feat: review and publish 16-item Featured selections from monthly installs

[Patrick-Erichsen]

What Problem This Solves

Staff need a complete, explainable Featured proposal: 16 plugins and 16 skills, with editable editorial plugin reservations and the remaining places ranked by recorded adoption.

User Impact

Plugins reserve eight staff-selected entries first and recommend eight distinct eligible entries by installs over 30 completed UTC days; skills recommend 16. Final-seven-day installs then stable identity break ties. Search demand remains separate context. Missing editorial entries stay pending without public links or replacement candidates. Neither recomputation nor editing publishes a selection.

Why This Change Was Made

One stored selection owner provides editorial revision checks, audited publication, and a consistent 16-item capacity. The staff API and CLI publish only the exact ordered identities, versions, reasons, and counts from a completed saved recommendation report, then recheck current eligibility in the publication transaction. Dry runs preserve badges, audit state, and digest state. Publishing currently requires all 16 entries to be ready; three approved editorial entries are still awaiting canonical public releases.

Monthly collection scans the complete positive install population before ranking, with no search, download, incumbent Featured, or publisher bonus. Existing category and security eligibility remain. The dashboard and versioned digest expose counts, periods, capture times, imported-data provenance, pending reasons, and proposed removals. Deploy the compatible Hermit receiver before the v4 sender.

Evidence

At combined stack head 19695a845b7d925714b05e58ff1f50c055f5b7d9: 7,070 unit tests passed (3 skipped), static/audit, full types/build, packages, HTTP/CLI e2e, all three explicit package/Convex type checks, and 19 Chromium smoke tests passed.

Native local Convex plus the real built staff CLI published exact 16-item fixture sets for both catalogs. Twenty altered-evidence, expired-report, changed-version, and stale-publication cases rejected without changing protected state. The accepted autoreview finding about caller-supplied evidence was reproduced before the repair and fixed by authoritative saved-report binding.

Real React/Convex browser proof covers editable reservations, stale-report refresh, 13-ready/3-pending plugins, 16 skills, empty install evidence, and desktop/laptop/tablet/mobile views. No production writes or digest sends occurred. The original baseline fixture has fewer candidates, so those screenshots establish the expanded behavior rather than a controlled ranking comparison. Same-input mobile and public-order regressions have paired failing/passing proof.

An independent read-only production census matched every count in the approved frozen Aug 17–Sep 16 snapshot: 24,140 raw plugin-day rows and 2,220,978 raw skill-day rows; 1,430 and 9,230 nonzero rows, with no duplicate artifact/day pairs or differences. Counts represent recorded install events, not unique users or confirmed successful runtime installs.

The capture uses multiple query snapshots, with explicit collection start/end times. It does not promise an atomic database snapshot across late historical corrections. Saved reports freeze reviewed evidence; publication rejects changed payloads and current ineligibility.

Production +1,803/-461 (net +1,342); tests/fixture support +1,105/-557; generated schema/API +74/-2; docs +107/-19. Growth supplies persistent editable selection ownership, authenticated audited publication, complete monthly aggregation, and staff review surfaces; the prior weighted recommendation path is removed.

Real browser and native publication proof.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Sep 16, 2026 8:43pm UTC

[Patrick-Erichsen]

Autoreview closeout: two review cycles, followed by direct owner/dependency inspection and native proof.

• Accepted and repaired: publication trusted caller-supplied selection evidence. The pre-fix test accepted a forged install count; the canonical publication mutation now loads the saved report, verifies its chunk/hash/expiry contract, and matches exact identities, versions, ordering, basis, reasons, and counts before current eligibility checks. Native API/built-CLI proof rejects 20 altered/expired/stale cases with unchanged protected-state hashes.
• Not accepted as a defect: a single atomic database snapshot across all daily scans is not the specified collection contract. The owner records capture start/end and freezes the resulting report. Parallel or serial action queries are separate snapshots. Concurrent late historical corrections remain an explicit limitation; adding a producer watermark would introduce a new persistence contract. Independent production recount matched the approved frozen evidence exactly.
• Not accepted: split-range child isDone must drive further pagination. Convex explicitly defines fixed endCursor ranges; numItems does not truncate them, isDone describes global query exhaustion, and incomplete fixed ranges emit SplitRequired and are recursively replaced. SDK pagination.ts and use_paginated_query.ts use the same two-range replacement. Native proof split 20 rows into 11+9 with numItems=1 and maximumBytesRead=100: both full ranges returned, the left correctly had isDone=false, and there were no gaps or duplicates. The small fixture did not force a hard transaction SplitRequired; that branch is covered by owner tests and direct native backend source.

Direct dependency sources: https://github.com/get-convex/convex-backend/blob/86001446/crates/isolate/src/environment/udf/async_syscall.rs and https://github.com/get-convex/convex-backend/blob/86001446/crates/database/src/query/index_range.rs. The lead personally inspected these and the installed Convex SDK contract.

