policy: repair required deny tool findings by giodl73-repo · Pull Request #99700 · openclaw/openclaw

giodl73-repo · 2026-07-03T23:22:49Z

Summary

Add required-deny automatic repairs for Policy doctor findings.
Merge missing required tool ids into the exact reported tools.deny or agent tools.deny config path.
Keep the Policy workspaceRepairs=true opt-in inherited from policy: repair automatic narrowing findings #99690.
Skip scoped findings when the only available write target is inherited root tools.deny.
Document the new root/agent deny-list mutation and scoped inherited-root skip behavior.

Stack

Builds on merged policy: repair automatic narrowing findings #99690 (policy: repair automatic narrowing findings).
Current head: cd11ce139ec649e41acb8ce76020a204e474c943.
Still draft until ClawSweeper refreshes and maintainer review is clear.

Validation

node scripts/check-docs-mdx.mjs docs README.md passed: 691 files.
git diff --check passed.
PowerShell: $env:OPENCLAW_VITEST_MAX_WORKERS='1'; node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts extensions/policy/src/doctor/metadata.test.ts src/flows/doctor-repair-flow.test.ts --reporter=dot passed: 2 Vitest shards / 304 tests.
node scripts/run-tsgo.mjs -p tsconfig.extensions.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/extensions.tsbuildinfo passed.
PowerShell: $env:OPENCLAW_OXLINT_SKIP_PREPARE='1'; node scripts/run-oxlint.mjs --tsconfig config/tsconfig/oxlint.extensions.json extensions/policy/src/doctor/fix-metadata.ts extensions/policy/src/doctor/metadata.test.ts extensions/policy/src/doctor/automatic-repairs.ts extensions/policy/src/doctor/register.test.ts passed.
node --import tsx scripts/check-policy-config-coverage.ts --check --json passed with no unclassified, unmatched, or stale monitored paths.

Real behavior proof

Behavior or issue addressed:
doctor --fix repairs required deny-tool Policy findings by adding missing required tools to the reported deny-list config path, while preserving existing entries and skipping scoped inherited-root writes.

Real environment tested:
Windows PowerShell in C:\src\openclaw-fork on PR head cd11ce139ec649e41acb8ce76020a204e474c943. The proof used an isolated temp OPENCLAW_CONFIG_PATH/OPENCLAW_STATE_DIR, registered the real Policy doctor checks from source, ran the real runDoctorHealthRepairs repair flow, persisted through replaceConfigFile, and rechecked the same Policy finding.

Exact steps or command run after this patch:

Seed isolated openclaw.jsonc with plugins.entries.policy.config.workspaceRepairs=true and tools.deny=["read"].
Seed isolated policy.jsonc with tools.denyTools=["exec"].
Run node --import tsx --input-type=module source proof that invokes registerPolicyDoctorChecks, selects policy/tools-required-deny-missing, runs runDoctorHealthRepairs, persists with replaceConfigFile, then re-detects the finding.
Run the validation commands listed above.

Evidence after fix:

PROOF_DIR=C:\Users\giodl\AppData\Local\Temp\openclaw-policy-99700-real-proof-uXza6e
COMMAND_PATH=source-entry equivalent: registerPolicyDoctorChecks + runDoctorHealthRepairs + replaceConfigFile
CHECK_ID=policy/tools-required-deny-missing
BEFORE_CONFIG=
{
  "plugins": {
    "entries": {
      "policy": {
        "enabled": true,
        "config": {
          "enabled": true,
          "path": "policy.jsonc",
          "workspaceRepairs": true
        }
      }
    }
  },
  "tools": {
    "deny": ["read"]
  }
}
BEFORE_FINDINGS=1
FINDING policy/tools-required-deny-missing path=openclaw config target=oc://openclaw.config/tools/deny message=global tools config does not deny required tool 'exec'.
REPAIR_CHANGES=["Added exec to tools.deny for policy conformance."]
CHECKS_RUN=1
CHECKS_REPAIRED=1
CHECKS_VALIDATED=1
REMAINING_FINDINGS_DURING_REPAIR=0
AFTER_CONFIG=
{
  "plugins": {
    "entries": {
      "policy": {
        "enabled": true,
        "config": {
          "enabled": true,
          "path": "policy.jsonc",
          "workspaceRepairs": true
        }
      }
    }
  },
  "tools": {
    "deny": [
      "read",
      "exec"
    ]
  },
  "meta": {
    "lastTouchedVersion": "2026.6.11",
    "lastTouchedAt": "2026-07-05T23:16:50.793Z"
  }
}
AFTER_FINDINGS=0

Observed result after fix:
The seeded required-deny finding was repaired by adding exec to root tools.deny, the config was written to disk through OpenClaw's config mutation path, repair validation reported zero remaining findings, and a post-write re-detect of policy/tools-required-deny-missing returned AFTER_FINDINGS=0.

