test(policy): add config coverage report by giodl73-repo · Pull Request #87081 · openclaw/openclaw

giodl73-repo · 2026-05-26T23:44:18Z

Summary

This is the final policy-series maintainer follow-up. It adds an internal, report-only coverage inventory for the OpenClaw config fields that Policy currently watches for conformance or attestation drift.- adds pnpm policy:config-coverage- keeps the tool internal to repo maintainers, not an openclaw policy user command- classifies monitored config leaf paths as observed by the policy surface- supports --check, --json, and --show-covered for policy maintainer workflowsDefault mode is intentionally report-only so ordinary config PRs do not have to update Policy. Policy maintainers can run pnpm policy:config-coverage --check when they want unclassified or stale monitored paths to fail locally.## Stack noteThis branch is currently opened against main for GitHub visibility, but the reviewable change is the final commit:- 66eb73dbb19 test(policy): add config coverage reportIt is stacked after the active policy line, including #85572, #85744, #86768, #87056, and #87074.## Verification- pnpm policy:config-coverage --check- pnpm policy:config-coverage --check --json- pnpm exec oxfmt --check --threads=1 package.json scripts/check-policy-config-coverage.ts scripts/lib/policy-config-coverage.jsonc- pnpm tsgo:core- node scripts/run-oxlint.mjs --tsconfig config/tsconfig/oxlint.scripts.json scripts/check-policy-config-coverage.ts- git diff --check- ~/.codex/skills/codex-review/scripts/codex-review --mode local

Update after stale-pattern review

Head 24733ac67d addresses the latest P1 review finding by reporting monitored patterns that no longer match any generated config leaf. These unmatched monitored patterns now appear in text output, appear in JSON as unmatchedMonitored, set ok: false, and make --check exit nonzero unless covered by an explicit allowNoSchemaPath classification.

Additional proof on the pushed head:

PASS: pnpm policy:config-coverage --check --json -> ok: true, monitoredPaths: 209, unclassified: [], unmatchedMonitored: [], stale: [].
PASS: pnpm policy:config-coverage --check --show-covered.
PASS: node scripts/run-oxlint.mjs --tsconfig config/tsconfig/oxlint.scripts.json scripts/check-policy-config-coverage.ts.
PASS: pnpm exec oxfmt --check --threads=1 package.json scripts/check-policy-config-coverage.ts scripts/lib/policy-config-coverage.jsonc.
PASS: OPENCLAW_VITEST_FS_MODULE_CACHE_PATH=/tmp/openclaw-87081-stale-pattern-ff-cache OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts extensions/policy/src/cli.test.ts --reporter=dot --testTimeout=30000 -> 2 files, 310 tests passed.
PASS: pnpm tsgo:core.
PASS: git diff --check.

Negative proof: temporarily added monitored pattern zz.codexNegativeProof.missing; pnpm policy:config-coverage --check --json exited nonzero with ok: false and unmatchedMonitored: [{ "pattern": "zz.codexNegativeProof.missing" }]. The temporary pattern was removed before commit.

