[miguelbranco80]

What Problem This Solves

The input-safety scan blocked review of OCE's Gateway outbound RFC and implementation on a synthetic model-endpoint rejection URL inherited from upstream. The two findings in the blocked run are the same fixture in the old base and head of tests/integration/profile-renderer.test.mjs.

User Impact

Permit that review input only when the native URI finding matches the inspected fixture and one of three exact complete-source hashes. The updated OCE head constructs the URL with its existing runtime helper, but the review still includes the old literal in its base and deletion patch.

This is a proposed fixture qualification for maintainer review. It does not release the live scanner hold, request another review, change queue policy, or disable scanning.

Why This Change Was Made

Reuse the existing exact-attribution mechanism and its whole-blob pinning, following the historical OCE fixture approach in #1746. The exception binds the native detector type/name, PLAIN decoder, Raw and RawV2 digests, full source-line digest, exact path, regular-file mode and whole-source hashes. Other copies, verified findings and unreviewed complete blobs remain refused.

The three source pins correspond to OCE's original base d3ccc54781d0d50b40e9aeb814f0573d38c0a585, original head 792afad4f9e8bd4323fc197a102ebde7961484c9, and refreshed base 5f494a0fdf8f36f5b4cdf0a2886987ca49a5248c. No future head is qualified by path alone.

Evidence

Reviewed source: dcb3b26356ff92a15b7fa583963b9e688dc7a184, based on b79b76c.

• Complete fixture-policy suite: 489 passed, zero failures or skips (node --test test/agent-input-scan-fixtures.test.ts).
• The new unreviewed-copy regression was run against the unchanged baseline policy first, then the candidate. It distinguishes an unknown literal from the candidate's exact-source refusal.
• Focused strict TypeScript check of the policy and imported scanner owners passed with the existing compiler and Node types. Formatting, focused correctness lint, changelog validation and whitespace checks passed.
• Canonical isolated Codex review with GPT-6 Astra covered the working diff and then the committed branch, with full classifier and patch-witness context: no actionable P0–P2 findings. The reviewer did not execute tests or independently inspect the historical OCE blob contents; the native proof below supplies that separate check.

Real Behavior Proof

Claim: the production native input-admission path accepts the exact inspected historical fixture while refusing an unreviewed complete-source copy.

Surface/environment: scanAgentInput and the unchanged managed scanner/trust checks, macOS arm64, Node 24.3.0, checksum-qualified TruffleHog 3.97.4. Scanner modules were transpiled with an existing compiler; no dependencies were installed. All Git mutations were confined to disposable local clones; no hosted review, apply, dispatch or hold-release command ran.

Invocation: the production scanAgentInput export, with a neutral read-only prompt, timeoutMs: 120000 and source: { kind: "committed", baseSha, headSha }, against the isolated checkout at each selected head.

Observed results:

1. Original OCE range d3ccc54781d0d50b40e9aeb814f0573d38c0a585..792afad4f9e8bd4323fc197a102ebde7961484c9: baseline refuses with literal_not_reviewed, two unverified URI findings; candidate admits and classifies the exact base and head blobs.
2. Negative control: append an unrelated source comment to that head and commit it locally. Candidate refuses with source_not_reviewed, despite the unchanged synthetic URL, line and path.
3. Updated OCE range 5f494a0fdf8f36f5b4cdf0a2886987ca49a5248c..dd9701a8d54a447be4c9f363257719f2244f6df2: candidate admits, classifying the retained base blob and its deletion-patch witness. The cleaned current head contains no complete credential-bearing URL literal for this case.

Retained diagnostics contain source/blob identities, hashes, scanner coordinates, roles and refusal classifications; matched values are not reproduced here.

Limits/holds: this proves local native input admission, not a completed hosted model review or operational release of OCE's scanner hold. Maintainer fixture qualification and a later authorized re-review remain necessary. Full pnpm run check could not start because this fresh checkout has neither the pinned pnpm 12.4.1 runtime nor its dependency graph prepared; full repository build/lint/coverage and hosted CI remain holds. The focused checks above do not replace them. Keep this PR draft; no merge or force push is authorized.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

Qualifies one synthetic OCE model-endpoint rejection fixture only in three exact historical source blobs.

Example: Reviewing openclaw/openclaw-enterprise#2518 includes its historical profile-renderer rejection fixture.

• Before: The native URI finding stops input admission as literal_not_reviewed.
• After: The exact historical blobs qualify, while a copy with an unrelated source change remains source_not_reviewed.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The focused implementation is sound; the required inspectable runtime evidence remains outstanding.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: A synthetic rejection fixture prevents ClawSweeper from reviewing openclaw/openclaw-enterprise#2518.
Reason: The change restores a specific legitimate workflow through an established, tightly bounded qualification mechanism.

Merge readiness

⛔ Blocked before merge - 1 item remains

Keep open: this PR addresses a concrete review-admission blocker absent from current main, using a narrow existing mechanism; no introduced code defect was found.

