fix(review): admit Crabbox Postgres docs fixture

[vincentkoc]

What Problem This Solves

Resolves a problem where ClawSweeper refuses review admission for a Crabbox pull
request that changes docs/operations.md, because that file already contains a
public synthetic PostgreSQL connection example elsewhere in the document.

This is a prerequisite for reviewing
openclaw/crabbox#1904.

Why This Change Was Made

The change adds two exact host-owned attribution rows for the reviewed
PostgreSQL example. They bind the Postgres detector, the observed PLAIN and
HTML decoders, exact native value hashes, the complete source-line hash,
docs/operations.md, mode 100644, detector metadata, and the existing
committed base/head role requirement.

There is no path-wide, detector-wide, repository-controlled, or runtime
override. Changed values, lines, paths, modes, metadata, decoders, duplicates,
mixed unknown findings, and non-committed roles still refuse admission.

User Impact

Maintainers can review the affected Crabbox change without disabling input
scanning or authorizing unrelated findings. Genuine or changed credential-shaped
material remains blocking before a provider or model can launch.

OpenClaw Bay Impact

OpenClaw Bay is unaffected. This changes only host-side review-input
classification; no queue, status, lifecycle, telemetry, dashboard, or public
data contract changes.

Documentation Impact

The active scanner contract in README.md now documents the narrowly reviewed
Crabbox PostgreSQL example and its accepted native decoder variants.
CHANGELOG.md records the operational admission change.

Evidence

• Exact head: c95e0b18b49e6f975116947939bfda89afde837b
• Target Crabbox base: 728a0d0837642ac84f3302fe6191f24087320e1a
• Target Crabbox head: 0ac90de2ce3a5c1523c1885e81c7018a16b828b1
• Original refusal:
  https://github.com/openclaw/clawsweeper/actions/runs/34014871213
• TruffleHog: 3.97.1, binary SHA-256
  f6899e5521ff060634a9599e02215195d29d330e9a902feb3f5322eedcb7ba21
• Focused scanner suite: 256/256 passed.
• Static checks, build, lint, formatting, changed coverage, and diff checks
  passed.
• Exact committed-scope Codex review: scoped clean at P0-P2, correctness
  confidence 0.94.
• Production code delta: +33/-3; tests: +212; docs/changelog: +14/-10.

The local full pnpm run check completed static checks, builds, lint, and
changed coverage, then retained two unrelated host-environment failures in
test/live-proof-review-environment.test.ts: one synthetic review-child
compound command and one nodenv lookup for a missing literal Node 24
installation. The changed scanner suite and production replay are green;
hosted CI is the clean-environment gate.

Real Behavior Proof

Claim: the production admission boundary classifies the exact four native
records from the affected Crabbox review input while preserving the existing
fail-closed launch boundary.

Exercised surface: the built production scanAgentInput entry point with
committed Git source staging and pinned native TruffleHog output.

Scenario and environment: a private temporary harness called the candidate
ClawSweeper build against the exact Crabbox base/head revisions above. It used
TruffleHog 3.97.1 with the production arguments, isolated temporary
directories, and no provider or model process.

Observed result:

{
  "status": "classified",
  "nativeRecordCount": 4,
  "noticeCount": 2,
  "providerModelLaunchCount": 0,
  "records": [
    "Postgres docs head / PLAIN",
    "Postgres docs base / HTML",
    "existing Crabbox fleet URI / PLAIN",
    "existing Crabbox fleet URI / PLAIN"
  ]
}

The production boundary invoked trusted Git 58 times and pinned TruffleHog once.
It invoked no provider or model. The canonical compact trace, excluding its
self-digest field, has SHA-256
a221a36a175b38921a592910d78fe02add22e457bbac03636c847cfe836b251e;
the retained pretty-printed sanitized file has SHA-256
8224d2c47b56f19825172fbb68a688a0caf543bb12c781de4223d707dcd38088.
The trace contains only source paths, blob IDs, detector/decoder names, line
numbers, roles, and fixture hashes, not native matched values.

Limits: this proof is exact to the listed Crabbox revisions, source line,
path, mode, detector metadata, observed decoder identities, and TruffleHog
version. It does not authorize different bytes, future scanner behavior,
verified findings, other repositories or paths, other modes or roles,
duplicates, or mixed unknown findings.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 6, 2026, 2:35 AM ET / 06:35 UTC.

ClawSweeper review

What this changes

Adds narrowly matched PostgreSQL documentation fixtures to ClawSweeper’s review-input scanner, with rejection coverage and updated scanner documentation.

Merge readiness

✅ Ready for maintainer review

The PR remains useful: current main lacks this exact fixture exception, and the patch preserves the existing admission checks. No actionable introduced defect was found; MEMBER-authored work is also protected from cleanup closure.

