Verify the Agent’s model credential in First Agent Smoke

[freeqaz-openai]

First Agent Smoke checked that its model provider answered a fresh nonce, but the provider never checked the bearer credential. I reproduced a completed model turn over both HTTPS and WebSocket with the Authorization header absent, and again with an incorrect bearer. A green smoke could therefore miss a regression in credential delivery.

The smoke now gives each Agent a distinct, disposable credential and gives the stand-in provider only the corresponding SHA-256 digests. The provider checks the bearer before handling an HTTPS request or a WebSocket upgrade. Its successful-turn event identifies the matched test Agent, and the smoke requires that identity and the turn nonce. No production authentication changes; fixture users that do not configure this check retain their existing behavior.

Verified locally with the committed fixture, real TLS, HTTPS and WebSocket on isolated loopback:

• Missing or wrong bearer: both transports return 401, including the initial HTTPS credential check.
• Expected bearer: the initial model-less request gets the intended 400, and both transports complete a turn. A response attributed to another valid test Agent does not satisfy the smoke assertion.
• Malformed verifier configuration fails closed; the fixture events contain neither generated credentials nor their digests. Existing smoke and model-provider tests: 30 passed.

Hosted First Agent Smoke passed on this exact head. CI built the checkout images, installed OCE, and completed the credential-bound turns: embedded OpenClaw over HTTPS and dedicated Codex over WebSocket, including the turns after stop/start. Required CI also passed; it is a separate check. This proves delivery of the assigned synthetic bearer on those turns, not exclusive custody, real-provider authorization, or OpenShell qualification.

An independent source review found no blocking issue. The separate local automated review timed out without a report; that is unavailable evidence, not a passing review.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

The smoke verifies each Agent’s synthetic bearer credential and binds successful model turns to that Agent and its nonce.

Example: A Codex turn requests nonce OCE_SMOKE_123 without an Authorization header.

• Before: The provider could answer the nonce and let the smoke pass.
• After: The provider returns 401 before accepting the turn.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The focused patch appears correct; independent evidence of the changed end-to-end credential path is still limited.
Proof confidence	🦐 gold shrimp (3/6)	This collaborator-authored test repair is outside the ordinary contributor proof gate; its body reports local real-TLS fixture checks, while hosted Agent provisioning and credential-delivery verification remain in progress.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Test only · Worth it: Yes · Fix scope: Complete
User problem: A green First Agent Smoke could conceal missing or incorrect model credentials in deployed Agents.
Reason: The collaborator-authored direction improves an existing installation test with a focused fixture-only environment setting and no production contract change.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: it closes a real credential-delivery blind spot in First Agent Smoke, and source review found no blocking defect.

Priority: P2
Reviewed head: 041cabe2095ff9b303473aed51a9864658f29a0c

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: The hosted exact-head installation smoke has not yet completed, and no attached transcript demonstrates the reported credential-rejection regression comparison.

Agent review details

How this fits together

First Agent Smoke installs OCE on local Kubernetes, provisions Agents through existing workflows, and checks their model requests against a controlled TLS provider.

flowchart LR
  A[Smoke orchestrator] --> B[Agent provisioning]
  B --> C[Agent runtime]
  A --> D[Provider credential digests]
  C --> E[TLS provider fixture]
  D --> E
  E --> F[Caller and nonce assertion]

Loading

Technical review

Best possible solution:

Keep credential checking in the existing provider fixture and require the expected Agent identity alongside every asserted nonce.

Do we have a high-confidence way to reproduce the issue?

Current-main provider handlers do not inspect Authorization, and the smoke checks only the returned nonce; the PR additionally reports successful unauthorized turns over both transports.

Is this the best way to solve the issue?

The change extends the existing fixture and assertion owners, preserves unconfigured fixture behavior, and uses distinct credentials to detect cross-Agent substitution.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 5963327b74b6.

Provenance checked

• Smoke credential generation and nonce assertions keeps the original intent (2d312de: The original smoke used disposable placeholder credentials and provider nonce events to establish that deployed Agents completed actual model requests.)
• Shared HTTPS and WebSocket provider fixture keeps the original intent (573a314: The fixture supports controlled runtime startup and model-probe scenarios; credential enforcement remains optional so existing callers retain those scenarios.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Pinned diff, current-main behavior, history, and verification: The pinned diff adds credential verification before HTTPS handling and WebSocket upgrade, propagates the matched caller into successful-turn events, and requires caller plus nonce in the smoke. Base blobs confirm main accepts turns without checking credentials. The original smoke rationale in ci(first-agent): add a per-merge first agent smoke on local setup #899 establishes nonce-based model-turn verification; this change strengthens that contract. The full current PR body reports local TLS acceptance and rejection scenarios; comments contain no additional verification artifacts. CI Required and Image Model Probes pass, while the exact-head First Agent Smoke remains in progress at https://github.com/openclaw/openclaw-enterprise/actions/runs/39225791676/job/117971716318. Root policy was read completely; no nested AGENTS.md, maintainer notes directory, or pr-simplify skill was found. History inspection reached the documented missing-object boundary once; available history establishes the relevant ownership. The checkout remains clean. (scripts/ci/first-agent-smoke.mjs:691, 041cabe2095f)

Labels

Label changes:

No label changes.

Label justifications:

• P2: This improves credential-delivery regression detection in CI without changing production authentication.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Inspect the completed exact-head First Agent Smoke result for successful embedded and dedicated Agent turns.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 19, 2026, 5:04 AM ET / 09:04 UTC.