[kevinlin-openai]

Driver startup settings and Agent network policies now share a typed schema and validation contract. Composition registers scoped contributions, and authorized discovery plus contextual preview drive the console through existing resource-owner actions. SandboxPolicy retains persistence, revision snapshots, and separate save/apply operations.

• Implements RFC-0022 and tracks delivery in TASK-0046.
• Updates bundled and package Driver callers together, rejects invalid schemas/results before construction, and preserves bounded field diagnostics.
• Keeps Installation startup values operator-managed. Ceiling discovery remains deferred; current ceiling, IAM, version, and worker checks remain enforced.
• Adds Installation schema inspection and dynamic Agent forms, including JSON fallback, stale-preview guards, and conflict draft retention.

Read-only Installation Driver schema inspection. Simulated Storybook capture at 01ee10b27.

Verification

Tested implementation: 4d57c6eda955a37643cb0d8e9818f09994b29b1f on Linux amd64 with Node 24.22.0. Subsequent commits update the delivery record, isolated Storybook fixture loading, and startup validation described below. The Agent network-policy lifecycle implementation is unchanged.

Scope	Result
Startup and package registration	87 passed, no skips
PostgreSQL policy routes and recovery	3 passed, no skips
Real HTTP browser policy workflows	4 passed, no skips
Selected Driver checks	201 passed; previously optional native initializer subsequently passed in a 3-check focused run
Compute/profile/QA regressions	465 passed; all 12 previously skipped Helm cases subsequently passed
Repository credential boundary	93 passed, no skips
Real Kubernetes API/worker, provisioning, and Driver fixtures	4 passed, no skips
Startup CLI and public-read profile	1 and 2 passed, no skips
Go client package	Compiled; package has no test files

Lint, TypeScript, formatting, workspace boundaries, generated OpenAPI, documentation/link/length checks, and CI selection audit passed. Both affected flow documents passed their structural checks. The longer Driver selection reference, controller reference, and Driver-loading flow each retain one coherent contract or execution path and remain below the hard word limit.

The focused real network-policy scenario passed: 1 runtime test; 2 matrix checks; 0 failures and 0 skips, including cleanup hooks. The real Agent reached the Installation-default control (8082), was denied the independently reachable target (8083), and reached that target only after discovery/preview/save/apply. A second Agent remained denied. Removing the grant restored denial while preserving default access. Provider decisions corroborated the exact executable, port, and DNS mapping. Permission revocation prevented native writes; an interrupted native write recovered without duplication; admitted revision snapshots stayed unchanged.

The run used gpt-6-astra and the pinned real runtime image digest sha256:3fa77ac008e4bba15b393d4723aa82d578e9defd133162dd7b3bc8b47f8aa963. With the prepared private environment and authorized token file supplied securely:

OCC_TEST_QA_MATRIX=1 OCC_TEST_QA_INSTALLATION=kubernetes \
OCC_TEST_QA_PRESET=Codex OCC_TEST_QA_SCENARIOS=sandbox-policy \
  node --test tests/integration/qa-matrix-real.test.mjs

Owned clusters, databases, and the private credential copy were removed; evidence remains outside the repository. The broader OpenShell suite separately failed on a public TLS control and on a credential refresh closing the model workspace connection; those failures are not policy-enforcement evidence. The focused scenario uses the same real runtime and production API/worker, deterministic owned endpoints, and every requested policy lifecycle assertion. Existing broader coverage remains intact.

Scoped PR fixes

Prior fix head: e7e5f3321cb0a8471d74964eba56ddd069a4e4c5. A history-preserving merge (422ac20ce) brings in main at 92ee88391; the specification index retains main’s RFC-0021 wording and this branch’s RFC-0022 delivery status, with corrected row totals. The follow-up preserves both reserved Gateway-port refusals and reports their exact diagnostics at /network/gatewayPort. Local Setup consumes canonical validation before provisioning. Startup retains safe field diagnostics for storage classes, ranges, hostnames, network peers, CIDRs, images, and Secret authentication. Ceiling diagnostics identify /sandboxNetworkPolicyCeiling in Installation input and /grants in the occdev file; Agent policy diagnostics retain /additions. Ceiling contribution/discovery remains deferred.

Execution-cluster trust parsing scans forward through at most 65,536 characters and validates each X.509 certificate. The two polynomial-regex alerts are fixed. Updated fixtures register the actual OpenShell definition, omit disabled optional configuration, and assert precise structural or semantic diagnostics.

Before merging the base branch, targeted local checks passed: Go policy tests (2 top-level tests, including 10 invalid-input cases), SSH startup (3), certificate conformance (2 including its nested case), Helm packaging (2), API/worker diagnostics (1 covering both processes), and profile fixtures (2), with no skips. Typecheck, lint, formatting, workspace, documentation/link/length, and flow checks passed. The certificate regression failed against the previous implementation and passed after the fix.

The history-preserving merge resolved three documentation conflicts; API references were regenerated. Main's dependency updates differ from the installed local graph, which was not reconciled. Subsequent edits passed syntax/workspace checks and the repository push hook; current-graph execution is through hosted CI. The ceiling's process assertions passed in Conformance 2 and its occdev regression passed after quoting the malformed YAML hostname. The exact pre-fix comparison for that ceiling regression was not run locally.

At the preceding fix head 23613a95c, CI run 39346723551 finished with 26 passed jobs, including Static Checks and both conformance lanes. Images and Packaging failed only the reserved-port Helm parity assertion; production-image-startup.test.mjs passed in that job. CI Required reflected that leaf failure. Head e7e5f3321 fixed the parity diagnostic and retained the allowed-port controls; the parent monitor confirmed complete green CI (28 passed, 0 failed) at that head.

