feat(gateway): enforce scoped guest models and foreground-only work

[vincentkoc]

Fixes #156269.

What Problem This Solves

Shared Gateway operators need to offer guests approved models and bounded conversation work with understandable Stop, cleanup and restart outcomes.

User Impact

Guest restrictions reuse the existing role modelPolicy. Accepted work must satisfy both its immutable original ceiling and current policy. Automatic selection chooses an allowed route for that caller without changing shared staff pins; explicitly forbidden choices and unsupported routes visibly refuse.

Foreground-only guest work preserves conversation history and drafts. Stop holds admission until owned cleanup settles. Restart records a visible stopped notice without automatically replaying work; continuing requires a fresh authenticated request. Uncertain sandbox cleanup prevents reuse.

Catalogs, session metadata and UI choices respect the same restrictions. Narrow session events require current identity and every referenced session’s live sharing fence. Unrestricted staff behavior, defaults and workspace locations remain unchanged.

Why This Change Was Made

Model authority, foreground admission, native allocation/retirement and session/UI access must agree throughout execution and cleanup. The existing policy owner carries authority through nested work and binds logical selection to the actual provider delegate. This does not certify additional native runtimes or Codex routes.

Change scope against the frozen base

Production/tooling: 334 paths, +13,019/−5,772 lines (net +7,247). Tests/helpers: 151 paths, +21,257/−965 (net +20,292). Production growth implements the four shared authority, foreground, native lifecycle and session-access boundaries above; it does not add a separate policy configuration or database schema.

Existing JSON records gain foregroundRun and retirementPolicy metadata. No new roles.models configuration, database, table, column or schema-version bump is introduced. Older-binary rollback of candidate state remains unqualified: restart, backup and updater evidence do not establish equivalent enforcement after downgrade.

openclaw/rfcs#74 remains a separate, unaccepted draft. Source landing does not deploy this feature or change operator access infrastructure.

Evidence

Current candidate: addc4ec21a4a7226530e612b8f4881626e0920a1, tree 8fdca6d8a4bb3749a9de27290f1d2c50cf2672b4.

• Actual private-QA build passed in 5m52.411s; all four real Linux UI scenarios passed with no skips. Strict same-toolchain startup-budget comparison against frozen base 0c7d77cd passed.
• Five-pass scoped production review at d63b7688 was clean. Subsequent diagnostic and transcript-selector changes are test-only and received scoped review.
• Historical native final-effect coverage: Docker7 and Podman6 passed at 36c5fc4862ad09b22bf63edcec9a0da9ccaa0c76, with no skips. The 444-case composite remains revision-bound: 299 at eda43e0eacb294d6b4ec8cad0d7720b522503947 and 145 at ee23da7771abd28bfcd953e2ef918805d38fa4df; these are not an exact-head aggregate.
• Exact-head GitHub CI remains pending publication and native gate admission.

Restart checks count one transcript notice, excluding its separate accessibility announcement, and verify reload, no replay and a fresh request.

Real Linux UI: Stop, cleanup uncertainty and restart

Running work before Stop:

Draft preserved after Stop:

Cleanup still pending:

Cleanup uncertainty refuses reuse:

Running work before Gateway restart:

History and visible notice after restart:

ClawSweeper’s prior parallel-policy finding is addressed by convergence on the existing modelPolicy owner. Native final-effect results address its requested execution/cleanup proof; older-state rollback qualification remains explicitly open.

Named follow-up: Guest Publish PR capability messaging — the narrow guest panel currently reports missing operator.read; improve its gating/message separately.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 24, 2026, 1:32 AM ET / 05:32 UTC (Revision 4).

ClawSweeper review

What this changes

The branch adds scoped guest model routing and foreground-only chat work across Gateway admission, provider hooks, sandbox cleanup, session records, and Control UI Stop and restart flows.

Merge readiness

⛔ Blocked before merge - 11 items remain

Current main has the role model ceiling but not the foreground Stop and restart behavior, so this PR still has distinct value. The prior synchronous SQLite finding remains, an existing bundled provider route can lose finite-role access, and rollback safety for new persisted guest state is unresolved.

