feat(feeds): serve signed catalog queries and changes

[giodl73-repo]

## Feed stack (3 of 4 — ClawHub) **Review after:** #3005 → #3149 **Then:** #3163 (sharded snapshots) → openclaw/openclaw#110250 (consumer) This branch is rebased directly on #3149. Its incremental range is `ce757dc3..428b4fa`; after the predecessors land, the PR diff collapses to signed paged query/delta transport only. No production signing key is needed to review or merge this PR. Tests use generated keys; production signing remains dormant. ## Summary - expose signed changed-since pages and retention-reset responses - persist revision-pinned query indexes for `q`, `type`, `state`, and `publisherId` - expose signed bounded query pages with exact result counts - issue short-lived integrity-protected cursors bound to feed, revision/range, normalized filters, page state, limits, and expiry - use standard DSSE envelopes and fail closed only for clients that explicitly request signed representations - keep query materialization and response sizes bounded ## Review unit This PR combines the former signed change route (#3151) and indexed signed query route (#3160). Both are bounded projections over #3149's distribution state and use the dormant signer from #3005. Sharded full snapshots remain separate in #3163. ## Bounds - change page: at most 500 records and 1 MiB - query result page: at most 200 entries and 1 MiB - query materialization batch: 250 entries - continuation lifetime: five minutes - query validity never exceeds the source revision expiry ## Validation - 64 focused catalog/query/change/signing tests passed - schema package build and `git diff --check` - direct Codex incremental review against #3149: no actionable findings

[vercel]

Someone is attempting to deploy a commit to the OpenClaw Foundation Team on Vercel.

A member of the Team first needs to authorize it.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed July 21, 2026, 12:57 PM ET / 16:57 UTC.

Summary
The draft adds signed, revision-pinned catalog query and change-feed endpoints with retained indexes, bounded cursor pagination, schemas, and tests.

Reproducibility: no. live high-confidence reproduction is supplied. Source inspection clearly establishes that the patch changes the existing route’s handler and makes its availability depend on signing configuration.

Review metrics: 1 noteworthy metric.

• Patch surface: 31 files affected; 4,827 added, 57 removed. The draft combines public routes, signing, retained state, schemas, generated package artifacts, tests, crons, and specifications, so the route transition needs an explicit migration decision.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🦪 silver shellfish
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Preserve the raw feed contract or obtain explicit approval for a versioned/negotiated DSSE cutover.
• Run Convex code generation and commit all resulting artifacts.
• [P1] Attach redacted live endpoint and signature-verification proof for both successful and missing-signer paths.

Proof guidance:

• [P1] Needs real behavior proof before merge: The PR body lists tests and static checks only; before merge it needs redacted real-deployment evidence of a signed query and change response, successful verification, cursor continuation/expiry, and signer-unavailable behavior. Redact keys, private endpoints, and other sensitive values; updating the PR body should trigger a fresh review, or a maintainer can request @clawsweeper re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

• [P1] Replacing the existing /api/v1/feeds/plugins raw representation with DSSE, and returning 503 until a signer secret is provisioned, can break existing consumers at runtime.
• [P1] The new public signing boundary needs real deployment evidence that the configured key, serving route, cursor continuation, and consumer-compatible trust-root rollout work together.

Maintainer options:

1. Retain the raw route during migration (recommended)
   Restore the raw catalog response as the default and add DSSE through explicit negotiation or a new versioned route, with focused compatibility coverage.
2. Approve a breaking signer rollout
   Accept the route replacement only after documenting the client cutover, provisioning the signing secret and trust root, and showing live redacted verification evidence.
3. Pause the stacked transport slice
   Keep the draft paused if the raw-to-DSSE transition cannot be sponsored as a deliberate public API change.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Preserve the existing raw catalog-feed response by default; expose DSSE only through an explicit negotiated or versioned path, add compatibility coverage, regenerate committed Convex artifacts, and attach redacted live endpoint proof.

Next step before merge

• [P1] A maintainer must choose the public raw-feed-to-DSSE transition; contributor proof and generated artifacts are required after that direction is settled.

Maintainer decision needed

• Question: Should ClawHub replace the existing raw /api/v1/feeds/plugins response with signing-dependent DSSE now, or preserve the raw contract and add DSSE through a negotiated or versioned transition?
• Rationale: The patch deliberately changes an established public response and adds a fail-closed deployment prerequisite; source inspection cannot determine the intended consumer migration and signer-rollout policy.
• Likely owner: unidentified current-main catalog-feed owner — Current-main ownership attribution could not be established safely because the read-only shell failed before git provenance commands could run.
• Options:
  • Preserve raw compatibility (recommended): Keep the current raw response as the default and expose DSSE through an explicit media type or versioned endpoint until consumers and signer provisioning are ready.
  • Authorize an immediate cutover: Accept the DSSE-only and signer-required route as a breaking release with documented consumer migration and production key rollout.

Security
Cleared: No concrete code-level security or supply-chain regression was found; the remaining security concern is operational proof of the new signer and trust-root rollout.

