chore(deps): bump plugins/clawmetry from 382605c to 61ddf73

[dependabot]

Bumps plugins/clawmetry from 382605c to 61ddf73.

Commits

• 61ddf73 [RELEASE] local dashboard actually starts + truthful onboard copy
• 2cb1d83 fix(onboard): local dashboard actually starts, and the copy tells the truth (...
• ee4cf12 feat(license): pro_install_age_days_at_batch + /api/license/pro-install-age-d...
• 48f6cdf chore: bump to v0.12.589 [skip ci] (#4223)
• 2ee653a feat(license): license_age_days_at_batch + /api/license/age-days-at-batch
• fd63282 [RELEASE] onboard sign-in-first + 7-day Pro trial license (#4222)
• 0c49a57 feat(onboard): sign-in-first menu with automatic 7-day Pro trial license (#4220)
• 23c54eb chore: bump to v0.12.588 [skip ci] (#4219)
• d6424a2 [RELEASE] republish onboard detection grid: 0.12.587 wheel was stale (#4218)
• 8a13f22 chore: bump to v0.12.587 [skip ci] (#4217)
• Additional commits viewable in compare view

[clawsweeper]

Codex review: found issues before merge. Reviewed August 4, 2026, 2:14 AM ET / 06:14 UTC.

ClawSweeper review

What this changes

The PR advances the ClawMetry external-plugin fixture submodule from 382605c to 61ddf73.

Merge readiness

⛔ Blocked until real behavior proof is added - 5 items remain

Keep open: the gitlink update is focused and its CI checks passed, but it still leaves Crabpot’s committed ClawMetry evidence tied to 382605c rather than the proposed 61ddf73. Likely related people: Peter Steinberger for fixture refreshes and Vincent Koc for fixture-refresh validation.

Priority: P2
Reviewed head: 3e788511f9eb1c94d2324b85e5efcbb8c2249870

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The proposed update is narrowly scoped, but its required generated provenance and real after-update proof are absent.
Proof confidence	🧂 unranked krab (1/6)	Needs real behavior proof before merge: The PR body provides no after-update real behavior output; CI is useful supplemental evidence but does not replace a redacted isolated-fixture run identifying 61ddf73. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The PR body provides no after-update real behavior output; CI is useful supplemental evidence but does not replace a redacted isolated-fixture run identifying 61ddf73. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	5 items	Fixture purpose: ClawMetry is configured as an observability fixture with diagnostics, gateway-service, sidecar, and telemetry seams. Stale report provenance: Current generated reports still link ClawMetry findings to source revision 382605c, while this PR changes only the gitlink to 61ddf73. Repository policy: Repository guidance requires source references and generated report/test expectations to move together when package versions change.
Findings	1 actionable finding	[P2] Refresh the generated ClawMetry evidence
Security	Needs attention	Review the new external fixture revision: The new upstream revision changes code exercised by fixture inspection, while the checked-in provenance remains tied to the previous revision; reviewers cannot yet connect the recorded evidence to the code being admitted.

How this fits together

Crabpot tracks external OpenClaw plugins as git-submodule fixtures. The pinned source and fixture configuration feed inspector checks whose generated reports and tests provide CI and dashboard provenance.

flowchart LR
  A[ClawMetry submodule] --> B[Fixture configuration]
  B --> C[Inspector checks]
  C --> D[Generated reports and tests]
  D --> E[CI and dashboard]

Loading

Before merge

• Refresh the generated ClawMetry evidence (P2) - This changes the fixture revision to 61ddf73, but the committed reports still link ClawMetry evidence to 382605c. Refresh the reports and any changed expectations so the repository’s inspection evidence describes the code the fixture actually pins.
• Resolve security concern: Review the new external fixture revision - The new upstream revision changes code exercised by fixture inspection, while the checked-in provenance remains tied to the previous revision; reviewers cannot yet connect the recorded evidence to the code being admitted.
• Resolve merge risk (P1) - Merging would leave checked-in inspection evidence describing the old plugin revision while fixture execution uses the new one.
• Resolve merge risk (P1) - The new gitlink admits third-party executable plugin changes, including dashboard and onboarding behavior, without refreshed provenance artifacts for review.
• Complete next step (P2) - The contributor must refresh the generated evidence and provide real after-update proof; a repair worker cannot supply proof from the contributor’s setup.

Findings

• [P2] Refresh the generated ClawMetry evidence — plugins/clawmetry:1
• [medium] Review the new external fixture revision — plugins/clawmetry:1

Agent review details

Security

Needs attention: The gitlink advances a third-party executable fixture, so refreshed inspection evidence and after-update validation are needed before merge.

Review metrics

Metric	Value	Why it matters
Diff scope	1 gitlink changed; 0 report/test files changed	The source revision changes while the repository’s checked-in fixture evidence remains at the prior revision.

Merge-risk options

Maintainer options:

1. Refresh the fixture evidence (recommended)
   Update the generated reports and expectations for 61ddf73 and provide after-update isolated fixture output before merging.
2. Pause the dependency update
   Keep the current known fixture pin if refreshed provenance and validation for this upstream revision are not available.

Technical review

Best possible solution:

Refresh the generated fixture reports and expectations against 61ddf73, then attach redacted after-update isolated-fixture output that identifies the tested revision.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-fixture update rather than a reported product defect; the relevant validation is regenerated output for the new pinned revision.

Is this the best way to solve the issue?

No: a gitlink-only update is incomplete for this fixture-driven repository because its generated reports still identify the prior source revision.

Full review comments:

• [P2] Refresh the generated ClawMetry evidence — plugins/clawmetry:1
  This changes the fixture revision to 61ddf73, but the committed reports still link ClawMetry evidence to 382605c. Refresh the reports and any changed expectations so the repository’s inspection evidence describes the code the fixture actually pins.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.98

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 8ba54f94a9ee.

Labels

Label justifications:

• P2: This is a bounded fixture-integrity problem that can make committed inspection evidence inaccurate.
• merge-risk: 🚨 compatibility: Generated compatibility and inspector findings would remain tied to the old upstream source revision after merge.
• merge-risk: 🚨 security-boundary: The change advances an externally sourced executable plugin fixture without refreshed reviewable provenance.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body provides no after-update real behavior output; CI is useful supplemental evidence but does not replace a redacted isolated-fixture run identifying 61ddf73. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Security concerns:

• [medium] Review the new external fixture revision — plugins/clawmetry:1
  The new upstream revision changes code exercised by fixture inspection, while the checked-in provenance remains tied to the previous revision; reviewers cannot yet connect the recorded evidence to the code being admitted.
  Confidence: 0.94

What I checked:

• Fixture purpose: ClawMetry is configured as an observability fixture with diagnostics, gateway-service, sidecar, and telemetry seams. (crabpot.config.json:1425, 8ba54f94a9ee)
• Stale report provenance: Current generated reports still link ClawMetry findings to source revision 382605c, while this PR changes only the gitlink to 61ddf73. (reports/crabpot-report.md:1056, 8ba54f94a9ee)
• Repository policy: Repository guidance requires source references and generated report/test expectations to move together when package versions change. (AGENTS.md:13, 8ba54f94a9ee)
• Prior blocker remains: The proposed branch contains only the one-line submodule update; the earlier review identified the same missing generated-output refresh on this exact head. (plugins/clawmetry:1, 3e788511f9eb)
• Fixture-history routing: Fixture refreshes were substantially maintained by Peter Steinberger, while Vincent Koc recently maintained fixture-refresh and validation behavior. (crabpot.config.json:1425, b92a5b604375)

Likely related people:

• Peter Steinberger: Authored the broad fixture refresh that changed both submodule/configuration surfaces and generated fixture outputs. (role: fixture-refresh contributor; confidence: high; commits: b92a5b604375; files: .gitmodules, crabpot.config.json)
• Vincent Koc: Authored recent fixes to fixture refresh behavior and related validation tests. (role: recent fixture-validation contributor; confidence: high; commits: 7d89a9f09475, 75ada37884a5; files: crabpot.config.json, test/plugin-inspector-source.test.mjs, test/track-metadata.test.mjs)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Regenerate and commit the reports and expectations for the new fixture revision.
• Add redacted output from an isolated after-update fixture run; updating the PR body will trigger a fresh review.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (25 earlier review cycles; latest 8 shown)

• reviewed 2026-08-02T21:04:31.731Z sha 3e78851 :: needs changes before merge. :: [P2] Refresh the checked-in ClawMetry expectations
• reviewed 2026-08-03T04:03:17.674Z sha 3e78851 :: needs changes before merge. :: [P2] Refresh the checked-in ClawMetry expectations
• reviewed 2026-08-03T05:26:37.950Z sha 3e78851 :: needs changes before merge. :: [P2] Regenerate the checked-in ClawMetry reports
• reviewed 2026-08-03T10:31:05.337Z sha 3e78851 :: needs changes before merge. :: [P2] Regenerate the ClawMetry reports
• reviewed 2026-08-03T11:56:44.741Z sha 3e78851 :: found issues before merge. :: [P2] Refresh generated ClawMetry reports
• reviewed 2026-08-03T16:47:47.940Z sha 3e78851 :: needs changes before merge. :: [P2] Refresh the generated ClawMetry reports
• reviewed 2026-08-03T23:04:21.957Z sha 3e78851 :: needs changes before merge. :: [P2] Refresh the generated ClawMetry reports
• reviewed 2026-08-04T04:01:13.087Z sha 3e78851 :: needs changes before merge. :: [P2] Regenerate the ClawMetry fixture reports

[dependabot]

Superseded by #278.