docs: propose credential lifecycle and GitHub App access

[freeqaz-openai]

What Problem This Solves

Enterprise Agents need repository access whose scope, approvals and cleanup survive turns and runtime replacement. Provider tokens alone cannot enforce an approved candidate, exact branch or original-work attribution.

Why This Change Was Made

Propose native Agent repository configuration and an Installation-selected CredentialGatewayDriver for mediation and credential lifecycle. Delivery starts with managed metadata, clone and fetch, then adds selected coding read workflows and exact-candidate Approve and publish. Any configured, authorized human may approve, including the requester; an Agent cannot. Independent-human approval and automatic authorization under explicit policy for bounded, allowlisted push/draft-PR operations are separate later modes. Broader durable Work and lifecycle controls follow the initial root work and subordinate helpers using the same scope.

User Impact

The proposed configuration and driver API are not implemented. The proposed GitHub profile keeps provider credentials outside Agent workloads and requires current online OCC authority for reads, writes and credential maintenance. Publication binds the candidate, refs, expected remote tip and PR metadata, preserving separate effect receipts and reconciling unknown outcomes without blind replay. Permission changes require fresh Pod/gVisor isolation; uncapped execution still uses finite leases.

This is a documentation proposal extending RFC 0027. It remains draft with a blank implementation issue pending acceptance.

Reading Guide

• Credential lifecycle and GitHub App access and detailed specification.
• Repository configuration and CredentialGatewayDriver.
• GitHub profile.
• Recovery and qualification.
• Series overview.
• Related drafts: #69, #70, #71.

Evidence

• Checked draft metadata, required sections, Markdown structure, links, anchors and whitespace; reran desktop/mobile rendering and independent cross-RFC review.
• Desktop preview uses a local Markdown render with GitHub-style CSS.
• Document checks only; provider, native runtime and deployment qualification require separate evidence.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge.

What this changes

This PR proposes managed GitHub repository access, protected credential lifecycle management, and staged human-approved publication for Enterprise Agents.

Example: An Agent has coding access to org/service and read access to org/library.

• Before: The accepted Enterprise RFC does not specify repository selection or exact-candidate publication.
• After: The proposal requires separate repository grants and human approval of the exact org/service candidate while denying publication to org/library.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Readable documentation with explicit implementation limits and no concrete findings; product acceptance remains unresolved.
Proof confidence	🐚 platinum hermit (4/6) ✨ media proof bonus	Sufficient (screenshot): The committed desktop preview directly shows the added RFC's readable documentation and diagram; runtime and GitHub-provider behavior are expressly future implementation claims.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Feature · Worth it: Needs a maintainer decision
User problem: Enterprise Agents need managed repository access whose permissions, publication approval, and cleanup remain attributable across turns and runtime replacement.
Reason: The proposal has clear potential value, but adds repository configuration and a credential Driver contract whose delivery scope has not been accepted.

Merge readiness

⛔ Blocked before merge - 1 item remains

Keep this PR open for RFC acceptance: it makes a distinct, coherent proposal absent from current main, and no concrete document defect was found.

Priority: P3
Reviewed head: 8c65dbb3d535d0805cd74cce5f6c368a82733106
Owner decision: Required. See Decision needed.

Decision needed

• Question: Should this RFC require protected execution origin from stage A and exact-candidate human approval in stage B, or be revised toward the smaller Enterprise MVP?
• Recommendation: Keep draft and align the MVP scope: Resolve the origin-protection and publication boundaries with the Enterprise area owner before recording RFC acceptance.
• Why: These are new configuration, Driver, and publication contracts; no recorded acceptance settles them, and the closed Enterprise proposal describes different MVP boundaries.

Before merge

• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

None.

Agent review details

How this fits together

The proposed credential gateway sits between Enterprise Agent Git clients and GitHub, consuming current OCC authorization and protected execution context before dispatching scoped requests with credentials held outside Agent execution.

flowchart LR
  Config[Administrator repository selection] --> OCC[OCC authorization]
  Agent[Agent Git client] --> Connector[Trusted execution connector]
  Connector --> Gateway[Proposed credential gateway]
  OCC --> Gateway
  Agent --> Publisher[Human approved publisher]
  Publisher --> Gateway
  Gateway --> GitHub[GitHub]

Loading

Technical review

Best possible solution:

Resolve the staged credential-access contract through RFC acceptance, then track implementation and runtime qualification separately.

