fix(review): classify a reviewed synthetic URI fixture

[steipete]

What Problem This Solves

Resolves a problem where the native review of #1294 repeatedly fails before provider invocation because TruffleHog finds the same existing 45-byte synthetic malformed-configuration URI (no path, query, or fragment) in the complete base and head versions of a changed test file. Removing it only from the new revision would still leave the base finding.

Why This Change Was Made

Keep classification at the host-owned scan boundary. One reviewed fixture is identified by its exact full-value SHA-256, URI detector contract, and literal occurrence at the reported line of a host-staged Git blob for test/action-ledger-runtime.test.ts. The policy never comes from the reviewed checkout. All findings must qualify, and the native scanner must report complete, error-free output under the pinned 3.97.1 contract. Both Raw and RawV2 are checked. This exact approved URI has no path, query, or fragment, so native TruffleHog returns the same 45 bytes in both fields. For a different URI with a path, the detector removes that path from Raw but preserves it in RawV2; that different full value must remain blocked.

The complete raw diffs, binary patches, before/head blobs, prompt, schema, and additional input still reach TruffleHog with the original flags. Changed values, mixed findings, prompt/schema/diff/additional-input occurrences, encoded-only occurrences, scan errors, and source drift still refuse admission. There are no ignore comments, excluded detectors or paths, new configuration, or fixture rewrites. A sanitized structured host stderr notice preserves each accepted source/blob/line/decoder/count without raw values or verification diagnostics; successful provider callers cannot hide it by discarding their stderr.

User Impact

Reviews that encounter this existing synthetic fixture can proceed while unrelated sensitive findings remain blocking. The classification deliberately fails closed if the scanner output contract changes; a scanner upgrade requires requalification.

OpenClaw Bay Impact

None. This changes pre-provider input admission and emits an operator log notice; it does not change queue, publication, dashboard, or observer data contracts.

Documentation Impact

Updated the active README Safety Model at the scan owner to describe the exact classification, its limits, audit notice, and scanner-upgrade requirement. Reviewed docs/commit-sweeper.md; its complete-input scanning contract is unchanged.

Evidence

• Corrected regression reproduction rejects the reviewed fixture on the previous owner with AgentInputScanError: findings, before provider invocation.
• node --test test/agent-input-scan.test.ts: 49/49 passed, including all 20 new classification/refusal/audit cases and the existing snapshot cases. node --test test/agent-runner.test.ts: 8/8 passed. The full admission run caught a test-helper callback-argument regression during development; the helper signature was restored and the original assertions then passed unchanged.
• Exact-head hosted CI passed, including the full pnpm run check, sparse builds, and Windows launcher; CodeQL also passed.
• pnpm run build:node, pnpm run check:static, pnpm run lint:src, pnpm run lint:scripts, and git diff --check pass.
• Fresh isolated Codex autoreviews before commit and against the committed branch report no accepted/actionable P0 findings. Candidate head: 6e0e0a75a46bac1f656069e87e9a379642155450.
• Direct dependency inspection: URI detector, JSON output, and scan completion/exit ordering. Exit 183 alone is insufficient because detector errors can be logged while findings are returned.
• The fixture's introduction was verified from the raw parent and parent-to-commit patch of d68b1861172120fc6429cb346aadce65a46ed5a2, not blame alone. No credential-shaped value is copied into this PR.

Real Behavior Proof

Claim: the actual host admission owner accepts the unchanged PR's reviewed fixture and continues refusing altered or additional findings with the native scanner.

Environment: macOS arm64, Node 24.20.0, TruffleHog 3.97.1; trusted compiled candidate modules outside an isolated, clean Git target. Target base db14db010bf3044be85f25fe40a587a5ca77523a, unchanged head 0efc0e7d2ada1f665e5b2c00ad41c5c3d078c65a. The proof invokes scanAgentInput({cwd, prompt, source: {kind: "committed", baseSha, headSha}, timeoutMs}) rather than manually selecting scan files. It stages both changed test files and all complete source inputs through the production owner with --results=verified,unknown --fail --fail-on-scan-errors --no-update --json --no-color.

Rebuilt and repeated against clean committed candidate 6e0e0a75a46bac1f656069e87e9a379642155450 at 2026-08-29 19:38:54 UTC. git rev-parse HEAD matched that commit and git status --porcelain was empty before rebuilding, before snapshotting the compiled owner, and after proof. The copied compiled owner matched the rebuild byte-for-byte; the committed source hashes were recorded alongside the compiled hashes. This distinguishes the owner PR head (1296) from the input target PR head (1294).

