Add gated Claw publication and profile validation

[giodl73-repo]

Summary

• Gates Claw publication before multipart storage reads, blob writes, staged-ticket consumption, and other mutation while retaining later defense-in-depth checks.
• Validates exact bounded profile bytes, package identity/version binding, archive size/path/hierarchy safety, and the shared host-environment policy exported by clawhub-schema.
• Applies the requested CLAW.md package-envelope contract: non-empty bounded body bytes become the managed SOUL.md, explicit SOUL.md is rejected, and provenance/digests bind the exact immutable bytes.
• Preserves legacy ZIP compatibility while rejecting file/ancestor hierarchy collisions across loose files, TGZ, legacy ZIP, and extraction.
• Keeps ownership, moderation, scanning, immutable artifacts, releases, and visibility boundaries intact.
• Filters disabled Claw families before list/search quotas and ranking, preserving recall, fair family ranking, stable cursors, and bounded public summaries.

This is ClawHub PR 2 of 4 for RFC #27, with the portable-core/profile integration based on RFC #48, OpenClaw #112773, and merged parent #3089.

Experimental boundary

Disabled deployments reject Claw publication before package-specific storage access or mutation. Enabling the gate does not bypass ownership, moderation, scanning, package identity, immutable-byte, or release invariants. OpenClaw retains applying-version-specific tool-profile resolution and local preview, consent, mutation, update, and removal.

Stack

1. Add experimental portable Claw package schema #3089: portable schema and storage (merged)
2. Add gated Claw publication and profile validation #3090: gated publication, package envelope, profile validation, and disabled-family filtering
3. Add gated Claw discovery and API projection #3091: discovery APIs
4. Add gated Claw hosted feed and lifecycle proof #3092: hosted feed and OpenClaw bridge proof

Validation

• bun run ci:static
• bun run ci:unit (5,376 passed, 1 skipped)
• bun run ci:types-build
• bun run ci:packages
• bun run ci:e2e-http
• bunx vitest run convex/packages.public.test.ts (310 passed)
• focused CLI package-command tests (81 passed)
• schema, CLI, and root TypeScript checks; schema/CLI mirror equality; git diff --check
• disposable real local Convex schema/function push (no cloud runtime modified)
• final contextualized autoreview: clean, no accepted/actionable findings

Exact pushed head: a9f1bb419fecef3191fbf012b9e2483fc8092b3f.

Contract note

At RFC #48 head 6459c70e8585205ddc884566d837d13d7ad6ff91, the public prose still describes the CLAW.md body as documentation-only and possibly empty. This implementation follows the maintainer-directed managed-body contract summarized above; that prose mismatch remains explicit rather than being treated as settled normative proof.

No production deployment was performed.

[vercel]

@giodl73-repo is attempting to deploy a commit to the OpenClaw Foundation Team on Vercel.

A member of the Team first needs to authorize it.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	croner@​10.0.1

View full report

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed July 19, 2026, 10:10 PM ET / July 20, 2026, 02:10 UTC.

Summary
Adds feature-gated Claw package publication, strict manifest/archive validation, CLI support, safe stored summaries, disabled-state visibility filtering, documentation, and regression coverage.

Reproducibility: not applicable. as a bug reproduction: this is a new registry capability. The provided focused tests give a clear source-level validation path, but no real deployed lifecycle demonstration.

Review metrics: 2 noteworthy metrics.

• Patch surface: 38 files affected; 4,672 added, 62 removed. This is a broad cross-layer feature slice touching persistence, Convex publication, CLI, docs, generated schema artifacts, and tests.
• Claimed focused coverage: 340 tests across 4 focused files. The reported tests exercise validators and handler paths, but do not replace live deployment lifecycle proof.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🦐 gold shrimp
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Obtain explicit maintainer sponsorship for the RFC-backed experimental registry contract and stack order.
• After the schema prerequisite lands, rebase and provide redacted live deployment proof for enabled and disabled lifecycle behavior.

Proof guidance:

• [P1] Needs real behavior proof before merge: The PR supplies focused tests, builds, and handler-harness output but explicitly lacks a live Convex deployment; before merge, add redacted live evidence showing enabled publication and safe output plus disabled pre-mutation rejection and invisibility. Update the PR body afterward for a fresh review, or ask a maintainer to comment @clawsweeper re-review.

