Skip to content

fix(heartbeat): scope commitment fan-out prompts#98169

Merged
steipete merged 3 commits into
openclaw:mainfrom
bdjben:fix/commitment-heartbeat-scoped-prompts
Jul 1, 2026
Merged

fix(heartbeat): scope commitment fan-out prompts#98169
steipete merged 3 commits into
openclaw:mainfrom
bdjben:fix/commitment-heartbeat-scoped-prompts

Conversation

@bdjben

@bdjben bdjben commented Jun 30, 2026 •
edited by steipete
Loading

Copy link
Copy Markdown
Contributor

What Problem This Solves

Heartbeat scheduling has two related paths: the agent's normal configured heartbeat, then fan-out to other sessions with due inferred commitments. Commitment fan-out previously reused the global heartbeat preparation path and inferred its special meaning from the free-form diagnostic reason "commitment".

That let a commitment-only wake inherit unrelated global work: periodic tasks and timestamps, HEARTBEAT.md or default heartbeat instructions, queued system/plugin context, subagent steering, and one-shot aborted-run state. In a channel such as Telegram, the visible result could mix or redirect a room-specific follow-up with global operational work.

Why This Change Was Made

The scheduler now selects a closed, private HeartbeatRunScope at the scheduler/runner boundary:

  • global remains the default for ordinary heartbeats, periodic tasks, and public/gateway callers.
  • commitment-only is available only to due-commitment fan-out and carries through reply preparation plus embedded, CLI, Codex, and Copilot execution.

Commitment-only runs use only the due commitment prompt. They do not advance periodic task timestamps, append global heartbeat/bootstrap prompt material, drain queued system/plugin context, lease subagent steering, or consume an aborted-run hint. Isolated session identity and delivery routing are preserved.

This removes semantic control from reason, keeps the exceptional mode owned by the scheduler, and makes the valid run modes explicit across every supported runtime.

User Impact

Due commitments are delivered to the original channel/session without unrelated global heartbeat content or state being consumed. Normal heartbeat behavior is unchanged. There is no new config, public protocol, or plugin SDK contract.

Evidence

  • Focused regression/runtime suite:
    • node scripts/run-vitest.mjs src/agents/embedded-agent-runner/run/attempt.spawn-workspace.context-engine.test.ts src/auto-reply/reply/get-reply-run.media-only.test.ts src/infra/heartbeat-runner.commitments.test.ts src/agents/embedded-agent-runner/run/attempt.prompt-helpers.test.ts src/agents/harness/prompt-compaction-hook-helpers.test.ts extensions/codex/src/app-server/thread-lifecycle.test.ts extensions/codex/src/app-server/run-attempt.context-engine.test.ts
    • 7 files, 283/283 tests passed.
  • Broad remote behavior proof: Blacksmith Testbox tbx_01kwdhq565h90s0c32a8m0tez8 (jade-krill), 14 files and 728/728 tests passed across 7 shards.
  • Fresh changed gate: Blacksmith Testbox tbx_01kwdm4y55wxt582k3ra632hmh (brisk-lobster), Actions run 28486841407; all tsgo, oxlint, import-cycle, SDK/export, and changed guards passed.
  • node scripts/plugin-sdk-surface-report.mjs --check passed at 10,400 exports / 5,219 callables.
  • git diff --check, oxfmt checks, and a fresh autoreview passed with no actionable findings.
  • Existing native Telegram Desktop proof: proof comment, Actions run 28449800270, artifact 7984402251.
  • Fresh native Telegram Desktop proof passed against exact candidate 0722a1b7ead60dac9955e494dc1507f5f9c830d2: AWS Crabbox Mantis run 28488853390, artifact 7999198366, before/after proof comment, baseline pass, candidate pass/fixed, overall pass.
  • Exact-head hosted gates passed: CI 28488806614, Workflow Sanity 28488806576, Blacksmith Testbox 28488806599, ARM Testbox 28488806595, and Build Artifacts Testbox 28488806588.

Direct Codex protocol/runtime inspection confirms that Codex exposes a generic turn API with no OpenClaw heartbeat field, so this scope remains internal to OpenClaw (codex-rs/app-server-protocol/src/protocol/v2/turn.rs:68-157, codex-rs/app-server/src/request_processors/turn_processor.rs:155-173,442-540).

@openclaw-barnacle openclaw-barnacle Bot added size: S triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. and removed triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. labels Jun 30, 2026
@clawsweeper

clawsweeper Bot commented Jun 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed June 30, 2026, 10:37 PM ET / 02:37 UTC.

Summary
The PR adds an internal commitment-only heartbeat run scope across heartbeat scheduling, reply preparation, Codex/Copilot execution, and tests, while the current head also changes release metadata, dependency graphs, workflows, apps, docs, UI settings, and many plugins.

Reproducibility: yes. from source inspection: current main still uses reason-based commitment fan-out through normal heartbeat preflight, which can inspect global session events before commitment-only scoping exists. I did not run tests because this review is read-only.

Review metrics: 3 noteworthy metrics.

  • Dependency graph changes: 206 dependency-related files flagged. Package, shrinkwrap, and lockfile changes are supply-chain surfaces that need owner/security review before merge.
  • Release-owned metadata: 3 release surfaces changed. CHANGELOG.md, appcast.xml, and release-note docs are release-owned and should not ride along with a normal heartbeat fix.
  • Persisted UI setting surface: 1 added. The new chatPersistCommentary stored preference is unrelated to heartbeat routing and needs separate compatibility/upgrade review if retained.

Stored data model
Persistent data-model change detected: durable storage schema: ui/src/ui/storage.node.test.ts, durable storage schema: ui/src/ui/storage.ts, migration/backfill/repair: docs/docs_map.md, migration/backfill/repair: docs/gateway/cli-backends.md, persistent cache schema: appcast.xml, unknown-truncated-pull-files, and 3 more. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🦪 silver shellfish
Patch quality: 🧂 unranked krab
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Reset or split the PR to only the heartbeat run-scope implementation and focused tests.
  • Remove or separately authorize dependency graph and release workflow changes.
  • Provide fresh current-head Telegram Desktop proof after narrowing.

