[Patrick-Erichsen]

Summary

• Give staging a permanent, isolated Convex backend (cheery-civet-733) and branch-scoped Vercel configuration.
• Gate deployment on successful CI for the exact staging commit, deploy and stamp Convex first, then verify the immutable Vercel candidate and stable hostname.
• Require the staging branch's edge credential alongside verified Vercel Preview OIDC before accepting client-IP authority or issuing archive manifests.
• Configure the staging worker credential and automatically route publish/scan events through a secretless main-branch relay to workers on staging, using the Staging GitHub environment, fixed staging backend, and isolated concurrency.
• Upgrade TanStack Start to the official security patch and initialize CSP nonces before the framework prepares hydration scripts.

Landed and deployed

Merged as 58865c42d91f574bc78a564eb83788f1f1e4d8e1.

The protected permanent staging branch remains at the validated and deployed revision 135d2524a8611eec155a15905364bb80c190e6b9.

• Staging push CI: passed.
• PR CI: passed. The generated-card shard required one retry after local Convex admission errors; the same test passed in the staging push run.
• Staging deployment: passed, including candidate API/UI and stable-host smoke checks.
• Live staging: https://stg.clawhub.openclaw.org (Vercel Preview sign-in protected).

Before and after proof

Check	Before	After
Backend isolation	Staging Preview reported Test backend artful-cuttlefish-632	Stable API returns HTTP 200, X-ClawHub-Staging-Backend: cheery-civet-733, and build SHA 135d2524a8611eec155a15905364bb80c190e6b9
Worker credential	Real staging worker claim failed	Matching unique credential in Convex and GitHub Staging; real publishing completes
Automatic publish	Test upload staging-worker-proof@1.0.1 pending, both checks pending	Attempt finalized, version published, TruffleHog clean, ClawScan clean
Security rescan	Fixture job queued with zero attempts	Job succeeded on its first attempt with clean analysis
Framework hydration	New framework scripts lacked the response nonce and the browser blocked hydration	Regression test verifies inline script nonces match the CSP and hydration completes; all 19 browser smoke tests pass

Automatic publish proof:

• Main relay: successful staging dispatch; production worker skipped.
• Staging publish worker: passed.
• Attempt rn7dkyx0p1xgjs6zgazd5tb1b98ffyy7, version yx73z2d5txhzfhggjh3sykfbjd8fehe9.

Automatic security-scan proof:

• Main relay: successful staging dispatch; production workers skipped.
• Staging security workers: fixture job vs78q41vtw1mz5chscyp2adtf18ffq40 succeeded with clean analysis; the shared shard completed and the priority shard entered its normal bounded polling window.

An earlier manual staging publish also published staging-worker-proof@1.0.0 with both scanners clean. Its authorized archive download returned HTTP 200 / application/zip containing SKILL.md and _meta.json, exercising signed-manifest issuance, verification, and archive assembly.

Security boundary proof

A temporary sibling deployment in the same Vercel project verified its real runtime token's signature, issuer, audience, expiry, project, and Preview environment. It had no staging edge credential. Its staging API and archive-manifest requests both received 401, with no manifest or quota headers and zero test-IP quota rows before and after. The temporary deployment was removed.

A staging-only revocation drill temporarily changed Convex's edge credential while the frontend retained the previously valid value. API and archive requests received 401/plain text, and all 30 httpRateLimitKeys rows were unchanged across the denied requests. Restoring the matching credential returned the API to 200. This temporary revocation test is separate from the earlier permanent rotation of Vercel Preview bypass tokens.

Validation and dependency patch

• bun run ci:static
• bun run ci:unit -- --maxWorkers=8 — 7,373 passed, 3 skipped. An initial load-related weekly-digest timeout passed its focused 11-test retry and full rerun.
• bun run ci:types-build, including schema and CLI TypeScript checks; Convex deploy typecheck passed.
• bun run ci:playwright-smoke — 19 passed.
• Focused worker/dispatch/relay regression coverage and full GitHub CI, including authenticated browser shards.
• Structured reviews of the staging implementation, workers, and final dependency patch found no actionable issues. Two nonce-review suggestions were rejected after checking actual dependency types, passing TypeScript/build output, and the app's server-function usage; neither identified a failing current app path.

