fix(setup): validate current OpenClaw package lifecycle

[TheAngryPit]

Summary

• Problem: Windows Companion setup must install the exact OpenClaw package declared by its reviewed composition proof. A changed HTTP response must not reach the installer without matching that artifact.
• Impact: Without a package-consumption boundary, a substituted or corrupted composed package could be consumed after CI selected the intended source.
• Changed behavior: CI builds one package from frozen OpenClaw inputs, records its SHA-256, carries that digest through the Setup Engine contract, and verifies the downloaded response before the official installer consumes the same local .tgz.
• User impact: Official stable 2026.7.1 remains the embedded LKG and minimum security floor. The compatibility candidate is separately composed from official 2026.7.2-beta.5 plus the bounded wizard lifecycle correction. Digest mismatch fails closed before installation.
• Non-goals: This PR does not publish the composed package as an official OpenClaw release, transfer Core ownership into Windows Companion, alter LKG rollback semantics, add permissions, or modify tokens, secrets, models, memory, plugins, or command authority.

Change Type

• Bug fix
• Feature
• Refactor
• Docs or instructions
• Tests or validation
• Security hardening
• Chore or infrastructure

Scope

• Tray or WinUI UX
• Windows node capability
• Local MCP or winnode
• Gateway, connection, or pairing
• Setup or onboarding
• Permissions, privacy, or security
• Tests, CI, or docs

Linked work

• Related Windows Node issue: Keep Windows Companion aligned with current OpenClaw stable and beta releases #1000
• Core lifecycle fix, merged: fix(gateway): hosted setup exits no longer stop the gateway openclaw#115671
• Core settlement/install-daemon follow-up, merged: fix(gateway): prevent overlapping setup after wizard cancellation openclaw#115856
• Superseded Core PR with preserved authorship history: fix(gateway): isolate wizard exits from shared process openclaw#110382
• OpenClaw package-runner contract, merged: fix(release): stop Windows package descendants after timeout openclaw#111956

Frozen composition and artifact

Exact-head CI run: 30463588149

• Windows Node PR head: 19145d0e6c2d895a537235112833d529d51034fe
• Official OpenClaw source tag: v2026.7.2-beta.5
• Official OpenClaw source SHA: ee929dbb857c717a60f3b2b502db5a6dd31b5c11
• Upstream #115671 prepared head represented by the three-file lifecycle patch: c6b4e912eb103fe8ceb89ffc2a60411624163b4b
• Upstream #115671 landed squash: 1dd28f1bca984efcdec6a6c537a5a8426694d1b2
• Frozen compatibility head: 2a3612054f6cacce893526c16ce37daa94ba9abf
• Compatibility patch SHA-256: adad475a3018b523306c7c002c5d91efadeecdf7cc61a9ffb723c85600a39dd7
• Artifact: openclaw-2026.7.2-beta.5-hosted-wizard.tgz
• Package SHA-256: 967f413f9970c76cb51c0c11477fb61be552564a2f67a2004843ea5910209f7e
• Package size: 34,219,052 bytes
• Internal package version: 2026.7.2-beta.5

The uploaded artifact openclaw-beta5-hosted-wizard-composed contains provenance.json, SHA256SUMS, and the package. CI verifies the source SHA, compatibility base and head, patch hash, five-path allowlist, internal package version, and final package digest before any composed E2E consumer runs.

The three Gateway files are the beta-5 projection of the lifecycle correction that landed through #115671. The remaining two setup.finalize files adapt that correction to beta 5's published-model-catalog ownership. That two-file compatibility delta is still fetched from the contributor fork; it is disclosed rather than presented as upstream-owned. Maintainer acceptance or a narrow Core upstreaming step remains the provenance decision.