Proof guidance:

  • [P1] Needs stronger real behavior proof before merge: Existing Telegram Desktop screenshots and video links are positive for candidate ee8652d, but they do not prove current head 0722a1b after later commits broadened the branch substantially. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Mantis proof suggestion
Native Telegram proof can directly show that a commitment-only wake no longer leaks HEARTBEAT.md, periodic task, or queued-event text into the target chat. A maintainer can ask Mantis to capture proof by posting this exact PR comment:

@openclaw-mantis telegram desktop proof: refresh this PR at current narrowed head to show commitment-only wake excludes HEARTBEAT.md, periodic task, and queued-event text.

Risk before merge

  • [P1] Merging the current head would combine a heartbeat routing fix with unrelated release, dependency, workflow, app, docs, UI, and plugin changes that need different owners and proof.
  • [P1] The dependency graph guard is failing on the current head, so package and shrinkwrap changes need removal or explicit repository admin/security authorization.
  • [P1] The Telegram Desktop proof is positive for candidate ee8652d, but it does not prove current head 0722a1b after later commits broadened the branch substantially.
  • [P1] The heartbeat scope change affects visible commitment delivery and session/context handling, so current-head transport proof is still needed after narrowing.

Maintainer options:

  1. Split to a heartbeat-only branch (recommended)
    Reset or replace this PR so it contains only the commitment heartbeat run-scope implementation, focused tests, and current-head Telegram proof.
  2. Move release and dependency work elsewhere
    Preserve any intended release, ClawHub workflow, package, app, docs, and UI changes in separate owner-reviewed PRs with dependency and upgrade evidence.
  3. Pause this mixed branch
    If the mixed surfaces cannot be separated quickly, keep this PR paused while maintainers choose a narrower heartbeat review path.

Next step before merge

  • [P1] Maintainers need to decide whether to reset, split, replace, or explicitly authorize the mixed branch; the blocker is branch scope and ownership, not a narrow automated repair.

Security
Needs attention: The current head introduces unrelated supply-chain and release automation changes that need owner/security review or should be split out before merge.

Review findings

  • [P1] Remove unrelated dependency and publish workflow changes — .github/workflows/plugin-clawhub-release.yml:45
  • [P2] Drop release-owned changelog and appcast updates — CHANGELOG.md:11
Review details

Best possible solution:

Keep the commitment-only heartbeat fix, but reset or replace this PR with a narrow heartbeat/runtime/test branch and fresh current-head Telegram proof; route dependency, release, workflow, app, docs, and UI work through separate owner-reviewed PRs.

Do we have a high-confidence way to reproduce the issue?

Yes, from source inspection: current main still uses reason-based commitment fan-out through normal heartbeat preflight, which can inspect global session events before commitment-only scoping exists. I did not run tests because this review is read-only.

Is this the best way to solve the issue?

No, this PR is not the best merge vehicle in its current form. The heartbeat-only scope design is plausible, but it should land as a narrow runtime/test change rather than mixed with release, dependency, app, docs, and UI churn.

Full review comments:

  • [P1] Remove unrelated dependency and publish workflow changes — .github/workflows/plugin-clawhub-release.yml:45
    This heartbeat PR now changes ClawHub publish workflow inputs and package/shrinkwrap dependency graph files. Those supply-chain and automation changes are unrelated to the scoped heartbeat fix and are already blocked by dependency guard; please split or remove them from this branch.
    Confidence: 0.96
  • [P2] Drop release-owned changelog and appcast updates — CHANGELOG.md:11
    Normal heartbeat fix PRs should not edit release-owned metadata like CHANGELOG.md and appcast.xml. Please remove these release artifacts from this branch and keep release context in the PR body or a release-owned change.
    Confidence: 0.9

Overall correctness: patch is incorrect
Overall confidence: 0.94

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 816038e97a5d.

Label changes

Label changes:

  • add merge-risk: 🚨 automation: The current head also changes ClawHub release workflows, reusable workflow refs, publish inputs, and package/shrinkwrap files.

Label justifications:

  • P2: The intended heartbeat/commitment routing bug fix has real but bounded user-visible chat impact.
  • merge-risk: 🚨 message-delivery: The heartbeat portion changes which prompt material and delivery routing reach visible commitment wake messages.
  • merge-risk: 🚨 session-state: The heartbeat portion changes queued event handling, heartbeat task state, and context classification for commitment-only runs.
  • merge-risk: 🚨 automation: The current head also changes ClawHub release workflows, reusable workflow refs, publish inputs, and package/shrinkwrap files.
  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🦪 silver shellfish and patch quality is 🧂 unranked krab.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Existing Telegram Desktop screenshots and video links are positive for candidate ee8652d, but they do not prove current head 0722a1b after later commits broadened the branch substantially. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
  • proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. Existing Telegram Desktop screenshots and video links are positive for candidate ee8652d, but they do not prove current head 0722a1b after later commits broadened the branch substantially.
  • mantis: telegram-visible-proof: Mantis should capture Telegram visible proof. The PR changes visible Telegram commitment heartbeat output, so a short native Telegram Desktop proof is useful once the branch is narrowed.
Evidence reviewed

Security concerns:

  • [medium] Unrelated workflow and package-resolution changes — .github/workflows/plugin-clawhub-release.yml:45
    The diff bumps the ClawHub CLI package, changes a reusable workflow SHA, adds publish input behavior, and includes many package/shrinkwrap updates in a heartbeat PR, expanding code-execution and publishing surface without matching PR intent.
    Confidence: 0.94
  • [medium] Dependency graph guard is blocking current head
    GitHub dependency-guard reports dependency graph changes are blocked unless an admin or security explicitly authorizes the current head SHA, so these changes cannot be treated as ordinary heartbeat validation noise.
    Confidence: 0.93

Acceptance criteria:

  • [P1] node scripts/run-vitest.mjs src/infra/heartbeat-runner.commitments.test.ts src/auto-reply/reply/get-reply-run.media-only.test.ts src/agents/embedded-agent-runner/run/attempt.prompt-helpers.test.ts extensions/codex/src/app-server/run-attempt.context-engine.test.ts extensions/codex/src/app-server/thread-lifecycle.test.ts.
  • [P1] node scripts/plugin-sdk-surface-report.mjs --check.
  • [P1] Fresh Telegram Desktop proof at the final narrowed head.