Priority: P2
Reviewed head: c95e0b18b49e6f975116947939bfda89afde837b

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused policy extension with relevant native production output and substantial rejection coverage; no blocking defect was found.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The captured body reports this head’s production scanAgentInput path using committed Git staging and pinned native TruffleHog against the specified Crabbox revisions, yielding four classified records and two notices without provider launch; the result directly exercises the added fixture entries.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The captured body reports this head’s production scanAgentInput path using committed Git staging and pinned native TruffleHog against the specified Crabbox revisions, yielding four classified records and two notices without provider launch; the result directly exercises the added fixture entries.
Evidence reviewed	7 items	Current main still needs the exception: The pinned main attribution table contains logging fixtures but no Crabbox operations-document entry; its validator only accepts the logging source path. No merged replacement was established, and no released fix is claimed. Narrow policy expansion: Two static rows bind the Postgres detector, PLAIN or HTML decoder, both native value hashes, complete source-line hash, operations-document path, and regular-file mode. The shared classifier still checks every staged reference, committed role, metadata shape, verification state, and duplicate finding. Admission remains before provider execution: The production scanner throws on refused classification and rechecks source freshness; agent runners call that boundary before invoking either provider. The patch does not introduce persisted authorization, change provider selection, or modify the launch sequence.
Findings	None	None.
Security	None	None.

How this fits together

ClawSweeper scans review prompts and Git source material before starting an agent. Its host-owned fixture classifier allows known synthetic examples while rejecting unrecognized credential findings.

flowchart TD
  A[Review prompt and Git revisions] --> B[Trusted source staging]
  B --> C[Native secret scanner]
  C --> D[Exact fixture checks]
  D -->|All findings qualify| E[Admission and sanitized notices]
  D -->|Any finding fails| F[Stop before agent launch]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	Production +33/-3; tests +212/-0	Production growth is justified by two exact fixture rows and their narrowly scoped policy validation.

Technical review

Best possible solution:

Keep synthetic-fixture admission in the existing host-owned exact-match policy, with all unrelated findings continuing to block agent launch.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level: the supplied native Postgres records cannot match current main’s attribution table and fall through to rejection. This review did not execute a failing scan.

Is this the best way to solve the issue?

Yes. Adding exact rows to the existing classifier avoids a competing bypass and preserves the established source, decoder, metadata, and committed-role checks.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 10c64167c30d.

Labels

Label changes:

• add P2: Repairs a bounded review-admission failure without evidence of a broader production outage.
• add proof: sufficient: Contributor real behavior proof is sufficient. The captured body reports this head’s production scanAgentInput path using committed Git staging and pinned native TruffleHog against the specified Crabbox revisions, yielding four classified records and two notices without provider launch; the result directly exercises the added fixture entries.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The captured body reports this head’s production scanAgentInput path using committed Git staging and pinned native TruffleHog against the specified Crabbox revisions, yielding four classified records and two notices without provider launch; the result directly exercises the added fixture entries.

Label justifications:

• P2: Repairs a bounded review-admission failure without evidence of a broader production outage.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The captured body reports this head’s production scanAgentInput path using committed Git staging and pinned native TruffleHog against the specified Crabbox revisions, yielding four classified records and two notices without provider launch; the result directly exercises the added fixture entries.
• proof: sufficient: Contributor real behavior proof is sufficient. The captured body reports this head’s production scanAgentInput path using committed Git staging and pinned native TruffleHog against the specified Crabbox revisions, yielding four classified records and two notices without provider launch; the result directly exercises the added fixture entries.

Evidence

What I checked:

• Current main still needs the exception: The pinned main attribution table contains logging fixtures but no Crabbox operations-document entry; its validator only accepts the logging source path. No merged replacement was established, and no released fix is claimed. (src/agent-input-scan-fixtures.ts:174, 10c64167c30d)
• Narrow policy expansion: Two static rows bind the Postgres detector, PLAIN or HTML decoder, both native value hashes, complete source-line hash, operations-document path, and regular-file mode. The shared classifier still checks every staged reference, committed role, metadata shape, verification state, and duplicate finding. (src/agent-input-scan-fixtures.ts:172, c95e0b18b49e)
• Admission remains before provider execution: The production scanner throws on refused classification and rechecks source freshness; agent runners call that boundary before invoking either provider. The patch does not introduce persisted authorization, change provider selection, or modify the launch sequence. (src/agent-runner.ts:50, c95e0b18b49e)
• Focused regression coverage: The added test checks all 15 nonempty subsets of four fixture records in forward and reverse order, plus 11 refusal mutations. Existing tests cover malformed Postgres metadata. Tests were inspected, not executed during this read-only review; diff whitespace validation passed. (test/agent-input-scan.test.ts:889, c95e0b18b49e)
• Captured production proof: The supplied PR body identifies this exact head and reports the built scanAgentInput entrypoint staging committed Crabbox revisions and invoking pinned TruffleHog 3.97.1. Its copied result records four native findings, two notices, and zero provider/model launches. It distinguishes the two Postgres records from two existing fleet URI records and supplies sanitized-trace hashes. This is production scan evidence, not merely the reported 256 passing tests; it does not independently demonstrate every negative case. (c95e0b18b49e)
• Relevant prior contributors: Available current-main file history records Vincent Koc’s attribution and Crabbox-fixture work and Peter Steinberger’s adjacent fixture-maintenance work. Raw commit records were readable, but parent-file inspection and blame could not complete, so these are routing candidates rather than verified source-line introduction attributions. (src/agent-input-scan-fixtures.ts, 10c64167c30d)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.