Persist ClawHub skill install provenance by momothemage · Pull Request #93283 · openclaw/openclaw

momothemage · 2026-06-15T12:10:12Z

Summary

Refs #92077.

This PR implements a narrow, local lockfile slice of the ClawHub skill provenance work:

persists the downloaded ClawHub artifact SHA256/integrity in .clawhub/lock.json
records the installed SKILL.md filename and SHA256 after extraction
snapshots the ClawHub skill verification envelope fields that are useful for audit (decision, reasons, card, artifact, provenance, security, signature)
keeps install telemetry backwards-shaped so the richer local lock data is not sent back to ClawHub telemetry

This intentionally does not close #92077. Source URL requirements, publish-time source validation, pinned install syntax, richer audit commands, and sandbox-by-default remain larger follow-up decisions.

Verification

node scripts/run-vitest.mjs src/skills/lifecycle/clawhub.test.ts
node scripts/run-vitest.mjs src/cli/skills-cli.verify.test.ts
pnpm tsgo:core
pnpm tsgo:test:src
pnpm exec oxfmt --check --threads=1 src/skills/lifecycle/clawhub.ts src/skills/lifecycle/clawhub.test.ts
node scripts/run-oxlint.mjs src/skills/lifecycle/clawhub.ts src/skills/lifecycle/clawhub.test.ts
git diff --check

Real behavior proof

Behavior addressed: ClawHub skill installs now leave local audit data that ties the install to the downloaded artifact, installed SKILL.md, and ClawHub verification response.

Real environment tested: local macOS checkout, Node v22.18.0, pnpm v11.2.2, live https://clawhub.ai.

Exact command run after this patch:

node --import tsx -e 'const fs = await import("node:fs/promises"); const os = await import("node:os"); const path = await import("node:path"); const { installSkillFromClawHub } = await import("./src/skills/lifecycle/clawhub.ts"); const root = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-clawhub-lock-proof-")); try { const result = await installSkillFromClawHub({ workspaceDir: root, slug: "openclaw-find-skills", logger: { info: (message) => console.log(`info:${message}`) } }); console.log(`result:${JSON.stringify(result)}`); if (!result.ok) process.exit(1); const lock = JSON.parse(await fs.readFile(path.join(root, ".clawhub", "lock.json"), "utf8")); const entry = lock.skills["openclaw-find-skills"]; console.log(`lock:${JSON.stringify({ version: entry.version, artifact: entry.artifact, skillFile: entry.skillFile, verification: entry.verification && { ok: entry.verification.ok, decision: entry.verification.decision, reasons: entry.verification.reasons, provenance: entry.verification.provenance, securityStatus: entry.verification.security?.status } }, null, 2)}`); } finally { await fs.rm(root, { recursive: true, force: true }); }'

Observed result after fix:

{
  "version": "1.0.0",
  "artifact": {
    "kind": "archive",
    "sha256": "9fb2b8e43f8301560f50a4484742c51e2d02be1f6a437f4d51e345f970addaca",
    "integrity": "sha256-n7K45D+DAVYPUKRIR0LFHi0Cvh9qQ39NUeNF+XCt2so="
  },
  "skillFile": {
    "path": "SKILL.md",
    "sha256": "6895c10c93ec17ca64b2b06ff15cbfa4278e7a011cb9464d9fc4b90a029af71b"
  },
  "verification": {
    "ok": false,
    "decision": "fail",
    "reasons": ["security.status_not_clean"],
    "provenance": {
      "source": "unavailable",
      "reason": "No server-resolved GitHub import provenance is stored for this version."
    },
    "securityStatus": "suspicious"
  }
}

What was not tested: full openclaw skills audit / frozen install behavior, because this PR only persists the lock data needed for those later features.

clawsweeper · 2026-06-15T12:12:07Z

Codex review: passed. Reviewed June 15, 2026, 9:03 AM ET / 13:03 UTC.

Summary
The PR adds artifact, installed skill-file, source URL, and verification-envelope fields to ClawHub skill origin/lock metadata while keeping install telemetry restricted to the older version/registry shape.

PR surface: Source +144, Tests +139. Total +283 across 2 files.

Reproducibility: not applicable. as a bug reproduction. Source inspection shows current main lacks the richer .clawhub provenance fields, and the PR body provides after-patch live output from a ClawHub install.

Review metrics: 1 noteworthy metric.

Persistent metadata surface: 4 lock fields added, 3 origin fields added. The PR changes local ClawHub install metadata that future audit and frozen-install flows may treat as an upgrade contract.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

[P1] The .clawhub lock/origin additions are additive today, but once shipped they can become the compatibility contract for future skills audit, frozen install, and upgrade behavior.
[P1] For GitHub-backed latest installs, the PR records the downloaded commit/source URL and archive hash while using the current ClawHub verify endpoint for the verification snapshot; maintainers should accept that contract before treating the snapshot as frozen provenance.