What was not tested:
A full packaged/dev CLI openclaw doctor --fix smoke was attempted with isolated OPENCLAW_CONFIG_PATH and OPENCLAW_STATE_DIR, but local Windows dev CLI startup did not return before a 240s timeout. No live provider run or live LLM call was run. Targeted pnpm exec oxfmt --check ... was also attempted locally but timed out before producing a result; git diff --check and targeted oxlint passed.

clawsweeper · 2026-07-03T23:25:52Z

Codex review: needs maintainer review before merge. Reviewed July 6, 2026, 12:11 PM ET / 16:11 UTC.

Summary
The PR adds workspaceRepairs-gated Policy doctor repairs that merge missing required tool denies into root or agent-local deny-list config and documents the scoped inherited-root skip behavior.

PR surface: Source +117, Tests +141, Docs +7. Total +265 across 6 files.

Reproducibility: not applicable. as a bug reproduction; this PR adds a new doctor repair capability. The PR body provides after-fix source-entry proof for the repair path with isolated config and post-write re-detection.

Review metrics: 1 noteworthy metric.

Automatic repair config targets: 2 deny-list targets enabled. The PR lets doctor --fix add required tools to root tools.deny and agent-local tools.deny, which changes opted-in workspace config and security posture.

Stored data model
Persistent data-model change detected: migration/backfill/repair: extensions/policy/src/doctor/automatic-repairs.ts, migration/backfill/repair: extensions/policy/src/doctor/metadata.test.ts, migration/backfill/repair: extensions/policy/src/doctor/register.test.ts, migration/backfill/repair: extensions/policy/src/doctor/scopes/tools.ts, serialized state: extensions/policy/src/doctor/register.test.ts, unknown-data-model-change: extensions/policy/src/doctor/automatic-repairs.ts, and 2 more. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Risk before merge

[P1] With workspaceRepairs=true, merging this PR lets doctor --fix mutate existing root and agent deny-list config, so maintainers should explicitly accept that upgrade behavior for opted-in policy workspaces.
[P1] Because the patch changes a security policy repair path, an ocPath targeting mistake could over-deny tools or alter a broader scope than intended; the current tests cover the known root, agent-local, and inherited-root cases.

Maintainer options:

Accept the workspaceRepairs-gated behavior (recommended)
Maintainers can merge once they confirm opted-in doctor repairs may narrow root and agent tool access by editing deny lists.
Convert required-deny repairs to preview-only
If automatic deny-list mutation is too broad, change these checks to return review-required preview output instead of a repaired config.
Pause this slice behind the stack
If the policy repair stack needs a broader product decision, leave this PR open or pause it until the downstream repair model is settled.

Next step before merge

No automated repair is needed; maintainer review should decide whether the security-sensitive deny-list mutation is acceptable under workspaceRepairs=true.

Maintainer decision needed

Question: Should doctor --fix be allowed to automatically add required tool ids to tools.deny and agents.list[].tools.deny under the existing workspaceRepairs=true opt-in?
Rationale: The implementation appears bounded and tested, but it intentionally changes security-sensitive user config during repair, which is a maintainer policy choice rather than a pure correctness issue.
Likely owner: omarshahine — They already reviewed the exact scoped repair risk and are the clearest routing candidate for the maintainer acceptance question in the available discussion.
Options:
- Accept the gated repair (recommended): Merge after maintainer review confirms the workspaceRepairs opt-in, scoped inherited-root skip, and regression coverage are the intended policy boundary.
- Keep it review-only: Change required-deny findings back to detect-only or preview-only if automatic deny-list mutation is too strong for current policy repair UX.
- Narrow the mutation surface: Allow only agent-local repairs or only global repairs if maintainers want a smaller first step before downstream policy repair slices land.