What I checked:

  • Repository policy read: Read the full root AGENTS.md plus scoped docs, UI, extensions, scripts, agents, gateway, outbound, and plugin SDK guides; dependency graph, release-owned metadata, Codex source inspection, proof, and session/message-routing guidance affected the review. (AGENTS.md:1, 816038e97a5d)
  • Live PR metadata: Live PR metadata reports current head 0722a1b, base 6cb82ea, 662 changed files, and assignee steipete. (0722a1b7ead6)
  • Current main heartbeat behavior: Current main preflight peeks pending session events before the PR's run-scope distinction exists, so a due commitment fan-out can inherit global queued context. (src/infra/heartbeat-runner.ts:1033, 816038e97a5d)
  • Current main reason-based fan-out: Current main commitment fan-out calls runOnce with reason "commitment", using a free-form diagnostic reason as the special-mode signal. (src/infra/heartbeat-runner.ts:2676, 51e0997c2bbd)
  • Heartbeat scope implementation: The PR adds runScope to preflight and makes commitment-only preflight skip pending event inspection and HEARTBEAT.md file gates. (src/infra/heartbeat-runner.ts:1035, 0722a1b7ead6)
  • Commitment-only prompt isolation: The PR makes commitment-only prompt resolution return only the due commitment prompt and suppress exec, cron, and heartbeat-file prompt material. (src/infra/heartbeat-runner.ts:1252, 0722a1b7ead6)

Likely related people:

  • steipete: Live PR metadata shows steipete assigned, and PR commits e08bb5e and 0722a1b are authored by Peter Steinberger and broaden the branch after the initial heartbeat commit. (role: recent branch contributor and assignee; confidence: high; commits: e08bb5e73fab, 0722a1b7ead6; files: src/infra/heartbeat-runner.ts, .github/workflows/plugin-clawhub-release.yml, CHANGELOG.md)
  • vincentkoc: git blame on current main points the central heartbeat preflight and commitment fan-out lines to commit 51e0997 by Vincent Koc, making this a strong routing signal for the heartbeat runner behavior. (role: recent area contributor; confidence: medium; commits: 51e0997c2bbd; files: src/infra/heartbeat-runner.ts)
  • clawsweeper[bot]: The related merged repair PR changed the same heartbeat runner and commitment test surface for an adjacent due-commitment task-mixing bug. (role: adjacent repair author; confidence: medium; commits: 955a0e9c0f7d; files: src/infra/heartbeat-runner.ts, src/infra/heartbeat-runner.commitments.test.ts)
  • vignesh07: The related merged PR body credits earlier commitment-safety behavior under review to Vignesh, which is relevant history for the same heartbeat/commitment area. (role: introduced adjacent commitment behavior; confidence: medium; commits: b277ae3f4c40; files: src/infra/heartbeat-runner.ts, src/infra/heartbeat-runner.commitments.test.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. mantis: telegram-visible-proof Mantis should capture Telegram visible proof. P2 Normal backlog priority with limited blast radius. labels Jun 30, 2026
@clawsweeper
clawsweeper Bot temporarily deployed to qa-live-shared June 30, 2026 13:58 Inactive
@openclaw-mantis

openclaw-mantis Bot commented Jun 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Mantis Telegram Desktop Proof

Summary: Mantis captured native Telegram Desktop before/after GIF evidence with Convex-leased Telegram credentials.

Main screenshot This PR screenshot
Baseline native Telegram Desktop screenshot Candidate native Telegram Desktop screenshot
Main This PR
Baseline native Telegram Desktop proof GIF Candidate native Telegram Desktop proof GIF

Motion-trimmed clips:

Raw QA files: https://artifacts.openclaw.ai/mantis/telegram-desktop/pr-98169/run-28488853390-1/index.json

@bdjben

bdjben commented Jun 30, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

Added redacted after-fix real runtime proof to the PR body under Evidence -> Real Runtime Proof. The proof references the native Telegram Desktop candidate pass at the PR SHA, plus the proof comment, run, artifact, raw QA index, screenshot, GIF, and MP4.

@clawsweeper

clawsweeper Bot commented Jun 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. proof: 🎥 video Contributor real behavior proof includes video or recording evidence. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jun 30, 2026
@bdjben
bdjben marked this pull request as ready for review June 30, 2026 17:46
@steipete steipete self-assigned this Jun 30, 2026
@openclaw-barnacle openclaw-barnacle Bot added app: web-ui App: web-ui gateway Gateway runtime agents Agent runtime and tooling extensions: codex extensions: copilot size: L and removed size: S labels Jul 1, 2026
@clawsweeper clawsweeper Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jul 1, 2026
@openclaw-barnacle openclaw-barnacle Bot added channel: tlon Channel integration: tlon channel: voice-call Channel integration: voice-call channel: whatsapp-web Channel integration: whatsapp-web channel: zalo Channel integration: zalo channel: zalouser Channel integration: zalouser app: android App: android app: ios App: ios extensions: copilot-proxy Extension: copilot-proxy extensions: diagnostics-otel Extension: diagnostics-otel extensions: llm-task Extension: llm-task extensions: lobster Extension: lobster extensions: memory-core Extension: memory-core extensions: memory-lancedb Extension: memory-lancedb extensions: open-prose Extension: open-prose cli CLI command changes scripts Repository scripts commands Command implementations channel: feishu Channel integration: feishu channel: twitch Channel integration: twitch channel: irc extensions: acpx extensions: anthropic extensions: openai extensions: minimax labels Jul 1, 2026
@github-actions

github-actions Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

  • extensions/acpx/npm-shrinkwrap.json
  • extensions/acpx/package.json
  • extensions/admin-http-rpc/package.json
  • extensions/alibaba/package.json
  • extensions/amazon-bedrock-mantle/npm-shrinkwrap.json
  • extensions/amazon-bedrock-mantle/package.json
  • extensions/amazon-bedrock/npm-shrinkwrap.json
  • extensions/amazon-bedrock/package.json
  • extensions/anthropic-vertex/npm-shrinkwrap.json
  • extensions/anthropic-vertex/package.json
  • extensions/anthropic/package.json
  • extensions/arcee/npm-shrinkwrap.json
  • extensions/arcee/package.json
  • extensions/azure-speech/package.json
  • extensions/bonjour/package.json
  • extensions/brave/npm-shrinkwrap.json
  • extensions/brave/package.json
  • extensions/browser/package.json
  • extensions/byteplus/package.json
  • extensions/canvas/package.json
  • extensions/cerebras/npm-shrinkwrap.json
  • extensions/cerebras/package.json
  • extensions/chutes/npm-shrinkwrap.json
  • extensions/chutes/package.json
  • extensions/clickclack/npm-shrinkwrap.json
  • 182 additional dependency-related files not shown

Maintainer follow-up:

  • Review whether the dependency changes are intentional.
  • Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.
  • Treat package-lock.json and npm-shrinkwrap.json diffs as security-review surfaces.
  • Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

@github-actions

github-actions Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

Dependency graph changes are blocked

OpenClaw does not accept dependency graph changes through PRs unless a repository admin or security explicitly authorizes the current head SHA. Dependency updates are generated internally by maintainers so external PRs cannot change the resolved graph.

