OpenClaw's Bash predicate repair has not reached a published channel

What this changes for operators

• POSIX Gateway owners relying on exec allowlists: restrict adversarial shell work and host exposure until a published version contains this repair. Enforce any interim predicate restriction outside the affected classifier, with whole-process containment and narrowly scoped credentials where untrusted work must continue.
• Watch for a containing stable tag, then run harmless substitution and case-variant refusal tests through the real approval chain. Tag ancestry plus recorded refusals would settle delivery and deployed enforcement; the maintainer’s production-chain probe was not reproduced here.
• The separately released final-hook-argument binding does not repair this shell classifier. Review effort cannot protect a request that the classifier never sends for approval; containment and release tracking now consume the attention that a narrow allowlist was meant to save.