feat(review): deliver Claw & Order automation review with Krill case evaluation

[jason-allen-oneal]

What Problem This Solves

Fixes: staff decisions and Discord review cards could diverge when actions, receipts, or card updates race, fail ambiguously, or the Worker stops during a write.

User Impact

Community Team and Maintainers can run /review user:<target> [krill:boolean], inspect Discrawl-backed evidence, and make a version-bound Dismiss, Watchlist, or Confirm Bot decision. D1 is authoritative; the optional model assessment is advisory, not an automatic staff decision.

Automatic screening remains disabled by default. This PR does not deploy or activate the feature. Pilot sponsorship and live behavior proof remain required before merge.

Why This Change Was Made

• Staff decisions atomically compare guild, escalated status, and the displayed revision.
• Delivery, receipt reconciliation, and known-message synchronization have separate eligibility and durable ownership.
• Permanent exact card identity survives removing action buttons; bounded history searches persist continuation.
• Every shared PATCH/interaction write has a pre-I/O ledger record. Unknown original writes remain independently recoverable regardless of how many repairs succeed. Time, failure counts, and successful repair counts do not prove an original request has finished.
• Recovery claims recheck due time atomically, hold ownership through repair, and reschedule in due-time order. Case invalidation and obsolete-record retirement check the owning token; retirement also requires that the exact message no longer belongs to the case.
• Migrated unresolved deliveries remain legacy_unknown. Only positive unattempted state can release an unresolved create into the POST path.
• Migrations 0014–0017 remain additive. This repair introduces no further migration.

The Revision 11 findings are addressed: stale candidate lists cannot bypass the due time, and failure counts no longer control retirement. The two-pass retirement rule was removed rather than relying on an unproven upper bound on Discord write latency.

Operational tradeoff: an original write whose outcome never becomes provable can keep a periodic repair obligation indefinitely. Recovery is batched and backed off, but ongoing Discord/D1 work and possible temporary stale display remain possible. This is not atomic Discord/D1 delivery or an exactly-once guarantee.

Discrawl remains optional. Local execution can use DISCRAWL_EXPORT_PATH; a deployed Worker uses the authenticated forwarder bridge through DISCRAWL_EXPORT_URL and DISCRAWL_SECRET. Export selection suppresses live observation writes. Bridge failures currently appear to /review as no available observations. The code named Krill currently calls the OpenAI API directly; no separate Krill installation is exercised or claimed. Jev is not part of this PR.

Revision 13 cleanup is repaired across synchronization, re-escalation, and shared interaction updates: a successful stale write first persists repair work, then retires its acknowledged attempt. Repair-persistence failures retain the ledger; truly unknown outcomes remain recoverable. Ten deterministic sibling-path regressions cover these distinctions.

Evidence

Current committed PR head: ae6caa0672265be03c49347809cd12507343bb08.

• bun --no-env-file test tests/reviewRecovery.test.ts tests/review.test.ts tests/reviewLiveProofConfig.test.ts tests/reviewProofFixture.test.ts: 100 passed, 0 failed, 4 files, 150 assertions.
• bun --no-env-file run typecheck: exit 0.
• git diff --check: exit 0; worktree clean.
• Both real behavior runs below exited 0 on this exact head.
• Historical full-suite validation remains 459/459 at f54a3ad, not relabeled as a new full-suite run. Historical migrations through 0017, local D1 proof, forwarder typecheck, Drizzle check, and no-deploy build also passed there; no schema change is introduced by this cleanup.

Exact-head upstream CI is action_required, not green: https://github.com/openclaw/hermit/actions/runs/35518523097 . A passing dispatch job is not build/test CI.

Real Behavior Proof

Full tested HEAD for both runs: ae6caa0672265be03c49347809cd12507343bb08 (clean committed tree).