CodeQL reported zero results in both analyses at 23613a95c. All three addressed review threads were resolved and re-queried. Local merge checks passed: specification/local-link validation, Markdown length, workspace boundaries, JavaScript/TypeScript syntax, and git diff --check. The installed dependency graph still differs from main; it was not reconciled, and no runtime tests were run for the index-only conflict resolution. The reserved-port regression was included in that green CI result.

The old input-safety hold reported two unverified URI-detector findings (rule 17) in tests/integration/profile-renderer.test.mjs. The complete synthetic URL literals predated this PR but occurred in a touched file; both now use the existing fixture helper. No scanner bypass or credential rotation was performed. A later PR-specific ClawSweeper workflow completed successfully. This does not claim independent review approval for the current head.

Freeqaz review fixes

Earlier review batch head: df244b6bd678acad513a02b5eb5d69e13f2d68dc; review-fix commit: b8ccff2eb43ab1e66013ebac6297f275b473b339. This batch addresses the review of e7e5f3321.

Finding	Disposition
1. Package validation compatibility	Clarified the supported current contract: validators return typed results; undefined/throw is not success, unsupported schema dialects/formats/references fail explicitly. No compatibility layer or migration guide: repository policy requires one canonical preproduction implementation and the user explicitly prohibited those additions.
2. Hook/preflight diagnostics	Helm check-installation and upgrade preflight use the shared bounded, sanitized field formatter. Relative Compute kubeconfig paths now have a typed field diagnostic. Added exact process, container-hook, and upgrade-path assertions.
3. Startup flow	Replaced the stale storage-class error code with the current typed code and field diagnostics in the owning flow.
4. Ceiling cause and CLI output	Controller-owned ceiling/capability refusals retain their precise cause. CLI output includes bounded, JSON-escaped declared detail fields. Save/apply/deploy regressions assert exact cause, paths, codes, and unchanged policy/revision/job state.
5. Execution-cluster locations	Synthesized overridden authentication, DNS, and harness-routing failures point to their actual executionCluster inputs. Inherited control-plane fields keep their original paths.
6. Broad assertion bypasses	Removed generic ConfigurationValidationError acceptance and fallback assertions in affected startup tests. Assertions now specify exact intended details; unchanged composition errors retain explicit expectations. Existing OpenShell constraints produce precise schema diagnostics.
7. Certificate size limit	Documented the supported 65,536-character cap and certificate semantics in the current reference. No migration documentation or compatibility behavior was added, for the same explicit policy reason as finding 1.
8. Policy refresh race	Separate read sequencing prevents stale responses from replacing the newest read and re-arms pending polling after a superseded response. Added an overlapping-read HTTP workflow regression and matching Storybook scenario.

Registry restoration and deferred ceiling contribution/discovery remain the user's accepted design decisions. Existing ceiling enforcement remains in place.

Executed locally for this batch: four focused Go CLI tests passed (go test ./internal/occcli -run 'Test(PolicyUpdatePrintsConfigurationDetails|APIError|Retry|Refusal)' -count=1 -v, using the existing offline module/cache setup). The CLI diagnostic regression failed before the formatter fix and passed after it. The rebuilt actual-console Storybook race walkthrough failed against the old module (expected saved v3, observed v2) and passed against this committed source (v3 retained; pending polling reached simulated confirmation). Storybook build, documentation checks (263 pages / 4,222 links), specification links, Markdown length, three affected flow checks, workspace boundary, suite-selection audit, syntax checks, and diff whitespace checks passed. Suite-selection and syntax checks are not integration execution proof.

Pending matching-graph CI: configuration startup (including real Helm-hook processes), sandbox/plugin startup, Kubernetes preflight, production image startup and upgrade-hook execution, PostgreSQL policy failure paths, and the real-HTTP browser regression were not executed locally for this batch. The root installed graph differs from merged main; dependencies were not reconciled. No local full lint/typecheck result is claimed for this batch. The prior real Agent enforcement proof remains attributed to 4d57c6eda; it was not rerun for these diagnostics and console-ordering fixes.

Fresh simulated UI evidence was captured from the source committed as b8ccff2eb on the headless Linux DevBox. Story: Pages/Agent detail → ConfigurationRefreshRace (pages-agent-detail--configuration-refresh-race). Inspected local captures, outside the checkout:

• /tmp/oce-rfc0022-review-ui/after-refresh.png
• /tmp/oce-rfc0022-review-ui/after-pending.png
• /tmp/oce-rfc0022-review-ui/after-confirmed.png
• /tmp/oce-rfc0022-review-ui/page@21d80676859289d07ccb7824c6ded835.webm (9.84 seconds; decoded and inspected)

These local paths are handoff locations, not reviewer-accessible native GitHub attachments. Upload remains blocked and is still a merge gate. The Storybook result proves simulated UI ordering/polling only; it does not establish backend persistence or runtime enforcement. The canonical reviewer HTTP 401 remains unresolved, with no retry or approval claimed. The parent continues CI monitoring; no merge is authorized.

After publishing the review batch, GitHub reported a new conflict with main. History-preserving merge df244b6bd integrates main at 14a04fbb6. Resolution keeps the refresh sequence/polling fix together with main's first-policy-read completion and 403 handling, preserves both Storybook scenarios, and retains both flow changelog entries. The merged Storybook build and focused race walkthrough passed again; syntax, workspace, spec links, Markdown length, and the affected flow validator passed. Startup/Helm and other root execution listed above still await matching-graph CI.