Exact-head validation

Published PR head: 19145d0e6c2d895a537235112833d529d51034fe

Fresh GitHub Windows/WSL checks on this exact head:

• repository hygiene: passed
• complete test job: passed in 12m56s
• composed package build and provenance: passed
• composed Gateway proof: passed in 6m47s
• embedded LKG 2026.7.1 setup and connection: passed in 11m33s
• composed setup and connection: passed in 12m47s
• composed revocation recovery: passed in 10m46s
• composed network recovery: passed in 13m19s
• Windows x64 build: passed in 4m56s
• Windows ARM64 build: passed
• CodeQL setup gate: passed
• release and MSIX jobs: skipped by normal PR conditions

Local current-head proof before publication:

• Setup Engine: 765/765
• package/provenance E2E contracts: 34/34
• focused terminal-wizard lifecycle tests: 35/35
• scoped Auto-review: no accepted/actionable findings, confidence 0.98

Real behavior proof

The exact-head composed E2E consumed the SHA-256-bound artifact above on a disposable GitHub Windows/WSL runner and passed setup, Gateway restart, HTTP readiness, connection, revocation recovery, and network recovery.

The official unmodified 2026.7.2-beta.5 control exercised the same setup-connect path and failed after Gateway restart with:

PreparedModelCatalogConfigReplacedError: prepared model catalog owner config was replaced during the read ($HOME/.openclaw/agents/main/agent)

The control reached the wizard end and a healthy restarted Gateway (HTTP 200) before the safety check rejected the replaced catalog owner. Its downstream fixture failures are a consequence of that initialization failure. The composed candidate passes the same supported path, isolating the five-file compatibility correction from the Windows Companion changes.

The package-consumption boundary is independently pinned by current-head tests:

1. Setup downloads the actual HTTP response to a local .tgz.
2. SHA-256 verification runs before the installer.
3. The verified local .tgz is passed to the official installer path.
4. A deliberately wrong digest fails before installer/npm execution.
5. Invalid or missing composed-package provenance fails closed.

No operator runtime, private data, credentials, or channels were used.

Package and lifecycle compatibility

• 2026.7.1 is the embedded official LKG fallback and minimum security floor.
• 2026.7.2-beta.5 is the frozen official control.
• The composed beta-5 candidate adds only the five-path lifecycle compatibility patch listed in provenance.json.
• Composed packages remain governed by their immutable version, URI, source refs, path allowlist, patch hash, and package digest.

The fallback policy is recorded in docs/adr/0001-gateway-lkg-security-floor.md. Automation accepts only exact official stable versions strictly newer than the current pin; it rejects prereleases, equal versions, and downgrades.

Current and composed packages use gateway.nodes.commands.allow. The pinned historical packages retain their version-appropriate legacy command-policy key. All paths preserve the complete capability-derived allowlist.

Selected-port ownership is proven by matching every listener PID from ss to the managed openclaw-gateway.service MainPID. Unknown, mixed, or unattributable ownership fails closed. The patch does not kill processes or broaden command authority.

Security impact

• New permissions or capabilities: No.
• Secret or token handling changes: No.
• New production network destination: No.
• Broader command authority: No.
• Integrity change: composed-package HTTP responses are bound to the reviewed SHA-256 and rejected before installation on mismatch.
• Supply-chain boundary: the contributor-fork compatibility source is explicit and immutable, but remains a maintainer provenance decision rather than an official upstream source.
• Security-floor change: the ordinary fallback cannot regress below 2026.7.1 and cannot be replaced by a prerelease or composed package reference.

Compatibility and migration

• Backward compatible: Yes.
• Config migration: None.
• Embedded official LKG: 2026.7.1.
• Frozen official control: 2026.7.2-beta.5.
• Existing custom package URLs without an expected digest remain invalid for the governed composed-candidate path.
• LKG automation moves forward only to a strictly newer official stable release; rollback to an older fallback is intentionally rejected.

