Environment

• macOS 15.3.1 (arm64, Mac mini — no Touch ID, no companion app)
• OpenClaw 2026.2.19-2

Description

After every openclaw gateway restart, exec calls from the agent return Approval required for anywhere between 2.5 and 18 minutes, even though:

• exec-approvals.json has security=full, ask=off, askFallback=full
• openclaw approvals get --gateway confirms the gateway loaded the correct config (security=full, ask=off)
• The exec calls do eventually resolve successfully (they're not permanently blocked)

Steps to Reproduce

1. Set ~/.openclaw/exec-approvals.json with security=full, ask=off, askFallback=full for both defaults and all agents
2. Run openclaw gateway restart
3. Immediately attempt an exec call from the agent
4. Observe: returns Approval required (id ...) and sits pending for several minutes
5. Eventually resolves with Exec finished system event

What I Tried

• Set tools.exec.host=gateway, security=full, ask=off in openclaw.json — no change
• Explicitly passing host=gateway in exec tool calls — same delay
• openclaw approvals get --gateway shows correct config is loaded
• No companion app / macOS app installed (Mac mini without Touch ID)

Expected Behavior

With security=full and ask=off, exec should work immediately after gateway restart with no approval prompts or delays.

Actual Behavior

3–18 minute delay before exec calls resolve. Delay is inconsistent across restarts. During this window, all exec calls queue as Approval required and eventually complete — none are permanently denied.

Notes

The exec-approvals.sock file is never created (no companion app), which may be related. askFallback=full was added specifically to handle the no-UI case.