Add Vault SecretRef plugin by sallyom · Pull Request #89255 · openclaw/openclaw

sallyom · 2026-06-01T23:33:14Z

Summary

Adds a bundled vault plugin that provides a reference SecretRef exec provider for HashiCorp Vault KV.
Resolves SecretRefs through a Node-based resolver using VAULT_ADDR, VAULT_TOKEN, optional VAULT_NAMESPACE, and KV mount/version env vars, so no Vault CLI is required in the Gateway image.
Adds openclaw vault status and openclaw vault setup helpers for local and server workflows.
Documents the uncontainerized setup path first, plus container/K8s runtime env requirements and generated plugin inventory entries.

Linked context

Adding a reference implementation for the external SecretRef provider contract.

Real behavior proof

Behavior addressed: OpenClaw can configure and use the bundled vault SecretRef provider to resolve model provider credentials from a real Vault KV secret without storing plaintext provider keys in OpenClaw config.
Real environment tested: local uncontainerized OpenClaw source checkout on this PR branch, using an isolated temp OPENCLAW_STATE_DIR and OPENCLAW_CONFIG_PATH, a maintainer-provided HTTPS Vault endpoint, VAULT_TOKEN, OPENCLAW_VAULT_KV_MOUNT=users, and Vault id sallyom/openrouter/apiKey.
Secret material handling: the Vault token and resolved OpenRouter key were never printed. Proof output was redacted and checked that it did not contain the Vault secret path or API key prefix.
Exact steps run after this patch: enabled the bundled vault plugin in the temp config, generated a setup plan with pnpm openclaw vault setup --plan-out <plan> --openrouter-id sallyom/openrouter/apiKey, dry-ran pnpm openclaw secrets apply --from <plan> --dry-run --allow-exec --json, applied it with pnpm openclaw secrets apply --from <plan> --allow-exec --json, audited with pnpm openclaw secrets audit --allow-exec --json, then ran pnpm openclaw models list --provider openrouter --json.
Evidence after fix: setup plan generated successfully; dry-run and write apply paths returned JSON; the stored provider source was exec; plugin integration was { pluginId: "vault", integrationId: "vault" }; OpenRouter apiKey remained a SecretRef instead of plaintext.
Audit evidence: openclaw secrets audit --allow-exec --json reported status: "clean", refsChecked: 1, unresolvedRefCount: 0, and plaintextCount: 0.
OpenRouter probe evidence: openclaw models list --provider openrouter --json returned modelCount: 3 while using the Vault-backed SecretRef.
Fail-closed evidence: resolver tests cover missing-token and invalid-VAULT_ADDR behavior, including no returned value when token/address requirements are not met.
Observed result after fix: the local OpenClaw setup can read the real Vault-backed OpenRouter API key SecretRef, apply it into config as a plugin-managed exec SecretRef provider, audit it as resolved/non-plaintext, and use it for OpenRouter model listing.
Proof limitations or environment constraints: this proof intentionally used local deployment, not K8s. The models list command reported that gateway secrets.resolve was unavailable in the temp config and resolved command secrets locally; the earlier linked K8s smoke covers installer-configured deployment behavior.

From local run:

$ openclaw vault status --json
{
  "providerAlias": "vault",
  "provider": {
    "configured": true,
    "source": "exec",
    "pluginIntegration": {
      "pluginId": "vault",
      "integrationId": "vault"
    }
  },
  "resolverScript": "/app/dist/extensions/vault/vault-secret-ref-resolver.js",
  "vaultAddr": "https://vault.xxxxxx.com",
  "authMethod": "token",
  "authMount": "jwt",
  "hasJwtFile": false,
  "hasVaultTokenFile": false,
  "kvMount": "users",
  "kvVersion": "2",
  "hasVaultToken": true
}

Tests and validation

Commands run locally:

node scripts/run-vitest.mjs extensions/vault/src/secret-ref-resolver.test.ts extensions/vault/src/cli.test.ts src/secrets/apply.test.ts src/secrets/provider-integrations.test.ts
node scripts/run-oxlint.mjs --tsconfig config/tsconfig/oxlint.extensions.json extensions/vault
node --check extensions/vault/vault-secret-ref-resolver.js
git diff --check

Broad changed gate run in Blacksmith Testbox:

pnpm check:changed

Testbox result:

Provider: blacksmith-testbox.
Lease: tbx_01ktkvw57z4t3f2c82v1r2448b.
Actions run: https://github.com/openclaw/openclaw/actions/runs/27146514380.
Result: passed; typecheck, lint, and runtime import cycle checks completed with exit code 0.