Detected dependency graph changes:

  • extensions/acpx/npm-shrinkwrap.json changed.
  • extensions/amazon-bedrock-mantle/npm-shrinkwrap.json changed.
  • extensions/amazon-bedrock/npm-shrinkwrap.json changed.
  • extensions/anthropic-vertex/npm-shrinkwrap.json changed.
  • extensions/arcee/npm-shrinkwrap.json changed.
  • extensions/brave/npm-shrinkwrap.json changed.
  • extensions/cerebras/npm-shrinkwrap.json changed.
  • extensions/chutes/npm-shrinkwrap.json changed.
  • extensions/clickclack/npm-shrinkwrap.json changed.
  • extensions/cloudflare-ai-gateway/npm-shrinkwrap.json changed.
  • extensions/codex/npm-shrinkwrap.json changed.
  • extensions/cohere/npm-shrinkwrap.json changed.
  • extensions/copilot/npm-shrinkwrap.json changed.
  • extensions/deepinfra/npm-shrinkwrap.json changed.
  • extensions/deepseek/npm-shrinkwrap.json changed.
  • extensions/diagnostics-otel/npm-shrinkwrap.json changed.
  • extensions/diagnostics-prometheus/npm-shrinkwrap.json changed.
  • extensions/diffs-language-pack/npm-shrinkwrap.json changed.
  • extensions/diffs/npm-shrinkwrap.json changed.
  • extensions/discord/npm-shrinkwrap.json changed.
  • extensions/exa/npm-shrinkwrap.json changed.
  • extensions/feishu/npm-shrinkwrap.json changed.
  • extensions/firecrawl/npm-shrinkwrap.json changed.
  • extensions/fireworks/npm-shrinkwrap.json changed.
  • extensions/gmi/npm-shrinkwrap.json changed.
  • extensions/google-meet/npm-shrinkwrap.json changed.
  • extensions/googlechat/npm-shrinkwrap.json changed.
  • extensions/gradium/npm-shrinkwrap.json changed.
  • extensions/groq/npm-shrinkwrap.json changed.
  • extensions/inworld/npm-shrinkwrap.json changed.
  • extensions/irc/npm-shrinkwrap.json changed.
  • extensions/kilocode/npm-shrinkwrap.json changed.
  • extensions/kimi-coding/npm-shrinkwrap.json changed.
  • extensions/line/npm-shrinkwrap.json changed.
  • extensions/llama-cpp/npm-shrinkwrap.json changed.
  • extensions/lobster/npm-shrinkwrap.json changed.
  • extensions/matrix/npm-shrinkwrap.json changed.
  • extensions/mattermost/npm-shrinkwrap.json changed.
  • extensions/memory-lancedb/npm-shrinkwrap.json changed.
  • extensions/moonshot/npm-shrinkwrap.json changed.
  • extensions/msteams/npm-shrinkwrap.json changed.
  • extensions/nextcloud-talk/npm-shrinkwrap.json changed.
  • extensions/nostr/npm-shrinkwrap.json changed.
  • extensions/openshell/npm-shrinkwrap.json changed.
  • extensions/parallel/npm-shrinkwrap.json changed.
  • extensions/perplexity/npm-shrinkwrap.json changed.
  • extensions/pixverse/npm-shrinkwrap.json changed.
  • extensions/qianfan/npm-shrinkwrap.json changed.
  • extensions/qqbot/npm-shrinkwrap.json changed.
  • extensions/qwen/npm-shrinkwrap.json changed.
  • extensions/raft/npm-shrinkwrap.json changed.
  • extensions/searxng/npm-shrinkwrap.json changed.
  • extensions/signal/npm-shrinkwrap.json changed.
  • extensions/slack/npm-shrinkwrap.json changed.
  • extensions/sms/npm-shrinkwrap.json changed.
  • extensions/stepfun/npm-shrinkwrap.json changed.
  • extensions/synology-chat/npm-shrinkwrap.json changed.
  • extensions/tavily/npm-shrinkwrap.json changed.
  • extensions/tencent/npm-shrinkwrap.json changed.
  • extensions/tlon/npm-shrinkwrap.json changed.
  • extensions/tokenjuice/npm-shrinkwrap.json changed.
  • extensions/twitch/npm-shrinkwrap.json changed.
  • extensions/venice/npm-shrinkwrap.json changed.
  • extensions/vercel-ai-gateway/npm-shrinkwrap.json changed.
  • extensions/voice-call/npm-shrinkwrap.json changed.
  • extensions/whatsapp/npm-shrinkwrap.json changed.
  • extensions/zai/npm-shrinkwrap.json changed.
  • extensions/zalo/npm-shrinkwrap.json changed.
  • extensions/zalouser/npm-shrinkwrap.json changed.
  • npm-shrinkwrap.json changed.
  • pnpm-lock.yaml changed.
  • extensions/acpx/package.json changed version.
  • extensions/admin-http-rpc/package.json changed version.
  • extensions/alibaba/package.json changed version.
  • extensions/amazon-bedrock-mantle/package.json changed version.
  • extensions/amazon-bedrock/package.json changed version.
  • extensions/anthropic-vertex/package.json changed version.
  • extensions/anthropic/package.json changed version.
  • extensions/arcee/package.json changed version.
  • extensions/azure-speech/package.json changed version.
  • extensions/bonjour/package.json changed version.
  • extensions/brave/package.json changed version.
  • extensions/browser/package.json changed version.
  • extensions/byteplus/package.json changed version.
  • extensions/canvas/package.json changed version.
  • extensions/cerebras/package.json changed version.
  • extensions/chutes/package.json changed version.
  • extensions/clickclack/package.json changed devDependencies, peerDependencies, version.
  • extensions/cloudflare-ai-gateway/package.json changed version.
  • extensions/codex-supervisor/package.json changed version.
  • extensions/codex/package.json changed version.
  • extensions/cohere/package.json changed version.
  • extensions/comfy/package.json changed version.
  • extensions/copilot-proxy/package.json changed version.
  • extensions/copilot/package.json changed version.
  • extensions/deepgram/package.json changed version.
  • extensions/deepinfra/package.json changed version.
  • extensions/deepseek/package.json changed version.
  • extensions/diagnostics-otel/package.json changed version.
  • extensions/diagnostics-prometheus/package.json changed version.
  • extensions/diffs-language-pack/package.json changed version.
  • extensions/diffs/package.json changed version.
  • extensions/discord/package.json changed devDependencies, peerDependencies, version.
  • extensions/document-extract/package.json changed version.
  • extensions/duckduckgo/package.json changed version.
  • extensions/elevenlabs/package.json changed version.
  • extensions/exa/package.json changed version.
  • extensions/fal/package.json changed version.
  • extensions/feishu/package.json changed devDependencies, peerDependencies, version.
  • extensions/file-transfer/package.json changed version.
  • extensions/firecrawl/package.json changed version.