socket-security · 2026-05-26T23:45:01Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Low adoption: npm `@snazzah/davey-android-arm-eabi` Location: Package overview From: extensions/discord/npm-shrinkwrap.json → `npm/@discordjs/[email protected]` → `npm/@snazzah/[email protected]` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@snazzah/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@snazzah/davey-android-arm64` Location: Package overview From: extensions/discord/npm-shrinkwrap.json → `npm/@discordjs/[email protected]` → `npm/@snazzah/[email protected]` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@snazzah/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@snazzah/davey-darwin-arm64` Location: Package overview From: extensions/discord/npm-shrinkwrap.json → `npm/@discordjs/[email protected]` → `npm/@snazzah/[email protected]` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@snazzah/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@snazzah/davey-darwin-x64` Location: Package overview From: extensions/discord/npm-shrinkwrap.json → `npm/@discordjs/[email protected]` → `npm/@snazzah/[email protected]` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@snazzah/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@snazzah/davey-freebsd-x64` Location: Package overview From: extensions/discord/npm-shrinkwrap.json → `npm/@discordjs/[email protected]` → `npm/@snazzah/[email protected]` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@snazzah/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@snazzah/davey-linux-arm-gnueabihf` Location: Package overview From: extensions/discord/npm-shrinkwrap.json → `npm/@discordjs/[email protected]` → `npm/@snazzah/[email protected]` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@snazzah/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@snazzah/davey-linux-arm64-gnu` Location: Package overview From: extensions/discord/npm-shrinkwrap.json → `npm/@discordjs/[email protected]` → `npm/@snazzah/[email protected]` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@snazzah/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@snazzah/davey-linux-arm64-musl` Location: Package overview From: extensions/discord/npm-shrinkwrap.json → `npm/@discordjs/[email protected]` → `npm/@snazzah/[email protected]` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@snazzah/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@snazzah/davey-wasm32-wasi` Location: Package overview From: extensions/discord/npm-shrinkwrap.json → `npm/@discordjs/[email protected]` → `npm/@snazzah/[email protected]` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@snazzah/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@snazzah/davey-win32-arm64-msvc` Location: Package overview From: extensions/discord/npm-shrinkwrap.json → `npm/@discordjs/[email protected]` → `npm/@snazzah/[email protected]` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@snazzah/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@snazzah/davey-win32-ia32-msvc` Location: Package overview From: extensions/discord/npm-shrinkwrap.json → `npm/@discordjs/[email protected]` → `npm/@snazzah/[email protected]` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@snazzah/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

clawsweeper · 2026-05-26T23:46:43Z

Codex review: needs changes before merge. Reviewed June 26, 2026, 9:21 PM ET / 01:21 UTC.

Summary
Adds an internal pnpm policy:config-coverage package script, TypeScript report/check script, and JSONC inventory for Policy-monitored config leaf coverage.

PR surface: Config +1, Other +993. Total +994 across 3 files.

Reproducibility: yes. Source inspection shows unmatchedMonitored can be bypassed by broad allowNoSchemaPath patterns, and the inventory contains such a broad agent-tools pattern.

Review metrics: 1 noteworthy metric.

Runtime config surfaces: 0 added, 0 changed, 0 removed. The diff inventories existing config leaves; the merge risk is report accuracy for Policy maintainers, not an upgrade migration.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦞 diamond lobster
Patch quality: 🦐 gold shrimp
Result: needs maintainer review before merge.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Make allowNoSchemaPath suppression exact and include a negative proof or regression check for a monitored path hidden by a broad waiver.
[P2] After the repair, ask a reviewer or maintainer to supersede the outdated requested-changes review.

Risk before merge

[P1] Broad allowNoSchemaPath classifications can still make --check pass for missing monitored security/tool config paths, giving Policy maintainers false confidence from the report.
[P1] The live PR has the protected maintainer label and GitHub still reports CHANGES_REQUESTED; a reviewer or maintainer should supersede that state after the narrow repair.

Maintainer options:

Make no-schema waivers exact before merge (recommended)
Tighten unmatchedMonitored so broad allowNoSchemaPath patterns cannot suppress missing monitored paths, then rerun the report and a negative stale-path proof.
Accept broad waiver semantics explicitly
Maintainers can decide that broad allowNoSchemaPath entries are intentional waivers, but that should be a visible product/security-maintenance choice before merge.
Pause until reviewer state is refreshed
If the coverage baseline cannot be reviewed now, leave the PR open and ask a reviewer to supersede the stale requested-changes review after the guard semantics are resolved.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Fix `scripts/check-policy-config-coverage.ts` so unmatched monitored paths are exempted only by an explicit same-pattern `allowNoSchemaPath` classification, add or document focused negative proof for a stale monitored path that would otherwise be hidden by a broad waiver such as `agents.*.tools.**`, and rerun the policy coverage report plus focused script lint/format checks. Do not change runtime policy/config behavior.

Next step before merge

[P2] A narrow automated repair can tighten the stale-pattern guard without choosing product direction; maintainer review is still needed afterward for the protected baseline.

Security
Needs attention: No new dependency or runtime secret-handling path was found, but the coverage baseline can falsely pass stale security-related monitored paths until no-schema exemptions are tightened.

