fix(kiloclaw) smoke prod parity

services/kiloclaw/DEVELOPMENT.md

@@ -591,7 +591,7 @@ Then run one of:
     no token -> `401`, correct proxy token -> pass-through.
   - Use this when changing proxy token logic or route/auth ordering.
 - `bash scripts/tests/smoke-live-provider.sh`
-  - Runs the packaged image against the real Kilo Gateway with `kilocode/kilo-auto/free`, verifying `openclaw config validate --json`, Control UI proxying, packaged Kilo Chat loading, and one live agent turn.
+  - Runs the packaged image against the real Kilo Gateway with a paid route (`kilocode/kilo-auto/balanced` by default; free routes are rejected), verifying `openclaw config validate --json`, Control UI proxying, packaged Kilo Chat loading, and one live agent turn per leg. In `--upgrade` mode the candidate is asserted both on the baseline's persisted root and on a fresh root.
   - Reads `KILOCODE_API_KEY` from the environment, or falls back locally to the active `kilocodeToken` and matching organization scope in `~/.kilocode/cli/config.json`. The credential is passed to the temporary container as an environment variable; the script does not print it or dump potentially sensitive controller logs on startup failure.
   - Publishes the temporary controller only on loopback and generates a random controller/proxy token unless `TOKEN` is explicitly set.
   - Uses a generated non-sensitive nonce prompt because Auto Free can route to upstream providers that log prompts.

services/kiloclaw/scripts/tests/README.md

@@ -11,7 +11,7 @@ Validate an OpenClaw version bump before merging the bump PR.
 **Run this one:**
 
 ```bash
-export KILOCODE_API_KEY=<dedicated free-model key>   # for the live smoke; from app.kilo.ai/profile
+export KILOCODE_API_KEY=<key on an account with credits>   # for the live smoke; from app.kilo.ai/profile
 export KILOCODE_ORGANIZATION_ID=<org id>             # REQUIRED if the key is a personal key in an org
 bash services/kiloclaw/scripts/tests/openclaw-upgrade-validate.sh
 ```

services/kiloclaw/scripts/tests/openclaw-upgrade-image-checks.sh

@@ -433,17 +433,18 @@ This run covered only the checks that need NO Kilo API key. Before merge,
 run the credentialed live smoke locally too (it loads a real key into the
 freshly released OpenClaw, which is why nothing here runs in CI):
 
-  export KILOCODE_API_KEY=<dedicated free-model key>   # not your personal key
+  export KILOCODE_API_KEY=<key on an account with credits>   # not your personal key
   export KILOCODE_ORGANIZATION_ID=<org id>             # required to spend ORG credits
   bash services/kiloclaw/scripts/tests/openclaw-upgrade-smoke.sh
 
 That covers what CI cannot without a credential:
   - persisted-root upgrade boot (baseline -> candidate on the same /root)
+  - the candidate on a FRESH root too (the shape a new signup gets)
   - gateway readiness + proxied Control UI
   - kilo-chat plugin load, diagnostics, and webhook route
   - app config-write routes (/_kilo/config/patch, agent-defaults, agents CRUD)
   - exec-approvals seeding
-  - a real Auto Free agent turn through the live Kilo Gateway
+  - a real agent turn on a paid route through the live Kilo Gateway
 ----------------------------------------------------------------------
 EOF
 

services/kiloclaw/scripts/tests/openclaw-upgrade-validate.sh

@@ -12,8 +12,9 @@ set -uo pipefail
 #
 #   Phase 2  credentialed live smoke — builds the before/after images, performs
 #            the persisted-root upgrade (boots baseline, then candidate on the
-#            same /root), and runs every assertion incl. a real Auto Free gateway
-#            turn. Needs a dedicated free-model Kilo API key.
+#            same /root), then asserts the candidate BOTH as an upgraded instance
+#            and on a fresh root, each with a real gateway turn on a paid route.
+#            Needs a Kilo API key on an account with credits.
 #
 # OpenClaw is never built or run in CI (it is a security-sensitive upstream), so
 # this is the gate a human runs locally before marking the bump PR ready.
@@ -150,7 +151,7 @@ elif [ "$IS_BUMP" -eq 1 ]; then
   echo "  • Phase 2 — credentialed live smoke: WILL BE SKIPPED (no Kilo API key is set)"
   echo
   echo "Phase 2 (the live smoke) is half the coverage and needs a Kilo API key."
-  echo "For the full validation, set a dedicated free-model key and re-run:"
+  echo "For the full validation, set a key on an account WITH CREDITS and re-run:"
   echo "    export KILOCODE_API_KEY=<key>   # from https://app.kilo.ai/profile (bottom)"
   echo "    export KILOCODE_ORGANIZATION_ID=<org id>   # REQUIRED to spend ORG credits;"
   echo "                                               # a personal token alone spends only"