fix(policy): reject unsupported policy keys by giodl73-repo · Pull Request #87074 · openclaw/openclaw

giodl73-repo · 2026-05-26T23:19:33Z

Summary

Tightens policy validation so unsupported policy sections and rule keys are reported as policy/policy-jsonc-invalid instead of being silently ignored. This keeps policy.jsonc strict: if an operator writes a policy claim that OpenClaw does not understand or cannot evaluate, Policy reports that as invalid policy syntax rather than giving false confidence.

Contract

Policy files remain config-conformance documents. This PR does not add runtime enforcement or new policy surfaces; it makes the existing surfaces stricter about unknown keys.

Examples that now produce policy/policy-jsonc-invalid findings include:

{
  "unknownSection": {},
  "network": {
    "privateNetwork": {
      "allow": false,
      "unknownRule": true
    }
  },
  "scopes": {
    "ops": {
      "agentIds": ["analyst"],
      "ingress": {
        "channels": {
          "denyOpenGroups": true
        }
      }
    }
  }
}

The scoped example is invalid because ingress.channels.* requires a channelIds selector, not agentIds. Every scoped policy section must be valid and enforceable for the selector it declares.

Behavior

Unsupported keys are rejected across the policy namespaces already covered by the policy stack, including top-level sections, nested section keys, and scoped overlays. Known strictness metadata still controls allowed stricter overlays and policy compare; this PR makes unknown fields fail fast before evaluation.

Usage

openclaw policy check
openclaw policy check --json
openclaw doctor --lint
openclaw policy compare --baseline official.policy.jsonc --policy policy.jsonc

Validation

Focused policy doctor coverage for unsupported top-level sections, unsupported nested rule keys, unsupported scoped sections, and selector/section mismatches.
Policy docs updated to state that unsupported policy sections or rule keys are reported as policy/policy-jsonc-invalid instead of being ignored.

clawsweeper · 2026-05-26T23:21:46Z

Codex review: needs maintainer review before merge. Reviewed June 2, 2026, 5:59 PM ET / 21:59 UTC.

Summary
The PR tightens the Policy plugin doctor/check and compare validation so unsupported policy.jsonc sections and rule keys fail, adds focused tests, and documents strict policy files.

PR surface: Source +359, Tests +175, Docs +2. Total +536 across 3 files.

Reproducibility: yes. from source: current main lacks the unsupported-key allowlists while the PR adds them and tests concrete rejected policy shapes. I did not run tests in this read-only review.

Review metrics: 1 noteworthy metric.

Policy validation strictness: 1 existing policy-file surface tightened, 0 new config keys added. The PR changes how existing operator policy files are accepted during check/compare/lint without adding a new policy syntax surface.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Keep the strictness/upgrade-impact decision visible when merging.

Risk before merge

[P1] Merging intentionally turns previously ignored unknown policy.jsonc sections or rule keys into hard failures for openclaw policy check, openclaw policy compare, and openclaw doctor --lint; existing operator files with undocumented keys may start failing.
[P1] Because Policy is a conformance/security-boundary surface, maintainers should own the fail-closed choice and the assertion that the allowlists cover every supported policy rule.

Maintainer options:

Land With Recorded Strictness (recommended)
If maintainers accept unknown policy claims as invalid, merge with the current tests/docs and keep the upgrade impact visible in the PR record.
Add An Upgrade Window
If maintainers want a softer upgrade path, change unknown-key handling to a warning or staged diagnostic before making it a hard failure.
Pause If Allowlists Are Incomplete
If the allowlists are not considered authoritative for every supported policy rule, pause this PR until the missing policy surface is enumerated.

Next step before merge

[P2] Human maintainer handling remains because the PR has a protected maintainer label and intentionally changes compatibility/security-boundary strictness; no narrow automation repair remains.

Security
Cleared: The diff is security-sensitive but fail-closes unsupported policy claims and does not change dependencies, scripts, secrets, permissions, or package resolution.

Review details

Best possible solution:

Land only with maintainer acceptance of the fail-closed policy strictness, keeping the validation local to the Policy plugin doctor/check path with the current focused docs and tests.

Do we have a high-confidence way to reproduce the issue?

Yes, from source: current main lacks the unsupported-key allowlists while the PR adds them and tests concrete rejected policy shapes. I did not run tests in this read-only review.

