feat: clarify publisher state and discovery labels

[giodl73-repo]

Summary

• define separate claim, official, and restriction facts for ClawHub publishers
• derive official state only from ClawHub-managed official-publisher records
• keep claim, verification, suspension, and revocation concepts separate from feed trust
• rename publisher discovery surfaces from generic Verified wording to Official
• show explicit Official publisher, Public profile, and Public catalog labels where supported by existing facts
• preserve compatibility with legacy publisher ownership and older admin responses

Review unit

This PR combines publisher-state facts with the profile/discovery labels that consume existing publisher facts. It does not add following, feed transport, scan authority, install eligibility, or OpenClaw registry decisions.

Trust boundary

Publisher official state is a ClawHub identity fact. It does not imply that a feed is signed, an artifact is reviewed or scanned, or an install is locally approved.

Validation

• targeted publisher state, publisher route, schema, creators-route, and profile-route coverage from the two original slices
• targeted oxfmt over the combined diff
• git diff --check
• combined branch resolved only the specs index and retains both source specifications
• focused tests were not rerun in the consolidation worktree because dependencies are not installed; the original slices carried their own focused proof

[vercel]

@giodl73-repo is attempting to deploy a commit to the OpenClaw Foundation Team on Vercel.

A member of the Team first needs to authorize it.

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed July 22, 2026, 1:32 AM ET / 05:32 UTC.

Summary
The PR adds publisher claim/official/restriction state facts to official-publisher administration responses and changes related publisher discovery and profile labels from “Verified” to “Official.”.

Reproducibility: yes. for the review finding: a publisher with at least 20 eligible-role membership rows whose scanned users are all deleted or deactivated reaches the fallback that returns claimed. No supplied live setup proves the intended API/UI behavior after the proposed change.

Review metrics: 2 noteworthy metrics.

• Changed surface: 16 files, 862 added, 8 removed. The PR combines backend state semantics, an API schema, UI labels, tests, and product specifications in one compatibility-sensitive review unit.
• Patch structure: 2 commits. The second commit folds the previously closed discovery-label branch into the publisher-state change, so both behavior and presentation require a single contract decision.

Root-cause cluster
Relationship: canonical
Canonical: #2949
Summary: This combined PR is the remaining canonical proposal for publisher-state facts and discovery labels; the prior label-only branch was closed unmerged after being incorporated, while the registry-export proposal is adjacent rather than a replacement.

Members:

• superseded: feat: clarify publisher discovery state labels #2951 - Its profile/discovery-label scope is incorporated into this combined branch, and it was closed unmerged.
• partial_overlap: feat: add OpenClaw registry export bridge #2953 - It shares the official-publisher fact as an input to a registry export bridge but introduces a separate export concern and remains open.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🦪 silver shellfish
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P1] Correct the saturated inactive-membership claim predicate and add a regression case.
• Post redacted live Convex/API output for active and inactive publishers plus a real browser capture of the revised profile/discovery labels.
• Obtain maintainer confirmation that the new publisher-state vocabulary is the intended supported contract.

Proof guidance:

• [P1] Needs real behavior proof before merge: No after-fix real Convex/API output or real-browser capture is present for the new publisher-state response and discovery labels; add redacted active/inactive and official/non-official evidence, then update the PR body for automatic re-review or ask a maintainer to comment @clawsweeper re-review.

Risk before merge

• [P1] The new optional official-publisher API state becomes a compatibility-sensitive vocabulary; consumers may treat claimState or officialState as a broader approval or safety signal despite the PR’s intended separation.
• [P1] The saturated membership scan can misstate publisher identity ownership by reporting claimed without an observed active owner, admin, or publisher member.
• [P1] Merging without redacted live API or browser proof leaves both active/inactive state behavior and the visible discovery labels unverified in a real ClawHub setup.

Maintainer options:

1. Correct the claim predicate before merge (recommended)
   Remove the saturated-scan shortcut or otherwise establish an active eligible member before emitting claimed, then cover the no-active-member saturated case.
2. Adopt a broader contract deliberately
   If bounded scans are required for performance, document and approve an explicit unknown or indeterminate state instead of presenting an unverified claim as claimed.
3. Defer state fields
   Close or split out the new API state vocabulary if maintainers do not want to support its semantics and upgrade expectations yet.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Repair the claim-state predicate so claimed requires an observed active eligible owner/admin/publisher member, add a regression test for a saturated all-inactive member set, and retain the existing official-state separation.

Next step before merge

• [P1] A mechanical predicate repair is identifiable, but maintainers must first approve the new publisher-state API vocabulary and the contributor must supply real behavior proof; this is not ready for an automated repair/merge lane.

Maintainer decision needed

• Question: Should ClawHub expose claimState, officialState, and restrictionState as an official-publisher administration contract now, with “claimed” requiring an observed active eligible member?
• Rationale: This PR introduces new durable trust vocabulary and UI meaning; the implementation can be corrected mechanically, but maintainers must decide whether this is the intended public/administrative contract and its precise semantics.
• Likely owner: unknown — No non-author current-main feature owner can be established from the supplied history evidence.
• Options:
  • Sponsor the bounded contract (recommended): Keep the three distinct state fields, require observed active membership for claimed, and merge only after targeted live proof and compatibility review.
  • Narrow to presentation-only labels: Land only the existing-fact “Official” presentation clarification and defer new publisher-state response fields until a broader API contract is approved.
  • Defer the feature: Pause this PR until maintainers define the publisher identity and trust-state API alongside its consumers and upgrade guarantees.