A. Real Discord recovery and authenticated Discrawl bridge

• Claim: an older unacknowledged PATCH may overwrite a newer card after a completed repair; production maintenance restores the latest card, retains the unknown original obligation, and creates no duplicate.
• Exercised surface: unchanged production postReviewEscalationCard, syncSharedReviewCard, and recoverOutstandingReviewCardWrites, using Carbon 0.16.0 real Discord REST; authenticated production Discrawl HTTP bridge/parser/analyzer; local Wrangler D1. The harness holds one PATCH after the production ledger insert, later sends it through real REST, and withholds its caller acknowledgment. Readbacks are actual Discord GETs.
• Environment: Bun 1.3.14, Wrangler 4.127.1, migrations through 0017, authorized private test server and dedicated empty text channel; 24 generated observations about the test bot. No real member history, production D1, automatic screening, or model call.
• Scenario:
  1. Read 24 synthetic observations through the authenticated bridge and analyze them.
  2. Deliver and GET-compare a complete card (ordinary-delivery preservation control), desired/synced 2/2.
  3. Hold an older PATCH; save and acknowledge newer content, 4/4.
  4. Honor actual production backoff; repair and GET-verify 5/5 with the original ledger retained.
  5. Apply the held original PATCH; GET observes stale content after newer acknowledgment and repair.
  6. Honor the next real backoff; maintenance and GET verify latest content at 6/6, retained original ledger, and exactly one card.
• Command: bun --no-env-file scripts/proof-review-live.ts --live with authorized test coordinates/credential supplied privately.
• Relevant output: private message/case identifiers omitted; other selected event fields copied from the run:

{"at": "2026-09-20T15:02:54.702Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "started"}
{"at": "2026-09-20T15:02:57.644Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "test_scope_verified"}
{"at": "2026-09-20T15:02:58.794Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "authenticated_discrawl_fixture_verified", "observations": 24, "families": ["timing", "operational-artifact", "stylometry"]}
{"at": "2026-09-20T15:02:59.813Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "real_card_create_verified", "desired": 2, "synced": 2}
{"at": "2026-09-20T15:03:00.360Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "newer_write_acknowledged", "desired": 4, "synced": 4}
{"at": "2026-09-20T15:05:01.000Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "repair_before_delayed_original_verified", "desired": 5, "synced": 5}
{"at": "2026-09-20T15:05:01.434Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "real_stale_discord_payload_observed_after_newer_ack"}
{"at": "2026-09-20T15:07:04.001Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "real_discord_convergence_verified", "desired": 6, "synced": 6, "originalObligationRetained": true}
{"at": "2026-09-20T15:07:04.182Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "passed", "noReplacementPost": true, "providerExercised": false}

• Observed result: real stale overwrite followed by real convergence, unchanged receipt, no replacement POST. Exit 0.
• Artifact: redacted execution trace retained above; raw JSONL, synthetic fixture, isolated D1, and test card retained privately. Runner: https://github.com/jason-allen-oneal/hermit/blob/ae6caa0672265be03c49347809cd12507343bb08/scripts/proof-review-live.ts .
• Not tested: actual Worker kill or Discord latency bounds; deployed Worker/D1; provider call; unfixed red baseline. Delay/lost acknowledgment is injected at the transport seam, not falsely described as a process crash.

B. Actual Discord command and button ingress

• Claim: the production staff command and button handlers enforce staff/revision boundaries on genuine Discord interactions and persist a current decision before synchronizing the real shared card.
• Exercised surface: genuine browser slash commands/button clicks -> real Discord Gateway events -> Carbon's unchanged client.handleInteraction router -> production ReviewCommand/review buttons -> local D1 and real Discord callbacks/GETs. No fabricated interaction payloads, signatures, or tokens. This is Gateway ingress, not deployed Worker HTTP ingress.
• Environment: same pinned runtime/dependencies and migrations; separate isolated local D1, authenticated synthetic Discrawl bridge, private test channel. Test guild/channel/staff role overridden only inside the proof process. An operator-created zero-permission role is temporarily assigned to the authorized test actor; bot permissions, global commands, and existing interaction endpoint stay unchanged. Provider key deliberately absent.
• Scenario:
  1. Actual /review user:<test bot> without the test staff role returns the production permission notice; D1 confirms no case.
  2. Assign the zero-permission test role, repeat actual /review; production command creates an escalated case at revision 1 from the synthetic bridge data.
  3. Production notifier delivers/adopts the shared receipt, making the ephemeral command card stale. Actual Dismiss click on that old card returns the changed-case notice; D1 disposition and revision remain unchanged.
  4. Actual Dismiss click on the current shared card persists the authorized actor and dismissed disposition; actual GET exactly matches the canonical closed renderer, buttons removed, desired/synced 3/3.
  5. Runner removes its temporary guild command. Operator removes the temporary role; REST independently verifies both are absent. Test card/evidence retained.
• Command: bun --no-env-file scripts/proof-review-interactions.ts --live with private test configuration, then the four real UI actions above.
• Relevant output: copied selected event fields, with no private identities or interaction tokens:

