Bug Report: Discord SecretRef-backed bot tokens fail to resolve at runtime despite healthy secrets subsystem

OpenClaw version: 2026.5.3-1 (2eae30e) Last known good version: 2026.5.2 Date of incident: 2026-05-05 (immediately after upgrade to 2026.5.3) Channel: Discord Symptom: All Discord bot accounts show tokenStatus: "configured_unavailable" and lastError: "not configured"; replacing SecretRefs with literal tokens immediately fixes the issue.

Symptom

After upgrading from OpenClaw 2026.5.2 to 2026.5.3 and restarting the gateway on 2026-05-05, none of the six configured Discord bot accounts came online. The same SecretRef configuration worked correctly on 2026.5.2. openclaw channels status --probe reported every account as configured but stopped, with token:config (unavailable) and error:not configured. Telegram bots on the same gateway started normally. The only recovery was replacing SecretRef objects in channels.discord.accounts.*.token with literal token strings and restarting the gateway.

Environment

• OS: macOS (x86_64)
• OpenClaw version: 2026.5.3-1 (2eae30e)
• Gateway mode: local/loopback (ws://127.0.0.1:18789)
• Affected agents: vladislava, mikhail, milena, nadia, sofia, viktor (all Discord accounts)
• Unaffected agents: All Telegram bots (use tokenFile mechanism, not SecretRefs)
• Secrets provider: filemain pointing to ~/.openclaw/secrets.json (valid JSON, readable, contains all tokens)

Observed Behavior

1. Gateway boots and loads the discord plugin successfully.
2. Gateway reports starting channels and sidecars... but Discord accounts never initialize.
3. openclaw channels status --probe shows:

   - Discord default: enabled, configured, secret unavailable in this command path, stopped, disconnected, token:config (unavailable), health:not-running, error:not configured
   - Discord mikhail: enabled, configured, secret unavailable in this command path, stopped, disconnected, token:config (unavailable), health:not-running, error:not configured
   ... (repeats for all 6 accounts)

4. openclaw secrets reload reports Secrets reloaded. but does not change Discord status.
5. Replacing each {"source": "file", "provider": "filemain", "id": "/channels/discord/accounts/<account>/token"} with the literal token string and restarting the gateway causes all Discord bots to come online immediately.

Log Evidence

Gateway boot showing plugin loaded but no Discord provider startups (contrast with Telegram which starts immediately):

2026-05-05T08:32:03.208+08:00 [gateway] http server listening (6 plugins: acpx, active-memory, codex, discord, memory-core, telegram; 8.2s)
2026-05-05T08:32:03.306+08:00 [gateway] starting channels and sidecars...
2026-05-05T08:32:04.269+08:00 [gateway] ready
2026-05-05T08:32:06.006+08:00 [telegram] [milena] starting provider (@dlpc_milena_bot)
2026-05-05T08:32:06.173+08:00 [telegram] [viktor] starting provider (@dlpc_viktor_bot)
... (all Telegram accounts start; no Discord entries follow)

Note: In an earlier boot on the same day (06:33), Discord SecretRefs did resolve and bots initialized. The failing boot at 08:32 followed the weekly update that installed 2026.5.3. A config reload event at 08:31:19 evaluated plugins.allow (which was previously absent and remained absent after the reload), after which the gateway restarted and Discord SecretRefs no longer resolved.

Root Cause Analysis

The Discord channel plugin is loaded and channels.discord is fully configured, but the runtime cannot resolve the file-source SecretRefs for Discord bot tokens. This appears to be a gap in the channel initialization path rather than a general secrets system failure, because:

• secrets.providers.filemain is correctly configured.
• ~/.openclaw/secrets.json exists, is valid JSON, and contains all expected keys.
• openclaw secrets reload completes without error.
• Other SecretRef consumers (if any) may still work; Telegram is unaffected because it uses tokenFile, not SecretRefs.

Upgrade correlation: The issue manifested immediately after upgrading from 2026.5.2 to 2026.5.3. The prior version (2026.5.2) ran the same SecretRef configuration without issue. This suggests a regression in the 2026.5.3 release affecting Discord channel initialization or SecretRef resolution order.

This matches a known fragile area in the codebase. CHANGELOG references multiple prior fixes for Discord SecretRef resolution:

• #76987 — Discord: resolve SecretRef-backed bot tokens from the active runtime snapshot
• #76371 — Channels/secrets: resolve SecretRef-backed channel credentials through external plugin secret contracts after the plugin split
• #74737 — Channels/Discord: keep read-only accessors from resolving SecretRef-backed bot tokens

The fact that repeated secrets.reload calls do not recover the channel suggests the resolution failure happens during Discord-specific startup/initialization, not during the secrets snapshot refresh itself.

Reproduction Steps

1. Configure channels.discord.accounts.<name>.token as a SecretRef:

   {
     "source": "file",
     "provider": "filemain",
     "id": "/channels/discord/accounts/<name>/token"
   }

2. Ensure secrets.providers.filemain points to a readable JSON file containing the matching key.
3. Ensure plugins.entries.discord.enabled is true.
4. Start (or restart) the gateway.
5. Observe that openclaw channels status --probe shows Discord accounts as configured but error:not configured.
6. Run openclaw secrets reload — note that it reports success but Discord status does not change.
7. Replace SecretRef with literal token string, restart gateway — observe Discord bots connect.

Fix Applied

Replaced all six Discord account token SecretRefs with literal token strings in channels.discord.accounts.*.token. After gateway restart, all Discord bots connected successfully.

This is a workaround, not a root-cause fix. The SecretRef mechanism should work.

Related Source Paths

• src/channels/discord/ (Discord channel provider initialization)
• src/gateway/secrets.ts or equivalent (runtime snapshot resolution)
• src/channels/channel-manager.ts (channel startup ordering relative to secrets snapshot)

Attachments

• /Users/mike/.openclaw/logs/gateway.log (contains boot timeline and absence of Discord initialization)
• /Users/mike/.openclaw/logs/config-audit.jsonl (contains config reload event at 08:31:19)

Redactions applied:

• All Discord bot tokens replaced with <REDACTED_TOKEN>
• All Telegram bot tokens replaced with <REDACTED_TOKEN>
• Discord user IDs, guild IDs, channel IDs replaced with opaque placeholders
• Gateway auth token replaced with <REDACTED>