Best possible solution:

Close this branch and keep the linked Slack issue as the canonical maintainer decision path for a narrow startup, doctor, or warning fix with real Slack upgrade proof.

Do we have a high-confidence way to reproduce the issue?

Yes for the linked issue from source inspection: current main still requires a non-bundled channel owner to be explicitly enabled before startup planning includes it. I did not run a live Slack upgrade repro, and this PR does not touch that path.

Is this the best way to solve the issue?

No: this PR is the wrong layer and adds a malformed duplicate helper file. The maintainable fix belongs in plugin startup activation, doctor/update migration, or operator-visible warning behavior after maintainer direction.

Security review:

Security review cleared: No dependency, workflow, package, secret, or new reachable runtime security surface was introduced; the added command/SSH helper copy is unrelated and should be discarded.

AGENTS.md: found and applied where relevant.

What I checked:

• Scoped extension policy read: extensions/AGENTS.md says bundled plugin code lives under extensions/ and should stay within the owning plugin boundary; the PR instead adds a nested openclaw/extensions/... path outside the established tree. (extensions/AGENTS.md:1, a6aa84f2d024)
• Wrong changed surface: The PR creates openclaw/extensions/qa-lab/src/mantis/crabbox-runtime.ts, while the real QA Lab Mantis runtime already exists at extensions/qa-lab/src/mantis/crabbox-runtime.ts; this duplicate path is not the Slack startup surface. (openclaw/extensions/qa-lab/src/mantis/crabbox-runtime.ts:1, f75deb2f971b)
• Malformed generated code: The added file inserts this._ready listener branches into a plain function, leaves callback/bracing structure malformed, and references undefined u, making the branch unmergeable even aside from the wrong path. (openclaw/extensions/qa-lab/src/mantis/crabbox-runtime.ts:63, f75deb2f971b)
• Current main already has the real QA helper: Current main's actual extensions/qa-lab/src/mantis/crabbox-runtime.ts contains the clean command runner and lease-id extraction helper that the PR appears to have copied and corrupted under a nested path. (extensions/qa-lab/src/mantis/crabbox-runtime.ts:34, a6aa84f2d024)
• Linked Slack regression lives in plugin startup trust gating: Current startup planning only starts non-bundled configured channel owners when the activation state is both enabled and explicitly enabled, so the relevant repair surface is plugin startup/activation rather than QA Lab Crabbox helpers. (src/plugins/gateway-startup-plugin-ids.ts:1767, a6aa84f2d024)
• plugins.allow is one explicit trust path: Current activation logic treats non-bundled plugin ids in plugins.allow as explicitly enabled, matching the workaround described in the linked Slack issue and showing why this PR's QA Lab file cannot fix it. (src/plugins/config-activation-shared.ts:122, a6aa84f2d024)

Likely related people:

• Peter Lindsey: git blame points both the real QA Lab Crabbox runtime and the current startup gating snapshot in this shallow checkout to commit d4237cb. (role: recent area contributor; confidence: medium; commits: d4237cb14d83; files: extensions/qa-lab/src/mantis/crabbox-runtime.ts, src/plugins/gateway-startup-plugin-ids.ts)
• brokemac79: Recent commit de4b8d8 changed installed trusted policy contracts and touched the plugin startup planning path implicated by the linked Slack regression. (role: recent adjacent contributor; confidence: medium; commits: de4b8d8ebf73; files: src/plugins/gateway-startup-plugin-ids.ts, src/plugins/channel-plugin-ids.test.ts, src/plugins/loader.ts)

Codex review notes: model internal, reasoning high; reviewed against a6aa84f2d024.