Add TweetClaw secret example and isolate redaction caches

[kriptoburak]

Summary

• Recommends environment fallback for the 1claw agent key.
• Adds the current verified ClawHub installation path for TweetClaw.
• Defines the secret boundary between 1claw and TweetClaw.
• Documents required reconfiguration after each Xquik key rotation.
• Adds gateway restart and runtime inspection steps.

Independent Repository Fix

• Replaces the process-wide secret-redaction cache with client-scoped weak caches.
• Prevents one vault client from reusing another client's cached secrets.
• Adds a regression test covering 2 isolated clients.

Secret Handoff

1claw manages the vault copy and its lifecycle. TweetClaw reads sensitive local
OpenClaw plugin config. 1claw does not change another plugin's config
automatically.

Use a trusted human shell for the temporary XQUIK_API_KEY handoff. Never paste
the key into an agent prompt. Repeat the config step after rotating the key.

Validation

• npm ci --ignore-scripts --no-audit --no-fund
• npm run typecheck
• npm run build
• node --test tests/*.test.mjs - 1 passed
• npm pack --dry-run --json
• npm audit --omit=dev - 0 vulnerabilities
• git diff --check
• Git object and clean-merge checks
• Current TweetClaw repository, package, and runtime commands verified

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.

[kriptoburak]

Follow-up is public at c66d8ec. This now includes an independent isolation fix: secret-redaction caches are scoped per client, with a regression test proving 2 clients cannot reuse each other’s cached secret set.

[kriptoburak]

Republished the existing change on current upstream main with GitHub-verified signed commits.

Current head: 1375fb6417d20aea45604de17ce0541f1f77aefa

Validation rerun:

• TypeScript typecheck passed
• Production build passed
• Secret redaction cache-isolation regression passed
• Package dry run passed
• Diff and clean merge-tree checks passed

The TweetClaw companion example and independent per-client redaction cache fix remain focused and unchanged.

[kriptoburak]

Follow-up is in GitHub-verified signed commit 039da85.

The complete re-audit confirmed the client-scoped cache fix remains correct. It also found a stale secret handoff. Rotating the vault copy did not update TweetClaw's local plugin config automatically.

The documentation now states that boundary. It uses TweetClaw's current verified ClawHub path. It also requires reconfiguration, restart, and runtime inspection after rotation.

Validation passed: typecheck, build, regression test, package dry run, dependency audit, object integrity, and a clean upstream merge tree.

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.