Review conversations

• Reconciled the PR body with the exact published head and current immutable inputs.
• Reconciled #110382 with the landed #115671 and #115856 work.
• Closed the package-consumption integrity boundary with fail-closed pre-install verification.
• Added exact-head GitHub Windows/WSL proof for the composed candidate.
• Preserved the official beta-5 failure as the failed-first control for the Core regression.
• Recorded the 2026.7.1 minimum security floor and stable-only forward-update rule.
• Maintainer decision: accept the disclosed frozen contributor-fork compatibility source or require the remaining two-file Core delta to land upstream first.
• Maintainer review is pending.

Agent Transcript

Redacted operator and agent engineering record

• The operator fixed the product boundary early: Windows Companion owns Windows/WSL setup and safe package consumption; OpenClaw owns Gateway lifecycle behavior.
• The initial broad Core work was decomposed. Peter's upstream takeover landed the core lifecycle correction through #115671 and the settlement remainder through #115856 while preserving contributor credit.
• The operator rejected a fallback downgrade and set official stable 2026.7.1 as the minimum security floor. The branch records that as an ADR instead of coupling ordinary rollback to the beta candidate.
• Scott Hanselman's review reframed update safety around ordinary-user disk pressure. The resulting contract uses bounded, rollback-capable retention rather than indefinite full copies.
• CI first exposed current command-policy schema drift and false port-owner inference. The branch moved to version-aware policy keys and systemd MainPID ownership instead of adding process killing or broader authority.
• Beta 5 then reproduced a Core catalog-owner race after a healthy Gateway restart. The candidate was reduced to five OpenClaw paths; the official control still fails while the composed candidate passes the same setup-connect path.
• A later CI failure revealed step-local shell variables being reused across GitHub Actions steps. The workflow now recomputes and validates provenance in the consuming step.
• Package provenance, path allowlisting, digest verification, setup-connect, recovery paths, x64/ARM64 builds, focused tests, and scoped Auto-review were all rerun on the published head.
• The unresolved boundary is explicit: two Core compatibility files are still sourced from the contributor fork. No claim is made that they have already landed upstream.
• Raw sessions, local paths, credentials, private messages, tokens, and unrelated operator data are excluded.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 5, 2026, 8:22 AM ET / 12:22 UTC.

ClawSweeper review

What this changes

This PR adds digest-verified composed Gateway package installation for setup validation, updates Gateway lifecycle and command-policy handling, and expands CI, tests, and documentation around that path.

Merge readiness

⚠️ Needs maintainer review before merge - 5 items remain

Current main does not include the PR’s package-digest and setup-lifecycle work. The remaining blocker is a maintainer security-boundary decision on whether CI may compose and exercise Gateway code fetched from a contributor fork, not a discrete patch defect.

Priority: P1
Reviewed head: 19145d0e6c2d895a537235112833d529d51034fe
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The branch has unusually detailed current-head runtime evidence, while the forked-Core provenance decision prevents a higher readiness rating.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (linked_artifact): The PR body provides exact-head GitHub Windows/WSL setup, connection, revocation-recovery, network-recovery, and digest-mismatch evidence for the composed candidate.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): The PR body provides exact-head GitHub Windows/WSL setup, connection, revocation-recovery, network-recovery, and digest-mismatch evidence for the composed candidate.
Evidence reviewed	6 items	Current main lacks the requested lifecycle boundary: Current main still pins the default Gateway LKG to 2026.6.11 and has no expected-package digest field or composed-package CI job. PR implements pre-install package verification: The branch downloads a package to a local file, checks the configured SHA-256, and passes that local tarball to the official installer. Forked Core source remains the decision boundary: The new CI job fetches a fixed commit from TheAngryPit/openclaw, validates its hash and five-path allowlist, then packages it for E2E consumption.
Findings	None	None.
Security	Needs attention	Obtain approval for the forked Gateway source: This workflow fetches and packages an exact contributor-fork commit. The commit hash and path allowlist make the input reproducible, but they do not establish that this repository should endorse the remaining non-upstream Core delta.