React Start 1.168.60 / Router 1.170.41 resolve start-server-core 1.169.39, as required by TanStack's CVE-2026-102989 advisory. The official patch was allowed through the local package-age filter for that single install command. No persistent age-policy change, CSP relaxation, or Vercel vulnerability bypass was added. Vercel accepted and deployed the patched release.

Operational notes

• SECURITY_SCAN_EVENT_DISPATCH_ENABLED=1 and staged prepublication checks are enabled on staging. General Convex crons remain disabled there.
• The staging worker and edge credentials are scoped to their respective staging runtimes. No credential values appear in this PR.
• stg.clawhub.ai awaits DNS-owner verification: TXT _vercel.clawhub.ai = vc-domain-verify=stg.clawhub.ai,42f428eb4b2f7aa99a97. Its A record is configured; the Foundation hostname is working now.
• Interactive GitHub OAuth callback verification remains a follow-up. The callback is https://cheery-civet-733.convex.site/api/auth/callback/github; these proofs do not claim a completed browser sign-in.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Oct 1, 2026 9:30pm UTC

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed October 1, 2026, 5:31 PM ET / 21:31 UTC (Revision 9).

ClawSweeper review

What this changes

The branch adds an isolated staging deployment, branch-specific edge authentication, staging scan and publication workers, deployment checks, and updated frontend dependencies with compatible CSP nonce handling.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep open: the isolated staging capability is absent from current main, and this collaborator-authored PR remains useful. No blocking code findings remain; the previous authority-proof gaps are addressed.

Priority: P2
Reviewed head: 135d2524a8611eec155a15905364bb80c190e6b9
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A useful, coherent implementation with strong authority-boundary evidence and no blocking code findings.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (live_output): The captured live observations exercise the proxy and Convex identity boundary: authorized archive issuance succeeds, a valid-OIDC sibling Preview is rejected, and revoked edge credentials fail before quota writes or archive effects. Successful real staging publication is linked and GitHub-verified. This satisfies the previously scoped authority gate; the collaborator remains exempt from unrelated contributor proof. Final deployment completion and OAuth scope are separate rollout concerns. No stored-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The captured live observations exercise the proxy and Convex identity boundary: authorized archive issuance succeeds, a valid-OIDC sibling Preview is rejected, and revoked edge credentials fail before quota writes or archive effects. Successful real staging publication is linked and GitHub-verified. This satisfies the previously scoped authority gate; the collaborator remains exempt from unrelated contributor proof. Final deployment completion and OAuth scope are separate rollout concerns. No stored-data contract changes.
Evidence reviewed	10 items	Pinned introduction and continuing necessity: Reviewed the introduced delta from pinned main 72a32c2 to original head 135d252. Main's build plan supports production, Test, and disposable Previews, but lacks the permanent staging path. The staging deploy workflow is absent from both pinned main and v0.23.3. No merged replacement was established. Authorization before effects: The proxy replaces visitor identity headers and sends the staging secret only to the paired staging Convex origin. Convex checks that secret alongside project/environment OIDC before trusting anonymous IP identities or issuing download/export manifests; rejection precedes quota consumption and manifest production. Prior authority-proof requests addressed: The captured PR body, sourceRevision 87a297bcdd7f738bbf7759a945d22ee094814c6888cc54972db0cd3c8111efbf, reports valid-OIDC sibling Preview rejection with zero quota rows added, an authorized HTTP 200 ZIP containing SKILL.md and _meta.json, and retired edge-secret rejection for API/archive requests with all 30 quota rows unchanged. Restoring the credential restored HTTP 200. These observations cover the allowed, nearest forbidden, and revoked-edge cases requested previously. The authority files are unchanged since the previous reviewed head accc9db.
Findings	None	None.
Security	None	None.