Priority: P2
Reviewed head: addc4ec21a4a7226530e612b8f4881626e0920a1
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The branch has meaningful current-binary behavior evidence, but an unresolved authority upgrade boundary and two actionable findings limit merge confidence.
Proof confidence	🦐 gold shrimp (3/6)	Needs stronger real behavior proof before merge: Authority-chain proof required: the PR reports real Linux Gateway/UI Stop and restart runs plus Docker and Podman final-effect observations on production paths unchanged since those runs. It does not show an older binary opening candidate-written foregroundRun and retirementPolicy state and rejecting stale guest authority before provider or sandbox I/O. Existing-state compatibility is therefore insufficient; four prepared UI images returned 404 and browser opening returned cache misses, which is a reviewer inspection limit rather than a separate contributor failure. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: Authority-chain proof required: the PR reports real Linux Gateway/UI Stop and restart runs plus Docker and Podman final-effect observations on production paths unchanged since those runs. It does not show an older binary opening candidate-written foregroundRun and retirementPolicy state and rejecting stale guest authority before provider or sandbox I/O. Existing-state compatibility is therefore insufficient; four prepared UI images returned 404 and browser opening returned cache misses, which is a reviewer inspection limit rather than a separate contributor failure. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	10 items	Current-main boundary: Current main documents role modelPolicy, but the foreground admission and persisted foreground-run files added by this branch are absent there; the PR's central Stop and restart behavior remains unique. Prior finding remains: The introduced retirement guard synchronously reads the state database; Gateway sandbox and cleanup callers invoke it. The previous ClawSweeper review raised this same concern on the pinned head. Provider compatibility trigger: A finite model request now requires an affirmative declaration for a present provider wrapper.
Findings	2 actionable findings	[P1] Qualify existing finite-role provider wrappers before rejecting them [P2] Move the retirement registry read to the SQLite worker
Security	Needs attention	Qualify guest custody after downgrade: The new retirement marker is persisted in registry JSON, while the pinned older reader's removal path has no corresponding check. The PR acknowledges that rollback does not establish equivalent enforcement; prove rejection before provider or sandbox I/O or constrain deployment accordingly.

How this fits together

The Gateway accepts authenticated guest requests and applies role policy before an agent reaches a provider or sandbox. It records foreground work and sends Stop and restart outcomes back to the conversation UI.

flowchart LR
  A[Authenticated guest] --> B[Gateway role policy]
  B --> C[Model route check]
  C --> D[Provider request]
  B --> E[Foreground admission]
  E --> F[Sandbox cleanup]
  F --> G[Session notice and chat UI]

Loading

Decision needed

Question	Recommendation
Must a Gateway downgrade be blocked after candidate-written guest foreground or sandbox state, or may operators accept loss of equivalent guest enforcement during rollback?	Fence unsafe rollback: Require a proven downgrade guard or state-drain procedure before enabling guest access on candidate-written state.

Why: The branch writes authority-related state that the older reader does not check, and the PR explicitly leaves rollback unqualified; the acceptable deployment boundary is a maintainer security choice.

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: Authority-chain proof required: the PR reports real Linux Gateway/UI Stop and restart runs plus Docker and Podman final-effect observations on production paths unchanged since those runs. It does not show an older binary opening candidate-written foregroundRun and retirementPolicy state and rejecting stale guest authority before provider or sandbox I/O. Existing-state compatibility is therefore insufficient; four prepared UI images returned 404 and browser opening returned cache misses, which is a reviewer inspection limit rather than a separate contributor failure. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Qualify existing finite-role provider wrappers before rejecting them (P1) - The new declaration check rejects a present wrapper without resolveModelRequestBindingSupport. The bundled llama.cpp provider still registers both wrappers without that query, so a role already using modelPolicy with this route can lose access after upgrade. Qualify the route or obtain an explicit compatibility decision with an upgrade path. This is a late discovery on code unchanged since the prior reviewed head.
• Move the retirement registry read to the SQLite worker (P2) - The new retirement assertion synchronously rereads SQLite from Gateway sandbox and cleanup callers. Route this check through the database worker while retaining the generation check before the final effect.
• Resolve security concern: Qualify guest custody after downgrade - The new retirement marker is persisted in registry JSON, while the pinned older reader's removal path has no corresponding check. The PR acknowledges that rollback does not establish equivalent enforcement; prove rejection before provider or sandbox I/O or constrain deployment accordingly.
• Resolve merge risk (P1) - Candidate-written foreground and sandbox records lack an older-binary rollback case proving that ended guest authority is rejected before provider or sandbox I/O.
• Resolve merge risk (P1) - Existing finite-role configurations using undeclared custom provider wrappers, including the bundled llama.cpp wrapper, can stop working until those routes are qualified or maintainers explicitly accept the restriction.
• Resolve merge risk (P1) - The provided GitHub snapshot reported a dirty merge; the fresh mergeability projection is unknown, so the resulting tree against current main still needs review.
• Complete next step (P2) - Fix the retirement read, qualify or explicitly accept affected provider routes, decide and prove the rollback boundary, and review a clean merge result before merge.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.
• Review config compatibility - Confirm compatibility and upgrade impact for the changed config or default surface before merge.
• Add data-model compatibility proof - Confirm migration or upgrade compatibility proof before merge.

