🦞🧹 ClawSweeper

!ClawSweeper banner

ClawSweeper is the conservative review bot for OpenClaw repositories. It keeps the backlog reviewed, keeps maintainer-visible GitHub comments tidy, and applies unchanged, high-confidence close proposals through deterministic safety gates.

The dashboard Worker's explicit production targets are openclaw/openclaw, openclaw/clawhub, openclaw/clawsweeper, and openclaw/fs-safe. Additional public openclaw/ and steipete/ repositories can use configured profiles or conservative generic fallback review through event dispatch and scheduled fanout.

Project vision and boundaries: VISION.md

Documentation by task and audience: docs/README.md

Contributing

For local setup, PR scope, main-body proof, and the author-owned review loop, read CONTRIBUTING.md before opening or updating a pull request. Use the documentation index to reach architecture, configuration, dashboard, policy, and operator references without scanning this entire README. The contributing guide explains when to use @clawsweeper re-review, why a changed head or PR body needs fresh evidence, and why readiness is not merge authority.

The OpenClaw-hosted ClawSweeper instance is not a public review service and does not provide free reviews for third-party repositories. If you want ClawSweeper for your own project, fork this repository, deploy it in your own organization, and configure that self-hosted instance for your repositories.

At a high level ClawSweeper:

• reviews open issues and pull requests on a schedule and on exact GitHub events
• writes one durable markdown report per item in generated state
• syncs one marker-backed public review comment per issue or PR, edited in place
• closes only unchanged, high-confidence, policy-allowed proposals
• routes maintainer commands @clawsweeper review, @clawsweeper re-review,

• can acknowledge maintainer comment commands through an optional GitHub App

• can review local branch ranges with repository and GitHub access kept local

• publishes canonical review records to the Cloudflare Worker, action ledgers

The oversized PR close lane proposes closing pull requests above 50,000 changed lines before hydration, scanning, or model review, with a maintainer size: accepted-large exemption. See the close-policy index for the guarded close lanes.

ClawSweeper is not a generic auto-close bot. Review is proposal-only, apply is guarded, Codex never gets write credentials during review, and every GitHub mutation is rechecked against live target state immediately before it happens.

Capabilities

Issue and PR Reviews

Scheduled runs scan open issues and pull requests, while target repositories can forward exact issue/PR events through keyless OIDC Worker intake for low-latency one-item reviews. Each review writes records//items/.md with the decision, evidence, proposed maintainer-facing comment, runtime metadata, and GitHub snapshot hash.

PR checkout preparation captures only the recursive tree's entry types, object IDs, sizes, and truncation flag from the GitHub CLI. This keeps path and URL metadata from exhausting the response buffer while preserving the existing checkout size limits and rejection of incomplete or malformed trees.

Media proof preparation recognizes image/video filename extensions and GitHub attachment URLs, including legacy repository asset links. Attachments are fetched with GET and classified by the response content type; images are saved locally and videos are probed and converted to contact sheets. PR patches and supplemental body excerpts never supply host download URLs.

ClawSweeper syncs one marker-backed public review comment per item and edits it in place instead of posting repeated completed reviews. Scheduled review workers use a separate temporary status comment for lease coordination. Command-triggered exact reviews instead rewrite their existing acknowledgement and use the durable queue claim as their coordination lease, so they do not add a second visible status comment. Exact-review workers verify queue ownership before generation and during finalization. Temporary lease comments are removed after publication. Pull request comments include hidden verdict/action markers for trusted automation ownership. See docs/pr-review-comments.md.

Review prompts include compact related issue and PR context from explicit links, linked closing PRs, existing local ClawSweeper reports, optional gitcrawl clusters, and opt-in live GitHub issue search for exact event reviews. This is advisory context for duplicate/superseded reasoning, not a standalone close decision. Reviews also persist a typed, proposal-only root-cause assessment with same-repository URLs and at most one evidence-backed canonical item; it does not dispatch repair, suppress jobs, mutate siblings, close, or merge. See docs/related-issue-discovery.md.

