feat: synchronize immutable curated plugin releases

[Patrick-Erichsen]

Curated sources now synchronize into immutable releases: unchanged hashes are skipped, changed bytes repeat source validation and normal security checks, and reused upstream versions receive a source-hash suffix. Missing sources, identity changes, pending scans, historical rollbacks and adopted company publishers produce explicit operator decisions without overwriting the last safe release.

A reviewed company replacement publishes and redirects its registry predecessor in one transaction. Public discovery shows one canonical result; old version downloads retain their original bytes. Exact download and file routes now reject pending and blocked updates, closing a gap exposed by the real update acceptance test.

The scheduled workflow is disabled by default and runs only approved source identities on main in the Production environment. Initial bytes must match the reviewed hash; activation requires the staff token and explicit repository opt-in. The operator README covers planning, digest-bound application, custody, replacement and reporting.

Validation includes required static, coverage, type/build, package and HTTP gates, focused immutable/replacement regressions, and the real local ClawHub → archive download → OpenClaw 2026.9.3 acceptance flow. Controlled worker verdicts exercise pending, clean and malicious outcomes; they are not live ClawScan provider certification.

Final local gates: 6,547 unit tests, 17 public browser smoke checks, and the 2.5-minute catalog/download/update/replacement/OpenClaw acceptance run pass. Review findings were adjudicated against the approved scheduling contract and actual runtime proof; accepted findings are fixed. The final empty-list schema alignment and strict published-target guard were manually reviewed and covered through real Convex publication/replacement regressions.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Sep 9, 2026 4:09am UTC

[clawsweeper]

Codex review: blocked before merge. Reviewed September 9, 2026, 8:33 AM ET / 12:33 UTC (Revision 3).

ClawSweeper review

What this changes

Adds scheduled synchronization of curated plugins into immutable releases, reviewed company-package replacements, historical download preservation, publication visibility checks, and operator reports.

Regression provenance

Possible regression — suspected (reviewed change). No predecessor PR is attributed.

Merge readiness

⛔ Blocked before merge - 6 items remain

This remains useful work absent from current main. Both previously reported blockers remain on the unchanged head; the attached runtime evidence supports the feature but does not resolve those findings.

Priority: P2
Reviewed head: 5979ee9a00ad21b1db7ab6203ef4c5669375d380

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Useful implementation and convincing real-path evidence are limited by two unchanged, concrete blockers.
Proof confidence	🐚 platinum hermit (4/6) ✨ media proof bonus	Sufficient (linked_artifact): The linked report for candidate ad61c85 exercises the real local ClawHub publication, synchronization, catalog, and download paths, records immutable updates and a canonical redirect, and includes four OpenClaw installation transcripts. The screenshot confirms the resulting company package page; worker verdicts are controlled fixtures. This supports the feature but does not resolve the two source-proven findings.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): The linked report for candidate ad61c85 exercises the real local ClawHub publication, synchronization, catalog, and download paths, records immutable updates and a canonical redirect, and includes four OpenClaw installation transcripts. The screenshot confirms the resulting company package page; worker verdicts are controlled fixtures. This supports the feature but does not resolve the two source-proven findings.
Evidence reviewed	10 items	Policy and ownership boundary: Read the complete root AGENTS.md and applicable ClawHub maintainer, Convex, and retention guidance. No ancestor-scoped AGENTS.md beyond the root applies to the changed paths, and .agents/maintainer-notes is absent. The origin remote verifies the target repository. Pinned introduction and review continuity: Inspected the merge-base-to-head changes across all 27 files. The checkout remains the previously reviewed 5979ee9; the two implicated files have no changes since that review. The stale test merge was not used to infer removals from main. Historical audit identity remains broken: The introduced followCanonical condition redirects unversioned detail requests. src/routes/plugins/$name/security-audit.tsx:42 still calls fetchPackageDetail(candidateName) without requestedVersion; src/lib/packageApi.ts:524 does not accept a version. The publisher audit route then redirects using the replacement package name while retaining the historical version string.
Findings	2 actionable findings	[P1] Preserve the original package on version-pinned security audits [P2] Write the failure report before preparing incomplete registry snapshots
Security	Needs attention	Historical security reports can describe replacement bytes: Canonical detail resolution changes the package identity used by version-pinned audit pages, allowing users to see the replacement package's verdict for an original artifact download.

How this fits together

ClawHub imports reviewed plugin sources through its existing publication and security-check pipeline. Synchronization compares source hashes, publishes changed artifacts, and directs catalog visitors to the canonical package while preserving historical releases.

flowchart TD
  A[Reviewed source manifest] --> B[Fetch and validate sources]
  B --> C[Compare hashes and release state]
  C --> D[Skip or report operator decision]
  C --> E[Publish through security checks]
  E --> F[Immutable release]
  F --> G[Canonical catalog and redirects]
  F --> H[Historical downloads and audits]

