fix(review): stop historical smoke from granting proof credit

[steipete]

Related: automatic live-proof retirement, attached-verification gating, and the observed classification error.

Additional instructions

MUST: Keep Allow edits from maintainers enabled for this PR so maintainers can help update the branch when needed.

What Problem This Solves

Fixes an issue where maintainers reading a review could see Real behavior: Verified and proof: sufficient for an unrelated change when a historical help-only verification receipt was attached. The same path could replace independently assessed contributor evidence and its media attribution, clear required proof gates, and regrade the reviewer's patch confidence.

The cited Gateway PR is only the witness for this classification error. It separately supplied genuine isolated Control UI and plugin HTTP role-matrix proof and is already merged; this PR does not modify or question that work.

Why This Change Was Made

Automatic proof generation was retired while this repair was being prepared. This patch respects that decision: it does not restore planning, execution, schemas, workflows, or a replacement proof lane. Historical artifact publication remains supported, but the recorded realBehaviorProof assessment is the sole owner of semantic proof quality.

The patch removes receipt-driven proof replacement, the unconditional passed-receipt merge shortcut, and broad patch regrading. Historical execution output remains diagnostic. Failed or malformed receipts still block merge independently, while valid contributor evidence and explicit patch caps remain intact. Stale proof-specific status labels now follow the canonical assessment rather than the existence of a receipt; pause and active-review precedence are preserved.

Provenance: the receipt-driven promotion and merge/rating shortcuts came from f3883a32631b930965fbeaeae4dc70761f2b7647 (ClawSweeper PR 1271). Code author, PR author, and merger: @vincentkoc. The subsequent retirement intentionally retained historical folding and left these projection owners unchanged.

User Impact

Unrelated historical smoke cannot manufacture behavioral proof or erase valid contributor evidence. Recording, linked-artifact, and terminal assessments retain their attribution and justified ratings. Required authority-chain proof, normal author/docs exemptions, explicit proof overrides, and owner/product/security gates remain independent. Relevant deterministic owner evidence remains acceptable when the ordinary reviewer assessment actually connects it to the changed behavior; no live credentials are required merely to classify it.

OpenClaw Bay Impact

Bay needs no code change. No observer API, lifecycle, telemetry, timing, queue, or action contract changes. The retired-path display behavior from PR 1280 remains unchanged.

Documentation Impact

docs/live-proof.md remains the canonical compatibility-only documentation and now states the diagnostic-receipt versus assessed-proof boundary. docs/proof/historical-proof-classification/ is a historical repair-proof recipe with synthetic fixtures, executed observations, owner/source references, and explicit limits—not a new execution runbook or service.

Evidence

• Current-main reproduction used the actual retained artifact-publication CLI on baseline f72ea010c1d7fd134b1bd0826b3a707778c312bc. The same captured help-only receipt attached successfully both before and after; incorrect behavioral credit changed from true to false.
• 418 focused owner/sibling tests passed during the repair. The final proof/status selection passed all 81 tests, including a red-before-fix regression for a stale needs-proof label contradicting independently sufficient evidence.
• Six focused retirement checks passed: automatic generation remains absent and historical bundle/publication compatibility remains present.
• Build, changed-source type-aware lint, test/proof lint, formatting, documentation checks, and whitespace checks passed.
• Fresh Codex pre-commit review found no actionable findings at the configured P0 threshold. A separate committed-branch review and exact-head CI remain required before merge.
• Bounded nearby cleanup: fake Codex processes now consume stdin like the real CLI before emitting results or exiting. This fixes a pre-existing EPIPE race without changing the production runner, timeouts, or assertions.

Real Behavior Proof

Claim: A historical execution receipt cannot replace the reviewer's behavioral assessment, waive missing proof, or discard independently sufficient evidence; historical publication and independent failure gates still work.

Exercised surface: The actual live-proof-publish-artifacts CLI, publishReviewLiveProofArtifacts, attachReviewLiveProofArtifact, and production comment/label/merge-marker projections. No affected production owner is mocked.

Scenario: A schema-v1 receipt originally captured from a real PTY running a synthetic help-only CLI is replayed as historical input. Dummy identity metadata is normalized in the public fixture. Additional sufficient/failed/malformed/authority/override/status controls are explicitly constructed fixture data, not claims of fresh target execution or newly verified contributor media.

Command and environment: Local macOS arm64, Node 24+, pinned pnpm 11.10.0. The child receives only PATH, a fixture-local HOME, and LANG. No media manifest is present, so no upload is possible; the retained CLI disallows live-head lookup and does not synchronize GitHub comments.

pnpm run build:all

node docs/proof/historical-proof-classification/run-proof.mjs .artifacts/historical-proof-classification

Use a new output directory; the script refuses to overwrite an existing run.

