fix: complete the Homebrew formula handoff

[steipete]

Install goplaces through brew install openclaw/tap/goplaces instead of the retired Cask. Update the README, website, migration instructions, and Unreleased changelog, and pin tap commit 104616d9828cf28202bccff19c0738f179c2a3f8 from openclaw/homebrew-tap#56 and openclaw/homebrew-tap#57.

The handoff accepts URL-derived versions and one direct-child provenance-only commit for an already-current Formula. Ruby tokenization rejects noncanonical or duplicate version declarations without evaluating the Formula. Exact release URLs, all four hashes, commit parent, provenance trailers, and unrelated-file rejection remain enforced. GoReleaser already contains no Cask generator; its guard remains in place.

Document the equivalent recovery handoff for published v0.4.11 after release closeout advanced main. It preserves the original frozen records and native release proofs, separately pins current protected source main, verifies unchanged verifier policy and two independent asset copies, then binds one exact tap workflow run, commit, and installed binary. This does not rebuild, republish, or move the release tag.

Validation: independent P0–P2 review returned scoped-clean for the implementation and final pin. The full local release-contract suite, focused Formula/version/provenance regressions, ShellCheck, documentation metadata tests, and final CI passed: https://github.com/openclaw/goplaces/actions/runs/34862450343. The tap's strict online audit, branch install, package test, exact binary equality, Developer ID requirements, and online notarization checks passed for 0.4.11; its final shared-updater tests and macOS ARM64/Intel/Linux install checks also passed.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 14, 2026, 11:34 AM ET / 15:34 UTC (Revision 2).

ClawSweeper review

What this changes

Switch Homebrew installation guidance to the Formula, update the trusted tap revision, accept URL-derived versions and provenance-only commits, and document release recovery.

Merge readiness

✅ Ready for maintainer review

The prior updater incompatibility is resolved by the corrected, merged tap pin. No remaining introduced defect was found; this PR remains necessary because current main still uses the blocked handoff contract.

Priority: P2
Reviewed head: 8520aedb65d2ae79e12215effad2bc205a2575ec

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused repair with the previous blocker resolved and no remaining actionable findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: The collaborator-authored PR is exempt from ordinary contributor proof. The linked merged tap migration reports real Formula installation and native verification; the corrected renderer has source and regression evidence, while the serialized producer handoff is explicitly scheduled after this PR.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The collaborator-authored PR is exempt from ordinary contributor proof. The linked merged tap migration reports real Formula installation and native verification; the corrected renderer has source and regression evidence, while the serialized producer handoff is explicitly scheduled after this PR.
Evidence reviewed	8 items	Current main still needs this change: The fetched main revision retains tap base 45b93a0b3de27e46b636a0cef819fb1ecef25bcd and requires exactly one explicit version declaration. The new tap Formula instead derives its version from release URLs. Current-main contents were inspected through GitHub's contents API. Introduced validation remains bounded: The complete local introduced diff adds Ruby tokenization without evaluating Formula code and permits an empty-tree provenance commit. Exact parent, commit message, request identity, four URL/hash pairs, and unrelated-file rejection remain enforced. Added tests cover invalid versions and malformed or unrelated commit comparisons. Dependency contract and security boundary: The producer explicitly dispatches openclaw/homebrew-tap's updater, establishing the dependency boundary. Preflight requires protected main to equal the pinned commit; result validation limits changes to the Formula, and installation rechecks the release and tap identities before execution.
Findings	None	None.
Security	None	None.

How this fits together

The release producer verifies published goplaces binaries and passes their hashes to the Homebrew tap updater. It then checks the resulting Formula commit and installed binary before recording completion.

flowchart TD
  A[Published release assets] --> B[Verify identities and hashes]
  B --> C[Check pinned tap contract]
  C --> D[Dispatch Formula updater]
  D --> E[Validate commit and Formula]
  E --> F[Verify installed binary]
  F --> G[Record release completion]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	Production +38/-11; tests +64/-11	Production growth implements the version parser and bounded commit validation, with focused negative-case coverage.

Technical review

Best possible solution:

Use the corrected Formula contract while preserving exact release identities, serialized dispatch, and installed-binary verification.

Do we have a high-confidence way to reproduce the issue?

Yes, from source: current main pins the blocked tap contract and rejects the Formula's absent explicit version. No release operation was executed during this review.

Is this the best way to solve the issue?

Yes. The corrected tap pin and narrow validator changes reconcile the existing producer with the merged Formula contract without adding a competing release path.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 727965013a90.

Labels

Label changes:

• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The collaborator-authored PR is exempt from ordinary contributor proof. The linked merged tap migration reports real Formula installation and native verification; the corrected renderer has source and regression evidence, while the serialized producer handoff is explicitly scheduled after this PR.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
• remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.
• remove merge-risk: 🚨 automation: Current PR review selected no merge-risk labels.

Label justifications:

• P2: This is a bounded repair to Homebrew release handoff and installation guidance.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The collaborator-authored PR is exempt from ordinary contributor proof. The linked merged tap migration reports real Formula installation and native verification; the corrected renderer has source and regression evidence, while the serialized producer handoff is explicitly scheduled after this PR.

Evidence

What I checked:

• Current main still needs this change: The fetched main revision retains tap base 45b93a0b3de27e46b636a0cef819fb1ecef25bcd and requires exactly one explicit version declaration. The new tap Formula instead derives its version from release URLs. Current-main contents were inspected through GitHub's contents API. (scripts/release-local:16, 727965013a90)
• Introduced validation remains bounded: The complete local introduced diff adds Ruby tokenization without evaluating Formula code and permits an empty-tree provenance commit. Exact parent, commit message, request identity, four URL/hash pairs, and unrelated-file rejection remain enforced. Added tests cover invalid versions and malformed or unrelated commit comparisons. (scripts/release-local:2774, 8520aedb65d2)
• Dependency contract and security boundary: The producer explicitly dispatches openclaw/homebrew-tap's updater, establishing the dependency boundary. Preflight requires protected main to equal the pinned commit; result validation limits changes to the Formula, and installation rechecks the release and tap identities before execution. (scripts/release-local:2431, 8520aedb65d2)
• Prior finding resolved: GitHub confirms fix: keep verified formula release URLs literal homebrew-tap#57 merged at the exact newly pinned SHA. Its verified renderer now uses literal target URLs; inspected regression coverage checks version changes, absent explicit versions, and idempotence. The PR also reports that rendering the seeded goplaces Formula reproduces its bytes exactly, addressing the prior rank-up request alongside the version-change coverage. (.github/scripts/formula_text.py:507, 104616d9828c)
• Published Formula and installation evidence: The merged migration at fix: migrate goplaces to a binary formula homebrew-tap#56 reports successful online audit, installation, package test, release-member byte equality, signing/notarization verification, and quarantine preservation. The inspected pinned Formula uses four literal release URLs and installs the supplied executable without rebuilding. These observations establish Formula installation coverage, not completion of the later serialized handoff. (Formula/goplaces.rb:1, 104616d9828c)
• Recovery scope is explicit: Recovery instructions retain frozen release records, independently bind current protected main to the original release proof, require unchanged verification policy, and prohibit republishing or moving the tag. They explicitly acknowledge that the existing producer command does not perform this post-closeout recovery. (docs/releasing-homebrew.md:54, 8520aedb65d2)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)
• openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-14T15:22:20.061Z sha e37ea6d :: blocked before merge. :: [P2] [P2] Pin an updater that preserves the producer's concrete URLs