Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

On 2026.5.22, the documented/expected openai/gpt-5.5 + Pi runtime + openai-codex OAuth setup is not usable end-to-end, while the legacy openai-codex/gpt-5.5 workaround logs repeated encrypted-reasoning retry warnings.

Steps to reproduce

1. Start OpenClaw 2026.5.22 (a374c3a) on macOS with a Codex OAuth profile stored under provider openai-codex.
2. Configure the canonical model with Pi runtime and Codex OAuth order, using a redacted shape like:

{
  "agents": {
    "defaults": {
      "model": { "primary": "openai/gpt-5.5" },
      "models": {
        "openai/gpt-5.5": { "agentRuntime": { "id": "pi" } }
      }
    }
  },
  "auth": {
    "order": { "openai": ["openai-codex:[email protected]"] },
    "profiles": {
      "openai-codex:[email protected]": {
        "provider": "openai-codex",
        "mode": "oauth"
      }
    }
  }
}

3. In a fresh session, try to manually pin the profile with /model openai/gpt-5.5@openai-codex:[email protected].
4. As a workaround, switch the configured primary model to openai-codex/gpt-5.5 with agentRuntime.id: "pi" and run normal agent turns.
5. Tail gateway logs while the legacy workaround handles GPT-5.5 turns.

Expected behavior

Using openai/gpt-5.5 with agentRuntime.id: "pi" should be able to select/use the configured openai-codex OAuth profile without requiring OPENAI_API_KEY or switching to the Codex runtime. Normal GPT-5.5 turns should not need a failed encrypted-reasoning attempt before retrying.

Actual behavior

The manual profile pin path rejects the Codex OAuth profile for the canonical model, with the user-visible error: Auth profile "openai-codex:[email protected]" is for openai-codex, not openai.

Using auth.order.openai: ["openai-codex:[email protected]"] did not preserve the desired Pi + Codex OAuth route for openai/gpt-5.5 in this setup. The practical workaround is openai-codex/gpt-5.5 plus agentRuntime.id: "pi".

That workaround runs, but gateway logs repeatedly show: [responses] retrying without encrypted reasoning content provider=openai-codex api=openai-codex-responses model=gpt-5.5.

OpenClaw version

2026.5.22 (a374c3a)

Operating system

macOS 26.5 (25F71), arm64

Install method

local source checkout, gateway launched from dist via LaunchAgent (node ~/clawdbot/dist/index.js gateway)

Model

openai/gpt-5.5 intended route; openai-codex/gpt-5.5 legacy workaround

Provider / routing chain

OpenClaw gateway -> Pi runtime -> OpenAI GPT-5.5 with Codex OAuth profile (legacy workaround uses openai-codex-responses transport)

Additional provider/model setup details

Redacted relevant config shape:

{
  "agents": {
    "defaults": {
      "model": {
        "primary": "openai-codex/gpt-5.5",
        "fallbacks": ["openai-codex/gpt-5.4", "..."]
      },
      "models": {
        "openai/gpt-5.5": {
          "agentRuntime": { "id": "pi" }
        },
        "openai-codex/gpt-5.5": {
          "alias": "gpt",
          "params": { "thinking": "low" },
          "agentRuntime": { "id": "pi" }
        }
      }
    }
  },
  "auth": {
    "order": {
      "openai": ["openai-codex:[email protected]"]
    },
    "profiles": {
      "openai-codex:[email protected]": {
        "provider": "openai-codex",
        "mode": "oauth"
      }
    }
  }
}

openclaw models status shows both openai/gpt-5.5 and openai-codex/gpt-5.5 configured/available, but the OAuth profile is under provider openai-codex.

Logs, screenshots, and evidence

Redacted command/evidence excerpts:


OpenClaw 2026.5.22 (a374c3a)
Default: openai-codex/gpt-5.5
Configured models include: openai/gpt-5.5, openai-codex/gpt-5.5
openai-codex effective=profiles:... | profiles=1 (oauth=1, token=0, api_key=0)


User-visible profile pin error:


/model openai/gpt-5.5@openai-codex:[email protected]
Auth profile "openai-codex:[email protected]" is for openai-codex, not openai.


Gateway warning samples from the legacy workaround:


2026-05-26T17:05:00.162-04:00 [openai-transport] [responses] retrying without encrypted reasoning content provider=openai-codex api=openai-codex-responses model=gpt-5.5
2026-05-26T17:05:04.088-04:00 [openai-transport] [responses] retrying without encrypted reasoning content provider=openai-codex api=openai-codex-responses model=gpt-5.5
2026-05-26T19:25:05.906-04:00 [openai-transport] [responses] retrying without encrypted reasoning content provider=openai-codex api=openai-codex-responses model=gpt-5.5

Impact and severity

Affected: users trying to run GPT-5.5 through Pi runtime with Codex OAuth, without OPENAI_API_KEY and without Codex runtime.

Severity: medium/high. The intended route cannot be selected cleanly, and the available workaround adds noisy repeated retries.

Frequency: profile/provider mismatch was observed on the manual pin path; encrypted-reasoning retry warnings recur repeatedly during normal legacy-workaround turns.

Consequence: users are pushed onto the legacy openai-codex/gpt-5.5 route or unwanted auth/runtime paths, with avoidable latency/noise and unclear supported configuration.

Additional information

This may be one product bug with two related symptoms:

1. The documented/expected canonical openai/gpt-5.5 route cannot use an openai-codex OAuth profile through the user-facing /model ...@profile validator.
2. The legacy workaround route (openai-codex/gpt-5.5) works but repeatedly retries after stripping encrypted reasoning content.

If the canonical route is not meant to accept openai-codex OAuth profiles, the docs/config guidance and validator should probably make the supported Pi + Codex OAuth shape explicit.