[freeqaz-openai]

Summary

Define versioned credential-gateway contracts with a small public API. Caller-facing schema contracts remain at @openclaw-enterprise/occ; generic handles, connection data and operation bookkeeping remain internal to their owning modules.

• Keep Bounds, ValidatedSchemaValue and schema-registration input/result types available to their callers. Registrations identify admitted primitives through data rather than executable callbacks.
• Keep GitHub constructors and GitHubRepositoryWriteSelectionV1 in the controller's token provider. The exact write-permission profile and existing read-only issuer selection remain unchanged.
• Keep generic gateway compiler fixtures in OCC and move concrete provider selection checks into the controller. Both fixture projects run through the root pnpm typecheck command used by required CI.

Dependency and scope

Based on #173. This PR supplies declarations and reference documentation. The fixed schema interpreter is implemented in #184; runtime admission, broker composition and installed Agent behavior belong to their implementation PRs.

Current supplier refresh

This update receives #173 at 4272410246b5e114865de80d4484e40fca0e8f61, including main's Agent stop and Go CLI changes. The root scripts retain all three compiler checks alongside the Go CLI build, check and test commands. Contract source and compiler fixtures are unchanged; the complete migration tree matches the accepted supplier.

Current validation

• The project build, OCC gateway fixture compiler and controller token-provider fixture compiler all passed.
• All four fixture files remain unchanged, preserving 204 negative assertions. These include the original 113 GitHub checks: 95 in OCC and 18 in the controller.
• Generated OpenAPI/reference checks, full repository formatting, workspace boundaries, documentation length and diff whitespace checks passed.

PostgreSQL migrations and database integration were not rerun locally for this head. Required hosted CI must validate this exact revision before merge. These results do not qualify live providers, installed custody or a regular Agent workflow.

Earlier evidence

At the previously published head, 0efac2d865e7cf6bce6b5f223e6248d1227dee55, 61 selected provider-protocol, protected-crypto and real-filesystem token-store tests passed without failures or skips. Its authored documentation build validated 115 pages and 1,300 links; its documentation suite passed 16 of 17 tests because the generated-API fixture could not load workspace dependencies. Those are earlier results. The full typecheck, compiler fixtures and generated API checks now pass as recorded above.

[kevinlin-openai]

Reviewed the complete diff at 86637a1. No actionable findings. Simplicity and Test Audits completed; declaration fixtures retained for distinct type/privacy contracts. Local workspace isolation and diff checks passed; exact-head hosted CI passed. Local compiler was unavailable, so compiler execution evidence comes from hosted CI. Approval applies to this head and its intended stacked base; no merge or retarget is included.

Withdrawing my approval: the branch-specific mandatory autoreview helper pass was not yet completed. Approval will be reconsidered only after the complete current-head review workflow succeeds.

[kevinlin-openai]

Reviewed the complete PR diff at 86637a1. No actionable findings. Applicable documentation/code, Simplicity and Test Audits completed; test dispositions and proof limits were recorded. The mandatory isolated P0–P2 autoreview also completed scoped-clean. Exact-head hosted CI Required passed. Local validation: git diff --check against exact base passed; Workspace isolation passed (254 sources); Exact-head hosted CI Required and Checks, Conformance, Browser passed; no failing/pending checks; zero comments/reviews/unresolved threads; Flow document validator passed; Mandatory isolated autoreview succeeded scoped-clean P0–P2, absolute installed Codex binary; status/report files preserved.; Mandatory isolated autoreview completed scoped-clean for P0–P2 component diff; manual review separately enforces unchanged AGENTS workflow integration requirements.. Local dependency/infrastructure limitations are not claimed as executed proof. Approval covers this exact head against its intended base stack/github-gateway-base. This replaces my earlier dismissed approval after completion of the missing branch-specific review step.

Withdrawing this task’s approval at the user’s direction: this batch is review-only. The review findings remain available; no approval or merge is authorized.

[kevinlin-openai]

Approved.