Maintainer options:

Confirm the lock metadata contract (recommended)
A maintainer should confirm that artifact, skillFile, sourceUrl, and verification are the intended durable .clawhub audit fields before merge.
Tighten GitHub verification binding first
If maintainers need the verification snapshot to be commit-specific for GitHub-backed installs, pause and add the ClawHub API/CLI contract before landing.
Keep the broader trust work separate
Maintainers can land this additive local metadata slice while keeping source requirements, pinned install syntax, audit/frozen commands, and sandbox policy on the open follow-up issue.

Next step before merge

[P2] The remaining action is maintainer acceptance of the persistent .clawhub metadata contract; no narrow automated repair is identified.

Security
Cleared: The diff touches a security-sensitive skill supply-chain surface but adds local provenance without new dependencies, secret handling, workflow permissions, or code-execution paths.

Review details

Best possible solution:

Land this slice only if maintainers accept the .clawhub provenance field contract, leaving source URL requirements, pinned installs, audit/frozen behavior, and sandbox policy on the canonical follow-up.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction. Source inspection shows current main lacks the richer .clawhub provenance fields, and the PR body provides after-patch live output from a ClawHub install.

Is this the best way to solve the issue?

Yes for this narrow local provenance slice if maintainers accept the stored metadata contract. The change sits at the existing ClawHub lifecycle boundary, preserves the telemetry shape, and leaves broader enforcement policy to the canonical follow-up issue.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 018d2794687f.

Label changes

Label justifications:

P2: This is meaningful ClawHub skill supply-chain provenance hardening with limited immediate runtime blast radius.
merge-risk: 🚨 compatibility: The PR changes persisted .clawhub install metadata that future audit, frozen-install, and upgrade behavior may rely on.
rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
status: 🚀 automerge armed: This PR is in ClawSweeper's automerge lane. Sufficient (live_output): The PR body includes after-patch live output from a local checkout against live ClawHub showing .clawhub/lock.json artifact, skillFile, and verification fields.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-patch live output from a local checkout against live ClawHub showing .clawhub/lock.json artifact, skillFile, and verification fields.

Evidence reviewed

PR surface:

Source +144, Tests +139. Total +283 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	153	9	+144
Tests	1	142	3	+139
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	295	12	+283

What I checked:

Current main lock shape: Current main stores only version, installedAt, and optional registry in the ClawHub lock entry, so the richer provenance data is not already present. (src/skills/lifecycle/clawhub.ts:45, 018d2794687f)
Current main install write path: Current main writes origin and lock metadata after install with only registry, slug/version, installedAt, and telemetry receives the same narrow lock object. (src/skills/lifecycle/clawhub.ts:985, 018d2794687f)
PR implementation: The PR head adds artifact, skillFile, sourceUrl, and verification lock/origin types and writes those fields after the install target is materialized. (src/skills/lifecycle/clawhub.ts:42, 65774f4f4ba9)
PR install write path: The PR builds the downloaded artifact lock, reads the installed marker hash, snapshots verification, writes local metadata, and sends only telemetry-shaped fields back to ClawHub. (src/skills/lifecycle/clawhub.ts:1107, 65774f4f4ba9)
Focused tests: The PR adds coverage for persisted artifact, skillFile, verification, and the verification-unavailable best-effort install path. (src/skills/lifecycle/clawhub.test.ts:310, 65774f4f4ba9)
ClawHub verification contract: The existing infra contract exposes the clawhub.skill.verify.v1 envelope used by the PR snapshot, and a live public verify call returned that envelope with artifact/provenance/security/signature fields. (src/infra/clawhub.ts:342, 018d2794687f)

Likely related people:

Patrick-Erichsen: Recent merged work added GitHub-backed ClawHub skill installs and ClawHub verification/trust surfaces that directly overlap this provenance path. (role: recent feature contributor; confidence: high; commits: 8f85f949465a, ee57f341f056; files: src/skills/lifecycle/clawhub.ts, src/infra/clawhub.ts, src/cli/skills-cli.ts)
joshavant: Authored the operator install policy changes that affect the same skill install trust boundary before activation. (role: adjacent security contributor; confidence: medium; commits: 154f439c8103; files: src/skills/lifecycle/clawhub.ts, src/infra/clawhub.ts, src/plugins/install-security-scan.ts)
shakkernerd: Recent skills subsystem layout work moved and maintained the ClawHub lifecycle and test files around this feature area. (role: recent area refactor contributor; confidence: medium; commits: d9278c8efdb5, bedfd4c20077; files: src/skills/lifecycle/clawhub.ts, src/skills/lifecycle/clawhub.test.ts)
steipete: The PR is currently assigned to steipete, and recent history shows adjacent skill runtime and ClawHub infra documentation work. (role: assigned reviewer and adjacent contributor; confidence: medium; commits: 6c48a1256213, 1275368151dd; files: src/skills/lifecycle/clawhub.ts, src/infra/clawhub.ts, docs/cli/skills.md)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

momothemage · 2026-06-15T12:24:48Z

@clawsweeper automerge

clawsweeper · 2026-06-15T12:24:51Z

🦞✅
ClawSweeper merged this PR after the passing review.

