feat: 0.5.0 API surface — archive policy, publication mechanics, sync locks, secret create-only, Root.walk, cleanup receipts

[steipete]

Summary

This is the complete 0.5.0 surface. Nothing in this PR is staged for a later feature release: optional native acceleration, every guarded JavaScript fallback, archive policy, publication semantics, walking, locks, secret/temp APIs, Windows security, migration guidance, CI, and release-graph proof all ship together.

• Policy-driven archive filtering, clamp/preserve modes, metadata/path-depth/byte/count limits, bounded entry reads, and native fd-relative ZIP/TAR/gzip/zstd/bzip2 extraction.
• Exclusive publication with hardlink, clone, copy_file_range, JavaScript-loop, and native no-replace rename strategies under common identity/content/durability fencing.
• Root-bounded walking with subtree pruning, bounded partial-error reporting, synchronous/async sidecar locks, async/create-only secret files, and identity-conditioned temp cleanup.
• Direct Windows owner/DACL inspection and creation-time private-directory DACLs, with the existing inspection fallback retained where equivalent.
• A checked-in seven-target native loader with process-report/filesystem/ELF libc detection and no process execution at import time.
• A Python-name warn-and-map bridge solely for shipped 0.4 consumers. Python is not executed and interpreter paths are ignored; consumers migrate during the 0.5 upgrade.

Final 0.5 additions

Harvest-audit API closeout

• movePathWithCopyFallback({ sourceHardlinks: "reject" }) now performs a streaming 50,000-entry recursive preflight before mutation. This closes the shipped 0.4.x ordering gap where a successful same-filesystem rename bypassed the policy. Because link count and rename cannot be made atomic portably, this opt-in mode publishes a fresh staged copy even on one filesystem, fencing nlink after open and after copying; self-descendant, symlink-aliased, and dot-segment destinations fail before staging.
• sha256File(input: string | FileHandle) is public from @openclaw/fs-safe/durability and returns Promise<{ bytes: number; digest: string }>. It uses the async native task when available and a positioned 64 KiB JS stream otherwise, preserves caller handle ownership/offset, and opens path inputs no-follow/nonblocking before regular-file and identity validation.
• readOwnerAndDacl(path) is public from @openclaw/fs-safe/permissions. Windows returns { status: "supported", ownerSid, daclPresent, isLocal, complete, unsupportedAceTypes, aces }; each ordered allow/deny ACE contains { sid, mask, aceType, flags }, including inheritOnly and raw/decoded inheritance flags. Other platforms return { status: "unsupported-platform", platform }. The API reports facts only and applies no trusted-SID policy.

Publication sync-failure policy

publishFileExclusive() adds:

onSyncFailure?: "rollback" | "preserve";

• rollback remains the default. After a thrown parent-directory sync, fs-safe removes only the unchanged target identity created by this call.
• preserve keeps the complete, fenced target and throws the typed error with details: { phase: "directory-sync", targetCreated: true, targetIdentity, cleanup: "preserved", directorySync: { status: "failed", code? } }.
• A replacement pathname is preserved under either policy. rename-noreplace also always preserves after a successful rename because the target is the source's only remaining name.
• Neither policy converts a failed sync into durability: rollback deletion is not proven durable, while a preserved name may disappear after a crash. Backup archives normally prefer preserve; protocols where the name means “durably committed” normally prefer rollback.

OpenClaw adoption closeout

• Source descriptors are closed when parent pinning fails before publication begins.
• Root.walk() supports entryFilter: "include" | "skip" | "skip-subtree" and onDirectoryError: "throw" | "skip-and-report"; every examined entry consumes the traversal budget before filtering.
• maxEntryPathComponents defaults to 256 after stripComponents and rejects JS/native extraction before implicit directory creation.

Architecture and fallback contract

TypeScript is the only policy owner. Rust receives validated relative mechanisms and accepted archive plans; no policy is duplicated. Native absence does not change traversal/link rejection, filters, limits, mode clamping, exclusive creation, identity/content fencing, cleanup receipts, secret policy, or lock policy.