For open issues with complete, current kept-open reviews, ClawSweeper also projects selected structured review conclusions into advisory GitHub labels for maintainer filtering and project views. These labels expose states such as current-main reproduction, source reproduction, linked open PRs, queueable fixes, verified small bugs suitable for good first issue, missing info, and product/security review needs. They are advisory only and do not trigger repair, merge, or close behavior. Label-only syncs record labels_synced_at in the durable report so GitHub updated_at changes caused by ClawSweeper-owned label writes do not look like fresh target-side activity to the scheduler. See docs/work-lane.md.

Apply and State

Apply mode re-fetches live GitHub state, checks labels, maintainer authorship, paired issue/PR state, snapshot drift, and repository profile rules before commenting or closing anything. Closed or already-closed reports move to records//closed/.md; reopened archived items move back to items/ as stale work.

Apply and artifact replay also maintain Codex-authored decision packet JSON at records//decision-packets/.json for reports that need a maintainer ruling. Codex supplies the exact question, rationale, options, recommendation, and likely owner as structured review output. Deterministic code validates that intent, persists it, refreshes item state, and removes stale packets; labels and report prose do not reconstruct the decision. Pass --decision-packets-dir to write those packet files somewhere other than the profile's default records directory.

Canonical review records live in the Cloudflare Durable Object store and are snapshotted to R2. Immutable ledger/v1/ action events, published assets/, and the bounded content-addressed artifacts/exact-review/v1/ retry cache also live in R2. The state branch of openclaw/clawsweeper-state now retains only jobs/, results/, notifications/, apply-report.json, and repair-apply-report.json; its main branch remains the dashboard renderer source. scripts/hydrate-state.ts combines those sources for local commands. See docs/state-storage.md for the ownership table.

Commit Reviews (retired)

The push/manual commit-review lane was retired in July 2026. Use pnpm local-review for GitHub-isolated local branch reviews.

Operations

Repository-specific rules live in src/repository-profiles.ts, so OpenClaw, ClawHub, and ClawSweeper can share the same engine while keeping different apply limits. Review supports manual workflow dispatch, reruns, and backfills.

Guardrails

ClawSweeper may propose a close only when the item is clearly one of these:

• implemented on current main
• not reproducible on current main
• better suited for ClawHub skill/plugin work than core
• duplicate or superseded by a canonical issue/PR
• low-signal pull request whose branch is mostly unrelated or unmergeable churn
• external low-rated pull request whose requested real-behavior proof never

• external pull request abandoned for 30+ days as a draft, waiting on its

• concrete but not actionable in this source repo
• incoherent enough that no action can be taken
• stale issue older than 60 days with too little data to verify

PR-to-PR duplicate/superseded closes also require a safe canonical target: ClawSweeper refuses to close one PR as replaced by another PR that is closed unmerged, missing positive real behavior proof, F-rated, already proposed for close, not cleanly mergeable, or otherwise not a viable landing path.

Repository profiles can further narrow apply. ClawHub and ClawSweeper self-review are intentionally stricter: they review issues and PRs, but apply may close only PRs where current main already implements the proposed change with source-backed evidence.

Maintainer-authored issues and PRs, and items labeled maintainer, created from 2026-10-15 03:50 UTC are reviewed like everyone else's: a PR gets one automatic review and later reviews need a request; an issue follows the ordinary issue cadence. Older maintainer items stay excluded from automatic reviews and scheduled sweeps, and got one opening/ready reminder explaining how to opt in. Only request @clawsweeper review when a review is needed and the work and validation are complete; agents must not request reviews automatically or repeat requests while one is queued or running. A one-off request does not opt future pushes into reviews, but it stays open until it is answered: if the item changes while it is reviewed, ClawSweeper re-reviews and still answers that request. The retired clawsweeper:autofix and clawsweeper:automerge labels no longer change review admission; they still protect an item from close proposals.

Maintainer Commands

The canonical comment commands are:

@clawsweeper review
@clawsweeper re-review
@clawsweeper explain
@clawsweeper stop

review and re-review request a fresh read-only issue/PR review; explain summarizes the current result, and stop prevents further automatic handling. The router checks repository permissions and the command's current source comment before accepting work. Contributors may request a review of their own items under the configured authorization policy.

