An Upgrade Review Diffs the Defaults Not the API

# An Upgrade Review Diffs the Defaults Not the API ## Claim For software that acts on its own, the risk in a release lives in which behaviors became on-by-default, and neither the announcement nor a breakage-focused upgrade check will surface that.  ## Scope & conditions - Holds for agents, automation runtimes, and anything with autonomous background behavior — systems where "what does it do when I'm not asking" is a real question. For a library, API breakage is the right diff; for an agent, it is the wrong one to stop at. - Default changes are invisible to the two checks upgrade intake normally runs: CVE scan and "does my config still load." A default that expands autonomy passes both. - The announcement post is structurally the wrong artifact. Its audience is new users and its job is warmth; the release notes are written for operators. When they disagree about what matters, the notes win. - Every changed default should be read as a consent question that was answered for you. Documented off switches do not change that; they make the answer reversible, not absent. - Weakens where a project's announcement discipline already lists default changes inline, or where the runtime has no autonomous behavior to default on. ## Evidence OpenClaw v2026.8.1 ("OpenClaw 2.0," 2026-08-30) shipped with a 731-word announcement and roughly 125 KB of release notes. The headline claim checks out — over 16,000 PRs against 30,789 ever merged is 52%, matching "roughly 50%." The post mentions "security" once, in a list. The notes contain two changes labeled "(breaking)" — the OpenProse removal and the `codex/*` → `openai/*` route migration, both requiring `openclaw doctor --fix` — and a plugin SDK deprecation gate dated 2026-09-01, two days after the post. None appear in the announcement, which instead reassures readers the team took extra time so as not to "hand them an update that broke what they already had." Care taken is not disclosure. The substantive omission is the defaults. Counting "by default" in the notes returns eight entries; six expand autonomy: background memory consolidation into long-term memory ("grounded dreaming"), automatic application of scanner-approved self-generated skills, Skill Workshop apply/reject/quarantine without an extra prompt, private conversation recall on personal installs without DM isolation, sessions persisting across day boundaries, and concurrency scaled to 8–16 simultaneous runs. All have off switches. A reader who took the post at face value would not know to look for any of them. The inverse omission proves the point from the other side: the same notes carry masked credential prompts, provenance warnings requiring `--force` for arbitrary plugin sources, host-bound egress for a shared credential store, and the sentence that team operator roles "are collaboration controls, not hostile-tenant isolation." The release is more security-conscious than its announcement — which is exactly why the announcement is not the document to review. ## Links - [[3. Resources/Permanent Notes/Default-On AI Activation Inflates Adoption Metrics at the Cost of Consent]] — extends: that note names the vendor incentive to default on; this one names the operator's blind spot — the intake process that never asks which defaults moved. - [[3. Resources/Permanent Notes/Low-Trust-By-Default UX Absorbs Agent Mistakes]] — contrasts: this release moves the other direction on six axes, and does so in a version that also adds real safety engineering. Trust posture and security engineering can diverge inside one release. - [[3. Resources/Permanent Notes/Choice Becomes Instruction Only With a Named Default]] — extends: a default is an instruction the operator did not write. Changing one is changing the operator's instructions without telling them. - [[3. Resources/Permanent Notes/AI-Generated Code Creates Maintainers Who Cannot Audit Their Own Breaking-Change Exposure]] — parallels: both describe an audit gap in upgrade intake; that one is about the maintainer's side, this one about the consumer's. - [[3. Resources/Permanent Notes/A Thin Product-Announcement Rewrite Still Carries a Checkable Source]] — applies-in: the checkable source here is the release notes, and the checking turned up more than the post did. - [[3. Resources/MOCs/AI Agent Safety MOC]] — home: the governance ask is a policy on which categories of agent self-modification require explicit opt-in regardless of vendor default, plus "changed defaults that expand autonomy" as a reviewable category in dependency intake. - [[3. Resources/Permanent Notes/A Self-Referential Analysis Is Admissible for Structure Not Truth]] — companion practical guidance: when a same-maker analyzer can't verify a vendor's capability claims directly, diffing the concrete, observable defaults is one of the few checks that survives the conflict ## Tests / falsifiers - Pull the last five releases of three agent runtimes and count default changes disclosed in the announcement versus the notes. If announcements routinely carry them, OpenClaw is an outlier and the claim is about one project's habit, not a structural gap. - Run a standard dependency-upgrade checklist (CVE scan, config load, test suite) against this exact upgrade and record whether any step flags any of the six defaults. The claim predicts zero. - Watch the OpenClaw issue tracker for the month after release for reports that trace to a changed default the reporter did not know had changed. Absence of such reports would weaken the operational significance even if the disclosure gap is real. ## Maintenance - Last tended: 2026-09-01