Is this the best way to solve the issue?

Yes, this is the right implementation boundary if maintainers accept the strictness: the change stays in Policy plugin validation and reuses the existing policy invalid/conformance invalid paths instead of adding runtime enforcement.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against a86a1de8499f.

Label changes

Label justifications:

P2: This is a normal-priority policy/security-boundary validation improvement with bounded surface but real compatibility impact.
merge-risk: 🚨 compatibility: Existing operator policy.jsonc files containing unknown sections or rule keys can start failing after upgrade.
merge-risk: 🚨 security-boundary: The changed behavior decides whether unsupported policy claims fail closed instead of being silently ignored on a conformance boundary.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR discussion includes after-fix command-function behavior for rejected policy keys plus focused validation commands; this is enough for the non-visual CLI/policy behavior under review.
proof: sufficient: Contributor real behavior proof is sufficient. The PR discussion includes after-fix command-function behavior for rejected policy keys plus focused validation commands; this is enough for the non-visual CLI/policy behavior under review.

Evidence reviewed

PR surface:

Source +359, Tests +175, Docs +2. Total +536 across 3 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	379	20	+359
Tests	1	176	1	+175
Docs	1	2	0	+2
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	3	557	21	+536

What I checked:

Scoped repository policy read: Root, extensions, and docs AGENTS.md were read; the applicable guidance treats config strictness and security-boundary changes as compatibility-sensitive maintainer review items. (AGENTS.md:27, a86a1de8499f)
Strict policy section allowlist: PR head defines supported top-level policy sections and rejects the first unsupported section before existing namespace-specific validation runs. (extensions/policy/src/doctor/register.ts:526, 3ab4ff1d8f77)
Unsupported tools stubs fixed in latest head: The latest commit removes tools.settings and tools.entries from the tools policy allowlist and adds test cases proving those stubs are rejected. (extensions/policy/src/doctor/register.ts:2547, 3ab4ff1d8f77)
Check and compare callers use shape findings: Policy check/doctor lint includes policyContainerShapeFindings, and policy compare maps the same shape findings to policy/policy-conformance-invalid, so the change affects the documented command paths. (extensions/policy/src/policy-conformance.ts:94, 3ab4ff1d8f77)
Regression coverage: The new test table covers unsupported keys across top-level, tools, channels, ingress, MCP, models, network, gateway, agents, dataHandling, secrets, and auth namespaces with policy/policy-jsonc-invalid targets. (extensions/policy/src/doctor/register.test.ts:996, 3ab4ff1d8f77)
Docs updated: The CLI policy docs now state that unsupported policy sections or rule keys are reported as policy/policy-jsonc-invalid instead of ignored. Public docs: docs/cli/policy.md. (docs/cli/policy.md:205, 3ab4ff1d8f77)

Likely related people:

giodl73-repo: The same contributor recently landed the related Policy data-handling conformance work on current main and authored this stacked strict-key follow-up in the same files. (role: recent area contributor; confidence: high; commits: 1d3cfc4b0168, 7311f7ddf762, 1ca7aa6330ac; files: extensions/policy/src/doctor/register.ts, extensions/policy/src/doctor/register.test.ts, docs/cli/policy.md)
galiniliev: Reviewed the policy stack earlier in the PR discussion, found no blocking code issues, and called out the compatibility strictness decision for maintainer acceptance. (role: reviewer; confidence: medium; files: extensions/policy/src/doctor/register.ts, extensions/policy/src/doctor/register.test.ts, docs/cli/policy.md)
NVIDIAN: The shallow/grafted current-main history attributes much of the pre-policy doctor module to the large initial imported commit, so this is weak routing signal for older surrounding behavior. (role: historical importer; confidence: low; commits: 895dccd0582d; files: extensions/policy/src/doctor/register.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

clawsweeper · 2026-05-26T23:25:44Z

ClawSweeper PR egg

✨ Hatched: 💎 rare Gilded Patch Peep

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

Merged PRs are hatchable.
Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

Rarity: 💎 rare.
Trait: stacks clean commits.
Image traits: location workflow harbor; accessory release bell; palette pearl, teal, and neon green; mood mischievous; pose pointing at a small proof artifact; shell soft velvet shell; lighting soft studio lighting; background tiny shells and proof notes.
Share on X: post this hatch
Copy: My PR egg hatched a 💎 rare Gilded Patch Peep in ClawSweeper.