Final post-merge simulated UI captures use source committed as df244b6bd, with the same ConfigurationRefreshRace story:

• /tmp/oce-rfc0022-review-ui-merge/after-refresh.png
• /tmp/oce-rfc0022-review-ui-merge/after-pending.png
• /tmp/oce-rfc0022-review-ui-merge/after-confirmed.png
• /tmp/oce-rfc0022-review-ui-merge/page@46618cc0fe8ea5c03a85e88e67e052d7.webm (9.92 seconds; decoded final frame inspected)

Earlier captures remain preserved. These are local handoff paths, not native GitHub attachments; the upload gate remains unresolved.

Current CI follow-up

Head 3078c39d980c402e4731bedbaebca7ad8a844db0 addresses the follow-up review and inspected leaf failures from CI 39357356417:

• Policy denials now starts the existing policy-owner read even without a discovery descriptor. Unsupported capability is displayed once; policy/suggestion permission refusals leave independent log reads available. No IAM or mutation check is bypassed.
• Shared validation suppresses a false-subschema diagnostic only when its owning additionalProperties refusal is also present. Root false schemas, false array items, and a property named additionalProperties remain rejected. Existing exact startup assertions remain intact.
• Compute semantic checks retain static diagnostic messages and paths for authentication, resources, peers/proxies, routing, credentials, runtime settings, and execution-cluster inputs. Missing context is covered through actual API/worker/Helm-hook process assertions and execution-cluster mapping checks.
• CLI detail output rejects Unicode control characters, including DEL and C1, instead of relying on JSON escaping. The existing CLI/HTTP regression checks both safe field output and omission of unsafe details.
• Corrected the existing image-diagnostic code reference and current flow. No new migration guide, compatibility layer, ceiling contribution, or discovery scope was added. Earlier dispositions for compatibility/migration requests remain unchanged.

Local execution: the focused Go CLI regression passed (1 test); four controls against the unchanged contracts TypeBox 1.3.36 passed. The rebuilt production-console Storybook proof failed against the pre-fix module and passed with this source: unsupported capability makes no unavailable log/recommendation reads; policy refusal does not block refreshing independent logs. Documentation checked 263 pages / 4,223 links; length, flow, workspace, syntax, suite audit, and whitespace checks passed. Root startup/Helm/Compute/browser tests and lint/typecheck were left for matching-graph hosted CI, which has now passed at this head; no local dependencies were reconciled. Previous-head CI passed Images and Packaging, PostgreSQL lanes, Static Checks, Storybook, and CodeQL analyses, but failed the startup and browser cases fixed here. Current-head CI is now green, as recorded below.

Final simulated UI evidence for this source, outside the checkout: Pages/Agent detail → PolicyDenialsUnsupported and ConfigurationOwnerDenied. Screenshots: /tmp/oce-2980-detached-ui/after-unsupported.png, /tmp/oce-2980-detached-ui/after-owner-denied.png, /tmp/oce-2980-detached-ui/after-policy-refusals.png. Interaction video: /tmp/oce-2980-detached-ui/page@3cb01680c23270b3799678beb084a4db.webm (2.76 seconds; decoded final frame inspected). These local handoff paths are not native GitHub attachments and do not prove backend or runtime enforcement. Prior real Agent proof and refresh-race media remain preserved.

The prior ClawSweeper dispatch was cancelled after its admission leaf could not verify repository eligibility/public visibility; this is not a code finding or completed review. Canonical reviewer HTTP 401 and native media upload remain separate unresolved review/merge gates. CI passed at the review-fix head; a later main conflict required the history-preserving merge below. The detached CI loop has now completed with green CI on the merge head; no merge is authorized.

CI result before the latest main merge

At 2026-10-20 04:05 UTC, head 3078c39d980c402e4731bedbaebca7ad8a844db0 is ready and mergeable. CI 39366441045 completed successfully: 28 jobs passed, 0 failed, 1 skipped. The skipped CI job is Native Container Verification, an independently selected lane; this is not a claim that manual credentialed lanes ran. Both conformance lanes, both browser lanes, startup/image/packaging lanes, PostgreSQL lanes, Static Checks, and First Agent Smoke passed. This closes the previously recorded matching-graph execution gap for the changes in this PR.

Storybook, CodeQL, and Observability Demo also passed. Latest check accounting reports 36 successful and 7 skipped checks, no failures or pending checks. Advisory QA was skipped; earlier real Agent network-policy proof remains attributed to its tested revision. All three inline threads remain resolved; the final general-comment/review check found no new actionable feedback. Review and native-media gates described above remain separate from CI. The PR was not merged.

Latest main conflict resolution

Current head: 01ee10b27e1de60faccccf2f386cff394c1afedc, merging main at 184b49511 without rewriting history. Main changed Settings while the preceding head's CI was finishing. The resolution keeps its account/session cards and Sign out, followed by this PR's administrator-only Installation Driver schema inspection. Both Storybook scenarios and their instructions remain. No policy validation or enforcement code changed in this merge.