  • extensions/fireworks/package.json changed version.
  • extensions/github-copilot/package.json changed version.
  • extensions/gmi/package.json changed version.
  • extensions/google-meet/package.json changed devDependencies, peerDependencies, version.
  • extensions/google/package.json changed version.
  • extensions/googlechat/package.json changed devDependencies, peerDependencies, version.
  • extensions/gradium/package.json changed version.
  • extensions/groq/package.json changed version.
  • extensions/huggingface/package.json changed version.
  • extensions/image-generation-core/package.json changed version.
  • extensions/imessage/package.json changed version.
  • extensions/inworld/package.json changed version.
  • extensions/irc/package.json changed version.
  • extensions/kilocode/package.json changed version.
  • extensions/kimi-coding/package.json changed version.
  • extensions/line/package.json changed devDependencies, peerDependencies, version.
  • extensions/litellm/package.json changed version.
  • extensions/llama-cpp/package.json changed version.
  • extensions/llm-task/package.json changed version.
  • extensions/lmstudio/package.json changed version.
  • extensions/lobster/package.json changed version.
  • extensions/matrix/package.json changed devDependencies, peerDependencies, version.
  • extensions/mattermost/package.json changed devDependencies, peerDependencies, version.
  • extensions/media-understanding-core/package.json changed version.
  • extensions/memory-core/package.json changed devDependencies, peerDependencies, version.
  • extensions/memory-lancedb/package.json changed version.
  • extensions/memory-wiki/package.json changed devDependencies, peerDependencies, version.
  • extensions/microsoft-foundry/package.json changed version.
  • extensions/microsoft/package.json changed version.
  • extensions/migrate-claude/package.json changed devDependencies, peerDependencies, version.
  • extensions/migrate-hermes/package.json changed devDependencies, peerDependencies, version.
  • extensions/minimax/package.json changed version.
  • extensions/mistral/package.json changed version.
  • extensions/moonshot/package.json changed version.
  • extensions/msteams/package.json changed devDependencies, peerDependencies, version.
  • extensions/nextcloud-talk/package.json changed devDependencies, peerDependencies, version.
  • extensions/nostr/package.json changed devDependencies, peerDependencies, version.
  • extensions/novita/package.json changed version.
  • extensions/nvidia/package.json changed version.
  • extensions/oc-path/package.json changed devDependencies, peerDependencies, version.
  • extensions/ollama/package.json changed version.
  • extensions/open-prose/package.json changed version.
  • extensions/openai/package.json changed version.
  • extensions/opencode-go/package.json changed version.
  • extensions/opencode/package.json changed version.
  • extensions/openrouter/package.json changed version.
  • extensions/openshell/package.json changed version.
  • extensions/parallel/package.json changed version.
  • extensions/perplexity/package.json changed version.
  • extensions/pixverse/package.json changed devDependencies, peerDependencies, version.
  • extensions/policy/package.json changed devDependencies, peerDependencies, version.
  • extensions/qa-channel/package.json changed devDependencies, peerDependencies, version.
  • extensions/qa-lab/package.json changed devDependencies, peerDependencies, version.
  • extensions/qa-matrix/package.json changed devDependencies, peerDependencies, version.
  • extensions/qianfan/package.json changed version.
  • extensions/qqbot/package.json changed devDependencies, peerDependencies, version.
  • extensions/qwen/package.json changed version.
  • extensions/raft/package.json changed devDependencies, peerDependencies, version.
  • extensions/runway/package.json changed version.
  • extensions/searxng/package.json changed version.
  • extensions/senseaudio/package.json changed version.
  • extensions/sglang/package.json changed version.
  • extensions/signal/package.json changed version.
  • extensions/slack/package.json changed devDependencies, peerDependencies, version.
  • extensions/sms/package.json changed version.
  • extensions/stepfun/package.json changed version.
  • extensions/synology-chat/package.json changed version.
  • extensions/synthetic/package.json changed version.
  • extensions/tavily/package.json changed version.
  • extensions/telegram/package.json changed version.
  • extensions/tencent/package.json changed version.
  • extensions/tlon/package.json changed devDependencies, peerDependencies, version.
  • extensions/together/package.json changed version.
  • extensions/tokenjuice/package.json changed devDependencies, peerDependencies, version.
  • extensions/tts-local-cli/package.json changed version.
  • extensions/twitch/package.json changed version.
  • extensions/venice/package.json changed version.
  • extensions/vercel-ai-gateway/package.json changed version.
  • extensions/video-generation-core/package.json changed version.
  • extensions/vllm/package.json changed version.
  • extensions/voice-call/package.json changed devDependencies, peerDependencies, version.
  • extensions/volcengine/package.json changed version.
  • extensions/voyage/package.json changed version.
  • extensions/vydra/package.json changed version.
  • extensions/web-readability/package.json changed version.
  • extensions/webhooks/package.json changed version.
  • extensions/whatsapp/package.json changed devDependencies, peerDependencies, version.
  • extensions/workboard/package.json changed devDependencies, peerDependencies, version.
  • extensions/xai/package.json changed version.
  • extensions/xiaomi/package.json changed version.
  • extensions/zai/package.json changed version.
  • extensions/zalo/package.json changed devDependencies, peerDependencies, version.
  • extensions/zalouser/package.json changed devDependencies, peerDependencies, version.
  • package.json changed version.
  • packages/speech-core/package.json changed dependencies.

