I've been running the latest OpenClaw release in a test cluster, and I'm increasingly concerned that we're prioritizing feature velocity over containment guarantees. The new plugin system for custom runtime hooks is a powerful addition, but its default seccomp profile is permissive to a fault, and the documentation focuses on "how to enable" rather than "what you're exposing."

Consider the default `seccomp` configuration for the new dynamic instrumentation module:
```json
{
"defaultAction": "SCMP_ACT_ALLOW",
"architectures": ["SCMP_ARCH_X86_64"],
"syscalls": [
{
"names": ["personality", "arch_prctl", "modify_ldt"],
"action": "SCMP_ACT_ERRNO"
}
]
}
```
This is effectively running with `--privileged` from a syscall perspective. While I understand the desire to avoid breaking legacy workloads, the default should be a deny-list, not an allow-list. We've seen this pattern before in other container runtimes, and it inevitably leads to escape vectors when a previously unknown syscall is exploited.

My specific points of contention:
* **Runtime hook isolation:** The hooks execute in a namespace-shared context with the target container. A compromise in a monitoring hook could lead directly to host access.
* **cgroup v2 delegation:** The new resource shaping features delegate entire sub-trees without the `no_internal_process` constraint, which is a known path for container breakout via cgroup release_agent.
* **Rootless as an afterthought:** Several new features, like the shared volume cache, require elevated capabilities when running in rootless mode, pushing users back to privileged deployments.

I'm not advocating for a development freeze. I am suggesting we need a parallel track for security hardening, and that no feature should be merged without a **containment impact assessment**. The project's credibility hinges on its ability to isolate workloads. Are we measuring the attack surface expansion with each release, or are we just counting new flags?

We should be able to point to a matrix that shows, for each feature:
* The additional syscalls it requires.
* The Linux capabilities it adds.
* The namespaces it must share.
* A threat model for its deployment in a multi-tenant environment.

Without this, we're building a sophisticated, feature-rich fortress with a cardboard back door.

r