How this fits together

Windows Companion setup provisions an app-owned WSL Gateway, then pairs the tray and Windows node with it. The PR changes package selection and verification before installation, then validates the resulting Gateway service and connection path.

flowchart LR
  A[Setup configuration] --> B[Gateway package selection]
  B --> C[Digest verification]
  C --> D[Gateway installer]
  D --> E[Gateway service]
  E --> F[Tray and Windows node]
  G[CI composition inputs] --> B

Loading

Decision needed

Question	Recommendation
Should this repository accept CI composition of the exact two-file Gateway compatibility delta from the disclosed contributor fork, or require that remaining delta to land in openclaw/openclaw first?	Require upstream Core provenance: Keep the digest-verification and setup changes, but replace the contributor-fork compatibility delta with an official Core commit before merge.

Why: The implementation verifies immutable refs, allowed paths, and package bytes, but deciding whether this repository endorses non-upstream Gateway behavior is a supply-chain and ownership choice.

Before merge

• Resolve security concern: Obtain approval for the forked Gateway source - This workflow fetches and packages an exact contributor-fork commit. The commit hash and path allowlist make the input reproducible, but they do not establish that this repository should endorse the remaining non-upstream Core delta.
• Resolve merge risk (P1) - Merging would make repository CI compose and consume a Gateway package containing a two-file compatibility delta fetched from a contributor fork. Hash pinning prevents substitution but does not decide whether that non-upstream Core source is acceptable.
• Resolve merge risk (P1) - The PR changes 40 files across setup, CI, Gateway policy, recovery, and documentation, so the provenance decision should cover the whole composed-package contract rather than only the digest check.
• Complete next step (P2) - A maintainer must decide whether the explicit contributor-fork Core source is an acceptable supply-chain boundary before this PR can merge.

Findings

• [medium] Obtain approval for the forked Gateway source — .github/workflows/ci.yml:68

Agent review details

Security

Needs attention: The branch has strong integrity checks, but it introduces a maintainer-owned supply-chain exception by fetching and packaging Gateway source from a contributor fork.

Review metrics

Metric	Value	Why it matters
Patch surface	40 files affected	The branch spans setup, CI, recovery, policy, documentation, and E2E proof rather than one isolated fix.
Production versus tests	production +1434/-113, tests +1949/-33	The substantial test expansion supports the new lifecycle contract, but the production and workflow growth merits ownership review.

Merge-risk options

Maintainer options:

1. Require official Core provenance (recommended)
   Replace the contributor-fork delta with an upstream Core revision, then rerun the exact composed-package E2E matrix before merge.
2. Accept the disclosed frozen source
   Approve the exact commit, allowlist, and hash as a documented temporary supply-chain exception for the composed CI candidate.
3. Pause the composed candidate
   Keep the stable LKG work separate and defer the composed-package lane until Core owns the remaining compatibility behavior.

Technical review

Best possible solution:

Keep the official 2026.7.1 fallback path and accept the composed candidate only after maintainers explicitly approve the frozen Core delta, or replace that delta with an official upstream revision and retain the digest-bound installer contract.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level. Current main pins 2026.6.11 and lacks the digest-bound package path that this PR adds; the provided exact-head E2E evidence also reports the composed setup and recovery paths passing.

Is this the best way to solve the issue?

Unclear. The digest-bound local-package installation path is a focused integrity design, but accepting the remaining contributor-fork Gateway source requires maintainer approval or an upstream replacement.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against d2de6150753b.

Labels

Label justifications:

• P1: Gateway setup and lifecycle changes affect a real Windows onboarding and connection path.
• merge-risk: 🚨 compatibility: The PR changes the default Gateway LKG, version-specific policy keys, and setup lifecycle behavior.
• merge-risk: 🚨 security-boundary: CI fetches and packages an immutable but contributor-owned Core compatibility commit for setup E2E use.
• merge-risk: 🚨 availability: Gateway install, restart, health polling, recovery, and port-ownership behavior change in the onboarding path.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (linked_artifact): The PR body provides exact-head GitHub Windows/WSL setup, connection, revocation-recovery, network-recovery, and digest-mismatch evidence for the composed candidate.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides exact-head GitHub Windows/WSL setup, connection, revocation-recovery, network-recovery, and digest-mismatch evidence for the composed candidate.