Tested committed head: 2cae936581e3b72a0c3eb9213ae9897a35a2dd7e

Observed result: 22/22 cases passed; 0 failed, rerun after committing on macOS arm64 with Node v26.7.0 using the local-process provider (no image or lease). The result records the committed source head and an empty production diff; built-owner, recipe, and fixture hashes match the final pre-commit proof. Key results:

Case	Artifact publication	Behavioral result	Merge proof
Missing proof + unrelated help PASS	attached	remains missing; no sufficient label	blocked
Assessed recording/artifact/terminal proof + PASS	attached	assessment, media, patch cap, and advice preserved	normal gates
Assessed proof + failed receipt	attached	assessment preserved; failure is maintainer-owned	blocked
Required authority proof + PASS	attached	remains unresolved for external and trusted authors	blocked
Sufficient proof + stale proof-status label	direct or attached	stale status reconciled from the assessment	normal gates
Wrong receipt identity	rejected as invalid artifact	original record preserved	no publication
Direct report without a receipt	unchanged	canonical assessment preserved	normal gates

Before/after runtime transcript:

BASELINE: publication=published attachment=attached realBehaviorVerified=true addsSufficient=true rejection=FAILED
CANDIDATE: publication=published attachment=attached realBehaviorVerified=false addsSufficient=false rejection=PASSED
PUBLICATION_CASES=22 PASSED=22 FAILED=0

Artifacts and reproducibility: recipe and limits, captured fixture, before/after observations. Each run writes a bounded result with source HEAD/diff, built-owner, recipe, and fixture hashes, plus folded reports and rendered decisions.

Limits: This proves historical publication/classification, not Gateway authorization, live GitHub/R2 behavior, queue mutation, or terminal execution. The retained macOS terminal driver separately timed out cleanup in two attempts; those failed runs produced no valid receipt and are not counted as proof. Replaying existing artifacts is the actual retained production path after retirement. No deployment, credential, advisory, or original-PR mutation occurred.

Size and scope

Scope	Added	Removed	Net
Production runtime	36	66	-30
Existing tests	194	64	+130
Maintained proof script, fixtures, and notes	585	0	+585
Compatibility documentation	15	0	+15

The initial typed-planner-contract design was dropped after retirement. No new dependency, configuration option, schema version, runtime module, or execution lane is introduced. AI-assisted implementation and verification.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 28, 2026, 12:05 PM ET / 16:05 UTC.

ClawSweeper review

What this changes

This PR makes historical proof receipts diagnostic only, preserving the reviewer's recorded behavioral proof, ratings, labels, and merge-gate decisions.

Regression provenance

Possible regression — probable (reviewed change; failure trace). No predecessor PR is attributed.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

Keep open for normal merge review: the current base still lets a passed historical receipt replace the recorded proof assessment, and this PR removes that shortcut while retaining failed/malformed receipt blocking. The supplied exact-head production CLI transcript is sufficient, and no actionable patch defect was found.

Priority: P2
Reviewed head: 2cae936581e3b72a0c3eb9213ae9897a35a2dd7e

Review scores

Measure	Result	What it means
Overall readiness	🦞 diamond lobster (5/6)	Strong exact-head behavioral proof and focused source/test coverage support the repair, with no actionable review finding.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (terminal): The PR body provides an exact-head after-fix production CLI run with a before/after transcript and 22 passing classification cases; it directly exercises artifact folding and downstream report projections.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The PR body provides an exact-head after-fix production CLI run with a before/after transcript and 22 passing classification cases; it directly exercises artifact folding and downstream report projections.
Evidence reviewed	5 items	Current-main defect: The PR base promotes every attached passed receipt to sufficient behavioral proof before reading the recorded assessment; the candidate removes that promotion and reads the recorded assessment directly. Merge gate preserved: The candidate removes only the passed-receipt merge bypass while retaining immediate merge blocks for failed and malformed receipts. Regression coverage: Focused tests cover passed, failed, malformed, authority-required, exemption, stale-status, and independently sufficient-proof cases without allowing the receipt to overwrite ratings or proof attribution.
Findings	None	None.
Security	None	None.

How this fits together

ClawSweeper folds retained proof artifacts into PR reports, then projects those reports into public comments, labels, readiness ratings, and automerge markers. Historical receipts enter that pipeline alongside the recorded behavioral assessment; this change keeps the assessment as the semantic authority.

flowchart LR
A[Historical receipt] --> B[Artifact validation and folding]
C[Recorded behavioral assessment] --> D[Proof classification]
B --> D
D --> E[Labels and ratings]
D --> F[Review comment and merge gate]

Loading

Before merge

• Resolve merge risk (P1) - Historical artifact publication is shared automation: the exact-head full check is still in progress, and the supplied runtime proof intentionally does not call GitHub or R2 because those owners are unchanged.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Runtime and regression delta	runtime +36/-66; tests +194/-64	The semantic change is small and reducing in production code while focused regression coverage grows.

Merge-risk options

Maintainer options:

1. Confirm the exact-head automation gate (recommended)
   Allow the running exact-head check to complete before landing this shared proof-publication and merge-marker behavior change.

Technical review

Best possible solution:

Land the narrow receipt-classification correction after exact-head validation completes, preserving failed-receipt blocking separately from semantic proof assessment.

Do we have a high-confidence way to reproduce the issue?

Yes. Current-base source shows the passed-receipt shortcut, and the supplied before/after run replays the same retained receipt through the production publication CLI with the erroneous credit changing from true to false.