Loading

Before merge

• Preserve the original package on version-pinned security audits (P1) - This prior finding remains. loadPluginSecurityAudit calls fetchPackageDetail(candidateName) without the requested version, so this new canonical-following request returns the company package. The publisher audit route then redirects to that package while preserving the old version string. If both packages contain that version, the page shows the replacement artifact's report while the pinned download serves the original bytes; otherwise the historical audit becomes unavailable. Pass the version through detail resolution and retain the original package for pinned audits.
• Write the failure report before preparing incomplete registry snapshots (P2) - This prior finding remains. When fetchSnapshot fails for a repository listed in manifest.registries, the new catch records the error and continues, but prepareBatch reaches inventoryPlugins, which throws Missing registry snapshot before the report is written. The scheduled run therefore cannot retain the promised source-error report. Persist the failure report before inventory preparation, then abort application; cover a configured-registry fetch failure with zero publication.
• Resolve security concern: Historical security reports can describe replacement bytes - Canonical detail resolution changes the package identity used by version-pinned audit pages, allowing users to see the replacement package's verdict for an original artifact download.
• Resolve merge risk (P1) - Existing version-pinned security-audit links can show a different artifact's report after canonical replacement; the supplied browser proof does not cover that compatibility boundary.
• Resolve merge risk (P1) - The scheduled workflow may have no operator report to upload after a configured registry fetch fails.
• Complete next step (P2) - Repair version-pinned audit resolution and registry-failure report retention, then complete the two retained validation moves.

Findings

• [P1] Preserve the original package on version-pinned security audits — convex/httpApiV1/packagesV1.ts:4183-4184
• [P2] Write the failure report before preparing incomplete registry snapshots — scripts/company-plugins/sync-cli.ts:89-93
• [medium] Historical security reports can describe replacement bytes — convex/httpApiV1/packagesV1.ts:4183

Agent review details

Security

Needs attention: Historical audit redirects can associate a security verdict with the wrong artifact; no additional authorization or supply-chain regression was established.

Review metrics

Metric	Value	Why it matters
Diff size	+1,152/-22 across 27 files	The change spans publication, public APIs, operator tooling, schemas, and acceptance coverage.
Production and test LOC	Production +523/-19; tests +573/-2; docs +50; generated +6/-1	Production growth supports the stated synchronization feature and is accompanied by substantial regression and acceptance coverage.

Merge-risk options

Maintainer options:

1. Preserve historical audit identity (recommended)
   Pass the requested version through package-detail resolution and demonstrate that an old audit still describes the exact old downloaded artifact after replacement.
2. Retain reports on registry failure
   Save collected source errors before preparing an incomplete inventory and verify that failure produces a report with zero publication.

Technical review

Best possible solution:

Keep immutable publication and transactional replacement, while preserving package/version identity throughout historical audits and retaining failure reports before any publication attempt.

Do we have a high-confidence way to reproduce the issue?

Yes, source establishes both patch defects: open a version-pinned audit after replacing its package, or fail a fetch for a configured registry before inventory preparation. These paths were traced without executing target code.

Is this the best way to solve the issue?

The architecture is appropriate: it reuses the existing publisher rather than creating a parallel release store. It remains incomplete at the audit consumer and failure-report boundary; fixing those callers is narrower than removing canonical redirects or weakening inventory validation.

Full review comments:

• [P1] Preserve the original package on version-pinned security audits — convex/httpApiV1/packagesV1.ts:4183-4184
  This prior finding remains. loadPluginSecurityAudit calls fetchPackageDetail(candidateName) without the requested version, so this new canonical-following request returns the company package. The publisher audit route then redirects to that package while preserving the old version string. If both packages contain that version, the page shows the replacement artifact's report while the pinned download serves the original bytes; otherwise the historical audit becomes unavailable. Pass the version through detail resolution and retain the original package for pinned audits.
  Confidence: 0.99
• [P2] Write the failure report before preparing incomplete registry snapshots — scripts/company-plugins/sync-cli.ts:89-93
  This prior finding remains. When fetchSnapshot fails for a repository listed in manifest.registries, the new catch records the error and continues, but prepareBatch reaches inventoryPlugins, which throws Missing registry snapshot before the report is written. The scheduled run therefore cannot retain the promised source-error report. Persist the failure report before inventory preparation, then abort application; cover a configured-registry fetch failure with zero publication.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.97

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 6b25e866fb91.

Labels

Label changes:

• add P2: This is a bounded curated-publication improvement whose scheduled activation remains disabled.
• add merge-risk: 🚨 compatibility: Canonical redirects break the identity contract of existing version-pinned security-audit links.
• add merge-risk: 🚨 automation: The new scheduled synchronization path can fail before saving the operator artifact it promises to retain.
• add proof: sufficient: Contributor real behavior proof is sufficient. The linked report for candidate ad61c85 exercises the real local ClawHub publication, synchronization, catalog, and download paths, records immutable updates and a canonical redirect, and includes four OpenClaw installation transcripts. The screenshot confirms the resulting company package page; worker verdicts are controlled fixtures. This supports the feature but does not resolve the two source-proven findings.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🐚 platinum hermit and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (linked_artifact): The linked report for candidate ad61c85 exercises the real local ClawHub publication, synchronization, catalog, and download paths, records immutable updates and a canonical redirect, and includes four OpenClaw installation transcripts. The screenshot confirms the resulting company package page; worker verdicts are controlled fixtures. This supports the feature but does not resolve the two source-proven findings.