Native scenario	Result	Host audit	Target state
Exact unchanged PR 1294	admitted, 8.2 seconds	one sanitized classification event	clean, exact head unchanged
Same target with fixture credential altered	refused: findings, 8.1 seconds	none	clean
Same target with a distinct additional finding	refused: findings, 6.0 seconds	none	clean

Redacted native field trace, freshly observed 19:36:44 UTC on the complete base/head blobs:

Source	Line	Raw bytes	RawV2 bytes	Equal	Path / query / fragment present
Base blob 706a111e474d4ffff0ba27d49fade1c8c66e1c97	3484	45	45	true	false / false / false
Head blob a17ba3b4b08d5f4e0673321a1202d3d4d6525a91	3492	45	45	true	false / false / false

Both raw-field SHA-256 values in every record are a728de5dbbef23b8aa5ef2d99060835f4f2fb5a0fa2abb9fe249d08aa09bd09e. These are real TruffleHog 3.97.1 records, not the fake scanner fixture. Completion reported zero verified findings, two unknown findings, and no scan errors. Decoder duplication may vary between native runs; no fixed finding count is assumed by production.

A fourth native case at 19:42:00 UTC exercises the review's distinct-field scenario directly. A real two-commit Git fixture contains the complete original test file at its canonical path, with only a path extension added to the URI in the second commit. Native TruffleHog reports Raw = 45 bytes with the approved digest, RawV2 = 49 bytes with digest b146c2ee0e8714569773e6c7113d97ae66bf3c2bd4e6170823d40796c9562a99, equality false, and a path only in RawV2. The actual committed owner refuses with findings and emits no classification notice, as required. This bounded field-contract fixture is separate from the three whole-PR runs above. Local redacted receipt: /tmp/clawsweeper-1296-committed-native-2mj7p_ww/path-negative-receipt.json.

The successful owner event identifies only the fixture digest and Git blob/line/decoder/count metadata. Captured stdout/stderr were checked for absence of the URI, password, and hostname. Exact committed candidate fingerprints:

File	SHA-256
src/agent-input-scan.ts	8538338d2cbfa1e475ebb34e68641ba6c76392b10a23891903ac4bf60723ff11
src/agent-input-scan-fixtures.ts	286fa5c7e024795915a99a13e724cd0e2f7ad866c9f8704a9af83fd52fca1d8d
dist/agent-input-scan.js	9a75c8dbdfdfed1a91d5197b16a8484a7e6309fca9a1404fd730b679ec316926
dist/agent-input-scan-fixtures.js	95a685771e73b978a68891900ea73cc9a72ccc5dbd8aa1bb9f761fee8845a268

Reproduction of the positive admission path from a clean checkout of this PR head, with the native scanner installed outside both checkouts:

pnpm install --frozen-lockfile
pnpm run build:node
scan_target=$(mktemp -d)
git clone --quiet --no-checkout https://github.com/openclaw/clawsweeper.git "$scan_target/target"
git -C "$scan_target/target" checkout --quiet --detach 0efc0e7d2ada1f665e5b2c00ad41c5c3d078c65a
SCAN_TARGET="$scan_target/target" node --input-type=module <<'JS'
import { scanAgentInput } from './dist/agent-input-scan.js';
scanAgentInput({
  cwd: process.env.SCAN_TARGET,
  prompt: 'Review the committed cleanup change.',
  source: {
    kind: 'committed',
    baseSha: 'db14db010bf3044be85f25fe40a587a5ca77523a',
    headSha: '0efc0e7d2ada1f665e5b2c00ad41c5c3d078c65a',
  },
  timeoutMs: 120000,
});
console.log('admission passed; no provider started');
JS

Local redacted receipts: /tmp/clawsweeper-1296-committed-native-2mj7p_ww/receipt.json and /tmp/clawsweeper-1294-native-field-shape-rjzxdik5/receipt.json (not hosted artifacts; their material results are reproduced above).

Limits: this is real scanner/admission proof, not a provider or hosted-review claim. The target PR remains unchanged and unmerged until this owner repair lands and its normal native review succeeds. No raw scanner findings or credentials are included in proof output.

Review Finding Disposition

The 19:34 UTC review's P1 premise is not supported by the native output: the reviewed fixture has no path, so clearing its already-empty path leaves Raw equal to RawV2. I re-read the actual pinned detector (uri.go:93–109) and verified the fixture directly from this PR's committed source. A fresh native trace at 19:36:44 UTC reports both fields as 45 bytes, the same approved SHA-256, equality true, and path/query/fragment presence false for both base and head findings. Raw URI presence was measured without WHATWG normalization (which inserts a default slash).

The proposed general distinct-field admission is intentionally not adopted: this is one exact fixture classification, not permission for other full URIs sharing its abbreviated Raw. The existing changed full URI regression sets a different RawV2 while keeping Raw and verifies refusal. Native distinct-field proof and the rebuilt committed-head binding are recorded above. This resolves the P1 premise and associated automation-risk claim without loosening the gate. The requested stronger proof is accepted and supplied; there is no functional source change.