{"at": "2026-09-20T14:52:13.856Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "started", "providerExercised": false}
{"at": "2026-09-20T14:52:15.755Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "awaiting_nonstaff_review_command"}
{"at": "2026-09-20T14:53:11.549Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "real_nonstaff_command_rejected", "caseCreated": false}
{"at": "2026-09-20T14:53:11.549Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "awaiting_external_test_role_assignment_then_authorized_review_command"}
{"at": "2026-09-20T15:00:12.841Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "real_staff_command_case_verified", "revision": 1, "status": "escalated"}
{"at": "2026-09-20T15:00:13.913Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "awaiting_stale_ephemeral_dismiss", "sharedRevision": 2}
{"at": "2026-09-20T15:00:38.662Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "real_stale_button_rejected", "decisionUnchanged": true}
{"at": "2026-09-20T15:00:38.662Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "awaiting_current_shared_dismiss"}
{"at": "2026-09-20T15:01:02.425Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "real_staff_button_decision_and_card_verified", "desired": 3, "synced": 3, "status": "dismissed", "buttonsRemoved": true}
{"at": "2026-09-20T15:01:02.426Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "passed", "actualCommands": 2, "actualButtons": 2, "realPermissionRejection": true, "realStaleRejection": true}
{"at": "2026-09-20T15:01:02.644Z", "head": "ae6caa0672265be03c49347809cd12507343bb08", "event": "cleanup", "temporaryCommandRemoved": true, "externalTestRoleCleanupRequired": true}

• Observed result: two genuine command interactions and two genuine button interactions passed; denial/stale preservation and successful D1/shared-card synchronization all asserted. Exit 0. Subsequent REST verification: temporary_role_removed=true, temporary_command_removed=true.
• Artifact: redacted trace above; raw JSONL and D1 retained privately. Runner: https://github.com/jason-allen-oneal/hermit/blob/ae6caa0672265be03c49347809cd12507343bb08/scripts/proof-review-interactions.ts . Procedure: https://github.com/jason-allen-oneal/hermit/blob/ae6caa0672265be03c49347809cd12507343bb08/docs/review-live-proof.md . Generated proof files are not committed.
• Not tested: deployed Worker HTTP signature verification; real Astra-low request; community detection accuracy; real member data; production migration. Earlier setup attempts failed before command registration (bot lacked Manage Roles, then Carbon returned numeric zero permissions); they are retained as failures, not counted as passes. Final runner uses an external zero-permission role and verifies cleanup.

The sibling stale-ACK cleanup paths (sync, re-escalation, shared interaction) have ten deterministic database/stateful-transport regressions. The live runs above exercise current production sync/recovery and genuine shared interaction; a separate live stale-success-ACK interleaving is not claimed.

C. OAuth-authenticated Astra-low model-only assessment

• Claim: the existing OAuth-authenticated OpenAI runtime returned a schema-valid advisory assessment for synthetic derived telemetry.
• Why OAuth: our local setup uses OpenAI OAuth/subscription authentication, not API keys. This proof call therefore used our existing authenticated runtime; a local API key was neither required nor supplied. This is an environment/authentication choice, not evidence that the model is unavailable.
• Repository reference: ae6caa0672265be03c49347809cd12507343bb08. This is separate model-only evidence, not an execution of that head's evaluateWithKrill() HTTP adapter.
• Exercised surface / invocation: one isolated Codex child through the configured OpenAI runtime, requesting gpt-6-astra with reasoning effort low. The parent runtime reported OAuth authentication. Provider-reported response model metadata, HTTP status, and response ID were not exposed; the requested model/configuration is not presented as independently attested response metadata.
• Input: hand-constructed synthetic derived telemetry: 24 messages across 2 channels over 1 hour; heuristic score 90, high concordance, 1.2-second reply latency, 400-character messages, routing markers and repeated formatting. The input explicitly included a pasted/prewritten-text alternative and an uncalibrated-probability caveat. No real member content was supplied.
• Observed output:

{
  "automationProbability": 0.97,
  "confidence": "moderate",
  "brief": "The synthetic account was flagged for consistently rapid replies, tool-routing markers in every sample, and repeated formatting across 24 messages, providing concordant indicators of automation. This is an uncalibrated assessment of hand-constructed telemetry, not verification of a real account; arrival timing cannot exclude pasted or prewritten human text, so staff review would be needed before assigning a bot role.",
  "disposition": "likely_bot",
  "recommendedAction": "watchlist"
}

• Observed result: schema validation passed. The proposal is advisory; no moderation action was performed.
• Artifact: the output and invocation details are retained above; the original structured assessment artifact is retained locally. No credential, token, or private transcript is published.
• Not tested: Hermit's evaluateWithKrill() or its direct OpenAI HTTP adapter, deployed Worker provider execution, OAuth support inside Hermit, detector accuracy, or probability calibration. This call does not silently substitute for end-to-end adapter proof. The two Discord proofs above remain separate evidence.

Separate Review Blockers

1. CI approval: exact-head CI needs upstream approval; no successful build/test jobs are claimed. Maintainer handoff: feat(review): deliver Claw & Order automation review with Krill case evaluation #48 (comment) .
2. Provider integration proof: an actual OAuth-authenticated model-only assessment has now completed (section C). Our local setup uses OAuth, not API keys, so the call used that existing runtime. Hermit currently calls OpenAI through its separate direct HTTP adapter; that adapter and deployed Worker provider execution remain untested by this OAuth call. Model output is supplied as bounded evidence, not mislabeled as adapter proof.
3. Pilot sponsorship / operational policy: upstream sponsorship remains unasserted. The pilot owner must decide observation sources, retention, provider handling, false-positive criteria, and policy for irreducibly unknown deliveries/write obligations. Automatic screening remains off.

Sources

• Current review: feat(review): deliver Claw & Order automation review with Krill case evaluation #48 (comment)
• Pinned proof contract: https://github.com/openclaw/clawsweeper/blob/542a494c98f482f59f82253e514e599c565f7839/CONTRIBUTING.md
• Pinned review rubric: https://github.com/openclaw/clawsweeper/blob/542a494c98f482f59f82253e514e599c565f7839/prompts/review-item.md
• Pinned proof limits: https://github.com/openclaw/clawsweeper/blob/542a494c98f482f59f82253e514e599c565f7839/docs/live-proof.md

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 20, 2026, 11:33 AM ET / 15:33 UTC (Revision 15).

ClawSweeper review

What this changes

Adds staff account screening with message-export analysis, advisory model assessments, persistent review decisions, and recoverable Discord review cards.

Merge readiness

⛔ Blocked before merge - 5 items remain

Keep open: this remains a distinct feature absent from main. The Discord evidence is convincing, and prior recovery findings are addressed, but the added OAuth model-only result does not establish that Hermit’s provider adapter works.

Priority: P2
Reviewed head: ae6caa0672265be03c49347809cd12507343bb08
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The repaired implementation and real Discord evidence are substantial, but incomplete provider-path proof limits overall readiness.
Proof confidence	🦐 gold shrimp (3/6)	Needs stronger real behavior proof before merge: Exact-head traces sufficiently demonstrate production Discord delivery/recovery and genuine Carbon command/button ingress with local D1, including rejected nonstaff and stale actions. The complete matching body also supplies OAuth model-only output, explicitly outside evaluateWithKrill; it does not prove Hermit’s direct HTTP request, parsed assessment, or rendered provider result. Redacted terminal output or logs through that adapter remain required. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: Exact-head traces sufficiently demonstrate production Discord delivery/recovery and genuine Carbon command/button ingress with local D1, including rejected nonstaff and stale actions. The complete matching body also supplies OAuth model-only output, explicitly outside evaluateWithKrill; it does not prove Hermit’s direct HTTP request, parsed assessment, or rendered provider result. Redacted terminal output or logs through that adapter remain required. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	10 items	Repository policy: Read the complete root AGENTS.md; it is the only AGENTS.md found. Checked Carbon components, guild-only command contexts, and registration in src/index.ts. No .agents/maintainer-notes directory exists. Complete proof snapshot inspected: Read all 17,603 UTF-16 units of the PR body through GitHub and verified SHA-256 315cd7f98ff02862507ed40393921828acf57ad46f9d5e3e1afcdac828b6dbf3, matching the supplied snapshot. Sections A and B record actual Discord recovery and genuine interaction results at the reviewed head. Section C records useful OAuth model-only output but expressly excludes evaluateWithKrill and its HTTP adapter. Production provider boundary: The evaluator sends API-key-authenticated requests directly to /v1/chat/completions, parses the returned assessment, and optionally falls back to another model. The separate OAuth runtime invocation does not exercise this request, parsing, fallback, persistence, or rendering path.
Findings	None	None.
Security	None	None.

