Weekly digest -- 2026-08-31 (cloud relay in seconds + OTLP BYO-agent + CI credential sweep + 2 new runtimes)

[vivekchand]

Theme of the week

The two biggest surface changes were invisible-to-the-eye infrastructure: cloud relay queries that used to stall ≤60s now resolve in seconds (wake long-poll), and any app already emitting OpenTelemetry traces now gets full ClawMetry session attribution without a code change (OTLP BYO-agent). On top of that, CI got a systematic credential-hygiene sweep (8 separate hardening PRs), two new runtimes shipped (Lovable #29, Replit Agent #30), and Windows desktop installs became self-healing.

Note: vivekchand/clawmetry-cloud is outside this session's MCP scope — cloud-side PR/issue counts are unavailable this week. Cloud sections are marked accordingly.

---

Shipped (OSS — 36 meaningful PRs; cloud data unavailable)

OSS (vivekchand/clawmetry)

Features

• feat(otlp): sessions materialized from spans, honest runtime attribution for OTLP apps #5389 feat(otlp): sessions materialized from spans, honest runtime attribution for OTLP apps — any app emitting OTel traces gets a full ClawMetry session with correct runtime label; zero code changes required from the user
• feat(approvals): question-set approvals — decisions beyond yes/no (WO-52 phase 1) #5372 feat(approvals): question-set approvals — decisions beyond yes/no (WO-52 phase 1) — approval dialogs can now present a structured set of questions rather than a binary gate
• feat(replay): page older transcript history on demand; keep first paint instant #5369 feat(replay): page older transcript history on demand; keep first paint instant — "Load earlier" now fetches history in pages without blocking the initial render
• Wake long-poll: idle daemon answers cloud relay queries in seconds (was ≤60s) #5342 Wake long-poll: idle daemon answers cloud relay queries in seconds (was ≤60s) — cloud transcript and Brain window loads feel instant instead of stuck
• [RELEASE] feat(sessions): style thinking apart from the reply + per-turn token/cost badges; fix dead Back buttons #5349 (via RELEASE [RELEASE] feat(sessions): style thinking apart from the reply + per-turn token/cost badges; fix dead Back buttons #5349): style thinking apart from the reply + per-turn token/cost badges in the Sessions viewer
• [RELEASE] Replit Agent, the 30th runtime (carries clawmetry-pro#197) #5340 Replit Agent — the 30th supported runtime (carries clawmetry-pro#197)
• [RELEASE] Lovable, the 29th runtime (carries clawmetry-pro#196) #5337 Lovable — the 29th supported runtime (carries clawmetry-pro#196)

Fixes

• fix(nemoclaw): fall back to sandbox exec when host path yields no gateway logs (#5192) #5205 fix(nemoclaw): fall back to sandbox exec when host path yields no gateway logs (closes [obs-gap:nemoclaw] nemoclaw: container-sandbox gateway log fetched via sandbox exec ... tail, not host filesystem read #5192) — NemoClaw container-backed sessions now surface gateway logs that were silently dropping
• [RELEASE] fix(replay): Load-earlier button broke the Sessions transcript layout #5384 fix(replay): Load-earlier button was hijacking the Sessions transcript grid column
• fix(snapshot): keep the opening user prompt when capping long transcripts #5362 fix(snapshot): keep the opening user prompt when capping long transcripts — context windows were silently losing the first message
• fix: roll back to the previous version when clawmetry update fails #5361 fix: roll back to the previous version when clawmetry update fails — bad upgrade no longer leaves the install in a broken state
• Wake answers immediately: heartbeat inside the wake return, not after the next cycle #5358 Wake answers immediately: heartbeat now fires inside the wake return, not after the next main-loop cycle — eliminates one extra ≤2s delay on relay answers
• fix: make webview storage-path guard survive the binding refactor #5355 fix: webview storage-path guard survives the binding refactor
• Desktop shell: an exe stub is not an install — recover package corpses #5356 Desktop shell: recover package corpses — an .exe stub is not a valid install; the shell now detects and heals it
• Desktop shell: make the first pip install self-healing on Windows #5333 Desktop shell: first-pip-install self-healing on Windows (closes related bootstrap-failure class)
• Desktop shell: report the classified bootstrap-failure family (closes #5348) #5351 Desktop shell: report the classified bootstrap-failure family in the open-ping diagnostic
• Split the cffi pin per interpreter; never compile on end-user Windows #5344 Split cffi pin per interpreter; never compile on end-user Windows — removes the native-build failure class on Windows entirely

