docs: open 0.7.1 unreleased changelog

[steipete]

Summary

Open 0.7.1 - Unreleased after the verified 0.7.0 release. This is a two-line changelog-only follow-up. Package versions stay at 0.7.0, and the released changelog, tag, runtime code, and artifacts are unchanged.

Executed artifact proof

The changelog now begins:

# Changelog

## 0.7.1 - Unreleased

## 0.7.0 - 2026-08-31

### Highlights

Ran the real release-note generator and compared the entire changelog against the immutable v0.7.0 tag, allowing only the new empty section. Actual output:

{"proof":"post-release-changelog","next":"0.7.1 - Unreleased","publishedVersion":"0.7.0","releasedChangelogByteIdentical":true,"releaseNoteBytes":9335,"releaseNoteSha256":"147eaadf28a96fcfe7406b0a402519b89a748c2443e5d2a4da1a6fafbf676899"}

Release verification

The release workflow passed all seven native builds, package assembly, publication, provenance verification, and GitHub Release promotion. Independently verified all eight public npm versions, latest tags, publication times, signatures, and Sigstore provenance; downloaded every tarball and matched its actual bytes, size, and SHA-512 integrity against the exact workflow manifest. The public Release body contains the byte-identical approved notes and all eight npm, tarball, integrity, and provenance links.

A fresh root-only install of @openclaw/fs-safe@0.7.0 from public npm selected the real macOS arm64 binding and passed native hashing, Root JSON I/O, bounded temp cleanup, Root-backed lock acquire/verify/release, regular append, strict native-off rejection before child creation, and compatible native-off cleanup. A separate installed-package process passed archive filter/path-limit rejection, hardlink rejection, Root walk pruning/error reporting, publication cleanup outcomes, and directory-sync rollback/preserve behavior. This is macOS arm64 runtime proof, not execution proof for the other six release targets.

The first isolated consumer invocation stopped before installation because npm refuses the same empty file for both user and global config. Separate empty configs resolved the harness setup issue; the subsequent public install and runtime proofs passed. No package or release change was needed.

Exact-head live CLI evidence

Executed both release-note paths on this PR head. This is generated-artifact behavior proof, not a runtime-app exemption: 0.7.0 still emits its full published notes; 0.7.1 is refused because it is explicitly unreleased. Commands: node scripts/release-notes.mjs 0.7.0 and node scripts/release-notes.mjs 0.7.1.

{
  "proof": "exact-head-release-note-cli",
  "head": "d875ecfcfe8e179db60f46104003c6e90f80ef47",
  "releasedVersion": "0.7.0",
  "releasedNotesExitCode": 0,
  "releasedNotesBytes": 9335,
  "releasedNotesSha256": "147eaadf28a96fcfe7406b0a402519b89a748c2443e5d2a4da1a6fafbf676899",
  "unreleasedVersion": "0.7.1",
  "unreleasedExitCode": 1,
  "unreleasedStdoutBytes": 0,
  "unreleasedError": "Error: CHANGELOG.md section 0.7.1 must have a release date"
}

Complete actual 0.7.0 generated Markdown output

### Highlights

- **Safer reads and writes:** extend exact identity checks and retained-descriptor publication to reject substituted inputs and detect publication mismatches, including rounded-equal Windows file IDs.
- **Opt into bounded temp cleanup:** `cleanupSafety: "require-bounded"` prevents recursive traversal of substituted workspace trees, while the compatible default remains available without native support. See the [cleanup guarantees and POSIX limits](https://fs-safe.io/temp.html#private-temp-workspaces).
- **Harden untrusted archive handling:** reject hidden path aliases, ambiguous TAR metadata, corrupt gzip streams, and excessive decoded data before publication; align filtering and entry reads across JavaScript and native backends.
- **Preserve queued work and durability:** generation-bound claims protect newer same-ID entries from acknowledgement or quarantine, and queue transitions and synchronous store writes sync their filesystem changes.
- **Make lock handoffs and timeouts reliable:** recover from ownership records unlinked during contention, surface release failures, and finish in-flight archive publication or rollback before returning a timeout.