Current PR CI snapshot at head 87fb72f88ed58760c49534a0f8288060a4020a0a:

Real behavior proof: pass.
Workflow sanity actionlint and no-tabs: pass.
tui-pty: in progress when this body was refreshed.
Several broad CI, CodeQL, and dependency-guard jobs were skipped by current path/check selection at this head.

Regression coverage added:

Resolver tests for manifest integration metadata, inline test values, KV v2 HTTP path/header behavior, per-id auth errors, and Vault error-body redaction.
CLI tests for setup plan generation, duplicate provider rejection, and traversal segment rejection.
Secrets apply coverage for plugin-managed exec provider upserts, restrictive plugin allowlists, and preserving an explicitly disabled plugin owner.

What failed before this fix:

OpenClaw had the SecretRef provider contract but no bundled Vault reference implementation.

Risk checklist

Did user-visible behavior change? Yes
Did config, environment, or migration behavior change? Yes
Did security, auth, secrets, network, or tool execution behavior change? Yes
Highest-risk area: SecretRef resolution now shells out to the bundled Node resolver, which reads Vault over the network using runtime env credentials.
Risk mitigation: the provider is opt-in, uses plugin-managed exec provider metadata, requires explicit SecretRefs, validates Vault address scheme, uses the plugin SDK SSRF guard scoped to the configured Vault host, returns per-id errors, avoids printing tokens or raw Vault error bodies, preserves explicitly disabled plugin owners during secrets apply, and has focused resolver/CLI/secrets tests plus extension boundary/type checks.

Current review state

Next action: maintainer/security review for the bundled exec resolver trust model.

Waiting on: tui-pty completion at the current head SHA.

Reviewer focus:

SecretRef provider manifest shape and plugin-managed exec integration.
Vault id/path convention (<vault-secret-path>/<field>) and KV v1/v2 behavior.
Bundled plugin exec resolver trust model: VAULT_TOKEN is passed through environment, network read is host-scoped to VAULT_ADDR, and failures do not echo secret values or raw Vault response bodies.
Auth env naming: OpenClaw-owned knobs use OPENCLAW_VAULT_*; standard HashiCorp Vault knobs remain VAULT_*.
Docs clarity for local shells, services, containers, and OpenShift token injection.

github-actions · 2026-06-01T23:33:31Z

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

extensions/vault/npm-shrinkwrap.json
extensions/vault/package.json
pnpm-lock.yaml

Maintainer follow-up:

Review whether the dependency changes are intentional.
Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.
Treat package-lock.json and npm-shrinkwrap.json diffs as security-review surfaces.
Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

github-actions · 2026-06-01T23:33:47Z

Dependency graph change authorized

This PR includes dependency graph changes. A repository admin or member of @openclaw/openclaw-secops authorized this exact head SHA with /allow-dependencies-change.

Approved SHA: 90d13e0becde6d2394ad3847dd479b940cbfc861
Approved by: @joshavant

A later push changes the PR head SHA and requires a fresh security approval.

clawsweeper · 2026-06-01T23:35:05Z

Codex review: needs maintainer review before merge. Reviewed July 9, 2026, 6:00 AM ET / 10:00 UTC.

Summary
The branch adds a bundled vault plugin with SecretRef exec-provider metadata, a Node Vault resolver, openclaw vault setup/status commands, docs, tests, package metadata, and a narrow SDK target lookup helper.

PR surface: Source +1099, Tests +1147, Docs +384, Config +33, Generated 0, Other +6. Total +2669 across 30 files.

Reproducibility: not applicable. as a bug reproduction; this is a new bundled integration. The PR body provides redacted live output for Vault-backed setup, apply, audit, status, and provider model listing.

Review metrics: 3 noteworthy metrics.

Vault Operator Surface: 1 provider, 12 env pass-through entries, 2 CLI subcommands. Operators must understand and support a new credential-bearing setup/status workflow and runtime environment contract.
Public SDK Surface: 2 exports added, 1 callable export added. The Vault setup path promotes target-path lookup through the plugin SDK, making the API surface compatibility-sensitive.
Dependency Graph Surface: 1 extension package, 1 shrinkwrap, 1 root lockfile entry. Credential-handling bundled plugin metadata and lock surfaces need supply-chain review before distribution.

Stored data model
Persistent data-model change detected: serialized state: extensions/vault/src/secret-ref-resolver.test.ts, serialized state: extensions/vault/vault-secret-ref-resolver.js. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Get explicit maintainer/security acceptance for the bundled Vault resolver trust model and support surface.

