openclaw - 💡(How to fix) Fix [Bug]: cron payload.model 'openai/gpt-5.4' (and 'openai/gpt-5.4-mini') rejected by allowlist when agentRuntime.id=codex is set — regression since v2026.5.12

Summary

Since upgrading to v2026.5.12, isolated cron jobs that specify payload.model: "openai/gpt-5.4" or payload.model: "openai/gpt-5.4-mini" are rejected by the preflight allowlist check, even though both models are explicitly configured in agents.defaults.models.

This is the same class of bug as #76267 (claude-cli/ models rejected) but affects openai/ models that have agentRuntime.id: "codex" in their config entry.

Reproduction

Config (agents.defaults.models):

{
  "openai/gpt-5.4": {
    "params": { "transport": "auto" },
    "agentRuntime": { "id": "codex" }
  },
  "openai/gpt-5.4-mini": {
    "agentRuntime": { "id": "codex" }
  }
}

Cron job payload:

{
  "kind": "agentTurn",
  "model": "openai/gpt-5.4-mini",
  "message": "...",
  "timeoutSeconds": 3600
}

Failure on fire:

cron payload.model 'openai/gpt-5.4-mini' rejected by agents.defaults.models allowlist: openai/gpt-5.4-mini

cron payload.model 'openai/gpt-5.4' rejected by agents.defaults.models allowlist: openai/gpt-5.4

Key observation

The error message itself lists the rejected model (openai/gpt-5.4-mini) — which is the same string as the configured allowlist key. The model is in the allowlist but the preflight check still rejects it.

This started failing after the 2026.5.12 upgrade (specifically after PR #82328 merged on 2026-05-15).

Suspected root cause

Same underlying issue as #76267: resolveCronModelSelection calls resolveAllowedModelRef against cfgWithAgentDefaults, and there appears to be a mismatch between how openai/gpt-5.4-mini is resolved when building the allowed set vs. when checking the cron payload model. The agentRuntime.id: "codex" config entry may cause the allowlist key to be stored under a different normalized form (openai-codex/gpt-5.4-mini) while the incoming payload is checked as-is (openai/gpt-5.4-mini).

See also openAIProviderUsesCodexRuntimeByDefault in openai-codex-routing — this returns true for openai/ providers without a custom base URL, which may affect how the model key is built in the allowlist.

Workaround

Change cron payload.model from openai/gpt-5.4-mini → openai-codex/gpt-5.4-mini (explicit Codex routing) and add openai-codex/gpt-5.4-mini to agents.defaults.models. Jobs resume normally.

Expected behavior

openai/gpt-5.4-mini configured in agents.defaults.models (with or without agentRuntime) should be accepted as a valid payload.model in isolated cron jobs.

Environment

• OpenClaw: v2026.5.12
• Working on: v2026.5.2 (last verified working)
• OS: macOS arm64
• Auth: Claude Max (Anthropic) + OpenAI API

Related

• #76267 — same bug class for claude-cli/ models