OpenClaw 2.0 said the gateway is the trust domain. The graph is the security docs.

OpenClaw is the local-agent project people actually installed. Discord, WhatsApp, iMessage, a gateway on your machine, a model that can run tools. In late August the 2.0 line (v2026.8.1) made the threat model explicit: credentials and permission modes, sandbox and approvals off by default, one gateway = one trust domain. Tenant isolation, if you need it, is separate Gateway cells, not a switch in the product.

That is the news. Decrypt and VentureBeat covered it. The docs are at docs.openclaw.ai/security. It is not what Helix indexed.

Helix does not time-travel to a release blog. It indexes the latest merged pull requests. On 2 Sep 2026, Helix indexed 44 PRs on openclaw/openclaw.

The graph in this window is the security docs and install-policy scan, not the runtime sandbox. The other ~40 PRs are the firehose around it.

What Helix showed

Verified fact (this window). 44 PRs. 564 files. 555 ownership gaps. 8 coupled pairs. 21 people. 139 directories. Pulse: 98% of files have one author.

The files that keep shipping together are not the runtime sandbox. They are the gateway security docs and the install-policy scan:

• docs/gateway/security/index.md with docs/tools/plugin.md
• docs/gateway/security/index.md with docs/tools/skills-config.md
• docs/gateway/security/index.md with install-policy-warning
• docs/gateway/security/index.md with install-security-scan

Helix counted 2 shared PRs on each of those pairs.

Overview silos on those docs: jesse-merhi is the only evidenced author.

The PRs that are that cluster:

• #116489 feat(security) install-policy acknowledgement (64 files, jesse-merhi)
• #120900 feat(ui) review install policy warnings

Meanwhile the person Pulse ranks as the expert is not jesse-merhi. It is steipete: score 57, 19 authored / 0 reviewed / 172 files. Hottest Pulse file is a validation script (scripts/validate-authorized-beta-focused-evidence.mts, 867 line changes).

src/gateway is the #2 churn area (19 files / 1767). Two gateway code fixes did land: #126424 conversation delivery within agent bindings, #135517 continuation admission.

Not in this index: sandbox, shrinkwrap, tenant, isolation, trust-as-a-node, and the two GitHub security PRs from the same cycle (#136090 delegated-authority, #136019 MCP Allow Always). Do not read this graph as “Helix found the 2.0 CVE.” There wasn’t a new CVE that week. Helix found the docs and install-policy surface moving, with almost every file in the window single-author.

How to read that without overclaiming

Helix inference. In this window, the change center Helix named is documentation of the gateway security model plus the install-policy warning/scan UI, not a sandbox rewrite.

Hypothesis (not a graph finding). That is a plausible in-window echo of the 2.0 permission story: the product already decided “one gateway, one trust domain, sandbox off unless you turn it on.” The PRs Helix saw are the repo teaching that to installers and plugin authors, while steipete’s 172 files are the UI/firehose around it.

The evidence does not prove OpenClaw is unsafe, that jesse-merhi is a bus factor for the whole project, or that 2.0 “failed.” It does show a 98% single-author window, a docs pair that keeps shipping together, and a split: one person on the security-docs silos, another on the expertise score.

The lesson

When a viral agent project announces a trust model, the interesting question is not “did they ship a blog.” It is: which files in the repo are actually carrying that model.

For OpenClaw, the public story is the gateway as the trust domain. In the last 44 merged PRs Helix could see, the files that keep moving together are docs/gateway/security and the install-policy scan, and Helix can name who authored them.

That is the kind of thing you cannot get from the README. It is also the kind of thing you want before you point an always-on agent at your files.

What would Helix find in your software?

Connect GitHub. Let your last few dozen merges explain themselves, including the ones that never made the launch post.

Request a walkthrough.