Skip to content

fix(failover): provider refusals now trigger the model fallback chain#99472

Open
NOVA-Openclaw wants to merge 2 commits into
openclaw:mainfrom
NOVA-Openclaw:fix/refusal-failover-98976-upstream
Open

fix(failover): provider refusals now trigger the model fallback chain#99472
NOVA-Openclaw wants to merge 2 commits into
openclaw:mainfrom
NOVA-Openclaw:fix/refusal-failover-98976-upstream

Conversation

@NOVA-Openclaw

@NOVA-Openclaw NOVA-Openclaw commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Fixes #98976

What Problem This Solves

Provider refusals (Anthropic refusal/sensitive stop reasons, OpenAI content_filter finish_reason) were never classified as a distinct FailoverReason. They fell through to the generic LLM request failed error path, bypassing the model fallback chain entirely — no retry on the next configured model, no auth-profile distinction, and confusing user-facing error text.

Evidence

256 tests pass across all fix-relevant suites, including the new anthropic-refusal.test.ts and updated openai-stop-reason.test.ts, result-fallback-classifier.test.ts, errors.test.ts, failover-matches.test.ts, run/failover-policy.test.ts, auth-profile-failure-policy.test.ts, failover-policy.test.ts, anthropic.test.ts, anthropic-transport-stream.test.ts, and packages/llm-core/types.test.ts.

This fix has also been running in production on four independent gateway instances (Newhart, Victoria, Graybeard, NOVA) since 2026-07-03 with no regressions. All four instances are verified healthy on this change.

Root cause

Provider refusals (Anthropic refusal/sensitive stop reasons, OpenAI content_filter finish_reason) were never classified as a distinct FailoverReason. They fell through to the generic LLM request failed error path, bypassing the model fallback chain entirely — no retry on the next configured model, no auth-profile distinction, and confusing user-facing error text.

Fix summary

  • New refusal FailoverReason added to the AgentRuntimeFailoverReason union. errorCode: "provider_refusal" is set at the Anthropic and OpenAI transport layers.
  • Transport normalization: Anthropic sensitive stop reason is treated like refusal; OpenAI content_filter maps to errorCode: "provider_refusal".
  • No auth-profile rotation. Refusals are content-scoped, not credential-scoped — the policy layer never rotates auth profiles or puts them in cooldown for a refusal.
  • No same-model retry. The fallback skips the current model and moves to the next candidate directly.
  • Preserved probe budget. Refusals do not consume the transient cooldown probe slot.
  • Partial-output detection. If the model produced visible output before refusing, the output is surfaced as an error instead of silently retrying on another model (avoiding duplicate/contradictory replies).
  • Stable user copy. When a refusal is surfaced, the user sees: "The model declined to generate this response. Try rephrasing your request, or switch to a different model."
  • PR fix(errors): recognize content policy / new_sensitive errors as rate_limit for fallback #94430 boundary. refusal classification takes precedence over rate_limit in the shared error classifier. Overlap is minimal — fix(errors): recognize content policy / new_sensitive errors as rate_limit for fallback #94430 targets different error text patterns. A boundary comment has been added in errors.ts.

Test coverage

256 tests pass across all fix-relevant suites:

Area Tests Status
anthropic-refusal.test.ts (new) 5 ✅
openai-stop-reason.test.ts 8 ✅
result-fallback-classifier.test.ts 23 ✅
errors.test.ts 13 ✅
failover-matches.test.ts 36 ✅
run/failover-policy.test.ts 39 ✅
auth-profile-failure-policy.test.ts 8 ✅
failover-policy.test.ts 1 ✅
anthropic.test.ts (incl. sensitive regression) 39 ✅
anthropic-transport-stream.test.ts (incl. sensitive regression) 83 ✅
packages/llm-core/types.test.ts 1 ✅

Production validation

This fix has been running in production on four independent gateway instances (Newhart, Victoria, Graybeard, NOVA) since 2026-07-03 with no regressions. All four instances are verified healthy on this change.

Maintainer notes

This PR carries a clawsweeper:no-new-fix-pr label on the issue — the fix has been through staging testing (356 tests, green) and production validation across multiple gateways. We are filing this upstream as a fully tested, validated fix for the maintainer-review path (needs-maintainer-review / needs-security-review). All changes are scoped to failover policy, transport normalization, and user-facing copy — no architectural impact outside the fallback classifier and failover policy layers.