Review findings

[P2] Require exact no-schema exemptions — scripts/check-policy-config-coverage.ts:80

Review details

Best possible solution:

Keep the internal report shape, but make no-schema exemptions exact or explicitly classified so --check cannot hide stale monitored security/config paths.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection shows unmatchedMonitored can be bypassed by broad allowNoSchemaPath patterns, and the inventory contains such a broad agent-tools pattern.

Is this the best way to solve the issue?

No. The report is the right owner-boundary shape, but the stale-path exemption should be exact or explicitly classified before this becomes the maintainer baseline.

Full review comments:

[P2] Require exact no-schema exemptions — scripts/check-policy-config-coverage.ts:80
unmatchedMonitored currently treats any allowNoSchemaPath classification pattern as an exemption when it matches the monitored pattern. Because the inventory includes broad waivers such as agents.*.tools.**, a removed monitored path under that subtree would still pass --check, so the stale-pattern guard can miss the drift it was added to catch. Make these exemptions exact, or add explicit no-schema classifications for each intentional missing monitored path.
Confidence: 0.86

Overall correctness: patch is incorrect
Overall confidence: 0.86

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 072d3ed7b5e4.

Label changes

Label changes:

add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (terminal): The PR body and comments include terminal proof for the report/check happy path plus a negative stale-pattern case; that satisfies the proof gate even though code review found an untested broad-waiver path.
remove rating: 🐚 platinum hermit: Current PR rating is rating: 🦐 gold shrimp, so this older rating label is no longer current.
remove status: 👀 ready for maintainer look: Current PR status label is status: ⏳ waiting on author.

Label justifications:

P2: This is a bounded maintainer-tooling correctness issue with security-sensitive policy coverage impact, but it does not break a live user workflow.
merge-risk: 🚨 security-boundary: Merging an inaccurate Policy coverage baseline could hide drift in auth, gateway, sandbox, secrets, tools, or other security-relevant config leaves.
rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (terminal): The PR body and comments include terminal proof for the report/check happy path plus a negative stale-pattern case; that satisfies the proof gate even though code review found an untested broad-waiver path.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body and comments include terminal proof for the report/check happy path plus a negative stale-pattern case; that satisfies the proof gate even though code review found an untested broad-waiver path.

Evidence reviewed

PR surface:

Config +1, Other +993. Total +994 across 3 files.

View PR surface stats

Area	Files	Added	Net
Source	0	0	0
Tests	0	0	0
Docs	0	0	0
Config	1	1	+1
Generated	0	0	0
Other	2	993	+993
Total	3	994	+994

Security concerns:

[medium] Broad no-schema waiver hides policy drift — scripts/check-policy-config-coverage.ts:80
The new report covers security-sensitive Policy config leaves, and broad allowNoSchemaPath matching can hide stale monitored paths from --check. That weakens the report as a security-maintenance guard even though it is report-only.
Confidence: 0.84

Acceptance criteria:

[P1] pnpm policy:config-coverage --check --json.
[P1] node scripts/run-oxlint.mjs --tsconfig config/tsconfig/oxlint.scripts.json scripts/check-policy-config-coverage.ts.
[P1] pnpm exec oxfmt --check --threads=1 package.json scripts/check-policy-config-coverage.ts scripts/lib/policy-config-coverage.jsonc.
[P1] git diff --check.

What I checked:

Live PR surface: Live GitHub state shows the PR is open, non-draft, mergeable, protected by the maintainer label, and changes package.json, scripts/check-policy-config-coverage.ts, and scripts/lib/policy-config-coverage.jsonc. (689734541b7a)
Current main gap: Current main has no policy:config-coverage or policy-config-coverage script/file, so the central PR work is not implemented on main. (072d3ed7b5e4)
Stale-pattern guard issue: The new unmatched monitored-pattern check suppresses missing schema paths when any allowNoSchemaPath classification pattern matches the monitored pattern, which lets broad waiver patterns mask stale monitored entries. (scripts/check-policy-config-coverage.ts:79, 689734541b7a)
Broad no-schema waiver: The inventory includes a broad agents.*.tools.** classification with allowNoSchemaPath: true, so a stale monitored path under agent tool config could be exempted without an exact classification. (scripts/lib/policy-config-coverage.jsonc:592, 689734541b7a)
Coverage source contract: The script correctly builds its leaf inventory from renderConfigDocBaselineArtifacts, which returns core, channel, and plugin baseline entries for generated config documentation. (src/config/doc-baseline.ts:571, 072d3ed7b5e4)
Policy observes concrete gateway leaves: Current Policy evidence scans the concrete Gateway Control UI leaves that the inventory now classifies, matching the earlier maintainer review direction. (extensions/policy/src/policy-state.ts:895, 072d3ed7b5e4)

