Codex review: found issues before merge. Reviewed July 15, 2026, 12:52 AM ET / 04:52 UTC.

Summary
The PR reduces the bundled starter skills, externalizes Sherpa ONNX TTS as an official ClawHub-only plugin, and updates installation routing, packaging, documentation, dependencies, and tests.

Reproducibility: not applicable. this is a packaging, installation, and product-boundary change rather than a report of broken current behavior.

Review metrics: 3 noteworthy metrics.

• Bundled skill surface: 37 removed, 14 retained, 1 externalized. This quantifies the upgrade-sensitive capability change that requires migration and availability proof.
• Official install source: 1 ClawHub-only official route added. Bare-ID installation now crosses a new official package trust and fallback boundary.
• Dependency surfaces: 1 package manifest and 1 lockfile importer added. Both require current-head supply-chain authorization before release.

Stored data model
Persistent data-model change detected: persistent cache schema: skills/openai-whisper/SKILL.md, serialized state: skills/session-logs/SKILL.md, serialized state: skills/taskflow/SKILL.md, serialized state: src/skills/loading/bundled-frontmatter.test.ts, unknown-data-model-change: skills/session-logs/SKILL.md, unknown-truncated-pull-files, and 18 more. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: canonical
Canonical: #95132
Summary: This PR is the canonical remaining bundled-skill deprecation and Sherpa packaging decision after narrower safe slices landed separately.

Members:

• partial_overlap: refactor(plugins): move owner skills into plugins #95664 - Merged the plugin-owned Canvas, Discord, Slack, voice-call, and WhatsApp skill relocation that was split out of this branch.
• partial_overlap: fix(skills): harden ClawHub update policy #95684 - Merged ClawHub skill update-policy hardening that was removed from this branch.
• adjacent_distinct: docs(notion): make allowlist examples direct #79619 - Repairs Notion skill guidance that this PR removes from the root bundle, but the allowlist documentation defect remains independently actionable.
• adjacent_distinct: xurl skill: add confirm-before-post enforcement and audit log instructions #56897 - Requests safety policy for the xurl skill; removing its bundled copy does not by itself resolve the requested confirmation and audit behavior.
• adjacent_distinct: wacli skill: add recipient allowlist and confirm-before-send enforcement #56898 - Requests WhatsApp skill safety policy and is not resolved by this PR’s broader starter-set packaging direction.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🌊 off-meta tidepool
Patch quality: 🦐 gold shrimp
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Add and prove a doctor migration for existing bundled-skill references and destinations.
• Provide current-head dependency authorization and real install/upgrade proof for the Sherpa ClawHub package and native artifacts.

Risk before merge

• [P1] Existing users can lose previously bundled capabilities after upgrade while their skills.allowBundled, skills.entries, workspace instructions, or automation still references removed skill names; the PR currently offers manual recovery rather than a doctor migration.
• [P1] The current head changes the dependency graph through a new package manifest and lockfile importer, and the earlier dependency authorization was tied to a different head SHA.
• [P1] Sherpa becomes an officially trusted ClawHub-only package whose skill downloads native executables and model archives, so release owners must accept package availability, provenance, integrity, and support behavior before merge.

Maintainer options:

1. Add migration and release proof (recommended)
   Implement and test doctor migration for shipped references, verify removed packages and Sherpa through real install and upgrade scenarios, and authorize the current dependency graph before merge.
2. Accept a documented breaking release
   Maintainers may intentionally accept the removals and new trust route, but must own release notes, support handling, package availability, and artifact provenance.
3. Split or pause the draft
   Extract any independently desired Sherpa work and pause or close the broad skill trim if the migration and deprecation commitment is not ready.

Next step before merge

• [P2] A maintainer must first choose the deprecation and official-package trust direction; after that choice, the branch needs migration and release proof rather than an unsupervised mechanical repair.

Maintainer decision needed

• Question: Should this release remove the listed shipped root skills and designate Sherpa ONNX TTS as an official ClawHub-only plugin?
• Rationale: Code review cannot choose whether existing users should absorb this compatibility break or whether the new official package and native-download trust boundary is an accepted product commitment.
• Likely owner: vincentkoc — He authored the merged precursor slices and explicitly defined the remaining decision surface in this PR discussion.
• Options:
  • Migrate, prove, then land (recommended): Keep the combined direction, but require doctor migration, fresh-install and upgrade proof, current-head dependency authorization, and Sherpa package/artifact verification before merge.
  • Split Sherpa packaging: Move the Sherpa official-plugin work into a focused PR and defer the broader bundled-skill deprecation until its migration plan is ready.
  • Park the broad trim: Retain the current bundled set and close or pause this draft until a release-owned deprecation policy is sponsored.

Security
Needs attention: No malicious behavior is evident, but the new official package trust route, native artifact downloads, and current-head dependency graph require explicit release/security acceptance.

Review findings

• [P1] Add an upgrade migration before removing shipped skills — docs/help/faq.md:298-302

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

• extensions/sherpa-onnx-tts/package.json
• pnpm-lock.yaml

Maintainer follow-up:

• Review whether the dependency changes are intentional.
• Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.
• Treat package-lock.json and npm-shrinkwrap.json diffs as security-review surfaces.
• Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

Dependency graph changes are blocked

OpenClaw does not accept dependency graph changes through PRs unless a repository admin or security explicitly authorizes the current head SHA. Dependency updates are generated internally by maintainers so external PRs cannot change the resolved graph.

Detected dependency graph changes:

• pnpm-lock.yaml changed.
• extensions/sherpa-onnx-tts/package.json changed devDependencies, name, version.

Auto-scrub was not attempted because this PR changes package manifest dependency graph fields:

• extensions/sherpa-onnx-tts/package.json changed devDependencies, name, version.

Dependency graph changes must be reviewed by security or handled by maintainers internally. Please remove lockfile changes manually if they are not needed.

To remove lockfile changes, restore them from the target branch:

git fetch origin
git checkout 'origin/main' -- 'pnpm-lock.yaml'
git commit -m 'chore: remove dependency lockfile change'
git push

If this PR intentionally needs a dependency graph change, ask a repository admin or member of @openclaw/openclaw-secops to comment:

/allow-dependencies-change

The action will approve the current head SHA (b836394b3781a2634169832cfa24ae67e26f2e8d) when it reruns. A later push requires a fresh approval.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review published an exact durable review comment and queued an exact-item serialized router run.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29250660027
• Updated: 2026-07-13T12:44:33.155Z

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review published an exact durable review comment and queued an executing target-wide serialized router scan.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29376036069
• Updated: 2026-07-14T23:33:13.813Z

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Review in progress
• Detail: The exact-review queue leased this run; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29384226389
• Updated: 2026-07-15T02:30:52.012Z

ClawSweeper status: review started.

I am starting a fresh review of this pull request: refactor(skills): trim bundled starter set This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.