Source: clawsweeper[bot]
Feedback: structured ClawSweeper verdict: pass (sha=65774f4f4ba98611446989a0b1e9497fafa29ae6)
Merge status: merged by ClawSweeper automerge
Merged at: 2026-06-15T13:04:09Z
Merge commit: dd7f2ef002e8

What merged:

The PR adds artifact, installed skill-file, source URL, and verification-envelope fields to ClawHub skill origin/lock metadata while keeping install telemetry restricted to the older version/registry shape.
PR surface: Source +144, Tests +139. Total +283 across 2 files.
Reproducibility: not applicable. as a bug reproduction. Source inspection shows current main lacks the richer .clawhub provenance fields, and the PR body provides after-patch live output from a ClawHub install.

Automerge notes:

PR branch already contained follow-up commit before automerge: Persist ClawHub skill install provenance

The automerge loop is complete.

Automerge progress:

2026-06-15 12:25:51 UTC review queued 846cd0d763d6 (queued)

2026-06-15 12:35:42 UTC review passed 846cd0d763d6 (structured ClawSweeper verdict: pass (sha=846cd0d763d6e4fb9cb915301066ba8bfc62b...)

2026-06-15 12:36:03 UTC repair queued 846cd0d763d6 (autonomous) Run: https://github.com/openclaw/clawsweeper/actions/runs/27546646260

2026-06-15 12:37:53 UTC repair started (running) in 1s Run: https://github.com/openclaw/clawsweeper/actions/runs/27546646260 automerge-openclaw-openclaw-93283

2026-06-15 12:38:17 UTC validation plan (passed) in 25s Run: https://github.com/openclaw/clawsweeper/actions/runs/27546646260 pnpm check:changed; pnpm lint; pnpm check:test-types

2026-06-15 12:38:38 UTC Codex write preflight (passed) in 46s Run: https://github.com/openclaw/clawsweeper/actions/runs/27546646260 danger-full-access

2026-06-15 12:46:02 UTC Codex edit 1 377914d3bcd2 (complete) in 8m 10s Run: https://github.com/openclaw/clawsweeper/actions/runs/27546646260 exit 0

2026-06-15 12:49:11 UTC validation and review 1 65774f4f4ba9 (complete) in 11m 19s Run: https://github.com/openclaw/clawsweeper/actions/runs/27546646260 already-current

2026-06-15 12:49:17 UTC repair completed 65774f4f4ba9 (branch updated) in 11m 25s Run: https://github.com/openclaw/clawsweeper/actions/runs/27546646260 initial automerge rebase is delegated to Codex repair

2026-06-15 12:49:16 UTC review queued 65774f4f4ba9 (after repair)

2026-06-15 12:59:22 UTC automerge wait 65774f4f4ba9 (waiting) in 21m 30s Run: https://github.com/openclaw/clawsweeper/actions/runs/27546646260 waiting for exact-head ClawSweeper review pass

2026-06-15 12:55:46 UTC review queued 65774f4f4ba9 (queued)

2026-06-15 12:59:23 UTC repair finished 65774f4f4ba9 (pushed) in 21m 32s Run: https://github.com/openclaw/clawsweeper/actions/runs/27546646260 repair_contributor_branch

2026-06-15 13:03:53 UTC review passed 65774f4f4ba9 (structured ClawSweeper verdict: pass (sha=65774f4f4ba98611446989a0b1e9497fafa29...)