What is this egg doing here?

Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

galiniliev · 2026-05-27T03:15:57Z

Maintainer review: no blocking findings.

I reviewed the final stack commit c6b6696f2c6 rather than treating the full stacked branch as one change. The patch tightens policy.jsonc validation from permissive shape checks to explicit unsupported-key rejection across the existing Policy plugin namespaces, with docs updated to state that unsupported sections/rules report policy/policy-jsonc-invalid.

Best-fix verdict: this is the right owner boundary for the current fix. Keeping validation in extensions/policy/src/doctor/register.ts matches the existing doctor/check path, avoids adding runtime enforcement, and keeps the behavior local to the Policy plugin. The cleaner long-term alternative would be a declarative policy-shape table or schema that drives both allowed-key validation and docs, but that is a broader refactor and not clearly safer for this stacked follow-up. I would not block this PR on that extraction unless the policy surface keeps growing in the next few commits.

Compatibility note: this intentionally changes previously ignored policy keys into hard policy-file errors. That is the desired behavior here, but it should remain a maintainer-accepted config strictness change before merge.

Proof read: extensions/AGENTS.md, docs/AGENTS.md, docs/cli/policy.md, extensions/policy/src/doctor/register.ts, extensions/policy/src/doctor/register.test.ts, extensions/policy/src/cli.test.ts.

Verification run against PR commit c6b6696f2c6 in a detached temp worktree:

OPENCLAW_VITEST_FS_MODULE_CACHE_PATH=/tmp/openclaw-pr-87074-vitest-cache OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts -- --reporter=dot --testTimeout=30000

Result: 253 tests passed.

OPENCLAW_VITEST_FS_MODULE_CACHE_PATH=/tmp/openclaw-pr-87074-vitest-cache-cli OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/policy/src/cli.test.ts -- --reporter=dot --testTimeout=30000

Result: 28 tests passed.

Live PR checks currently show Real behavior proof, actionlint, no-tabs, and Socket PR alerts passing; most broad CI shards are skipped while this remains a draft/stacked PR.

giodl73-repo · 2026-05-27T18:52:16Z

Updated this branch on top of the rebased data-handling branch (53462da7fb5).

@galiniliev I kept the unsupported-key behavior as the intentional config strictness change you called out in the compatibility note. No additional code change was needed beyond rebasing the stack.

Fresh validation after the rebase:

OPENCLAW_VITEST_FS_MODULE_CACHE_PATH=/tmp/openclaw-87074-shape-rebase OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts extensions/policy/src/cli.test.ts -- --reporter=dot --testTimeout=30000 -> 2 files, 282 tests passed
pnpm tsgo:extensions
pnpm exec oxfmt --check --threads=1 docs/cli/policy.md docs/plugins/reference/policy.md extensions/policy/src/doctor/register.ts extensions/policy/src/doctor/register.test.ts extensions/policy/src/policy-state.ts && git diff --check
node scripts/run-bundled-extension-oxlint.mjs
pnpm docs:check-mdx docs/cli/policy.md docs/plugins/reference/policy.md

@clawsweeper re-review

clawsweeper · 2026-05-27T18:52:20Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26531938865
Updated: 2026-05-27T19:01:48.890Z

giodl73-repo · 2026-05-27T23:18:22Z

Rebased #87074 over the cleaned data-handling branch after removing the release-owned changelog edit from the lower policy stack.

Current signed head: a54b1553faa.

Validation from the top-of-stack checkout after rebasing #87074 and #87081:

OPENCLAW_VITEST_FS_MODULE_CACHE_PATH=/tmp/openclaw-87081-stack-final OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts extensions/policy/src/cli.test.ts -- --reporter=dot --testTimeout=30000 -> 2 files, 285 tests passed
pnpm tsgo:extensions
node scripts/run-bundled-extension-oxlint.mjs -> 0 warnings, 0 errors
pnpm exec oxfmt --check --threads=1 docs/cli/policy.md docs/plugins/reference/policy.md extensions/policy/src/doctor/register.ts extensions/policy/src/doctor/register.test.ts extensions/policy/src/policy-state.ts scripts/lib/policy-config-coverage.jsonc scripts/check-policy-config-coverage.ts && git diff --check