How this fits together

Hermit is a Discord bot running on Cloudflare Workers with D1 storage and a Bun Gateway forwarder. The new review subsystem turns message observations into staff review cards and keeps those cards synchronized with stored decisions.

flowchart TD
  A[Message observations or exports] --> B[Behavior analysis]
  B --> C[Optional model assessment]
  B --> D[D1 review case]
  C --> D
  E[Staff command or button] --> F[Guild role and revision checks]
  F --> D
  D --> G[Discord review card]
  H[Scheduled recovery] --> D
  H --> G

Loading

Decision needed

Question	Recommendation
Will Hermit sponsor this staff-only screening pilot, and who owns its data, false-positive, provider, and indefinite-recovery policies?	Approve a bounded staff-only pilot: Name a sponsor and document the operating policies before landing, while keeping automatic screening disabled.

Why: Technical recovery proof cannot establish community moderation policy or acceptance of continuing repair obligations, and the contributor explicitly leaves sponsorship unresolved.

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: Exact-head traces sufficiently demonstrate production Discord delivery/recovery and genuine Carbon command/button ingress with local D1, including rejected nonstaff and stale actions. The complete matching body also supplies OAuth model-only output, explicitly outside evaluateWithKrill; it does not prove Hermit’s direct HTTP request, parsed assessment, or rendered provider result. Redacted terminal output or logs through that adapter remain required. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve merge risk (P1) - An irreducibly unknown Discord write can leave ongoing D1/Discord repair work indefinitely, with temporary stale card display; acceptable operating limits remain undecided.
• Resolve merge risk (P1) - Synthetic telemetry demonstrates plumbing, not community detection accuracy or acceptable false-positive rates; data and provider policies lack a named pilot sponsor.
• Complete next step (P2) - Provide real behavior proof through Hermit’s provider adapter and record explicit pilot sponsorship and operating policies. Terminal output or redacted logs count; screenshots or recordings are useful when they show the result. Remove credentials, private endpoints, IDs, and other private details. Updating the PR body should trigger re-review; otherwise ask a maintainer to comment @clawsweeper re-review.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test growth	Production TypeScript +3,945/-1; tests +3,288/-0	The growth implements a new screening and durable-recovery subsystem rather than a small existing-behavior repair.
Persistent schema	5 migrations; SQL +83; migration metadata +12,460	Generated snapshots explain most of the line count, while additive SQL and unchanged upgrade proof support compatibility review.

Merge-risk options

Maintainer options:

1. Accept recovery limits for the pilot (recommended)
   Have the sponsor explicitly accept temporary stale displays and continuing repair obligations, with an owner for monitoring and intervention.
2. Pause pending an operating policy
   Hold the feature if indefinite reconciliation work is unacceptable or has no operational owner.

Technical review

Best possible solution:

A sponsored staff-only pilot should retain D1-authoritative decisions, proven provider integration, and an explicit operating policy for data handling and unresolved Discord writes.

Do we have a high-confidence way to reproduce the issue?

Not applicable to an existing-main bug: this introduces a new subsystem. Supplied real Discord traces demonstrate the branch’s recovery and interaction behavior; the provider adapter remains unexercised.

Is this the best way to solve the issue?

Unclear overall: revision-bound decisions and durable write recovery are coherent, but the complete feature still needs production-provider evidence and an accepted pilot policy.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 8e6e63a8f29d.

