Summary

Adds scripts/validate-config.sh — a config schema validation gate that runs BEFORE any container restart in deploy/hotfix workflows. Prevents container crash loops from invalid config.

KI Gate: Matched KI-047, KI-048, KI-050, KI-052

Changes

scripts/validate-config.sh (NEW)

• Validates JSON/JSON5 syntax (strips comments before parsing)
• Validates gateway section exists (KI-048)
• Validates agents.defaults.model.primary is a non-empty string (KI-050)
• Validates top-level models is not null and has valid provider entries (KI-052, KI-047)
• Exit 0 = PASS, non-zero = FAIL with clear error identifying which check failed
• Made executable (mode 100755)

Workflow Integration (in Piboonsak/Openclaw)

Validation step added BEFORE restart in:

• deploy-openclaw-github-private-secrets.yml — before docker compose restart
• deploy-hotfix-openclaw-github-private-secrets.yml — before docker compose up -d --force-recreate

Step pattern:

- name: Validate config schema before restart
  run: |
    set -euo pipefail
    chmod +x openclaw_github/scripts/validate-config.sh
    openclaw_github/scripts/validate-config.sh openclaw_github/config/openclaw.prod.json5

Acceptance Criteria

• AC-7: Schema validation runs BEFORE restart
• AC-8: Catches models=null, missing gateway, missing agents.defaults.model
• Exit 0 = valid, non-zero = invalid with clear error message

Usage

# Manual validation before deploy:
./scripts/validate-config.sh config/openclaw.prod.json5

# Expected output on valid config:
# PASS [syntax]: JSON/JSON5 syntax is valid
# PASS [gateway]: gateway section exists
# PASS [agents.defaults.model]: model.primary = anthropic/claude-sonnet-4-6
# INFO [models]: no top-level models key (OK)
# PASS: All config validation checks passed. Safe to restart container.

Refs Piboonsak/Openclaw#202

Sprint: 2.5 D4