feat: deliver deterministic weekly search intelligence through Hermit

[Patrick-Erichsen]

Build a deterministic Monday search-intelligence digest

Problem

Surface aggregate official gaps, Featured candidates, and weekly movement without sharing raw observations.

Change

Schedule Monday 09:00 Pacific delivery using completed UTC weeks. Only advisory intent classification uses a structured model with aggregate-only inputs. Persist shared classification and a frozen, bounded payload atomically; retries reuse it unchanged. All provenance, counts, ranking, and thresholds are deterministic.

Validation

Final integrated ClawHub suite: 6,582 passed, 3 skipped. Latest affected suite: 69 passed. Real Convex proof froze a 19-search completed-week payload and preserved dropped-to-zero movers. Independent review passed. Real Discord proof remains blocked by bot access error 50001.

Review status

Draft for human review. This is a dedicated search-intelligence stack, independent of the plugin-page/category work. No merge or production deployment is authorized.

The full integrated stack at ca843a963a passed bun run ci:unit (6,582 passed, 3 skipped), bun run ci:types-build, package/HTTP/browser checks, and the non-audit static constituents. bun run ci:static remains red on seven dependency advisories in the unchanged baseline lockfile; that repair is deliberately outside this stack. These results are from the saved reviewed head, not a claim that CI on this PR has passed.

Real Discord delivery, duplicate receipt/readback, and Discord UI proof remain incomplete: the configured test bot receives HTTP 403 / Discord 50001 Missing Access for the intended channel. The preview and local tests are not production-delivery evidence.

Related draft PRs

Review ClawHub bottom-to-top: capture → web attribution → dashboard/API/CLI → weekly producer.

Separate-repository companions: OpenClaw Control UI and Hermit receiver. The producer requires the Hermit receiver; the Control UI source marker requires the capture boundary. No plugin-page/category stack branches are included.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Sep 8, 2026 11:13pm UTC

[clawsweeper]

Codex review: blocked before merge. Reviewed September 8, 2026, 7:19 PM ET / 23:19 UTC.

ClawSweeper review

What this changes

Adds a scheduled weekly search-demand digest with advisory classification, persisted retry state, and authenticated delivery through Hermit.

Merge readiness

⛔ Blocked before merge - 5 items remain

This remains distinct, useful work absent from current main. One token-fallback defect needs correction, and the collaborator-authored draft explicitly reserves rollout for human review.

Priority: P2
Reviewed head: ca843a963ab6bedc16d6eba18e42f3c8b6417d31
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The implementation is focused and extensively tested, but a concrete credential-fallback defect and unresolved delivery integration limit readiness.
Proof confidence	🌊 off-meta tidepool	Not applicable: The collaborator-authored PR is exempt from the ordinary external-contributor proof gate. The reported real Convex freeze covers generation; inspected sibling screenshots do not establish Hermit delivery or duplicate receipts, which remain explicit rollout uncertainties.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The collaborator-authored PR is exempt from the ordinary external-contributor proof gate. The reported real Convex freeze covers generation; inspected sibling screenshots do not establish Hermit delivery or duplicate receipts, which remain explicit rollout uncertainties.
Evidence reviewed	10 items	Pinned scope and live state: The introduced delta contains 16 files and two commits. REST verification confirms the same pinned head and stacked base, an open draft, and COLLABORATOR association. Repository policy applied: Read the complete root AGENTS.md and applicable ClawHub maintainer, Convex, and retention guidance. No nested AGENTS.md files were found under convex or specs, and no maintainer-notes directory exists. Inspection remained read-only; no tests or reviewer helpers were executed. Still necessary on main: Current-main searches found existing Hermit content-rights integration but no weekly search-intelligence producer. The supplied related PRs are open stack dependencies, not merged replacements.
Findings	1 actionable finding	[P2] Trim the primary token before selecting the legacy fallback
Security	None	None.

How this fits together

ClawHub turns aggregated plugin searches into weekly demand and curation leads. The producer freezes those facts in Convex and sends them to Hermit, which owns Discord delivery and durable duplicate suppression.

flowchart LR
  A[Search aggregates] --> B[Completed week reports]
  C[Advisory classifier] --> D[Bounded frozen digest]
  B --> D
  E[Monday schedule and retries] --> D
  D --> F[Authenticated Hermit receiver]
  F --> G[Discord message and receipt]
  G --> E

Loading

Decision needed

Question	Recommendation
Should this producer remain inactive until the Hermit receiver and Discord delivery are verified, or land behind an explicit disabled activation gate?	Verify receiver before activation: Keep the draft pending until the receiver, persisted delivery receipts, and coordinated deployment order are verified.

Why: The cron activates automatically, while the companion receiver is still a draft and the author explicitly reserves merge and deployment for human approval.