Review findings

• [P1] Preserve the existing raw catalog-feed contract — convex/http.ts:167-169
• [P1] Commit regenerated Convex API and data-model artifacts — convex/schema.ts:2664

Review details

Best possible solution:

Preserve the raw catalog-feed representation by default and introduce DSSE through explicit content negotiation or a versioned route, then land the generated Convex artifacts with redacted live validation of signing, verification, pagination, expiry, and missing-signer behavior.

Do we have a high-confidence way to reproduce the issue?

No live high-confidence reproduction is supplied. Source inspection clearly establishes that the patch changes the existing route’s handler and makes its availability depend on signing configuration.

Is this the best way to solve the issue?

No. The signing/query design is bounded and documented, but replacing the raw route without an explicit compatibility transition is not the narrowest safe solution for existing consumers.

Full review comments:

• [P1] Preserve the existing raw catalog-feed contract — convex/http.ts:167-169
  This remains unresolved from the prior review at the same head. Replacing catalogFeedV1Http on the existing route makes current raw-JSON clients receive DSSE or a 503 when the signer is absent; keep the raw response by default or introduce an explicit negotiated/versioned DSSE transition.
  Confidence: 0.98
  Late finding: first raised on code an earlier review cycle already covered.
• [P1] Commit regenerated Convex API and data-model artifacts — convex/schema.ts:2664
  This remains unresolved from the prior review at the same head. The branch adds Convex modules and schema tables but omits the committed convex/_generated updates required by repository policy; regenerate and include the resulting API/type artifacts before merge.
  Confidence: 0.9
  Late finding: first raised on code an earlier review cycle already covered.

Overall correctness: patch is incorrect
Overall confidence: 0.95

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a09d42484a7d.

Label changes

Label justifications:

• P2: This is a substantial but not currently user-reported public-feed capability whose merge is blocked by bounded compatibility and rollout decisions.
• merge-risk: 🚨 compatibility: The patch replaces the existing catalog-feed handler at the same public route with a different DSSE representation.
• merge-risk: 🚨 security-boundary: The new public integrity boundary depends on configured signing keys, cursor authentication, and matching consumer trust-root rollout.
• merge-risk: 🚨 availability: The replacement handler intentionally returns 503 when signing configuration is absent or invalid, affecting the existing route's availability.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body lists tests and static checks only; before merge it needs redacted real-deployment evidence of a signed query and change response, successful verification, cursor continuation/expiry, and signer-unavailable behavior. Redact keys, private endpoints, and other sensitive values; updating the PR body should trigger a fresh review, or a maintainer can request @clawsweeper re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

What I checked:

• Existing route contract: Current main registers the catalog-feed surface through the existing HTTP router; the patch replaces its raw handler at the same route with a signing-dependent DSSE handler, so existing consumers can receive a different representation or a 503. (convex/http.ts:167, a09d42484a7d)
• Prior blocker remains at the same head: The latest review covered commit e66b8ce and identified preservation of the raw catalog-feed contract plus generated Convex artifacts as P1 blockers; the current PR head is still e66b8ce, with no author commit after that review. (convex/http.ts:167, e66b8ce4039c)
• Generated-artifact policy: Repository policy commits Convex generated API/types and requires code generation after Convex API or schema changes; this branch adds schema tables and new Convex HTTP modules but its supplied file list omits convex/_generated artifacts. (AGENTS.md:3, a09d42484a7d)
• Runtime-proof requirement: The PR body supplies tests and static checks only, while the repository policy requires a real Convex validation path for changed runtime semantics; the PR remains labeled status: 📣 needs proof and contains no after-fix endpoint transcript, signature verification, or signer-rollout proof. (AGENTS.md:9, a09d42484a7d)
• Security scope: The patch introduces DSSE signing, key configuration parsing, integrity-protected cursors, and public HTTP endpoints without adding dependencies, package lifecycle hooks, workflow edits, or broader repository permissions. (convex/httpApiV1/catalogFeedSigning.ts:1, e66b8ce4039c)

Likely related people:

• unidentified current-main catalog-feed owner: The available read-only environment blocked the required git history commands; current-main catalog-feed routing and publication code are the appropriate ownership surface, but no reliable individual attribution was recoverable without inventing one. (role: current-main feature owner unresolved; confidence: low; commits: a09d42484a7d; files: convex/http.ts, convex/httpApiV1/catalogFeedV1.ts, convex/catalogFeed.ts)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

• reviewed 2026-07-18T03:33:05.330Z sha e66b8ce :: needs real behavior proof before merge. :: [P1] Preserve the existing raw catalog-feed contract | [P1] Commit regenerated Convex API and data-model artifacts

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: feat(feeds): serve signed catalog queries and changes This is item 1/1 in the current shard. Shard 2/4.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

[github-actions]

This pull request has been automatically marked as stale due to inactivity.
Please update it or it will be closed.

[github-actions]

Closing due to inactivity.
If this PR should be revived, reopen it with current context and a fresh validation plan.