fix: require verified provenance for main-implemented PR closes

[brokemac79]

Summary

Fail closed when ClawSweeper considers closing a redundant implementation PR and its one linked originating issue. The apply path now requires verified canonical implementation evidence, an independently reviewed paired issue, a live formal GitHub closing relationship, and final eligibility checks immediately before mutation.

Canonical evidence and live disposition

The redundant candidate is openclaw/openclaw#78035. The canonical implementation is openclaw/openclaw#126530, merged at 3fe833dfa4084ad79d4545093f39f192c2108317.

The originating issue is openclaw/openclaw#77897. A live GitHub GraphQL read shows that #126530 is merged, #77897 is still open and has generic CrossReferencedEvent entries, but #126530 has no closingIssuesReferences(excludeUserLinked: true) entry for #77897. Therefore this real target intentionally remains open: matching behavior, prose, or a generic cross-reference is not sufficient authority for paired destructive closeout.

Authorization and closeout behavior

• Query the live canonical PullRequest.closingIssuesReferences(first: 100, excludeUserLinked: true) relation instead of accepting CrossReferencedEvent timeline entries.
• Require the formal closing node to match the exact issue number and exact same repository, and require that issue to still be open.
• Separately require the canonical PR to be merged and its fixing commit to remain reachable from the repository default branch.
• Accept only exactly one same-repository originating issue that was independently reviewed and remains eligible for the same close reason.
• Reject missing, ambiguous, manually linked, generic-reference-only, cross-repository, different-issue, already-closed, stale, locked, concurrently changed, or independently unreviewed pairs.
• Recheck labels, locks, source state, reviewer freshness, post-review human activity, and the paired issue source snapshot after the closeout note and immediately before mutation.
• Tolerate eventual consistency in the issue's own updated_at after ClawSweeper's verified self-comment, while still rejecting any title, body, metadata, lock, label, bot, or human activity drift.
• Close and durably archive the paired issue record before closing the redundant PR; later cleanup failure cannot strand a parent retry after the child close became durable.

Real GitHub transport proof

Claim. The production apply owner sends no close request for a generic-reference-only canonical PR, but closes an independently reviewed exact same-repository issue/PR pair in issue-before-PR order when the merged canonical PR formally closes that issue.

Exact environment. AWS Crabbox Linux c7a.8xlarge, run run_9f4a31ad720a, lease cbx_f3ae7fc12be1 (jade-crayfish), exit 0; the lease was released and no AWS Crabbox leases remain. The raw remote checkout was reconstructed from a verified Git bundle containing current head e229f5f4676b8353401779109bf39499dba28fb0 and base 2da70c23b043609f338c2b05eb2d5d7f091946f3. The harness then verified the exact committed blob OID for every changed file before enabling mutation.

The run downloaded official GitHub CLI 2.88.1 and verified gh_2.88.1_linux_amd64.tar.gz against the official release checksum 36352a993b97e9758793cdb87f9ba674bd6d88c914488e122be78a1962203803, installed the frozen lockfile, ran pnpm run build:all, and invoked the built production apply path through the real gh transport.

The proof reused the existing personal E2E repository brokemac79/clawsweeper-e2e-target-target; it did not create a repository under openclaw.

Rejected lane:

• Merged canonical PR #12 only says Related to #15.
• Candidate PR #17 and issue #15 remained open.
• The real transport wrapper observed zero close requests.

Accepted lane:

• Merged canonical PR #9 formally says Fixes #14.

• The production path closed issue #14 before candidate PR #16, then verified both durable archives (14.md, 16.md).
  Final-boundary revocation lane:

• After the initial valid provenance checks, the harness reopened Limit protected audit failures to live records #14/fix: wrap JSON.parse in ghJson/ghJsonLines with contextual error messages #16 and changed canonical PR Publish audit health in README #9 from Fixes #14 to Related to #14 on the second linked-issue mutation lease.

• The production apply path re-read formal provenance under that lease immediately before the issue-close side effect, rejected the close, and the real transport wrapper observed zero close requests.

• Issue Limit protected audit failures to live records #14 and candidate PR fix: wrap JSON.parse in ghJson/ghJsonLines with contextual error messages #16 both remained open. The harness restored canonical PR Publish audit health in README #9 to Fixes #14 in a finally block and verified the restored fixture afterward.