Evidence

Security concerns:

• [medium] Obtain approval for the forked Gateway source — .github/workflows/ci.yml:68
  This workflow fetches and packages an exact contributor-fork commit. The commit hash and path allowlist make the input reproducible, but they do not establish that this repository should endorse the remaining non-upstream Core delta.
  Confidence: 0.98

What I checked:

• Current main lacks the requested lifecycle boundary: Current main still pins the default Gateway LKG to 2026.6.11 and has no expected-package digest field or composed-package CI job. (src/OpenClaw.SetupEngine/GatewayLkgVersion.cs:6, d2de6150753b)
• PR implements pre-install package verification: The branch downloads a package to a local file, checks the configured SHA-256, and passes that local tarball to the official installer. (src/OpenClaw.SetupEngine/SetupSteps.cs:1352, 19145d0e6c2d)
• Forked Core source remains the decision boundary: The new CI job fetches a fixed commit from TheAngryPit/openclaw, validates its hash and five-path allowlist, then packages it for E2E consumption. (.github/workflows/ci.yml:68, 19145d0e6c2d)
• PR head provenance: The latest branch commit scopes the composed provenance references to the package step and was authored on 2026-07-29. (.github/workflows/ci.yml:119, 19145d0e6c2d)
• Not implemented or released from this branch: The PR head is not contained by current main or any locally available release tag, so neither current-main nor release provenance supports closure. (19145d0e6c2d)
• Review-helper limitation: The repository autoreview helper could not create its isolated temporary workspace in this read-only sandbox, so the review relied on direct diff, source, policy, history, and provided CI/proof inspection. (19145d0e6c2d)

Likely related people:

• AlexAlves87: Current-main blame attributes the Gateway LKG definition to this contributor. (role: original LKG contributor; confidence: high; commits: f536bcf06559; files: src/OpenClaw.SetupEngine/GatewayLkgVersion.cs)
• Caleb Eden: Recent main history includes app-owned WSL setup boundary work in the central setup implementation. (role: recent setup-area contributor; confidence: medium; commits: d0fca93d5f61; files: src/OpenClaw.SetupEngine/SetupSteps.cs)
• Barbara Kudiess: Recent main work maintained local Gateway recovery behavior adjacent to this setup and lifecycle path. (role: recent gateway-connection contributor; confidence: medium; commits: bc210e048aa9; files: src/OpenClaw.SetupEngine/SetupSteps.cs)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Obtain a maintainer decision on the frozen contributor-fork Core delta.
• If upstream provenance is required, replace the delta with the official Core revision and rerun the composed E2E matrix.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (35 earlier review cycles; latest 8 shown)

• reviewed 2026-07-25T23:58:38.442Z sha 1f785aa :: needs real behavior proof before merge. :: [P1] Align frozen provenance with the workflow inputs
• reviewed 2026-07-26T02:17:39.221Z sha 1f785aa :: needs real behavior proof before merge. :: none
• reviewed 2026-07-26T10:34:29.232Z sha f5958e2 :: needs real behavior proof before merge. :: none
• reviewed 2026-07-26T10:41:07.766Z sha f5958e2 :: needs real behavior proof before merge. :: none
• reviewed 2026-07-29T13:07:38.486Z sha 278c1bc :: needs real behavior proof before merge. :: none
• reviewed 2026-07-29T14:17:35.177Z sha df5bfeb :: needs real behavior proof before merge. :: [P1] Align composed-package provenance with the current head
• reviewed 2026-07-29T15:03:50.352Z sha 19145d0 :: needs real behavior proof before merge. :: [P1] Align the composed-package provenance with the current head
• reviewed 2026-07-29T15:43:48.086Z sha 19145d0 :: needs maintainer review before merge. :: none