Likely related people:

giodl73-repo: Authored and merged multiple related Policy conformance PRs that introduced the policy surfaces this coverage report inventories. (role: recent policy feature contributor; confidence: high; commits: af64a824a1f8, 1d3cfc4b0168, 646974b7d8fb; files: extensions/policy/src/doctor/register.ts, extensions/policy/src/policy-state.ts, docs/cli/policy.md)
vincentkoc: Authored the merged config-baseline split that provides the renderConfigDocBaselineArtifacts contract consumed by this PR's script. (role: config baseline feature owner; confidence: high; commits: f5c3b409ea74; files: src/config/doc-baseline.ts, scripts/generate-config-doc-baseline.ts, src/config/doc-baseline.integration.test.ts)
galiniliev: Reviewed the first version of this coverage inventory and identified the concrete Gateway schema-path issue that shaped the current branch. (role: exact PR reviewer; confidence: medium; commits: 66eb73dbb199; files: scripts/lib/policy-config-coverage.jsonc, scripts/check-policy-config-coverage.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

clawsweeper · 2026-05-26T23:51:12Z

ClawSweeper PR egg

✨ Hatched: 🌱 uncommon Neon Merge Sprite

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

Merged PRs are hatchable.
Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

Rarity: 🌱 uncommon.
Trait: purrs at green checks.
Image traits: location artifact grotto; accessory green check lantern; palette violet, aqua, and starlight; mood bright-eyed; pose pointing at a small proof artifact; shell paper lantern shell; lighting cool dashboard glow; background gentle dashboard dots.
Share on X: post this hatch
Copy: My PR egg hatched a 🌱 uncommon Neon Merge Sprite in ClawSweeper.

What is this egg doing here?

Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

galiniliev · 2026-05-27T03:04:51Z

+    "gateway.auth.mode",
+    "gateway.auth.rateLimit.*",
+    "gateway.bind",
+    "gateway.controlUi.allowInsecure",


This monitored path does not exist in the config schema. The concrete Control UI leaves Policy scans are gateway.controlUi.allowInsecureAuth, gateway.controlUi.dangerouslyDisableDeviceAuth, and gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback; similarly the Tailscale and HTTP entries below use gateway.tailscale.mode / preserveFunnel and gateway.http.endpoints.<endpoint>... paths. Since the matching classifications are allowed to have no schema path, --check can pass while these real gateway exposure leaves are not counted. Please classify the concrete schema paths, including the HTTP URL-fetch allowUrl leaves that drive the allowlist policy.

Fixed in 7b9b6865da2.

The coverage inventory now monitors/classifies the concrete schema leaves Policy actually observes:

gateway.controlUi.allowInsecureAuth

gateway.controlUi.dangerouslyDisableDeviceAuth

gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback

gateway.tailscale.mode

gateway.tailscale.preserveFunnel

gateway.http.endpoints.*.enabled

gateway.http.endpoints.*.*.allowUrl

gateway.http.endpoints.*.*.urlAllowlist.*

I also removed the allowNoSchemaPath escape for those Gateway classifications so stale synthetic paths no longer pass --check. pnpm policy:config-coverage -- --check --show-covered now reports no stale classifications and shows the concrete Gateway leaves covered.

galiniliev

This PR adds an internal maintainer report for Policy config coverage. The useful part is the final stacked commit, which wires pnpm policy:config-coverage to a new script and classification inventory.

Findings: request changes.

LOC: +10770/-1861 (12 files). Final commit 66eb73dbb199705d30343ded51f4e04391bd87e8: +922/-0 (3 files).