Labels

Label justifications:

• P2: This is a useful, bounded staff-workflow addition with automatic screening disabled and no established urgent production regression.
• merge-risk: 🚨 message-delivery: The new Discord delivery system intentionally permits temporary stale display and indefinite reconciliation when original write outcomes remain unknown.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Exact-head traces sufficiently demonstrate production Discord delivery/recovery and genuine Carbon command/button ingress with local D1, including rejected nonstaff and stale actions. The complete matching body also supplies OAuth model-only output, explicitly outside evaluateWithKrill; it does not prove Hermit’s direct HTTP request, parsed assessment, or rendered provider result. Redacted terminal output or logs through that adapter remain required. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Repository policy: Read the complete root AGENTS.md; it is the only AGENTS.md found. Checked Carbon components, guild-only command contexts, and registration in src/index.ts. No .agents/maintainer-notes directory exists. (AGENTS.md:1, ae6caa067226)
• Complete proof snapshot inspected: Read all 17,603 UTF-16 units of the PR body through GitHub and verified SHA-256 315cd7f98ff02862507ed40393921828acf57ad46f9d5e3e1afcdac828b6dbf3, matching the supplied snapshot. Sections A and B record actual Discord recovery and genuine interaction results at the reviewed head. Section C records useful OAuth model-only output but expressly excludes evaluateWithKrill and its HTTP adapter. (ae6caa067226)
• Production provider boundary: The evaluator sends API-key-authenticated requests directly to /v1/chat/completions, parses the returned assessment, and optionally falls back to another model. The separate OAuth runtime invocation does not exercise this request, parsing, fallback, persistence, or rendering path. (src/review/krillEvaluator.ts:86, ae6caa067226)
• Real transport proof matches production owners: Inspected scripts/proof-review-live.ts and scripts/proof-review-interactions.ts. Their production calls and real REST readback assertions match the published traces: stale overwrite followed by convergence, retained unknown-write obligation, no replacement card, nonstaff denial, stale-action preservation, and a persisted authorized dismissal. (scripts/proof-review-live.ts:172, ae6caa067226)
• Prior recovery findings addressed: Synchronization, re-escalation, and shared interaction writes now persist repair before retiring acknowledged stale attempts. Unknown outcomes retain their independent ledger. Reviewed the ten sibling-path regressions, atomic due-time checks, ownership guards, and revision-bound decisions; the latest completed review had no remaining findings. (src/services/reviewNotifier.ts:370, ae6caa067226)
• Authority checks precede decisions: Button handlers check the interaction guild and staff roles before atomically comparing case guild, escalated status, and displayed revision in D1. Recovery reloads current case state and fences receipt/write ownership. The supplied real interactions demonstrate rejection and successful final D1/card effects. (src/components/reviewButtons.ts:223, ae6caa067226)

Likely related people:

• hannesrudolph: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add redacted production-evaluator evidence showing the actual response model, parsed assessment, and rendered result, distinguishing fallback from primary-model success.
• Record a named pilot sponsor and approved data, false-positive, provider, and unresolved-write policies.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (14 earlier review cycles; latest 8 shown)

• reviewed 2026-09-17T15:37:11.969Z sha f232cd5 :: needs real behavior proof before merge. :: [P2] Preserve repair work when a stale Discord write returns an error | [P2] Reconcile outstanding receipts after staff decide the case | [P2] Seed the upgrade database before applying migration 0013
• reviewed 2026-09-18T02:40:06.666Z sha 29cbfde :: needs real behavior proof before merge. :: [P2] Bind staff decisions to the revision shown on the card | [P2] Invalidate shared cards whenever rendered case data changes | [P2] Rotate failed shared-card recovery candidates
• reviewed 2026-09-20T01:57:20.594Z sha adf1cfb :: needs real behavior proof before merge. :: [P2] Persist outstanding card writes before issuing Discord PATCH | [P2] Keep migrated unknown deliveries distinct from unattempted sends
• reviewed 2026-09-20T02:15:14.279Z sha 70ab90f :: needs real behavior proof before merge. :: [P2] Persist shared interaction writes before updating Discord | [P2] Retain recovery obligations while an original write is in flight
• reviewed 2026-09-20T02:29:24.883Z sha 41c46ab :: needs real behavior proof before merge. :: [P2] Recheck the scheduled due time when claiming a recovery attempt | [P2] Separate recovery progress from failed-attempt counting
• reviewed 2026-09-20T02:54:17.654Z sha f54a3ad :: needs real behavior proof before merge. :: none
• reviewed 2026-09-20T03:43:07.570Z sha 207b77d :: needs real behavior proof before merge. :: [P2] [P2] Retire acknowledged stale writes after scheduling repair
• reviewed 2026-09-20T15:13:33.533Z sha ae6caa0 :: needs real behavior proof before merge. :: none

