chore(deps): bump plugins/clawmetry from 382605c to 7271437

[dependabot]

Bumps plugins/clawmetry from 382605c to 7271437.

Commits

• 7271437 [RELEASE] Context usage merge: honest session + runtime scoped context view (...
• 4e54c98 feat(context): merge LLM Context tab into Context usage (honest, session + ru...
• 9e2068d feat(brain): group the activity stream into per-session sequence blocks (#4374)
• 7526a4f fix(sessions): render workspace.conflict events in transcript view (#4372)
• 64586b8 docs(i18n): sync translated READMEs (#4368)
• 9449e5f feat(license): license_subject_at_batch + /api/license/subject-at-batch (#4361)
• 134d294 chore: bump to v0.12.616 [skip ci] (#4367)
• 3f0dac9 feat(entitlement): has_channel_count + /api/entitlement/has-channel-count (#4...
• 7742786 feat(license): is_subject_at + /api/license/is-subject-at (#4350)
• aadbfb3 feat(license): has_feature_at + /api/license/has-feature-at (#4347)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 4, 2026, 5:21 AM ET / 09:21 UTC.

ClawSweeper review

What this changes

The PR advances the ClawMetry git-submodule fixture to commit 7271437 and refreshes Crabpot’s generated compatibility dashboard and reports.

Merge readiness

⚠️ Ready for maintainer review - 4 items remain

Keep open for maintainer review: this is a current Dependabot update to an external telemetry fixture, and its generated compatibility report remains passing, but the upstream executable-plugin change needs a security and compatibility review before merge.

Priority: P2
Reviewed head: aad76ca23c390801d42639271e2033a9da040583
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The update is structurally consistent with fixture policy and has passing generated reports, but acceptance depends on an upstream telemetry/security review.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot fixture-pin PR is exempt from the external-contributor real-behavior-proof gate; generated compatibility evidence is supplemental review material.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot fixture-pin PR is exempt from the external-contributor real-behavior-proof gate; generated compatibility evidence is supplemental review material.
Evidence reviewed	5 items	Fixture boundary: Current configuration identifies ClawMetry as a medium-priority observability fixture with telemetry, sidecar, gateway-service, and log-transport seams; external plugin code is intentionally consumed through its submodule. PR pin: The PR head points plugins/clawmetry at upstream commit 72714376a4b358dcb2b62e6c3ae05140903bcdff. Generated-report scope: The PR changes one submodule pointer and 26 generated README/report artifacts, consistent with a fixture refresh; its generated CI summary reports a passing status with zero hard breakages.
Findings	None	None.
Security	Needs attention	Review upstream telemetry changes before approval: This line advances external executable fixture code to a release containing session/context and dashboard changes; inspect the upstream comparison for privacy, credential, and sidecar-boundary effects before merging.

How this fits together

Crabpot pins external plugins as git submodule fixtures, inspects them against an OpenClaw host, and publishes generated compatibility reports. Updating the ClawMetry fixture changes the plugin input used by the inspector and the resulting dashboard evidence.

flowchart LR
  A[Fixture configuration] --> B[ClawMetry submodule]
  B --> C[Plugin inspection]
  C --> D[Compatibility probes]
  D --> E[Generated reports]
  E --> F[Dashboard and CI review]

Loading

Decision needed

Question	Recommendation
Is the upstream ClawMetry release at 7271437 acceptable for Crabpot’s telemetry/sidecar fixture boundary after reviewing its privacy and compatibility changes?	Review and accept the upstream release: Inspect the upstream comparison for telemetry, credential, and compatibility changes, then merge if its behavior remains acceptable.

Why: The repository deliberately consumes external plugin code by submodule, while this checkout cannot inspect the new upstream source objects; approving that external executable change requires maintainer judgment.

Before merge

• Resolve security concern: Review upstream telemetry changes before approval - This line advances external executable fixture code to a release containing session/context and dashboard changes; inspect the upstream comparison for privacy, credential, and sidecar-boundary effects before merging.
• Resolve merge risk (P1) - ClawMetry is an external telemetry and sidecar fixture; its upstream release includes session/context and dashboard changes, so the upstream comparison should be reviewed for privacy, credential, and compatibility effects before the pin is accepted.
• Complete next step (P2) - A maintainer must approve the external telemetry-plugin release after reviewing its upstream privacy and compatibility implications; there is no narrow Crabpot repair to dispatch.

Findings

• [medium] Review upstream telemetry changes before approval — plugins/clawmetry:1

Agent review details

Security

Needs attention: No direct workflow or secret-handling edit is present, but the external telemetry-plugin release requires upstream source review before its new pin is approved.

Review metrics

Metric	Value	Why it matters
Refresh scope	27 files affected: 1 submodule pointer and 26 generated report/dashboard files	The broad textual diff is generated fixture evidence rather than a broad Crabpot implementation rewrite.

Root-cause cluster

Relationship: canonical
Canonical: #278
Summary: This is the active ClawMetry update; the earlier Dependabot update targeted an older upstream commit and is closed unmerged.

Members:

• superseded: chore(deps): bump plugins/clawmetry from 382605c to 61ddf73 #272 - That closed Dependabot PR advanced the same submodule only to 61ddf73, while this PR advances it further to 7271437.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Complete upstream fixture review (recommended)
   Review the ClawMetry release comparison and retain the generated passing reports before merging the new external plugin pin.
2. Hold at the current pin
   Pause this dependency update if the upstream telemetry or sidecar changes cannot be accepted for the fixture boundary.

Technical review

Best possible solution:

Confirm the upstream 382605c...7271437 changes preserve Crabpot’s credential-free fixture contract and telemetry boundaries, then merge the pinned update and its regenerated reports.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this dependency refresh does not report a standalone failure, and the refreshed generated summary records a passing compatibility result.

Is this the best way to solve the issue?

Unclear: the submodule pin and generated reports match repository policy, but the upstream executable-plugin change needs maintainer review before it can be considered the safest update.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 8ba54f94a9ee.

Labels

Label justifications:

• P2: This is a normal-priority external fixture dependency update with no reported hard breakage.
• merge-risk: 🚨 compatibility: The pin advances an external plugin whose observed hooks and package behavior feed Crabpot’s compatibility results.
• merge-risk: 🚨 security-boundary: The external fixture handles telemetry and sidecar behavior, so upstream changes require privacy-boundary review before acceptance.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This Dependabot fixture-pin PR is exempt from the external-contributor real-behavior-proof gate; generated compatibility evidence is supplemental review material.

Evidence

Security concerns:

• [medium] Review upstream telemetry changes before approval — plugins/clawmetry:1
  This line advances external executable fixture code to a release containing session/context and dashboard changes; inspect the upstream comparison for privacy, credential, and sidecar-boundary effects before merging.
  Confidence: 0.88

What I checked:

• Fixture boundary: Current configuration identifies ClawMetry as a medium-priority observability fixture with telemetry, sidecar, gateway-service, and log-transport seams; external plugin code is intentionally consumed through its submodule. (crabpot.config.json:1425, 8ba54f94a9ee)
• PR pin: The PR head points plugins/clawmetry at upstream commit 72714376a4b358dcb2b62e6c3ae05140903bcdff. (plugins/clawmetry:1, aad76ca23c39)
• Generated-report scope: The PR changes one submodule pointer and 26 generated README/report artifacts, consistent with a fixture refresh; its generated CI summary reports a passing status with zero hard breakages. (reports/crabpot-ci-summary.json:1, aad76ca23c39)
• Feature history: The current pin was introduced by the prior merged Dependabot fixture update; the history also shows recurring fixture refresh and dependency-maintenance work in this path. (plugins/clawmetry:1, deecfb3e5823)
• Repository policy: The repository policy requires external plugin code to remain under plugins/ as submodules and expects source-reference changes to be reflected in generated expectations; this PR follows that structure. (AGENTS.md:1, 8ba54f94a9ee)

Likely related people:

• Vincent Koc: Recent work maintained fixture refresh behavior and the configuration/reporting path used by this update. (role: recent fixture-system contributor; confidence: high; commits: 7d89a9f09475, 90fe18e5c020; files: crabpot.config.json, reports/crabpot-ci-summary.json)
• Peter Steinberger: Recent fixture-refresh and release work covers the submodule and generated-report surfaces involved here. (role: recent fixture-refresh contributor; confidence: medium; commits: b92a5b604375, 1e7e129eaf06; files: plugins/clawmetry, reports/crabpot-report.md)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Review the upstream 382605c...7271437 comparison for telemetry, session/context, and sidecar behavior.
• Retain or rerun the default credential-free compatibility suite on the exact PR head before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-08-04T09:15:02.167Z sha 1ba76ea :: needs maintainer review before merge. :: none