The mechanism delta is explicit:

Capability	Native	Guarded JavaScript
Root mutations	Descriptor-relative beneath syscalls (openat2, component walk, NtCreateFile with reparse rejection)	Lexical/canonical checks, no-follow opens, private temp/rename, post-operation identity checks
ZIP/TAR/gzip	Rust streaming + fd-relative output	JSZip/node-tar private staging + guarded merge
Zstd/bzip2 TAR	Supported	Typed helper-unavailable
Publication	Clone/copy_file_range/async native SHA-256	Exclusive byte loop + Node SHA-256 under the same fences
rename-noreplace	Atomic platform primitive	No unsafe check-then-rename emulation
Windows private directory	Creation-time protected DACL	No weaker fallback
Windows owner/ACE facts	Direct GetSecurityInfo, ordered basic ACE facts	Typed unsupported result off Windows; Windows requires native for lossless ACE facts

auto prefers native and falls back where equivalent; off deterministically tests JavaScript; require fails closed. Import-time loading never spawns a process.

Packed behavior proof

The nine-package macOS arm64 scratch install exercises the published package boundary:

{
  "native": {
    "nativeBinding": "loaded",
    "openBeneath": "function",
    "publicHash": { "bytes": 3, "digest": "ba7816bf...15ad" }
  },
  "fallback": { "nativeMode": "off", "fallback": "hardlink" },
  "finalRound": {
    "hash": { "bytes": 3, "digest": "ba7816bf...15ad" },
    "dacl": { "status": "unsupported-platform", "platform": "darwin" },
    "moveHardlinks": { "sameFilesystemRejected": true, "errorCode": "hardlink" },
    "archive": {
      "errorCode": "entry-filtered",
      "pathLimitCode": "archive-entry-path-components-exceeds-limit"
    },
    "walk": {
      "prunedSubtree": true,
      "directoryErrorReported": true,
      "healthyEntryPreserved": true
    }
  },
  "missingRequiredBinding": { "errorCode": "helper-unavailable" }
}

The source-blind behavior contract varied native require/off, physically removed the binding for the required-native failure, checked hardlink source/target state, and exercised both hash implementations.

Documentation and migration

The new 0.5 migration checklist covers install/runtime, Python-to-native configuration, archive clamp-default auditing, filter/limit adoption, publication sync policy, bounded walking, locks/secrets/temp, native-only features, exact Windows ACE facts, public streaming hashes, and consumer CI.

The docs pass also corrected behavior drift: Windows fallback inspection uses path-only icacls rather than invalid /sid; lock retry factor defaults to 1; non-test hook registration throws; FsSafeError exposes details; the main export and install subpath tables now match package.json; sync-lock examples are actually synchronous; strict secret reads include their required label; and the quickstart copies into the temp workspace rather than an unrelated root.

ClawSweeper checklist

• Packed all nine packages and installed the root tarball in scratch projects on Linux, macOS, and Windows.
• Proved native load, forced off fallback, and binding-removed require failure.
• Proved auto / require / off, native/JS equivalence, Alpine musl, archive adversarial cases, publication receipts, and Windows fallback/native modes.
• Removed PATH-resolved ldd; loader detection is strictly non-executing.
• Retained every safe JavaScript fallback and documented the exact native delta.
• Retained legacy Python warning/mapping only as a shipped-0.4 upgrade bridge; no Python execution remains.
• Verified fast-wrap-ansi@0.2.2 is dev-only through @napi-rs/cli; Socket justification is in this comment.
• Closed the shipped 0.4.x hardlink-policy ordering gap and adversarially proved common same-filesystem rejection.

Corrected APFS benchmark

Local macOS arm64, APFS SSD, Node 26.5.0, release native build, real-byte fixtures. End-to-end includes all identity, fsync, and SHA-256 fences; primitive rows isolate clone + normalization/fsync.

Size	JavaScript byte loop	Native APFS clone end-to-end	Clone primitive
4 KiB	9.31 ms	5.75 ms	0.51 ms
1 MiB	12.84 ms	7.81 ms	0.47 ms
64 MiB	216.41 ms	129.94 ms	0.82 ms

Single-host medians only; the public native operation still scales with mandatory hashing.

CI and local proof

Final exact head: cfbe661c2a590c3997315da6e162a0a416a69f37.

• CI: run 30184836215 — Node 22/24 × Ubuntu/macOS/Windows; native modes/equivalence × three OSes; Alpine musl; cargo clippy/audit; actionlint; release-graph smoke × three OSes.
• Coverage: run 30184836189.
• CodeQL: run 30184836216.
• Benchmarks: run 30184836205.
• Local: pnpm check (585 passed, 7 skipped), pnpm test:security (59 passed), Rust tests (13 passed), clippy with warnings denied, RustSec audit of 70 locked dependencies, cargo fmt, actionlint, docs build, packed release-graph smoke, source-blind behavior validation, and final P1 autoreview clean.