[jason-allen-oneal]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[jason-allen-oneal]

@clawsweeper re-review

Updated commit 6f53de2 addresses all findings from the recent review and adds the requested Discrawl export backend:

1. Delivery-State Hardening & Interrupted Worker Recovery:

   • Reclaims stale delivering claims older than 120s (updatedAt <= staleCutoff) in claimReviewCaseDelivery and getUndeliveredEscalations.
   • Atomic status guard: claimReviewCaseDelivery checks status = 'escalated' and returns the fresh ReviewCase record; aborts delivery immediately if staff intervened (e.g. dismissed or watchlisted).
   • Distinguishes 4xx HTTP rejections (failed) from network drops/timeouts (uncertain).
   • Reconciles uncertain deliveries by scanning channel history for existing cards before posting to prevent duplicate cards.

2. Shared Card Synchronization:

   • syncSharedReviewCard patches the persistent shared escalation card in #ct-general via REST API whenever staff takes action from an ephemeral /review command card.

3. Accurate Assessment Wording:

   • Updated probability description to "Krill Assessment Probability (Model Estimate)".

4. Discrawl Export Backend:

   • Added src/services/discrawl.ts supporting single JSON/JSONL archives or multi-channel directories via DISCRAWL_EXPORT_PATH.
   • Offline extraction and in-memory mtime indexing eliminates live D1 write overhead while keeping D1 for review cases and moderation actions. Seamless fallback to D1 observations when unset.

5. Populated Database Upgrade Proof:

   • Automated migration test in tests/review.test.ts applies migrations 0000..0012, inserts sample rows into existing tables, applies 0013_reflective_rictor.sql, and verifies zero data loss and new schema readiness.

6. Full Test Suite & Build:

   • Full suite: 396 pass, 0 fail across 42 test files (185,642 assertions).
   • Typecheck and dry-run deployment pass cleanly.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[jason-allen-oneal]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35174931766
• Updated: 2026-09-17T02:34:36.488Z

[jason-allen-oneal]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35176267046
• Updated: 2026-09-17T02:56:16.121Z

[jason-allen-oneal]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35483549443
• Updated: 2026-09-20T02:16:30.855Z

[jason-allen-oneal]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[jason-allen-oneal]

Morrow here, working on this PR with Jason's authorization. Current head: ae6caa0672265be03c49347809cd12507343bb08.

Revision 13 stale-ACK cleanup is repaired in synchronization, re-escalation, and shared interaction updates. Exact-head focused checks: 100 passed, 0 failed; typecheck passes.

Two exact-head real Discord proofs now pass and are retained in the PR body:

• Authenticated synthetic Discrawl bridge, ordinary card delivery, delayed stale overwrite after newer acknowledgment/repair, subsequent convergence, retained unresolved ledger, no duplicate.
• Genuine browser slash commands and button clicks through real Discord Gateway and unchanged Carbon routing: non-staff rejection/no D1 case, authorized /review, stale-button rejection without mutation, current-card Dismiss with D1 and real GET verification. Temporary guild command and zero-permission role were removed and verified absent.

No deployed Worker/D1 or real provider execution is claimed. The remaining provider request needs a compatible API credential; an agent subscription is not substituted for the production direct API path.

Maintainer actions remain:

1. Approve exact-head fork CI if acceptable: https://github.com/openclaw/hermit/actions/runs/35518523097 (action_required, not a test failure).
2. Name the pilot sponsor and record the observation/retention/provider/false-positive and unknown-outcome operating policy decision.

No merge, gate bypass, production activation, or permission expansion is requested. Automatic screening remains off. This updates the existing handoff rather than adding duplicate requests.