Provider key in a workspace `.env`? Move it before agents run.

OpenClaw's environment docs now draw a useful trust boundary: workspace `.env` files are lower-trust and provider credentials loaded only from there are ignored. That is good hardening, but it can look like a broken model route if you do not know where the Gateway process actually reads keys. Treat the fix as both reliability and security work: move provider keys into a trusted OpenClaw env/secret source, remove plaintext residue from agent-readable files, then prove one tiny provider call before unattended work resumes.

In simple words: Make a safe copy if the step could change your setup, try the smallest check, then confirm OpenClaw is back to normal before doing more. The source link and commands stay below for people who want the technical detail.

# Run from the OpenClaw workspace/config areas you control.
# Inspect matches manually; do not paste secret values into tickets or agent prompts.
find . -maxdepth 4 -type f \( -name '.env*' -o -name 'openclaw.json' -o -name 'auth-profiles.json' -o -name '*models.json' \) -print

- Provider / model route being fixed:
- Old key location, if any:
- New trusted source (`~/.openclaw/.env`, state `.env`, config `env`, shell-env, or SecretRef):
- Plaintext residue checked: yes/no
- `openclaw doctor` result:
- Tiny provider smoke result:
- Rotation or rollback decision: