fix(security): refresh scanner runtime trust inputs by joshavant · Pull Request #89 · openclaw/clawscan

joshavant · 2026-10-23T18:37:05Z

Summary

Update the runtime image from Codex 0.160.0 to0.164.0 and direct Claude Code 2.1.306 to2.1.309.
Match the manual judge lane to Codex 0.164.0 and exact Node 24.22.1. Scanner sources, Responses patches, models, trust settings and publication gates stay with their existing owners.

Scope

Release/CI/repo automation

Security / Trust Impact

Security/trust impact explained

The released native CLI selections carry their vendor trust-policy updates. Existing certificate verification, custom-CA interfaces and fail-closed scanner/publication assertions are preserved.

Verification

Native Linux ARM, cold --pull --no-cache build of the complete canonical Dockerfile: 38 SkillSpector tests and 259 AIG adapter tests passed; installed scanner help and native CLI version smoke passed.
go test ./..., go vet ./..., actual CLI help/build, and 16 offline runtime publication contract tests passed. Independent P0–P3 autoreview: scoped-clean.
Native clients in the actual rebuilt image, Codex 0.164.0 and Claude 2.1.309: 14 incident hosts, matched peer certificates covering six affected TLS keys. Codex Responses-WebSocket emits CertDistrusted in 56 default/explicit-old-CA/proxy cases; Claude emits CERT_REJECTED in 42 default/old-extra-CA/proxy cases. Matching old-CA curl controls validate every endpoint; private HTTPS and CONNECT controls reach the product request paths.
Actual image Python/system and HTTPX default trust reject all 14 incident hosts; legitimate HTTPS succeeds. Normal resolution selected Python 3.12.15, Node 24.22.1, uv 0.13.5 and certifi 2026.10.23 in system/AIG/Snyk environments.

Notes

Linux AMD64 native image qualification is left to the existing PR build-only platform lane. No paid live-model judge, credentialed scanner, deployed-fleet or release/publication proof is claimed. The negative Codex jobs were bounded after recording native WebSocket certificate rejection; their later generic HTTP failures do not establish every delegated HTTP/OS backend's verifier behavior. Windows/macOS and the two code-signing keys are not exercised by these TLS endpoints.

Python root-data removal still accepts incident chains when an explicit old CA bundle is supplied. pip vendors certifi 2026.10.19 and stable Codex retains roots 1.0.10, so additional C1/C3 data removal remains distinct from demonstrated key rejection. The image also selects HFHub 1.33.0 and compiled hf-xet 1.7.0. The bounded native proof below confirms conditional old-store acceptance; its recorded source lock selects WebPKI 0.103.15, so Python certifi proof does not clear that native transport. No transitive overrides or vendor edits are introduced.

Existing Docker 29/containerd image-ID versus config-digest publication binding is recorded as a baseline delivery compatibility followup; the hosted backend and an actual publication failure have not been established, and the strict gate is preserved. This PR does not publish an image or deploy a service.

Additional actual-image qualification: the installed Linux ARM64 hf-xet1.7 extension (SHA256 07f5fdbcf98b9a72a6312a2d9bac7b58822c6cd37f694ab650e4724676e640f6) accepts both representative G3/AAA incident chains with an explicit old SSL_CERT_FILE store, reaching native HTTP before expected synthetic-response JSON parsing errors. Default-store rejection, proper private-CA recovery, hostname rejection and legitimate HF HTTP controls were also exercised. This confirms a separate compiled-native upstream hold; the Python certifi update does not close it. No successful Xet reconstruction is claimed. Native evidence archive SHA256 736529679e9dacc3e2ba9691749bde8cdf57dd2c50d5e0173ed271fcca3fbc0f.

Inspectable retained TLS evidence

These are field-preserving projections of retained isolated Linux ARM64 runs. Local paths, owned private endpoint addresses and header values are omitted. Native verifier results and legitimate controls are shown explicitly; process exit alone is not used as a TLS verdict. Component reuse is limited to the exact selected executable identity. Source validation, other native platforms, full fallback qualification and fleet delivery remain separate.

{
  "scope": "Actual released native clients in rebuilt Linux ARM64 image; Codex Responses-WebSocket and Claude message request paths",
  "CodexELFSHA256": "8813c8d8a4cea2eeba271b72ab22f49628b184b24ab18dbef06b4ce41e9a8d39",
  "imageID": "sha256:866c2b331740137e46c41c9ab018510582036126eff78d2ff6a8f3c361038d62",
  "oldStoreSHA256": "c3aa6ce83618c247fdeb0afad3a4eb1d01da2eb9035defe70f74c4bbaaca986f",
  "incidentExample": {
    "host": "dv-g3b-emudhra.we-have-a-problem.com",
    "matchedIssuerSPKI_SHA256": "EBED6475C2C2D80FCB199F3FE8DD6E6B3CE60B77EB15D4E42C3DEC0C6F5B5105",
    "oldCurlControl": {
      "sslVerifyResult": 0,
      "httpCode": 405
    },
    "nativeModes": [
      {
        "mode": "codex-default",
        "nativeMarker": "CertDistrusted",
        "outerTimeout": true,
        "exit": null
      },
      {
        "mode": "codex-old-codex",
        "nativeMarker": "CertDistrusted",
        "outerTimeout": true,
        "exit": null
      },
      {
        "mode": "codex-old-ssl",
        "nativeMarker": "CertDistrusted",
        "outerTimeout": true,
        "exit": null
      },
      {
        "mode": "codex-old-proxy",
        "nativeMarker": "CertDistrusted",
        "outerTimeout": true,
        "exit": null
      },
      {
        "mode": "claude-default",
        "nativeMarker": "CERT_REJECTED",
        "outerTimeout": false,
        "exit": 1
      },
      {
        "mode": "claude-old-extra",
        "nativeMarker": "CERT_REJECTED",
        "outerTimeout": false,
        "exit": 1
      },
      {
        "mode": "claude-old-proxy",
        "nativeMarker": "CERT_REJECTED",
        "outerTimeout": false,
        "exit": 1
      }
    ]
  },
  "completeCorpus": {
    "hosts": 14,
    "TLSKeys": 6,
    "CodexRejections": 56,
    "ClaudeRejections": 42
  },
  "legitimateOwnedHTTPSObservedRequestExamples": [
    {
      "path": "/v1/responses",
      "case": "02-codex-private-custom",
      "syntheticAuthorization": true,
      "syntheticAnthropicKey": false
    },
    {
      "path": "/v1/messages?beta=true",
      "case": "05-claude-private-custom",
      "syntheticAuthorization": false,
      "syntheticAnthropicKey": true
    }
  ],
  "limits": [
    "Linux ARM actual released native clients in rebuilt image only.",
    "Codex CertDistrusted proves Responses WebSocket verification; subsequent HTTP errors are generic and not independently attributed to key checks.",
    "Codex negative jobs were externally bounded after4seconds and native rejection; this does not demonstrate normal completion or recovery.",
    "Two code-signing keys have no TLS endpoints and are not exercised.",
    "No Windows/macOS/delegated nativeHTTP backend or fleet/publication claim.",
    "Raw classifier leaves Claude public HTTPS unclassified; actual JSON api_error_status405 proves reached HTTP; this summary supersedes raw classifier for that control."
  ]
}

Actual additional final-effect and runtime evidence

Actual Codex HTTP and fallback wire evidence

Unmodified released Codex0.164.0 Linux ARM64 ELF SHA256 8813c8d8a4cea2eeba271b72ab22f49628b184b24ab18dbef06b4ce41e9a8d39; source 6aaac694803004a63c6f393d153c96d22521a6b9. Historical CA bundle SHA256 c3aa6ce83618c247fdeb0afad3a4eb1d01da2eb9035defe70f74c4bbaaca986f. Consumers reuse this evidence only where their selected ELF matches exactly.

A pass-through CONNECT recorder observed the unchanged CLI, without TLS termination, interception, certificate substitution, decryption, request-payload recording or real credentials. It parsed record lengths and ClientHello/ServerHello fields. Each run had isolated state and a synthetic key. The negative oracle is natural connection closure and complete client-flight records, never timeout or process cleanup.

Mode	Hosts	Connections	Actual client observation
Default HTTP	14	14	Plaintext fatal unknown_ca48; no encrypted client flight
CODEX_CA_CERTIFICATE historical store, HTTP	14	14	CCS + one19-byte encrypted record, then clientEOF
SSL_CERT_FILE historical store, HTTP	14	14	Same19-byte flight and clientEOF
Actual WebSocket failure → HTTP fallback, historical store	14	42	Typed WebSocket CertDistrusted then POST diagnostic; all3connections/host have same19-byte flight and clientEOF

All84incident connections select TLS1.3/cipher0x1302 (AES256GCM/SHA384), with no PSK or early-data offer. All client streams parse completely, with zero trailing bytes. All close before the diagnostic process cleanup signal; zero observation bounds and zero unsettled connections. Four server streams have partial trailing bytes after client abort; this does not truncate the client records.

Inference from the recorded protocol: with this negotiated cipher a client Finished needs at least69protected bytes (48verify data +4handshake header +1inner type +16tag). The only encrypted19-byte flight cannot contain Finished. With no early-data offer and natural closure, the tested conforming CLI cannot have sent an authenticated HTTP request. The19-byte record was not decrypted and is not represented as a decoded alert or typed HTTP CertDistrusted. See RFC8446 §2, §4.4.4, §5.2.

Actual legitimate controls: custom-private-CA HTTP and custom-private-CA WebSocket→HTTP fallback each receive a synthetic authenticated /v1/responses POST. Ordinary public HTTPS reaches HTTP405. Unknown private CA and wrong hostname do not reach private HTTP. Two0.160.0 predecessor controls against incident destinations emit Finished-sized and subsequent large encrypted records; remote reset prevents claiming a successful remote HTTP response. Predecessor ELF SHA256 50b06603bdcdac39b714f5c3e68583c002b8ad8779ebfdaaf4932ff016b379c0.

Inspectable per-case observations

Case	Connections	Close	Client encrypted-record lengths	HTTP POST diagnostic	Typed WebSocket rejection
incident-00-default	1	client-reset	[[]]	True	False
incident-00-codex	1	client-eof	[[19]]	True	False
incident-00-ssl	1	client-eof	[[19]]	True	False
incident-00-fallback	3	client-eof,client-eof,client-eof	[[19], [19], [19]]	True	True
incident-01-default	1	client-reset	[[]]	True	False
incident-01-codex	1	client-eof	[[19]]	True	False
incident-01-ssl	1	client-eof	[[19]]	True	False
incident-01-fallback	3	client-eof,client-eof,client-eof	[[19], [19], [19]]	True	True
incident-02-default	1	client-reset	[[]]	True	False
incident-02-codex	1	client-eof	[[19]]	True	False
incident-02-ssl	1	client-eof	[[19]]	True	False
incident-02-fallback	3	client-eof,client-eof,client-eof	[[19], [19], [19]]	True	True
incident-03-default	1	ConnectionResetError	[[]]	True	False
incident-03-codex	1	client-eof	[[19]]	True	False
incident-03-ssl	1	client-eof	[[19]]	True	False
incident-03-fallback	3	client-eof,client-eof,client-eof	[[19], [19], [19]]	True	True
incident-04-default	1	client-reset	[[]]	True	False
incident-04-codex	1	client-eof	[[19]]	True	False
incident-04-ssl	1	client-eof	[[19]]	True	False
incident-04-fallback	3	client-eof,client-eof,client-eof	[[19], [19], [19]]	True	True
incident-05-default	1	client-reset	[[]]	True	False
incident-05-codex	1	client-eof	[[19]]	True	False
incident-05-ssl	1	client-eof	[[19]]	True	False
incident-05-fallback	3	client-eof,client-eof,client-eof	[[19], [19], [19]]	True	True
incident-06-default	1	client-reset	[[]]	True	False
incident-06-codex	1	client-eof	[[19]]	True	False
incident-06-ssl	1	client-eof	[[19]]	True	False
incident-06-fallback	3	client-eof,client-eof,client-eof	[[19], [19], [19]]	True	True
incident-07-default	1	client-reset	[[]]	True	False
incident-07-codex	1	client-eof	[[19]]	True	False
incident-07-ssl	1	client-eof	[[19]]	True	False
incident-07-fallback	3	client-eof,client-eof,client-eof	[[19], [19], [19]]	True	True
incident-08-default	1	client-reset	[[]]	True	False
incident-08-codex	1	client-eof	[[19]]	True	False
incident-08-ssl	1	client-eof	[[19]]	True	False
incident-08-fallback	3	client-eof,client-eof,client-eof	[[19], [19], [19]]	True	True
incident-09-default	1	client-reset	[[]]	True	False
incident-09-codex	1	client-eof	[[19]]	True	False
incident-09-ssl	1	client-eof	[[19]]	True	False
incident-09-fallback	3	client-eof,client-eof,client-eof	[[19], [19], [19]]	True	True
incident-10-default	1	client-reset	[[]]	True	False
incident-10-codex	1	client-eof	[[19]]	True	False
incident-10-ssl	1	client-eof	[[19]]	True	False
incident-10-fallback	3	client-eof,client-eof,client-eof	[[19], [19], [19]]	True	True
incident-11-default	1	client-reset	[[]]	True	False
incident-11-codex	1	client-eof	[[19]]	True	False
incident-11-ssl	1	client-eof	[[19]]	True	False
incident-11-fallback	3	client-eof,client-eof,client-eof	[[19], [19], [19]]	True	True
incident-12-default	1	client-reset	[[]]	True	False
incident-12-codex	1	client-eof	[[19]]	True	False
incident-12-ssl	1	client-eof	[[19]]	True	False
incident-12-fallback	3	client-eof,client-eof,client-eof	[[19], [19], [19]]	True	True
incident-13-default	1	client-reset	[[]]	True	False
incident-13-codex	1	client-eof	[[19]]	True	False
incident-13-ssl	1	client-eof	[[19]]	True	False
incident-13-fallback	3	client-eof,client-eof,client-eof	[[19], [19], [19]]	True	True

Positive-control observations

[
  {
    "case": "private-control",
    "privateHTTP": [
      {
        "path": "/v1/responses",
        "syntheticAuth": true
      }
    ],
    "response405Observed": false,
    "externalBoundReached": false,
    "unsettledAtCleanup": 0
  },
  {
    "case": "private-fallback-control",
    "privateHTTP": [
      {
        "path": "/v1/responses",
        "syntheticAuth": true
      }
    ],
    "response405Observed": false,
    "externalBoundReached": false,
    "unsettledAtCleanup": 0
  },
  {
    "case": "private-unknown",
    "privateHTTP": [],
    "response405Observed": false,
    "externalBoundReached": false,
    "unsettledAtCleanup": 0
  },
  {
    "case": "private-hostname",
    "privateHTTP": [],
    "response405Observed": false,
    "externalBoundReached": false,
    "unsettledAtCleanup": 0
  },
  {
    "case": "public-control",
    "privateHTTP": [],
    "response405Observed": true,
    "externalBoundReached": false,
    "unsettledAtCleanup": 0
  }
]

Results JSON SHA256 df4c13638aba42614b5ae34d99096d6c696fc8102943defb092f230d2c86fb38; harness SHA256 e7a99a9a91dff63943ff4c55217ee9b4de41683b46716217a1b0b33800547cf1. All63cases/93connections retained locally with per-stream and stdout/stderr hashes. Independent interpretation reviewed the harness and all rows; no implementation change was necessary.

