OpenClaw Signals: Merge Queue Telemetry, Sandbox Escape Vectors, and the Backpressure Breakthrough

Tools

Merge Queue Telemetry Tracks Pipeline Health Across Teams

This PR instruments the merge queue with per-team latency and failure metrics. If you're running a large shared OpenClaw cluster, you can now pinpoint which teams are bottlenecking the pipeline and optimize accordingly.

Backpressure-Aware Task Scheduler Prevents Queue Saturation

This PR introduces a token-bucket mechanism that throttles task submission when downstream consumers are saturated. No more silent task drops or OOM kills during traffic spikes.

Plugin Manifest Schema v3 Adds Dependency Locking

The new manifest schema version supports pinning plugin dependencies to exact versions with integrity checksums. This closes a long-standing gap where plugins could silently drift across deploys.

News

Sandbox Escape Vector Reported in Plugin Runtime

A researcher disclosed a path traversal bug in the plugin sandbox that allows filesystem access outside the container boundary. The team has acknowledged it and a fix is in progress. If you're running untrusted plugins in production, patch immediately.