Summary

This PR implements the read-side normalization layer proposed in #70823: plugins.slots.memory and plugins.slots.contextEngine can now be read as either a bare plugin id string or an object-form ownership record with an owner field.

What problem does this PR solve?

• Today, OpenClaw slot ownership is represented only as a bare string such as plugins.slots.memory = "memory-core".
• That makes ownership checks brittle: every runtime, doctor, validation, install/update, and plugin trust path has to assume the raw slot value is a string.
• It also blocks the next step in RFC: machine-readable memory-slot ownership — plugins.slots.<slot>.owner #70823: recording slot ownership provenance without breaking existing configs.

What changes?

• Adds PluginSlotOwnerRecord and PluginSlotValue config types.
• Extends the config schema so plugins.slots.memory and plugins.slots.contextEngine accept either "plugin-id" or { "owner": "plugin-id", ...metadata }.
• Adds resolvePluginSlotOwner(value) as the shared read-side helper for slot owner normalization.
• Updates slot consumers across config normalization, validation, stale config scanning, doctor repair paths, startup plugin preloading, active runtime/status paths, context-engine resolution, memory dreaming, provider auth alias/env-var trust, uninstall cleanup, and plugin ID migration.
• Preserves object-form metadata when plugin ID migration changes only the owner field.
• Updates docs and focused regression coverage for object-form slot values.

What is intentionally out of scope?

• No write-side canonicalization. OpenClaw does not start writing { owner, claimed_at, claimed_by_version } records in this PR.
• No overwrite invariant or --force behavior. Silent overwrite prevention remains a follow-up to RFC: machine-readable memory-slot ownership — plugins.slots.<slot>.owner #70823.
• No new slot keys. This PR only covers the existing memory and contextEngine slots.
• No direct implementation of the memory role-slot architecture from feat(memory): add multi-slot memory role architecture #86210.

Intended outcome:

• Existing configs keep working unchanged.
• New object-form slot records are accepted everywhere relevant on read.
• Later PRs can extend this groundwork instead of reimplementing slot-owner parsing in each surface.

Linked context

Closes #70823.

Directly related work:

• feat(memory): add multi-slot memory role architecture #86210: adds the multi-slot memory role architecture requested by Multi-Slot Memory Architecture #60572. This PR intentionally lands the smaller owner-record primitive first, or can be rebased after feat(memory): add multi-slot memory role architecture #86210 by extending the same helper/schema pattern across the new memory role slots.
• feat: add per-agent compaction overrides (AI-assisted) #83637: adds per-agent compaction/context-pruning overrides. This PR is complementary because it only changes global plugin-slot value shape and keeps context-engine/compaction semantics separate.
• Multi-Slot Memory Architecture #60572: user demand for composable memory slots. This PR is supporting groundwork for Multi-Slot Memory Architecture #60572 by creating the owner-normalization primitive that the role-slot architecture can reuse.

Supporting related PRs and issues:

• feat(plugins): support multi-kind plugins for dual slot ownership #57507: prior multi-kind plugin work showed that one plugin may legitimately participate in multiple exclusive plugin categories.
• fix(plugins): preserve contextEngine slot through config normalization #64192: context-engine slot normalization precedent.
• fix(plugins): scope install slot selection #75640: plugin install slot-selection scope precedent.
• [AI-assisted] fix(update): clear stale plugin refs after failed updates #81512 and fix(cli): report stale plugin doctor config #81515: stale plugin reference cleanup and doctor/reporting precedent for slot references.
• fix(config): warn for missing official memory slot #82438: memory-slot warning precedent.
• fix(memory-lancedb): expose public memory artifacts #85060: memory provider parity proof pattern for active memory plugin behavior.
• Fix plugin packaging recovery hints #86591: current external-PR body/proof structure used as a template for ClawSweeper-friendly real behavior proof.

Problem / Root Cause

Before this change, slot readers commonly assumed plugins.slots.<slot> was a string. That assumption is exactly what #70823 needs to retire.

The problem is not just schema shape. If only the schema accepts object-form records, but runtime paths keep reading raw values directly, then object-form configs fail in subtle places:

• startup preloading may skip the selected plugin;
• doctor and stale-config scans may miss or misreport owners;
• context-engine resolution may fall back to legacy;
• memory status/tool-disable paths may misread none;
• provider auth alias/env-var trust may ignore a selected workspace context engine;
• plugin update can collapse or lose ownership metadata.

This PR makes the read-side contract real by routing those consumers through one shared helper.

What Changed

• src/config/types.plugins.ts

  • Adds PluginSlotOwnerRecord.
  • Adds PluginSlotValue = string | PluginSlotOwnerRecord.
  • Applies the value type to plugins.slots.memory and plugins.slots.contextEngine.