[TheAngryPit]

Status update after current-main integration and fresh official-package validation:

• The PR head is 031c665b804ec185ad30279a2c551cdc2b68986a and remains mergeable.
• The final public branch passes Setup Engine 438/438; focused stable-version/schema tests pass 4/4; git diff --check passes.
• Scoped Codex Auto-review found zero issues (patch is correct, confidence 0.97).
• The repository-built Companion installer completed successfully in a disposable Windows VM. MXC selected appcontainer-dacl; the bounded allow case passed and the outside-root write was denied without creating a file.
• All three GitHub WSL setup shards installed official OpenClaw 2026.7.1, then failed at the same upstream start-gateway startup-migration lease regression tracked by [Bug]: update to openclaw 2026.7.1: gateway fails to start w/ error openclaw#108435. Later scenario failures are cascades, not three separate Companion failures.
• OpenClaw 2026.7.2-beta.2 release notes include the matching lease-release fix, but this PR intentionally does not silently make a prerelease the stable Companion default.

The PR body now contains the full failed-first evidence, scope, validation, and sanitized operator/agent decision record. I am marking it ready so maintainers can review the actual tradeoff rather than leaving the work hidden in draft. This is not a claim that the known stable-package E2E blocker is resolved.

No maintainer or automerge action is requested here. @clawsweeper re-review

[TheAngryPit]

Current-head proof update:

• Head prepared locally: 9c308f0bd13948ccfd3c39d0e7373914fa8d6801, integrated with upstream main 4518dd87ed2bbfbdb3e1389cd88e2bc95141ea2b.
• Build passed with zero warnings/errors.
• Fresh suites passed: Connection 443/443, SetupEngine 448/448, Tray 1742/1742, Shared 2866 plus 31 explicit integration skips.
• Disposable Companion-owned WSL revocation/reconnect E2E passed 1/1 and completed uninstall/teardown.
• Strict Gateway -> Windows Node -> MXC E2E passed 2/2 without skip allowance, including the protected-write denial, and completed uninstall/teardown.
• Official OpenClaw 2026.7.2-beta.2 still reproduces the native wizard Gateway-loss defect. The successful E2E explicitly injected a separately scoped OpenClaw wizard-runtime correction after the normal official install; that correction is not part of this Companion PR.
• Final scoped Auto-review produced one restart/uninstall claim, rejected by direct call-path inspection because the restart helper contains no uninstall call. Accepted actionable findings: zero.

The PR body now distinguishes the Companion fixes from the remaining OpenClaw core dependency and requests review of the beta-default contract. @clawsweeper re-review

[TheAngryPit]

Security-floor correction published

Current head: f5958e2190e5484a40ce551783765c0637a1786a

This update corrects the ordinary Gateway fallback at the layer that owns it:

• restores official stable 2026.7.1 as the minimum security floor;
• records the decision in docs/adr/0001-gateway-lkg-security-floor.md;
• permits automation to move only to a strictly newer exact stable release;
• rejects prereleases, equal versions, and downgrades;
• keeps composed-main packages on their separate immutable version, URI, and SHA-256 contract.

Fresh local proof on the exact commit:

• focused SetupEngine: 3/3;
• complete Release build: passed;
• Shared: 3,232 passed with 31 declared environment-dependent skips;
• Tray: 1,958/1,958;
• YAML parse and forward/equal/downgrade policy simulation: passed;
• scoped Auto-review: no findings, patch is correct, confidence 0.95.

GitHub checks started automatically from the push. No manual ClawSweeper re-review command was added.

[github-actions]

This pull request has been automatically marked as stale due to inactivity.
Please update it or it will be closed.

[github-actions]

Closing due to inactivity.
If this PR should be revived, reopen it with current context and a fresh validation plan.