REMOTE_PROOF_HEAD=e229f5f4676b8353401779109bf39499dba28fb0
PROOF_HEAD=e229f5f4676b8353401779109bf39499dba28fb0
PROOF_CHANGED_FILES=24
PROOF_BLOBS=verified
REJECTED_CLOSE_REQUESTS=0
REJECTED_STATES=open,open
REJECTED_REASON=implemented-on-main close no longer has current GitHub issue-to-fixing-pull-request provenance
REVOKED_FINAL_PROVENANCE_CLOSE_REQUESTS=0
REVOKED_FINAL_PROVENANCE_STATES=open,open
ACCEPTED_CLOSE_ORDER=issue#14,pull_request#16
ACCEPTED_STATES=closed,closed
ACCEPTED_ARCHIVES=14.md,16.md
REAL_GITHUB_TRANSPORT=verified
CSW134_REAL_TRANSPORT_PROOF=PASS

Proof boundary. The live run used the personal brokemac79 GitHub token and configured that identity as the trusted E2E comment author. The fixtures and review records are intentionally synthetic. This proves production apply behavior and actual GitHub API side effects through the real transport, but it does not claim deployed GitHub App authentication equivalence.

Validation and review

• pnpm run build:all passed.
• The complete affected suite passed: 70/70 across apply-label-sync, PR coverage recheck, fixed-SHA resolution, paired close, and retry policy.
• The exact-head regression matrix includes canonical-provenance revocation, retargeting, and human activity arriving during final linked-issue lease acquisition; every lane records zero issue/PR closes.
• AWS Crabbox Linux static CI gate pnpm run check:static passed in run_226719f08cde, including the full 744-file format check.
• node --test test/fixed-sha-pull-resolution.test.ts passed: 18/18.
• Focused type-aware lint, formatting, and git diff --check passed.
• Dirty-tree Codex review found and drove fixes for exact-head pinning, explicit live-mutation opt-in, proof config restoration, and delayed self-comment timestamp propagation; the final dirty review was clean.
• Committed Codex review against origin/main found no actionable correctness issue.
• Local ClawSweeper committed-range review at base 2da70c23b043609f338c2b05eb2d5d7f091946f3, head e229f5f4676b8353401779109bf39499dba28fb0 found no discrete correctness or security defect and reported overall correctness patch is correct.
• git rebase origin/main is a no-op: the branch contains current base 2da70c23b043609f338c2b05eb2d5d7f091946f3 and is 0 commits behind.
• The local worktree is clean. This PR does not merge itself; ClawSweeper determines readiness after normal review.

Bay impact

OpenClaw Bay is unaffected: this changes internal apply-time GitHub closeout authorization and record sequencing, not Bay data contracts, routes, rendering, or controls.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 23, 2026, 4:15 PM ET / 20:15 UTC.

ClawSweeper review

What this changes

The PR hardens implementation-based PR closeouts by requiring verified merged-PR provenance, formal linked-issue evidence, and fresh checks before paired GitHub mutations.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep open for normal maintainer merge review: no actionable correctness or security defect was found, and the current-head production transport proof covers both accepted and revoked-provenance paths.

Priority: P1
Reviewed head: e229f5f4676b8353401779109bf39499dba28fb0

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Strong exact-head production proof and broad focused coverage support a good but high-complexity automation patch.
Proof confidence	🦀 challenger crab (6/6)	Sufficient (live_output): The current-head Crabbox trace uses the production apply owner and real GitHub transport, showing both issue-before-PR closure and zero close I/O after final provenance revocation.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The current-head Crabbox trace uses the production apply owner and real GitHub transport, showing both issue-before-PR closure and zero close I/O after final provenance revocation.
Evidence reviewed	5 items	Final provenance check: The paired issue is closed only after the apply path reacquires its mutation lease and revalidates the candidate PR's formal provenance immediately before the close request. Formal GitHub relation: The status context queries the canonical PR's non-user-linked closing references and accepts only the exact still-open issue in the same repository. Regression coverage: The paired-close test exercises revoked provenance, retargeted provenance, source/metadata drift, and human activity during the linked-issue lease.
Findings	None	None.
Security	None	None.

