlation could rely on copied flat fields instead of the exact execution identity that had been admitted by the host runtime. The PR calls out Codex dynamic-tool construction as one of the paths where that drift could matter.
In an agent runtime, identity is not just bookkeeping. It decides which policy applies, which approval belongs to which attempt, and which diagnostics can be trusted after the fact.
Immutable Attribution
The fix binds tools to the original immutable attribution through private, host-owned carriers. Those carriers survive Codex and Copilot tool construction, so tool paths stay correlated to the execution that was actually admitted.
The PR deliberately avoids turning this into a new public construction surface. It says the privileged authority runtime is absent from package exports and generated declarations, and that loader aliases are limited to official Codex and Copilot runtimes. Installed plugins do not get a general-purpose way to manufacture attribution authority.
That boundary is the center of the story. OpenClaw wants Codex and Copilot integrations to preserve execution identity, but it does not want arbitrary package code to mint that identity for itself.
What Users Should Notice
There is no new model-facing schema or plugin API. Operators should not need to rewrite tools.
The user-facing win is that policy and approval decisions stay attached to the admitted execution across dynamic tool paths. If a tool is allowed or denied, that decision should follow the real execution attempt rather than a copied approximation of it.
The PR also says Copilot's no-tool path remains lazy and does not load the full tool graph. That is a useful guardrail: preserving identity should not force every path to pay the cost of every tool integration.
Guardrails And Proof
The evidence list is broad. OpenClaw reports 420 focused authority-repair tests, 104 packaging-validator repair tests, and 109 post-rebase attribution, loop-admission, and before-tool-call end-to-end tests.
The checks cover Codex and Copilot lazy loading, tool construction, SDK aliases, package contracts, plugin boundaries, policy, approvals, diagnostics, clone retention, exact-attempt binding, alias ownership, package-boundary denial, and npm build validation.
The PR also says generated Plugin SDK API and package exports contain no attribution authority runtime or AgentExecutionAttribution construction surface.
Why This Is Worth Watching
OpenClaw is steadily moving identity from "fields that happen to be present" toward "host-owned authority that survives runtime transformations." That is the right direction for agent infrastructure, because tool calls increasingly pass through adapters, dynamic constructors, SDK wrappers, and provider-specific execution paths.
PR #116795 is not a flashy feature. It is a security-boundary repair that makes the platform harder to confuse. For operators who run Codex, Copilot, or dynamic tools under policy, that is exactly the kind of change that deserves attention.