[Patrick-Erichsen]

What Problem This Solves

Fixes blocked publication checks for uploads whose JavaScript validators use statically provable native storage and function results.

User Impact

Adopts the reviewed scanner repair so unchanged eligible uploads can pass ordinary checks. Production activation and original-upload recovery are separate operations; no issue is automatically closed by this PR.

Why This Change Was Made

-clawscan source: c0731bff55f735957dda18d3fc29e54d7b9f3b13
+clawscan source: aff544dc623c9b2d420bbd13a2c8aab46a90738c
 dependency lock: f4bfc4c3d226c4be309e01b7c5043ca34c53a40975a1ba39cae4c0463c98fb7f

Consumes ClawScan #123 and adds its exact source-to-lock binding while retaining every prior diagnostic binding. Extends the existing matrix and updates the policy pin. Scanner budgets, models, reasoning, service tiers and installer verification remain unchanged.

Evidence

• Before: the actual source-bound runtime validator rejects the new immutable source. Unchanged gtrk-ai-drama 1.3.9 is 2/3 fully inspected.
  After: that same validator accepts the qualified source with its exact lock; unknown/cross-source locks remain rejected. The installed scanner fully inspects 3/3 original files, removing only three generated incomplete-reference rows and retaining all six missing-reference caveats. Other 29 originals retain full finding payloads and coverage counts; one evidenced Feishu reason refines to opaque_content while remaining partial under the same budget. All 30 suppression payloads/counts match.
• Exact-source CI and runtime publication passed. Both native platform/config/smoke identities independently match published immutable index sha256:de7f6f6f77a201dd0f4f02b0b8cbeca91f033e1a382db3993389756ca536fc18.
• 752 source controls, 1,101 installed controls, 300 executable negative controls, Go tests/vet and cumulative-plus-delta source/consumer review qualify the upstream repair. Historical review findings remain recorded with their reproduced repairs.
• Adoption: 23 focused tests, ci:static, ci:types-build, ci:packages, explicit schema/CLI type checks, Convex typecheck and independent P0–P3 integration review passed.
• Local full serial coverage: 8,268 passed / 3 skipped, thresholds passed (87.77% statements / 81% branches / 88.8% functions / 90.41% lines), but exit 1 from an unhandled Darwin Node 24.22.1 setTypeOfService EINVAL in unchanged playwright-local-convex.test.ts. Its candidate isolated runs also pass all three assertions but retain that error; one unchanged-main isolated run exits cleanly. Cause remains unproven; the full hosted unit gate must pass before merge. No assertion or error policy was weakened.
• Exact-head hosted CI is now fully green: 8,268 unit tests passed / 3 skipped with clean command completion; every browser gate and all 29 check/status contexts passed. Fresh review-thread/read-request inventory is empty. The completed independent P0–P3 review qualifies this four-file integration; hosted ClawSweeper has acknowledged only, and no completed bot review is claimed.

Merge Danger

Door: two-way. Revert the source pin and its binding to roll back.

Blast Radius: publication. This changes the scanner source selected by publication workers; deployment and ordinary original-upload checks must be verified separately.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Oct 28, 2026 9:44am UTC

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[Patrick-Erichsen]

The unchanged original @gitruck/gtrk-ai-drama 1.3.9 is now published and installable, verified 2026-10-28 10:43 UTC.

• Exact public version and download return HTTP 200. All 3 original files / 41,634 bytes match retained and published paths, sizes and SHA-256 hashes. Fingerprint remains 716afab09bcd621afae2c10f8d5248bf9e2c039bb1356a3996d2eb6507f9e83b.
• Normal targeted production worker succeeded. Original attempt zx76xmvef0qs0pxcd3mtka1n058h2x6t finalized after one audited retry; ClawScan and TruffleHog are clean. Prior failure count 3 and recovery audit remain preserved.
• Fresh anonymous installs with actual CLI 0.23.3 and 0.24.1, using clawhub --no-input install @gitruck/gtrk-ai-drama --version 1.3.9, both exit 0 without force. All three installed original hashes match. Existing warnings and security guidance remain visible.

Scanner repair #123 is active through production adoption #4115. This resolves AI Drama's original upload. This issue remains open for gtrk-cover and the other unresolved original uploads reported here.