feat: add publisher feed query and delta state

[giodl73-repo]

Summary

Adds the durable publisher-feed query and changed-since foundation defined by RFC 0009.

• stores contiguous publisher-feed revisions and append-only metadata/upsert/removal change records
• establishes safe zero-change baselines for pre-history publications and returns reset-required when a client cannot reconstruct prior state
• adds bounded deterministic publisher query projections with exact NFC/ASCII-whitespace normalization
• adds bounded changed-since projections backed by contiguous global change numbers
• validates retained change continuity before returning a page
• adds strict schema types for future signed publisher query, change, and reset payloads

Stack

• Depends on feat: add publisher feed model API #2948 for the coherent publisher snapshot and stable publisher identity.
• Protocol contract: RFC 0009: align Hosted Feed v1 specifications rfcs#39.
• A signer-dependent child PR will expose the public DSSE query/change routes after ClawHub feat(feeds): add dormant catalog signing foundation #3005 is available.

This PR intentionally exposes no unsigned public query or delta endpoint.

Storage

Adds:

• publisherFeedRevisions: one row per accepted contiguous revision
• publisherFeedChanges: one row per metadata replacement, complete entry upsert, or removal tombstone
• optional cumulativeChangeCount on current publications for upgrade-safe baseline establishment

The current snapshot remains in publisherFeedPublications. All revision/change writes occur in the same Convex mutation as snapshot publication.

Validation

• bun x vitest run packages/schema/src/accountFeed.test.ts convex/accountFeeds.test.ts convex/lib/retentionPolicy.test.ts (24 tests)
• bun x tsc -p packages/schema/tsconfig.json --noEmit
• bun x tsc --noEmit
• bun run lint
• Knip files/dependencies/exports through bun x knip@6.8.0
• targeted oxfmt --check
• git diff --check
• iterative codex review --uncommitted; final pass found no discrete correctness, security, or maintainability defects

The full local ci:static wrapper stops on pre-existing formatter drift in root CLAUDE.md files outside this branch; all changed files pass targeted formatting.

[vercel]

Someone is attempting to deploy a commit to the OpenClaw Foundation Team on Vercel.

A member of the Team first needs to authorize it.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed July 22, 2026, 1:32 AM ET / 05:32 UTC.

Summary
The branch adds durable publisher-feed revision and change state, publisher query/change projections, related HTTP/OpenAPI contracts, retention policies, schema types, specs, and focused tests.

Reproducibility: not applicable. as a defect report: this PR proposes a new publisher-feed query and delta capability rather than repairing an established broken behavior.

Review metrics: 2 noteworthy metrics.

• Patch surface: 25 files affected; 3,478 additions and 111 deletions. The branch combines storage, HTTP/OpenAPI, schema, retention, specs, and tests, so it needs stack-level review rather than isolated endpoint approval.
• Persistent feed state: 3 publisher-feed collections added. The revision, change, and publication collections create an upgrade-sensitive data and protocol boundary.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🦐 gold shrimp
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P1] Add redacted real Convex/API output covering publication, query/change paging, reset-required, retention, and upgrade behavior.
• Obtain explicit maintainer confirmation of the RFC-aligned publisher-feed contract and stacked landing order.

Proof guidance:

• [P1] Needs real behavior proof before merge: The PR has tests and successful CI, but no after-fix run from a real Convex/API setup; add redacted live HTTP or terminal output for publication, query/change pages, reset-required, retention, and an upgrade baseline, then update the PR body for re-review.

Risk before merge

• [P1] Merging establishes a persistent publisher-feed protocol and retained data model while the parent foundation and RFC-dependent distribution design remain unmerged, so later contract changes may require compatibility or migration work.
• [P1] The branch has not demonstrated live publication-to-query/change/reset and upgrade-baseline behavior in a real Convex/API setup; tests and green CI do not prove that operational path.

Maintainer options:

1. Stage after contract confirmation (recommended)
   Keep this draft open until maintainers confirm the publisher-feed protocol and dependency order, then require real upgrade and runtime proof before merge.
2. Accept the protocol surface now
   Maintainers may explicitly accept the persistent revision/change contract and own any later compatibility or migration work across the feed stack.