• src/config/zod-schema.ts

  • Accepts string slot values and object values with required owner.
  • Allows additional object fields so future provenance fields can be carried without another schema turn.

• src/plugins/slots.ts

  • Adds resolvePluginSlotOwner(value).
  • Normalizes strings and object-form owners to one scalar owner id.
  • Treats blank values as unset and none as the slot-disabled sentinel.
  • Uses the helper in exclusive slot switching so existing object-form ownership is recognized.

• Runtime/config consumers now normalize slot owners before comparison:

  • config normalization
  • config validation
  • stale plugin config detection
  • doctor route and context-engine compatibility checks
  • gateway startup plugin id selection
  • context-engine resolution
  • memory dreaming config resolution
  • memory status and tool-disable logic
  • provider auth alias/env-var workspace trust checks
  • uninstall cleanup
  • plugin update ID migration

• Documentation now states that slot values may be string ids or { owner: "<plugin-id>" } records.

Merge-Order Compatibility

This PR is deliberately a groundwork PR, not a competing architecture.

If this lands before #86210:

• feat(memory): add multi-slot memory role architecture #86210 should extend PluginSlotsConfig/schema with memory.recall, memory.compaction, memory.capture, memory.dreaming, and memory.userModel using the same PluginSlotValue shape.
• feat(memory): add multi-slot memory role architecture #86210 should use resolvePluginSlotOwner() at new role-slot read sites instead of adding new local normalization.
• Expected rebase work should be ordinary schema/docs/test conflicts, not a design rewrite.

If #86210 lands before this:

• This branch should rebase by applying the object-form slot value support to the new memory role keys as well as existing memory and contextEngine.
• The core helper remains valid; it just gets called from more role-slot consumers.

If #83637 lands before or after this:

• The two changes should stay complementary.
• feat: add per-agent compaction overrides (AI-assisted) #83637 controls which agent scope supplies compaction/context-pruning settings.
• This PR controls how global plugin-slot owners are represented and normalized on read.
• Later compaction/context-engine work should consume normalized contextEngine ownership where it reads that slot, without changing per-agent compaction semantics.

Follow-up intended after this PR:

• Write-side canonicalization to produce object-form owner records.
• Slot overwrite invariants and explicit force/override behavior.
• Plugin-side adoption of the normalized owner abstraction.

Real behavior proof

• Behavior or issue addressed: object-form plugins.slots.memory and plugins.slots.contextEngine records should behave the same as bare string slot owners across config parsing, validation, doctor checks, startup planning, runtime memory/context-engine resolution, provider auth trust checks, plugin lifecycle cleanup, and plugin ID migration.
• Current PR head: b87f4a710c6de665bffcc6c58245d9950a021926 (feat(plugins): accept slot owner records), a final single-commit squash on top of fork main at 26913e60a42e84dd256a682c5239be57f346e244.
• Proof note: The detailed proof below was collected before the final rebase/squash at 27585fb987df8d6c68886566a6280e755a507456. The final squash preserves the intended branch content as one commit, but exact-head proof has not yet been rerun for b87f4a710c6de665bffcc6c58245d9950a021926.
• Real environment tested for proof refresh: Dev-01 source checkout at /home/kklouzal/.openclaw/workspace/repos/openclaw; branch feat/plugin-slot-owner-records; proof head 27585fb987df8d6c68886566a6280e755a507456; local Node/Vitest/OpenClaw repo toolchain.
• Exact steps or command run for that proof refresh:

npx vitest run src/plugins/config-state.test.ts src/plugins/slots.test.ts src/config/config-misc.test.ts src/config/config.plugin-validation.test.ts src/agents/provider-auth-aliases.test.ts src/commands/doctor/shared/context-engine-host-compat.test.ts src/commands/status.scan.shared.test.ts src/context-engine/context-engine.test.ts src/gateway/tools-invoke-shared.test.ts src/memory-host-sdk/dreaming.test.ts src/secrets/provider-env-vars.dynamic.test.ts
npx vitest run src/plugins/update.test.ts
node --import tsx scripts/generate-config-doc-baseline.ts --check
node --import tsx scripts/generate-base-config-schema.ts --check
npx oxfmt --check <touched files>
git diff --check
node scripts/run-tsgo.mjs -p tsconfig.core.json

• Evidence after fix:

Test Files 11 passed (11)
Tests 301 passed (301)

Test Files 1 passed (1)
Tests 80 passed (80)

OK docs/.generated/config-baseline.sha256
[base-config-schema] ok

All matched files use the correct format.
git diff --check passed
tsgo core check exitCode=0

