[obs-gap:openclaw] openclaw: session share-link state not surfaced

[github-actions]

Automated harness-observability audit found a gap for openclaw.

• Harness exposes: Sessions can be explicitly published as a revocable read-only public link, exposing both existing and future conversation text to anyone with the link.
• ClawMetry misses: Session dataclass has no field for share/publish state (e.g. is_shared, share_url, revoked_at), and the adapter does not read any share-registry file. This is a real security/exposure signal (an agent transcript being publicly link-accessible) that ClawMetry's Guard/security posture surfaces have no visibility into.
• Where (harness): CHANGELOG.md 2026.9.3 highlights (#139489)
• Severity: high
• Closest capability: new

Filed by scripts/harness/audit.py. Fingerprint: hgap-b04a00b71e (used to dedupe — keep it in the body).

[Aaqibhafeezkhan]

@vivekchand

Can I pick this issue?

[vivekchand]

@Aaqibhafeezkhan Yes, go ahead!

[Aaqibhafeezkhan]

Please review

#5760 @vivekchand

[vivekchand]

Verified against the FULL adapter (not the truncated view that produced #5750): this gap is real. clawmetry/adapters/openclaw.py has no share/publish state reader anywhere in its 193k characters. The only share matches are unrelated ("reasoning-token share", "shared filesystem", "shared plugin-SDK monitor").

Noting it because #5764 fixes an auditor truncation bug that filed #5750 as fiction, and I did not want this one dismissed by association. PR #5760 is doing real work.

---

Generated by Claude Code