fix: retire automatic live proof

[roboclaw-bot]

Summary

• retire automatic ClawSweeper live-proof planning and execution
• restore direct publication as the normal review path
• retain historical proof artifact validation, rendering, publication, and retraction
• exclude retired proof/batch journeys from OpenClaw Bay timing and Kanban by default, with an observer-only comparison switch

Initial value analysis: why retire it

The automatic live-proof lane was not adding enough independent review value to justify its cost and failure surface:

• It ran after the review result was already produced. It could add an artifact, but it could not improve the code analysis or change which defects the reviewer found.
• It did not replace the actual proof gate. Merge readiness still depends on current-head contributor- or maintainer-supplied evidence and maintainer judgment, so the automatic run was an additional lane rather than authoritative proof.
• For terminal and static-text cases, it mostly repackaged evidence already available as readable command output. A recording of deterministic text did not establish more than the underlying exit status and transcript.
• It put unrelated infrastructure on the publication critical path. Provisioning, package-manager setup, browser/PTY tooling, recording, media validation, artifact upload, and storage credentials could delay or fail an otherwise publishable review without indicating a patch defect.
• It made review timing harder to interpret. Bay mixed ordinary direct reviews with the longer retired proof/batch journey, so the headline latency did not describe the normal review path.
• The useful parts do not require automatic execution. Direct publication already carries the review result; human-supplied proof remains supported; and historical proof artifacts remain readable, publishable, and retractable.

The narrow conclusion was to remove new automatic planning/execution, restore direct publication as the default, and retain historical compatibility while those artifacts age out.

PR behavior proof

• Claim: Reviews no longer execute automatic live proof; normal review artifacts remain directly publishable; historical proof-bearing artifacts remain compatible; Bay defaults to normal direct-review journeys.
• Exercised surface: Exact and scheduled review workflows, decision schema/prompt, artifact publication compatibility, SQLite-backed ExactReviewQueue, /api/status, and /bay.
• Scenario/fixture: The maintained Bay demo seeds direct and legacy lifecycle journeys, including simultaneous direct/legacy paths for one target, then exercises the real local Wrangler Worker and Durable Object.
• Command/environment: docs/proof/retire-automatic-live-proof/run-proof.sh in Crabbox local-container on current head aeccb97a2fac48a3cf270fcb90d4df84b6dedf5b and base a4592a03e194228fc66b57bc4ad64deb11fb444b; run run_9eebd46fa0b5, lease cbx_49823050dad7, Podman runtime, node:24-bookworm image.
• Observable result: Exit 0; complete public and activity projections; 6 direct and 4 legacy cards; default legacy switch off; no production mutation. Independent cleanup checks found no remaining Crabbox lease or Podman container.
• Artifact/trace: docs/proof/retire-automatic-live-proof/receipt.json, the behavior contract and proof script, plus the redacted readable transcript below.
• Limits: No production workflow dispatch, queue mutation, or deploy was performed; historical publication uses checked-in fixtures.

Validation and reviews

• pnpm run check on Node 26: 3,967 passed, 0 failed, 0 cancelled, 8 skipped; formatting, static checks, builds, lint, and coverage thresholds passed.
• Committed Codex review against origin/main: no actionable correctness issues.
• Local ClawSweeper --local-range review on the exact base/head: patch correct, no findings or security concerns, proof sufficient, no rank-up moves.

Readable current-head proof transcript

• Tested head: aeccb97a2fac48a3cf270fcb90d4df84b6dedf5b
• Tested base: a4592a03e194228fc66b57bc4ad64deb11fb444b
• Provider/runtime: Crabbox local-container, run run_9eebd46fa0b5, lease cbx_49823050dad7, Podman, node:24-bookworm
• Command: bash docs/proof/retire-automatic-live-proof/run-proof.sh

CRABBOX_PHASE:build
CRABBOX_PHASE:contract
✔ exact event review publishes directly with a queue-bounded canonical fallback
✔ scheduled review shards retire automatic live proof without removing historical publication
ℹ tests 2
ℹ pass 2
ℹ fail 0
ℹ cancelled 0

✔ automatic live proof is retired while historical artifact publication remains
✔ historical proof-bearing exact review bundles still validate
✔ new exact review bundle creation omits live-proof directories
✔ review jobs upload completed reviews without automatic live proof
✔ historical publication lanes preserve live-proof folding after generation retirement
✔ review prompt and generation schema constrain live proof to the retired compatibility shape
ℹ tests 6
ℹ pass 6
ℹ fail 0
ℹ cancelled 0

✔ Bay lifecycle excludes the retired batch path from normal review timing by default
✔ Bay lifecycle retains direct-path classification after direct telemetry expires
✔ Bay lifecycle tide rebuild preserves pre-change direct publication classification
✔ Bay lifecycle keeps failed legacy publishers out of the default direct view
✔ Bay lifecycle migration recovers retained pre-v2 direct tide rows from their fence
✔ Bay queue projection preserves a direct review beside newer legacy publication work
✔ public Bay keeps opposite-path direct queue work beside an active legacy worker
✔ public Bay retains simultaneous direct and legacy workers for one target
ℹ tests 17
ℹ pass 17
ℹ fail 0
ℹ cancelled 0

✔ direct publication endpoint authenticates, dedupes, and returns a structured 413
✔ batch claims retain lifecycle identity until canonical routing is durable
ℹ tests 2
ℹ pass 2
ℹ fail 0
ℹ cancelled 0

CRABBOX_PHASE:runtime
{"runtime":"wrangler dev --local","durable_object":"SQLite-backed ExactReviewQueue","http_routes":["/api/status","/bay"],"public_projection_complete":true,"activity_complete":true,"direct_items":6,"legacy_items":4,"default_legacy_toggle":false,"timing_comparison_available":true,"production_mutation":false}
PROOF_RESULT=automatic-live-proof-retired
PROOF_COMPATIBILITY=historical-publication-retained
PROOF_BAY_DEFAULT=normal-direct-reviews

Sanitized stderr contained only package-manager/bootstrap notices and the three TypeScript build commands; it contained no runtime or assertion error. Crabbox returned exit 0. Independent cleanup checks found no matching lease or container after the known Podman rootless-network cleanup warning.

Maintainer direction

The originating human request explicitly chose full retirement of automatic ClawSweeper live-proof generation and execution, with no replacement proof lane. Contributor- and maintainer-supplied proof remains part of ordinary review readiness.

Review finding disposition

• Resolved: the earlier durable review requested head-bound, readable behavior proof. The current receipt names the exact base, branch-wide diff digest, provider, run, lease, image, script hash, and output hashes; the PR body now names the exact tested head and includes the readable focused and Wrangler runtime transcript.
• Resolved: exact and scheduled review jobs no longer execute automatic live proof, while historical parsing/publication/retraction compatibility remains covered.
• Resolved: OpenClaw Bay path identity, persistence migration, active overlap, bounded sampling, and observer-toggle edge cases have focused regression coverage and real local Worker proof.

OpenClaw Bay

Affected and updated. Bay remains public, indexable, and observer-only; the comparison switch changes presentation only and cannot trigger queue, workflow, GitHub, recovery, deploy, or rollback actions.

Worked on by

• @brokemac79

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 28, 2026, 9:23 AM ET / 13:23 UTC.

ClawSweeper review

What this changes

The PR removes automatic live-proof planning and execution from exact and scheduled reviews, preserves historical proof-artifact publication, and hides legacy batch journeys from Bay’s default view.

Merge readiness

⚠️ Ready for maintainer review - 4 items remain

No introduced correctness or security defect surfaced, and the current-head local Worker proof is strong. This PR remains necessary because retiring automatic execution is an intentional workflow-policy decision that needs maintainer confirmation before merge.

Priority: P2
Reviewed head: aeccb97a2fac48a3cf270fcb90d4df84b6dedf5b
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦞 diamond lobster (5/6)	PR readiness rating was derived from proof quality, review findings, security review, and reviewer confidence.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (terminal): ClawSweeper live verification passed on the reviewed terminal surface.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): ClawSweeper live verification passed on the reviewed terminal surface.
Evidence reviewed	5 items	Automatic execution is removed from active review workflows: The exact-review bundle now follows review completion without proof-execution gating, and direct publication no longer excludes proof-produced artifacts. New decisions use a compatibility-only empty proof shape: The schema fixes new liveProofPlan output to not_applicable, no surface, no entry, and no steps while retaining the field for historical records. Bay path separation is implemented in the durable lifecycle view: Lifecycle timing excludes legacy batch rows by default and provides a separately aggregated legacy-inclusive comparison.
Findings	None	None.
Security	None	None.

Live Verification

Command: pnpm run build:all && node --test --test-name-pattern='automatic live proof is retired while historical artifact publication remains' test/live-proof.test.ts

Result: PASS (completed)

$ pnpm run build && pnpm run build:repair && pnpm run build:dashboard
$ tsc -p tsconfig.json
$ tsc -p tsconfig.repair.json
$ tsc -p tsconfig.dashboard.json
✔ automatic live proof is retired while historical artifact publication remains (98.798072ms)
ℹ tests 1
ℹ suites 0
ℹ pass 1
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 420.238513

Assertions:

• PASS expect_output: automatic live proof is retired while historical artifact publication remains
• PASS expect_output: pass 1

How this fits together

ClawSweeper’s review workflows create artifacts that are published directly or through the queue, while Bay renders their public read-only status. This change removes new proof execution from those workflows but retains historical artifact handling and exposes legacy-path status only as an observer toggle.

flowchart LR
  A[Review request] --> B[Review workflow]
  B --> C[Review artifact]
  C --> D[Direct or legacy publication]
  D --> E[Public review result]
  D --> F[Bay status projection]
  G[Historical proof artifacts] --> D

Loading

Decision needed

Question	Recommendation
Should ClawSweeper permanently stop automatic live-proof execution for new reviews while retaining only historical proof-artifact support?	Confirm scoped retirement: Adopt direct publication and contributor- or maintainer-supplied proof for future reviews while retaining historical artifact support.

Why: The patch is technically coherent, but it deliberately removes an existing review capability and changes the operational proof model; implementation evidence cannot establish that policy preference.

Before merge

• Resolve merge risk (P1) - Merging intentionally stops automatic execution of reviewed PR code; repositories that relied on generated live proof will instead rely on contributor- or maintainer-supplied evidence.
• Resolve merge risk (P1) - The Bay lifecycle and public-status contract adds legacy-path fields and migration logic, so deployment should retain the demonstrated upgrade path and observer-only behavior.
• Complete next step (P2) - A maintainer must confirm the deliberate retirement of automatic proof execution; no narrow mechanical repair is indicated.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Changed surface	41 files; 2,986 added, 2,834 removed	The retirement spans workflow control flow, artifact compatibility, and Bay’s public projection rather than a localized deletion.
Production versus test delta	production +1,068/-1,069; tests +1,540/-862	The expanded focused coverage is proportionate to the workflow, queue, migration, and dashboard compatibility paths changed.

Merge-risk options

Maintainer options:

1. Confirm the new proof policy (recommended)
   Merge after a maintainer explicitly accepts that future reviews no longer execute automatic live proof and rely on supplied proof instead.
2. Keep the execution lane
   Pause this branch if automated execution remains a required independent review signal, then define the desired retained contract before revising it.

Technical review

Best possible solution:

Confirm the retirement direction, then retain contributor-supplied proof and historical-artifact compatibility while using direct review publication as the normal path.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a deliberate retirement rather than a reported defect. The supplied current-head proof instead exercises the changed workflow contracts and local Worker projection.

Is this the best way to solve the issue?

Unclear: the implementation and compatibility coverage support the proposed path, but whether automatic execution should be retired is a maintainer policy decision.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a4592a03e194.

Labels

Label changes:

• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• remove rating: 🐚 platinum hermit: Current PR rating is rating: 🦞 diamond lobster, so this older rating label is no longer current.

Label justifications:

• P2: This is a deliberate review-automation and observability change with bounded operational blast radius.
• merge-risk: 🚨 compatibility: Existing proof-producing and lifecycle-status consumers must continue to handle historical artifacts and the evolved public projection.
• merge-risk: 🚨 automation: The PR changes the GitHub Actions review and publication path by removing automatic proof inspection, tooling, and execution.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): ClawSweeper live verification passed on the reviewed terminal surface.
• proof: sufficient: Contributor real behavior proof is sufficient. ClawSweeper live verification passed on the reviewed terminal surface.

Evidence

What I checked:

• Automatic execution is removed from active review workflows: The exact-review bundle now follows review completion without proof-execution gating, and direct publication no longer excludes proof-produced artifacts. (.github/workflows/sweep.yml:1350, aeccb97a2fac)
• New decisions use a compatibility-only empty proof shape: The schema fixes new liveProofPlan output to not_applicable, no surface, no entry, and no steps while retaining the field for historical records. (schema/clawsweeper-decision.schema.json:791, aeccb97a2fac)
• Bay path separation is implemented in the durable lifecycle view: Lifecycle timing excludes legacy batch rows by default and provides a separately aggregated legacy-inclusive comparison. (dashboard/exact-review-lifecycle-telemetry.ts:970, aeccb97a2fac)
• Current-head real behavior proof: The checked-in receipt records a successful Crabbox local-container run, and the PR body includes a readable current-head transcript covering the local Wrangler Worker, queue, direct and legacy projections, and the default-off toggle. (docs/proof/retire-automatic-live-proof/receipt.json:1, aeccb97a2fac)
• Feature-history provenance: History identifies Peter Steinberger’s earlier live-proof workflow work and Martin Cleary’s recent Bay lifecycle measurement work as the relevant established surfaces. (.github/workflows/sweep.yml:1350, 03c1f452ec49)

Likely related people:

• Peter Steinberger: History credits the original review-job live-proof implementation, which this PR retires. (role: original live-proof workflow contributor; confidence: high; commits: 03c1f452ec49, c06a897aadd7; files: .github/workflows/sweep.yml, src/clawsweeper-review-runtime.ts)
• Martin Cleary: Recent history attributes the durable final-receipt Bay lifecycle metric that this PR extends with legacy-path filtering. (role: recent Bay lifecycle contributor; confidence: high; commits: 91a2bf645327, 2da70c23b043; files: dashboard/exact-review-lifecycle-telemetry.ts, dashboard/worker.ts)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (7 earlier review cycles)

• reviewed 2026-08-28T08:24:14.450Z sha 86d7fe2 :: needs real behavior proof before merge. :: [P2] Run the required local-container behavior proof
• reviewed 2026-08-28T08:44:01.670Z sha 5ea2bdf :: needs real behavior proof before merge. :: [P2] Bind the local-container proof to the submitted head
• reviewed 2026-08-28T09:06:49.902Z sha ee2596e :: needs real behavior proof before merge. :: [P2] Bind the behavior proof to the submitted head
• reviewed 2026-08-28T09:12:09.212Z sha ee2596e :: found issues before merge. :: [P2] Attach a head-bound readable proof transcript
• reviewed 2026-08-28T10:04:04.999Z sha ceb93f3 :: needs real behavior proof before merge. :: [P2] Attach a readable current-head proof transcript
• reviewed 2026-08-28T10:09:45.780Z sha ceb93f3 :: needs maintainer review before merge. :: none
• reviewed 2026-08-28T10:15:05.413Z sha ceb93f3 :: needs maintainer review before merge. :: none

[roboclaw-bot]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/33162039823
• Updated: 2026-08-28T10:06:13.543Z

[roboclaw-bot]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/33162431484
• Updated: 2026-08-28T10:12:11.563Z

[roboclaw-bot]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/33175765687
• Updated: 2026-08-28T13:31:42.396Z