The rebuilt Pages/Settings → Account (pages-settings--settings) walkthrough passed: expanded the read-only schema, signed out, and verified private schema content was removed. This is simulated UI evidence from the source committed as 01ee10b27, not backend or runtime proof. Captures remain outside the checkout: /tmp/oce-2980-settings-merge-ui/settings-schema.png, /tmp/oce-2980-settings-merge-ui/signed-out.png, and /tmp/oce-2980-settings-merge-ui/page@59a902a04b86ea8f83272406bc721d71.webm (1.92 seconds; decoded and visually inspected). Syntax, workspace, specification links, Markdown length, whitespace, and the push formatting hook passed. Hosted current-head CI now passed; the preceding run remains separately attributed to 3078c39d9.

Final merge-head verification

At 2026-10-20 04:22 UTC, final head 01ee10b27e1de60faccccf2f386cff394c1afedc is ready and MERGEABLE, with no new actionable review feedback and all three inline threads resolved. CI 39368244727 completed successfully: 28 jobs passed, 0 failed, 1 skipped (Native Container Verification was not selected). First Agent Smoke passed. Both conformance and browser lanes, startup/image/packaging, PostgreSQL, Static Checks, and CI Required passed.

Storybook, CodeQL, and Observability Demo also passed. The final pre-handoff check snapshot contained 36 successful and 7 skipped checks, with no failures or pending checks. The detached babysit loop is complete. No PR merge, runner change, dependency reconciliation, credential refresh, or unnecessary model-proof rerun occurred. The canonical reviewer HTTP 401 and native-media attachment requirements remain separate review/merge gates; green CI is not an independent review verdict.

Validation ownership simplification (#1)

Current refactor head: e901b099efbba442aa584331951f897b16d130f7. The platform now checks plain JSON input against the admitted schema once per admission call, invokes the Driver's semantic callback with an isolated frozen copy, validates its readonly field-error list, and returns the original validated input. Empty error lists mean success. Drivers no longer repeat TypeBox schema validation or return success/data envelopes; the platform no longer rechecks replacement data or equality. Public ConfigurationResult<T> preview responses and API/wire schemas remain unchanged.

All bundled definitions, the Sandbox contribution, installed-package fixtures, and callers use the semantic-only contract. Schema-only Drivers return an empty list. Existing independent constructor admission remains; Kubernetes Compute retains its owned copy of constructor options. Malformed/throwing callbacks, old data envelopes, and attempted input mutation fail closed. Input accessors are refused before evaluation. Schema admission, noncoercion, diagnostic bounds/path safety, contribution registry, scope/key dispatch, discovery, preview/no-write, IAM/ceiling enforcement, snapshots, worker rechecks, and save/apply boundaries remain in place.

#2 is not implemented here. The executionCluster synthetic control-plane validation and error mapping are unchanged; a parsed-AST comparison confirmed that scope boundary. The parent owns its separate follow-up issue; this worker created no issue. Active RFC-0022/TASK-0046, Driver authoring/selection reference, and package-loading flow now describe the semantic-error contract. No compatibility shim or additional validation framework was added. The RFC retains its review status; this records the user-authorized implementation direction, not an independent approval.

Local verification: package/contract tests 88 passed / 0 skipped; bundled Sandbox/Plugin/SSH startup tests 111 passed / 1 skipped (the existing native OpenClaw initializer lacked OCC_TEST_RUNTIME_IMAGE); selected API/worker/Helm process diagnostics 2 passed / 0 skipped; the new original-input/callback-reference isolation test 1 passed. A final bundled-startup recheck also passed. Typecheck, full lint, changed-file formatting, unchanged OpenAPI/reference/cheat sheet checks, workspace and repository-credential boundaries, docs links/length/spec checks, flow validation, and suite audit passed. Manual Notes were preserved. No dependency graph was installed or reconciled. Matching-graph hosted CI has now passed for this head.

Final qualification for e901b099e, checked 2026-10-20 06:19 UTC: CI 39378255569 28 passed / 0 failed / 1 skipped (Native Container Verification was not selected), including First Agent Smoke. CodeQL, Storybook, and Observability Demo passed. The final check snapshot has 36 successful and 7 skipped checks, none failed or pending. The PR is ready and mergeable, all three inline threads remain resolved, and no new actionable feedback was found. Babysitting for #1 is complete; no merge occurred.

RFC-0022 remains one coherent definition/ownership/discovery specification at 1,541 visible words, below the 2,500-word limit; its related contracts and lifecycle boundaries stay together. Manual Notes and historical specifications remain unchanged.

This is an internal refactor with unchanged UI and wire behavior. Existing media is preserved; no new UI proof is claimed or required for these edits. The earlier genuine Agent network-policy proof remains attributed to its tested revision and was not rerun. Canonical reviewer HTTP 401 and native-media uploads remain separate known merge gates; neither was retried. No merge is authorized.

Rebase onto current main (2026-10-21)

Rebased original tip e901b099efbba442aa584331951f897b16d130f7 onto pinned main 90e8ac917dcfd3925a5bf9cfa4243d1459e39c84; rebased integration head was 87a64bd432d9e6f0fea15c20d219a98d4564864d, followed by documentation-only fix 9b5a1dcce30b72f4bfeaaef0372920826cefe76b (current head). All 13 non-merge feature commits were replayed. Range-diff and a full original-tip/main three-way tree comparison preserved the earlier merge-only Settings schema inspection, policy polling/permission behavior, generated references, and RFC status corrections. The original tip remains backed up locally. The update uses the user's explicitly authorized, exact force-with-lease; no PR merge or bare force push.

Main extracted API startup into api-startup.mjs. Its startupFailureFields now preserves the shared configuration diagnostics. The startup test retains main's reduced process-boot strategy while asserting exact field errors for refused runtime images. The owning flow names the new entry point. Validation simplification, registry/discovery, policy/ceiling/snapshot behavior, and the deferred #3014 algorithm remain unchanged.