Blocking: the gateway coverage inventory uses non-schema or stale paths, so --check can report success while omitting real Policy-observed gateway exposure config. The new inventory monitors/classifies gateway.controlUi.allowInsecure, gateway.tailscale.funnel, and gateway.http.* / gateway.http.*.urlAllowlist.*, but the schema and Policy evidence use gateway.controlUi.allowInsecureAuth, gateway.controlUi.dangerouslyDisableDeviceAuth, gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback, gateway.tailscale.mode, gateway.tailscale.preserveFunnel, and gateway.http.endpoints.<endpoint>... including the URL-fetch allowUrl leaves. Because the current entries either do not match the baseline at all or are hidden behind allowNoSchemaPath, the report undercounts the exact security/config leaves it is meant to inventory. Please switch these to the concrete schema paths and include the URL-fetch allowUrl paths that Policy uses to decide whether an allowlist is required.

Best fix verdict: the script shape is reasonable, but the coverage source data needs correction before merge; otherwise this becomes a false confidence report for gateway policy coverage.

Evidence read: scripts/check-policy-config-coverage.ts, scripts/lib/policy-config-coverage.jsonc, src/config/zod-schema.ts, src/config/doc-baseline.ts, extensions/policy/src/policy-state.ts, extensions/policy/src/doctor/register.ts.

Verification run: node --import tsx -e 'import {renderConfigDocBaselineArtifacts, flattenConfigDocBaselineEntries} from "./src/config/doc-baseline.ts"; const {baseline}=await renderConfigDocBaselineArtifacts(); for (const e of flattenConfigDocBaselineEntries(baseline).filter(e=>!e.hasChildren && /^(gateway\\.controlUi\\.(allowInsecure|allowInsecureAuth|dangerouslyDisableDeviceAuth|dangerouslyAllowHostHeaderOriginFallback)|gateway\\.tailscale\\.(funnel|mode|preserveFunnel)|gateway\\.http\\.)/.test(e.path)).map(e=>e.path).sort()) console.log(e);'

giodl73-repo · 2026-05-27T18:56:55Z

@galiniliev fixed the Gateway inventory issue in 7b9b6865da2.

What changed:

replaced stale gateway.controlUi.allowInsecure with the concrete schema leaves:
- gateway.controlUi.allowInsecureAuth
- gateway.controlUi.dangerouslyDisableDeviceAuth
- gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback
replaced synthetic gateway.tailscale.funnel with:
- gateway.tailscale.mode
- gateway.tailscale.preserveFunnel
replaced synthetic HTTP patterns with concrete endpoint paths:
- gateway.http.endpoints.*.enabled
- gateway.http.endpoints.*.*.allowUrl
- gateway.http.endpoints.*.*.urlAllowlist.*
removed allowNoSchemaPath from those Gateway classifications so stale paths fail --check.

Fresh validation:

pnpm policy:config-coverage -- --check --show-covered -> 204 monitored config leaf paths, no unclassified paths, no stale classifications; Gateway observed count is 22 and includes the concrete Control UI, Tailscale, endpoint, allowUrl, and urlAllowlist leaves.
pnpm exec oxfmt --check --threads=1 scripts/lib/policy-config-coverage.jsonc scripts/check-policy-config-coverage.ts && git diff --check
OPENCLAW_VITEST_FS_MODULE_CACHE_PATH=/tmp/openclaw-87081-coverage-rebase OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts extensions/policy/src/cli.test.ts -- --reporter=dot --testTimeout=30000 -> 2 files, 282 tests passed
pnpm tsgo:extensions

@clawsweeper re-review

clawsweeper · 2026-05-27T18:56:58Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26532180010
Updated: 2026-05-27T19:07:41.629Z

socket-security · 2026-05-27T23:14:10Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/undici@8.3.0
	npm/libopus-wasm@0.1.0
	npm/@shikijs/langs@4.1.0
	npm/@pierre/theme@1.0.3
	npm/playwright-core@1.60.0
	npm/@pierre/diffs@1.2.3
	npm/zca-js@2.1.2
	npm/discord-api-types@0.38.48

View full report

giodl73-repo · 2026-05-27T23:18:23Z

Rebased #87081 over the cleaned unsupported-key branch after removing the release-owned changelog edit from the lower policy stack.

Current signed head: 881cfe97328.