Risk before merge

[P1] Bundling Vault makes a vendor-specific enterprise credential backend an OpenClaw-distributed support surface instead of keeping it external on the existing plugin seam.
[P1] The resolver receives Vault authentication environment and reads secrets over the network, so the credential/process boundary needs explicit maintainer and security acceptance even though no concrete leak was found.
[P1] The PR expands public SDK and operator setup surfaces for credential configuration; green CI does not settle the long-term compatibility and ownership choice.

Maintainer options:

Approve bundled Vault ownership (recommended)
Maintainers can land this after explicitly accepting the credential resolver boundary, public SDK/setup surface, dependency metadata, and ongoing Vault support obligation.
Keep the integration external
Maintainers can pause or close this PR and ask for Vault to ship through ClawHub or an external plugin on the existing manifest integration contract.
Request targeted hardening first
Maintainers can require a narrow follow-up if security review identifies a missing guard, packaging change, or additional operator proof requirement.

Next step before merge

[P2] Manual maintainer/security review is the next action because the remaining blocker is bundled credential-boundary and ownership approval, not a narrow repair.

Maintainer decision needed

Question: Should OpenClaw bundle and maintain this Vault SecretRef exec provider, including its Vault auth env pass-through and network resolver, or keep Vault outside core on the existing plugin integration seam?
Rationale: The patch is technically plausible and proof-backed, but it crosses a credential and support boundary that automation cannot approve as product direction or security posture.
Likely owner: joshavant — Josh has both shipped SecretRef baseline history and current-head Vault hardening/dependency-approval context.
Options:
- Bundle after security approval (recommended): Approve this PR once maintainers accept the resolver trust model, Vault env pass-through, plugin enablement behavior, dependency metadata, and support surface as OpenClaw responsibilities.
- Keep Vault external: Pause or close this PR and direct Vault support to a ClawHub or external plugin because current main already has the generic SecretRef provider integration seam.
- Hold for hardening conditions: Keep the PR open while a named security owner defines any additional resolver, packaging, or operator-proof requirements before merge.

Security
Needs attention: No exploitable defect was confirmed, but the PR adds a credential-bearing network exec resolver and bundled package metadata that need maintainer/security approval.

Review details

Best possible solution:

Land only after maintainers explicitly accept bundled Vault ownership, resolver env pass-through, security posture, SDK/config setup behavior, and dependency metadata; otherwise keep Vault as an external or ClawHub plugin using the existing SecretRef integration seam.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction; this is a new bundled integration. The PR body provides redacted live output for Vault-backed setup, apply, audit, status, and provider model listing.

Is this the best way to solve the issue?

Unclear as product direction; technically it uses the existing plugin-managed SecretRef seam and the latest head fixes prior policy-boundary concerns. The remaining question is whether Vault should be bundled in OpenClaw rather than shipped externally.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f650d641e439.

Label changes

Label justifications:

P2: This is an opt-in bundled credential integration with meaningful maintainer/security review needs but limited immediate blast radius.
merge-risk: 🚨 compatibility: The PR adds a public SDK helper and setup/apply behavior that affect plugin policy, operator config, and upgrade expectations.
merge-risk: 🚨 auth-provider: The new provider resolves model credentials from Vault and forwards Vault authentication environment into the resolver process.
merge-risk: 🚨 security-boundary: The diff adds a network-capable exec resolver and package metadata in a credential-handling path, which requires maintainer/security acceptance beyond green CI.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): Sufficient live output is present: the PR body shows a redacted real Vault-backed setup/apply/status/audit path and OpenRouter model listing after the change.
proof: sufficient: Contributor real behavior proof is sufficient. Sufficient live output is present: the PR body shows a redacted real Vault-backed setup/apply/status/audit path and OpenRouter model listing after the change.