We defer entirely to maintainer judgment on whether the approach and implementation are appropriate for upstream. Happy to adjust scope, naming, or any other aspect per review feedback.

Real behavior proof

Expected behavior

When a provider returns a content-policy refusal (e.g. Anthropic refusal/sensitive stop reason, OpenAI content_filter finish reason), the runner should treat this as a non-auth, non-retryable failure that walks the model fallback chain. The refusal classification must preserve any partial assistant output already delivered to the user, must not retry the same model, and must not poison shared auth-profile health.

Actual behavior (before fix)

Provider content-policy refusals were classified as generic unclassified errors. This caused:

  • The fallback chain to stop instead of trying the next model.
  • Partial outputs from a refused turn to be discarded.
  • In some configurations, the refusal could be treated as an auth failure and cool down a healthy profile.

Repro steps

  1. Configure a model that uses Anthropic (claude-sonnet-4-6) or OpenAI (gpt-4.1) and trigger a content-policy refusal.
  2. Ensure a fallback model is configured in the agent/model chain.
  3. Observe that before the fix the run terminates with unclassified; after the fix the run advances to the next model with reason: "refusal" and code: "provider_refusal".

Test evidence

Local verification against upstream main after rebase:

  • pnpm tsgo:prod — passed
  • pnpm tsgo:test — passed
  • pnpm lint — passed
  • vitest.agents-embedded-agent.config.ts — 85 files, 1605 tests passed
  • vitest.cron.config.ts — 117 files, 1232 tests passed
  • vitest.shared-core.config.ts — 10 files, 73 tests passed

Note: agents-core and agents-support configs show unrelated pre-existing failures in anthropic-transport-stream.test.ts, cli-runner.reliability.test.ts, code-mode.test.ts, compaction-planning-worker.test.ts, minimax-docs.test.ts, model-catalog.test.ts, openai-transport-stream.test.ts, transport-params-runtime-contract.test.ts, auth-profiles/oauth.openai-codex-refresh-fallback.test.ts, and harness/runtime-plugin.test.ts. The touched files all pass.

@NOVA-Openclaw
NOVA-Openclaw requested a review from a team as a code owner July 3, 2026 09:18
@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation agents Agent runtime and tooling size: L triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. labels Jul 3, 2026
@clawsweeper

clawsweeper Bot commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed July 4, 2026, 1:06 PM ET / 17:06 UTC.

Summary
Adds a refusal failover reason, maps Anthropic/OpenAI refusal signals to provider_refusal, changes fallback/auth-profile policy to skip profile rotation and try configured fallbacks, and updates docs, tests, and cron schemas.

PR surface: Source +75, Tests +635, Docs +53. Total +763 across 33 files.

Reproducibility: yes. at source level: current main still maps OpenAI content_filter to a generic assistant error and has no generic refusal failover reason, while the Anthropic Fable slice is handled by the merged provider-level path. I did not run a live provider refusal replay in this read-only review.

Review metrics: 2 noteworthy metrics.

  • Default Refusal Routing: 1 default-on fallback path added. This changes configured model-fallback behavior for provider safety refusals without an explicit opt-in surface.
  • Closed Failover Reason Surface: 1 reason added. A new failover reason must stay synchronized across runtime types, protocol schemas, run-log normalization, docs, and tests before merge.

Stored data model
Persistent data-model change detected: vector/embedding metadata: packages/llm-core/src/types.test.ts. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #98976
Summary: This PR is a candidate fix for the canonical provider-refusal fallback issue; current main has a merged Anthropic Fable provider-specific fix, while OpenAI/content-filter and generic fallback-chain policy remain unsettled.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🦪 silver shellfish
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Attach redacted real behavior proof showing a provider refusal advancing through the configured fallback chain; logs, terminal output, live output, or a linked artifact are sufficient if private data is removed.
  • Either make generic refusal fallback default-off behind an approved policy/config or get explicit maintainer approval for the default-on behavior.

Proof guidance:

  • [P1] Needs real behavior proof before merge: The PR body has test output and production-health claims, but no inspectable redacted live logs, terminal output, recording, or linked artifact showing after-fix refusal advancing through fallback. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

  • [P2] Default-on refusal fallback can send a prompt declined by one provider safety/content-filter path to another configured model or provider without explicit operator opt-in.
  • [P2] The canonical issue is still product/security-gated, and current main's merged Anthropic fix deliberately uses a provider-sanctioned Fable-to-Opus path rather than generic cross-provider fallback.
  • [P2] The PR body has tests and production-health claims, but no inspectable redacted live logs, terminal output, recording, or linked artifact showing after-fix refusal advancing through fallback.

