Agent runtimeautonomousopscodingtestedunattended capable

Operational brief

OpenClaw

Self-hosted agent gateway with channels, cron, and write-tools. Failure has an operator.

Choose it when

You need an always-on operator agent on your own machine, with a real owner when it fails.

Skip it when

You want a hosted IDE agent with no server to own.

01 / Classification

Autonomy evidence

This is our classification, not a vendor badge. The record says what the product normally does. The gaps stay visible.

How we classify it

Unattended scheduler/heartbeat with write-tools; failure has a real owner.

Runs unattended

Yes — that capability is documented in this brief.

Trigger

The gateway's built-in scheduler persists jobs and wakes the agent without a new chat prompt. Chat-led work remains available; the autonomous facet describes an operator-owned always-on deployment, not automatic authority over every tool.

State

The gateway manages sessions, tools, events and channel connections; the scheduler persists jobs. Upstream describes state, memory and credentials on operator hardware. These are current documented contracts, not a trial of every feature on the installed runtime.

Tools

Host filesystem/shell, channel messages and scheduler management provide durable writes. README says main-session tools run on the host unless sandboxing is configured; a self-hosted gateway isn't default tool isolation.

Human control

The operator chooses access, tool policy and sandboxing, reviews run history and investigates no-delivery/failure outcomes. Current docs point to failure notifications and retries but this index doesn't establish their exact policy or guaranteed recovery. One trusted boundary per gateway; don't mix adversarial users under shared credentials.

02 / Operations

Control reality

Useful agents eventually touch something real. This is the operational picture we have, not a promise hidden in a sales page.

Where it runs

Operator-run gateway and local control plane; upstream supports hosted or local model providers. Self-hosting the gateway doesn't make inference local.

Data boundary

Upstream says state, memory and credentials live on your hardware, while prompts go to configured model providers and chat platforms. Optional diagnostics and provider retention need separate review; this isn't an end-to-end no-egress promise.

Identity & permissions

Gateway credentials and channel pairing/allowlists define the trusted boundary. Message-tool access can span conversations/providers by default; configure restrictions explicitly. Shared gateway membership isn't adversarial tenant isolation.

What it can write

host filesystem · shell · channel messages · cron

Surfaces

Self-hosted gateway · Telegram / Discord / Slack / WhatsApp · Control UI · CLI

Export / lock-in

Operator-held state and scheduler run history are documented. Complete portable backup/restore and provider-side deletion weren't assessed in these retained pages; local files alone aren't proof of a tested round trip.

03 / Receipts

Evidence ledger

Here is what this brief is built on. “Documented” means we found a source. “Tested” means this desk actually ran it. Those are different things.

Evidence status

tested

Source set

7 primary sources

Evidence review

2026-10-16

Sources on file

Corrections

2026-10-16 · Withdrew the stale current-runtime stamp and separated parent-retained installed-CLI observation from the uninspected active process and upstream stable v2026.10.3. Release metadata is upstream published_at, not an upgrade performed here. Retained tested only for established desk operations; current scheduler/security capabilities are vendor-documented, not runtime-tested. Clarified host-tool defaults and one-trusted-boundary deployment scope.

Desk notes

What we found

Useful context, not a substitute for the source record above. This is not a desk test unless the evidence status says tested.

Pick when you want to own an always-on gateway and its failures; skip when you need managed hosting or adversarial tenant isolation out of the box.

Scheduler

Persists jobs and wakes the agent

Tool boundary

Main-session tools run on host unless sandboxed

Trust

One trusted operator/team boundary per gateway

Version scope

Upstream v2026.10.3 isn't proof of installed or active-process version

What the vendor says

Current cron/security captures are overview indexes. They support scheduler ownership and trust boundaries, not precise retry/retention guarantees. New upstream capabilities are not runtime-tested; existing operational evidence isn't a release-wide certification.

GitHub

Inspected upstream README, MIT license and stable-release metadata/body. GitHub establishes the upstream release, not this host's installed or running binary; repository popularity wasn't assessed.

Sources fetched 2026-10-16

04 / Change log

Related coverage

The brief tells you what the product is. Payloads track the changes that may alter the decision.