Final numstat

Category	Added	Deleted
Rust native source/build	4,369	0
TypeScript source	3,672	1,566
Tests	2,203	493
Scripts and proof tooling	1,224	2
Docs and changelog	1,281	251
CI and release workflows	429	148
Package metadata	162	1
Generated loaders and locks	1,453	2
Workspace config	8	1
Total	14,801	2,464

Rust dependency health

Crate	Version	Health
tar	0.4.46	maintained tar-rs line; policy remains outside parser
flate2	1.1.9	established implementation; multi-member gzip tested
zstd	0.13.3	maintained streaming decoder
bzip2	0.6.1	maintained; concatenated members tested
zip	6.0.0	maintained; default features disabled, deflate only
sha2	0.11.0	maintained RustCrypto implementation

cargo audit --deny warnings reports no advisories across the 70 locked Rust dependencies.

Final downstream identity addendum: Windows readOwnerAndDacl() results now include currentUserSid, serialized from the current process token's TokenUser; it is a policy-free fact alongside ownerSid.

[clawsweeper]

Codex review: found issues before merge. Reviewed July 26, 2026, 12:04 AM ET / 04:04 UTC.

ClawSweeper review

What this changes

This PR replaces the optional Python helper with optional native filesystem packages and adds archive, publication, walking, locking, secret, temporary-workspace, Windows-permission, and release-pipeline APIs.

Merge readiness

⚠️ Needs maintainer review before merge - 6 items remain

Keep this PR open for an explicit release-direction decision: the documented 0.5 migration makes existing required-helper deployments fail closed when no native package is usable, and the only supplied approval statement is from the contributor. Likely related people: steipete (low-confidence routing candidate for the proposed native-helper migration).

Priority: P1
Reviewed head: 3f77406e8ba7cf7c5827e926776bb83972413c6c
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The PR has strong reported behavior proof, but a P1 upgrade-contract decision prevents merge readiness.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (live_output): The PR body provides concrete packed-install output for native loading, forced fallback, and required-native failure across the proposed package boundary.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The PR body provides concrete packed-install output for native loading, forced fallback, and required-native failure across the proposed package boundary.
Evidence reviewed	5 items	Migration behavior: The proposed migration guide maps legacy Python mode names to native mode, ignores configured interpreter paths, and states that Python is never spawned; a prior require deployment without a usable native binding therefore changes to helper-unavailable at runtime. Prior review remains unresolved: The latest completed ClawSweeper review at cfbe661c2a590c3997315da6e162a0a416a69f37 raised the same P1 release-approval blocker. The current head only adds current-process SID exposure, so the migration decision remains visible and unresolved. Contributor context: The contributor states that native-only helper migration is intentional, but the supplied discussion does not show independent maintainer approval for accepting the established required-helper upgrade break.
Findings	1 actionable finding	[P1] Obtain approval for the required-helper migration
Security	None	None.

How this fits together

fs-safe provides capability-style filesystem roots and guarded helper APIs for Node applications handling untrusted paths. Calls select an optional native mechanism or a guarded JavaScript fallback, then use identity and path checks before changing filesystem state.

flowchart LR
  App[Node application] --> Root[Capability root and policies]
  Root --> Mode[Native mode selection]
  Mode --> Native[Optional native packages]
  Mode --> Fallback[Guarded JavaScript fallback]
  Native --> Guards[Path and identity guards]
  Fallback --> Guards
  Guards --> APIs[Archive, publish, walk, lock and secret APIs]
  APIs --> Disk[Filesystem state]

Loading

Decision needed

Question	Recommendation
Should version 0.5 remove execution of configured Python helper paths and allow existing require configurations to fail with helper-unavailable when no matching native package is installed?	Keep a compatible transition: Preserve the existing required-helper behavior or a compatible default until a later version, while keeping an explicit native-only strict mode.

Why: This is an intentional public upgrade-contract and fail-closed-policy choice; the supplied contributor statement does not establish independent maintainer acceptance of the deployment break.