2026-06-15 13:04:11 UTC merged 65774f4f4ba9 (merged by ClawSweeper automerge)

Summary: - The PR adds artifact, installed skill-file, source URL, and verification-envelope fields to ClawHub skill origin/lock metadata while keeping install telemetry restricted to the older version/registry shape. - PR surface: Source +144, Tests +139. Total +283 across 2 files. - Reproducibility: not applicable. as a bug reproduction. Source inspection shows current main lacks the richer `.clawhub` provenance fields, and the PR body provides after-patch live output from a ClawHub install. Automerge notes: - PR branch already contained follow-up commit before automerge: Persist ClawHub skill install provenance Validation: - ClawSweeper review passed for head 65774f4. - Required merge gates passed before the squash merge. Prepared head SHA: 65774f4 Review: openclaw#93283 (comment) Co-authored-by: momothemage <[email protected]> Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: momothemage

PR openclaw#93283 began persisting install provenance (sourceUrl, artifact, skillFile) into each skill `.clawhub/origin.json`, but the shared `normalizeClawHubSkillOrigin` reader rebuilds the origin object from a fixed allowlist and only kept the identity fields (version/registry/slug/installedVersion/installedAt). The newly persisted provenance was silently dropped on every readback path (`readClawHubSkillOrigin`, `readClawHubSkillOriginStatusSync`, `readClawHubSkillOriginStrict`), so the write side and read side of origin.json were asymmetric. The workspace lockfile reader keeps these fields (raw skills passthrough); origin.json did not. Preserve the persisted provenance on readback with strict, allowlist validation (artifact.kind in {archive,clawpack}, non-empty sha256 / integrity / path; malformed fields are dropped, not promoted), and surface the restored fields through the exported `resolveClawHubSkillStatusLinkSync` linked result as backward-compatible optional fields. Old origins without these fields keep working.

Summary: - The PR adds artifact, installed skill-file, source URL, and verification-envelope fields to ClawHub skill origin/lock metadata while keeping install telemetry restricted to the older version/registry shape. - PR surface: Source +144, Tests +139. Total +283 across 2 files. - Reproducibility: not applicable. as a bug reproduction. Source inspection shows current main lacks the richer `.clawhub` provenance fields, and the PR body provides after-patch live output from a ClawHub install. Automerge notes: - PR branch already contained follow-up commit before automerge: Persist ClawHub skill install provenance Validation: - ClawSweeper review passed for head 65774f4. - Required merge gates passed before the squash merge. Prepared head SHA: 65774f4 Review: openclaw#93283 (comment) Co-authored-by: momothemage <[email protected]> Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: momothemage

openclaw-barnacle Bot added size: M maintainer Maintainer-authored PR labels Jun 15, 2026

clawsweeper Bot added the clawsweeper:automerge Maintainer opted this PR into bounded ClawSweeper-reviewed automerge label Jun 15, 2026

hxy91819 assigned steipete Jun 15, 2026

momothemage and others added 2 commits June 15, 2026 12:39

fix(skills): persist ClawHub install provenance

377914d

Persist ClawHub skill install provenance

65774f4

clawsweeper Bot force-pushed the feature/issue-92077-clawhub-lock-provenance branch from 846cd0d to 65774f4 Compare June 15, 2026 12:49

clawsweeper Bot merged commit dd7f2ef into main Jun 15, 2026
163 checks passed

clawsweeper Bot deleted the feature/issue-92077-clawhub-lock-provenance branch June 15, 2026 13:04

Alix-007 mentioned this pull request Jun 15, 2026

fix(skills): preserve ClawHub origin provenance on readback #93314

Merged

github-actions Bot mentioned this pull request Jun 15, 2026

📡 Upstream Digest — 2026-06-15 15:37 UTC curtismercier/openclaw-mods#1083

Open

clawsweeper Bot mentioned this pull request Jun 15, 2026

#92077: skills/ClawHub: add sourceUrl to skill metadata schema and CLI display #92860

Closed

5 tasks

momothemage mentioned this pull request Jun 16, 2026

Consume ClawHub skill source provenance #93477

Closed

This was referenced Jun 18, 2026

[Feature Request] Code Verification and Signature for Skills #12507

Open

fix(skills): warn for untrusted local sources #80142

Open

This was referenced Jun 19, 2026

Verify installed ClawHub skill file hashes #93600

Closed

[Feature]: Skill Permission Manifest Standard (skill.yaml) #12219

Open

Verify installed ClawHub skill file hashes #96008

Open

This was referenced Jun 27, 2026

Community Skill Development & ClawHub #50090

Open

fix(clawhub): reject mutable GitHub skill refs #97157

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Persist ClawHub skill install provenance#93283

Persist ClawHub skill install provenance#93283
clawsweeper[bot] merged 2 commits into
mainfrom
feature/issue-92077-clawhub-lock-provenance

momothemage commented Jun 15, 2026

Uh oh!

clawsweeper Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

momothemage commented Jun 15, 2026

Uh oh!

clawsweeper Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

momothemage commented Jun 15, 2026

Summary

Verification

Real behavior proof

Uh oh!

clawsweeper Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

momothemage commented Jun 15, 2026

Uh oh!

clawsweeper Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clawsweeper Bot commented Jun 15, 2026 •

edited

Loading

clawsweeper Bot commented Jun 15, 2026 •

edited

Loading