Risk before merge

• [P1] Merging expands the persisted package-family and publication contract; existing consumers and operators need the experimental gate, upgrade behavior, and stack order explicitly owned before the new family is exposed.
• [P1] The supplied validation is limited to tests and local handler harnesses; it does not prove that an enabled deployment can publish and safely project a Claw while a disabled deployment rejects and hides it before any storage mutation.

Maintainer options:

1. Sponsor, then prove the gated lifecycle (recommended)
   After the schema prerequisite lands, rebase and add redacted live deployment evidence for enabled publish/public projection and disabled pre-mutation rejection before merge.
2. Accept experimental-contract ownership
   A maintainer may explicitly accept the new persisted claw family and gated registry contract, including the future compatibility and migration commitment.
3. Pause the registry rollout
   Keep the draft stack unmerged if RFC sponsorship or an operator-ready experimental deployment is not currently intended.

Next step before merge

• [P1] A maintainer must sponsor the new experimental registry contract and rollout order; missing live proof is contributor-supplied evidence, not a safe automated repair task.

Maintainer decision needed

• Question: Should ClawHub adopt the RFC-backed experimental claw package family now, with CLAWHUB_EXPERIMENTAL_CLAWS=1 as the deployment gate and the proposed staged rollout?
• Rationale: This PR introduces a new persisted registry family, publishing surface, validation contract, and deployment setting; correctness alone cannot determine whether that product and compatibility commitment should be accepted.
• Likely owner: giodl73-repo — They have the most complete documented context for the four proposed ClawHub slices, while a ClawHub product owner must make the final sponsorship decision.
• Options:
  • Pause pending RFC sponsorship (recommended): Keep this draft stack open but do not merge until a responsible maintainer explicitly sponsors the experimental registry direction and rollout order.
  • Sponsor the staged rollout: Approve the gated registry direction, land the schema prerequisite first, then require fresh live lifecycle proof before merging this publication slice.
  • Narrow the scope: Request a smaller schema-only or validator-only experiment if the team wants RFC feedback without enabling hosted publication yet.

Security
Cleared: No discrete security or supply-chain defect is evident in the proposed diff; the added YAML and cron dependencies are pinned and the code adds strict validation and a deployment gate, though live boundary proof is still required.

Review details

Best possible solution:

After a maintainer sponsors the RFC-backed experimental scope and the schema prerequisite lands, rebase this slice and attach redacted live deployment evidence covering enabled publication, safe public projection, and disabled rejection/absence.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction: this is a new registry capability. The provided focused tests give a clear source-level validation path, but no real deployed lifecycle demonstration.

Is this the best way to solve the issue?

Unclear: the patch is a coherent implementation path, but adopting a persisted experimental Claw registry family and its deployment gate requires maintainer product approval before code quality alone can establish it as the best solution.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against aaa73625ed41.

Label changes

Label justifications:

• P2: This is a substantial but gated experimental registry feature with limited immediate user blast radius while disabled by default.
• merge-risk: 🚨 compatibility: The patch adds a persisted package family and public/package CLI contract whose experimental upgrade and consumer behavior need maintainer ownership.
• merge-risk: 🚨 security-boundary: The patch accepts packages that describe agent, workspace, MCP, cron, and package inputs, so deployment-gate and validation behavior require live boundary proof.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR supplies focused tests, builds, and handler-harness output but explicitly lacks a live Convex deployment; before merge, add redacted live evidence showing enabled publication and safe output plus disabled pre-mutation rejection and invisibility. Update the PR body afterward for a fresh review, or ask a maintainer to comment @clawsweeper re-review.

Evidence reviewed

What I checked:

• Current-main gap: The patch adds v.literal("claw") to the package-family validator and introduces Claw summary storage, showing the requested registry capability is not already implemented by the stated current-main baseline. (convex/schema.ts:513, 0e868cca40ad)
• Publication and safety boundary: The proposed publication path checks CLAWHUB_EXPERIMENTAL_CLAWS and strips extractedClawManifest from public release projection; the supplied tests also cover disabled publication and public visibility filtering. (convex/packages.ts:1208, 0e868cca40ad)
• Open prerequisite: The PR body and related-item context identify the schema/storage slice as a dependency, and Add experimental portable Claw package schema #3089 remains an open draft PR. (specs/claws.md:20, 0e868cca40ad)
• Prior finding addressed: The contributor reports that disabled-state filtering now covers unfiltered lists/search and named detail/version reads; the proposed diff includes visibility checks in both digest and package list filters. (convex/packages.ts:1309, 0e868cca40ad)
• Proof remains harness-only: The PR body reports 340 focused tests and builds but explicitly states that no live Convex deployment was tested, so it does not demonstrate an after-fix enabled publish and disabled read/publication lifecycle in a real deployment. (0e868cca40ad)

