Best possible solution:

Close this stale PR. The latest review rated it F, the branch still lacks merge-ready proof, and there has been no human follow-up after the durable review.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection shows openclaw exec-policy preset reaches the exec approvals writer, and current main still has a test expecting a symlinked .openclaw component to be rejected.

Is this the best way to solve the issue?

No, not as submitted. The compatibility direction is valid, but the stale draft needs a rebase that preserves current state-dir behavior and hardening before it can be the best fix.

Security review:

Security review needs attention: The patch changes command-approval filesystem trust boundaries and currently misses current main's directory hardening on the Node path.

• [medium] Approval directory hardening is missing on PR head — src/infra/exec-approvals.ts:285
  The PR head no longer performs current main's POSIX 0700 chmod after creating the approvals directory, leaving command-approval state permissions dependent on existing mode or process umask.
  Confidence: 0.86
• [medium] Symlink trust boundary needs maintainer review — apps/macos/Sources/OpenClaw/ExecApprovalsSocket.swift:755
  The branch allows previously rejected symlink shapes in approval storage and macOS socket handling, so ownership, permissions, chained symlinks, destination-file symlinks, and socket placement need explicit security review before merge.
  Confidence: 0.84

AGENTS.md: found and applied where relevant.

What I checked:

• stale F-rated PR: PR was opened 2026-04-27T08:40:23Z, is older than 60 days, and the latest review rated it F.
• proof blocker: real behavior proof is missing and proof tier is F, so this branch is not merge-ready without contributor follow-up.
• no human follow-up: live comments and timeline hydrated by apply contain no non-automation activity after the ClawSweeper review.

Likely related people:

• Takhoffman: Commit 4bf94aa added the local exec-policy CLI and updated the approvals write path used by the reported command. (role: introduced affected CLI surface; confidence: high; commits: 4bf94aa0d669; files: src/cli/exec-policy-cli.ts, src/infra/exec-approvals.ts, src/infra/exec-approvals-store.test.ts)
• vincentkoc: Commit 364d498 repaired trusted OPENCLAW_HOME symlinks in the same exec approvals path and tests. (role: recent symlink-fix contributor; confidence: high; commits: 364d49889e67; files: src/infra/exec-approvals.ts, src/infra/exec-approvals-store.test.ts)
• steipete: Commit 538605f extracted filesystem safety primitives and moved exec approvals toward the shared fs-safe guard surface. (role: adjacent filesystem-safety contributor; confidence: high; commits: 538605ff44d2; files: src/infra/fs-safe-advanced.ts, src/infra/exec-approvals.ts)
• jesse-merhi: Commit c9707ab recently changed command authorization and exec approvals store/tests adjacent to this path. (role: recent adjacent exec approvals contributor; confidence: medium; commits: c9707ab635b9; files: src/infra/exec-approvals.ts, src/infra/exec-approvals-store.test.ts, src/gateway/server-methods/exec-approval.ts)

Codex review notes: model internal, reasoning high; reviewed against 36dd9ee3c3c1.

• The egg game starts only after the PR passes the real-behavior proof check.
• Before that, no creature or rarity is rolled. The treat waits for real proof.
• This is still just collectible flavor: proof affects review readiness, not creature quality.