fix: require verified provenance for main-implemented PR closes

config/documentation-site.json

@@ -14,6 +14,7 @@
         "pr-review-comments.md",
         "pr-proof-triage-dashboard.md",
         "author-pr-budget-close-policy.md",
+        "implemented-on-main-close-policy.md",
         "obsolescence-close-policies.md",
         "product-direction-close-policy.md",
         "stalled-pr-close-policies.md",

docs/README.md

@@ -145,6 +145,8 @@ poster or WebP over accumulated before/after sets.
 
 ## Close policy
 
+- [Implemented-on-main paired close policy](implemented-on-main-close-policy.md)
+  — active policy and formal GitHub-link requirement
 - [Obsolescence policies](obsolescence-close-policies.md) — active policy map
 - [Unsponsored feature policy](unsponsored-feature-close-policy.md) — active
 - [Product direction policy](product-direction-close-policy.md) — active

docs/implemented-on-main-close-policy.md

@@ -0,0 +1,39 @@
+# Implemented-on-main paired close policy
+
+- Status: active
+- Owner: ClawSweeper maintainers
+- Owning code: `src/clawsweeper-status-context.ts` and `src/clawsweeper-apply-close-execution.ts`
+- Update when: implementation-provenance, linked-issue, or paired-close guards change
+
+`implemented_on_main` and `mostly_implemented_on_main` are destructive apply
+paths. A review may identify semantic equivalence, but `apply-decisions` closes
+only after fresh GitHub reads prove every required relationship.
+
+## Required relationship
+
+For a PR and exactly one same-repository linked issue, both independently
+reviewed reports must cite the same high-confidence, GitHub-verified merged PR
+on the default branch. At apply time, ClawSweeper re-reads the PR body and the
+linked issue. The issue must still be open, and that exact cited same-repository
+PR's current GitHub `closingIssuesReferences` relationship must contain the
+still-open issue. The query excludes manually linked issues, and a generic
+cross-reference (for example, `Related to #123`) is not closing provenance. A
+missing, closed, unreadable, manually linked, or mismatched relation keeps both
+items open.
+
+This is intentionally stricter than semantic review evidence: a canonical PR
+must have a durable GitHub relationship to the still-open linked issue before
+ClawSweeper can close the pair. A canonical PR with no such relationship is
+useful review context, but it does not authorize automatic paired closure. A
+maintainer can evaluate that case through the ordinary review path.
+
+## Mutation and visibility boundaries
+
+Before any mutation, apply rechecks report freshness, source state, labels,
+locks, and post-review human activity. The linked issue has its own mutation
+lease and ledger record; it is archived before the parent PR, so an interrupted
+parent close cannot erase an independently completed issue record.
+
+OpenClaw Bay is unaffected. Bay remains an observer-only projection of durable
+workflow state: this policy changes neither Bay's public schema nor its ability
+to initiate GitHub or apply actions.

prompts/review-item.md

@@ -75,6 +75,13 @@ whether the fix is in the latest release or main-only, and whether a merged or
 open related PR now owns the work. When current `main` solves the issue with
 high-confidence source, history, and release/main-only evidence, prefer an
 `implemented_on_main` close even if the fix has not shipped in a release yet.
+For a pull request, source resemblance, an overlapping feature, or a current
+main commit alone is never sufficient to propose `implemented_on_main` or
+`mostly_implemented_on_main`. Require a GitHub-verified, merged fixing PR in
+the same repository, with an explicit connection to the requested behavior.
+If that connection is incomplete, ambiguous, cross-repository, or only
+inferred from filenames/commit text, keep the PR open and do not close any
+linked issue. A linked issue is not permission or proof to close either item.
 If a meaningful requested behavior remains missing, keep the item open or link
 the canonical remaining work.
 
@@ -689,6 +696,11 @@ Use reason-specific anchors:
   release tag/version. If it is only on current `main`, say that and include the
   commit timestamp. If you cannot establish either the shipped release or the
   main-only timestamp with high confidence, keep the item open.
+  For PR closure, additionally require a same-repository merged fixing PR that
+  GitHub formally identifies as closing the relevant issue or request; cite its
+  PR URL in the review and final closeout. A commit with no such PR, a PR that
+  only happens to touch nearby code, an unverified issue link, or an ambiguous
+  partial implementation is a keep-open result, not an automatic close.
 - For `cannot_reproduce`, distinguish missing reporter evidence from a report
   whose concrete mechanism is disproved. Search the complete current tree,
   source history, renamed paths, and shipped version when identified; trace the