feat(kiloclaw): bump openclaw to version 2026.3.28

[kilo-code-bot]

Summary

Bumps the pinned OpenClaw version in kiloclaw/Dockerfile from 2026.3.13 to 2026.3.28 for reproducible builds.

Verification

• Dockerfile change is a single-line version pin update; no logic changes.
• Pre-push hooks passed: format check, lint, and typecheck all green.

Visual Changes

N/A

Reviewer Notes

Release notes reviewed for potential deployment impact. The following changes from the 2026.3.28 release warrant attention:

Breaking changes:

• qwen-portal-auth OAuth removed: The deprecated Qwen Portal OAuth integration has been removed. This only affects users who were still using portal.qwen.ai OAuth auth — they must migrate to Model Studio with an API key. If any KiloClaw deployments rely on this auth path, they will break.

• Config/Doctor drops automatic migrations older than two months: Very old legacy config keys will now fail validation instead of being silently rewritten by openclaw doctor. If any KiloClaw machines have configs last migrated more than two months ago (e.g. from stale volumes that haven't been started in a while), they may fail to start until manually updated.

Notable behavior changes:

• ACP agent registry tightened: Unknown ACP agent IDs no longer fall through to raw --agent command execution on the MCP-proxy path. If any custom ACP agents are invoked by ID and not registered in the updated ACPX built-in mirror, they will stop working.

• Bundled plugin paths rewritten by Doctor: Doctor now rewrites stale bundled plugin load paths from legacy extensions/* locations to the packaged path. This is generally safe but worth noting on first-boot after upgrade.

• Rate-limit cooldown scoping changed: Cooldowns are now per-model instead of per-auth-profile. The escalation ladder has also changed from exponential (1 min → 1 h) to stepped (30 s / 1 min / 5 min). This is an improvement but changes observable retry behavior.

[kilo-code-bot]

WARNING: This OpenClaw bump can strand dormant KiloClaw instances with stale configs

KiloClaw runs openclaw doctor --fix --non-interactive on every boot once /root/.openclaw/openclaw.json exists (kiloclaw/controller/src/bootstrap.ts:387), and the manual repair path does the same (kiloclaw/src/durable-objects/kiloclaw-instance/pairing.ts:409). The PR notes that 2026.3.28 no longer auto-migrates config keys older than two months, so existing volumes that have been idle for a while can fail to start immediately after this image rollout. This needs either a compatibility/recovery path or a rollout plan that migrates stale configs before bumping the pinned version.

[kilo-code-bot]

Code Review Summary

Status: 1 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Fix these issues in Kilo Cloud

Issue Details (click to expand)

CRITICAL

File	Line	Issue
kiloclaw/Dockerfile	45	Upgrading to OpenClaw 2026.3.28 introduces a documented doctor/config migration break for stale installs, but KiloClaw still runs openclaw doctor --fix --non-interactive on existing volumes during boot.

Other Observations (not in diff)

N/A

Files Reviewed (1 files)

• kiloclaw/Dockerfile - 1 issue

---

_{Reviewed by gpt-5.4-20260305 · 228,079 tokens}