Findings

• [P1] Qualify existing finite-role provider wrappers before rejecting them — src/plugins/provider-model-request-binding.ts:29-32
• [P2] Move the retirement registry read to the SQLite worker — src/agents/sandbox/registry.ts:233-235
• [medium] Qualify guest custody after downgrade — src/agents/sandbox/registry.kernel.ts:156

Agent review details

Security

Needs attention: No supply-chain change was identified, but candidate-written guest custody is not qualified against older-binary final effects.

PR surface

PR surface statistics unavailable: the file list is incomplete.

Review metrics

Metric	Value	Why it matters
Production and test growth	production/tooling net +7,247; tests/helpers net +20,292, as reported in the PR body	The four stated authority and lifecycle boundaries explain substantial production growth, making upgrade proof consequential.
Persisted metadata	2 new JSON fields	Both foregroundRun and retirementPolicy require an existing-state and rollback compatibility assessment.

Stored data model

Persistent data-model change detected: unknown-truncated-pull-files. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #156269
Summary: This PR is the open implementation candidate for the linked guest-mode feature; two merged PRs provide overlapping groundwork rather than replacing its foreground behavior.

Members:

• canonical: [Feature]: Scoped guest model access and foreground-only work #156269 - The PR body explicitly identifies this open feature issue as its target.
• partial_overlap: feat: limit model use by operator role #156346 - Merged role model-policy groundwork covers one part of the requested capability.
• partial_overlap: fix: cancel Guest work when its original access is revoked #156106 - Merged guest revocation and sandbox cleanup groundwork supports, but does not supply, this foreground flow.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Mantis proof suggestion

Redacted web UI chat captures could independently show guest Stop, draft preservation, and the restart notice because the linked UI images could not be inspected. A maintainer can ask Mantis to capture proof by posting this exact PR comment:

@openclaw-mantis verify scoped guest Stop and restart in web UI chat; capture redacted evidence that the draft survives Stop and the interrupted turn shows one stopped-work notice without replay.

Merge-risk options

Maintainer options:

1. Qualify the upgrade boundary (recommended)
   Move the retirement read to worker ownership, qualify existing finite-role provider hooks, and prove or fence older-binary access before merge.
2. Accept a limited deployment
   Maintainers may document unsupported rollback and custom-provider refusal for a controlled rollout after the code finding is fixed.
3. Pause this branch
   Hold the PR if safe rollback and provider adoption cannot be established for the intended shared-Gateway users.

Technical review

Best possible solution:

Keep policy in the existing Gateway owner, move retirement reads to its worker, qualify affected provider hooks, and establish an explicit, proven rollback boundary before guest rollout.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR adds a guest mode. Source comparison shows current main lacks its foreground admission and restart records.

Is this the best way to solve the issue?

Unclear: reusing the existing role policy is sound, but the synchronous registry read, provider compatibility break, and rollback boundary prevent a best-solution verdict.

Full review comments:

• [P1] Qualify existing finite-role provider wrappers before rejecting them — src/plugins/provider-model-request-binding.ts:29-32
  The new declaration check rejects a present wrapper without resolveModelRequestBindingSupport. The bundled llama.cpp provider still registers both wrappers without that query, so a role already using modelPolicy with this route can lose access after upgrade. Qualify the route or obtain an explicit compatibility decision with an upgrade path. This is a late discovery on code unchanged since the prior reviewed head.
  Confidence: 0.87
  Late finding: first raised on code an earlier review cycle already covered.
• [P2] Move the retirement registry read to the SQLite worker — src/agents/sandbox/registry.ts:233-235
  The new retirement assertion synchronously rereads SQLite from Gateway sandbox and cleanup callers. Route this check through the database worker while retaining the generation check before the final effect.
  Confidence: 0.96

Overall correctness: patch is incorrect
Overall confidence: 0.88

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against c3daf0cddacd.