The GitHub App webhook durably records eligible review comment versions before acknowledging them. Exact item work is coalesced and leased by the Worker, so a webhook burst does not create capacity-waiting Actions runners. Repair, autofix, automerge, issue implementation, fix-ci, and address-review commands are retired.

Dashboard

Live dashboard and generated state: https://github.com/openclaw/clawsweeper-state

Live pipeline dashboard: https://clawsweeper.openclaw.ai/

The Cloudflare control plane exposes read-only queue, review, publication, and health telemetry. It never delegates GitHub mutations to the browser. See docs/live-dashboard.md.

The optional triage dashboard page at /triage exposes ClawSweeper advisory issue labels as read-only maintainer views, including local routing groups derived from existing impact:* labels. It is backed by GitHub Search snapshots instead of GitHub Project writes. See docs/triage-dashboard.md.

The optional PR proof triage page at /pr-proof-triage exposes open pull requests that are blocked on real behavior proof labels, including missing proof, supplied-but-not-sufficient proof, mock-only proof, and proof label mismatches. See docs/pr-proof-triage-dashboard.md.

The default-off unconfirmed product-direction policy can propose closure for a strictly bounded class of technically correct, well-proven external feature PRs that still lack maintainer-confirmed direction. Live maintainer signals and automation opt-ins veto apply. See docs/product-direction-close-policy.md.

The default-off per-author PR-budget policy gradually trims an external author's oldest lowest-signal PRs only after apply verifies the live repository count, seven-day inactivity, rating/proof eligibility, protected labels, and maintainer engagement. See docs/author-pr-budget-close-policy.md.

How It Works

ClawSweeper has two operational lanes:

• review lane: scheduled and event-driven issue/PR reviews, durable reports, and

• apply lane: guarded close/comment mutations, audit, reconcile, and state

Scheduler

The issue/PR scheduler decides what to scan and how often. New and active items get more attention; older quiet items fall back to a slower cadence. Detailed scheduling, capacity, and monitoring behavior is documented in docs/scheduler.md.

• hot/new and recently active items are checked hourly, with a 5-minute intake

• target repositories can forward issue and PR events through OIDC Worker intake;

• pull requests and issues younger than 30 days are checked daily once they

• older inactive issues are checked weekly
• apply wakes every 15 minutes and exits quickly when there are no unchanged

Review Lane

Review is proposal-only. It never closes items.

• The ClawSweeper Review Plan workflow (review-plan.yml) selects due items

• Manual review runs in review-plan.yml can select item_number or comma-separated

• Each admitted item gets its own review workflow for the selected target.
• Codex reviews use gpt-6.1-sol with medium reasoning in the direct API auth

• Each item becomes a flat report under

• High-confidence allowed close decisions become proposed_close.
• After publish, the lane checks the selected items' single marker-backed Codex

• PR review comments keep the top-level note concise, put source links and full

Apply Lane

Apply reads existing reports and mutates GitHub only when the stored review is still valid.

Reviewer decisions come only from the typed review_record stored in each report. A missing or unreadable record requires a fresh review: apply records skipped_changed_since_review without calling GitHub, and decision packets and public decision renderers do not infer decisions from report prose. The completed backfill command and workflow have been retired.

• Updates the single marker-backed Codex automated review comment in place.
• Closes only unchanged high-confidence proposals.
• Keeps the durable review comment. Applied PR closes also post one idempotent,

• Moves closed or already-closed reports to

• Moves reopened archived reports back to the repo’s items/ folder as stale.
• Commits checkpoints and machine-readable status during long runs.

Apply health keeps the scheduler-admitted apply_ready_count separate from the full promotion backlog, cooldown-eligible probes, proof-required work, guarded retries, and inconsistent records. Its cycle estimate covers work actionable in the current scheduler window rather than presenting every probe as immediately closable.