Label justifications:

• P2: This is a bounded curated-publication improvement whose scheduled activation remains disabled.
• merge-risk: 🚨 compatibility: Canonical redirects break the identity contract of existing version-pinned security-audit links.
• merge-risk: 🚨 automation: The new scheduled synchronization path can fail before saving the operator artifact it promises to retain.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🐚 platinum hermit and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (linked_artifact): The linked report for candidate ad61c85 exercises the real local ClawHub publication, synchronization, catalog, and download paths, records immutable updates and a canonical redirect, and includes four OpenClaw installation transcripts. The screenshot confirms the resulting company package page; worker verdicts are controlled fixtures. This supports the feature but does not resolve the two source-proven findings.
• proof: sufficient: Contributor real behavior proof is sufficient. The linked report for candidate ad61c85 exercises the real local ClawHub publication, synchronization, catalog, and download paths, records immutable updates and a canonical redirect, and includes four OpenClaw installation transcripts. The screenshot confirms the resulting company package page; worker verdicts are controlled fixtures. This supports the feature but does not resolve the two source-proven findings.

Evidence

Security concerns:

• [medium] Historical security reports can describe replacement bytes — convex/httpApiV1/packagesV1.ts:4183
  Canonical detail resolution changes the package identity used by version-pinned audit pages, allowing users to see the replacement package's verdict for an original artifact download.
  Confidence: 0.99

What I checked:

• Policy and ownership boundary: Read the complete root AGENTS.md and applicable ClawHub maintainer, Convex, and retention guidance. No ancestor-scoped AGENTS.md beyond the root applies to the changed paths, and .agents/maintainer-notes is absent. The origin remote verifies the target repository. (AGENTS.md:1, 5979ee9a00ad)
• Pinned introduction and review continuity: Inspected the merge-base-to-head changes across all 27 files. The checkout remains the previously reviewed 5979ee9; the two implicated files have no changes since that review. The stale test merge was not used to infer removals from main. (5979ee9a00ad)
• Historical audit identity remains broken: The introduced followCanonical condition redirects unversioned detail requests. src/routes/plugins/$name/security-audit.tsx:42 still calls fetchPackageDetail(candidateName) without requestedVersion; src/lib/packageApi.ts:524 does not accept a version. The publisher audit route then redirects using the replacement package name while retaining the historical version string. (convex/httpApiV1/packagesV1.ts:4183, 5979ee9a00ad)
• Failure reporting remains unreachable for missing registry snapshots: Snapshot fetch failures are collected, but prepareBatch executes before the report write. inventoryPlugins throws at scripts/company-plugins/inventory.ts:240 when a configured registry snapshot is absent, preventing the report and its collected errors from being saved. (scripts/company-plugins/sync-cli.ts:90, 5979ee9a00ad)
• Real API and installation evidence: Inspected the downloaded package screenshot and linked report at https://github.com/openclaw/clawhub/tree/qa-artifacts/clawhub-ui-proof/pr-3644/immutable-company-plugin-sync. Report SHA-256 is e8041dab2087d3f6468e9fe09ab7f5c8072ed5e2a0ec9799ba705effeb99bac2. It identifies candidate ad61c85, local ClawHub at http://127.0.0.1:4590, controlled worker verdicts, unchanged-hash decisions, a hash-suffixed update, a 307 replacement redirect, three canonical catalog entries, and four successful OpenClaw 2026.9.3 installations. It does not demonstrate historical audit-page identity or registry-fetch failure reporting.
• Authority and publication checks: Replacement checks active admin status, matching integration/job, registry-to-company authorship, a clean published target, and current target custody before persisting the alias. Publication applies the replacement in the same mutation and revalidates curated publisher custody. Canonical reads independently apply the target package's visibility checks. No additional reachable authorization bypass was established. (convex/curatedPlugins.ts:155, 5979ee9a00ad)

Likely related people:

• Patrick-Erichsen: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Fix pinned audit identity and demonstrate distinct original and replacement hashes and reports in the real browser flow.
• Add a configured-registry fetch failure regression that verifies report retention and zero publication.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-09-09T03:22:47.372Z sha ad61c85 :: blocked before merge. :: [P1] Preserve the original package on version-pinned security audits | [P2] Write the failure report before preparing incomplete registry snapshots
• reviewed 2026-09-09T04:11:03.053Z sha 5979ee9 :: blocked before merge. :: [P1] Preserve the original package on version-pinned security audits | [P2] Write the failure report before preparing incomplete registry snapshots

[Patrick-Erichsen]

ClawHub UI Proof

Status: passed
Mode: feature
Scenario: immutable-company-plugin-sync
Provider: local Convex/dev-auth; real Playwright Chromium; controlled security-worker fixtures
Baseline: not run for feature proof.
Candidate: ad61c852ff

Canonical company package after immutable update and redirect

Raw proof files: https://github.com/openclaw/clawhub/tree/qa-artifacts/clawhub-ui-proof/pr-3644/immutable-company-plugin-sync