Priority: P2
Reviewed head: dcb3b26356ff92a15b7fa583963b9e688dc7a184

Before merge

• Add real behavior proof - The body reports scanAgentInput running with checksum-qualified TruffleHog 3.97.4 on macOS arm64 for head dcb3b26, including positive admission and mutated-copy refusal, but the retained diagnostics are neither included nor linked. Attach those existing redacted logs or terminal output showing source identities, classifications, and results; redact credentials, IPs, and non-public endpoints. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.

Findings

None.

Tests

• Missing end-to-end proof: Share the retained native admission traces for the historical and refreshed ranges plus the unreviewed-copy refusal; the described scenarios cover the changed behavior.

Agent review details

How this fits together

ClawSweeper scans committed sources and patches before launching a reviewer; host-owned fixture attribution either admits inspected synthetic findings or refuses the input.

flowchart TD
  A[Committed sources and patch] --> B[Native secret scanner]
  B --> C[Exact finding identity]
  C --> D[Whole source hash]
  D --> E[Line path mode and role checks]
  E --> F[Admit review input]
  D --> G[Refuse unknown input]
  E --> G

Loading

Technical review

Best possible solution:

Retain this exact historical qualification in the existing classifier, with all native scanning and attribution checks enforced.

Do we have a high-confidence way to reproduce the issue?

Current main lacks the fixture attribution, and independently inspected historical blobs contain the reported synthetic rejection URL; no target code was executed during this read-only review.

Is this the best way to solve the issue?

The patch uses the smallest existing admission mechanism and preserves the whole-blob restriction established by #1746.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against b79b76cc0cc4.

Provenance checked

• Historical OCE fixture qualification keeps the original intent (f7c8c55: Preserve admission of known historical OCE source blobs while refusing arbitrary future copies.)
• Exact native attribution validation keeps the original intent (c338967: Bind synthetic findings to exact detector, decoder, value, source-line, path, mode, and committed attribution.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Exact introduced change: The pinned diff adds three complete-source hashes, one URI attribution, its validator path, a refusal regression, and one changelog fragment; current main lacks this attribution. (src/agent-input-scan-fixtures.ts:284, dcb3b26356ff)
• Admission boundaries remain enforced: Whole-source filtering precedes native metadata, complete-line, occurrence, path, mode, and committed-role checks; patch witnesses recursively reuse blob qualification, and refused scans throw before reviewer launch. (src/agent-input-scan-fixtures.ts:1132, dcb3b26356ff)
• Original base source verified: Read-only content hashing yields 74221411b5fa46a5be9c593dc5572eabe6983a9667830faaa0b00574631ca208; the credential-shaped URL is a synthetic user-info rejection case. This source is an affirmative dependency because the PR's admission policy and proof explicitly depend on its exact bytes. (tests/integration/profile-renderer.test.mjs:2741, d3ccc54781d0)
• Original head source verified: Read-only content hashing yields 754f7089704228fcdfa8b3586752c4faecba734e45b8a1a65d4db5fe88445f62, matching the second pin and the same synthetic rejection line. (tests/integration/profile-renderer.test.mjs:2640, 792afad4f9e8)
• Refreshed base source verified: Read-only content hashing yields d66caf0df7a586321da4c1077bbc3a51aa118f7fde343010fc1dbec28cecc8a8, matching the third pin. (tests/integration/profile-renderer.test.mjs:2741, 5f494a0fdf8f)
• Current fixture construction respects dependency policy: The complete dependency AGENTS.md was read; its relevant rule requires runtime construction of synthetic credential URLs, which the refreshed head uses. Historical base and deletion witnesses still require scanner attribution. (tests/integration/profile-renderer.test.mjs:2640, dd9701a8d54a)

Likely related people:

• Dallin Romney: Raw commit f7c8c55 adds src/agent-input-scan-fixtures.ts:280 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: f7c8c55f33a2; files: src/agent-input-scan-fixtures.ts)
• Peter Steinberger: Raw commit 96aa78a adds src/agent-input-scan-fixtures.ts:254 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 96aa78ac663f; files: src/agent-input-scan-fixtures.ts)
• Vincent Koc: Raw commit c338967 adds src/agent-input-scan-fixtures.ts:174 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: c33896727985; files: src/agent-input-scan-fixtures.ts)

Review metrics

Metric	Value	Why it matters
Production and regression delta	production +12/-1; tests +22/-0	Growth is limited to exact policy data, validator support, and a distinct unreviewed-copy refusal regression.

Labels

Label changes:

• add P2: A bounded synthetic-fixture false positive blocks a specific review workflow without affecting general runtime availability.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P2: A bounded synthetic-fixture false positive blocks a specific review workflow without affecting general runtime availability.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 19, 2026, 5:48 PM ET / 21:48 UTC.