Auto-scrub was not attempted because this PR changes package manifest dependency graph fields:

  • extensions/acpx/package.json changed version.
  • extensions/admin-http-rpc/package.json changed version.
  • extensions/alibaba/package.json changed version.
  • extensions/amazon-bedrock-mantle/package.json changed version.
  • extensions/amazon-bedrock/package.json changed version.
  • extensions/anthropic-vertex/package.json changed version.
  • extensions/anthropic/package.json changed version.
  • extensions/arcee/package.json changed version.
  • extensions/azure-speech/package.json changed version.
  • extensions/bonjour/package.json changed version.
  • extensions/brave/package.json changed version.
  • extensions/browser/package.json changed version.
  • extensions/byteplus/package.json changed version.
  • extensions/canvas/package.json changed version.
  • extensions/cerebras/package.json changed version.
  • extensions/chutes/package.json changed version.
  • extensions/clickclack/package.json changed devDependencies, peerDependencies, version.
  • extensions/cloudflare-ai-gateway/package.json changed version.
  • extensions/codex-supervisor/package.json changed version.
  • extensions/codex/package.json changed version.
  • extensions/cohere/package.json changed version.
  • extensions/comfy/package.json changed version.
  • extensions/copilot-proxy/package.json changed version.
  • extensions/copilot/package.json changed version.
  • extensions/deepgram/package.json changed version.
  • extensions/deepinfra/package.json changed version.
  • extensions/deepseek/package.json changed version.
  • extensions/diagnostics-otel/package.json changed version.
  • extensions/diagnostics-prometheus/package.json changed version.
  • extensions/diffs-language-pack/package.json changed version.
  • extensions/diffs/package.json changed version.
  • extensions/discord/package.json changed devDependencies, peerDependencies, version.
  • extensions/document-extract/package.json changed version.
  • extensions/duckduckgo/package.json changed version.
  • extensions/elevenlabs/package.json changed version.
  • extensions/exa/package.json changed version.
  • extensions/fal/package.json changed version.
  • extensions/feishu/package.json changed devDependencies, peerDependencies, version.
  • extensions/file-transfer/package.json changed version.
  • extensions/firecrawl/package.json changed version.
  • extensions/fireworks/package.json changed version.
  • extensions/github-copilot/package.json changed version.
  • extensions/gmi/package.json changed version.
  • extensions/google-meet/package.json changed devDependencies, peerDependencies, version.
  • extensions/google/package.json changed version.
  • extensions/googlechat/package.json changed devDependencies, peerDependencies, version.
  • extensions/gradium/package.json changed version.
  • extensions/groq/package.json changed version.
  • extensions/huggingface/package.json changed version.
  • extensions/image-generation-core/package.json changed version.
  • extensions/imessage/package.json changed version.
  • extensions/inworld/package.json changed version.
  • extensions/irc/package.json changed version.
  • extensions/kilocode/package.json changed version.
  • extensions/kimi-coding/package.json changed version.
  • extensions/line/package.json changed devDependencies, peerDependencies, version.
  • extensions/litellm/package.json changed version.
  • extensions/llama-cpp/package.json changed version.
  • extensions/llm-task/package.json changed version.
  • extensions/lmstudio/package.json changed version.
  • extensions/lobster/package.json changed version.
  • extensions/matrix/package.json changed devDependencies, peerDependencies, version.
  • extensions/mattermost/package.json changed devDependencies, peerDependencies, version.
  • extensions/media-understanding-core/package.json changed version.
  • extensions/memory-core/package.json changed devDependencies, peerDependencies, version.
  • extensions/memory-lancedb/package.json changed version.
  • extensions/memory-wiki/package.json changed devDependencies, peerDependencies, version.
  • extensions/microsoft-foundry/package.json changed version.
  • extensions/microsoft/package.json changed version.
  • extensions/migrate-claude/package.json changed devDependencies, peerDependencies, version.
  • extensions/migrate-hermes/package.json changed devDependencies, peerDependencies, version.
  • extensions/minimax/package.json changed version.
  • extensions/mistral/package.json changed version.
  • extensions/moonshot/package.json changed version.
  • extensions/msteams/package.json changed devDependencies, peerDependencies, version.
  • extensions/nextcloud-talk/package.json changed devDependencies, peerDependencies, version.
  • extensions/nostr/package.json changed devDependencies, peerDependencies, version.
  • extensions/novita/package.json changed version.
  • extensions/nvidia/package.json changed version.
  • extensions/oc-path/package.json changed devDependencies, peerDependencies, version.
  • extensions/ollama/package.json changed version.
  • extensions/open-prose/package.json changed version.
  • extensions/openai/package.json changed version.
  • extensions/opencode-go/package.json changed version.
  • extensions/opencode/package.json changed version.
  • extensions/openrouter/package.json changed version.
  • extensions/openshell/package.json changed version.
  • extensions/parallel/package.json changed version.
  • extensions/perplexity/package.json changed version.
  • extensions/pixverse/package.json changed devDependencies, peerDependencies, version.
  • extensions/policy/package.json changed devDependencies, peerDependencies, version.
  • extensions/qa-channel/package.json changed devDependencies, peerDependencies, version.
  • extensions/qa-lab/package.json changed devDependencies, peerDependencies, version.
  • extensions/qa-matrix/package.json changed devDependencies, peerDependencies, version.
  • extensions/qianfan/package.json changed version.
  • extensions/qqbot/package.json changed devDependencies, peerDependencies, version.
  • extensions/qwen/package.json changed version.
  • extensions/raft/package.json changed devDependencies, peerDependencies, version.
  • extensions/runway/package.json changed version.
  • extensions/searxng/package.json changed version.
  • extensions/senseaudio/package.json changed version.
  • extensions/sglang/package.json changed version.
  • extensions/signal/package.json changed version.
  • extensions/slack/package.json changed devDependencies, peerDependencies, version.
  • extensions/sms/package.json changed version.
  • extensions/stepfun/package.json changed version.
  • extensions/synology-chat/package.json changed version.
  • extensions/synthetic/package.json changed version.
  • extensions/tavily/package.json changed version.
  • extensions/telegram/package.json changed version.
  • extensions/tencent/package.json changed version.
  • extensions/tlon/package.json changed devDependencies, peerDependencies, version.
  • extensions/together/package.json changed version.
  • extensions/tokenjuice/package.json changed devDependencies, peerDependencies, version.
  • extensions/tts-local-cli/package.json changed version.
  • extensions/twitch/package.json changed version.
  • extensions/venice/package.json changed version.
  • extensions/vercel-ai-gateway/package.json changed version.
  • extensions/video-generation-core/package.json changed version.
  • extensions/vllm/package.json changed version.
  • extensions/voice-call/package.json changed devDependencies, peerDependencies, version.
  • extensions/volcengine/package.json changed version.
  • extensions/voyage/package.json changed version.
  • extensions/vydra/package.json changed version.
  • extensions/web-readability/package.json changed version.
  • extensions/webhooks/package.json changed version.
  • extensions/whatsapp/package.json changed devDependencies, peerDependencies, version.
  • extensions/workboard/package.json changed devDependencies, peerDependencies, version.
  • extensions/xai/package.json changed version.
  • extensions/xiaomi/package.json changed version.
  • extensions/zai/package.json changed version.
  • extensions/zalo/package.json changed devDependencies, peerDependencies, version.
  • extensions/zalouser/package.json changed devDependencies, peerDependencies, version.
  • package.json changed version.
  • packages/speech-core/package.json changed dependencies.

