Summary

sessions_spawn fails with missing scope: operator.write on OpenClaw 2026.6.11, in a setup that works correctly on 2026.6.1. This is a confirmed regression, not a longstanding issue — same deployment, same config, only the OpenClaw version differs.

This has the same symptom as #77807, but that issue was reported on 2026.5.4/2026.5.6 and doesn't establish when/why it regressed relative to a known-working version. This issue adds a bisection to the exact introducing commit.

Environment

• Working: OpenClaw 2026.6.1, production deployment
• Broken: OpenClaw 2026.6.11 (current "Latest" release), staging deployment, same config
• OS: Linux x64 (GCE VM)
• Gateway: local Gateway, bind: lan, token auth (auth.mode: "token")
• Trigger: Google Chat channel, main agent session, sessions_spawn tool available and allow-listed for the target role

Steps to reproduce

1. Run OpenClaw with a local Gateway, token auth, googlechat channel enabled.
2. From a Google Chat DM, ask the main agent to delegate a task to another configured agent role (triggers the sessions_spawn tool with role: "<other-agent>").
3. On 2026.6.1: subagent spawns and completes normally.
4. On 2026.6.11: spawn fails immediately with:

{
  "status": "error",
  "error": "missing scope: operator.write",
  "childSessionKey": "agent:<role>:subagent:<uuid>",
  "runId": "<uuid>",
  "role": "<role>"
}

Root cause (bisected)

Diffed src/gateway/call.ts between v2026.6.1 and v2026.6.11. shouldOmitDeviceIdentityForGatewayCall changed:

- const hasSharedAuth = Boolean(params.token || params.password);
+ const hasDirectLocalBackendAuth =
+   Boolean(params.token || params.password) || params.allowAuthNone === true;
  return (
    mode === GATEWAY_CLIENT_MODES.BACKEND &&
    clientName === GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT &&
-   hasSharedAuth &&
+   hasDirectLocalBackendAuth &&
    isLoopbackGatewayUrl(params.url)
  );

The new || params.allowAuthNone === true branch, combined with the new requireLocalBackendSharedAuth / allowAuthNone plumbing added at the call site, widens the conditions under which device identity (and therefore the resolved operator scopes) is omitted for internal loopback Gateway calls — matching the mechanism described in #85716 as the cause of #77807.

This was introduced in commit e085fa1a3ffd32d0ea6917e1e6fb4ecbffbb77d2 ("ci(release): stabilize anthropic live smoke selection"), dated 2026-06-29 19:00:39 -0700 — less than 24 hours before the v2026.6.11 stable tag (2026-06-30). No pull request is linked to this commit via the GitHub API, which made it hard to find from the issue tracker alone.

Related issues / PRs

• [Bug]: sessions_spawn fails with missing scope operator.write despite full-scope operator token #77807 — same missing scope: operator.write on sessions_spawn, reported on 2026.5.4/2026.5.6 (predates this regression's introducing commit — likely a related but distinct occurrence of the same general fragility in this code path)
• [Bug]: clearUnboundScopes strips operator scopes unconditionally for non-local token-auth clients #51396 — clearUnboundScopes strips operator scopes unconditionally for non-local token-auth clients (regression, security review needed)
• fix(agents,gateway): three subagent announce delivery failures in loopback token-auth setups #85716 — open PR fixing the device-identity omission for explicitly-scoped subagent calls; addresses this class of bug but was still under review (narrowing in progress) as of 2026-06-28, one day before the introducing commit here landed

Impact

Any deployment using the Google Chat (or similar loopback/local-backend) channel to trigger sessions_spawn-based multi-agent delegation breaks on upgrade to 2026.6.11, with no config-level workaround — allowAgents/tool policy on the caller are correctly configured and are not the issue.

Expected behavior

sessions_spawn from a Google-Chat-triggered main-agent session should succeed as it does on 2026.6.1, preserving the operator device identity (and therefore operator.write scope) for calls that explicitly request operator scopes.