Limits: Linux ARM64 exact native binary via pass-through CONNECT only. The fixture provider explicitly selects each destination, env_key=CODEX_API_KEY, Responses routing and requires_openai_auth=false, using a synthetic key. This exercises the real CLI TLS/HTTP/fallback transport, but does not qualify the default first-party provider credential-selection/authentication integration. This does not qualify direct routing, Windows/macOS/AMD64, arbitrary delegated TLS backends, the independent Responses API proxy, code-signing keys without TLS endpoints, all images or deployed fleets. Previous4second-bounded WebSocket evidence remains historical; this new connection proof closes only the stated HTTP/fallback gap.

Refreshed upstream default-native trust hold (October 24 UTC)

A fresh official GitHub/npm check still selects stable Codex 0.164.0, source 6aaac694803004a63c6f393d153c96d22521a6b9. The newer 0.165.0-alpha.1 and inspected main 970111f6cb62cc02fe36a82ea7d71b37a2889c97 retain the identical complete codex-rs/http-client tree (a3a9da460393dd54f4b1cef30aef4bd528af0287) and relevant TLS dependency lock entries. No released or maintained owning repair for this default-backend gap was identified. The owning source forces Rustls for a selected CA override and otherwise preserves the default builder.

The retained native AMD64 actual-CLI proof, ELF SHA256 b93f6811d3f653f0fb83be4050d857fb9abbb111dfa2ce160563327daff7f306, accepted seven of 14 matching incident chains through client Finished and subsequent encrypted client records on Ubuntu 26's native/default HTTP path. Hold affected default-native uses for an owning repair and actual-artifact default HTTP, default/no-CA WebSocket-to-HTTP fallback, explicit-CA and legitimate HTTPS/private-CA controls. This is an environment/backend-specific demonstrated gap, not an attributed new regression or invalidation of the separate ARM64/explicit-CA proofs above. Provider-authentication status does not establish certificate rejection; credentialed acceptance is tracked separately. No forced-CA workaround, source change or gate waiver is introduced by this status update.

clawsweeper · 2026-10-23T18:37:10Z

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

clawsweeper · 2026-10-23T18:51:35Z

Codex review: needs maintainer review before merge.

What this changes

Updates bundled Codex to 0.164.0 and Claude Code to 2.1.309, and aligns the manual judge workflow with Codex 0.164.0 and Node 24.22.1.

Example: Codex connects to an incident certificate endpoint using a historical CA store on Linux ARM64.

Before: The supplied 0.160.0 controls emit Finished-sized and subsequent encrypted records.
After: The selected 0.164.0 binary closes before TLS completion, including after WebSocket-to-HTTP fallback.

Review scores

Measure	Result	What it means
Overall readiness	🦞 diamond lobster (5/6)	A minimal, useful security refresh with actual shipped-client negative and positive controls, exact-head native build validation, and no actionable findings.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (logs): The complete retained output maps the rebuilt Linux ARM64 image and selected Codex ELF to actual Claude and Codex request paths. Native rejection diagnostics cover incident certificates; additional complete wire observations show Codex HTTP and WebSocket-to-HTTP fallback closing before TLS completion, while allowed private-CA controls receive synthetic authenticated requests and unknown-CA/hostname controls do not. This clears the earlier scoped HTTP/fallback gap. AMD64 TLS behavior, arbitrary delegated backends, independent Xet transport, paid inference, publication, and fleet deployment are expressly outside the demonstrated claim.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Bundled native clients can retain older certificate trust behavior when connecting to affected TLS endpoints.
Reason: The supplied owner-direction context authorizes this narrow trust refresh, and native negative and legitimate controls demonstrate value without expanding the product surface.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: current main retains the older runtime selections, and the focused security update has sufficient scoped behavior evidence with no actionable findings.