Evidence reviewed

PR surface:

Source +1099, Tests +1147, Docs +384, Config +33, Generated 0, Other +6. Total +2669 across 30 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	10	1099	0	+1099
Tests	5	1147	0	+1147
Docs	10	388	4	+384
Config	2	33	0	+33
Generated	1	2	2	0
Other	2	8	2	+6
Total	30	2677	8	+2669

Security concerns:

[medium] Credential-bearing Vault resolver needs approval — extensions/vault/vault-secret-ref-resolver.js:235
The resolver reads Vault secrets over HTTP(S) using Vault auth material, so the trust boundary, failure behavior, and ongoing maintenance responsibility need explicit security sign-off.
Confidence: 0.87
[medium] Vault auth environment is passed to plugin exec — extensions/vault/openclaw.plugin.json:26
The manifest forwards Vault token, token-file, namespace, JWT/Kubernetes auth, KV settings, and Node CA trust inputs into the resolver process, which is expected for the feature but security-sensitive.
Confidence: 0.86
[low] New bundled package metadata needs supply-chain review — extensions/vault/package.json:1
The extension package, shrinkwrap, and root lockfile entries place this credential plugin in the distributed package surface, so the dependency approval must stay tied to the exact head.
Confidence: 0.78

What I checked:

Repository policy read: Root AGENTS.md and scoped docs/extensions/plugin-sdk/scripts/test guides were read fully; the review applied the plugin boundary, generated-doc, SDK surface, dependency/security, and maintainer-label rules. (AGENTS.md:1, f650d641e439)
Current main has the generic SecretRef plugin seam: Current main already resolves trusted plugin-declared SecretRef integrations by plugin id and integration id, which is the existing boundary this PR uses. (src/secrets/provider-integrations.ts:325, f650d641e439)
Current main does not bundle the Vault plugin: Current main has no extensions/vault directory, so the bundled Vault implementation remains a unique proposed addition rather than already implemented on main. (f650d641e439)
PR manifest adds a credential-bearing exec integration: The Vault plugin manifest declares secretProviderIntegrations.vault as an exec provider using ${node}, the bundled resolver, 15s timeouts, 1 MiB output cap, and Vault/Node trust environment pass-through. (extensions/vault/openclaw.plugin.json:15, 90d13e0becde)
Resolver reads Vault over the network with scoped guards: The resolver validates VAULT_ADDR, keeps requests on the configured origin, disables redirects, reads the requested Vault field, and returns per-id protocol errors instead of raw secret values. (extensions/vault/vault-secret-ref-resolver.js:122, 90d13e0becde)
Latest commit preserves plugin policy boundaries: The latest head rejects globally disabled plugins, denied plugin owners, explicitly disabled plugin entries, and restrictive allowlists that do not include the plugin, fixing the earlier allowlist-widening concern. (src/secrets/apply.ts:223, 90d13e0becde)

Likely related people:

sallyom: Authored the merged SecretRef provider integration contract and the current Vault plugin proposal, so this person has the strongest feature-history connection beyond simply opening this PR. (role: introduced plugin integration contract and Vault implementation; confidence: high; commits: 6037a7466079, 7bc1e0c4a0f0, 70047770c9b7; files: src/secrets/provider-integrations.ts, src/plugins/manifest.ts, extensions/vault)
joshavant: Authored the shipped SecretRef schema/runtime foundations and the latest Vault PR hardening commits, including preserving plugin policy boundaries and approving the dependency graph at the current head. (role: recent secrets owner and PR hardening contributor; confidence: high; commits: 250aef1da409, 0ffcc308f2f1, 90d13e0becde; files: src/config/types.secrets.ts, src/secrets/apply.ts, extensions/vault/openclaw.plugin.json)
steipete: Carried the original external secrets landing stabilization and has recent security-sensitive secrets refactors around the same apply/runtime surfaces. (role: recent secrets hardening and landing-area contributor; confidence: medium; commits: 47fc6a0806d6, bbdcf2963b98, d84902f6896f; files: src/secrets/apply.ts, src/secrets/resolve.ts, docs/gateway/secrets.md)
vincentkoc: Recent history shows repeated performance and metadata work around SecretRef policy, target discovery, and runtime surfaces adjacent to this PR's setup/apply path. (role: recent adjacent secrets runtime contributor; confidence: medium; commits: bd20a920a2a3, 961eb95e9a88, b051b0511cb4; files: src/secrets/provider-integrations.ts, src/secrets/target-registry-query.ts, src/secrets/runtime.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (18 earlier review cycles; latest 8 shown)

reviewed 2026-07-08T12:17:23.195Z sha a96eceb :: needs maintainer review before merge. :: none
reviewed 2026-07-08T12:24:43.175Z sha a96eceb :: needs maintainer review before merge. :: none
reviewed 2026-07-08T22:19:59.593Z sha 6b8b05c :: found issues before merge. :: [P2] Move Vault setup target lookup behind a public seam
reviewed 2026-07-08T22:53:31.194Z sha fe1afb6 :: needs changes before merge. :: [P2] Preserve colons in auth-profile target paths
reviewed 2026-07-08T23:12:29.815Z sha fe1afb6 :: found issues before merge. :: [P2] Preserve colons in auth-profile target paths | [P2] Update the SDK surface budget with the new exports
reviewed 2026-07-09T00:02:34.895Z sha 1e958fd :: needs maintainer review before merge. :: none
reviewed 2026-07-09T00:11:02.917Z sha 1e958fd :: needs maintainer review before merge. :: none
reviewed 2026-07-09T09:10:53.996Z sha b9a3097 :: needs maintainer review before merge. :: none