How this fits together

ClawHub's deployment pipeline connects GitHub revisions to its Vercel frontend and Convex backend. Staging requests and publication workers use separate backend credentials while preserving production and disposable Preview paths.

flowchart TD
  A[Staging branch revision] --> B[Exact revision CI]
  B --> C[Isolated Convex deployment]
  C --> D[Vercel staging frontend]
  D --> E[OIDC and branch secret check]
  E --> F[API and archive responses]
  C --> G[Staging publication workers]

Loading

Decision needed

Question	Recommendation
Must interactive GitHub sign-in work for the initial staging rollout, or may it remain a documented follow-up?	Verify sign-in before rollout: Configure the dedicated staging OAuth callback and record successful interactive sign-in before treating staging as a complete testing environment.

Why: The PR explicitly leaves callback verification incomplete, and accepting that limitation changes which staging workflows are available.

Before merge

• Resolve merge risk (P1) - Interactive staging GitHub sign-in remains unverified; users could reach the staging frontend but fail to complete authentication unless callback registration is validated or a limited rollout is explicitly accepted.
• Resolve merge risk (P1) - The final framework revision has not yet completed the live candidate and stable-host deployment checks that previously exposed Vercel security and hydration incompatibilities.
• Complete next step (P2) - Resolve whether interactive staging sign-in is required for the initial rollout, and retain the final revision's candidate and stable-host deployment results.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Diff size	+2,292/-102 across 47 files	The review spans deployment automation, request authentication, workers, and frontend compatibility.
Production and test growth	production/config +922/-58; tests +1,178/-8	Production growth is justified by the isolated staging pipeline; counts exclude specs, generated schema output, and the lockfile.

Merge-risk options

Maintainer options:

1. Complete staging rollout validation (recommended)
   Verify interactive OAuth and retain successful exact-head candidate and stable-host checks before rollout.
2. Approve deferred interactive sign-in
   Accept a protected, limited staging rollout with OAuth explicitly deferred, while still requiring the final deployment checks to pass.

Technical review

Best possible solution:

Keep staging isolated through deployment, request authentication, and worker execution, with verified frontend compatibility and an explicit sign-in rollout contract.

Do we have a high-confidence way to reproduce the issue?

Not applicable to the staging feature request; source comparison establishes that main lacks this permanent isolated deployment, and supplied live observations exercise the new request and worker paths.

Is this the best way to solve the issue?

Yes, the separate backend and branch-bound deployment pipeline are an appropriate solution; reusing the existing disposable Preview path would not provide permanent staging isolation. OAuth rollout scope and the final deployment result remain unresolved.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 72a32c262670.

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. The captured live observations exercise the proxy and Convex identity boundary: authorized archive issuance succeeds, a valid-OIDC sibling Preview is rejected, and revoked edge credentials fail before quota writes or archive effects. Successful real staging publication is linked and GitHub-verified. This satisfies the previously scoped authority gate; the collaborator remains exempt from unrelated contributor proof. Final deployment completion and OAuth scope are separate rollout concerns. No stored-data contract changes.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit. Replaced prior rating: 🦐 gold shrimp.
• remove merge-risk: 🚨 security-boundary: Current PR review merge-risk labels are merge-risk: 🚨 auth-provider, merge-risk: 🚨 automation.
• remove status: 📣 needs proof: Current PR status no longer selects a status label.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P2: This is a bounded staging infrastructure improvement rather than an established urgent production failure.
• merge-risk: 🚨 auth-provider: The new staging environment's interactive OAuth callback remains unverified.
• merge-risk: 🚨 automation: The PR introduces deployment and worker routing automation whose final frontend rollout checks are still underway.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit. Replaced prior rating: 🦐 gold shrimp.
• proof: sufficient: Contributor real behavior proof is sufficient. The captured live observations exercise the proxy and Convex identity boundary: authorized archive issuance succeeds, a valid-OIDC sibling Preview is rejected, and revoked edge credentials fail before quota writes or archive effects. Successful real staging publication is linked and GitHub-verified. This satisfies the previously scoped authority gate; the collaborator remains exempt from unrelated contributor proof. Final deployment completion and OAuth scope are separate rollout concerns. No stored-data contract changes.