Chore / security / CI

• Harden CI: scope queue-priority's token per job, keep the workflow name out of the jq filter #5388 Harden CI: stop the screenshot job persisting the job credential #5338 Harden CI: stop the build and publish jobs persisting the job credential #5331 Harden CI: bind matrix.source before it reaches the smoke-test shell #5363 Harden CI: stop the gate, nightly and audit jobs persisting the job credential #5330 Harden CI: stop the read-only jobs persisting the job credential #5327 Harden CI (6 PRs): stop gate, build, publish, screenshot, nightly, audit, read-only, and smoke-test jobs from persisting the job credential — systematic sweep closing a credential-scope gap across the full workflow set
• ci: main-first runner priority (park queued PR runs, requeue green-drift PRs) #5373 ci: main-first runner priority — park queued PR runs, requeue green-drift PRs; reduces CI queue starvation
• Harden deps: floor cryptography past every published advisory #5387 Harden deps: take the npm fixes that fit the current major versions #5359 Harden deps: cryptography floor past every published advisory; npm fixes scoped to current major
• Scheduled workflow: file deduped field-failure issues from cloud aggregates #5371 Scheduled workflow: file deduped field-failure issues from cloud aggregates — closes the loop from cloud telemetry to OSS issue tracker
• CI: dmg-detach retry + cancel-in-progress groups (installer builds + queue depth) #5364 CI: dmg-detach retry + cancel-in-progress groups (macOS installer builds)
• docs(local_store): complete the invalidated-DB recovery recipe for PK indexes #5319 docs(local_store): complete the invalidated-DB recovery recipe for PK indexes

Cloud (vivekchand/clawmetry-cloud)

MCP access not scoped to this repo this session — PR/issue counts unavailable. Cloud-side velocity proxy: clawmetry-pro references in #5340 and #5337 confirm at least 2 cloud-side PRs (#196, #197) merged this week.

---

Biggest user-visible win

#5342 + #5347 Wake long-poll: cloud relay queries answered in seconds (was ≤60s)

Before this, a cloud user clicking into a session transcript had to wait for the daemon's next heartbeat cycle — up to a full minute of spinner before any content appeared. The wake long-poll holds the relay connection open and resolves the query the instant the answer is ready, eliminating the wait entirely. Combined with the heartbeat-inside-wake fix (#5358), the round-trip is now measured in single-digit seconds on a live daemon. For cloud users this is the most felt change of the week: transcripts and Brain windows now load at the speed they'd expect from a local session.

---

What users asked for (intel)

No explicit intel-feedback or intel-pain labelled issues were filed this week in OSS (label may live in the cloud repo). The highest-signal user-surface signals from the week:

1. [obs-gap:nemoclaw] nemoclaw: container-sandbox gateway log fetched via sandbox exec ... tail, not host filesystem read #5192 [obs-gap:nemoclaw] Container-sandbox gateway log fetched via host glob instead of sandbox-exec path (severity:high) — surfaced by the intel/obs-gap bot, fixed same week via fix(nemoclaw): fall back to sandbox exec when host path yields no gateway logs (#5192) #5205. Fast loop.
2. Desktop shell: report classified bootstrap-failure family with the open ping (AC-FFR-001) #5348 Desktop shell: report classified bootstrap-failure family with open ping (AC-FFR-001) — enhancement request translated directly into Desktop shell: report the classified bootstrap-failure family (closes #5348) #5351 and shipped the same day.
3. E2E Robustness Epic: regression tracking post-2026-08-26 (C1 segfault + C6 gate red) #5317 E2E Robustness Epic: regression tracking post-2026-08-26 (C1 segfault + C6 gate red) — vivekchand manually opened; signals that two E2E criteria are red and need attention this coming week.

---

Backlog health (OSS — cloud unavailable)

• Open issues: 118+ OSS (cloud: N/A) — no prior-week delta available cross-repo
• Open PRs: 36 OSS total (1 draft: feat(adapters/openclaw): surface nemoclaw onboarding OTel trace spans (#5380) #5386; 0 stale >14 days; 3 approaching stale: feat(channels): add Fish Audio voice/telephony channel ingest (#5045) #5055 10d, feat(entitlement): has_capacity_batch + has_capacity_batch_at + endpoints #5114 8d, Send the Quality grade to the cloud, and stop the cloud inventing an empty one #5121 8d)
• Oldest open issue: feat(v0.13): Native Event Stream Consumer — reference consumer for openclaw/openclaw#6467 #34 feat(v0.13): Native Event Stream Consumer (opened 2026-02-28, 184 days)
• Median open-issue age: ~35 days (estimated — dominated by recurring bot-filed obs-gap + audit issues filed in the last 30 days, offset by several 150+ day epics)
• Top label counts (OSS):
  • triaged: ~100+
  • enhancement / harness-gap / observability: ~40
  • bot-plan-only: ~30
  • weekly-digest: 9 (previous digests still open)
  • regression: 4 open

---

Bot productivity (OSS — cross-repo aware only where data available)

