[freeqaz-openai]

OpenShell capability discovery retained the caller's mutable options object, while revision policy used the configuration copied at construction. Mutating middleware names could make discovery and policy refer to different registrations. Discovery now reads the same installed configuration as policy rendering.

The regression covers mutation after construction, rejection when only a replacement registration is advertised, observed-hook preview authorization, stock repository-Git refusal, and repository-only classification.

Validation: seven focused configuration tests and the repository and test TypeScript checks passed. Gateway capability responses are fixtures; this does not qualify an installed OpenShell sender or runtime enforcement.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

Capability discovery now uses the OpenShell configuration copied at Driver construction, matching policy rendering.

Example: Construct the Driver with middlewareName="installed", then change the caller's options to "replacement".

• Before: Discovery checks "replacement" while revision policy still names "installed".
• After: Discovery and revision policy both use "installed", and a gateway advertising only "replacement" is rejected.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	A focused, source-supported repair with useful regression coverage; supplied behavioral evidence remains limited to a fixture-backed Driver test.
Proof confidence	🦐 gold shrimp (3/6)	This maintainer-authored consistency repair is outside the ordinary contributor proof gate; supplied validation exercises the real Driver with fixture gateway responses and does not qualify an installed OpenShell sender.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: A caller retaining and changing construction options can cause availability checks to disagree with the middleware selected for revision policy.
Reason: The maintainer-authored change restores consistency within an existing Driver without changing its configuration contract, defaults, or supported authorization profiles.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: it fixes a source-verifiable configuration mismatch still present on main, and no introduced defect was found.

Priority: P2
Reviewed head: 85a9a5a0af08bb62b65ba64b6c640773fd2efbba

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: No recorded base-fail/head-pass comparison or shipped-entry-point run demonstrates post-construction option mutation; the added regression uses fixture gateway responses.

Agent review details

How this fits together

Installation composition constructs the OpenShell Credential Proxy Driver; gateway capability advertisements and admitted revision plans enter it, and availability decisions and Sandbox policy wiring leave it.

flowchart LR
  A[Installation configuration] --> B[Driver configuration copy]
  C[Gateway advertisements] --> D[Capability discovery]
  B --> D
  B --> E[Policy rendering]
  F[Admitted revision plan] --> E
  D --> E
  E --> G[Sandbox policy wiring]

Loading

Technical review

Best possible solution:

Use the existing immutable configuration copy consistently for discovery and policy generation.

Do we have a high-confidence way to reproduce the issue?

Source inspection establishes the trigger: mutate the original options after construction and discovery reads different names from policy rendering; no execution was performed during this review.

Is this the best way to solve the issue?

This is the smallest complete repair because the Driver already owns an immutable configuration copy and needs no new state, option, or abstraction.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 689860f20909.

Provenance checked

• Discovery registration selection keeps the original intent (3115679: The original Credential Proxy implementation selected registered OpenShell middleware and separately copied configuration for policy and enforcement; no intentional mutable-configuration behavior was documented.)
• Repository-only refusal classification keeps the original intent (84a4767: A registered Git-only middleware must produce a permanent configuration refusal rather than an ambiguous transient outage; the patch preserves that distinction using the installed names.)
• CI expected-result inventory keeps the original intent (3115679: The existing manifest records this configuration suite's expected tests; the patch adds the new regression to that same inventory.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Current main retains the mismatch: The constructor copies options, but capability discovery still reads the caller-owned middleware names. (apps/controller/src/drivers/egress-proxy/openshell.ts:364, 689860f20909)
• Pinned introduced change: The production hunks replace only the discovery registration reads with this.options; the remaining changes add a regression and register its expected CI result. (apps/controller/src/drivers/egress-proxy/openshell.ts:364, 85a9a5a0af08)
• Focused regression coverage: The added test mutates both middleware names, checks original-registration policy wiring and preview discovery, rejects replacement-only advertisements, and preserves repository-only and unqualified-sender refusals; gateway responses are fixtures. (tests/integration/credential-proxy-configuration.test.ts:244, 85a9a5a0af08)
• Existing enforcement boundary remains: Discovery does not establish installed enforcement: wiring and installation verification still check the admitted plan, Sandbox ownership, exact policy, and enforcement evidence. (apps/controller/src/drivers/egress-proxy/openshell.ts:470, 85a9a5a0af08)
• Feature history and original intent: Credential Proxy Implementation #2487 introduced the copied configuration and discovery implementation; fix(credential-proxy): name the git-only proxy refusal instead of a 503 or a bare 404 #3531 intentionally distinguished a Git-only registration from a transient dependency failure, which this PR preserves. (apps/controller/src/drivers/egress-proxy/openshell.ts:343, 31156790238d)
• Discussion and review state: The complete body and comments contain fixture-based validation claims and no installed-runtime qualification claim; the PR is collaborator-authored, remains a draft, and GitHub reports it mergeable. (85a9a5a0af08)

Review metrics

Metric	Value	Why it matters
Change distribution	Production +4/-2 lines; tests +104/-0; CI inventory +2/-1.	Production scope is minimal; the larger test exercises configuration consistency and consequential refusal paths.

Labels

Label changes:

• add P2: The mismatch is a concrete Driver correctness bug triggered by post-construction caller mutation, with no demonstrated broad deployment outage.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: The mismatch is a concrete Driver correctness bug triggered by post-construction caller mutation, with no demonstrated broad deployment outage.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 27, 2026, 7:46 AM ET / 11:46 UTC.