Before merge

• Trim the primary token before selecting the legacy fallback (P2) - If CLAWHUB_HERMIT_TOKEN contains only whitespace and CLAWHUB_BAN_APPEALS_TOKEN is valid, this expression sends the blank primary credential instead of falling back. Hermit's publisherAbuseDigestApiToken trims before choosing its fallback, so the two services disagree and every delivery attempt fails authentication. Trim both values before the || selection and cover a whitespace-only primary value with a valid fallback.
• Resolve merge risk (P1) - Activating the hourly cron before the companion receiver, shared credentials, and Discord channel permissions are ready can exhaust a week's eight attempts; later configuration repair does not automatically reclaim an exhausted week.
• Resolve merge risk (P1) - Successful delivery, duplicate receipt/readback, and deployment over an existing populated Convex database have not been demonstrated in the reviewed evidence.
• Complete next step (P2) - Correct token fallback, then obtain human approval for activation after receiver delivery, duplicate receipts, and existing-database rollout are verified.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

• [P2] Trim the primary token before selecting the legacy fallback — convex/searchWeeklyDigest.ts:308

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Diff size	+1,839/-1 lines across 16 files	This is the weekly producer delta against its stacked base, excluding upstream stack changes.
Production versus tests	Production +841/-1; tests +902; generated types +10; specs +86	Production growth implements the stated scheduler, classifier, bounded payload, and durable delivery ledger.

Merge-risk options

Maintainer options:

1. Complete receiver readiness before activation (recommended)
   Verify receiver deployment, credentials, channel access, and durable duplicate receipts before enabling the producer cron.
2. Keep the stack paused
   Retain the draft while Discord access and the companion receiver remain unresolved.

Technical review

Best possible solution:

Preserve the shared reporting and frozen-payload design, normalize token fallback, and activate delivery only after the receiver and existing-database rollout are verified.

Do we have a high-confidence way to reproduce the issue?

Yes, for the patch defect: a whitespace-only CLAWHUB_HERMIT_TOKEN selects the wrong credential instead of a valid legacy fallback. This is source-proven; no runtime reproduction was executed.

Is this the best way to solve the issue?

The architecture is appropriate: reuse of canonical reports avoids competing counts, and Hermit retains Discord ownership. Token selection must match the receiver, and coordinated activation remains unproven.

Full review comments:

• [P2] Trim the primary token before selecting the legacy fallback — convex/searchWeeklyDigest.ts:308
  If CLAWHUB_HERMIT_TOKEN contains only whitespace and CLAWHUB_BAN_APPEALS_TOKEN is valid, this expression sends the blank primary credential instead of falling back. Hermit's publisherAbuseDigestApiToken trims before choosing its fallback, so the two services disagree and every delivery attempt fails authentication. Trim both values before the || selection and cover a whitespace-only primary value with a valid fallback.
  Confidence: 0.98

Overall correctness: patch is incorrect
Overall confidence: 0.94

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 651a7641a204.

Labels

Label changes:

• add P2: This is a bounded staff-intelligence feature with a limited token-fallback defect, not an urgent core-user regression.
• add merge-risk: 🚨 message-delivery: Automatic activation before receiver readiness can permanently exhaust that week's delivery attempts.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The collaborator-authored PR is exempt from the ordinary external-contributor proof gate. The reported real Convex freeze covers generation; inspected sibling screenshots do not establish Hermit delivery or duplicate receipts, which remain explicit rollout uncertainties.

Label justifications:

• P2: This is a bounded staff-intelligence feature with a limited token-fallback defect, not an urgent core-user regression.
• merge-risk: 🚨 message-delivery: Automatic activation before receiver readiness can permanently exhaust that week's delivery attempts.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The collaborator-authored PR is exempt from the ordinary external-contributor proof gate. The reported real Convex freeze covers generation; inspected sibling screenshots do not establish Hermit delivery or duplicate receipts, which remain explicit rollout uncertainties.

Evidence

What I checked:

• Pinned scope and live state: The introduced delta contains 16 files and two commits. REST verification confirms the same pinned head and stacked base, an open draft, and COLLABORATOR association. (ca843a963ab6)
• Repository policy applied: Read the complete root AGENTS.md and applicable ClawHub maintainer, Convex, and retention guidance. No nested AGENTS.md files were found under convex or specs, and no maintainer-notes directory exists. Inspection remained read-only; no tests or reviewer helpers were executed. (AGENTS.md:1, ca843a963ab6)
• Still necessary on main: Current-main searches found existing Hermit content-rights integration but no weekly search-intelligence producer. The supplied related PRs are open stack dependencies, not merged replacements. (651a7641a204)
• Latest-release tree check: The supplied v0.23.3 revision contains none of the searched weekly-digest or search-insights module/spec paths; no shipped implementation was established. (87ca030c30f3)
• Introduced token-fallback mismatch: The producer selects the primary token by untrimmed truthiness. A whitespace-only primary value therefore prevents selection of a valid legacy token. Existing ClawHub content-rights integration trims its reused legacy token. (convex/searchWeeklyDigest.ts:308, ca843a963ab6)
• Receiver dependency and token contract: The PR explicitly requires feat: receive and deduplicate weekly ClawHub search intelligence hermit#38. Its receiver uses publisherAbuseDigestApiToken, which trims the primary token before falling back to the trimmed legacy token. The producer directly invokes this receiver's weekly HTTP contract, establishing the dependency boundary. (src/clawhubPublisherAbuse/api.ts:352, b563b0f9a453)

Likely related people:

• Patrick Erichsen: Raw commit 89bb8fe adds convex/httpApiV1/contentRightsV1.ts:80 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 89bb8fe93864; files: convex/httpApiV1/contentRightsV1.ts)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Normalize both Hermit token values before fallback selection and add focused regression coverage.
• Provide redacted receiver delivery and duplicate-receipt evidence, plus existing-database deployment validation, before activation.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.