Local lint, formatting, syntax, workspace, documentation (270 pages / 4,287 links), spec/length/flow checks passed. Three selected startup cases failed in warm-up before their assertions because main added @fastify/ajv-compiler, absent from the installed local graph. Typecheck and OpenAPI verification are blocked by the same missing dependency; no dependencies were installed or reconciled. The first matching-graph run found the combined startup flow 27 words above its hard limit. The initial local shell chain did not propagate that failure; the length result was not a pass. The documentation-only follow-up removes repetition without changing requirements, Manual Notes, or the changelog. The flow is now 2,496 words and retains one complete startup workflow; length, link, formatting, and flow checks passed with failure propagation enabled. The same run had a sandboxed Git clone fail with a truncated TLS stream (GnuTLS packet decoding/early EOF) after fixture initialization and broker checks; that test is unchanged by this PR. A targeted retry was requested but GitHub declined it while the workflow remained active; none started. Fresh current-head CI passed both outcomes; the TLS failure did not recur and Static Checks accepted the corrected length. Existing runtime/UI proof remains attributed to its recorded revisions; no credential access, model rerun, reviewer-auth retry, or media-upload retry was needed.

Console evidence

Storybook screenshots and an interaction video were captured and inspected at UI revision 37ab33ff5, outside the repository. These captures predate the merge from main and are not claimed as final-head visual proof. Stories include ConfigurationInvalid, ConfigurationConflict, ConfigurationAlternateDriver, ConfigurationStalePreview, ConfigurationJsonFallback, ConfigurationDiscoveryLoading, ConfigurationDiscoveryDenied, ConfigurationOwnerDenied, and Settings. These are simulated UI evidence, separate from backend and runtime proof.

The initial Storybook CI build exposed an accidental root-package dependency in asset preparation. The fixture schema is now self-contained; asset preparation with third-party imports prohibited, the isolated build, and a refreshed browser walkthrough passed locally. Hosted Storybook CI also passed at UI revision 37ab33ff52e82cab4747937da170e2a2049746d5.

Native GitHub uploads are complete: all five screenshots and both videos are posted and verified. These are inspected, simulated Storybook captures with their original revision labels; they do not prove backend persistence or runtime enforcement and were not newly captured on the rebased head. Earlier upload-blocked statements above record the historical state. The separate reviewer limitation remains unchanged.

Agent policy states — captures refreshed for 3078c39d980c402e4731bedbaebca7ad8a844db0; stories Pages/Agent detail → PolicyDenialsUnsupported and ConfigurationOwnerDenied. The screenshot shows policy and suggestion permission refusals. The 2.76-second walkthrough includes unsupported capability and independently visible denial logs.

page@3cb01680c23270b3799678beb084a4db.webm

Installation schema inspection and sign-out — captured at 01ee10b27e1de60faccccf2f386cff394c1afedc; story Pages/Settings → Account (pages-settings--settings). The 1.92-second walkthrough expands the read-only Driver schema and signs out, removing private schema content.

page@59a902a04b86ea8f83272406bc721d71.webm

Outstanding review

The canonical isolated reviewer stopped with HTTP 401 (reviewer_unavailable, no assessment produced); it was not retried with unchanged authentication. The separate hosted Codex review assessed 88bce6682 and raised the ceiling-path finding, now fixed and resolved. No independent review approval for the current head or merge readiness is claimed. No merge is requested.

Historical simulated UI screenshots and videos have now been published by the requesting user in this evidence comment. Their original tested revisions and limitations remain explicit; they are not fresh captures of the rebased head. No duplicate upload or canonical-review authentication retry was attempted.

Final rebase qualification (2026-10-21 19:41 UTC): head 9b5a1dcce30b72f4bfeaaef0372920826cefe76b is ready and MERGEABLE on main 90e8ac917dcfd3925a5bf9cfa4243d1459e39c84. CI 39661244313 completed successfully: 28 passed, 0 failed, 1 skipped (Native Container Verification was not selected). Both conformance lanes, Static Checks, all selected image/packaging/database/credential checks, and First Agent Smoke passed. CodeQL, Storybook, and Observability Demo also passed. The final check snapshot contained 36 successful and 7 skipped checks, no failures or pending checks. All three inline threads remain resolved; the startup-extraction review comment is addressed. No new actionable feedback or conflict remains.

Local startup/type/OpenAPI execution remains limited by the missing local dependency; the passing hosted jobs provide matching-graph qualification. The original tip is backed up, range-diff represents every original non-merge feature commit, and the new range contains no merge commits. No dependencies, credentials, or unrelated implementation were changed. The PR was not merged; canonical-review authentication remains an unchanged limitation.

Post-simplification real Agent rerun and merge authorization (2026-10-21)

Tested 9b5a1dcce30b72f4bfeaaef0372920826cefe76b, with no source changes. The user authorized a disposable detached checkout and pnpm install --frozen-lockfile there; the original checkout and dependency hashes were preserved. Node 24.22.0 ran the canonical selector:

OCC_TEST_QA_MATRIX=1 OCC_TEST_QA_INSTALLATION=kubernetes \
OCC_TEST_QA_PRESET=Codex OCC_TEST_QA_SCENARIOS=sandbox-policy \
  node --test --test-reporter=tap tests/integration/qa-matrix-real.test.mjs

With the prepared private environment and existing authorized Agent credential, 2 matrix checks passed, 0 failed, 0 skipped. The nested genuine OpenShell/Codex workflow passed 1 runtime test, 0 failed, 0 skipped, including teardown. Real gpt-6-astra Gateway shell turns passed. The Agent reached the Installation-default control on 8082, received an enforcement denial for independently reachable 8083, and reached 8083 after generic discovery/preview/save/apply. Provider logs confirmed the executable, destination mapping, port, and decision. A second Agent retained default access and stayed denied on 8083. Removing the addition restored denial while preserving 8082 access. Both permission-revocation cases refused native writes; interrupted-write recovery issued no duplicate UpdateConfig; immutable revision evidence remained unchanged.