• Intel/obs-gap scout: ~15 new [obs-gap:*] issues filed this week (runtime:openclaw and runtime:nemoclaw); several correctly de-duped as duplicate on filing
• bot-pr-opened issues: ~6 created this week (e.g., [obs-gap:nemoclaw] NemoClaw: container-backed sandbox gateway log fetched via host glob instead of the harness's own sandbox-exec path #5291 NemoClaw sandbox path, [obs-gap:nemoclaw] NemoClaw: gateway-log-probe-timeout diagnostic (NEMOCLAW_LOGS_PROBE_TIMEOUT_MS) not surfaced #5293 diagnostic timeout, [obs-gap:openclaw] OpenClaw: Fish Audio speech synthesis usage/cost not tracked #5289 Fish Audio, [obs-gap:openclaw] OpenClaw: Fish Audio voice/telephony surface not in known channel set #5045 Fish Audio voice channel)
• bot-plan-only issues: ~12 filed (obs-gap enhancement backlog)
• Triage bot: all auto-filed issues carry triaged on creation — 0 manual triage needed
• Accuracy-audit fixer: 5 runs this week (2026-08-24 through 2026-08-31)
• Backlog-triage cron: 7 runs logged
• Good-first-issue scanner: 7 runs (daily cadence maintained)
• Smoke watchdog: 2 regressions filed in OSS (fleet 302 [regression] GET /fleet/ -- FAIL_STATUS got 302 expected 200 #5236, healthz 404 [regression] GET /healthz -- FAIL_STATUS got 404 expected 200 #5162); 1 blocked — could not reach clawmetry-cloud to file ([watchdog-blocker] smoke run 2026-08-29 — 1 new regression, cannot reach vivekchand/clawmetry-cloud to file #5335)
• CI babysit / PR autofix: multiple CI-harden PRs opened and merged by vivekchand directly; no bot-babysit marker PRs spotted in OSS this week

---

Concerning signal

#5335 — Watchdog can't reach vivekchand/clawmetry-cloud to file cloud regressions. The smoke watchdog detected a new regression on 2026-08-29 but couldn't file it to the cloud repo, so it fell into this OSS blocker issue instead. This means cloud-side regressions that only manifest against the cloud surface are currently creating a silent blind spot — the watchdog knows something is wrong but has nowhere to file it. Concrete next step: fix the cross-repo token/permission used by the watchdog workflow so it can write to clawmetry-cloud, or route cloud regressions through OSS with a regression:cloud label as a short-term fix.

Secondary: The [obs-gap:openclaw] secret egress host-binding fail-closed events not captured gap has been re-filed as 5 separate issues this week alone (#5044, #5287, #5377, #5395, and older ones) — identical finding, different issue numbers. The duplicate-detection logic isn't catching it. Either the gap needs a fix to close the loop, or the dedup threshold needs tightening so repeat filings land on the existing issue rather than creating new ones.

---

Suggested focus next week

• [OSS+cloud] Fix watchdog cross-repo filing ([watchdog-blocker] smoke run 2026-08-29 — 1 new regression, cannot reach vivekchand/clawmetry-cloud to file #5335) — cloud regression blind spot, highest risk item. Unblock the watchdog's write access to clawmetry-cloud.
• [OSS] Land pending feature PRs approaching stale: [RELEASE] Never delete another tool's Claude Code hook (carries #5209) #5216 (hook deletion protection — "Never delete another tool's Claude Code hook"), Extend agent principals: a team of their own, and inheritance up a ladder #5204 (agent principal inheritance), feat(adapters/openclaw): surface nemoclaw onboarding OTel trace artifacts (#5193) #5198 (NemoClaw OTel trace surface) — all ≥6 days open and ready to review.
• [OSS] Secret egress host-binding obs-gap — the recurring duplicate signal. Either ship the observer fix or add dedup logic to close-on-refile so the issue count stops climbing.

---

Code activity (OSS — cloud unavailable)

OSS

• Commits: 49 (since 2026-08-24)
• Lines: +753,177 / -420 across 2,183 files (dominated by i18n translation files added this week)
• Contributors: Vivek Chand (+ GitHub Actions bot for i18n/version bumps)
• Releases: v0.12.784 → v0.12.794 (11 releases shipped this week)

Cloud

• Commits: N/A (repo not in MCP scope)
• Lines: N/A
• Contributors: N/A
• Releases: (proxy: ≥2 PRs merged to main per clawmetry-pro#196, feat: skip onboard env var in install.sh #197 references)

---

Bot meta

Auto-generated 2026-08-31 07:30 UTC by the weekly digest bot. Tagged triaged so other bots leave it alone. Cross-repo aware — cloud data unavailable this run (vivekchand/clawmetry-cloud outside MCP scope; add repo to session scope to restore full cross-repo view).