All review execution uses the exact-item queue; broad runs only feed its planner. The read-only reviewer handles only the selected item, uploads a hash-bound GitHub Actions artifact, enqueues a separate durable publication lease, and then releases its review lease without checking out or pushing the state repository. The queue retries publication independently, so a cancelled publisher does not rerun Codex. The source fallback uses adaptive minimum/base/maximum values of 4/24/48; production overrides them with 8/32/32 and enables direct publication plus up to 8 concurrent size-8 batches, with two isolated preparation workers per batch. The Durable Object validates each artifact's workflow run, queue tuple, target, decision digest, file inventory, sizes, and SHA-256 hashes before a publisher receives write tokens. Publication leases reserve the bounded publisher lane's maximum queue wait; terminal-run reconciliation releases dead dispatches early. The publisher then uses the same review and apply paths with only the immediate-safe reasons enabled by default: implemented_on_main, duplicate_or_superseded, and low_signal_unmergeable_pr. A stale tuple now terminates as superseded instead of retrying, while permanent failures enter a bounded dead-letter store after their confirmation retries. Artifacts remain available for 90 days; three confirmed unavailable-artifact attempts queue one fresh exact review instead of waiting for the retention deadline.

Deterministic terminal and remain-open outcomes flow through the same publisher. Ordinary synced verdicts publish their exact durable comment, then queue an executing target-wide comment-router scan. Exact publishers use the bounded Durable Object lane while batch publishers remain per-target serialized. Exact publishers and the separate issue-implementation backfill workflow retain their guarded intake. Publication still does not claim an atomic state-publish-and-route boundary. stale_insufficient_info issue reports and mostly_implemented_on_main PR reports are never applied to young items; apply requires those reports to be at least 60 days old unless a manual run explicitly changes the threshold. A stale issue also stays open when a non-bot comment was posted in the last 60 days.

The external state dashboard is fleet-scoped. Each configured repository gets its own canonical record collection, status JSON, audit state, cadence counts, and recent activity section, so event runs from one repo do not hide the state of another.

There is still one deterministic apply path for writes. Review can propose and sync stale public review comments, but closing remains guarded by apply so a fresh GitHub snapshot, labels, maintainer-authorship, and unchanged item state are checked immediately before mutation. Maintainer-authored or maintainer-labeled items can still close when the only protected state is maintainer ownership and the close reason is verified implemented_on_main. Configured OpenClaw targets may close issues as implemented_on_main when the fix is proven on current main, even before the next release ships.

Commit Review Lane (retired)

The hosted commit-review lane was retired in July 2026 (zero successful runs in its final month). The local, GitHub-isolated review engine survives as pnpm local-review; see docs/commit-sweeper.md.

Safety Model

Native reviews require host-owned TruffleHog admission before any model-backed checkout inspection or review. The host scans the explicit initial prompt and schema plus complete raw before/after blobs and the full introduced diff. Scan coverage is independent of the 80-path/24K-character display evidence limits. Clean text-converted checkouts retain both canonical Git and raw working bytes in scan coverage. The host never starts a target-bundled autoreview helper or second reviewer.

Hosted Codex and OpenClaw setup share .github/actions/setup-review-tools, which caches only the checksum-pinned release archive. Every setup verifies its bytes, extracts a fresh private binary, checks the exact version, and runs the benign scan before advertising its path. Cache misses and corrupt archives use the pinned download; installed binaries and review data never enter the Actions cache. For local review, ClawSweeper first qualifies a trusted host executable outside both checkouts; when it is absent or reports a different TruffleHog release, it bootstraps the exact checksum-pinned release asset into a user-owned cache outside both checkouts. The local bootstrap accepts no URL or version override, verifies the download and cached executable, and runs a clean environment version check before scanning. Missing tools, unclassified findings, scan errors, source drift, incomplete ancestry/objects, changed gitlinks, and LFS pointers refuse the review. The scan stages at most 256 MiB in private external temporary files and uses the remaining review deadline; it never silently truncates or bypasses. Diagnostics omit scanner output and source values. Restore prerequisites or remove sensitive input before retrying a refusal. Exact-review failure manifests distinguish a native output/scan-contract failure from an unclassified finding. The latter records the first blocking finding's bounded detector metadata and host-staged material identity: prompt, schema, additional input, raw diff, patch, raw working bytes, or Git blob. Source references contain Git revisions and hashed paths, with at most four references and their total count. No raw paths, matched values, literal digests, or verification messages are retained; this provenance does not authorize a finding.