• Observed result after fix: object-form slot owners are accepted by schema, normalize to the same owner ids as string slots, preserve none behavior, participate in context-engine and memory runtime resolution, validate missing plugin references correctly, trust selected workspace context-engine plugins for provider auth only when the normalized owner matches, reset/update selected slots during uninstall/update, and preserve extra object metadata when plugin ID migration only changes owner.
• What was not tested: live production gateway behavior, write-side object canonicalization, overwrite enforcement, or future feat(memory): add multi-slot memory role architecture #86210 memory role slots. Those are out of scope for this read-side normalization PR.
• Proof limitations or environment constraints: this is a config/runtime parsing and normalization groundwork PR, so the proof is focused local deterministic execution rather than a live model/channel proof. No production config, gateway restart, external provider account, or live plugin registry state was mutated.
• Before evidence: RFC: machine-readable memory-slot ownership — plugins.slots.<slot>.owner #70823 documents the pre-change limitation: slot ownership was only machine-readable through direct string comparison, leaving no durable place for ownership provenance and forcing each consumer/plugin to repeat brittle raw-slot checks.

Tests and validation

Commands run:

npx vitest run src/plugins/config-state.test.ts src/plugins/slots.test.ts src/config/config-misc.test.ts src/config/config.plugin-validation.test.ts src/agents/provider-auth-aliases.test.ts src/commands/doctor/shared/context-engine-host-compat.test.ts src/commands/status.scan.shared.test.ts src/context-engine/context-engine.test.ts src/gateway/tools-invoke-shared.test.ts src/memory-host-sdk/dreaming.test.ts src/secrets/provider-env-vars.dynamic.test.ts
npx vitest run src/plugins/update.test.ts
node --import tsx scripts/generate-config-doc-baseline.ts --check
node --import tsx scripts/generate-base-config-schema.ts --check
npx oxfmt --check --threads=1 <touched files>
git diff --check
node scripts/run-tsgo.mjs -p tsconfig.core.json

Regression coverage added or updated:

• Slot normalization for string owners, object owners, blank values, and none.
• Config schema acceptance for object-form memory and contextEngine.
• Config validation diagnostics for missing plugin references inside object-form slot owners.
• Exclusive slot selection when the previous owner is object-form.
• Context-engine resolution for object-form contextEngine.
• Doctor host compatibility and route-warning paths with object-form context-engine owners.
• Memory status/tool-disable/dreaming paths with object-form memory.
• Provider auth alias/env-var trust checks for selected workspace context engines represented as owner records.
• Plugin update migration preserving object-form metadata while changing the owner.

Compatibility and Risk

Backward compatibility:

• Existing string slot configs remain valid.
• Existing "none" memory-slot behavior remains valid.
• Existing default behavior remains unchanged: memory defaults to memory-core; context engine defaults to legacy.
• Existing write paths that still write strings remain valid.

Compatibility changes reviewers should inspect:

• Config schema now accepts object records for existing slot values.
• Consumers that previously compared raw slot strings now compare normalized owners.
• Plugin update migration now preserves object-form slot metadata where possible.

Primary risks:

• A direct raw-slot read could remain somewhere outside the audited surfaces.
• A future feat(memory): add multi-slot memory role architecture #86210 rebase could add new role-slot read sites that need the same helper.
• Accepting passthrough metadata on slot records is intentionally forward-compatible, but reviewers may want to confirm the object shape is the right minimum for RFC: machine-readable memory-slot ownership — plugins.slots.<slot>.owner #70823.

Risk mitigation:

• The branch adds one shared resolver rather than multiple ad hoc conversions.
• Focused tests cover schema, normalization, runtime consumers, doctor paths, provider auth trust, status/tool behavior, and lifecycle migration.
• This PR avoids write-side canonicalization/enforcement, keeping the blast radius to read compatibility.

Current Branch State

• Base branch: main
• Current PR head: b87f4a710c6de665bffcc6c58245d9950a021926
• Commit: feat(plugins): accept slot owner records
• Branch shape: one squashed commit over fork main at 26913e60a42e84dd256a682c5239be57f346e244.
• Local final-shape checks before PR creation:
  • git diff --stat origin/main...fork/feat/plugin-slot-owner-records: 33 files changed, 450 insertions, 75 deletions.
  • git rev-list --left-right --count origin/main...fork/feat/plugin-slot-owner-records: 1 1 because the branch is based on the pinned green fork-main commit one commit behind upstream.
  • Branch verified as one squashed commit over fork/main.
  • Anchored conflict-marker scan clean.
  • git diff --check origin/main...fork/feat/plugin-slot-owner-records: passed.