### Compatibility and upgrade notes

- **Claim queued entries before processing.** Call `loadJsonDurableQueueEntry()` or the batch loader before acknowledgement, rather than pairing a direct read with `ackJsonDurableQueueEntry()`. A pending entry without a processing claim now rejects; missing entries remain idempotent no-ops. Queue and failed directories must share a filesystem with hardlink support for quarantine. See the [queue recovery contract](https://fs-safe.io/store.html).
- **Handle the new cleanup result.** `TempWorkspaceCleanupResult` adds `"indeterminate"` for cleanup whose safe completion cannot be established. Exhaustive result handlers must accept it; do not treat it as successful removal or blindly delete retained artifacts.
- **Archive filters receive canonical pre-strip paths.** `entryFilter` now sees normalized separators, dot components, and effective metadata names rather than alternate spellings of the same entry. Update filters that match raw aliases; invalid `onFiltered` values reject before extraction rather than enabling skipping.
- **Validate limits and handle surfaced errors.** Root, FileStore, secure/secret/regular reads, durable queues, and external output require `maxBytes` to be a non-negative safe integer or positive `Infinity`; zero is enforced and `undefined` retains configured defaults. Lock retry/deadline numbers are validated. Handle propagated release, failed-acquire cleanup, and durability failures; exhaustive archive-limit handlers must accept `archive-decoded-size-exceeds-limit`.

### File safety and temp cleanup

- Verify regular-file reads, root-file adapters, archive staging, `Root.copyIn()` sources, and durable JSON queue reads with lossless bigint identities. Reject replacements whose IDs round to the same JavaScript number and unresolved Windows identities before reading bytes; public numeric `Stats` receipts remain unchanged.
- Verify async and sync regular-file append targets against exact pre-open, descriptor, and current-path identities, rejecting rounded-equal replacements and persistent unknown Windows identities before chmod or append.
- Retain async and sync atomic replacement descriptors across `beforeRename`, retries, copy fallback, and publication. Reject substituted, non-regular, or hardlinked stages and preserve unowned cleanup paths. `replaceFileAtomic()` and its sync variant add `renameIdentity: "verify-content-with-lock"` for rename-unstable FUSE mounts: an explicit weaker identity contract for cooperating writers, not protection against same-authority actors ignoring the lock.
- Pin callback-produced sibling temps through mode application, optional fsync, rename, and publication checks. Preserve unverified paths and producer modes, retain disabled sync defaults and best-effort file/directory chmod, and admit read-only descriptors unless `writeSiblingTempFile` requests file sync.
- Apply `writeJsonSync()` best-effort file-mode tightening only through a reopened, single-link regular descriptor matching the staged bigint identity, so a swap cannot chmod an unrelated file.
- Add native handle-relative temp workspace removal with collision-safe quarantine, enumerated-child identity checks, mount-crossing rejection, and symlink/reparse leaf removal without target traversal. Windows deletes exact opened handles; POSIX retains a documented final name-based race bounded to one substituted leaf or empty directory entry, never recursive traversal of a substituted nonempty tree.
- Require usable Linux `openat2` with `RESOLVE_NO_XDEV` at runtime for bounded cleanup. Compatible mode falls back when unavailable; `cleanupSafety: "require-bounded"` rejects before creating a child.
- Open attacker-raceable secure, secret, archive, queue, publication, fallback, and lock-file read paths nonblocking on POSIX, so a FIFO substitution cannot stall admission, deadlines, or cleanup verification.