The host classifies the reviewed synthetic malformed-configuration URI in test/action-ledger-runtime.test.ts and the explicitly approved autoreview negative-test URI in the canonical autoreview test or its vendored OpenClaw copy as non-sensitive after a complete scan. OpenClaw's existing completion-webhook warning-redaction fixture qualifies only for FTP detector 899 with the observed PLAIN and HTML decoders. Both native value digests, the complete source file's SHA256, every literal occurrence's complete source line, original path, regular-file mode, committed base/head roles, and native FTP metadata shape must match. Any source-file edit requires requalification, including unrelated changes: HTML decoding can hide another occurrence from plain-text search. FTP patch findings and other decoders remain blocking. See the native before/after proof. The same exact-fixture policy covers the reviewed OpenClaw Browser CDP authentication and credential-redaction fixtures in chrome.test.ts, the remote-CDP coverage, the server-context redaction test, the profile-status redaction fixture, the remote-CDP documentation example, the credentialed-page rejection fixtures, the guarded CDP authentication fixtures, the MCP endpoint-redaction fixture, the Crabbox fleet audit sanitization fixture, the Mac dashboard credentialed-subframe rejection fixture, the Mattermost slash-error sanitization fixtures, the MCP Apps sandbox-origin rejection fixture, the Gateway config CDP-redaction fixture, the mocked marketplace telemetry-redaction fixture, the Signal URL-rejection fixtures in client tests and container tests (including the exact table-driven replacement), and the OpenClaw config URL-redaction and restoration fixtures after a complete scan. Static host policy associates each exact detector-matched URI SHA-256 with only its approved source paths and exact scanner Raw digest, including when Raw omits a path retained by RawV2. The matched value must be a literal in a host-staged Git blob from mode 100644. The three guarded-CDP/MCP entries, Crabbox fixture, Mac dashboard entry, MCP Apps entry, marketplace telemetry entry, Gateway config entry, two Signal entries, and four Mattermost entries also bind complete reviewed source lines, including surrounding query text that TruffleHog's URI detector does not match. Changes to those lines or additional literal occurrences refuse classification. These witnesses do not expand native query detection. The table binds exact values and paths across revisions, not particular commits. The host locates that exact literal independently in the staged blob. Decoder coordinates can shift, and TruffleHog can omit a companion plain-text finding, so admission does not depend on another finding or a reported line matching the original source. Repeated literals remain eligible unless an entry is bound to an approved complete-line digest; those entries require exactly one occurrence in the staged blob. Finding order and duplicate records do not change the exact value, path, and mode checks. Findings must use PLAIN or HTML, except the MCP Apps, marketplace telemetry, and Gateway config entries permit only their observed PLAIN decoder and the two guarded-CDP fixtures also permit BASE64. The pinned Base64 decoder preserves the rest of a chunk after decoding another token, so an unchanged literal can acquire that decoder label and win cross-decoder deduplication. Those entries still require the literal in its exact original source line; encoded-only content remains blocking.

The OpenClaw logging redaction fixtures and the reviewed Crabbox PostgreSQL operations example use a separate flat attribution table without changing the legacy URI policy above. Each row binds the exact detector ID and name, observed native decoder, Raw, RawV2, and complete source-line SHA-256 digests, path, and mode. The logging rows permit only their observed PLAIN, ESCAPED_UNICODE, or HTML variants. HTML is qualified only for the rewritten fixtures from OpenClaw #160879; the pre-rewrite rows remain for merge bases that predate it (proof). The Crabbox documentation row permits only its observed PLAIN or HTML variants. These exact attribution rows are role-neutral; every logical staged reference must independently match the row and have a committed base or head role. URI findings require one literal RawV2 witness unless the row declares an exact ordered sequence of complete source-line digests. A declared sequence must match every occurrence exactly; missing, extra, reordered, or changed lines refuse admission. Derived host, username, and password fields must match native metadata; the host preserves explicit default ports and original spelling, as TruffleHog does. MongoDB and Postgres findings bind the scanner-reported line and their exact native metadata shape. URI findings are attributed to the plain literal wherever it occurs in the blob or patch; a decoded finding is not yet bound to its own source location (#1724). Any emitted subset and order may qualify; duplicate exact findings, unknown variants, lossy decoder buckets, or an unqualified deduplicated blob reference refuse admission.

