[freeqaz-openai]

A withdrawal can outlive the person who requested it. These PostgreSQL tests now bind a withdrawal to its agent and credential source once, then name the acting principal at each read or replay. The scenarios still show the work attempts, audit records, and expected outcomes in place. This changes test code only.

All 36 tests in the file passed before and after against disposable PostgreSQL. I also checked that the relevant tests still fail if a withdrawal is attributed to the wrong person or if the test reads the denied source while expecting the allowed one to be revoked.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[freeqaz-openai]

@clawsweeper review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/39061076562
• Updated: 2026-10-17T19:07:36.513Z

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR binds credential-withdrawal test reads and replays to the Agent and source originally requested.

Example: An operator loses access after requesting a credential withdrawal.

• Before: Each scenario separately constructs and reuses the withdrawal request for subsequent reads and authorized replays.
• After: A source-bound handle retains the request target while each read or replay explicitly supplies its acting principal.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and source-consistent; validation rests on reported PostgreSQL runs and an integration job still running at inspection.
Proof confidence	🦐 gold shrimp (3/6)	This collaborator-authored test-only refactor changes no shipped behavior; the reported PostgreSQL runs support scenario preservation but are not live gateway proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Test only · Worth it: Yes · Fix scope: Complete
User problem: Repeated withdrawal request plumbing makes source identity and acting-principal changes harder to follow in lifecycle tests.
Reason: The collaborator-authored change modestly simplifies existing scenarios without introducing a platform feature, contract change, or competing test oracle.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: the focused test refactor preserves withdrawal targets, explicit principals, and existing assertions, with no actionable defect found.

Priority: P3
Reviewed head: a5719b2e47951f3f95eb29ff6cc42c7acc5d8d2d

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: The supplied validation concerns real PostgreSQL with controller/worker execution and Compute doubles; it does not demonstrate a live gateway withdrawal.

Agent review details

How this fits together

These PostgreSQL integration tests call OCC withdrawal APIs and run the controller worker against persisted work and audit records, using Compute doubles to simulate gateway outcomes.

flowchart TB
  A[Test scenario] --> B[Source-bound withdrawal handle]
  B --> C[OCC controller]
  C --> D[PostgreSQL state and work]
  D --> E[Controller worker]
  E --> F[Compute double]
  E --> G[Persisted outcomes and audit]

Loading

Technical review

Best possible solution:

Retain the source-bound helper and explicit per-call principals with the existing integration assertions.

Do we have a high-confidence way to reproduce the issue?

This PR refactors existing tests rather than repairing a reported product failure; no target code was executed during this read-only review.

Is this the best way to solve the issue?

The helper is appropriately local, preserves controller-owned revision selection, and keeps expected outcomes independent of request construction.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 3bdfcb10fe86.

Provenance checked

• Credential withdrawal scenario request plumbing keeps the original intent (test(worker): harden the convergence deadline tests and split the revision file #2298: That PR moved credential-source cases and their helpers unchanged into a dedicated file to reduce the revision suite's duration; earlier history also records shared withdrawal helpers.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Introduced change: The pinned diff changes only the integration test file; the helper captures the original target and forwards explicit principals to the existing controller methods. (tests/integration/postgres-worker-agent-revision-credential-sources.test.mjs:1427, a5719b2e4795)
• Independent assertions retained: The offboarding scenario still verifies the original requester, denial before gateway calls, authorized replay takeover, and successful audit attribution. (tests/integration/postgres-worker-agent-revision-credential-sources.test.mjs:1933, a5719b2e4795)
• Current production contract: OCC authorizes withdrawal and replay using the supplied principal and reads status using the Agent/source target; revision selection remains owned by OCC rather than the test helper. (packages/occ/src/index.ts:7436, 3bdfcb10fe86)
• Worker authorization boundary: The worker authorizes each withdrawal's requestedBy before including its source in Compute withdrawal calls; this production path is unchanged. (apps/controller/src/worker.ts:2795, 3bdfcb10fe86)
• Scenario provenance: test(worker): harden the convergence deadline tests and split the revision file #2298 explains that credential-source scenarios and helpers moved unchanged into this file; the current refactor retains their retry, replay, denial, and audit expectations. (tests/integration/postgres-worker-agent-revision-credential-sources.test.mjs, f890b9d48ddb)
• Validation and discussion: The author reports all 36 cases passing before and after with mutation checks; the complete discussion adds no further proof. Static checks succeeded while PostgreSQL Application remained in progress at inspection. (a5719b2e4795)

Likely related people:

• Free Wortley: Raw commit f890b9d adds tests/integration/postgres-worker-agent-revision-credential-sources.test.mjs:1815 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: f890b9d48ddb; files: tests/integration/postgres-worker-agent-revision-credential-sources.test.mjs)

Review metrics

Metric	Value	Why it matters
Change scope	Production +0/-0; tests +121/-142, net -21 lines	The local helper replaces repeated request plumbing without expanding production code.

Labels

Label changes:

• add P3: This is behavior-preserving test maintenance with no demonstrated user-facing regression.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: This is behavior-preserving test maintenance with no demonstrated user-facing regression.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 17, 2026, 3:06 PM ET / 19:06 UTC.