### Archive extraction and reads

- Prevent archive path aliases from bypassing excluded subtrees: pass canonical pre-strip paths to `entryFilter` across JavaScript/native ZIP, TAR, gzip, zstd, and bzip2, while retaining raw-path validation, stripping, collision checks, and filter rejection policy.
- Reject ambiguous TAR EOF framing, unsafe numeric sizes, and bodies on raw directory/link entries before parsing. Enforce an absolute decoded-byte ceiling through physical EOF, including metadata and zero padding, before extraction publication or entry-read success; report `archive-decoded-size-exceeds-limit` on overflow.
- Bound retained TAR manifests with a shared budget capped at 64 MiB, independent of compressed input size. Validate checksums, strict fixed-field UTF-8, NFC/NFD component lengths, GNU effective trailing separators, and linkname/type consistency before metadata processing or caller policy.
- Validate GNU long-name/link bodies on both backends before parsing: reject malformed UTF-8/NUL structure, repeated or dangling metadata, mixed PAX/GNU chains, and unsafe effective names, while preserving original bytes and valid L+K pairs.
- Apply ordered path, count, strip, depth, collision, and filter policy even to TAR records parsers would ignore (`V`, `A`, `I`, `M`, and unknown typeflags). Safely omit accepted unsupported records, validate raw names hidden by metadata or NUL terminators, and align native device/FIFO filtering and GNUDumpDir handling with JavaScript.
- Stop starting archive destination mutations at the timeout boundary and wait for any already-running destination mutation and rollback before rejecting. Non-mutating work retains prompt deadlines; publication cannot continue after the timeout is reported.
- Match `readArchiveEntry()` to extraction's validated canonical pre-strip paths and effective metadata names across all supported formats/backends. Preserve directory, link, collision, integrity, and byte-limit checks; read `maxBytes` remains a requested-entry budget, separate from archive-wide decoding and metadata limits.
- Charge TAR `maxEntryBytes` and `maxExtractedBytes` only to entries accepted after strip/filter policy, not skipped or fully stripped members. Raw framing, logical entry counts, metadata, and absolute decoded-byte limits still apply to the whole archive.
- Accept highly compressible gzip TARs within fs-safe's explicit limits consistently across backends by disabling node-tar's extra 1000x ratio threshold only after complete decoded-byte admission. Archive, decoded, entry, output, and deadline limits remain enforced.
- Preserve large finite TAR limits such as `Number.MAX_VALUE` in native `auto`/`require` modes through shared internal metadata/decoded-byte and u32 entry-count clamping before backend selection; retain high-level payload budgets and reject malformed direct native limits.
- Update native gzip/DEFLATE decoding to flate2 1.1.10 and miniz_oxide 0.9.1, including upstream incomplete-stream fixes. Truncated bodies, missing trailers, and checksum failures reject before extraction publishes files or an entry read returns bytes.

### Durable queues, stores, and locks

- Claim durable queue generations under a fail-closed cross-process lock using no-replace hardlinks and recoverable source retirement. Acknowledgement and quarantine preserve newer same-ID replacements, and quarantine collisions preserve existing failed-entry evidence.
- Fsync affected directories for queue creation, claims, acknowledgement, quarantine, marker cleanup, and retirement; propagate durability failures. Synchronous file-store writes now fsync temps before rename and parent directories after publication.
- Retry Root-backed sidecar acquisition when the owner unlinks its record after the waiter opens it, but only after the same Root capability proves absence. Replacements remain fail-closed; generic `Root.open()` behavior is unchanged.
- Propagate asynchronous sidecar release and failed-acquire deletion failures, preserve paired errors, and retain failed release state for a safe retry through the same handle or manager drain.
- Clamp synchronous lock backoff to the remaining finite deadline instead of overshooting the timeout or blocking forever.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: passed. Reviewed August 31, 2026, 12:49 PM ET / 16:49 UTC.

ClawSweeper review

What this changes

The PR adds an empty 0.7.1 - Unreleased section above the published 0.7.0 changelog notes.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

This is a clean, merge-ready post-release changelog follow-up: the exact introduced delta is limited to the new unreleased heading, and the release-note generator preserves 0.7.0 output while rejecting an undated 0.7.1 section.

Priority: P3
Reviewed head: d875ecfcfe8e179db60f46104003c6e90f80ef47

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, correct documentation change with directly relevant exact-head generator evidence.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (terminal): The changed production-facing owner is the release-note generator reading CHANGELOG.md. The PR body records exact-head terminal results for its two relevant entrypoints: 0.7.0 emits the existing 9,335-byte notes and 0.7.1 stops before output because its new heading is intentionally undated; source inspection independently matches both results.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The changed production-facing owner is the release-note generator reading CHANGELOG.md. The PR body records exact-head terminal results for its two relevant entrypoints: 0.7.0 emits the existing 9,335-byte notes and 0.7.1 stops before output because its new heading is intentionally undated; source inspection independently matches both results.
Evidence reviewed	5 items	Exact introduced change: The verified merge-base-to-head delta adds only the 0.7.1 - Unreleased heading and blank line; no released notes, package version, runtime, or workflow files change. Generator contract: The generator selects the requested version section, requires an ISO release date before emitting notes, and stops at the next version heading; this makes the new undated 0.7.1 section reject while leaving 0.7.0's section body unchanged. Release workflow integration: The tag-driven release workflow validates a dated changelog section and generates release notes through the same script, so the added heading is consistent with the repository release contract.
Findings	None	None.
Security	None	None.