Evidence

What I checked:

• Pinned introduction and continuing necessity: Reviewed the introduced delta from pinned main 72a32c2 to original head 135d252. Main's build plan supports production, Test, and disposable Previews, but lacks the permanent staging path. The staging deploy workflow is absent from both pinned main and v0.23.3. No merged replacement was established. (scripts/vercel-build.ts:92, 72a32c262670)
• Authorization before effects: The proxy replaces visitor identity headers and sends the staging secret only to the paired staging Convex origin. Convex checks that secret alongside project/environment OIDC before trusting anonymous IP identities or issuing download/export manifests; rejection precedes quota consumption and manifest production. (convex/lib/clawhubVercelOidc.ts:52, 135d2524a861)
• Prior authority-proof requests addressed: The captured PR body, sourceRevision 87a297bcdd7f738bbf7759a945d22ee094814c6888cc54972db0cd3c8111efbf, reports valid-OIDC sibling Preview rejection with zero quota rows added, an authorized HTTP 200 ZIP containing SKILL.md and _meta.json, and retired edge-secret rejection for API/archive requests with all 30 quota rows unchanged. Restoring the credential restored HTTP 200. These observations cover the allowed, nearest forbidden, and revoked-edge cases requested previously. The authority files are unchanged since the previous reviewed head accc9db. (135d2524a861)
• Live publication and relay rollout: GitHub confirms https://github.com/openclaw/clawhub/actions/runs/36925322530 succeeded at 2349807. The captured body records staging-worker-proof@1.0.0 progressing to published with clean scanner results. Automatic event dispatch deliberately remains disabled until the relay workflows land on main; this documented rollout ordering is not an introduced defect. (specs/deploy.md:200, 2349807bdfd5)
• Exact-head deployment still underway: At inspection, https://github.com/openclaw/clawhub/actions/runs/36928569105 was in progress at the pinned head. Exact-SHA CI, Convex deploy, contract verification, and SHA stamping had succeeded; candidate frontend and stable-host smoke steps had not completed. Earlier successful staging deployment evidence does not establish completion of this final dependency revision. (.github/workflows/deploy-staging.yml:446, 135d2524a861)
• OAuth rollout limitation: The captured body explicitly says GitHub OAuth initiation works but the interactive callback has not been verified, and identifies dedicated staging OAuth registration as follow-up. It does not record separate acceptance of a rollout with unverified interactive sign-in. This is the remaining prior rollout decision, not a newly discovered code finding. (.github/workflows/deploy-staging.yml:256, 135d2524a861)

Likely related people:

• Patrick-Erichsen: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Retain successful candidate and stable-host checks for the final dependency revision.
• Verify the staging OAuth callback or record explicit acceptance of its initial-rollout deferral.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (8 earlier review cycles)

• reviewed 2026-10-01T01:17:15.326Z sha c5a2b7a :: needs real behavior proof before merge. :: [P2] Require a staging-specific edge identity
• reviewed 2026-10-01T01:28:41.219Z sha 61950f6 :: needs real behavior proof before merge. :: [P2] Require a staging-only edge identity before accepting client IPs
• reviewed 2026-10-01T01:35:36.105Z sha 61950f6 :: needs real behavior proof before merge. :: [P2] Require a staging-only edge identity before accepting client IPs
• reviewed 2026-10-01T02:00:52.174Z sha f12c6db :: needs real behavior proof before merge. :: none
• reviewed 2026-10-01T02:07:52.674Z sha f12c6db :: needs real behavior proof before merge. :: none
• reviewed 2026-10-01T20:52:48.630Z sha 2349807 :: needs real behavior proof before merge. :: none
• reviewed 2026-10-01T20:59:50.398Z sha 2349807 :: needs real behavior proof before merge. :: none
• reviewed 2026-10-01T21:08:41.553Z sha accc9db :: needs real behavior proof before merge. :: none