[Patrick-Erichsen]

ClawHub UI Proof

Status: pass
Mode: before-after
Scenario: Featured editorial reservations, monthly 16 selections, public approved order
Provider: isolated Playwright + real disposable Convex
Baseline: 50726e9bec5d7a7355256605eebebb6b8bf03872
Candidate: ce75933cdd (production source; d06c696353 test-only closeout)

Eight-slot staff dashboard on original 50726 source	Sixteen staff slots: 13 ready, 3 pending reservations

Before: long publisher hides plugin title at 390px	After: title remains visible beside long publisher

Full videos:

• candidate full run

Raw proof files: https://github.com/openclaw/clawhub/tree/qa-artifacts/clawhub-ui-proof/pr-3765/featured-sixteen

[clawsweeper]

Codex review: blocked before merge. Reviewed September 16, 2026, 4:48 PM ET / 20:48 UTC.

ClawSweeper review

What this changes

Adds editable staff reservations, monthly install ranking, and audited publication of 16 Featured plugins and skills through the dashboard, API, and staff CLI.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep open: this adds meaningful capability absent from main, and no blocking code defect was established. The remaining gate is coordinating the digest receiver rollout.

Priority: P2
Reviewed head: e8fe2f5a82e0c33dfbc6777cba2c125360497238
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A solid implementation with substantial real setup proof and no established blocking code findings; release coordination remains necessary.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (linked_artifact): Inspected native Convex/API and built-CLI receipts show exact 16-entry publication, unchanged dry runs, and rejection of altered, expired, and stale evidence; actual browser screenshots support the staff selection view. Public-order proof belongs to the stacked follow-up, and production receiver deployment is assessed separately.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): Inspected native Convex/API and built-CLI receipts show exact 16-entry publication, unchanged dry runs, and rejection of altered, expired, and stale evidence; actual browser screenshots support the staff selection view. Public-order proof belongs to the stacked follow-up, and production receiver deployment is assessed separately.
Evidence reviewed	10 items	Current main still has the earlier capability: Main limits Featured to eight entries; the new selection owner is absent from both the pinned main tree and v0.23.3. The merged earlier lineup implementation does not supply editable reservations or monthly 16-entry publication. Publication authority checked at the write boundary: Publication verifies active staff authorization, editorial revision, publication timestamp, saved report expiry/hash, exact ordered evidence, and current artifact eligibility/version before changing badges. Existing badge writers are reused and bulk publication suppresses notifications. Inspected real setup proof: Inspected all four prepared screenshots and the linked report/summary. Native local Convex and the built staff CLI recorded exact 16-entry publication for both catalogs, unchanged dry-run state, and 20 rejected altered/expired/stale requests with matching protected-state hashes. Staff screenshots show 13 ready entries and three pending reservations. Native receipts identify local source 45a92c6061158262d58b18ce85a15c0005ab9e7d, which GitHub could not resolve; these are recorded after-fix outcomes, not independently verified execution of the pinned head.
Findings	None	None.
Security	None	None.

How this fits together

ClawHub’s Featured workflow turns catalog eligibility, recorded installs, and staff choices into reviewable selections. Approved publication updates catalog badges, while a separate weekly digest sends recommendation evidence to Hermit.

flowchart TD
  A[Daily install records] --> C[Monthly ranking and eligibility]
  B[Staff editorial reservations] --> C
  C --> D[Saved recommendation report]
  D --> E[Staff approval and current checks]
  E --> F[Featured badges and publication audit]
  C --> G[Weekly digest]
  G --> H[Compatible Hermit receiver]

Loading

Decision needed

Question	Recommendation
Should this sender land only after Hermit v4 deployment is verified, or should the sender switch be separated from the staff workflow?	Verify receiver first: Hold the sender rollout until the compatible Hermit deployment is verified, then land the coordinated change.

Why: Receiver deployment is an external release dependency that source inspection and local proof cannot establish.

Before merge

• Resolve merge risk (P1) - Deploying this sender before a compatible Hermit receiver can cause weekly digests to be rejected and exhaust delivery retries.
• Resolve merge risk (P1) - Pre-change built staff CLIs reject v2 report envelopes; operators must use the documented current-checkout CLI during rollout.
• Complete next step (P2) - Verify compatible Hermit deployment before landing or enabling the v4 sender, and use the current-checkout staff CLI for the backend upgrade.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Diff size	+3,089/-1,039 across 56 files	The change spans backend publication, reporting, staff interfaces, schemas, and validation.
Production versus tests	Production +1,803/-461; tests and fixtures +1,105/-557	Growth is explained by persistent selections, audited publication, monthly aggregation, and staff review surfaces.

Merge-risk options

Maintainer options:

1. Wait for receiver deployment (recommended)
   Pause landing until the compatible Hermit receiver is deployed and operators use the current-checkout staff CLI.
2. Defer v4 emission
   Separate the digest sender activation from the staff feature so receiver deployment can finish independently.

Technical review

Best possible solution:

Retain the shared report and badge owners, deploy the compatible receiver first, and coordinate the current-checkout staff CLI with the backend upgrade.

Do we have a high-confidence way to reproduce the issue?

Not applicable to the feature request; native publication receipts and browser screenshots demonstrate the added workflow.

Is this the best way to solve the issue?