Priority: P2
Reviewed head: 48303efea343c744eaa5349ac080c8cc3e447e4a

Before merge

None.

Findings

None.

Agent review details

How this fits together

The Dockerfile selects tools installed into the scanner runtime image; the manual workflow separately installs Codex to exercise judge inspection, producing scan and inspection artifacts.

flowchart TD
  A[Runtime version pins] --> B[Native Docker builds]
  B --> C[Installed scanner and judge tools]
  C --> D[Provider TLS connections]
  D --> E[Scan and judge artifacts]
  F[Manual judge workflow] --> D

Technical review

Best possible solution:

Land the focused version refresh through the existing native image gates, keeping publication and separate upstream transport remediation with their existing owners.

Do we have a high-confidence way to reproduce the issue?

Current-main source confirms the older selections, and supplied predecessor/native-client observations establish the affected transport scenario; this review ran no target code.

Is this the best way to solve the issue?

Updating the existing vendor selections is the smallest complete change for this scope and preserves scanner, sandbox, custom-CA, and publication ownership.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 7343e0e013a7.

Provenance checked

Manual judge runtime selections keeps the original intent (cdcbb17: test: verify live judge artifact inspection on a compatible runner #70 established an opt-in judge inspection check on Ubuntu 22.04 because the newer runner rejected nested sandbox setup.)
Direct Claude runtime selection keeps the original intent (fea9a66: fix: reject compromised CA keys in the Claude runtime #74 selected a released CLI with compromised-key rejection while keeping delivery qualification separate.)
Bundled Codex selection changes intended behavior with a stated reason (128e696: build(deps): refresh bundled scanner and harness tools #65 refreshed existing bundled tools to qualified releases; this PR explains the subsequent security refresh.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

Verified introduced scope: The pinned introduction changes exactly four version selections across two files; scanner sources, adapters, permissions, publication gates, and stored formats are unchanged. (docker/clawscan-runtime/Dockerfile:7, 48303efea343)
Still needed on current main: Fetched main selects Claude Code 2.1.306 and Codex 0.160.0; its manual judge workflow still selects Node 24 and Codex 0.160.0. (docker/clawscan-runtime/Dockerfile:7, 7343e0e013a7)
Complete updated proof inspected: Read the complete live PR body, including the previously omitted HTTP/fallback observations and positive controls. Its SHA256 matches captured source identity 4d85469cd54b02e2bae0697cfaf62df053feb40cb7846229a7a0ecffb740e54a. The evidence identifies the selected ARM64 executable, reports natural closure before TLS completion on 84 incident connections, and shows authenticated private-CA HTTP controls. Credit the updated evidence in fix(security): refresh scanner runtime trust inputs #89 (comment). (48303efea343)
Wire inference checked against TLS contract: The reported absence of early data and insufficient encrypted client bytes for Finished supports rejection before authenticated HTTP; this is a protocol inference, not a decrypted alert. See RFC 8446.
Exact-head validation: Both native runtime-image jobs, Linux/macOS tests, workflow lint, and security analysis succeeded for the reviewed head. The paid judge-inspection job was skipped, and publication was not exercised: https://github.com/openclaw/clawscan/actions/runs/40004772782. (.github/workflows/runtime-image-platform.yml:41, 48303efea343)
Existing feature intent preserved: Read test: verify live judge artifact inspection on a compatible runner #70, fix: reject compromised CA keys in the Claude runtime #74, fix(ci): pin Node releases with incident key rejection #75, and build(deps): refresh bundled scanner and harness tools #65: the update preserves the compatible manual runner, exact tool-selection pattern, private-CA support, and separation between source pins and image delivery. (.github/workflows/judge-inspection-smoke.yml:18, cdcbb17309b6)

Review metrics

Metric	Value	Why it matters
Patch scope	4 additions, 4 deletions; 2 files	Only existing version selections change; no new production machinery or test scaffolding is introduced.

Labels

Label changes:

No label changes.