How this fits together

CHANGELOG.md feeds the release-note generator and release workflow. Dated version sections become public release notes, while an undated upcoming version is intentionally not releasable.

flowchart LR
  A[Changelog source] --> B[Release-note generator]
  B --> C{Section has release date?}
  C -->|Yes| D[Generated release notes]
  C -->|No| E[Reject unreleased version]
  D --> F[Published release]

Loading

Before merge

• Complete next step (P2) - No repair lane is needed: there are no review findings, and the automerge-enabled PR has relevant exact-head proof.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Changelog delta	2 added, 0 removed; 1 file affected	The branch is narrowly scoped to opening the next release section and does not alter published notes or package behavior.

Technical review

Best possible solution:

Merge the isolated unreleased heading while retaining the dated-section gate that prevents accidental 0.7.1 publication until notes and a release date are ready.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction. The PR body nevertheless provides high-confidence exact-head terminal evidence for both affected generator paths, and the source confirms those outcomes.

Is this the best way to solve the issue?

Yes. Opening an explicit undated next-version section is the narrow, maintainable post-release convention; the existing generator continues to protect against releasing it prematurely.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 054b488dc2f2.

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. The changed production-facing owner is the release-note generator reading CHANGELOG.md. The PR body records exact-head terminal results for its two relevant entrypoints: 0.7.0 emits the existing 9,335-byte notes and 0.7.1 stops before output because its new heading is intentionally undated; source inspection independently matches both results.
• add status: 🚀 automerge armed: This PR is in ClawSweeper's automerge lane. Sufficient (terminal): The changed production-facing owner is the release-note generator reading CHANGELOG.md. The PR body records exact-head terminal results for its two relevant entrypoints: 0.7.0 emits the existing 9,335-byte notes and 0.7.1 stops before output because its new heading is intentionally undated; source inspection independently matches both results.
• remove status: 📣 needs proof: Current PR status label is status: 🚀 automerge armed.

Label justifications:

• P3: This is low-risk release-note maintenance with no runtime, package, or compatibility behavior change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 🚀 automerge armed: This PR is in ClawSweeper's automerge lane. Sufficient (terminal): The changed production-facing owner is the release-note generator reading CHANGELOG.md. The PR body records exact-head terminal results for its two relevant entrypoints: 0.7.0 emits the existing 9,335-byte notes and 0.7.1 stops before output because its new heading is intentionally undated; source inspection independently matches both results.
• proof: sufficient: Contributor real behavior proof is sufficient. The changed production-facing owner is the release-note generator reading CHANGELOG.md. The PR body records exact-head terminal results for its two relevant entrypoints: 0.7.0 emits the existing 9,335-byte notes and 0.7.1 stops before output because its new heading is intentionally undated; source inspection independently matches both results.

Evidence

What I checked:

• Exact introduced change: The verified merge-base-to-head delta adds only the 0.7.1 - Unreleased heading and blank line; no released notes, package version, runtime, or workflow files change. (CHANGELOG.md:3, d875ecfcfe8e)
• Generator contract: The generator selects the requested version section, requires an ISO release date before emitting notes, and stops at the next version heading; this makes the new undated 0.7.1 section reject while leaving 0.7.0's section body unchanged. (scripts/release-notes.mjs:10, d875ecfcfe8e)
• Release workflow integration: The tag-driven release workflow validates a dated changelog section and generates release notes through the same script, so the added heading is consistent with the repository release contract. (.github/workflows/release.yml:48, 054b488dc2f2)
• Release provenance: v0.7.0 contains the base commit and its changelog begins directly with the dated 0.7.0 section; the PR head is not in that release, as expected for a post-release follow-up. (CHANGELOG.md:3, 054b488dc2f2)
• Current release-area history: The current main release-preparation commit was authored by Peter Steinberger and established the 0.7.0 changelog baseline immediately preceding this PR. (CHANGELOG.md:5, 054b488dc2f2)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-08-31T16:40:53.540Z sha d875ecf :: needs real behavior proof before merge. :: none