@clawsweeper re-review

clawsweeper · 2026-05-27T23:18:25Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

clawsweeper · 2026-05-27T23:18:27Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Failed
Detail: The targeted re-review did not finish cleanly. Check the workflow run for details.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26621544005
Updated: 2026-05-29T06:24:58.490Z

giodl73-repo · 2026-05-27T23:32:49Z

@clawsweeper re-review

clawsweeper · 2026-05-27T23:32:52Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26545003630
Updated: 2026-05-27T23:39:30.815Z

giodl73-repo · 2026-05-29T06:25:32Z

Refreshed #87074 after the lower policy stack landed and after #87056 was rebuilt.

Current signed head: 28e2e4a4a7301ae1c579c69017fa44a4af4272d4.

Branch cleanup:

rebuilt on top of refreshed Policy: add data handling conformance checks #87056 head ccaef4e32434286069b60ed8301235260a011504
removed already-merged sandbox, ingress, and policy-compare stack commits
replayed only:
- feat(policy): add data handling conformance checks
- fix(policy): reject unsupported policy keys
PR diff remains scoped to the Policy docs/state/doctor validation files:
- docs/cli/policy.md
- docs/plugins/reference/policy.md
- extensions/policy/src/doctor/register.test.ts
- extensions/policy/src/doctor/register.ts
- extensions/policy/src/policy-state.ts

Fresh validation on this rebuilt head:

OPENCLAW_VITEST_FS_MODULE_CACHE_PATH=/tmp/openclaw-87074-refresh OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts extensions/policy/src/cli.test.ts -- --reporter=dot --testTimeout=30000 -> 2 files, 285 tests passed
pnpm exec oxfmt --check --threads=1 docs/cli/policy.md docs/plugins/reference/policy.md extensions/policy/src/doctor/register.test.ts extensions/policy/src/doctor/register.ts extensions/policy/src/policy-state.ts && git diff --check -> passed
node scripts/run-bundled-extension-oxlint.mjs -> 0 warnings, 0 errors
pnpm docs:check-mdx docs/cli/policy.md docs/plugins/reference/policy.md -> passed
pnpm tsgo:extensions -> passed

No new public config or plugin surface was added by the refresh. The top commit tightens Policy validation by rejecting unsupported policy keys.

@clawsweeper re-review

clawsweeper · 2026-05-29T06:25:35Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26648930391
Updated: 2026-05-29T16:30:33.804Z

giodl73-repo · 2026-06-01T03:36:15Z

Rebuilt this stack entry on the refreshed data-handling policy head and force-pushed. Focused proof from the stack: policy doctor tests pass (256/256), oxfmt check passes for touched policy/docs files, and git diff --check passes. @clawsweeper re-review

clawsweeper · 2026-06-01T03:36:18Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

clawsweeper · 2026-06-01T03:41:42Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26763411606
Updated: 2026-06-01T15:14:36.213Z

giodl73-repo · 2026-06-02T17:59:22Z

Rebuilt this PR after #87056 merged.

Current head: a313264a1ecf5ecc8a887cabc12f95774271e722
Base: current main at 1d3cfc4b016 from #87056

Scope after rebuild is back to the unsupported-policy-key change only:

docs/cli/policy.md
extensions/policy/src/doctor/register.ts
extensions/policy/src/doctor/register.test.ts

Proof from /root/src/openclaw-pr-87074-rebuild on the rebuilt head:

PASS: OPENCLAW_VITEST_FS_MODULE_CACHE_PATH=/tmp/openclaw-87074-rebuilt-cache OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts --reporter=dot --testTimeout=30000
- 1 file, 256 tests passed
PASS: node scripts/run-bundled-extension-oxlint.mjs --tsconfig ./tsconfig.json extensions/policy/src/doctor/register.ts extensions/policy/src/doctor/register.test.ts
- 0 warnings, 0 errors
PASS: pnpm exec oxfmt --check docs/cli/policy.md extensions/policy/src/doctor/register.ts extensions/policy/src/doctor/register.test.ts && git diff --check

Codex-review note: I attempted the review closeout, but the local Codex reviewer is currently blocked by account/model mismatch: gpt-5.3-codex model is not supported when using Codex with a ChatGPT account. I did not mark that review as passed.