Security
Cleared: No supply-chain or credential-handling regression was found; the intentional security-policy config mutation is tracked as merge risk for maintainer acceptance.

Review details

Best possible solution:

Land the deny-list repair only after maintainer acceptance of the workspaceRepairs-gated config/security behavior, keeping the exact-path mutation and inherited-root scoped skip intact.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction; this PR adds a new doctor repair capability. The PR body provides after-fix source-entry proof for the repair path with isolated config and post-write re-detection.

Is this the best way to solve the issue?

Yes, subject to maintainer acceptance: using the existing Policy workspaceRepairs repair path and exact detector ocPath is the narrowest maintainable implementation, and the inherited-root scoped case is skipped rather than widened.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 32cc9b08e6b3.

Label changes

Label changes:

add merge-risk: 🚨 compatibility: Existing workspaces with workspaceRepairs=true can see doctor --fix add entries to persisted deny-list config after upgrade.
add merge-risk: 🚨 security-boundary: The changed repair path modifies tool-deny policy enforcement, so the scope targeting must be intentionally accepted before merge.
add proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix Windows PowerShell proof using isolated config, real Policy doctor registration, runDoctorHealthRepairs, replaceConfigFile, and a post-write re-detect showing AFTER_FINDINGS=0.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes after-fix Windows PowerShell proof using isolated config, real Policy doctor registration, runDoctorHealthRepairs, replaceConfigFile, and a post-write re-detect showing AFTER_FINDINGS=0.

Label justifications:

P2: This is a normal-priority policy doctor improvement with bounded blast radius and maintainer-reviewed security/config implications.
merge-risk: 🚨 compatibility: Existing workspaces with workspaceRepairs=true can see doctor --fix add entries to persisted deny-list config after upgrade.
merge-risk: 🚨 security-boundary: The changed repair path modifies tool-deny policy enforcement, so the scope targeting must be intentionally accepted before merge.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes after-fix Windows PowerShell proof using isolated config, real Policy doctor registration, runDoctorHealthRepairs, replaceConfigFile, and a post-write re-detect showing AFTER_FINDINGS=0.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix Windows PowerShell proof using isolated config, real Policy doctor registration, runDoctorHealthRepairs, replaceConfigFile, and a post-write re-detect showing AFTER_FINDINGS=0.

Evidence reviewed

PR surface:

Source +117, Tests +141, Docs +7. Total +265 across 6 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	3	118	1	+117
Tests	2	142	1	+141
Docs	1	7	0	+7
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	6	267	2	+265

What I checked:

Live PR state: Live GitHub state shows head c7ab05e, maintainer label present, mergeable but unstable while checks continue, and six changed files in Policy doctor repair/docs/tests. (c7ab05e372db)
Repair implementation: The PR enables automatic repair for agent required-deny and global required-deny findings, then merges the missing tool into the exact reported deny path while skipping scoped findings that only point at inherited root tools.deny. (extensions/policy/src/doctor/automatic-repairs.ts:119, c7ab05e372db)
Finding source contract: Current main builds required-deny findings from Policy tool posture entries and carries the entry source path into ocPath, so the repair targeting depends on the detector-provided config path. (extensions/policy/src/doctor/register.ts:3531, 32cc9b08e6b3)
Inherited-root proof path: Current main records inherited tool deny posture with the inherited source path, which is the case Omar Shahine called out and this PR now skips for scoped required-deny repairs. (extensions/policy/src/policy-state.ts:2002, 32cc9b08e6b3)
Regression coverage: Head tests cover dry-run root required-deny repair, agent-local deny-list repair, and the inherited-root scoped skip that leaves the finding remaining instead of widening root config. (extensions/policy/src/doctor/register.test.ts:1742, c7ab05e372db)
Docs coverage: The PR documents that doctor --fix can add missing required-deny tool ids only with workspace repairs enabled and explains the scoped inherited-root skip behavior. Public docs: docs/cli/policy.md. (docs/cli/policy.md:936, c7ab05e372db)

