OpenClaw March-to-April Arc: Managed Hosting Trade-offs, Task Flow Substrate, and the ClawHub Security Reckoning

Analysis

Every March 2026 OpenClaw Release Summarized: v4.0 Architecture Rewrite Through v4.2 ACP

A managed-hosting vendor walks through the full v4.0-4.2 arc including the gateway daemon split, ClawHub marketplace launch, nine CVEs, and ACP inter-agent messaging in one readable brief. The upgrade math section is blunt: expect 1-3 hours of debugging minimum if you are self-hosting across this range.

Production Operator Notes on 3.31: Exec Obfuscation Patching and What Actually Broke in Multi-Agent Setups

A self-hoster running Opus plus GPT sub-agents on bare metal documents exactly how the obfuscation detection overrides ask:off even after you fix exec defaults, and provides a patch script targeting three locations in the distributed JavaScript. The detail on hardcoded MAX_COMMAND_CHARS and the dual gateway/node exec code paths is the most actionable breakdown available on this specific issue.

Release Notes

OpenClaw 4.2 Official Release Notes: Task Flow Substrate, Plugin Config Migrations, and Android Assistant

The canonical 4.2 changelog details two breaking plugin config migrations for xAI search and Firecrawl web fetch, plus the restored Task Flow control plane with managed child task spawning and sticky cancel intent. The new beforeagentreply plugin hook is a quiet but significant addition that lets plugins short-circuit the LLM with synthetic replies after inline actions.

OpenClaw 3.28 Release Notes: xAI Responses API, Async Plugin Approval Hooks, and Background Task Foundation

The 3.28 changelog is where the background task ledger and async requireApproval hooks first appear, making it the foundation release for everything that followed in 3.31 and 4.2. The ACP channel binds for Discord, BlueBubbles, and iMessage also land here, enabling Codex-backed workspaces without child thread creation.

OpenClaw v2026.3.31 Beta: Full Changelog Including Six Breaking Changes and SQLite Task Ledger

The primary source for the 3.31 beta includes the complete list of breaking changes, the unified task control plane details, and every security fix in one place. If you are auditing what changed between 3.28 and 4.0, start here.

Security

ClawHub Malware Problem: 1,184 Malicious Skills Found in the First Week of the Marketplace

The managed hosting writeup surfaces the ClawHub security finding as a standalone concern worth calling out: crypto stealers, prompt injection payloads, and data exfiltration tools were indexed within the first week of launch. The vetting process could not keep pace with submission volume, which matters if you are pulling community skills in any automated way.