Validation:

OPENCLAW_VITEST_FS_MODULE_CACHE_PATH=/tmp/openclaw-87081-stack-final OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts extensions/policy/src/cli.test.ts -- --reporter=dot --testTimeout=30000 -> 2 files, 285 tests passed
pnpm policy:config-coverage -- --check --show-covered -> passed; concrete Gateway leaves remain covered and no stale classification was reported
pnpm tsgo:extensions
node scripts/run-bundled-extension-oxlint.mjs -> 0 warnings, 0 errors
pnpm exec oxfmt --check --threads=1 docs/cli/policy.md docs/plugins/reference/policy.md extensions/policy/src/doctor/register.ts extensions/policy/src/doctor/register.test.ts extensions/policy/src/policy-state.ts scripts/lib/policy-config-coverage.jsonc scripts/check-policy-config-coverage.ts && git diff --check

@clawsweeper re-review

giodl73-repo · 2026-06-19T15:16:01Z

Rebased #87081 onto current origin/main and pushed current head 373f83cd0eb3846e5def46d03bc2256be6536091.

Result:

Resolved the package.json rebase conflict by preserving current main's plugin-sdk:usage memory flag and keeping the new policy:config-coverage script.
Adapted scripts/check-policy-config-coverage.ts to current main's config doc baseline API after flattenConfigDocBaselineEntries stopped being exported; the script now flattens the rendered baseline arrays locally.
Live PR state is now MERGEABLE; fresh GitHub checks are pending from the push.

Validation from /root/src/openclaw-policy-data-handling:

PASS: pnpm policy:config-coverage --check --json
- ok: true, monitoredPaths: 209, unclassified: [], stale: []
PASS: node scripts/run-oxlint.mjs --tsconfig config/tsconfig/oxlint.scripts.json scripts/check-policy-config-coverage.ts
PASS: pnpm exec oxfmt --check --threads=1 package.json scripts/check-policy-config-coverage.ts scripts/lib/policy-config-coverage.jsonc && git diff --check
PASS: OPENCLAW_VITEST_FS_MODULE_CACHE_PATH=/tmp/openclaw-87081-20260619-policy-cache OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts extensions/policy/src/cli.test.ts --reporter=dot --testTimeout=30000
- 2 files, 310 tests passed
PASS: pnpm tsgo:core

@clawsweeper re-review

clawsweeper · 2026-06-19T15:16:03Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-06-20T02:56:42Z

@clawsweeper re-review

Pushed 24733ac67d to address the latest P1 stale monitored-pattern finding.

Change made:

scripts/check-policy-config-coverage.ts now computes monitored patterns that match no generated config leaf.
Text output reports them under "Monitored patterns with no matching config paths".
JSON output includes unmatchedMonitored and sets ok: false when any are present.
--check exits nonzero when unmatched monitored patterns exist, unless the pattern is covered by an explicit allowNoSchemaPath classification.

Validation on the pushed head:

pnpm policy:config-coverage --check --json -> ok: true, monitoredPaths: 209, unclassified: [], unmatchedMonitored: [], stale: []
pnpm policy:config-coverage --check --show-covered
node scripts/run-oxlint.mjs --tsconfig config/tsconfig/oxlint.scripts.json scripts/check-policy-config-coverage.ts
pnpm exec oxfmt --check --threads=1 package.json scripts/check-policy-config-coverage.ts scripts/lib/policy-config-coverage.jsonc
OPENCLAW_VITEST_FS_MODULE_CACHE_PATH=/tmp/openclaw-87081-stale-pattern-ff-cache OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts extensions/policy/src/cli.test.ts --reporter=dot --testTimeout=30000 -> 2 files, 310 tests passed
pnpm tsgo:core
git diff --check

Negative proof: temporarily added monitored pattern zz.codexNegativeProof.missing; pnpm policy:config-coverage --check --json exited nonzero with ok: false and unmatchedMonitored: [{ "pattern": "zz.codexNegativeProof.missing" }]. The temporary pattern was removed before commit.