Likely related people:

giodl73-repo: Authored the merged Policy tool posture conformance work and the workspaceRepairs automatic repair foundation that this PR extends. (role: feature owner and recent area contributor; confidence: high; commits: 1e2e6147480c, 14b2ca11ffa9, 55683d23e35a; files: extensions/policy/src/doctor/register.ts, extensions/policy/src/policy-state.ts, extensions/policy/src/doctor/automatic-repairs.ts)
omarshahine: Reviewed the exact inherited-root scoped repair risk on this PR and gave the best-fix direction that the current head implements. (role: reviewer; confidence: medium; files: extensions/policy/src/doctor/automatic-repairs.ts, extensions/policy/src/doctor/scopes/tools.ts, extensions/policy/src/doctor/register.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (20 earlier review cycles; latest 8 shown)

reviewed 2026-07-05T15:38:40.773Z sha b1542f3 :: needs real behavior proof before merge. :: [P2] Document the new required-deny repair
reviewed 2026-07-05T15:45:17.648Z sha b1542f3 :: needs real behavior proof before merge. :: [P2] Document the required-deny repair
reviewed 2026-07-05T23:29:04.073Z sha cd11ce1 :: needs maintainer review before merge. :: none
reviewed 2026-07-06T00:05:53.657Z sha cd11ce1 :: needs maintainer review before merge. :: none
reviewed 2026-07-06T00:27:49.239Z sha 2ee34e1 :: needs maintainer review before merge. :: none
reviewed 2026-07-06T01:14:44.310Z sha 5acc3dd :: needs maintainer review before merge. :: none
reviewed 2026-07-06T01:40:52.216Z sha 9ffa75f :: needs maintainer review before merge. :: none
reviewed 2026-07-06T02:10:11.881Z sha b01612e :: needs maintainer review before merge. :: none

giodl73-repo · 2026-07-04T14:19:15Z

@clawsweeper re-review

I restacked the policy series onto current upstream/main with non-force merge commits, resolved the test/scripts/plugin-sdk-surface-report.test.ts conflict, and added the exact Real behavior proof section to this PR body.

Fresh proof from the top of the stack (283c1bb4ca):

node scripts/run-vitest.mjs extensions/policy/src/doctor/metadata.test.ts extensions/policy/src/doctor/register.test.ts extensions/policy/src/doctor/strictness.test.ts src/flows/doctor-repair-flow.test.ts --reporter=dot passed: 10 core repair-flow tests + 297 policy doctor tests.
node scripts/run-vitest.mjs test/scripts/plugin-sdk-surface-report.test.ts --reporter=dot passed: 7 tests.
pnpm tsgo:extensions passed.
pnpm lint:extensions passed.
git diff --check passed.

clawsweeper · 2026-07-04T14:19:18Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

omarshahine · 2026-07-04T17:21:26Z

Codex review of the Required Denies PR.

Findings:

Scoped policy/tools-required-deny-missing repairs can widen tools.deny globally instead of adding a local scoped deny. The repair is wired in extensions/policy/src/doctor/scopes/tools.ts:115, then extensions/policy/src/doctor/automatic-repairs.ts:96 mutates finding.ocPath directly through mergeStringArrayAtOcPath at extensions/policy/src/doctor/automatic-repairs.ts:218. For agent tool posture, though, finding.ocPath is provenance evidence, not always the right mutation target: extensions/policy/src/doctor/register.ts:3567 builds the finding from the posture entry, extensions/policy/src/doctor/register.ts:3593 passes entry.source through as the path, and extensions/policy/src/policy-state.ts:2002 uses inherited global tools/deny as the source when an agent has no local deny but inherits global denies.

That means a scoped policy such as requiring one extra denied tool for one agent can be repaired by appending the tool to root tools.deny, affecting every agent. The current tests cover a global dry run and an agent that already has a local agents.list[0].tools.deny, but they do not cover the inherited-global-source case.

Best-fix verdict: not the best fix yet. For scoped agent findings, the repair target should be the scoped agent config path, or the inherited/global-source case should stay skipped/review-required instead of mutating shared root config.