Live Verification

Command: pnpm run build:all && node --test test/fixed-sha-pull-resolution.test.ts

Result: PASS (completed)

pnpm run build:all && node --test test/fixed-sha-pull-resolution.test.ts
runner@runnervm76f27:/tmp/clawsweeper-live-proof-1212-KP2pMB/target$ pnpm run build:all && node --test test/fixed-sha-pull-resolution.test.ts
$ pnpm run build && pnpm run build:repair && pnpm run build:dashboard
$ tsc -p tsconfig.json
pnpm run build:all && node --test test/fixed-sha-pull-resolution.test.ts
$ tsc -p tsconfig.repair.json
$ tsc -p tsconfig.dashboard.json
✔ implementation provenance ignores HTML-commented issue references (2.955162ms)
✔ fixed-SHA issue enrichment reuses repeats and batches cold resolutions (3.40268ms)
✔ a shared head SHA preserves exact association ordering (0.403754ms)
✔ a merge-commit match is authoritative even when another pull shares its head SHA (0.301294ms)
✔ a changed fixed SHA does not reuse a prior association (0.322555ms)
✔ PR implementation closeout revalidates current issue linkage on the repository default branch (0.831705ms)
✔ PR implementation closeout rejects a fixing merge commit no longer on the default branch (0.390716ms)
✔ apply-time PR closeout rejects stale issue linkage (0.326211ms)
✔ apply-time PR closeout propagates GitHub rate limits (1.14801ms)
✔ PR implementation closeout accepts a reviewed canonical PR even while the linked issue remains open (0.486697ms)
✔ apply-time PR closeout propagates GitHub runtime budget exhaustion (0.610289ms)
✔ apply-time PR closeout accepts the merged canonical PR's formal relationship to a still-open issue (0.263328ms)
✔ apply-time PR closeout fails closed when the canonical PR identifies a different closing issue (0.303327ms)
✔ apply-time PR closeout fails closed when GitHub has no canonical closing reference for the open linked issue (0.267984ms)
✔ apply-time PR closeout fails closed when the canonical PR only generically cross-references the open linked issue (0.209669ms)
✔ apply-time PR closeout fails closed when the formally linked issue is already closed (0.193405ms)
✔ apply-time PR closeout fails closed when the fixing merge commit left the default branch (0.262146ms)
✔ apply-time PR closeout propagates fixing-commit containment rate limits (0.466357ms)
ℹ tests 18
ℹ suites 0
ℹ pass 18
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 346.846008
runner@runnervm76f27:/tmp/clawsweeper-live-proof-1212-KP2pMB/target$ pnpm run build:all && node --test test/fixed-sha-pull-resolution.test.ts

Assertions:

• PASS expect_output: apply-time PR closeout accepts the merged canonical PR's formal relationship to a still-open issue
• PASS expect_output: apply-time PR closeout fails closed when GitHub has no canonical closing reference for the open linked issue

How this fits together

ClawSweeper’s apply lane turns reviewed reports into GitHub closeout actions. This change verifies the canonical implementation and linked issue immediately before closing the issue and then its redundant PR.

flowchart LR
A[Reviewed closeout report] --> B[Apply eligibility checks]
B --> C[Verified fixing PR]
C --> D[Formal linked issue check]
D --> E[Final freshness and lease check]
E --> F[Close linked issue]
F --> G[Close redundant PR]

Loading

Before merge

• Resolve merge risk (P1) - This 24-file change alters destructive GitHub-close automation; defects could either retain eligible items for manual handling or mis-handle a paired closeout.
• Resolve merge risk (P1) - The formal-link requirement intentionally leaves semantic-only implementation matches open for maintainer resolution.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Change scope	24 files, +3,514 / -233 lines	The patch changes the apply workflow, provenance resolution, proof freshness, docs, and focused regressions.
Production versus tests	production +1,843 / -93; tests +1,671 / -140	The large production closeout sequence is paired with substantial targeted regression coverage.

Merge-risk options

Maintainer options:

1. Accept the fail-closed closeout policy (recommended)
   Merge with the intentional tradeoff that ambiguous or semantic-only implementation matches remain open instead of being automatically closed.

Technical review

Best possible solution:

Land the fail-closed provenance and paired-close sequence, leaving candidates without a current formal GitHub closing relationship open for ordinary maintainer review.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a PR, and its supplied exact-head production transport proof exercises the changed apply path with accepted and rejected provenance fixtures.

Is this the best way to solve the issue?

Yes: querying GitHub’s formal closing relationship and rechecking it under the linked issue’s mutation lease is narrower and safer than inferring close authority from commits or cross-references.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 2da70c23b043.