PR remains ready-for-review with maintainer-can-modify enabled; the old GitHub requested-changes review still needs reviewer/maintainer supersession after this code repair.

clawsweeper · 2026-06-20T02:56:45Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-06-26T18:08:10Z

Current exact-head readiness check for #87081:

Head: 24733ac67d0f81049fd63b3f256a57194b9c1d89
Non-draft and mergeable.
GitHub checks are green on the current head.
The remaining review thread is outdated and was addressed in the branch: concrete gateway schema paths were classified, and the later unmatchedMonitored guard prevents stale monitored patterns from passing --check silently.
Current proof remains: pnpm policy:config-coverage --check --json reports ok: true, unclassified: [], unmatchedMonitored: [], stale: []; focused policy doctor/CLI tests passed 310 tests; tsgo:core, oxfmt, oxlint, and git diff --check passed.

Requesting review refresh to supersede the stale requested-changes state.

giodl73-repo · 2026-06-27T01:28:42Z

Merged via squash.

Prepared head SHA: 689734541b7ac6f893f7ff9a0aa044dcef0a16e9
Merge commit: 4d0f19a96838f52f71ccf1048003826302d95b9c

Thanks @giodl73-repo!

openclaw-barnacle Bot added docs Improvements or additions to documentation scripts Repository scripts extensions: policy size: XL maintainer Maintainer-authored PR labels May 26, 2026

galiniliev assigned steipete May 27, 2026

galiniliev reviewed May 27, 2026

View reviewed changes

galiniliev requested changes May 27, 2026

View reviewed changes

galiniliev assigned galiniliev and unassigned steipete May 27, 2026

giodl73-repo force-pushed the policy-config-coverage-maintainer-tool branch from 66eb73d to 7b9b686 Compare May 27, 2026 18:56

clawsweeper Bot mentioned this pull request May 27, 2026

Policy: add data handling conformance checks #87056

Merged

giodl73-repo force-pushed the policy-config-coverage-maintainer-tool branch from 7b9b686 to 881cfe9 Compare May 27, 2026 23:13

giodl73-repo force-pushed the policy-config-coverage-maintainer-tool branch from b2550f7 to 373f83c Compare June 19, 2026 15:15

giodl73-repo requested a review from galiniliev June 26, 2026 18:08

giodl73-repo added 5 commits June 26, 2026 17:56

test(policy): add config coverage report

be4f238

fix(policy): classify concrete gateway coverage paths

c706158

fix(policy): avoid coverage script lint shadowing

a1017a0

fix(policy): adapt config coverage baseline flattening

2c7d031

fix(policy): fail stale monitored coverage paths

6897345

giodl73-repo force-pushed the policy-config-coverage-maintainer-tool branch from 24733ac to 6897345 Compare June 27, 2026 01:10

clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. labels Jun 27, 2026

Haderach-Ram mentioned this pull request Jun 27, 2026

Ecosystem Digest — 2026-06-27 Haderach-Ram/openclaw-radar#63

Open

github-actions Bot mentioned this pull request Jun 27, 2026

📡 Upstream Digest — 2026-06-27 02:29 UTC curtismercier/openclaw-mods#1157

Open

Uh oh!

Uh oh!

Conversation

giodl73-repo commented May 26, 2026 • edited by joshavant Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Update after stale-pattern review

Uh oh!

socket-security Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Hatch command

Uh oh!

galiniliev May 27, 2026

Choose a reason for hiding this comment

Uh oh!

giodl73-repo May 27, 2026

Choose a reason for hiding this comment

Uh oh!

galiniliev left a comment

Choose a reason for hiding this comment

Uh oh!

giodl73-repo commented May 27, 2026

Uh oh!

clawsweeper Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented May 27, 2026

Uh oh!

giodl73-repo commented Jun 19, 2026

Uh oh!

clawsweeper Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jun 20, 2026

Uh oh!

clawsweeper Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jun 26, 2026

Uh oh!

giodl73-repo commented Jun 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

giodl73-repo commented May 26, 2026 •

edited by joshavant

Loading

socket-security Bot commented May 26, 2026 •

edited

Loading

clawsweeper Bot commented May 26, 2026 •

edited

Loading

clawsweeper Bot commented May 26, 2026 •

edited

Loading

clawsweeper Bot commented May 27, 2026 •

edited

Loading

socket-security Bot commented May 27, 2026 •

edited

Loading

clawsweeper Bot commented Jun 19, 2026 •

edited

Loading

clawsweeper Bot commented Jun 20, 2026 •

edited

Loading