Security
Needs attention: The patch adds a publisher identity/trust signal whose current saturated-scan fallback can falsely assert a claim, so the trust-boundary predicate needs correction before merge.

Review findings

• [P1] Require an observed active member before returning claimed — convex/lib/publisherState.ts:52

Review details

Best possible solution:

Confirm the publisher-state contract, require claimState to be based on an observed active eligible member, add focused regression coverage for saturated inactive membership, and attach redacted live API plus browser proof showing active, inactive, official, and non-official publisher cases.

Do we have a high-confidence way to reproduce the issue?

Yes for the review finding: a publisher with at least 20 eligible-role membership rows whose scanned users are all deleted or deactivated reaches the fallback that returns claimed. No supplied live setup proves the intended API/UI behavior after the proposed change.

Is this the best way to solve the issue?

No. The separation of official state from feed or install trust is directionally sound, but returning claimed from a saturated scan without an observed active member is not a reliable implementation of the proposed state contract.

Full review comments:

• [P1] Require an observed active member before returning claimed — convex/lib/publisherState.ts:52
  This remains unresolved from the prior review cycle. When the role query reaches the 20-member cap, the helper returns true even if every scanned member belongs to a deleted or deactivated user, so the new response can report claimState: "claimed" without observing an active eligible representative.
  Confidence: 0.98

Overall correctness: patch is incorrect
Overall confidence: 0.94

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a9775fc39b10.

Label changes

Label justifications:

• P2: This is a bounded but compatibility- and trust-sensitive feature change with a concrete P1 correctness blocker rather than an active production outage.
• merge-risk: 🚨 compatibility: The PR adds optional response fields and changes “Verified” discovery wording to “Official,” creating a consumer and meaning compatibility surface.
• merge-risk: 🚨 security-boundary: Publisher claim and official facts are trust-boundary signals, and the current claim predicate can assert ownership without observing an active eligible member.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: No after-fix real Convex/API output or real-browser capture is present for the new publisher-state response and discovery labels; add redacted active/inactive and official/non-official evidence, then update the PR body for automatic re-review or ask a maintainer to comment @clawsweeper re-review.

Evidence reviewed

Security concerns:

• [medium] Claim state can assert unobserved active ownership — convex/lib/publisherState.ts:52
  The new identity fact treats a saturated member scan as claimed even when no active eligible member was found. Consumers can reasonably interpret this state as ownership or representation, making the false positive a trust-boundary concern.
  Confidence: 0.98

What I checked:

• Prior review continuity: The latest completed ClawSweeper review at head dd684f0 raised “Require an observed active member before returning claimed”; the provided current-head diff still contains the saturated-scan fallback. (convex/lib/publisherState.ts:52, dd684f0ef958)
• Current source defect: The new helper returns true for an organization when a role query reaches 20 rows even if none of the scanned members belongs to an active user, so it can report claimState: claimed without observing the condition the state is meant to represent. (convex/lib/publisherState.ts:52, dd684f0ef958)
• Missing runtime proof: The PR body says focused tests were not rerun in the consolidation worktree and supplies only static/claimed prior validation; the provided discussion contains no redacted live Convex/API output or real-browser evidence for active and inactive publisher cases. (dd684f0ef958)
• Scope and contract surface: The branch changes 16 files with 862 additions, including a new official-publisher response field, client schema, publisher-state helper, UI labels, and two durable product specifications; this is a public semantics change rather than a copy-only relabel. (packages/clawhub/src/schema/schemas.ts:319, dd684f0ef958)
• Related branch relationship: The closed-unmerged discovery-label branch is incorporated into this combined branch, while the open registry-export branch overlaps only on the separate official-publisher fact and does not replace this PR.

Likely related people:

• unknown: The provided context identifies the external proposer but contains no current-main blame, log, or merged-feature provenance that can safely route ownership to a person other than the PR author. (role: ownership not established; confidence: low; files: convex/lib/publisherState.ts, convex/publishers.ts, src/routes/user/$handle.tsx)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (8 earlier review cycles)

• reviewed 2026-07-04T07:13:54.051Z sha addff1f :: needs real behavior proof before merge. :: [P1] Require an observed active member before returning claimed
• reviewed 2026-07-04T07:24:39.757Z sha addff1f :: needs real behavior proof before merge. :: [P1] Require an observed active member before returning claimed
• reviewed 2026-07-04T08:24:05.131Z sha addff1f :: needs real behavior proof before merge. :: [P1] Require an observed active member before returning claimed
• reviewed 2026-07-07T23:48:47.186Z sha addff1f :: needs real behavior proof before merge. :: [P1] Require an observed active member before returning claimed
• reviewed 2026-07-08T01:23:18.598Z sha addff1f :: needs real behavior proof before merge. :: [P1] Require an observed active member before returning claimed
• reviewed 2026-07-09T02:13:18.881Z sha addff1f :: needs real behavior proof before merge. :: [P1] Require an observed active member before returning claimed
• reviewed 2026-07-18T03:33:11.676Z sha addff1f :: needs real behavior proof before merge. :: [P1] Do not infer a claim from a saturated scan
• reviewed 2026-07-21T16:57:23.292Z sha dd684f0 :: needs real behavior proof before merge. :: [P1] Require an observed active member before returning claimed

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[github-actions]

This pull request has been automatically marked as stale due to inactivity.
Please update it or it will be closed.

[github-actions]

Closing due to inactivity.
If this PR should be revived, reopen it with current context and a fresh validation plan.