Maintainer boundary note: this still touches policy/config compatibility behavior, so please keep the compatibility/security-boundary review expectation on it. The rebuild did not add plugin surface or unrelated config surface changes.

@clawsweeper re-review

clawsweeper · 2026-06-02T17:59:25Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26840313505
Updated: 2026-06-02T18:42:32.466Z

giodl73-repo · 2026-06-02T19:23:34Z

Refined the shape validator after reviewer concern about repeated section names.

Current head: 78a7203f79488997b66d035ebb1b08b473869d08

Change since prior proof:

centralized the supported top-level policy sections in SUPPORTED_POLICY_SECTIONS
centralized Gateway policy subsections in SUPPORTED_GATEWAY_POLICY_SECTIONS
kept the existing generic unsupportedPolicyKey() path, messages, targets, and behavior
no new public policy/config/plugin surface; this is an internal readability/maintenance refactor for the strict-key validator

Fresh proof from /root/src/openclaw-pr-87074-rebuild:

PASS: OPENCLAW_VITEST_FS_MODULE_CACHE_PATH=/tmp/openclaw-87074-section-refactor-cache OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts --reporter=dot --testTimeout=30000
- 1 file, 256 tests passed
PASS: node scripts/run-bundled-extension-oxlint.mjs --tsconfig ./tsconfig.json extensions/policy/src/doctor/register.ts extensions/policy/src/doctor/register.test.ts
- 0 warnings, 0 errors
PASS: pnpm exec oxfmt --check --threads=1 docs/cli/policy.md extensions/policy/src/doctor/register.ts extensions/policy/src/doctor/register.test.ts && git diff --check

@clawsweeper re-review

clawsweeper · 2026-06-02T19:23:37Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26842794799
Updated: 2026-06-02T19:30:59.571Z

giodl73-repo · 2026-06-02T20:19:04Z

Addressed the ClawSweeper finding from https://github.com/openclaw/clawsweeper/actions/runs/26842794799.

Current head: 2f5c45020fe

Change:

Removed the false allowlist entries for tools.settings and tools.entries.
Added regression coverage that rejects both unsupported tools stubs.
No new policy/config/plugin surface is being introduced here; this explicitly rejects those unsupported shapes instead of implementing them.

Behavior proof:

policyCheckCommand({ json: true }) with { "tools": { "settings": {} } } exits 1 with policy/policy-jsonc-invalid, target oc://policy.jsonc/tools/settings, message policy.jsonc tools.settings is not supported in tools policy.
policyCheckCommand({ json: true }) with { "tools": { "entries": [] } } exits 1 with policy/policy-jsonc-invalid, target oc://policy.jsonc/tools/entries, message policy.jsonc tools.entries is not supported in tools policy.
policyCheckCommand({ json: true }) with { "network": { "privateNetwork": { "allow": false, "unknownRule": true } } } exits 1 with policy/policy-jsonc-invalid, target oc://policy.jsonc/network/privateNetwork/unknownRule.
policyCompareCommand({ json: true }) for a baseline without unknownRule and candidate with unknownRule exits 1 with policy/policy-conformance-invalid, target oc://candidate.policy.jsonc/network/privateNetwork/unknownRule.

Validation:

OPENCLAW_VITEST_FS_MODULE_CACHE_PATH=/tmp/openclaw-87074-tools-shape-cache OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts --reporter=dot --testTimeout=30000 passed: 256 tests.
node scripts/run-bundled-extension-oxlint.mjs --tsconfig ./tsconfig.json extensions/policy/src/doctor/register.ts extensions/policy/src/doctor/register.test.ts passed: 0 warnings/errors.
pnpm exec oxfmt --check --threads=1 docs/cli/policy.md extensions/policy/src/doctor/register.ts extensions/policy/src/doctor/register.test.ts && git diff --check passed.

Note: full pnpm openclaw policy check --json still cannot start in this local checkout because the dev rebuild fails before policy code in the unrelated diagnostics OTEL dependency chain: protobufjs/ext/descriptor.js imports missing google/protobuf/descriptor.json. The proof above exercises the production policy command functions directly through tsx and covers the exact finding targets.