Labels

Label changes:

No label changes.

Label justifications:

• P2: This is a substantial optional guest capability with bounded user reach and material merge work.
• merge-risk: 🚨 compatibility: The new provider-hook declaration can refuse existing finite-role routes, and persisted records have an unqualified downgrade path.
• merge-risk: 🚨 security-boundary: Guest authority and sandbox custody cross persisted state, while older-binary rejection before final I/O remains unproven.
• merge-risk: 🚨 availability: The introduced synchronous SQLite read runs through Gateway sandbox and cleanup paths.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Authority-chain proof required: the PR reports real Linux Gateway/UI Stop and restart runs plus Docker and Podman final-effect observations on production paths unchanged since those runs. It does not show an older binary opening candidate-written foregroundRun and retirementPolicy state and rejecting stale guest authority before provider or sandbox I/O. Existing-state compatibility is therefore insufficient; four prepared UI images returned 404 and browser opening returned cache misses, which is a reviewer inspection limit rather than a separate contributor failure. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Security concerns:

• [medium] Qualify guest custody after downgrade — src/agents/sandbox/registry.kernel.ts:156
  The new retirement marker is persisted in registry JSON, while the pinned older reader's removal path has no corresponding check. The PR acknowledges that rollback does not establish equivalent enforcement; prove rejection before provider or sandbox I/O or constrain deployment accordingly.
  Confidence: 0.86

What I checked:

• Current-main boundary: Current main documents role modelPolicy, but the foreground admission and persisted foreground-run files added by this branch are absent there; the PR's central Stop and restart behavior remains unique. Public docs: docs/gateway/operator-scopes.md. (docs/gateway/operator-scopes.md:192, c3daf0cddacd)
• Prior finding remains: The introduced retirement guard synchronously reads the state database; Gateway sandbox and cleanup callers invoke it. The previous ClawSweeper review raised this same concern on the pinned head. (src/agents/sandbox/registry.ts:233, addc4ec21a4a)
• Provider compatibility trigger: A finite model request now requires an affirmative declaration for a present provider wrapper. (src/plugins/provider-model-request-binding.ts:29, addc4ec21a4a)
• Existing provider wrapper: The bundled llama.cpp provider registers two stream wrappers without the new support query; the same wrappers exist on current main. (extensions/llama-cpp/src/managed-provider.ts:152, addc4ec21a4a)
• Persisted state change: The branch writes foregroundRun to session records and retirementPolicy to sandbox registry JSON; the PR body explicitly leaves older-binary rollback unqualified. (src/agents/sandbox/registry.kernel.ts:156, addc4ec21a4a)
• Older-reader boundary: The pinned base's registry removal path has no retirementPolicy check, which is why a candidate-state downgrade needs final-effect qualification. (src/agents/sandbox/registry.kernel.ts:69, 0c7d77cd47ab)

Likely related people:

• shakkernerd: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Move the introduced synchronous registry reread to database worker ownership while preserving final-effect generation checks.
• Show that older-binary access to candidate-written guest state cannot reach provider or sandbox I/O without current authority.
• Qualify the bundled llama.cpp wrapper or obtain an explicit compatibility decision for its finite-role refusal.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (3 earlier review cycles)

• reviewed 2026-09-23T11:05:21.442Z sha b434df3 :: needs real behavior proof before merge. :: [P1] Reuse the landed role-model policy instead of adding a second ceiling
• reviewed 2026-09-24T01:30:34.807Z sha addc4ec :: needs real behavior proof before merge. :: [P2] Move the new registry reread off the Gateway thread
• reviewed 2026-09-24T02:42:08.181Z sha addc4ec :: needs real behavior proof before merge. :: [P2] Move the retirement registry read to the SQLite worker

[vincentkoc]

@clawsweeper re-review

Please review exact head addc4ec. The body now records the existing modelPolicy convergence, revision-bound native execution/cleanup evidence and the explicitly unqualified older-binary rollback boundary.

[github-actions]

⚠️ Security sensitive changes

This maintainer PR changes sensitive security components. This comment is informational because the PR author has repository Maintain or Admin access.