Dependency graph changes must be reviewed by security or handled by maintainers internally. Please remove lockfile changes manually if they are not needed.

To remove lockfile changes, restore them from the target branch:

git fetch origin
git checkout 'origin/main' -- 'extensions/acpx/npm-shrinkwrap.json' 'extensions/amazon-bedrock-mantle/npm-shrinkwrap.json' 'extensions/amazon-bedrock/npm-shrinkwrap.json' 'extensions/anthropic-vertex/npm-shrinkwrap.json' 'extensions/arcee/npm-shrinkwrap.json' 'extensions/brave/npm-shrinkwrap.json' 'extensions/cerebras/npm-shrinkwrap.json' 'extensions/chutes/npm-shrinkwrap.json' 'extensions/clickclack/npm-shrinkwrap.json' 'extensions/cloudflare-ai-gateway/npm-shrinkwrap.json' 'extensions/codex/npm-shrinkwrap.json' 'extensions/cohere/npm-shrinkwrap.json' 'extensions/copilot/npm-shrinkwrap.json' 'extensions/deepinfra/npm-shrinkwrap.json' 'extensions/deepseek/npm-shrinkwrap.json' 'extensions/diagnostics-otel/npm-shrinkwrap.json' 'extensions/diagnostics-prometheus/npm-shrinkwrap.json' 'extensions/diffs-language-pack/npm-shrinkwrap.json' 'extensions/diffs/npm-shrinkwrap.json' 'extensions/discord/npm-shrinkwrap.json' 'extensions/exa/npm-shrinkwrap.json' 'extensions/feishu/npm-shrinkwrap.json' 'extensions/firecrawl/npm-shrinkwrap.json' 'extensions/fireworks/npm-shrinkwrap.json' 'extensions/gmi/npm-shrinkwrap.json' 'extensions/google-meet/npm-shrinkwrap.json' 'extensions/googlechat/npm-shrinkwrap.json' 'extensions/gradium/npm-shrinkwrap.json' 'extensions/groq/npm-shrinkwrap.json' 'extensions/inworld/npm-shrinkwrap.json' 'extensions/irc/npm-shrinkwrap.json' 'extensions/kilocode/npm-shrinkwrap.json' 'extensions/kimi-coding/npm-shrinkwrap.json' 'extensions/line/npm-shrinkwrap.json' 'extensions/llama-cpp/npm-shrinkwrap.json' 'extensions/lobster/npm-shrinkwrap.json' 'extensions/matrix/npm-shrinkwrap.json' 'extensions/mattermost/npm-shrinkwrap.json' 'extensions/memory-lancedb/npm-shrinkwrap.json' 'extensions/moonshot/npm-shrinkwrap.json' 'extensions/msteams/npm-shrinkwrap.json' 'extensions/nextcloud-talk/npm-shrinkwrap.json' 'extensions/nostr/npm-shrinkwrap.json' 'extensions/openshell/npm-shrinkwrap.json' 'extensions/parallel/npm-shrinkwrap.json' 'extensions/perplexity/npm-shrinkwrap.json' 'extensions/pixverse/npm-shrinkwrap.json' 'extensions/qianfan/npm-shrinkwrap.json' 'extensions/qqbot/npm-shrinkwrap.json' 'extensions/qwen/npm-shrinkwrap.json' 'extensions/raft/npm-shrinkwrap.json' 'extensions/searxng/npm-shrinkwrap.json' 'extensions/signal/npm-shrinkwrap.json' 'extensions/slack/npm-shrinkwrap.json' 'extensions/sms/npm-shrinkwrap.json' 'extensions/stepfun/npm-shrinkwrap.json' 'extensions/synology-chat/npm-shrinkwrap.json' 'extensions/tavily/npm-shrinkwrap.json' 'extensions/tencent/npm-shrinkwrap.json' 'extensions/tlon/npm-shrinkwrap.json' 'extensions/tokenjuice/npm-shrinkwrap.json' 'extensions/twitch/npm-shrinkwrap.json' 'extensions/venice/npm-shrinkwrap.json' 'extensions/vercel-ai-gateway/npm-shrinkwrap.json' 'extensions/voice-call/npm-shrinkwrap.json' 'extensions/whatsapp/npm-shrinkwrap.json' 'extensions/zai/npm-shrinkwrap.json' 'extensions/zalo/npm-shrinkwrap.json' 'extensions/zalouser/npm-shrinkwrap.json' 'npm-shrinkwrap.json' 'pnpm-lock.yaml'
git commit -m 'chore: remove dependency lockfile change'
git push

If this PR intentionally needs a dependency graph change, ask a repository admin or member of @openclaw/openclaw-secops to comment:

/allow-dependencies-change

The action will approve the current head SHA (0722a1b7ead60dac9955e494dc1507f5f9c830d2) when it reruns. A later push requires a fresh approval.