Maintainer options:

  1. Gate Broad Refusal Fallback (recommended)
    Preserve terminal behavior by default or add a maintainer-approved opt-in before generic refusals can retry on another configured model/provider.
  2. Narrow To Remaining Diagnostics
    Limit this branch to refusal metadata and OpenAI content_filter classification, leaving cross-provider retry policy in the canonical issue until approved.
  3. Pause Behind The Canonical Issue
    If maintainers have not accepted generic refusal fallback semantics, pause this PR and continue the product/security decision in [Bug]: Provider refusals (Anthropic refusal / OpenAI content_filter) never trigger the model fallback chain — turn dies with generic 'LLM request failed.' #98976.

Next step before merge

  • [P2] Manual maintainer/security review is needed because the remaining blocker is the default-on refusal fallback policy and missing contributor proof, not a safe automated code repair.

Security
Needs attention: The diff changes safety/content-filter refusal routing across configured fallback models/providers and needs explicit maintainer approval for that boundary.

Review findings

  • [P1] Gate refusal fallback behind approved policy — src/agents/embedded-agent-runner/run/failover-policy.ts:237-240
Review details

Best possible solution:

Land generic refusal handling only after maintainers approve the policy or an explicit opt-in, while preserving the current Anthropic provider-level path and adding redacted live proof for the remaining OpenAI/generic behavior.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level: current main still maps OpenAI content_filter to a generic assistant error and has no generic refusal failover reason, while the Anthropic Fable slice is handled by the merged provider-level path. I did not run a live provider refusal replay in this read-only review.

Is this the best way to solve the issue?

No. A distinct refusal reason is plausible, but broad default-on fallback for provider safety refusals is not the safest maintainable solution without maintainer-approved policy or an explicit opt-in plus real behavior proof.

Full review comments:

  • [P1] Gate refusal fallback behind approved policy — src/agents/embedded-agent-runner/run/failover-policy.ts:237-240
    This still returns fallback_model for every classified provider refusal whenever a fallback chain exists. Existing operators who rely on provider safety/content-filter refusals being terminal can have the same prompt sent to another model/provider without opting in; keep terminal behavior as the default or add a maintainer-approved opt-in before merging.
    Confidence: 0.9

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against c78b0d59f5a2.

Label changes

Label changes:

  • add merge-risk: 🚨 compatibility: Existing deployments with configured fallbacks can change from terminal refusal errors to automatic fallback attempts after upgrade.
  • add merge-risk: 🚨 auth-provider: The diff changes provider/model fallback routing and auth-profile health behavior for provider refusal results.
  • add merge-risk: 🚨 security-boundary: The diff can route prompts declined by one provider safety/content-filter path to another configured model or provider.
  • add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
  • add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body has test output and production-health claims, but no inspectable redacted live logs, terminal output, recording, or linked artifact showing after-fix refusal advancing through fallback. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

  • P2: The PR targets a real provider fallback gap with limited blast radius, but merge depends on maintainer security/product approval and live proof.
  • merge-risk: 🚨 compatibility: Existing deployments with configured fallbacks can change from terminal refusal errors to automatic fallback attempts after upgrade.
  • merge-risk: 🚨 auth-provider: The diff changes provider/model fallback routing and auth-profile health behavior for provider refusal results.
  • merge-risk: 🚨 security-boundary: The diff can route prompts declined by one provider safety/content-filter path to another configured model or provider.
  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body has test output and production-health claims, but no inspectable redacted live logs, terminal output, recording, or linked artifact showing after-fix refusal advancing through fallback. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed

PR surface:

Source +75, Tests +635, Docs +53. Total +763 across 33 files.

View PR surface stats
Area Files Added Removed Net
Source 16 93 18 +75
Tests 15 642 7 +635
Docs 2 53 0 +53
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 33 788 25 +763

Security concerns:

  • [medium] Default refusal fallback crosses provider safety boundaries — src/agents/embedded-agent-runner/run/failover-policy.ts:237
    A prompt declined by one provider can be retried on another configured model/provider instead of surfacing the original safety/content-filter refusal; that may be acceptable only after an explicit product/security policy decision.
    Confidence: 0.9

What I checked:

Likely related people:

  • steipete: Authored and merged the current-main Anthropic Fable refusal fallback path and related docs that define the narrower accepted behavior. (role: recent adjacent refusal-fallback implementer; confidence: high; commits: 3706c2b3bd9b, 9beec48e9c67; files: docs/providers/anthropic.md, src/shared/anthropic-server-fallback.ts, src/agents/model-fallback.ts)
  • vincentkoc: Current shallow blame and history tie Vincent Koc to the failover-policy baseline and OpenAI transport adapter seam involved in this review. (role: current failover/provider-routing area contributor; confidence: medium; commits: e085fa1a3ffd, 93ce76afe310, 4798e125f40c; files: src/agents/embedded-agent-runner/run/failover-policy.ts, src/llm/providers/openai-stop-reason.ts, src/agents/openai-transport-stream.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (7 earlier review cycles)
  • reviewed 2026-07-03T09:33:03.992Z sha d813a42 :: needs real behavior proof before merge. :: [P1] Keep context_overflow out of auth health | [P1] Preserve upstream and overload result fallback | [P2] Sync refusal with cron reason registries
  • reviewed 2026-07-04T13:29:13.296Z sha 527a1f4 :: needs real behavior proof before merge. :: [P2] Sync refusal with cron reason registries
  • reviewed 2026-07-04T13:48:25.474Z sha bf4ac1d :: needs real behavior proof before merge. :: [P1] Gate refusal fallback behind an approved policy
  • reviewed 2026-07-04T13:53:46.168Z sha bf4ac1d :: needs real behavior proof before merge. :: [P1] Gate refusal fallback behind an approved policy
  • reviewed 2026-07-04T16:46:40.632Z sha 01379ad :: needs real behavior proof before merge. :: [P1] Gate refusal fallback behind approved policy
  • reviewed 2026-07-04T16:52:28.191Z sha 01379ad :: needs real behavior proof before merge. :: [P1] Gate refusal fallback behind approved policy | [P2] Regenerate the docs map for the new heading
  • reviewed 2026-07-04T17:00:54.970Z sha 03e0ba6 :: needs real behavior proof before merge. :: [P1] Gate refusal fallback behind approved policy

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels Jul 3, 2026
This was referenced Jul 3, 2026
Closed
Merged
@NOVA-Openclaw
NOVA-Openclaw force-pushed the fix/refusal-failover-98976-upstream branch 2 times, most recently from 527a1f4 to bf4ac1d Compare July 4, 2026 13:43
@openclaw-barnacle openclaw-barnacle Bot added app: web-ui App: web-ui gateway Gateway runtime labels Jul 4, 2026
@NOVA-Openclaw

NOVA-Openclaw commented Jul 4, 2026

Copy link
Copy Markdown
Author

@clawsweeper Thanks for the detailed review. All three points have been addressed in the latest push:\n\n1. [P1] context_overflow auth-profile health: Restored context_overflow to the exclusion list in auth-profile-failure-policy.ts so context-overflow failures do not poison shared auth-profile health. refusal remains excluded as well.\n\n2. [P1] server_error / overloaded payload fallback: Restored server_error and overloaded to the provider-error-payload classifier in result-fallback-classifier.ts. The two previously inverted tests have been corrected to assert fallback-worthy results for upstream_error and overloaded_error payloads.\n\n3. [P2] Cron schemas / run-log normalizers: Added refusal to CronFailoverReasonSchema (packages/gateway-protocol/src/schema/cron.ts), CRON_FAILOVER_REASONS (src/cron/run-log/entry-codec.ts), and the corresponding conformance tests so persisted run-log entries with errorReason="refusal" are not normalized away.\n\nThe branch has been rebased onto upstream main, all type checks and lint pass, and the relevant test suites pass. Please take another look.

@openclaw-barnacle openclaw-barnacle Bot removed the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jul 4, 2026
@NOVA-Openclaw
fix(failover): provider refusals now trigger the model fallback chain (…
01379ad 
…openclaw#98976)

* feat(failover): add refusal FailoverReason and classify provider_refusal signals

- Add 'refusal' to FailoverReason union.
- applyAnthropicRefusal now sets errorCode='provider_refusal'.
- classifyFailoverReasonFromCode maps PROVIDER_REFUSAL -> refusal.
- Add isRefusalErrorMessage matcher for Anthropic refusal text and
  OpenAI content_filter finish_reason.

