Completes P4 migration: Nexus API no longer reads openclaw.json.
Changes:
- AgentService: default path -> agents-sanitized.json
- OpenClawGatewayClient: LoadAgentIdsFromConfig + GetAvailableModels
both now read from agents-sanitized.json
- compose.yaml: mount agents-sanitized.json instead of openclaw.json
The deploy script (.gitea/scripts/deploy-nexus.sh) already generates
agents-sanitized.json during deployment, extracting only the
section (list + defaults) without gateway/auth/password secrets.
DoD:
- No read access to openclaw.json from Nexus API container
- No uid-1654 ACL dependency for agent identity resolution
- No secrets in agent responses or config files
developer
17dc84082c