Codex review: needs real behavior proof before merge. Reviewed July 9, 2026, 4:54 AM ET / 08:54 UTC.

Summary
The PR changes agent compaction and memory-core snippet truncation to use UTF-16-safe truncation helpers, adds focused regression coverage, and declares a new internal workspace dependency for agent-core.

PR surface: Source +3, Tests +80, Config +1, Other +3. Total +87 across 6 files.

Reproducibility: yes. from source: current main truncates with raw string slice at the compaction and memory snippet boundaries, so a supplementary Unicode character whose high surrogate lands at the limit can produce a dangling surrogate. I did not run a live repro in this read-only review.

Review metrics: 2 noteworthy metrics.

• Truncation boundaries changed: 3 call sites changed. The patch touches compaction summary truncation, short-term recall snippets, and promoted MEMORY.md display snippets, which are the behavior surfaces reviewers should verify.
• Dependency graph surfaces: 1 manifest dependency added, 1 lockfile importer changed. agent-core now directly depends on the internal normalization-core package, so the dependency guard and package-boundary review are relevant before merge.

Stored data model
Persistent data-model change detected: unknown-data-model-change: extensions/memory-core/src/short-term-promotion.test.ts, vector/embedding metadata: extensions/memory-core/src/short-term-promotion.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P1] Add redacted terminal or live-output proof that exercises the after-fix compaction serialization and memory recall/promotion paths outside unit-test assertions.
• Rerun or wait for dependency-guard after the /allow-dependencies-change comment and confirm CI is green on the exact head.

Proof guidance:

• [P1] Needs real behavior proof before merge: The PR body reports focused tests only; add redacted terminal/live output or logs showing the after-fix compaction and memory behavior, then update the PR body to trigger a fresh ClawSweeper review or ask a maintainer to comment @clawsweeper re-review.

Risk before merge

• [P1] Real behavior proof is only focused test output; the PR still needs redacted terminal/live output or logs showing the after-fix compaction and memory paths.
• [P1] The dependency graph change has a maintainer authorization comment, but dependency-guard still showed failure at review time and needs rerun/settling on the exact head.
• [P1] One CI shard was failing while logs were unavailable because the run was still in progress, so validation is not fully settled.

Maintainer options:

1. Decide the mitigation before merge
   Land the shared UTF-16-safe truncation fix after adding real behavior proof and letting dependency guard plus CI settle on the exact head.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• [P1] No automated code repair is indicated; the PR needs contributor real-behavior proof plus exact-head guard/CI follow-through.

Security
Cleared: No third-party dependency, secret, permission, or code-execution expansion was found; the internal workspace dependency has an explicit maintainer authorization comment pending guard rerun.

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

• packages/agent-core/package.json
• pnpm-lock.yaml

Maintainer follow-up:

• Review whether the dependency changes are intentional.
• Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.
• Treat package-lock.json and npm-shrinkwrap.json diffs as security-review surfaces.
• Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

Dependency graph change authorized

This PR includes dependency graph changes. A repository admin or member of @openclaw/openclaw-secops authorized this exact head SHA with /allow-dependencies-change.

• Approved SHA: 35c4f99efc05a47f5dae719b16246409d8307706
• Approved by: @steipete

A later push changes the PR head SHA and requires a fresh security approval.

/allow-dependencies-change

Additional real-behavior proof at exact head 35c4f99efc05a47f5dae719b16246409d8307706:

I ran a source-blind node --import tsx probe against the actual production functions, outside Vitest. It exercised:

• serializeConversation with an emoji straddling the 2,000-code-unit tool-result boundary;
• recordShortTermRecalls through the SQLite-backed memory-core state runtime with an emoji straddling the 800-code-unit recall boundary;
• rankShortTermPromotionCandidates plus applyShortTermPromotions, then read the generated MEMORY.md line with an emoji straddling the promoted-snippet budget.

Observed output:

{
  "compaction": {
    "hasUnpairedSurrogate": false,
    "exactOmittedMarker": true,
    "retainedPrefixChars": true
  },
  "recallStore": {
    "hasUnpairedSurrogate": false,
    "storedLength": 799,
    "exactSafePrefix": true
  },
  "promotion": {
    "hasUnpairedSurrogate": false,
    "exactSafePrefix": true
  }
}

The sole CI failure was an unrelated src/tui/tui-pty-local.e2e.test.ts timeout in the whole-repo shard; failed jobs are rerunning. The exact-head internal workspace dependency was reviewed and explicitly authorized with /allow-dependencies-change.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Maintainer review complete at exact head 35c4f99efc05a47f5dae719b16246409d8307706.

Review improvements:

• corrected compaction's omitted count to use the actual safe prefix;
• kept private truncation helpers private and replaced direct-helper tests with public serialization, recall-store, and promotion assertions;
• routed memory-core through the supported plugin SDK facade;
• declared agent-core's intentional direct internal workspace dependency.

Validation:

• compaction tests — 3 passed;
• focused memory-core UTF-16 tests — 2 passed, 91 skipped;
• source-blind runtime proof for compaction, SQLite recall persistence, and generated MEMORY.md — all boundaries valid;
• fresh autoreview — clean, 0.98 confidence;
• exact-head hosted CI/Testbox and dependency guard — passed after one unrelated TUI PTY timeout rerun.

Known proof gaps: none for these three bounded text paths.

Merged via squash.

• Prepared head SHA: 35c4f99efc05a47f5dae719b16246409d8307706
• Landed commit: f7cc6ebe1e0b8d76bde694ee78fdd57037101fdb