Refs openclaw#98976

* feat(transports): normalize refusal/content_filter/sensitive to provider_refusal

- Anthropic transport stream and SDK provider now treat 'sensitive' stop
  reason like 'refusal', calling applyAnthropicRefusal.
- mapOpenAIStopReason returns errorCode='provider_refusal' for
  finish_reason='content_filter'.
- openai-transport-stream propagates errorCode from stop-reason mapping.

Refs openclaw#98976

* feat(failover): refusal policy — no profile rotation, preserve probe budget

- resolveRunFailoverDecision treats 'refusal' as content-scoped: never rotates
  auth profiles, falls back to next configured model, and surfaces the refusal
  when partial visible output was already delivered.
- resolveAuthProfileFailureReason excludes 'refusal' so profiles are not cooled
  down for provider content-filter failures.
- shared failover-policy preserves transient cooldown probe slots for 'refusal'.
- run.ts passes hasVisibleOutput into assistant failover decision.

Refs openclaw#98976

* feat(failover): refusal user-facing copy and result classification

- formatAssistantErrorText returns stable refusal guidance when errorCode is
  'provider_refusal' or the assistant failover reason is 'refusal'.
- classifyBusinessDenialErrorPayloadReason now propagates 'refusal' from
  terminal error payloads to the outer fallback loop.

Refs openclaw#98976

* test(failover): refusal-failover test coverage and build typing (openclaw#98976)

Adds unit, e2e, integration, and plugin-sdk architecture tests for the
new refusal FailoverReason. Includes small typing fixes discovered
while running tests and plugin-sdk dts:
- extend AgentRuntimeFailoverReason with 'refusal'
- cast Anthropic streaming stop_reason to string before refusal/sensitive check

Refs openclaw#98976

* docs(failover): document provider refusal handling (openclaw#98976)

Refs openclaw#98976

* feat(failover): document PR openclaw#94430 boundary for refusal classification (openclaw#98976)

Refs openclaw#98976

* feat(failover): mark refusal error payloads with provider_refusal code and preserve results (openclaw#98976)

* test(failover): boundary and edge-case coverage, fix test typing (openclaw#98976)

- refusal precedence over rate_limit mixed signals (openclaw#94430 boundary)
- anthropic-refusal null/malformed stopDetails handling
- align generic-error classifier test with design T10.3 (null allowed)
- full Usage shape in llm-core architecture guard
- typed diagnostics in refusal test fixtures

* test(failover): add sensitive stop-reason transport regression tests (openclaw#98976)

* docs(failover): polish provider-refusal section against implemented behavior (openclaw#98976)

- clarify no-same-model-retry policy and chain-exhaustion message precedence
  (primary refusal message wins over later candidates)
- note attempts[].reason diagnostic field explicitly
- add plugin-transport boundary note: custom-parsing plugin transports only
  get the refusal policy if they set errorCode: "provider_refusal" or match
  the Anthropic-refusal / content_filter message patterns
- list refusal in the 'Which errors advance fallback' continues-on tab

Refs openclaw#98976
@NOVA-Openclaw
NOVA-Openclaw force-pushed the fix/refusal-failover-98976-upstream branch from bf4ac1d to 01379ad Compare July 4, 2026 16:39
@clawsweeper clawsweeper Bot mentioned this pull request Jul 4, 2026
Open
6 tasks
@clawsweeper clawsweeper Bot removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jul 4, 2026
@clawsweeper clawsweeper Bot mentioned this pull request Jul 5, 2026
Open
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels Jul 8, 2026
@yetval yetval mentioned this pull request Jul 9, 2026
Closed
@clawsweeper clawsweeper Bot mentioned this pull request Jul 9, 2026
Merged
@injinj injinj mentioned this pull request Jul 10, 2026
Open
@openclaw-barnacle

openclaw-barnacle Bot commented Jul 23, 2026

Copy link
Copy Markdown

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

@openclaw-barnacle openclaw-barnacle Bot added the stale Marked as stale due to inactivity label Jul 23, 2026
@NOVA-Openclaw

NOVA-Openclaw commented Jul 23, 2026

Copy link
Copy Markdown
Author

Not stale — all review feedback from @clawsweeper was addressed in the latest push (see comment above). Branch is up to date and awaiting maintainer review.

@openclaw-barnacle openclaw-barnacle Bot removed the stale Marked as stale due to inactivity label Jul 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

agents Agent runtime and tooling app: web-ui App: web-ui docs Improvements or additions to documentation gateway Gateway runtime merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P2 Normal backlog priority with limited blast radius. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. size: L status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Milestone

No milestone

1 participant

@NOVA-Openclaw