Scope and Risk

Production delta is +166/-2 lines; test delta is +125/-2 lines. The production growth is the new strict classification and audit boundary; the previous unconditional rejection remains for every unclassified finding. No configuration, dependency, database, workflow, provider, or review-policy changes. No broad false-positive heuristic or fallback was added.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[steipete]

@clawsweeper re-review

The current body records the executed native whole-PR scanner proof (unchanged input admitted; altered credential and additional finding refused), sanitized audit verification, 49 passing admission tests, eight passing runner tests, and clean pre-commit and committed-branch Codex reviews. Head is 6e0e0a75a46bac1f656069e87e9a379642155450; exact-head hosted CI is running. Please review the host-owned classification boundary without changing scan scope or scanner flags.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/33271441404
• Updated: 2026-08-29T19:39:53.639Z

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 29, 2026, 3:45 PM ET / 19:45 UTC.

ClawSweeper review

What this changes

The PR permits one exact synthetic URI finding from a staged Git blob after strict TruffleHog-output validation, while retaining refusal for every other finding.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep open for normal maintainer landing: current main still rejects every TruffleHog finding, while this PR adds a narrowly bound exception and the re-review evidence resolves the earlier field-equality concern. No introduced correctness defect was found.

Priority: P1
Reviewed head: 6e0e0a75a46bac1f656069e87e9a379642155450

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Focused implementation, adversarial coverage, and redacted exact-head native evidence support normal maintainer landing.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (logs): The changed production owner is the scan-admission path in src/agent-input-scan.ts; the PR body provides redacted native TruffleHog 3.97.1 exact-head traces through that owner showing admission only for the unchanged staged fixture and refusal for altered, additional, and path-extended cases.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (logs): The changed production owner is the scan-admission path in src/agent-input-scan.ts; the PR body provides redacted native TruffleHog 3.97.1 exact-head traces through that owner showing admission only for the unchanged staged fixture and refusal for altered, additional, and path-extended cases.
Evidence reviewed	7 items	Current main still blocks the reported fixture: The current-main scan owner rejects status 183 or any scanner stdout as findings, so it cannot admit the reviewed fixture described by this PR. Exception remains fail-closed: The introduced classifier requires pinned scanner completion metadata, the URI detector contract, an exact full-value digest, equal Raw and RawV2 fields, and a matching literal in an approved staged blob; any mismatch returns undefined and is refused. Staged source binding: Only blobs from the exact approved fixture path are retained for classification, and scanner metadata must resolve to those staged blobs before admission can continue.
Findings	None	None.
Security	None	None.

How this fits together

Review admission stages prompts and Git-derived inputs, scans them with TruffleHog, and blocks provider invocation on unsafe input. This change adds a narrow classification decision between scanner output and continuing an automated review.

flowchart LR
  A[Review inputs] --> B[Private host staging]
  B --> C[TruffleHog scan]
  C --> D{Exact reviewed fixture?}
  D -->|Yes| E[Sanitized audit notice]
  D -->|No or incomplete| F[Block review]
  E --> G[Provider review continues]

Loading

Before merge

• Resolve merge risk (P1) - This changes a security-sensitive automated admission boundary; future TruffleHog output-contract changes will safely block reviews until the pinned classifier is requalified.
• Complete next step (P2) - No mechanical repair is indicated; this PR is ready for normal maintainer landing review.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	production +166/-2, tests +125/-2, docs +13/-1	Most added production code is the strict classifier and audit boundary, paired with adversarial refusal coverage.
Admission scenarios	20 added scenarios	The tests exercise malformed scanner output and altered finding variants rather than only the accepted fixture.

Merge-risk options

Maintainer options:

1. Land the constrained exception (recommended)
   Accept the bounded admission change, retaining the documented requirement to requalify before any TruffleHog contract upgrade.
2. Pause if scanner support changes
   Keep the existing refusal behavior until fresh native evidence establishes the new scanner version’s output contract.

Technical review

Best possible solution:

Land the narrowly bound classifier with its pinned scanner contract and refusal coverage, then requalify it deliberately whenever the scanner version or JSON output contract changes.

Do we have a high-confidence way to reproduce the issue?

Yes: current-main source unconditionally rejects scanner findings, and the PR body supplies redacted native TruffleHog runs showing the fixture triggers that path before the introduced classifier admits it.

Is this the best way to solve the issue?

Yes: a host-side, exact-value classifier tied to staged Git blobs is a narrower maintainable repair than a scanner ignore rule or a broad URI exception.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against db14db010bf3.