Do we have a high-confidence way to reproduce the issue?

This is an explicitly unimplemented design proposal, so there is no reported runtime failure to reproduce.

Is this the best way to solve the issue?

The proposed ownership and qualification boundaries are coherent, but choosing their MVP scope requires an owner decision rather than a mechanical repair.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 967d9aac7472.

Security

None.

Evidence

What I checked:

• Distinct proposal absent from main: The pinned introduction diff adds documentation and diagrams only; current main contains the accepted Enterprise baseline but none of the proposed RFC 0034 files. The related proposals remain open. (rfcs/0034-github-app-credentials.md:15, 8c65dbb3d535)
• Acceptance remains an owner decision: The repository requires RFC discussion and acceptance before merging, followed by an implementation issue and accepted metadata. This proposal correctly remains draft with its issue blank; the inspected discussion and reviews record no acceptance. (README.md:78, 967d9aac7472)
• Feature-history routing: Path history, the introducing diff, and current-main blame identify kevinlin-openai as the author of the accepted credential boundary in merged RFC 0027: OpenClaw as the Open Enterprise Agent Platform #35; this establishes an area contributor, not maintainer authority. (rfcs/0027-openclaw-enterprise.md:355, af708f0ddb6f)
• Explicit dependency oracle: The series overview explicitly uses pinned Enterprise source to describe existing credential delivery and activation order, providing the affirmative dependency signal. The target contains no AGENTS.md or maintainer notes; the dependency's complete root AGENTS.md was read for the implementation comparison. (rfcs/0027/runtime-access-overview.md:16, 8c65dbb3d535)
• Pinned implementation comparison verified: The pinned controller commits successor selection, requests activation, and then requests predecessor retirement. Its credential reference separately confirms that dedicated Codex receives the account token and workspace ID while its gateway receives neither. (apps/controller/src/worker.ts:1010, 3eeacb85d9e8)
• Related work does not establish implementation or acceptance: The closed, unmerged docs: specify GitHub credentials, identity, Work, and runtime lifecycle openclaw-enterprise#172 proposes a smaller MVP with direct writes and deferred presenter-origin protection and candidate approval. The linked Retain validated Git snapshots independently of agent workspaces openclaw-enterprise#135, Add controller-owned GitHub read token issuance openclaw-enterprise#136, and Coordinate exact publication requests over retained Git snapshots openclaw-enterprise#143 are also closed without merging; they establish neither completion nor a same-repository replacement.

Likely related people:

• kevinlin-openai: Raw commit af708f0 adds rfcs/0027-openclaw-enterprise.md:355 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: af708f0ddb6f; files: rfcs/0027-openclaw-enterprise.md)

Review metrics

Metric	Value	Why it matters
Executable change surface	Production +0; tests +0; 13 added documentation and diagram files	The specification expands the proposed design without changing runtime behavior or persisted application state.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is a design proposal awaiting acceptance, with no shipped runtime regression introduced.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• proof: sufficient: Contributor real behavior proof is sufficient.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (19 earlier review cycles; latest 8 shown)

• reviewed 2026-09-09T21:43:36.560Z sha 7dea5a4 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-11T07:48:03.154Z sha 265cc4f :: blocked before merge. :: none
• reviewed 2026-09-11T19:11:16.301Z sha 0670aeb :: blocked before merge. :: none
• reviewed 2026-09-11T19:31:12.142Z sha 3d79901 :: blocked before merge. :: none
• reviewed 2026-09-14T21:59:39.919Z sha 3d79901 :: blocked before merge. :: none
• reviewed 2026-09-14T22:42:33.907Z sha 8c65dbb :: blocked before merge. :: none
• reviewed 2026-10-05T13:39:58.609Z sha 8c65dbb :: blocked before merge. :: none
• reviewed 2026-10-11T13:45:50.815Z sha 8c65dbb :: blocked before merge. :: none

Reviewed October 14, 2026, 7:28 AM ET / 11:28 UTC (Revision 20).