The same table qualifies the exact embedded-credential rejection fixture in OpenClaw's extensions/matrix/src/matrix/client.test.ts for URI detector 17, only with PLAIN or HTML attribution. Both raw-value digests, the complete source line, path, regular-file mode, and committed base/head references must match. Retained source-only native scans observed PLAIN findings; the original hosted refusal identified HTML for its first finding but did not retain the second finding's details. Constructed HTML regression records are not recovered hosted evidence. Qualification does not waive that unknown finding or replace fresh whole-input admission and a completed review.

The same table qualifies the existing OpenClaw browser URL-port precedence fixtures. The HTTPS input and assertion require their exact two-line sequence; the two loopback fixtures each require one complete source line. Only URI detector 17, PLAIN/HTML, the pinned raw-value identities, regular-file mode, and committed base/head references qualify. The native proof for PR #149651 observed PLAIN findings; HTML is separately covered by constructed classifier records.

The marketplace entries telemetry test uses the same reviewed feed URI twice, in live and snapshot metadata. Its exact attribution binds both complete source lines in order, URI detector 17, observed PLAIN or HTML decoding, regular-file mode, and committed base/head roles. The refresh test keeps its existing legacy approval and repair roles. Policy selection follows the staged source references, including each patch witness, so a shared URI does not transfer changed-line approval or duplicate-record rules between these sources. See the native proof.

Six existing Crabbox scope-normalization and redaction fixtures use the same exact attribution table, limited to their observed URI detector 17 / PLAIN results. Both raw digests, each complete source line (including the ordered pair for the repeated fixture), the three original test paths, regular-file mode, and every committed base/head reference must match. No test file is exempt from scanning. See the qualification contract and native proof.

The Gateway readiness error-privacy fixture in OpenClaw's readiness test is also qualified by this table. The exact URI detector 17 identities, complete source line (including the surrounding synthetic payload expression), regular-file mode, and committed base/head references must match. Native 3.97.4 scans observed PLAIN and HTML; only those two variants qualify. See the native proof.

The browser CDP discovery fixture in extensions/browser/src/browser/pw-session.connections.test.ts uses the same exact table for its observed URI detector 17 PLAIN and HTML findings. Both raw-value digests, the complete source line, original path, regular-file mode, and committed base/head references must match. See the native proof.

The CDP authentication and explicit-port fixtures in OpenClaw's SDK browser tests qualify only for their observed URI detector 17 PLAIN findings. Both native value digests, each complete source line (including the path suffix beyond the native match), the original path, regular-file mode, and every committed base/head reference must match. Other decoders and changed source lines remain blocking; the WebSocket fixture has no qualification because the pinned scanner did not emit a finding for it.

The TypeSafe local-transport URL-rejection fixture in extensions/typesafe/src/local.transport.test.ts binds its exact URI detector 17 identities, full source line, regular-file mode, and committed base/head references. Native 3.97.4 scans observed PLAIN and HTML; only those variants qualify. See the native proof.

The native-worker endpoint and startup-config rejection fixtures in transport tests and startup tests qualify only through their exact URI-17 PLAIN/HTML attribution, both value digests, complete source lines, regular-file mode and committed source references. No whole test file is exempt. See the native source-admission proof.

