OpenClaw 2026.5.7 doctor --fix does not recover openai/gpt-5.5 agent chains to openai-codex/gpt-5.5 under Codex OAuth-only auth

Summary

OpenClaw 2026.5.7 release notes say the Doctor/Codex OAuth fix should "preserve working openai-codex/* PI routes during doctor --fix and recover 2026.5.5-rewritten openai/* GPT-5 routes when only Codex OAuth auth is available" (fix for #78407).

On this host, doctor --fix --yes --non-interactive did not recover agent chains that appear to match that failure mode.

Environment

• OpenClaw version: 2026.5.7 (eeef486)
• Host auth state: Codex OAuth is configured and working for openai-codex/gpt-5.5; no direct OpenAI API key is configured for openai/gpt-5.5.
• Working control route: agent trent uses openai-codex/gpt-5.5, fallbacks=[], agentRuntime=null and runs successfully.
• Broken/rewrite suspect routes: multiple agents still reference openai/gpt-5.5 as primary or fallback.

Reproduction / Evidence

Before test, snapshot query:

jq '[.agents.list[] | select(.model.primary == "openai/gpt-5.5" or (.model.fallbacks[]? == "openai/gpt-5.5")) | {id, primary: .model.primary, fallbacks: .model.fallbacks}]' ~/.openclaw/openclaw.json

Result count: 24 agent chains referencing openai/gpt-5.5.

Sandbox/copy-state test:

TEST_ROOT=/home/openclawops/.openclaw/workspace/Sandboxed/openclaw-5.7-doctor-fix-test-20260508T142503Z
mkdir -p "$TEST_ROOT/state/cron" "$TEST_ROOT/workspace"
cp -a ~/.openclaw/openclaw.json "$TEST_ROOT/state/openclaw.json"
cp -a ~/.openclaw/secrets.json "$TEST_ROOT/state/secrets.json"
cp -a ~/.openclaw/.env "$TEST_ROOT/state/.env"
cp -a ~/.openclaw/cron/jobs.json "$TEST_ROOT/state/cron/jobs.json"
cp -a ~/.openclaw/cron/jobs-state.json "$TEST_ROOT/state/cron/jobs-state.json"

OPENCLAW_STATE_DIR="$TEST_ROOT/state" \
OPENCLAW_HOME="$TEST_ROOT/state" \
OPENCLAW_WORKSPACE_DIR="$TEST_ROOT/workspace" \
HOME=/home/openclawops \
openclaw doctor --fix --yes --non-interactive

After test, same snapshot query against copied state still returned count 24.

There was gateway/SecretRef health noise during the copied-state doctor run:

Health check failed: GatewaySecretRefUnavailableError: gateway.auth.token is configured as a secret reference but is unavailable in this command path.
Fix: set OPENCLAW_GATEWAY_TOKEN/OPENCLAW_GATEWAY_PASSWORD, pass explicit --token/--password,
or run a gateway command path that resolves secret references before credential selection.

Doctor still completed and did not rewrite the affected agent chains.

Expected behavior

Given only Codex OAuth is available and direct OpenAI API key auth is absent, doctor --fix should detect openai/gpt-5.5 references that cannot authenticate and recover them to the equivalent openai-codex/gpt-5.5 route, or at minimum report a clear warning/action item listing the unrecovered chains.

Actual behavior

• Pre-count of openai/gpt-5.5 references: 24
• Post-count after doctor --fix: 24
• No auto-recovery occurred for the copied state.
• In live operations, agents using openai/gpt-5.5 fallback fail with missing direct OpenAI API-key auth even though Codex OAuth works for openai-codex/gpt-5.5.

Example failure mode from an active Dev/Sec dept-head agent before local repair:

FallbackSummaryError: All models failed (2): ollama/kimi-k2.6: session file locked ... | openai/gpt-5.5: No API key found for provider "openai". Auth store: .../agents/evelyn-cross/agent/auth-profiles.json

Why this matters

This appears to be the exact class that #78407 / 2026.5.7 was meant to repair, but our config shape may be outside the current repair predicate.

Fleet impact on this host before local active-agent repair:

• 1 agent on working openai-codex/gpt-5.5 (Trent)
• 24 agent chains referencing broken openai/gpt-5.5 primary/fallback
• Active Dev/Sec fallback lanes failed when they reached the direct OpenAI provider path

Local mitigation

We manually repaired only six active Dev/Sec agents with bare native config commands, changing them to:

• primary: openai-codex/gpt-5.5
• fallbacks: []
• agentRuntime: unset/null where applicable

Dormant agents were intentionally left unchanged pending upstream guidance.

Request

Please clarify or extend the 2026.5.7 doctor repair predicate so it catches this shape, or emit an actionable doctor warning that lists unrecovered openai/gpt-5.5 chains when only Codex OAuth auth is available.