[freeqaz]

Problem

Finding 2290 (post-land review of #3044). deploy/runtime/Dockerfile applies eight patches, but /opt/oce/runtime/provenance.json recorded hashes for only four. The browser-reconnect bridge from #3044, openclaw-codex-preserve-on-request.patch, openclaw-codex-full-access-profile.patch and the worker-authority regression patch were missing, so images built with and without them had identical patch fields; only runtimeContentsSha256 differed. Whoever acts on a "remove this bridge" TODO could not tell from provenance which images carry a patch, and nothing stopped the next patch from being forgotten the same way. The runtime README's patch list also omitted two.

Change

• scripts/build-runtime-assets.mjs keeps one ordered appliedPatches list (file, SHA-256, optional legacy field). Provenance gains patches: file name to SHA-256, in apply order.
• The four existing fields (openclawBridgePatchSha256, openclawConnectPatchSha256, codexDependencyPinPatchSha256, openclawRequiredWorkerAuthorityPatchSha256) are derived from the same list, so their names and values are unchanged. The only in-repo consumers of provenance read source/commit (runtime-entrypoints.ts, Dockerfile label check) and runtimeContentsSha256/codex; none read patch fields.
• A Dockerfile comment points at the list; the README documents the two undocumented patches and patches.

Verification

• tests/integration/runtime-assets.test.mjs (checks-baseline-2) now parses the Dockerfile's COPY + sha256sum --check + git apply steps and asserts provenance.patches equals them in order, that every deploy/runtime/*.patch is applied in that form (a layout the pattern misses fails instead of passing silently), that each pinned hash is the file's own, and that the legacy fields match. Mutants (dropping the browser-reconnect entry; COPY --link on one patch) fail it.

• tests/integration/runtime-image-startup.test.mjs pins the four newly recorded hashes in the built image.

• Internal review: approve with nits; nits applied.

Risks

• Low. Additive provenance field; existing fields keep names and values.
• Open PRs that change the patch set (feat: assign configured OpenClaw roles to Agent users #906, feat(runtime): apply Gateway tool policy to dedicated OCE deployments #2633, feat: add Gateway managed mode to Agent deployments #2982) touch the same provenance block and will need a small merge; afterwards the new test makes them add their patch to the list, which is the point.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR records all eight Dockerfile patches in runtime provenance and checks their order and hashes against the build recipe.

Example: An operator inspects an image containing openclaw-control-ui-browser-reconnect.patch.

• Before: The patch has no named hash in provenance.json.
• After: provenance.patches records its SHA-256 as 964c500f981f343d8c131a213aad65ea47e2de4a9a5d11dbb57c3f30bead7065.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	A useful, focused repair with no actionable findings and passing relevant CI; available behavior evidence remains test-based.
Proof confidence	🦐 gold shrimp (3/6)	This collaborator-authored PR is outside the ordinary contributor proof gate; supplied verification describes assembly checks and built-image assertions, while inspected linked screenshots show unrelated Console access controls.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Operators cannot identify every applied runtime patch from the image's patch provenance.
Reason: The collaborator-authored repair restores documented provenance accuracy through the existing build owner without changing runtime policy or configuration.

Merge readiness

✅ Ready for maintainer review

Keep open: this PR fixes a verified provenance gap on current main, preserves existing metadata, and introduces no actionable defect found in review.

Priority: P2
Reviewed head: bfecb09e34571a739dfeebb08dc0729f187f8769

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: Independent base-versus-head execution and direct built-image provenance output were not supplied; the available verification is test-based.

Agent review details

How this fits together

The runtime image build applies verified patches to pinned OpenClaw source, then packages the runtime and its provenance for operator inspection and runtime identity reporting.

flowchart TB
  A[Pinned source and patches] --> B[Dockerfile build]
  B --> C[Runtime asset assembler]
  C --> D[Packaged runtime]
  C --> E[Provenance JSON]
  E --> F[Operator inspection]

Loading

Technical review

Best possible solution:

Land the focused provenance inventory and its packaging checks while retaining the existing metadata values.

Do we have a high-confidence way to reproduce the issue?

Source inspection establishes the mismatch between eight applied patches and four recorded hashes on current main; no target code or tests were run during this review.

Is this the best way to solve the issue?

The existing asset assembler is the appropriate owner, and checking its generated metadata against the Dockerfile and patch contents directly protects against another omitted entry.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 25b004874c3a.

Provenance checked

• Runtime patch provenance keeps the original intent (Update OpenClaw runtime source #502: Record verified source and bridge patch hashes to identify the custom runtime build; subsequent runtime changes added further individual hash fields.)
• Runtime assembly and packaging checks keeps the original intent (6b5c909: Assemble slim runtime contents with a content inventory and accurate provenance; the new assertions extend that packaging contract.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Current-main gap: Current main writes four individual patch hashes, while the Dockerfile applies eight patches, including the worker-authority regression and browser-reconnect patches. (scripts/build-runtime-assets.mjs:295, 25b004874c3a)
• Introduced implementation: The pinned introduced diff adds an ordered eight-patch inventory, derives the four existing fields without changing their values, and emits the complete patches map. (scripts/build-runtime-assets.mjs:339, bfecb09e3457)
• Independent packaging guard: The extended assembly test compares emitted metadata against Dockerfile application order, the patch-file inventory, actual file hashes, and existing field mappings; the image test checks the previously omitted hashes. (tests/integration/runtime-assets.test.mjs:158, bfecb09e3457)
• Compatibility boundary: Runtime identity reporting reads source and commit without rejecting additional keys; final inventory generation preserves other provenance fields. This is regenerated image metadata, with no user-state migration. (apps/controller/src/drivers/compute/kubernetes/runtime-entrypoints.ts:739, bfecb09e3457)
• Exact-head CI: CI Required, Checks and Conformance 2, and all three Image Runtime Startup checks succeeded for the reviewed head. Job metadata was readable; detailed log retrieval redirected to a storage host blocked by the review environment. (bfecb09e3457)
• Discussion and related change: This PR's comments contain review-status notices, with no additional direction or behavior proof. The merged browser-reconnect work at Help an open Gateway tab reconnect after sign-in expires #3044 explains one newly inventoried patch but does not repair the provenance gap.

Likely related people:

• Kevin: Raw commit 6b5c909 adds scripts/build-runtime-assets.mjs:211 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 6b5c9093b750; files: scripts/build-runtime-assets.mjs)
• stevenlee-oai: Raw commit e82fa9b adds scripts/build-runtime-assets.mjs:294 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: e82fa9b55e44; files: scripts/build-runtime-assets.mjs)

Labels

Label changes:

• add P2: Incomplete image provenance impairs patch identification and maintenance, with limited blast radius and no demonstrated execution failure.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: Incomplete image provenance impairs patch identification and maintenance, with limited blast radius and no demonstrated execution failure.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 24, 2026, 3:28 AM ET / 07:28 UTC.