One source path may contain multiple independently reviewed fixtures; each digest/path/mode tuple must match exactly, so source membership alone never qualifies a finding. The model-egress fixtures in OpenClaw's Crabbox model runner and configured model egress tests qualify three synthetic URI identities using their complete source lines and committed regular-file references. Native TruffleHog 3.97.4 observed PLAIN and HTML for each identity; only those variants qualify. See the native proof. Deduplicated blobs retain every scanned logical endpoint's role, path, and Git mode, including mode-only transitions and shared-path aliases. Every captured reference must qualify under the same exact attribution policy before any source is eligible for classification or an audit notice. The policy does not trust checkout ignore rules, domain patterns, fixture words, test names, or unchanged-line inference; no nearby fixture is implicitly approved. The mandatory scanner regression suite validates the immutable host-owned attribution table for malformed or duplicate rows. Normal scans do not repeat that static policy check: native scan completeness, staged source material, line attribution, and secret matching are still verified for every scan. Explicitly supplied test policies are validated before classification. When review evidence quotes an exact reviewed synthetic URI, prompt preparation replaces the URI with a visible reference to its source file, preserving closing Markdown and sentence punctuation. The original context is preserved, and changed paths, credentials, or additional query text remain untouched. This omission does not classify a native finding or prove its verification status. Source blobs, introduced patches, and scanner admission retain their existing checks. The create-profile response-redaction fixture in OpenClaw's extensions/browser/src/browser/profiles-service.test.ts also binds its exact URI identity, complete source line, regular-file mode, and committed base/head references. Native 3.97.4 scans observed only PLAIN and HTML attribution; the policy accepts those two variants.

The plugin settings redaction fixtures in OpenClaw's ui/src/pages/custodian/custodian-session-store.test.ts and ui/src/e2e/plugins-help.e2e.test.ts bind their exact synthetic URI, ordered complete source lines, regular-file mode, and committed base/head references. Native 3.97.4 scans observed PLAIN and HTML attribution for these fixtures; only those exact tuples qualify.

The autoreview hardening negative-test fixtures in skills/autoreview/tests/test_autoreview_hardening.py and its OpenClaw mirror at .agents/skills/autoreview/tests/test_autoreview_hardening.py use the same exact attribution table. URI detector 17, each row's qualified PLAIN or HTML decoder, both pinned raw-value digests, every complete source line in order, regular-file mode, and committed base/head references qualify. The existing legacy value-only row stays available for review-context omission; changed patch lines require these exact tuples. No other literal or source line in either test file is implicitly approved. The additional empty-username and encoded-NUL identities permit only their observed PLAIN decoding. See the repeated native proof.

The full generated patch remains scanned. Every literal occurrence of an eligible URI must bind to committed regular-file bytes through canonical same-path headers, full Git object IDs, hunk coordinates, counts, and newline markers. Unchanged context requires the identical full line in both blobs. Added lines require the head blob; removed lines require the base blob, and both require exact ordered full-line attribution policy. Legacy value/path-only rows remain context-only. Every retained blob reference must independently pass the existing fixture policy. New and deleted files additionally require one matching host-captured raw Git diff record proving the absent endpoint, correct zero object ID and mode, and the complete present-file hunk. A textual /dev/null header or missing blob is not absence proof; contradictory captured references refuse admission. Headers containing the URI, binary patches, ambiguous paths, mode changes, uncommitted endpoints, and encoded-only matches remain blocking. Decoder line coordinates are diagnostic only; source matching does not rely on them. Patch notices retain the original material ID, scanner line, decoder, and literal line, with patch provenance recording both revisions and each source blob/line. The prompt omission helper is never applied to scan input. See the reproducible admission proof.