The test loaded current production composition, routes, Drivers, PostgreSQL persistence, and worker source. API calls use authenticated Fastify injection; Agent workloads, Gateway/Codex/model execution, OpenShell RPCs, DNS, endpoints, and enforcement are real. This is the selected network-policy scenario, not a full OpenShell suite or Helm-installed control-plane qualification. The current controller image was built and its relevant packaged source hashes matched this head. Its imported digest was sha256:3fa794686d791dbb0afa2fd73bc3918796e2f875c24fb4a220364e5960c1e258. The current runtime recipe retained upstream OpenClaw commit f8386bc7df0a6c9eda7a28ae81943c5c06a414ff and Codex 0.163.0-alpha.2; the imported runtime digest was sha256:3fa77ac008e4bba15b393d4723aa82d578e9defd133162dd7b3bc8b47f8aa963. External OpenShell components used the repository's immutable pins.

Initial setup needed the isolated dependency graph and host-network access to the disposable loopback API. The sandbox-network attempt was cleaned before retry; no product assertion failed. Final test hooks and outer resource cleanup succeeded. Owned cluster/database resources, staged model credential, derived token, and private environment files were removed. The default kubeconfig and original dependencies are unchanged. Redacted TAP, matrix output, image/source hashes, and cleanup records remain outside Git under the DevBox evidence directory ~/.cache/oce-2980-e2e-rerun/ (qa.log, runtime/evidence/sandbox-policy-runtime.log, runtime/evidence/matrix.json, image-provenance.json, and result.json). These are local proof artifacts, not public attachments.

All five published screenshots and both videos remain accessible (HTTP 200); their original simulated-proof revision labels are retained. The relevant configuration UI source is unchanged by the validation refactor and rebase. Current-head CI is green: 36 successful checks, 7 unselected/skipped checks, no current failures or pending checks. All three inline threads remain resolved; prior concrete review findings remain addressed. The old cancelled ClawSweeper dispatch is superseded by later successful dispatches.

Authorized admin bypass: the requesting author explicitly asked to force merge once CI and the fresh runtime proof passed. The authenticated work account is the author, kevinlin-openai, with repository ADMIN permission. The remaining required-review rule prevents self-merging; the authorized bypass applies to that gate. The canonical isolated reviewer remains reviewer_unavailable (HTTP 401, no assessment), and no independent approval is claimed. This authorization supersedes historical no-merge statements above; it does not bypass an unresolved finding, failing test, conflict, or untested head.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review blocked

Automated review did not run, so no review verdict was produced.

Reason: The input-safety check rejected material in this revision. No detected value, path, or scanner output is reproduced here.

Automatic review is on hold, including after source changes. Request a fresh re-review after resolving the failure; maintainers can also release the hold through an intentional scanner-policy update.

Next step: If this is a genuine credential, remove and rotate it. If it is an intentional test fixture, a maintainer must review and qualify it.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T23:58:20.314280Z	88bce66	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 88bce6682f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[freeqaz]

Free's clanker here (an AI agent working on Free's behalf). This is a review of e7e5f3321 focused on contract compatibility and tests. I have not pushed, approved, run or merged anything.

Summary: Authorization on the new discovery and preview routes, stored-policy compatibility, the bounded certificate scanner and the stale-preview guards all hold up. I found two medium operator and contract regressions and a few smaller items. This PR also edits specs/rfcs/0022-*.md, so it needs human RFC review and a human merge either way.

1. Installed (package) Drivers break with no compatibility path or notice (medium). packages/contracts/src/configuration-definition.ts:376-397, packages/contracts/src/index.ts:1257

• validateConfiguration used to throw on bad input and return nothing on good input. It now has to return {success, data} or {success: false, error}. requireConfiguration treats undefined as a failure.
• So a package Driver written to the old contract fails startup with "Driver configuration validator failed." even when its configuration is valid.
• Registration also now enforces the 2020-12 meta-schema and rejects unknown formats, so draft-07 $schema or custom-format schemas that loaded before are refused.
• docs/guides/deploy/breaking-changes.md doesn't mention any of this, and the package contract has no version marker. Either accept the old shape (undefined means success, a throw means failure) or add a breaking-change entry with the migration.

2. The Helm pre-upgrade hook and the upgrade preflight no longer say which field is wrong (medium). deploy/helm/openclaw-enterprise/files/check-installation.mjs:20, scripts/upgrade-startup-preflight.mjs:35

• Both print error.message. ConfigurationValidationError always uses the message "Configuration validation failed." (configuration-definition.ts:64), and the details are in error.error.details.
• Repro: with runtime.gatewayStorageClassName: "Bad_Class", the hook prints installation-check: API and worker startup would refuse the Installation: Configuration validation failed. On main it names the setting.
• The hook's stated contract (line 10) is "name the key and file to fix".
• Separately, Kubernetes Compute checks that still throw ConfigurationFailure collapse to {path: "", message: "Configuration violates the Driver's constraints."} (configuration-definition.ts:346). For example, a relative authentication.kubeconfigPath gets no path at all, even in logs.
• Fix: have both scripts print the detail path/message pairs when given a ConfigurationValidationError, and add a hook test with one Driver-config refusal.

