perf(openclaw): avoid repeated auto-pair work after validated pre-warm #9023

Problem Statement

The launch-readiness lease from #8942 can skip repeated lifecycle recovery, readiness polling, and inference repair. An accepted OpenClaw launch still runs the complete connect-time auto-pair approval pass.

connect --probe-only already runs that pass during pre-warm. A later launch repeats an in-sandbox openclaw devices list operation even when the pairing state did not change.

In a portable Linux acceptance run, three accepted-lease launches reached the TUI in 10.10–10.51 seconds. A process trace attributed about 4.5 seconds to the repeated auto-pair path. The readiness-lease validation used about 0.35 seconds.

The repeated check exists for a security reason. It can approve an allowlisted scope request that appears after pre-warm. A performance change must not trust old evidence without checking current OpenClaw pairing state.

Desired Behavior

Let an accepted readiness lease skip the complete OpenClaw auto-pair pass when current pairing evidence proves that the pass is unnecessary.

• connect --probe-only must settle the existing allowlisted OpenClaw pairing flow before it publishes pairing evidence.
• The evidence must be credential-free and bound to the accepted launch-readiness lease, sandbox identity, owning gateway, OpenClaw version, and exact device identity.
• The evidence must record the required allowlisted roles and scopes. It must not contain a device token.
• A warm launch must perform a bounded lightweight check of current paired and pending state without starting the complete openclaw devices list path.
• Launch may skip the complete pass only when the current state matches the evidence and no relevant pending request exists.
• Missing, malformed, unsafe, stale, or mismatched evidence must run the existing complete auto-pair pass.
• A changed device, scope set, OpenClaw version, gateway, sandbox lifecycle identity, or readiness-lease epoch must run the existing complete pass.
• A late allowlisted scope request must not be hidden by cached evidence.
• Pairing observation failure must preserve the current fail-safe behavior. It must not convert a failed launch into success.
• This optimization applies only to OpenClaw. Hermes and other supported agents must keep their existing session setup.

The readiness lease must remain agent-neutral. OpenClaw-specific pairing evidence can extend its agent-specific session qualification.

Constraints and Non-goals

• Do not add a user-controlled skip flag.
• Do not change the approved pairing allowlist or grant new scopes.
• Do not write OpenClaw pairing state from a new host-side implementation.
• Do not store device tokens, gateway tokens, or other credentials in readiness evidence.
• Do not remove the complete auto-pair path or its fallback behavior.
• Do not change non-OpenClaw launch behavior.
• Do not use a timing threshold as a CI pass condition.

Acceptance Evidence

Deterministic tests

• Probe-only settles an allowlisted pending request before it publishes pairing evidence.
• A valid readiness lease and unchanged paired/pending state skip the complete auto-pair pass.
• Two launches within one lease remain fast and do not renew the fixed lease lifetime.
• /exit does not invalidate otherwise-current pairing evidence.
• A new relevant pending request runs the complete pass and approves only the existing allowlisted scopes.
• Changed paired state, device identity, required scopes, OpenClaw version, gateway, lifecycle identity, or lease epoch runs the complete pass.
• Missing, malformed, unsafe, or unreadable pairing state runs the complete pass.
• Evidence contains no credential value.
• Concurrent pre-warm, pairing change, and launch cannot accept stale evidence.
• Hermes and one other non-OpenClaw launch path remain unchanged.

Live end-to-end evidence

• Run connect --probe-only, then launch OpenClaw twice.
• Each launch must receive an exact real chat reply, accept /exit, and return status 0.
• Capture separate durations for lease validation, pairing qualification, remaining session setup, OpenShell attach, and TUI readiness.
• Prove that the unchanged-state launch does not invoke the complete auto-pair command path.
• Introduce an allowlisted pending scope request and prove the next launch uses the complete pass.
• Report the before-and-after launch-to-TUI measurements without a timing-sensitive assertion.

Related Work

• perf(cli): add a safe pre-warm-to-launch fast path #8942 defines the agent-neutral pre-warm-to-launch contract.
• perf(cli): add secure launch readiness leases #8951 implements the launch-readiness lease.
• fix(onboard): persist fresh sandbox lifecycle identity #9013 restores the fresh sandbox identity required for lease publication.
• [Ubuntu 24.04][Onboard][GitHub Issue #4504] openclaw agent after fresh onboard silently falls to embedded mode — scope upgrade pending approval (regression from NVB#6041401) #4504 and Cron job creation by agent does not work on DGX Spark #4616 document why the connect-time auto-pair pass remains a defense-in-depth operation.

Category

Performance improvement

Checklist

• I searched open and closed issues and found no duplicate
• I described the security fallback and observable acceptance evidence