openclaw - 💡(How to fix) Fix Feature request: Approval gate for restart-required config changes

Problem

When a restart-required config field (e.g. plugins.allow) is modified via direct file write (not the config.patch API), the gateway auto-detects the change and executes a restart without any human approval gate.

This is a problem in environments where:

• The config file is synced via Dropbox/iCloud/etc. and external changes can arrive unexpectedly
• Operational protocols require human approval before any gateway restart (e.g., in multi-agent production environments)

What happened

A Dropbox sync modified plugins.allow in ~/.openclaw/openclaw.json. The gateway detected the restart-required config change and auto-executed a restart — 5-minute drain timeout → SIGUSR1 → full restart. No API actor was logged (because it wasn't an API call), and no approval was requested.

This caused ~6 minutes of downtime and 4 failed message deliveries during an active conversation.

Proposed solution

Add a restartApproval config option (or similar) that, when enabled:

1. Detects restart-required config changes as it does today
2. Instead of auto-restarting, queues the restart and notifies the configured admin (via Slack/webhook/etc.)
3. Waits for explicit approval (e.g., a CLI command like openclaw gateway approve-restart or an API call) before executing the restart

Alternative (lighter touch)

A restartPolicy field with options:

• auto (current behavior — restart immediately)
• notify (restart, but send a notification first with a configurable delay)
• manual (queue the restart, require explicit approval)

Environment

• OpenClaw 2026.4.15
• macOS (LaunchAgent service)
• Config synced via Dropbox