3. Startup log codes changed without a notice (low-medium). apps/controller/src/startup-failure.ts, server.mjs

• GATEWAY_STORAGE_CLASS_INVALID, OPENSHELL_NETWORK_POLICY_NAME_REJECTED (with its reason: rename-or-merge) and, in practice, RUNTIME_IMAGE_INVALID all become DRIVER_CONFIGURATION_INVALID, so alerts keyed on the old codes stop matching.
• docs/flows/production-startup.md:294 still tells operators to look for GATEWAY_STORAGE_CLASS_INVALID.

4. A ceiling violation now reports the wrong cause (low). packages/occ/src/index.ts:7090

• When a grant exceeds the Installation delegation ceiling (or uses an unsupported wildcard or range), save, apply and deploy now say "The Sandbox Driver refused the requested policy." Before, they said "…exceeds the Installation delegation ceiling."
• internal/occclient/transport.go parses Details but occ never prints them, so a CLI user gets neither the cause nor the field.

5. Execution-cluster errors point at the control-plane path (low). apps/controller/src/drivers/compute/kubernetes/index.ts:3488

• The nested requireConfiguration re-validates a synthesized object and passes its details through without the /executionCluster prefix.
• Repro: executionCluster.network.dns.namespace: "Bad_NS" reports path: "/network/dns/namespace", the same as the control-plane DNS error.

6. Startup-refusal tests got weaker (low).

• tests/integration/sandbox-driver-startup.test.mjs:324-336 (rejectsAtStartup, 13 callers) and tests/integration/configuration-startup.test.mjs:1353 skip the expected regex whenever the error is a ConfigurationValidationError. So any validation failure passes, including a fixture typo.
• tests/integration/plugin-driver-startup.test.mjs:76 accepts /…|Configuration validation failed/.
• A mutant that drops one check (for example the toolBinaries rule) survives as long as some other field fails. Asserting the detail path and code would fix that, as the packaging and preflight-parity tests in this PR already do.

7. New 65,536-character cap on executionCluster.caBundle (low). kubernetes/index.ts:2995. This rejects a previously accepted larger bundle, such as a pasted system CA bundle of about 200 KB. The reference documents the cap, but breaking-changes doesn't.

8. Nit: apps/controller/src/console/agents/sandbox-policy.mjs:664. loadPolicy returns early, without re-arming policyTimer, when draftGeneration changed while the request was in flight. loadPolicy also bumps that generation itself, so two overlapping Refresh clicks drop the later response. It is mostly unreachable while an apply is pending, because the form is disabled then.

RFC note. specs/rfcs/0022 stays status: Proposed but changes its contract in substance. It restores the contribution registry, (capability, driverId, scope, key) dispatch and discoverConfigurations, which its own 10-19 revision had removed ("There is no contribution registry, scope dispatch…"). It also adds Agent discovery and defers the ceiling integration. That needs a human RFC review.

Checked and fine

• Installation discovery requires Installation administer and returns schemas only: no values, validators or actions.
• Agent discovery authorizes the Agent read and the Namespace, then filters on sandbox_policy read.
• Preview requires manage_policy plus sandbox_policy update, runs read-only and keeps the stale-version, editing-disabled and pending checks. The PostgreSQL tests cover the denials and "no work rows written".
• Descriptors carry no ceiling, secrets or other tenants' data.
• Persisted SandboxPolicy and revision snapshots go through the same grant rules as before, and the worker re-admits snapshots. Ceiling diagnostics now point at /sandboxNetworkPolicyCeiling/N/... and /grants/..., so the earlier bot finding is fixed.
• The OpenAPI and Go client changes are additive. Moving semantic grant errors on PUT from 404 to 409 is a correct reclassification.
• The certificate scanner is linear (each pass moves past the consumed block) and still rejects text between certificates. Both CodeQL alerts are fixed.
• There are no new test files to map: tests/helpers/qa-sandbox-policy.mjs is a helper. The CI script edits (the codeload URL in openshell.mjs, requireEnv in openshell.json, an optional env-file path in qa-matrix.json) look benign.

When I checked, CI was still running on e7e5f3321, and CI Required had not reported.

[freeqaz]

Free's clanker here (an AI agent working on Free's behalf). This is a re-check of b8ccff2eb and the main merge df244b6bd against my earlier review of e7e5f3321. I have not pushed, approved, rerun or merged anything.

Fixed since last time, thanks

• The Helm hook and the upgrade preflight now print the filtered field details. With gatewayStorageClassName: "Bad_Class" the hook prints DRIVER_CONFIGURATION_INVALID: [{"path":"/runtime/gatewayStorageClassName",...}]. A mutable image names /images/gateway.
• A ceiling refusal keeps its own message, and occ now prints the details.
• Execution-cluster errors are remapped to /executionCluster/.... The relative kubeconfigPath case has a path now.
• production-startup.md no longer points at GATEWAY_STORAGE_CLASS_INVALID.
• The startup-refusal helpers assert exact details instead of accepting any validation failure.
• The overlapping-refresh nit is fixed. The separate policyReadSequence and the re-arm in finally look right.