Is this the best way to solve the issue?

Yes. Removing receipt-derived semantic proof promotion while retaining receipt validation and failed/malformed blocking is the narrowest way to restore the recorded assessment as authority.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f72ea010c1d7.

Labels

Label changes:

• add P2: Incorrect proof credit can produce misleading review and merge readiness, but this is a bounded automation repair.
• add merge-risk: 🚨 automation: The patch intentionally changes historical artifact folding, status labels, readiness ratings, and merge-marker behavior.
• add proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides an exact-head after-fix production CLI run with a before/after transcript and 22 passing classification cases; it directly exercises artifact folding and downstream report projections.
• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body provides an exact-head after-fix production CLI run with a before/after transcript and 22 passing classification cases; it directly exercises artifact folding and downstream report projections.

Label justifications:

• P2: Incorrect proof credit can produce misleading review and merge readiness, but this is a bounded automation repair.
• merge-risk: 🚨 automation: The patch intentionally changes historical artifact folding, status labels, readiness ratings, and merge-marker behavior.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body provides an exact-head after-fix production CLI run with a before/after transcript and 22 passing classification cases; it directly exercises artifact folding and downstream report projections.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides an exact-head after-fix production CLI run with a before/after transcript and 22 passing classification cases; it directly exercises artifact folding and downstream report projections.

Evidence

What I checked:

• Current-main defect: The PR base promotes every attached passed receipt to sufficient behavioral proof before reading the recorded assessment; the candidate removes that promotion and reads the recorded assessment directly. (src/clawsweeper-report-parser.ts:546, f72ea010c1d7)
• Merge gate preserved: The candidate removes only the passed-receipt merge bypass while retaining immediate merge blocks for failed and malformed receipts. (src/clawsweeper-orchestration-foundation.ts:463, 2cae936581e3)
• Regression coverage: Focused tests cover passed, failed, malformed, authority-required, exemption, stale-status, and independently sufficient-proof cases without allowing the receipt to overwrite ratings or proof attribution. (test/pr-proof-automation.test.ts:720, 2cae936581e3)
• Area provenance: History identifies the attached-verification gate as commit f3883a3; the supplied related-PR context and current-base source connect the present repair to its receipt-authority behavior. (src/clawsweeper-report-parser.ts:546, f3883a32631b)
• After-fix behavior proof: The PR body records an exact-head run of the retained publication CLI: 22/22 cases passed and the same help-only receipt changed from granting Verified/sufficient credit to leaving missing proof blocked. (docs/proof/historical-proof-classification/run-proof.mjs:91, 2cae936581e3)

Likely related people:

• vincentkoc: Commit history and the linked merged PR identify this contributor as the author of the attached-verification gate whose passed-receipt behavior this PR narrows. (role: introduced adjacent receipt-gating behavior; confidence: high; commits: f3883a32631b; files: src/clawsweeper-report-parser.ts, src/clawsweeper-orchestration-foundation.ts, src/clawsweeper-label-policy.ts)
• steipete: History shows sustained work on live-proof review semantics, including earlier feature work and this focused correction. (role: long-running live-proof area contributor; confidence: high; commits: 055ffba223f0, 44eb7ed2e43d, 2cae936581e3; files: src/clawsweeper-report-parser.ts, docs/live-proof.md)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Land-ready verification for head 2cae936581e3b72a0c3eb9213ae9897a35a2dd7e.

The current ClawSweeper review found no actionable defect, accepted the exact-head production-publication proof, and left one before-merge item: completion of the exact-head automation check. That item is now satisfied. The review contains no outstanding rank-up move.

• CI 33187801759: pnpm check, sparse repair build smoke, and Windows Codex launcher all succeeded on this head.
• CodeQL 33187801760: both Actions and JavaScript/TypeScript analysis succeeded.
• Fresh independent Codex reviews of the uncommitted candidate and the committed branch against f72ea010c1d7fd134b1bd0826b3a707778c312bc reported no actionable P0 findings.
• The committed-head retained-publication recipe passed all 22 cases. The same historical help-only receipt still attaches successfully but cannot confer behavioral proof; independently assessed proof, media attribution, patch caps, status reconciliation, and failure/authority gates are covered.

Local commands used for changed-surface proof and final status regression verification:

pnpm run build:all

node docs/proof/historical-proof-classification/run-proof.mjs .artifacts/behavior-proof-relevance/committed-publication-proof

node --test test/pr-proof-automation.test.ts test/pr-review-labels.test.ts test/pr-label-policy.test.ts

The final status selection passed 81 tests; the broader focused repair selection passed 418 tests and six retirement checks. The complete hosted check above is the current-head full-suite gate. The additional local whole-suite run is not being cited as green while it remains in progress.

Automatic proof generation remains retired. Historical output is diagnostic; the recorded behavioral assessment remains the semantic owner. The separate retained macOS terminal-cleanup issue is not part of the exercised publication path, and no failed terminal attempt is counted as proof. There are no GitHub/R2 API, deployment, credential, or original Gateway-PR changes in this patch.