Before merge

• Obtain approval for the required-helper migration (P1) - The migration maps existing Python require configuration to native require while ignoring interpreter paths, so an upgraded deployment without a matching optional native package now fails at startup. This P1 was already raised in the prior review and remains unresolved; obtain an independent release decision or preserve a compatible transition path before merge.
• Resolve merge risk (P1) - Existing deployments that configured FS_SAFE_PYTHON_MODE=require can stop at runtime after upgrade when a matching optional native package is unavailable; the legacy name mapping does not preserve the prior interpreter-backed contract.
• Resolve merge risk (P1) - The PR changes filesystem-boundary mechanisms and adds native packages, so acceptance of the compatibility break should be an explicit release decision rather than an inferred contributor intent.
• Resolve merge risk (P1) - The release workflow now publishes a nine-package graph through trusted publishing; its production npm configuration must be confirmed by the release owner before the first tag.
• Complete next step (P2) - A release owner must choose the permanent upgrade contract; this is not a narrow mechanical repair suitable for an automated fix PR.

Findings

• [P1] Obtain approval for the required-helper migration — docs/migrating-to-0.5.md:31-35

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Changed surface	149 files affected; 14,817 additions and 2,464 deletions	The patch spans public APIs, native code, package metadata, tests, CI, and tag-driven publishing.
Release packages	9 packages in the release graph	The workflow and prerelease documentation introduce a multi-package trusted-publishing contract rather than a single-package release.

Merge-risk options

Maintainer options:

1. Decide the required-helper upgrade contract (recommended)
   Before merge, either obtain explicit release-owner approval for the fail-closed native-only migration or restore a compatible transition path with focused upgrade coverage.
2. Pause the release surface
   Keep this broad 0.5 PR open until an owner sponsors the migration and confirms the nine-package trusted-publishing setup.

Technical review

Best possible solution:

Land the native-helper design only after a release owner explicitly accepts the required-helper compatibility break, or retain a compatible transition path with tested default and strict-mode behavior through the 0.5 release.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a feature PR, so the relevant evidence is after-fix behavior and upgrade safety rather than reproduction of a current-main bug.

Is this the best way to solve the issue?

No: replacing the existing required-helper contract without an independent release decision is not yet the best maintainable path; either explicitly approve that incompatibility or preserve a tested transition.

Full review comments:

• [P1] Obtain approval for the required-helper migration — docs/migrating-to-0.5.md:31-35
  The migration maps existing Python require configuration to native require while ignoring interpreter paths, so an upgraded deployment without a matching optional native package now fails at startup. This P1 was already raised in the prior review and remains unresolved; obtain an independent release decision or preserve a compatible transition path before merge.
  Confidence: 0.94

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 8cced2ab6264.

Labels

Label changes:

• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
• remove rating: 🐚 platinum hermit: Current PR rating is rating: 🦐 gold shrimp, so this older rating label is no longer current.

Label justifications:

• P1: An intentional change to required-helper startup semantics can break active production deployments at runtime after upgrade.
• merge-risk: 🚨 compatibility: Legacy Python helper configuration is mapped to a different native-package availability contract.
• merge-risk: 🚨 security-boundary: The PR changes filesystem confinement mechanisms, archive extraction, Windows permission handling, and native fallback boundaries.
• merge-risk: 🚨 automation: The PR substantially rewrites CI validation and tag-driven publication for a nine-package release graph.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (live_output): The PR body provides concrete packed-install output for native loading, forced fallback, and required-native failure across the proposed package boundary.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides concrete packed-install output for native loading, forced fallback, and required-native failure across the proposed package boundary.

Evidence

What I checked:

• Migration behavior: The proposed migration guide maps legacy Python mode names to native mode, ignores configured interpreter paths, and states that Python is never spawned; a prior require deployment without a usable native binding therefore changes to helper-unavailable at runtime. (docs/migrating-to-0.5.md:31, 3f77406e8ba7)
• Prior review remains unresolved: The latest completed ClawSweeper review at cfbe661c2a590c3997315da6e162a0a416a69f37 raised the same P1 release-approval blocker. The current head only adds current-process SID exposure, so the migration decision remains visible and unresolved. (docs/migrating-to-0.5.md:31, 3f77406e8ba7)
• Contributor context: The contributor states that native-only helper migration is intentional, but the supplied discussion does not show independent maintainer approval for accepting the established required-helper upgrade break. (3f77406e8ba7)
• Behavior proof: The PR body reports packed multi-platform installation, native loading, forced JavaScript fallback, and required-native failure evidence; the provided context labels the proof sufficient. (3f77406e8ba7)
• Supply-chain context: Socket’s reported low-adoption warning is documented as a development-only transitive dependency of the native build CLI, not a runtime dependency; no separate concrete supply-chain defect is established from the provided materials. (native/package.json:37, 3f77406e8ba7)

Likely related people:

• steipete: The supplied history attributes the native-helper migration, release pipeline, and current-head permission API work to this contributor; no independent current-main ownership trail was available in the review materials. (role: recent area contributor; confidence: low; commits: b3a690577491, 434f9690acae, 3f77406e8ba7; files: docs/migrating-to-0.5.md, src/native-config.ts, .github/workflows/release.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Obtain an independent release-owner decision on the required-helper migration.
• If compatibility is retained, add focused upgrade proof for both legacy/default and explicit strict native modes.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (12 earlier review cycles; latest 8 shown)

• reviewed 2026-07-25T19:37:49.718Z sha 434f969 :: needs maintainer review before merge. :: none
• reviewed 2026-07-25T22:39:14.978Z sha 923b881 :: needs maintainer review before merge. :: none
• reviewed 2026-07-26T01:59:55.084Z sha 7442f9c :: needs real behavior proof before merge. :: none
• reviewed 2026-07-26T02:05:23.645Z sha 7442f9c :: needs maintainer review before merge. :: none
• reviewed 2026-07-26T02:10:27.326Z sha 7442f9c :: needs maintainer review before merge. :: none
• reviewed 2026-07-26T02:39:28.126Z sha cfbe661 :: needs real behavior proof before merge. :: none
• reviewed 2026-07-26T02:44:52.537Z sha cfbe661 :: needs maintainer review before merge. :: none
• reviewed 2026-07-26T02:50:27.554Z sha cfbe661 :: found issues before merge. :: [P1] Obtain release approval for the Python-helper removal

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​napi@​3.11.0
	cargo/​rustix@​1.1.4
	npm/​@​napi-rs/​cli@​3.7.4
	cargo/​libc@​0.2.189
	cargo/​bzip2@​0.6.1
	cargo/​flate2@​1.1.9
	cargo/​napi-build@​2.3.2
	cargo/​napi-derive@​3.6.0
	cargo/​sha2@​0.11.0
	cargo/​tar@​0.4.46
	cargo/​windows-sys@​0.61.2
	cargo/​zip@​6.0.0
	cargo/​zstd@​0.13.3

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Low adoption: npm fast-wrap-ansi Location: Package overview From: pnpm-lock.yaml → npm/@napi-rs/cli@3.7.4 → npm/fast-wrap-ansi@0.2.2 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fast-wrap-ansi@0.2.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[steipete]

Verified as development-only: fast-wrap-ansi@0.2.2 is present solely through @napi-rs/cli@3.7.4, which is a direct devDependency used to build the optional native packages. pnpm why fast-wrap-ansi --prod returns no dependency path, so it is not included in the runtime package graph.

@SocketSecurity ignore npm/fast-wrap-ansi@0.2.2

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Review in progress
• Detail: The exact-review queue leased this run; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/30169120128
• Updated: 2026-07-25T18:11:33.575Z

[steipete]

Maintainer decision: 0.5 intentionally adopts the native-only helper migration. Legacy Python modes warn and map for 0.5.x, but configured interpreter paths are no longer executed. require without a usable native binding fails closed with helper-unavailable. There is no Python fallback or permanent alias, and the migration bridge is removed in 0.6.

@clawsweeper re-review

[steipete]

Resolved the final P1: createPrivateDirectory() is now explicitly Windows-only and native-only. POSIX calls fail closed before any filesystem mutation, so pathname races and inherited ACLs cannot weaken the API's privacy guarantee. All required checks are green on de5404e49d2b48398516bda32a60650314626d0f.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Review in progress
• Detail: The exact-review queue leased this run; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/30170389627
• Updated: 2026-07-25T18:49:52.769Z

[steipete]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Review in progress
• Detail: The exact-review queue leased this run; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/30171930698
• Updated: 2026-07-25T19:36:34.343Z

[steipete]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Review in progress
• Detail: The exact-review queue leased this run; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/30177924875
• Updated: 2026-07-25T22:37:59.022Z

[steipete]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Review in progress
• Detail: The exact-review queue leased this run; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/30184838504
• Updated: 2026-07-26T02:37:18.357Z

[steipete]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Failed
• Detail: The exact review did not produce a publishable artifact. The durable queue will retry it.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/30187059669
• Updated: 2026-07-26T04:01:00.757Z