Best possible solution:

Fix the surface-anchor contract in this renderer, keep the workflow/script scope unchanged, and land this scorecard slice before the generated-docs PR consumes the new commands.

Do we have a high-confidence way to reproduce the issue?

Yes for the PR defect: source inspection shows generated links use surface IDs while target headings use surface names, with cli-install-update-onboard-doctor/CLI as a concrete mismatch. I did not run the renderer because this review is read-only, but the failure path is clear from the renderer and taxonomy source.

Is this the best way to solve the issue?

No as-is. The repo-owned renderer/workflow is the right layer and current main does not duplicate it, but the branch should fix generated anchors before merge.

Full review comments:

• [P2] Emit matching surface-id anchors — scripts/qa/render-maturity-docs.ts:1130
  The scorecard table links each surface to /taxonomy#${surface.id}, but the taxonomy page renders the target as #### ${surface.name} without an explicit matching ID anchor. Surfaces like cli-install-update-onboard-doctor render under the heading CLI, so generated navigation points to anchors that will not exist; emit stable surface-ID anchors or derive both sides from the same slug helper.
  Confidence: 0.93

Overall correctness: patch is incorrect
Overall confidence: 0.88

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 108d6d7eca00.

Label justifications:

• P2: This is a normal-priority maintainer CI/docs-generation improvement with limited runtime blast radius and one concrete pre-merge renderer defect.
• merge-risk: 🚨 automation: The diff adds a GitHub Actions workflow and root scripts that affect generated-doc checks, artifact rendering, and maintainer CI behavior.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This MEMBER-authored, maintainer-labeled PR is not subject to the external-contributor real behavior proof gate; PR-body commands and CI remain validation context.

PR surface:

Config +126, Other +1347. Total +1473 across 3 files.

Acceptance criteria:

• [P1] pnpm maturity:render -- --output-dir /tmp/openclaw-maturity-docs.
• [P1] rg 'cli-install-update-onboard-doctor' /tmp/openclaw-maturity-docs/taxonomy.md /tmp/openclaw-maturity-docs/maturity-scorecard.md.
• [P1] node scripts/run-oxlint-shards.mjs --threads=8.
• [P1] git diff --check.

What I checked:

• Repository policy read: Root AGENTS.md and the scoped scripts/AGENTS.md and docs/AGENTS.md were read fully; their generated-artifact and docs-link guidance applies to this workflow/script/docs-generation PR. (AGENTS.md:18, 108d6d7eca00)
• Current main lacks the renderer surface: A current-main search found no maturity:* package scripts, maturity renderer, maturity scorecard workflow, or generated maturity docs paths, so this PR is not already implemented on main. (package.json:1577, 108d6d7eca00)
• Generated link defect remains: The scorecard emits /taxonomy#${surface.id} links while the taxonomy renderer emits target sections as #### ${surface.name}, leaving surface IDs such as cli-install-update-onboard-doctor without matching target anchors. (scripts/qa/render-maturity-docs.ts:1130, 367690c63048)
• Taxonomy ID/name mismatch proof: The taxonomy source has id: cli-install-update-onboard-doctor with display name CLI, which demonstrates why linking to the ID will not match a generated #### CLI heading without an explicit anchor. (taxonomy.yaml:729, 108d6d7eca00)
• Latest CI state: The earlier lint blocker is no longer current: live PR checks show check-lint and the new Render maturity docs workflow completed successfully on the latest head. (367690c63048)
• Workflow security posture: The new workflow uses read-only actions/contents permissions, pinned checkout/upload-artifact action SHAs, and parses or copies same-repo artifacts rather than executing downloaded artifact contents. (.github/workflows/maturity-scorecard.yml:42, 367690c63048)

Likely related people:

• RomneyDa: Authored the merged claw-score skill migration and the current renderer/workflow branch, and also owns the related release-QA evidence branch. (role: recent scorecard workflow contributor; confidence: high; commits: 846591b55427, 367690c63048, a740724b8750; files: .agents/skills/claw-score/SKILL.md, scripts/qa/render-maturity-docs.ts, .github/workflows/maturity-scorecard.yml)
• kevinslin: Authored the merged taxonomy and maturity score source import that this renderer consumes, with adjacent scorecard skill/history context. (role: taxonomy and score source introducer; confidence: high; commits: a54f50a41ba0; files: taxonomy.yaml, docs/maturity-scores.yaml)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.