@steipete

steipete commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

Land-ready proof for exact head 0722a1b7ead60dac9955e494dc1507f5f9c830d2:

  • Final behavior: commitment fan-out is selected only through the private closed HeartbeatRunScope = "commitment-only"; ordinary heartbeats remain global. Commitment-only runs process only the due commitment and leave periodic tasks/timestamps, HEARTBEAT/bootstrap/global prompts, queued system/plugin context, subagent steering, and the one-shot aborted-run hint untouched. Isolated session identity and delivery routing remain unchanged.
  • Focused local proof:
    node scripts/run-vitest.mjs src/agents/embedded-agent-runner/run/attempt.spawn-workspace.context-engine.test.ts src/auto-reply/reply/get-reply-run.media-only.test.ts src/infra/heartbeat-runner.commitments.test.ts src/agents/embedded-agent-runner/run/attempt.prompt-helpers.test.ts src/agents/harness/prompt-compaction-hook-helpers.test.ts extensions/codex/src/app-server/thread-lifecycle.test.ts extensions/codex/src/app-server/run-attempt.context-engine.test.ts
    — 7 files, 283/283 tests passed.
  • Broad commitment/global runtime proof: Blacksmith Testbox tbx_01kwdhq565h90s0c32a8m0tez8 (jade-krill), 14 files and 728/728 tests passed across 7 shards.
  • Fresh changed gate:
    env CI=true OPENCLAW_CHECK_CHANGED_REMOTE_CHILD=1 OPENCLAW_CHANGED_LANES_RAW_SYNC=1 corepack pnpm check:changed
    — Blacksmith Testbox tbx_01kwdm4y55wxt582k3ra632hmh (brisk-lobster), run 28486841407, all tsgo, oxlint, import-cycle, SDK/export, and changed guards passed.
  • Exact-head hosted gates all passed: CI 28488806614, Blacksmith Testbox 28488806599, ARM Testbox 28488806595, Build Artifacts Testbox 28488806588, and Workflow Sanity 28488806576.
  • Native Telegram Desktop proof passed on AWS Crabbox: Mantis run 28488853390, artifact 7999198366, before/after screenshots and GIFs. Baseline passed; exact candidate passed/fixed; overall pass. The published bundle intentionally sanitizes the ephemeral lease ID.
  • node scripts/plugin-sdk-surface-report.mjs --check, git diff --check, oxfmt, build, and fresh autoreview all passed; autoreview had no accepted/actionable findings. No unresolved review threads remain.
  • Direct Codex contract checked: codex-rs/app-server-protocol/src/protocol/v2/turn.rs:68-157 and codex-rs/app-server/src/request_processors/turn_processor.rs:155-173,442-540; the generic turn API has no OpenClaw heartbeat field, so the scope correctly remains OpenClaw-internal.

No known proof gaps remain.

@steipete

steipete commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

Merged via squash.

@github-actions github-actions Bot mentioned this pull request Jul 1, 2026
Open
@clawsweeper clawsweeper Bot mentioned this pull request Jul 1, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@steipete steipete

Labels

agents Agent runtime and tooling app: android App: android app: ios App: ios app: web-ui App: web-ui channel: discord Channel integration: discord channel: feishu Channel integration: feishu channel: googlechat Channel integration: googlechat channel: imessage Channel integration: imessage channel: irc channel: line Channel integration: line channel: matrix Channel integration: matrix channel: mattermost Channel integration: mattermost channel: msteams Channel integration: msteams channel: nextcloud-talk Channel integration: nextcloud-talk channel: nostr Channel integration: nostr channel: qa-channel Channel integration: qa-channel channel: qqbot channel: raft Channel integration: Raft channel: signal Channel integration: signal channel: slack Channel integration: slack channel: sms Channel integration: sms channel: synology-chat channel: telegram Channel integration: telegram channel: tlon Channel integration: tlon channel: twitch Channel integration: twitch channel: voice-call Channel integration: voice-call channel: whatsapp-web Channel integration: whatsapp-web channel: zalo Channel integration: zalo channel: zalouser Channel integration: zalouser cli CLI command changes commands Command implementations docs Improvements or additions to documentation extensions: acpx extensions: admin-http-rpc extensions: anthropic extensions: arcee extensions: byteplus extensions: cerebras extensions: cloudflare-ai-gateway extensions: codex extensions: codex-supervisor Extension: codex-supervisor extensions: copilot extensions: copilot-proxy Extension: copilot-proxy extensions: deepinfra extensions: deepseek extensions: diagnostics-otel Extension: diagnostics-otel extensions: diagnostics-prometheus extensions: duckduckgo extensions: gmi extensions: huggingface extensions: inworld Extension: inworld extensions: kilocode extensions: kimi-coding extensions: litellm extensions: llama-cpp extensions: llm-task Extension: llm-task extensions: lmstudio extensions: lobster Extension: lobster extensions: memory-core Extension: memory-core extensions: memory-lancedb Extension: memory-lancedb extensions: memory-wiki extensions: minimax extensions: moonshot extensions: novita extensions: nvidia extensions: oc-path extensions: open-prose Extension: open-prose extensions: openai extensions: policy extensions: qa-lab extensions: qianfan extensions: senseaudio extensions: stepfun extensions: synthetic extensions: tavily extensions: tencent extensions: together extensions: tokenjuice Changes to the bundled tokenjuice extension extensions: tts-local-cli extensions: venice extensions: vercel-ai-gateway extensions: webhooks gateway Gateway runtime mantis: telegram-visible-proof Mantis should capture Telegram visible proof. merge-risk: 🚨 message-delivery 🚨 May drop, duplicate, misroute, suppress, or wrongly target messages. merge-risk: 🚨 session-state 🚨 May lose, corrupt, stale, or mis-associate session, agent, or context state. P2 Normal backlog priority with limited blast radius. plugin: azure-speech Azure Speech plugin plugin: bonjour Plugin integration: bonjour plugin: file-transfer plugin: google-meet plugin: migrate-claude plugin: migrate-hermes plugin: pixverse plugin: workboard proof: 📸 screenshot Contributor real behavior proof includes screenshot evidence. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. scripts Repository scripts size: XL status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bdjben @steipete