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. The current-head Crabbox trace uses the production apply owner and real GitHub transport, showing both issue-before-PR closure and zero close I/O after final provenance revocation.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦀 challenger crab and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The current-head Crabbox trace uses the production apply owner and real GitHub transport, showing both issue-before-PR closure and zero close I/O after final provenance revocation.
• remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P1: The PR changes authorization immediately before automated GitHub issue and PR closure side effects.
• merge-risk: 🚨 automation: The diff changes apply sequencing, mutation leases, freshness guards, and closeout records.
• merge-risk: 🚨 security-boundary: The diff strengthens the provenance checks that authorize destructive GitHub mutations.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦀 challenger crab and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The current-head Crabbox trace uses the production apply owner and real GitHub transport, showing both issue-before-PR closure and zero close I/O after final provenance revocation.
• proof: sufficient: Contributor real behavior proof is sufficient. The current-head Crabbox trace uses the production apply owner and real GitHub transport, showing both issue-before-PR closure and zero close I/O after final provenance revocation.

Evidence

What I checked:

• Final provenance check: The paired issue is closed only after the apply path reacquires its mutation lease and revalidates the candidate PR's formal provenance immediately before the close request. (src/clawsweeper-apply-close-execution.ts:895, e229f5f4676b)
• Formal GitHub relation: The status context queries the canonical PR's non-user-linked closing references and accepts only the exact still-open issue in the same repository. (src/clawsweeper-status-context.ts:669, e229f5f4676b)
• Regression coverage: The paired-close test exercises revoked provenance, retargeted provenance, source/metadata drift, and human activity during the linked-issue lease. (test/apply-label-sync.test.ts:3766, e229f5f4676b)
• Current-head real behavior proof: The PR body records a Crabbox run pinned to e229f5f with real GitHub transport: generic references sent zero close requests, formal references closed issue then PR, and revoked final provenance again sent zero close requests. (e229f5f4676b)
• Area provenance: The pre-existing apply-close execution path on main traces to Martin Cleary's commit 43799a1; this PR layers the new guard onto that path. (src/clawsweeper-apply-close-execution.ts:1, 43799a11fc26)

Likely related people:

• Martin Cleary: Current-main blame and history attribute the pre-existing apply-close execution path to this commit. (role: original closeout-path author; confidence: high; commits: 43799a11fc26; files: src/clawsweeper-apply-close-execution.ts, src/clawsweeper-apply-decision-workflow.ts)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (21 earlier review cycles; latest 8 shown)

• reviewed 2026-08-21T23:10:57.494Z sha 28489ef :: needs real behavior proof before merge. :: [P1] Revalidate the linked issue’s canonical closer at apply time
• reviewed 2026-08-21T23:26:30.188Z sha 28489ef :: needs real behavior proof before merge. :: [P1] Bind the fixing PR to the live linked issue | [P2] Document the paired-closeout policy and Bay impact
• reviewed 2026-08-22T01:11:57.514Z sha 427826b :: needs real behavior proof before merge. :: none
• reviewed 2026-08-23T09:42:58.063Z sha cecd1da :: needs real behavior proof before merge. :: none
• reviewed 2026-08-23T09:50:22.360Z sha cecd1da :: needs real behavior proof before merge. :: [P1] Verify that the canonical PR actually closes the linked issue
• reviewed 2026-08-23T11:07:41.815Z sha 81e2845 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-23T16:32:53.933Z sha b6ec4ab :: needs real behavior proof before merge. :: [P1] Revalidate provenance immediately before closing the linked issue
• reviewed 2026-08-23T20:00:58.188Z sha e229f5f :: needs real behavior proof before merge. :: none

[brokemac79]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[brokemac79]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/32341524259
• Updated: 2026-08-20T06:53:57.491Z

[brokemac79]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/32500834827
• Updated: 2026-08-21T16:02:50.865Z

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[brokemac79]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/32525997458
• Updated: 2026-08-21T20:55:42.205Z

[brokemac79]

@clawsweeper review

Current head 81e2845481b900830c33559f9bb4a9dcfa301d85 is rebased on 2da70c23b043609f338c2b05eb2d5d7f091946f3. The PR body now contains the formal closingIssuesReferences(excludeUserLinked: true) P1 repair, exact-head AWS Crabbox proof (run_deb6d1c209c8, lease released), full/focused/paired test results, and read-only live GitHub transport evidence for both a durable formal closer and the target generic-cross-reference-only fail-closed case.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/32635731145
• Updated: 2026-08-23T11:14:25.341Z

[brokemac79]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[brokemac79]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/32664260119
• Updated: 2026-08-23T20:23:40.772Z