CloudflareGlobalApiKey detector 58 can pair Git's generated 40-character blob IDs with nearby email context. An unverified PLAIN/HTML finding in a patch or raw diff requires a separate provenance scan only when every literal occurrence is an exact object-ID field in canonical same-path regular-file patch/raw-diff headers. Modified executable files also qualify when both endpoint modes remain 100755; their raw records, patch headers, and blob references must agree on that mode. Executable additions/deletions, mode changes, and symlinks remain unsupported. The two endpoint revisions, paths, modes, and full staged blobs must agree; the host independently rehashes each present blob. Added and deleted files require matching zero endpoints, mode/status fields, patch headers, and absence of source references at the missing endpoint. Raw records and matching patch sections must be unambiguous; malformed, duplicate, or unmatched records refuse. The matched bytes must be absent from every staged prompt, schema, additional input, raw working file, and full blob, preventing detector deduplication from hiding a content occurrence. Missing retained bytes, unsupported metadata, malformed native fields, verified findings, and scanner errors still refuse. The complete patch, raw diff, and blobs remain scanned unchanged. Metadata notices identify their classification and use a SHA-256 digest in the existing notice identity field; matched object IDs and verification values are never emitted. OpenClaw Bay is unaffected.

Those witnesses alone never admit a review: HTML decoding can create another matching value from source content while its reported line differs from the original bytes. The host scans a second complete copy of each affected patch or raw diff with only the proven object-ID fields masked at their original lengths. All filename context and content bytes remain unchanged, and the staged bytes record that actual masked copy. The same pinned scanner, verification flags, completion checks, and shared deadline apply. Any remaining unclassified finding or request for metadata proof refuses admission; success notices are emitted only after this replay and the final source fences. Raw-diff replay has no fixture-admission route: any remaining finding refuses. Existing URI-only reviews retain their original single scan.

Findings attributed to prompt, schema, additional-input, other-path, or unqualified patch material remain blocking, as do other findings, verified findings, and incomplete scans. Unverified findings alone never qualify: every finding must match the exact bytes, source association, and strict detector contract. This classification does not expand TruffleHog's detection coverage. The classification is pinned to TruffleHog 3.97.4's output contract; scanner upgrades require requalification. See src/agent-input-scan-fixtures.ts. After successful cleanup and final source fences, each accepted fixture/source pair emits a host-side structured stderr notice with event, fixtureSha256, source, detector, and findings entries containing blob, decoder, and occurrences; role-bound findings also include role. Each finding retains its reported scannerLine and a literalLine for the first exact literal in the staged blob. This bounded witness establishes literal presence; it does not identify which occurrence produced a decoded hit. Counts are per source: a shared blob can appear in both source notices and those counts must not be summed across sources. A refused or drifted scan emits no success notice. Raw values and verification diagnostics never appear in that audit notice.

Generated review and repair prompt diagnostics retire the previous attempt's copy before admission and persist only successfully scanned exact prompt bytes with owner-only access. Commit review, assist, and close-coverage proof do not retain unused prompt copies. Original input records remain operator-owned outputs.

This admission boundary is not universal provider-egress scanning. Automatically loaded project docs, resumed/steered history, later tool results, and unchanged repository history are outside its scope. Planning, assist, and close-coverage calls scan their explicit prompt/schema; they do not attest a source review. No dashboard projection or observer API changes; OpenClaw Bay is unaffected.

Maintainers can run the dispatch-only Hosted native review scan smoke job in ci.yml. It uses the existing OPENAI_API_KEY and CLAWSWEEPER_MODEL secrets only during host setup, with no App mutation token. The proof artifact records zero Codex launches on refusal, then proves the production review path completed a read-only command over a synthetic committed diff before returning a schema-valid decision and terminal turn. Raw commands, output, prompts, transcripts, fixture values, runner identities, and model identities stay in ephemeral private files; the uploaded artifact contains only booleans and counts, including explicit false coverage flags for external repositories, review publication, and queue lifecycle.

• Review and repair base fetches use fully qualified branch refspecs so inherited

• Maintainer-authored items are excluded from automated closes unless the close

• Protected labels block close proposals.
• Apply rechecks older skipped fixed-close reports and archives skipped item

• Apply can retry older kept_open close reports and clear linked-PR issue

• Open PRs with GitHub closing references block issue closes until the PR is

• Open same-author issue/PR pairs block one-sided closes.
• Codex runs without GitHub write tokens.
• Issue/PR event jobs create target write and report-push credentials only after

• The retired hosted commit-review lane no longer mints target credentials;

• CI keeps the target checkout read-only and gives Codex issue/PR reviewers a managed

... (README truncated for length)