OpenClaw merged PR #151696, a P0 release fix for extended-stable npm packages that could install with an incomplete dependency tree.
The affected path is specific: users installing or updating to openclaw@2026.7.33 could receive a root package whose shrinkwrap omitted the declared @openclaw/ai runtime. npm could exit successfully, but the installed CLI would not have everything it needed to start.
The Failure Mode
Packaging bugs are dangerous because they can look healthy from the outside. A package-manager success code is usually treated as the end of the story. In this case, the PR says both Node 24 with npm 11 and Node 22 with npm 10 could produce the same pattern: published 2026.7.33 installed cleanly, but the checker rejected it because npm-shrinkwrap.json was missing the declared AI dependency.
The repaired tarball tells a different story. The PR reports that it installed cleanly, printed the OpenClaw version, and passed openclaw gateway status.
That last step is important. A package should not merely unpack. It should prove the CLI can reach its basic runtime path.
What Changed
The shrinkwrap generator now resolves workspace dependencies to release versions and checks declared runtime dependencies against both the root lock declaration and package entries. The publication path also performs a public-registry install in a credential-free container after core packages publish and become registry-visible.
The container proof is intentionally locked down: non-root execution, read-only mounts, a read-only root filesystem, dropped capabilities, no-new-privileges, and before-and-after tarball hashing. The goal is to verify the same public dependency graph a real user would receive, not a local build that happens to have unpublished workspace packages nearby.
The PR also separates local preflight from public publication proof. Preflight can test prepared local candidates; publication must prove that the exact public package installs from public dependencies.
User Impact
The already-published 2026.7.33 artifact is unchanged. Future packages produced from the branch should include the declared AI runtime and fail release checks if the dependency graph is incomplete.
For users on the extended-stable line, this is the sort of fix that reduces install-time ambiguity. Either the public package contains the runtime it declares and can start, or the release gate stops it before publication.
Why It Matters
OpenClaw's extended-stable channel is for people who value predictability. A missing runtime dependency cuts against that promise because it moves the failure from release engineering to the user's machine.
PR #151696 pulls that failure back into release engineering, where it belongs. It adds dependency-coverage assertions, exact public install checks, and authority-boundary proof around the publication path. The evidence reports focused release tests, workflow validation, lint, tarball verification, and a clean structured review at P0/P1 scope.
That is not glamorous release work, but it is the kind of work that makes a stable channel feel stable.