Next step before merge

• [P1] A maintainer must decide the permanent publisher-feed protocol and dependency order; contributor-supplied real behavior proof is also required before merge.

Maintainer decision needed

• Question: Should ClawHub adopt this durable publisher-feed delta contract and land it only after the publisher-feed foundation and RFC-aligned protocol order are confirmed?
• Rationale: The patch creates a durable protocol and storage boundary shared by the open parent and signed-route child, so the permanent contract and merge sequence require maintainer intent rather than a mechanical repair.
• Likely owner: Patrick-Erichsen — Patrick is the only evidenced non-author routing candidate connected to the prior exact-head review of the shared publisher-feed foundation.
• Options:
  • Confirm and stage the feed contract (recommended): Approve the publisher-feed direction, land the parent foundation first, then rebase and review this delta layer with real behavior proof.
  • Pause the feed stack: Defer this storage and protocol surface until the RFC and intended consumer/distribution contract are accepted.

Security
Cleared: The supplied diff adds no third-party dependency, secret handling, or broader authorization mechanism; its public feed surface is explicitly constrained to discovery data.

Review details

Best possible solution:

Confirm the publisher-feed contract and stack order, land the foundation in dependency order, then demonstrate the complete publisher publication, query/change, reset, retention, and upgrade path against a real Convex deployment before merging.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a defect report: this PR proposes a new publisher-feed query and delta capability rather than repairing an established broken behavior.

Is this the best way to solve the issue?

Unclear: durable change state is a plausible foundation, but the best solution depends on maintainer acceptance of the still-open parent, RFC-aligned contract, and intended landing order.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a9775fc39b10.

Label changes

Label justifications:

• P2: This is a substantial but non-emergency publisher-feed infrastructure feature whose user-facing protocol is still awaiting maintainer confirmation.
• merge-risk: 🚨 compatibility: The branch adds durable revision/change state and publisher-feed API contracts that clients or follow-on signed routes may depend on.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR has tests and successful CI, but no after-fix run from a real Convex/API setup; add redacted live HTTP or terminal output for publication, query/change pages, reset-required, retention, and an upgrade baseline, then update the PR body for re-review.

Evidence reviewed

What I checked:

• Persistent publisher-feed contract: The branch adds publisherFeedPublications, publisherFeedRevisions, and publisherFeedChanges, establishing stored revision/change semantics rather than a narrow read-only query helper. (convex/schema.ts:2682, 37f27458e2a9)
• Stacked dependency remains open: The PR body declares an explicit dependency on the still-open publisher-feed foundation at feat: add publisher feed model API #2948; the signed-route child at feat: serve signed publisher feed projections #3117 also remains open and depends on this layer. (37f27458e2a9)
• No post-fix runtime proof: The PR body supplies unit/type/lint/CI validation, but the discussion contains no redacted live Convex or HTTP evidence covering publication, query/change paging, reset-required behavior, retention, and an upgrade baseline. (37f27458e2a9)
• Previous review blocker remains applicable: The prior ClawSweeper review at feat: add publisher feed query and delta state #3116 (comment) requested real behavior proof and a maintainer choice on protocol/stack landing order; the supplied follow-up context shows no proof artifact or maintainer decision. (37f27458e2a9)

Likely related people:

• Patrick-Erichsen: The open publisher-feed foundation describes fixes addressing Patrick's exact-head review, making Patrick the clearest available routing candidate for the shared publisher identity and feed-contract boundary. (role: adjacent reviewer; confidence: low; files: convex/lib/publishers.ts, convex/publishers.ts, convex/schema.ts)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

• reviewed 2026-07-18T03:32:56.846Z sha ead5260242df338230ce8629b9e366f36f72b344 :: needs real behavior proof before merge. :: none

[github-actions]

This pull request has been automatically marked as stale due to inactivity.
Please update it or it will be closed.

[github-actions]

Closing due to inactivity.
If this PR should be revived, reopen it with current context and a fresh validation plan.