• Current SHA: addc4ec21a4a7226530e612b8f4881626e0920a1
• Maintainer: @vincentkoc
• Repository role: admin

These security sensitive changes were made:

• src/agents/admitted-run-operator-authority.ts: Controls credential persistence, secret resolution, or redaction. Check storage permissions, credential scope, and exposure in logs or responses.
• src/agents/bash-tools.exec-approval-output.ts: Controls sandbox containment or tool execution authority. Check filesystem and network isolation, approval scope, and command allowlists.
• src/agents/embedded-agent-runner/run/auth-plan.ts: Controls credential persistence, secret resolution, or redaction. Check storage permissions, credential scope, and exposure in logs or responses.
• src/agents/runtime-plan/resolve-auth.ts: Controls credential persistence, secret resolution, or redaction. Check storage permissions, credential scope, and exposure in logs or responses.
• src/agents/sandbox/backend.ts: Controls sandbox containment or tool execution authority. Check filesystem and network isolation, approval scope, and command allowlists.
• src/agents/sandbox/container-engine.ts: Controls sandbox containment or tool execution authority. Check filesystem and network isolation, approval scope, and command allowlists.
• src/agents/sandbox/context.ts: Controls sandbox containment or tool execution authority. Check filesystem and network isolation, approval scope, and command allowlists.
• src/agents/sandbox/docker-backend.ts: Controls sandbox containment or tool execution authority. Check filesystem and network isolation, approval scope, and command allowlists.
• src/agents/sandbox/docker-create-args.ts: Controls sandbox containment or tool execution authority. Check filesystem and network isolation, approval scope, and command allowlists.
• src/agents/sandbox/docker-native-custody.ts: Controls sandbox containment or tool execution authority. Check filesystem and network isolation, approval scope, and command allowlists.
• src/agents/sandbox/docker.ts: Controls sandbox containment or tool execution authority. Check filesystem and network isolation, approval scope, and command allowlists.
• src/agents/sandbox/local-workspace-quiescence.ts: Controls sandbox containment or tool execution authority. Check filesystem and network isolation, approval scope, and command allowlists.
• src/agents/sandbox/manage.ts: Controls sandbox containment or tool execution authority. Check filesystem and network isolation, approval scope, and command allowlists.
• src/agents/sandbox/native-exec-binding.ts: Controls sandbox containment or tool execution authority. Check filesystem and network isolation, approval scope, and command allowlists.
• src/agents/sandbox/podman-runtime.ts: Controls sandbox containment or tool execution authority. Check filesystem and network isolation, approval scope, and command allowlists.
• src/agents/sandbox/registry.kernel.ts: Controls sandbox containment or tool execution authority. Check filesystem and network isolation, approval scope, and command allowlists.
• src/agents/sandbox/registry.ts: Controls sandbox containment or tool execution authority. Check filesystem and network isolation, approval scope, and command allowlists.
• src/agents/sandbox/registry.types.ts: Controls sandbox containment or tool execution authority. Check filesystem and network isolation, approval scope, and command allowlists.
• src/agents/workspace-sandbox.ts: Controls sandbox containment or tool execution authority. Check filesystem and network isolation, approval scope, and command allowlists.
• src/gateway/operator-role-policy.ts: Controls Gateway authentication, pairing, or caller permissions. Check identity validation, scope checks, and revocation.
• src/gateway/operator-run-authority.ts: Controls Gateway authentication, pairing, or caller permissions. Check identity validation, scope checks, and revocation.
• src/gateway/server-model-catalog-auth.ts: Controls Gateway authentication, pairing, or caller permissions. Check identity validation, scope checks, and revocation.
• src/gateway/server/ws-connection/connect-hello.ts: Controls Gateway authentication, pairing, or caller permissions. Check identity validation, scope checks, and revocation.
• src/gateway/server/ws-connection/connect-model-catalog.ts: Controls Gateway authentication, pairing, or caller permissions. Check identity validation, scope checks, and revocation.
• src/gateway/session-model-authority.ts: Controls Gateway authentication, pairing, or caller permissions. Check identity validation, scope checks, and revocation.
• 4 additional sensitive files; see the workflow summary.

Carefully review these changes before merging.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35943441306
• Updated: 2026-09-24T01:33:35.982Z

[vincentkoc]

Superseded for replacement by small, independently reviewable PRs.