Signed-off-by: sallyom <[email protected]>

joshavant · 2026-07-09T08:53:59Z

/allow-dependencies-change

joshavant · 2026-07-09T08:54:13Z

@clawsweeper re-review

clawsweeper · 2026-07-09T08:54:16Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

joshavant · 2026-07-09T09:49:18Z

/allow-dependencies-change

joshavant · 2026-07-09T09:49:44Z

@clawsweeper re-review

clawsweeper · 2026-07-09T09:49:46Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

sallyom requested a review from a team as a code owner June 1, 2026 23:33

openclaw-barnacle Bot added docs Improvements or additions to documentation gateway Gateway runtime size: L maintainer Maintainer-authored PR labels Jun 1, 2026

github-actions Bot added the dependencies-changed PR changes dependency-related files label Jun 1, 2026

sallyom force-pushed the vault-plugin branch from 65da901 to ed330fe Compare June 2, 2026 15:13

sallyom assigned steipete Jun 2, 2026

sallyom force-pushed the vault-plugin branch from ed330fe to 83b06c4 Compare June 2, 2026 17:51

openclaw-barnacle Bot added size: XL and removed size: L labels Jun 2, 2026

clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jun 2, 2026

sallyom changed the title ~~[WIP] Add Vault SecretRef plugin~~ Add Vault SecretRef plugin Jun 2, 2026

sallyom force-pushed the vault-plugin branch from 83b06c4 to f922b3d Compare June 3, 2026 05:35

sallyom unassigned steipete Jun 3, 2026

This was referenced Jul 8, 2026

switch to vault plugin that is bundled with openclaw image sallyom/claw-installer#172

Merged

onepassword plugin: add exec SecretRef #102293

Open

clawsweeper Bot removed the rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. label Jul 8, 2026

sallyom and others added 9 commits July 9, 2026 03:25

Add Vault SecretRef plugin

7bc1e0c

Signed-off-by: sallyom <[email protected]>

expand Vault setup to registered SecretRef targets

7004777

Signed-off-by: sallyom <[email protected]>

fix(vault): use sdk secret target seam

78d953d

fix(vault): preserve auth profile target paths

1c3b902

docs(vault): document plugin enable step

c167fc4

fix(vault): make status provider-alias aware

81dd529

fix(vault): reject noncanonical secret ids

d3452e4

fix(vault): separate resolver timeout deadlines

655bae9

fix(vault): forward private CA trust settings

b9a3097

fix(secrets): preserve plugin policy boundaries

90d13e0

github-actions Bot mentioned this pull request Jul 9, 2026

📡 Upstream Digest — 2026-07-09 10:56 UTC curtismercier/openclaw-mods#1242

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Add Vault SecretRef plugin#89255

Add Vault SecretRef plugin#89255
joshavant merged 10 commits into
openclaw:mainfrom
sallyom:vault-plugin

sallyom commented Jun 1, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 1, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 1, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 1, 2026 •

edited

Loading

Uh oh!

joshavant commented Jul 9, 2026

Uh oh!

joshavant commented Jul 9, 2026

Uh oh!

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

joshavant commented Jul 9, 2026

Uh oh!

joshavant commented Jul 9, 2026

Uh oh!

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

sallyom commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linked context

Real behavior proof

Tests and validation

Risk checklist

Current review state

Uh oh!

github-actions Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Guard

Uh oh!

github-actions Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency graph change authorized

Uh oh!

clawsweeper Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joshavant commented Jul 9, 2026

Uh oh!

joshavant commented Jul 9, 2026

Uh oh!

clawsweeper Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joshavant commented Jul 9, 2026

Uh oh!

joshavant commented Jul 9, 2026

Uh oh!

clawsweeper Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sallyom commented Jun 1, 2026 •

edited

Loading

github-actions Bot commented Jun 1, 2026 •

edited

Loading

github-actions Bot commented Jun 1, 2026 •

edited

Loading

clawsweeper Bot commented Jun 1, 2026 •

edited

Loading

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading

clawsweeper Bot commented Jul 9, 2026 •

edited

Loading