Yes, with coordinated rollout: extending the shared report and badge owners avoids a competing publication path; automatic publication or a source-coded editorial list would violate the documented review model.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 7725f32bf07d.

Labels

Label changes:

• add P2: This is a bounded staff curation improvement without evidence of an urgent user-facing outage.
• add merge-risk: 🚨 compatibility: The v4 sender requires a compatible receiver deployment, and report v2 requires current staff clients.
• add proof: sufficient: Contributor real behavior proof is sufficient. Inspected native Convex/API and built-CLI receipts show exact 16-entry publication, unchanged dry runs, and rejection of altered, expired, and stale evidence; actual browser screenshots support the staff selection view. Public-order proof belongs to the stacked follow-up, and production receiver deployment is assessed separately.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): Inspected native Convex/API and built-CLI receipts show exact 16-entry publication, unchanged dry runs, and rejection of altered, expired, and stale evidence; actual browser screenshots support the staff selection view. Public-order proof belongs to the stacked follow-up, and production receiver deployment is assessed separately.

Label justifications:

• P2: This is a bounded staff curation improvement without evidence of an urgent user-facing outage.
• merge-risk: 🚨 compatibility: The v4 sender requires a compatible receiver deployment, and report v2 requires current staff clients.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): Inspected native Convex/API and built-CLI receipts show exact 16-entry publication, unchanged dry runs, and rejection of altered, expired, and stale evidence; actual browser screenshots support the staff selection view. Public-order proof belongs to the stacked follow-up, and production receiver deployment is assessed separately.
• proof: sufficient: Contributor real behavior proof is sufficient. Inspected native Convex/API and built-CLI receipts show exact 16-entry publication, unchanged dry runs, and rejection of altered, expired, and stale evidence; actual browser screenshots support the staff selection view. Public-order proof belongs to the stacked follow-up, and production receiver deployment is assessed separately.

Evidence

What I checked:

• Current main still has the earlier capability: Main limits Featured to eight entries; the new selection owner is absent from both the pinned main tree and v0.23.3. The merged earlier lineup implementation does not supply editable reservations or monthly 16-entry publication. (convex/lib/featuredPolicy.ts:4, 7725f32bf07d)
• Publication authority checked at the write boundary: Publication verifies active staff authorization, editorial revision, publication timestamp, saved report expiry/hash, exact ordered evidence, and current artifact eligibility/version before changing badges. Existing badge writers are reused and bulk publication suppresses notifications. (convex/featuredSelections.ts:196, e8fe2f5a82e0)
• Inspected real setup proof: Inspected all four prepared screenshots and the linked report/summary. Native local Convex and the built staff CLI recorded exact 16-entry publication for both catalogs, unchanged dry-run state, and 20 rejected altered/expired/stale requests with matching protected-state hashes. Staff screenshots show 13 ready entries and three pending reservations. Native receipts identify local source 45a92c6061158262d58b18ce85a15c0005ab9e7d, which GitHub could not resolve; these are recorded after-fix outcomes, not independently verified execution of the pinned head. (clawhub-ui-proof/pr-3765/featured-sixteen/summary.json, a8a7faae7149)
• Pagination dependency signal: Monthly collection directly uses Convex pagination and recursively replaces SplitRequired ranges. The discussion explicitly relies on the native fixed-end-cursor contract; collection spans multiple snapshots, as documented, rather than promising an atomic historical census. (convex/featuredIntelligence.ts:214, e8fe2f5a82e0)
• Upstream fixed-range contract supports the implementation: The native page reader ignores page size when an end cursor exists, marks pagination-limit failures SplitRequired, and returns the requested end cursor. isDone reflects global End, so a completed left split need not report isDone=true; the previously discussed objection is not a defect. (crates/isolate/src/environment/udf/async_syscall.rs:1750, 86001446f914)
• Sender requires coordinated receiver deployment: New digests unconditionally use v4. The weekly delivery owner sends that payload through the existing Hermit endpoint; the PR body and spec explicitly require deploying the compatible receiver first. (convex/lib/searchEvidenceDigest.ts:262, e8fe2f5a82e0)

Likely related people:

• Patrick-Erichsen: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Record verification of the compatible Hermit deployment and current-checkout staff CLI before enabling the upgraded sender.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[Patrick-Erichsen]

The receiver rollout dependency is satisfied. Hermit #47 merged at 8e6e63a8f29ddf20c5b77626d636c0f6e2a79de4; its tree matches the tested 99d7a44 source. Cloudflare Workers Build 2108c7bc reports success for that exact commit and deployed version 9835056e-ff7a-465a-8f6d-3995975c90a0. Verification used control-plane receipts; no Discord digest was sent. Independent active-traffic allocation lookup was unavailable.

The operator is using the built staff CLI from current tested checkout 19695a845b7d925714b05e58ff1f50c055f5b7d9; authenticated whoami succeeds and the new report-bound featured publish command is present. The pre-upgrade staff CLI will not be used for v2 reports. This addresses the latest ClawSweeper compatibility concerns and its rollout rank-up move.

Exact-head CI passed for all three ClawHub layers: intelligence, public order, homepage. Publication remains separate from deployment and requires the saved reviewed report plus a fresh eligibility check.