@clawsweeper re-review

clawsweeper · 2026-06-02T20:19:07Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26845658082
Updated: 2026-06-02T20:26:18.862Z

giodl73-repo · 2026-06-02T20:52:53Z

Compatibility/security-boundary strictness decision:

Maintainer decision: we accept this strictness for this PR. The keys now rejected are not documented policy spec fields and are not represented in the policy rule metadata/evaluation model, so this is fail-closed validation for unsupported policy shape rather than removal of a supported surface.

Expected upgrade impact: an existing operator policy.jsonc containing unknown sections/rule keys may now fail openclaw policy check, openclaw policy compare, or openclaw doctor --lint. For the policy conformance/security boundary, that is the intended behavior here: unknown policy keys should not be silently accepted because that can make operators believe an undefined rule is being enforced.

Merge note: the current allowlists are intended to cover the supported policy rules; unknown keys should fail closed for this policy/security-boundary surface.

giodl73-repo · 2026-06-02T22:02:10Z

Merged via squash.

Prepared head SHA: 3ab4ff1d8f770a75da665b9502a4ff9d3b8d9519
Merge commit: 646974b7d8fbedcd4eee4ca5de455165737a77c4

Thanks @giodl73-repo!

openclaw-barnacle Bot added docs Improvements or additions to documentation extensions: policy size: XL maintainer Maintainer-authored PR labels May 26, 2026

giodl73-repo mentioned this pull request May 26, 2026

test(policy): add config coverage report #87081

Merged

galiniliev assigned steipete and galiniliev and unassigned steipete May 27, 2026

giodl73-repo force-pushed the policy-shape-validation-consistency branch from c6b6696 to b6edcc0 Compare May 27, 2026 18:51

clawsweeper Bot mentioned this pull request May 27, 2026

Policy: add data handling conformance checks #87056

Merged

giodl73-repo force-pushed the policy-shape-validation-consistency branch from b6edcc0 to a54b155 Compare May 27, 2026 23:12

clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels May 27, 2026

clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels May 27, 2026

clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels May 29, 2026

RomneyDa added the dependency-guard-backfill label May 29, 2026

RomneyDa removed the dependency-guard-backfill label May 29, 2026

clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. and removed rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. labels May 29, 2026

giodl73-repo added 3 commits June 2, 2026 14:51

fix(policy): reject unsupported policy keys

7311f7d

refactor(policy): centralize supported policy sections

1ca7aa6

fix(policy): reject unsupported tools policy stubs

3ab4ff1

github-actions Bot mentioned this pull request Jun 2, 2026

📡 Upstream Digest — 2026-06-02 22:17 UTC curtismercier/openclaw-mods#1004

Open

Uh oh!

Uh oh!

Conversation

giodl73-repo commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Contract

Behavior

Usage

Validation

Uh oh!

clawsweeper Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Hatch command

Uh oh!

galiniliev commented May 27, 2026

Uh oh!

giodl73-repo commented May 27, 2026

Uh oh!

clawsweeper Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented May 27, 2026

Uh oh!

clawsweeper Bot commented May 27, 2026

Uh oh!

clawsweeper Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented May 27, 2026

Uh oh!

clawsweeper Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented May 29, 2026

Uh oh!

clawsweeper Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jun 1, 2026

Uh oh!

clawsweeper Bot commented Jun 1, 2026

Uh oh!

clawsweeper Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jun 2, 2026

Uh oh!

clawsweeper Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jun 2, 2026

Uh oh!

clawsweeper Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jun 2, 2026

Uh oh!

clawsweeper Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jun 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

giodl73-repo commented May 26, 2026 •

edited

Loading

clawsweeper Bot commented May 26, 2026 •

edited

Loading

clawsweeper Bot commented May 26, 2026 •

edited

Loading

clawsweeper Bot commented May 27, 2026 •

edited

Loading

clawsweeper Bot commented May 27, 2026 •

edited

Loading

clawsweeper Bot commented May 27, 2026 •

edited

Loading

clawsweeper Bot commented May 29, 2026 •

edited

Loading

clawsweeper Bot commented Jun 1, 2026 •

edited

Loading

clawsweeper Bot commented Jun 2, 2026 •

edited

Loading

clawsweeper Bot commented Jun 2, 2026 •

edited

Loading

clawsweeper Bot commented Jun 2, 2026 •

edited

Loading

giodl73-repo commented Jun 2, 2026 •

edited

Loading