Labels

Label changes:

• add merge-risk: 🚨 security-boundary: The diff adds an exception to the sensitive-input admission boundary, albeit one restricted by full-value and staged-source checks.
• add proof: sufficient: Contributor real behavior proof is sufficient. The changed production owner is the scan-admission path in src/agent-input-scan.ts; the PR body provides redacted native TruffleHog 3.97.1 exact-head traces through that owner showing admission only for the unchanged staged fixture and refusal for altered, additional, and path-extended cases.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (logs): The changed production owner is the scan-admission path in src/agent-input-scan.ts; the PR body provides redacted native TruffleHog 3.97.1 exact-head traces through that owner showing admission only for the unchanged staged fixture and refusal for altered, additional, and path-extended cases.
• remove rating: 🧂 unranked krab: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
• remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

• P1: The repair restores a blocked automated review path while preserving sensitive-input admission controls.
• merge-risk: 🚨 automation: The diff changes the scanner result that permits or stops the automated review workflow.
• merge-risk: 🚨 security-boundary: The diff adds an exception to the sensitive-input admission boundary, albeit one restricted by full-value and staged-source checks.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (logs): The changed production owner is the scan-admission path in src/agent-input-scan.ts; the PR body provides redacted native TruffleHog 3.97.1 exact-head traces through that owner showing admission only for the unchanged staged fixture and refusal for altered, additional, and path-extended cases.
• proof: sufficient: Contributor real behavior proof is sufficient. The changed production owner is the scan-admission path in src/agent-input-scan.ts; the PR body provides redacted native TruffleHog 3.97.1 exact-head traces through that owner showing admission only for the unchanged staged fixture and refusal for altered, additional, and path-extended cases.

Evidence

What I checked:

• Current main still blocks the reported fixture: The current-main scan owner rejects status 183 or any scanner stdout as findings, so it cannot admit the reviewed fixture described by this PR. (src/agent-input-scan.ts:428, db14db010bf3)
• Exception remains fail-closed: The introduced classifier requires pinned scanner completion metadata, the URI detector contract, an exact full-value digest, equal Raw and RawV2 fields, and a matching literal in an approved staged blob; any mismatch returns undefined and is refused. (src/agent-input-scan-fixtures.ts:41, 6e0e0a75a46b)
• Staged source binding: Only blobs from the exact approved fixture path are retained for classification, and scanner metadata must resolve to those staged blobs before admission can continue. (src/agent-input-scan.ts:387, 6e0e0a75a46b)
• Adversarial coverage: Twenty new scenarios cover altered fields, mixed findings, prompt and encoded occurrences, malformed output, detector errors, version/count mismatches, and source drift; only the reviewed fixture and its HTML duplicate are admitted. (test/agent-input-scan.test.ts:428, 6e0e0a75a46b)
• Real behavior proof: The PR body records redacted native TruffleHog 3.97.1 runs against the exact committed owner head: the unchanged fixture is admitted, while altered, additional, and path-extended findings are refused without an audit notice. (src/agent-input-scan.ts:441, 6e0e0a75a46b)
• Current area ownership: The preceding host-owned scan implementation was introduced by Peter Steinberger in the current feature-history commit; this PR is the immediate follow-up on that owner. (src/agent-input-scan.ts:1, e1eefe217304)

Likely related people:

• Peter Steinberger: Introduced the host-owned input scanner in the immediately preceding feature-history commit and has the most recent history on its owner file. (role: scan-owner introducer and recent area contributor; confidence: high; commits: e1eefe217304, 6e0e0a75a46b; files: src/agent-input-scan.ts, test/agent-input-scan.test.ts)
• Vincent Koc: The classifier’s documented fixture provenance points to the ledger validation commit that introduced the source test case. (role: fixture-source contributor; confidence: medium; commits: d68b18611721; files: test/action-ledger-runtime.test.ts)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-08-29T19:34:00.548Z sha 6e0e0a7 :: needs real behavior proof before merge. :: [P1] Bind the complete URI field instead of requiring equal fields
• reviewed 2026-08-29T19:38:10.609Z sha 6e0e0a7 :: needs real behavior proof before merge. :: [P1] Bind the complete URI field instead of requiring equality

[steipete]

@clawsweeper re-review

The main body now includes the disposition of the field-equality finding and stronger proof bound explicitly to clean committed owner head 6e0e0a75a46bac1f656069e87e9a379642155450. The approved fixture has no path/query/fragment: real TruffleHog returns equal 45-byte Raw/RawV2 fields with the approved digest. A new native path-extension case produces distinct fields (45/49 bytes) and is correctly refused. The rebuilt exact-head owner again passed unchanged whole-PR admission and both altered/additional-finding refusals. All CI checks are green.

No source or policy change was made: accepting a different full URI just because its abbreviated field matches would broaden the intended classification. The native field trace, candidate source/compiled fingerprints, commands, and finding disposition are in the body.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/33271746823
• Updated: 2026-08-29T19:47:05.446Z