Likely related people:

• giodl73-repo: Authored the coordinated schema, publication, discovery, and feed proposals and documented the intended staged contract across the related PRs. (role: Claw stack author and domain context; confidence: medium; commits: a23ebf6113d5, 0e868cca40ad; files: specs/claws.md, convex/packages.ts, packages/schema/src/clawPackage.ts)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (4 earlier review cycles)

• reviewed 2026-07-16T11:13:04.964Z sha 476e86d57aae77a9bba6f984d9a6ba056c498f4a :: needs real behavior proof before merge. :: [P1] Gate existing package reads before enabling publication
• reviewed 2026-07-17T07:56:38.631Z sha fe333b8dc118cab2ee969d1c808eb1ef4494aa0b :: needs real behavior proof before merge. :: none
• reviewed 2026-07-17T11:45:12.440Z sha fe333b8dc118cab2ee969d1c808eb1ef4494aa0b :: needs real behavior proof before merge. :: none
• reviewed 2026-07-17T15:23:43.378Z sha fe333b8dc118cab2ee969d1c808eb1ef4494aa0b :: needs real behavior proof before merge. :: none

[giodl73-repo]

Addressed the fail-closed publication finding at fe333b8. PR #3090 now owns disabled-state filtering for existing unfiltered lists/search and named detail/version reads, strips extractedClawManifest from public releases, and keeps plugin audit pages plugin-only; #3091 is no longer needed to close the security boundary. CLAW.md ingestion also has exact filename plus BOM parity, and the CLI/backend validators are synchronized with #3089. Proof: 317 focused backend/schema tests, all 74 package CLI tests, full ci:static and ci:types-build, and a clean Codex branch review. The body honestly records that hosted Convex proof remains in the coordinated #3092 lifecycle slice.

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[giodl73-repo]

Restacked publication onto refreshed #3089 at �b120145. Package identity is now exact (no trim-into-validity), CLAW.md rejects aliases/anchors/merge keys/explicit tags exactly like OpenClaw, and both shipped validators carry the final strict policy. The PR body records 340 passing focused tests and the remaining Windows npm-shim gap.

[giodl73-repo]

@clawsweeper re-review

[giodl73-repo]

Final publication slice is at

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

[giodl73-repo]

Independent three-agent review fixes are applied at 1dd30e764762: Claw npm packs no longer require a plugin manifest; all package/source paths are canonical and exact; YAML/UTF-8 and preparse limits fail closed; tar processing is bounded and streaming; legacy ZIP bytes are stored and served immutably with historical fallback; and publication uses the canonical Claw coordinate. Current-head proof: 346 focused schema/publication tests plus 3 focused CLI tests, schema build, typechecks, type-aware lint, format, and diff checks pass. RFC #27 and its sidecars are updated: openclaw/rfcs#27

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[giodl73-repo]

Restacked and added the artifact enforcement layer for RFC #48: the referenced package-local OpenClaw YAML must exist, remain under 256 KiB, use JSON-compatible YAML, and satisfy the strict v1 profile schema. It is never returned separately or installed as ordinary OpenClaw config. Signed head a971c15661ba; 61 schema/package tests and all 79 CLI publication tests pass.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[giodl73-repo]

Restacked onto current ClawHub main through #3089. This PR is now at signed head 234acb86648b; 61/61 schema/package and 79/79 CLI publication tests remain green. @clawsweeper re-review

[giodl73-repo]

Publication validation is aligned with the final profile contract at signed head c1c0002298bd: unsupported heartbeat.skipWhenBusy is rejected, the CLI schema copy uses the same portable pointer rule, and canonical/CLI schemas are byte-identical. Validation includes 63/63 focused tests, schema and CLI typechecks, lint, formatting/diff checks, and a clean Codex review.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.