gateway-auto-rollback

# Gateway Auto-Rollback

**Three-layer configuration protection for OpenClaw Gateway** — never break your config again.

## What It Does

Automatically protects your OpenClaw configuration files with:

1. **Pre-modification backup** — SHA256 content-addressed snapshots before any change
2. **Post-modification validation** — JSON syntax check + Gateway health probe
3. **Automatic rollback** — instant restore if validation fails

## When to Use

- Before modifying `openclaw.json`, `exec-approvals.json`, or `skills.json`
- When running automated config changes (cron jobs, scripts)
- As a background safety net during development
- When you want peace of mind that a bad config won't take down your agent

## Quick Start

### One-shot check (before manual edits)

```bash
python3 gateway-auto-rollback.py
```

This initializes the backup directory, validates current config, and logs status.

### Watch mode (background daemon)

```bash
python3 gateway-auto-rollback.py --watch &
```

Monitors critical config files every 3 minutes. Auto-exits after 3 consecutive healthy checks (config is stable).

## How It Works

```
Before Modification        During              After Modification
       ↓                    ↓                        ↓
  Backup + Hash  ───→  Execute Change  ───→  JSON Validate + Health Check
       │                                          │
       └──────────────────────────────────────→ Auto-rollback on failure
```

### Protected Files

| File | Description |
|------|-------------|
| `openclaw.json` | Main Gateway configuration |
| `exec-approvals.json` | Command execution approvals |
| `skills.json` | Skills registry |

### Backup Naming

Backups are stored in `~/.openclaw/backup/` with content-addressed names:

```
openclaw.json.20260301_053612.a1b2c3d4.bak
                 ↑ timestamp    ↑ SHA256 prefix (dedup)
```

## API Reference

### Python Functions

```python
from gateway_auto_rollback import (
    pre_modification_check,   # Call before modifying...