1. The main merge leaves the Policy denials tab waiting forever when there is no policy descriptor (medium, new). apps/controller/src/console/agents/sandbox-policy.mjs:118-122, 205, 784-794

• fix(console): say once that policy denials are unavailable and drop retry after a refusal #2987 on main added firstPolicyRead. readLogs and loadSuggestions now await policySupported(), which waits for policyAnswered(). policyAnswered() is only called from loadPolicy's finally.
• In this PR, loadPolicy runs only if (descriptor). discoverConfigurations returns no sandbox-policy descriptor when the caller lacks sandbox_policy read, or when the Sandbox Driver has no per-Agent policy. driver-configurations.mjs:33 then renders the tab without a descriptor, and the same happens on its discovery-error path (line 55).
• In those cases the promise never resolves. Denials never load, even for an account whose read_logs grant should let it see them (the comment at driver-configurations.mjs:32 says so). The "does not support per-Agent network policy" status never appears either.
• CI shows it: Console Browser 2 fails console-agent-draft-guards.test.mjs:180 ("Policy denials says once that the Sandbox Driver lacks per-Agent network policy") and :240 ("A refused policy read offers no Retry"), both waiting 10 s for text that never renders. Both also fail locally on df244b6bd.
• Fix direction: resolve firstPolicyRead immediately when there is no descriptor, so logs fall back to their own permission. Then decide where the unsupported-Driver message comes from without a policy read. For example, discovery could return the descriptor with a null capability, or the tab could still do the policy read for that one message.

2. The new exact-detail assertions fail on CI and locally (medium, blocks CI Required). The validator emits an extra leading detail {path: "", code: "INVALID_VALUE", message: "Configuration does not satisfy boolean."} ahead of the additionalProperties one. These five tests fail on CI (Checks and Conformance 1/2, Image Runtime Startup 2) and locally on df244b6bd (5 fail and 142 pass across those four files):

• configuration-startup.test.mjs:1396 (plaintext secrets / unsupported schema options)
• plugin-driver-startup.test.mjs:110
• sandbox-driver-startup.test.mjs:641 and :672 (via rejectsAtStartup)
• sandbox-driver-startup.test.mjs:3381

The merge brought nothing into packages/contracts, so this comes from the PR's own commits, not from main. I'd suggest dropping the boolean keyword error in validateConfiguration (configuration-definition.ts:300). It just restates additionalProperties: false as a second, less useful detail that operators also see. Patching the expectations to match would keep that noise.

3. Many Kubernetes Compute checks still collapse to an empty path (low, rest of the earlier item 2). Only kubeconfigPath was converted. About 30 ConfigurationFailure throws and required(...) calls remain in validateConfiguration (kubernetes/index.ts:3196-3616). Repro: authentication: {mode: "kubeconfig", kubeconfigPath: "/etc/kube/config"} with no context.

• This branch's hook prints DRIVER_CONFIGURATION_INVALID: [{"path":"","code":"INVALID_VALUE","message":"Configuration violates the Driver's constraints."}].
• Current main prints Explicit Kubernetes context must be explicitly configured.
• The hook used to name the setting and now says nothing about which one is wrong. Converting required() to take a JSON Pointer would cover most of these at once.

Still open from last time (no change in this push)

• Item 1: the package-Driver validateConfiguration contract change (undefined now means failure, plus the 2020-12 meta-schema) still has no compatibility path or breaking-changes.md entry.
• Item 7: the 65,536-character executionCluster.caBundle cap is still not in breaking-changes.md.
• Related: docs/guides/deploy/breaking-changes.md:297 still says startup logs RUNTIME_IMAGE_INVALID for a refused Gateway or Agent image. Those checks now throw configurationConstraintFailure, so startup logs DRIVER_CONFIGURATION_INVALID instead.

Nit: internal/occclient/transport.go:103. The comment says JSON encoding escapes terminal control characters. encoding/json escapes C0 controls, but it leaves DEL (0x7f) and C1 controls such as U+009B (CSI) raw. If details can carry Driver-authored text, also skip details containing unicode.IsControl runes, as the server-side log filter does with \p{Cc}.

The merge resolution itself (sandbox-policy.mjs, scenarios.mjs, the upgrade-flow changelog) keeps both sides correctly. Item 1 is a semantic conflict, not a textual one. CI Required is red on df244b6bd because of items 1 and 2. The RFC-0022 note from my earlier comment still applies: this needs a human RFC review and merge.

[kevinlin-openai]

Simulated console UI evidence

Inspected all five screenshots and both playable videos. They show simulated Storybook UI with disposable demo data; no credentials or private data were observed. This proves UI behavior only, not backend persistence or real runtime enforcement. These are historical captures, not new captures on the rebased head. The later e901b099e validation refactor did not change UI.

Policy captures were refreshed for review fixes committed as 3078c39d980c402e4731bedbaebca7ad8a844db0. Stories: Pages/Agent detail → PolicyDenialsUnsupported and ConfigurationOwnerDenied.

Policy walkthrough (2.76 seconds): unsupported capability, independent denial logs, and permission refusals.

page@3cb01680c23270b3799678beb084a4db.webm

Unsupported Sandbox policy capability:

Independent denial logs remain visible when policy-owner discovery is denied:

Policy and suggestion permission refusals offer no editing or retry controls:

Settings captures are from 01ee10b27e1de60faccccf2f386cff394c1afedc. Story: Pages/Settings → Account (pages-settings--settings).

Settings walkthrough (1.92 seconds): expand the read-only Installation Driver schema, then sign out.

page@59a902a04b86ea8f83272406bc721d71.webm

Read-only Installation Driver schema inspection:

Signed-out page with schema content removed: