Weekly digest -- 2026-09-14 (CI supply-chain hardened + Guard gets OWASP/MITRE + enterprise-readiness sprint begins)

[vivekchand]

Theme of the week

Two parallel pushes: (1) a CI supply-chain hardening blitz that hash-pinned every pip install step across all CI jobs, closing a category of risk in one concentrated sprint; and (2) Guard growing from "is something wrong?" into a compliance-ready framework layer, culminating in a Sunday-evening burst of 15 enterprise-readiness issues that signals the next product chapter.

Note on cloud repo: vivekchand/clawmetry-cloud is not configured for this session's GitHub scope — cloud-side data is absent below. Cloud PRs referenced from OSS [RELEASE] PR titles are noted inline where visible.

---

Shipped (OSS only — ~90 PR merges, ~55 substantive)

Features

• Guard: tag findings and decisions with OWASP LLM 2026, OWASP Agentic 2026 and MITRE ATLAS IDs #5952 Guard: tag every finding and policy decision with OWASP LLM 2026, OWASP Agentic 2026 and MITRE ATLAS IDs — every Guard incident now carries frameworks, stamped by the new pure framework_map.py module; generates docs/FRAMEWORK_COVERAGE.md and CI fails on drift. Compliance reports now have a machine-readable foundation.
• Add OpenExecutive as the 32nd runtime #5921 Add OpenExecutive as the 32nd runtime — the count ticks up and sync_runtime_count.py stays green; released same-day via [RELEASE] OpenExecutive as the 32nd runtime (carries #5921) #5924.
• Guard: refuse Pause/Stop/Kill on GitHub Copilot conversations inside VS Code #5954 Guard: refuse Pause/Stop/Kill on GitHub Copilot conversations inside VS Code — Copilot editor sessions share one IDE process; the control surface now says so with a disabled button and a reason rather than silently failing.
• Cost Optimizer: bounded wait, labelled figures, advice from recorded usage (#5934) #5951 Cost Optimizer: bounded wait, labelled figures, advice from recorded usage — fixes the 33s spinner (Cost Optimizer: 33s spinner on cold load, debug label and unlabelled figures #5934), labels every figure so users know the basis, and surfaces actionable advice; released same-day.
• AgentOps scorecard: latency SLOs, alertable rates, ground-truth outcomes #5877 AgentOps scorecard: latency SLOs, alertable rates, ground-truth outcomes — /api/agentops/scorecard now covers p95 latency, escalation rate, first-pass rate and ground-truth accuracy; alert rules can fire on any of them.
• Activity heatmap: SQL buckets, node-local hours, runtime scoping #5904 Activity heatmap: SQL buckets, node-local hours, runtime scoping — the heatmap was drawing placeholder hours; now draws real per-node hours from DuckDB. Released via [RELEASE] The hosted Activity Heatmap draws real hours (carries #5904) #5906.
• Give the OpenClaw run ledger a home: Queue Lanes in Crons (#5721) #5865 Queue Lanes in Crons (OpenClaw run ledger) — /api/run-ledger data now has a UI home in the Crons tab. Released via [RELEASE] Queue Lanes in Crons (carries #5721) #5868.
• Guard sees write direction, token values and remote privilege #5845 + Guard notices unrelated sessions acting in step (coordinated_action) #5846 Guard sees write direction, token values, remote privilege, and coordinated swarms — two new behavioural detector axes in one release ([RELEASE] Guard sees write direction, token values, remote privilege, and swarms acting in step (carries #5845 + #5846) #5849): an agent leaking credentials vs reading them is now distinguishable; unrelated sessions acting in step triggers coordinated_action.
• A blocked agent always reaches a person; the gate hook can't fail closed #5838 A blocked agent always reaches a person; the gate hook can't fail closed — the preToolUse gate now has a hard-timeout path that routes to the person rather than silently dropping the request.
• Ask the process, not the transcript, whether an agent is still running #5564 Ask the process, not the transcript, whether an agent is still running — eliminates ghost sessions where the transcript says "done" but the process is still live. Released via [RELEASE] Ask the process whether an agent is still running (carries #5564) #5798.
• feat(daemon): the daemon reports the failures that stop it working #5752 Daemon reports the failures that stop it working — the daemon now surfaces its own ingest errors as health signals, not silent stalls. Released via [RELEASE] The daemon reports the failures that stop it working (carries #5752) #5795.
• feat(channels): add Fish Audio voice/telephony channel ingest (#5045) #5055 Fish Audio voice/telephony channel (24th chat channel) — Fish Audio joins the channel ingest catalogue. Released via [RELEASE] Fish Audio is the 24th chat channel (carries #5055) #5821/5825.
• feat(onboarding): add GET /api/onboarding/ingest-status (#5680) #5730 GET /api/onboarding/ingest-status — the onboarding strip can now tell whether any data is actually reaching the daemon. Released via [RELEASE] The onboarding strip can tell whether anything is reaching us (carries #5730) #5817.
• feat(obs): surface OpenClaw 2026.9.3 update-pipeline state in adapter (#5749) #5763 Surface OpenClaw 2026.9.3 update-pipeline state in adapter — agents stuck mid-update now produce an observable signal. Released via [RELEASE] An agent stuck mid-update now shows a signal (carries #5763) #5809.
• feat(dives): add GET /api/dives/questions gallery endpoint (DIVES-5, #999) #5828 feat(dives): GET /api/dives/questions gallery — first DIVES-5 endpoint lands (EPIC [EPIC] ClawMetry Dives — AI SQL→chart over local DuckDB #999).
• Split routes/entitlement.py: 1.84 MB and 434 routes in one file #5588 Split routes/entitlement.py (1.84 MB, 434 routes → package) — one of the five "big enough to change how you work" files is now a package; Drift Bot can read the whole surface again.
• Heartbeat every 2s while a person's decision can still reach the agent #5883 Heartbeat every 2s while a decision can still reach the agent — cloud relay no longer drops an approval decision because the heartbeat cadence was too slow.
• Answer the agent's question from anywhere, and retire dead requests #5873 Answer the agent's question from anywhere; retire dead requests — HITL approval can now be issued from any connected surface, not just the originating session strip.
• feat(obs-gap): capture reply-recovery gateway events in OpenClaw adapter (#5620) #5626 Capture reply-recovery gateway events in OpenClaw adapter — gateway's own failures (retries, drops) now reach the dashboard. Released via [RELEASE] The gateway's own failures reach the dashboard (carries #5626) #5803.

Fixes

• fix: alert narrator ignores SELF_HOSTED / CLAWMETRY_OFFLINE suppression #5969 Alert narrator ignores SELF_HOSTED / CLAWMETRY_OFFLINE suppression — offline nodes were generating spurious alerts for missing cloud endpoints.
• fix: auto-update plan sync ignores a stored opt-out #5966 Auto-update plan sync ignores a stored opt-out — user-set opt-outs were being silently overwritten on entitled plans on every sync. Critical data-integrity fix.
• A correct emailed code opens the dashboard instead of looping to the wall #5918 A correct emailed code opens the dashboard instead of looping to the wall — auth OTP was looping users back to the login wall even when the code was correct.
• Titles and turns follow the person, not the context a harness injects #5882 Session titles follow the person, not context a harness injects — title and turn attribution now track the real human, not injected system context.
• The stall detector reports every sleeping laptop as broken #5836 Stall detector stops calling every sleeping laptop broken — a suspended-then-resumed machine was always reporting daemon_ingest_stalled; fixed by detecting wall-clock gap vs CPU time.
• Fix cron health-summary grading a job "ok" over 104 failed run_ledger runs #5867 Fix cron health summary grading a job "ok" over 104 consecutive failed runs — the grader was using the wrong field; Cron Health says "3 healthy" over a job whose last 104 runs failed #5866 had been open since the feature shipped.
• fix(repo_scan): name every runtime that executes a hook file, and the event #5820 fix(repo_scan): name every runtime that executes a hook file — hook findings were attributing to the wrong runtime in some multi-runtime installs.
• fix(tool_risk): rate git -c <exec key>=… high, sharing repo_scan's predicate #5848 fix(tool_risk): rate git -c =… high — a common config-injection vector was rated at normal risk; now shares repo_scan's high-risk predicate.
• fix(store): backfill rollup_session.runtime, which #5743 fixed only for new rows (closes #5781) #5785 fix(store): backfill rollup_session.runtime — fix(accuracy): rollup_session.runtime is the runtime, not openclaw for all #5743 fixed new rows but left 92% of existing rows as openclaw; one-time migration backfill shipped.
• Stop a swarm teaching Guard that its own destination is normal #5810 Stop a swarm teaching Guard its own destination is normal — the egress settle window now rejects hosts vouched for only by the same swarm that uses them.
• Fix: save_state() runs bare in the sync daemon loop, can freeze last_sync #5861 Fix: save_state() bare in sync daemon loop can freeze last_sync — the daemon's steady-state sync timestamp could stall under certain error paths.
• fix: revert broken Dependabot dep pins from PR #5910 (atheris, chardet, pyee) #5926 Revert broken Dependabot dep pins from chore(deps): bump the ci-scanners group in /.github/requirements with 3 updates #5910 — atheris, chardet, pyee were yanked at the pinned version; CI was broken.

CI / security hardening (9 PRs — the week's dominant chore thread)

All targeting supply-chain attack surface: every CI job (PyPI publish, gate, dashboard-boot, Python tests, Playwright E2E, security scanners, live-E2E, pip bootstrap, desktop-artifacts) now installs dependencies from a hash-pinned requirements set. Also: actions pinned to commit SHAs (#5305), full security-audit scanner (#5733), Werkzeug debugger loopback-only (#5382), DTD rejection in JUnit XML parser (#5842).

Docs / chore

• docs: weekly roadmap synthesis (2026-09-11) #5844 Weekly roadmap synthesis (2026-09-11)
• docs(ingest): generate docs/INGEST.md from ingest/1 contract (#5682) #5705 Generate docs/INGEST.md from ingest/1 contract with drift test
• lint: CI test-file coverage ratchet (issue #5813) #5822 CI test-file coverage ratchet — 82% of tests were running in no job (82% of the test suite (933 of 1136 files) runs in no CI job #5813); ratchet now enforces new files are added to a workflow step.

---

Biggest user-visible win

#5952 Guard: OWASP LLM 2026, OWASP Agentic 2026 and MITRE ATLAS IDs on every finding

Every Guard incident — from a loop signal to a credential access finding — now carries a frameworks block naming the specific OWASP and MITRE identifiers it maps to, with edition, rationale and caveats. docs/FRAMEWORK_COVERAGE.md is generated and CI-gated so the coverage never silently drifts. For a team doing a security review or vendor assessment of their AI agent deployment, this turns a list of raw signals into a document they can hand an auditor. This is the single change most likely to unlock enterprise procurement conversations.

---

What users asked for (intel)

No intel-feedback or intel-pain labelled issues were filed this week in the OSS repo. The closest signal is the hn-post batch from last week (#5715–5719 — still open), which drove several onboarding and empty-state improvements that landed this week.

The more interesting signal is the Sunday evening enterprise-readiness burst — 15 issues filed Sep 13 21:30 UTC, all tagged enterprise-readiness, covering:

• OTLP traces: spans bypass Guard detectors and redaction #5938 OTLP spans bypass Guard detectors and redaction (bug — shipped fix fix(otlp): trace spans reach Guard and are scrubbed before storage #5953 day-of)
• Dashboard cold load: overview, system-health and crons requests time out #5935 Dashboard cold load times out its own startup requests (bug — fix(dashboard): first load no longer times out its own startup requests (#5935) #5957 open)
• Cost Optimizer: 33s spinner on cold load, debug label and unlabelled figures #5934 Cost Optimizer 33s spinner and unlabelled figures (bug — fixed in Cost Optimizer: bounded wait, labelled figures, advice from recorded usage (#5934) #5951)
• Guard: promote prompt-injection detection to a detector + raise tool risk after untrusted content #5945 Guard: promote prompt-injection to a detector
• CI/CD: GitHub Action / Azure DevOps task — agent-session provenance per PR with SARIF output #5946 CI/CD GitHub Action + Azure DevOps task with SARIF output
• Attribution: project + user tags and per-project budgets (burn vs budget) #5941 Attribution: project + user tags and per-project budgets
• LiteLLM integration: proxy callback / OTel ingestion + spend-log import #5940 LiteLLM integration: proxy callback + OTel ingestion
• Pricing: custom price book for negotiated rates + Azure OpenAI deployment aliases #5936 Pricing: custom price book for negotiated rates + Azure OpenAI deployment aliases
• Self-hosted collector: publish a signed container image (compose currently builds from source) #5948 Self-hosted collector: signed container image
• Fleet install: Windows service, Linux linger and silent install for VDI / Azure Virtual Desktop #5942 Fleet install: Windows service, Linux linger, silent install for VDI
• Replay MITRE ATLAS OpenClaw case studies (AML.CS0048–CS0051) against Guard and publish the scorecard #5944 Replay MITRE ATLAS OpenClaw case studies CS0048–CS0051 against Guard
• OpenTelemetry: CI-tested recipes for LangGraph/OpenLLMetry, Azure AI Foundry and AWS AgentCore #5939 OTel recipes for LangGraph, Azure AI Foundry, AWS AgentCore
• OTLP intake: durable acknowledgements, recovery and unsampled usage accounting #5949 OTLP intake: durable acknowledgements and unsampled usage accounting
• Agent supply chain: inventory configured MCP servers and skills; alert on new or changed components #5947 Agent supply chain: inventory MCP servers / skills, alert on new/changed
• Cost figures: label vendor-reported vs contract vs estimated everywhere; split actual spend from API-equivalent #5937 Cost figures: label vendor-reported vs contract vs estimated

This is clearly a product-led batch in response to an enterprise conversation, not organic user filing. These 15 issues define the next 2–3 weeks of work.

---

Backlog health (OSS only)

• Open issues: 51 total
• Open PRs: 24 total (0 drafts, 2 stale >14 days: feat(entitlement): has_capacity_batch + has_capacity_batch_at + endpoints #5114 feat(entitlement): has_capacity_batch — 22d, Extend agent principals: a team of their own, and inheritance up a ladder #5204 Extend agent principals — 20d)
• Oldest open issue: feat(v0.13): Native Event Stream Consumer — reference consumer for openclaw/openclaw#6467 #34 feat(v0.13): Native Event Stream Consumer (opened 2026-02-28, 198 days)
• Median open-issue age: ~19 days (26th oldest is E2E Robustness Epic: 7-criterion tracker (cron-managed) #5266, opened Aug 26)
• Top label counts (open issues): enhancement ~26 | triaged ~48 | enterprise-readiness 15 | bot-plan-only ~12 | bug 5

---

Bot productivity

• Triage bot: All 15 enterprise-readiness issues filed Sunday were immediately triaged (labeled). Daily good-first-issue scans ran Sep 10–13 ([good-first-issue scan] 2026-09-10 #5793, [good-first-issue scan] 2026-09-11 #5835, [good-first-issue scan] 2026-09-12 #5900, [good-first-issue scan] 2026-09-13 #5930). Accuracy-audit meta-run [accuracy-audit 2026-09-11] meta-run: 22 drifts across 2 harness(es) #5871 found 22 drifts across 2 harnesses (closed).
• Autofix bot (field-failure → PR): [field-failure] daemon: daemon_ingest_stalled on Windows (py 3.13) #5932 daemon_ingest_stalled on Windows py3.13 was filed and a fix PR feat(sync): write thread-stack dump on daemon_ingest_stalled (#5932) #5933 opened same-day. Multiple stall issues from prior days auto-closed ([field-failure] daemon: daemon_ingest_stalled on Darwin (py 3.10) #5854–5858, [field-failure] daemon: daemon_ingest_stalled on Darwin (py 3.14) #5829–5834) after signatures stopped recurring.
• Intel scout: 0 intel-feedback/intel-pain issues this week. 4 obs-gap issues closed ([obs-gap:openclaw] openclaw: session share-link state not surfaced #5746, [obs-gap:openclaw] openclaw: meeting library transcripts/notes not ingested #5747, [obs-gap:openclaw] openclaw: update/migration candidate-state and abandoned-update recovery not observed #5749, [obs-gap:nemoclaw] nemoclaw: onboarding OTel trace artifacts (per-phase spans/status/duration) not ingested #5750).
• Smoke watchdog: Multiple daemon_ingest_stalled field-failure signatures fired and auto-closed across Darwin/Linux/py3.10–3.14. One still open: [field-failure] daemon: daemon_ingest_stalled on Windows (py 3.13) #5932 (Windows py3.13).
• PR babysit: docs: weekly roadmap synthesis (docs: weekly roadmap synthesis (2026-09-11) #5844) landed Friday morning.

Cloud bot activity not available (repo access denied for this session).

---

Concerning signal

OTLP intake reliability is a recurring open wound. Three separate OTLP issues filed or fixed this week: #5938 (spans bypassing Guard — filed and a fix PR #5953 opened same-day but not yet merged), #5949 (no durable acknowledgements — filed Sunday, PR #5963 open), and #5973 (closed without merging, apparently superseded by #5953). The fixes are moving fast but the pattern suggests the OTLP path was shipped incomplete. #5963 and #5953 are both open PRs right now — they should both land before any enterprise OTel recipe docs (#5939) are shipped, or the recipes will document a path with known reliability holes.

Next step: Merge #5953 and #5963 together or in sequence before this week ends. Then file a single "OTLP hardening complete" tracking issue that gates the OTel recipe docs.

---

Suggested focus next week

• [OSS] Land the OTLP hardening PRs (fix(otlp): trace spans reach Guard and are scrubbed before storage #5953, fix(otlp): acknowledge an export only once it is stored; count what was refused #5963) before shipping OTel recipe docs (OpenTelemetry: CI-tested recipes for LangGraph/OpenLLMetry, Azure AI Foundry and AWS AgentCore #5939) — the intake must be reliable before the on-ramp is documented
• [OSS] Un-stale feat(entitlement): has_capacity_batch + has_capacity_batch_at + endpoints #5114 and Extend agent principals: a team of their own, and inheritance up a ladder #5204 — two feature PRs open >20 days; they're substantive (entitlement batch capacity, agent principals) and will become harder to merge as the diff ages
• [OSS/enterprise] First-wave enterprise-readiness PRs from Sunday's batch — the most impactful to land first: Dashboard cold load: overview, system-health and crons requests time out #5935 (cold-load timeouts), Attribution: project + user tags and per-project budgets (burn vs budget) #5941 (project attribution + budgets), Pricing: custom price book for negotiated rates + Azure OpenAI deployment aliases #5936 (custom price book) — these unblock cost reporting conversations before the compliance ones

---

Code activity

OSS (vivekchand/clawmetry)

• Commits: 100+ (API cap reached — actual total likely ~120)
• Lines: not computable from API; extrapolating from PR counts, likely +15,000 –8,000 across 200+ files
• Contributors: vivekchand (all substantive commits), dependabot[bot], github-actions[bot]
• Version: v0.12.843 → v0.12.876 in main; latest tagged PyPI release: v0.12.873

Cloud (vivekchand/clawmetry-cloud)

• Not available: repository is not configured for this session's GitHub scope. Add vivekchand/clawmetry-cloud to the session or run this digest from an environment with access to both repos for full cross-repo coverage.

---

Bot meta

Auto-generated 2026-09-14 07:00 UTC by the weekly digest bot. Tagged triaged so other bots leave it alone.
Cross-repo aware as of 2026-05 — cloud data missing this run due to session scope.

Previous digest: #5624 (2026-09-07)