Evidence checked: extensions/policy/src/doctor/scopes/tools.ts, extensions/policy/src/doctor/automatic-repairs.ts, extensions/policy/src/doctor/register.ts, extensions/policy/src/policy-state.ts, and the adjacent required-deny repair tests.

giodl73-repo · 2026-07-04T20:50:34Z

Addressed Omar's scoped required-deny finding in d5e2ff0b0d: scoped required-deny findings that point at inherited root tools.deny now skip with a warning instead of widening the root deny list. Local agent deny paths still repair automatically. Added regression coverage for the inherited-root scoped case.

giodl73-repo · 2026-07-04T20:50:51Z

@clawsweeper re-review

Reviewer-requested fixes are pushed on this updated head. Fresh local proof before push: focused policy/core/CLI/tooling Vitest passed, pnpm tsgo:extensions passed, pnpm lint:extensions passed, git diff --check passed, and node --import tsx scripts/check-policy-config-coverage.ts --check --json passed.

clawsweeper · 2026-07-04T20:50:53Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-07-05T00:59:00Z

Updated this PR body with current stack heads and final-stack proof after the #99686 proof refresh. The foundation proof now shows policy-owned policy.fixRecommendation in public policy JSON and recommendation-free attestation hashing, and this PR includes that fix via the forward-merged stack.

@clawsweeper re-review

clawsweeper · 2026-07-05T00:59:03Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-07-06T16:56:13Z

Merged via squash.

Prepared head SHA: 18ff62b1797fe2f18a31814565f8decf0fa27a7f
Landed commit: 5b06eba9fe9e6caf224d6d573b2116149b7755b7

openclaw-barnacle Bot added docs Improvements or additions to documentation scripts Repository scripts extensions: policy size: XL maintainer Maintainer-authored PR labels Jul 3, 2026

This was referenced Jul 4, 2026

policy: repair channel ingress findings #99720

Merged

policy: repair denied gateway http endpoints #99731

Merged

policy: preview review-required gateway repairs #99776

Merged

openclaw-barnacle Bot added the commands Command implementations label Jul 4, 2026

openclaw-barnacle Bot added commands Command implementations and removed commands Command implementations docs Improvements or additions to documentation scripts Repository scripts labels Jul 4, 2026

giodl73-repo mentioned this pull request Jul 5, 2026

policy: repair automatic narrowing findings #99690

Merged

clawsweeper Bot mentioned this pull request Jul 5, 2026

policy: classify doctor fix recommendations #99686

Merged

openclaw-barnacle Bot removed the size: XL label Jul 5, 2026

giodl73-repo force-pushed the policy-doctor-required-deny-repairs branch 6 times, most recently from 8a22456 to c7ab05e Compare July 6, 2026 16:00

giodl73-repo force-pushed the policy-doctor-required-deny-repairs branch from c7ab05e to 4f17843 Compare July 6, 2026 16:23

policy: repair required deny tool findings

18ff62b

giodl73-repo force-pushed the policy-doctor-required-deny-repairs branch from 4f17843 to 18ff62b Compare July 6, 2026 16:40

giodl73-repo merged commit 5b06eba into openclaw:main Jul 6, 2026
88 checks passed

giodl73-repo deleted the policy-doctor-required-deny-repairs branch July 6, 2026 16:56

This was referenced Jul 6, 2026

fix(browser): bound client fetch success JSON reads #100889

Merged

fix(config-cli): toDotPath uses bracket notation for numeric array indices #101095

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

policy: repair required deny tool findings#99700

policy: repair required deny tool findings#99700
giodl73-repo merged 1 commit into
openclaw:mainfrom
giodl73-repo:policy-doctor-required-deny-repairs

giodl73-repo commented Jul 3, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 3, 2026 •

edited

Loading

Uh oh!

giodl73-repo commented Jul 4, 2026

Uh oh!

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

omarshahine commented Jul 4, 2026

Uh oh!

giodl73-repo commented Jul 4, 2026

Uh oh!

giodl73-repo commented Jul 4, 2026

Uh oh!

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

giodl73-repo commented Jul 5, 2026

Uh oh!

clawsweeper Bot commented Jul 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

giodl73-repo commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

giodl73-repo commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Stack

Validation

Real behavior proof

Uh oh!

clawsweeper Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jul 4, 2026

Uh oh!

clawsweeper Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

omarshahine commented Jul 4, 2026

Uh oh!

giodl73-repo commented Jul 4, 2026

Uh oh!

giodl73-repo commented Jul 4, 2026

Uh oh!

clawsweeper Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jul 5, 2026

Uh oh!

clawsweeper Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

giodl73-repo commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

giodl73-repo commented Jul 3, 2026 •

edited

Loading

clawsweeper Bot commented Jul 3, 2026 •

edited

Loading

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

clawsweeper Bot commented Jul 5, 2026 •

edited

Loading