Label justifications:

P2: A focused runtime trust refresh with demonstrated benefit, without evidence of an urgent active failure introduced by this PR.
rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
proof: sufficient: Contributor real behavior proof is sufficient.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (3 earlier review cycles)

reviewed 2026-10-23T18:50:43.538Z sha 48303ef :: needs real behavior proof before merge. :: none
reviewed 2026-10-23T21:45:00.118Z sha 48303ef :: needs real behavior proof before merge. :: none
reviewed 2026-10-24T02:29:15.556Z sha 48303ef :: needs maintainer review before merge. :: none

Reviewed October 23, 2026, 10:32 PM ET / October 24, 2026, 02:32 UTC (Revision 4).

joshavant · 2026-10-23T21:40:43Z

@clawsweeper re-review

The body now includes retained native TLS diagnostics and legitimate controls tied to the exact artifact. The HTTP fallback and native Xet limitations remain explicit; these results do not qualify those paths.

clawsweeper · 2026-10-23T21:41:09Z

🦞👀
Exact review queued.

Re-review progress:

State: Complete
Detail: The durable review result and its route handoff completed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/40029174840
Updated: 2026-10-23T21:46:46.378Z

joshavant · 2026-10-24T02:26:35Z

@clawsweeper re-review

The body now includes inspectable actual HTTP/fallback wire observations for the exact selected Linux ARM64 Codex binary and explicit platform limits. Product source is unchanged.

clawsweeper · 2026-10-24T02:26:45Z

🦞👀
Exact review queued.

Re-review progress:

State: Complete
Detail: The item is closed; no stale verdict was published.
Run: https://github.com/openclaw/clawsweeper/actions/runs/40453182216
Updated: 2026-10-27T05:04:18.462Z

fix(security): refresh scanner runtime trust inputs

48303ef

joshavant requested review from a team and Patrick-Erichsen as code owners October 23, 2026 18:37

clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Oct 23, 2026

joshavant merged commit 1e9057b into main Oct 25, 2026
30 checks passed

joshavant deleted the security/patched-tool-inputs-20261023 branch October 25, 2026 02:20

clawsweeper Bot mentioned this pull request Oct 26, 2026

fix: refresh frozen SkillSpector certificate roots #94

Merged

Navigation Menu

Repository navigation

fix(security): refresh scanner runtime trust inputs - #89

fix(security): refresh scanner runtime trust inputs#89
joshavant merged 1 commit into
mainfrom
security/patched-tool-inputs-20261023

joshavant commented Oct 23, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Oct 23, 2026 •

edited

Loading

How this fits together

Technical review

Provenance checked

Testing

Security

Evidence

Review metrics

Labels

Rating scale

Workflow

History

Uh oh!

joshavant commented Oct 23, 2026

Uh oh!

clawsweeper Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

joshavant commented Oct 24, 2026

Uh oh!

clawsweeper Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

joshavant commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Scope

Security / Trust Impact

Verification

Notes

Inspectable retained TLS evidence

Actual Codex HTTP and fallback wire evidence

Inspectable per-case observations

Positive-control observations

Refreshed upstream default-native trust hold (October 24 UTC)

Uh oh!

clawsweeper Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ClawSweeper review complete

Uh oh!

clawsweeper Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this changes

Review scores

Product

Merge readiness

Before merge

Findings

How this fits together

Technical review

Provenance checked

Testing

Security

Evidence

Review metrics

Labels

Rating scale

Workflow

History

Uh oh!

joshavant commented Oct 23, 2026

Uh oh!

clawsweeper Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joshavant commented Oct 24, 2026

Uh oh!

clawsweeper Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

joshavant commented Oct 23, 2026 •

edited

Loading

clawsweeper Bot commented Oct 23, 2026 •

edited

Loading

clawsweeper Bot commented Oct 23, 2026 •

edited

Loading

clawsweeper Bot commented Oct 23, 2026 •

edited

Loading

clawsweeper Bot commented Oct 24, 2026 •

edited

Loading