[steipete]

@clawsweeper re-review

The main PR body now includes exact-head generated-artifact behavior proof for d875ecfcfe8e179db60f46104003c6e90f80ef47: both real release-note CLI invocations, their actual exit/status/error data, and the complete actual 9,335-byte generated 0.7.0 Markdown. The released notes remain byte-identical; requesting 0.7.1 correctly fails with no stdout because the new section is explicitly unreleased.

Please evaluate this concrete CLI/artifact evidence as the relevant changed behavior rather than a runtime-application not-applicable assessment. No code change, test relaxation, new release, tag change, or publishing action is requested. Review only; the coordinating maintainer will arm landing after the remaining gates.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/33416421026
• Updated: 2026-08-31T16:52:13.022Z

[steipete]

@clawsweeper automerge

Special instructions:
Land only this two-line post-release changelog follow-up, on exact reviewed head d875ecfcfe8e179db60f46104003c6e90f80ef47, after normal review/proof gates pass. All exact-head hosted checks are green, including the complete Node 22/24 OS matrix, four native execution targets, package smoke, coverage, and audit. Local Codex autoreview is scoped-clean with no findings. The main PR body contains complete executed generator output and exact-head proof for both the released and intentionally unreleased CLI paths; a re-review is already requested.

Local validation caveat: an unrestricted full-suite attempt was stopped after host-contention timeouts. The four-worker CI-mode rerun passed 6,085 tests with one 5-second PAX timeout; its unchanged isolated suite then passed all 158 tests. Package validation and diff whitespace checks passed. No tests, timeouts, runtime files, package versions, or release artifacts were changed. Hosted full checks on this exact head passed without retries.

Do not bypass a missing review/proof gate or change code to satisfy the docs-only proof policy. Preserve the byte-identical 0.7.0 release notes and package version, and do not create tags, publish packages, edit the existing Release, or start any unrelated work. The 0.7.0 release is already public and independently verified.

[clawsweeper]

🦞🧹
ClawSweeper could not enable automerge for this PR.

Reason: target is no longer an open PR.

Draft PRs stay fix-only until GitHub marks them ready for review. Pause with /clawsweeper stop.

Automerge progress:

• 2026-08-31 16:47:37 UTC active review reused d875ecfcfe8e (waiting)

• 2026-08-31 16:51:19 UTC review passed d875ecfcfe8e (structured ClawSweeper verdict: pass (sha=d875ecfcfe8e179db60f46104003c6e90f80e...)

• 2026-08-31 16:52:28 UTC merged d875ecfcfe8e (merged by ClawSweeper automerge)

[steipete]

Landed through maintainer-armed ClawSweeper automerge as abad7c213615. The merged tree exactly matches reviewed head d875ecfcfe8e179db60f46104003c6e90f80ef47; the final exact-head review passed with no findings.

Verification: CI and coverage passed, including all configured Node 22/24 OS checks, four native execution targets, package smoke, audit, and merged coverage. No hosted rerun was needed. Local Codex autoreview was scoped-clean. The extra local full run encountered host-contention timeouts; its four-worker rerun passed 6,085 tests with one 5-second PAX timeout, then the unchanged isolated PAX suite passed all 158 tests. pnpm pack:check and git diff --check passed. No timeout or test changes were made.

After fast-forwarding main, revalidated the real release-note generator and exact full-changelog comparison: only the empty 0.7.1 - Unreleased section was added, package version remains 0.7.0, and the complete generated 0.7.0 notes retain SHA-256 147eaadf28a96fcfe7406b0a402519b89a748c2443e5d2a4da1a6fafbf676899. Main is clean; the existing v0.7.0 tag and verified npm/GitHub Release are unchanged. Full public-registry tarball and fresh-consumer proof is recorded in the PR body.