feat: receive and deduplicate weekly ClawHub search intelligence

[Patrick-Erichsen]

Receive and deduplicate weekly search-intelligence digests

Problem

Keep Discord delivery credentials and durable delivery state in Hermit.

Change

Validate a strict authenticated, bounded aggregate payload. Render Carbon Components V2 with mentions disabled. Reuse D1 for durable deduplication and reconcile uncertain delivery before any resend.

Validation

300 tests, typecheck, and deployment dry-run passed. Real local D1 and protected Carbon preflight were exercised. The requested channel returned 403 / Discord code 50001 before any POST; message, deduplication readback, and Discord UI proof remain pending.

Review status

Draft for human review. This is a dedicated search-intelligence stack, independent of the plugin-page/category work. No merge or production deployment is authorized.

Real Discord delivery, duplicate receipt/readback, and Discord UI proof remain incomplete: the configured test bot receives HTTP 403 / Discord 50001 Missing Access for the intended channel. The preview and local tests are not production-delivery evidence.

Verified commands: bun test tests/searchIntelligenceApi.test.ts, bun run typecheck, bun run test, and bun run deploy:dry-run. No Discord credentials belong in the ClawHub producer.

Related draft PRs

Review ClawHub bottom-to-top: capture → web attribution → dashboard/API/CLI → weekly producer.

Separate-repository companions: OpenClaw Control UI and Hermit receiver. The producer requires the Hermit receiver; the Control UI source marker requires the capture boundary. No plugin-page/category stack branches are included.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 8, 2026, 7:18 PM ET / 23:18 UTC.

ClawSweeper review

What this changes

Adds an authenticated weekly ClawHub digest receiver that posts bounded Discord summaries and stores durable receipts to prevent duplicate delivery.

Merge readiness

⛔ Blocked before merge - 5 items remain

Keep open: this is coherent, distinct work absent from the reviewed main branch, with no merged replacement. Source review found no definite blocking code defect, but the contribution has not demonstrated successful delivery.

Priority: P2
Reviewed head: b563b0f9a45307fb5f4992c9c4445173ac949937
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The patch is coherent and substantially tested, but the central real-service behavior remains unproven.
Proof confidence	🦪 silver shellfish (2/6)	Needs stronger real behavior proof before merge: The reported real Carbon preflight stopped at channel access denial before the production receiver sent anything, so it does not establish Discord delivery or durable deduplication. SQLite tests mock Discord transport and remain supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: The reported real Carbon preflight stopped at channel access denial before the production receiver sent anything, so it does not establish Discord delivery or durable deduplication. SQLite tests mock Discord transport and remain supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	8 items	Repository policy: Read the full root AGENTS.md. No nested AGENTS.md files were found under the changed directories, and .agents/maintainer-notes is absent. The patch uses Carbon V2, the configured review channel, and the main request dispatcher. Introduced scope and current-main boundary: The verified base-to-head delta adds six files or file changes with 1,534 insertions and no deletions. Main's dispatcher has publisher-abuse notifications but no weekly search-intelligence receiver. The repository PR listing contains no merged replacement for this behavior. Durable delivery semantics: A namespaced D1 claim precedes the Discord POST; compare-and-swap updates fence attempts. Uncertain sends only reconcile history and remain blocked when no matching message is found.
Findings	None	None.
Security	None	None.

How this fits together

Hermit receives aggregate search intelligence from ClawHub and delivers it to the configured Discord review channel. D1 receipts coordinate concurrent requests and help reconcile uncertain sends.

flowchart TD
  A[ClawHub weekly digest] --> B[Authenticate and validate]
  B --> C[D1 delivery receipt]
  C --> D{Delivery state}
  D --> E[Post Discord summary]
  D --> F[Read Discord history]
  E --> C
  F --> C
  C --> G[Delivery response]

Loading

Decision needed

Question	Recommendation
Should Hermit own weekly search digests with indefinite blocking when an uncertain Discord send cannot be reconciled?	Sponsor the conservative delivery contract: Approve this direction subject to delivery and persistence proof, with an identified operator for unresolved receipts.

Why: This adds an operational service contract, and the draft explicitly reserves human approval; code review cannot choose the acceptable missed-delivery versus duplicate-delivery tradeoff.

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: The reported real Carbon preflight stopped at channel access denial before the production receiver sent anything, so it does not establish Discord delivery or durable deduplication. SQLite tests mock Discord transport and remain supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve merge risk (P1) - An uncertain send with inaccessible or unmatched channel history remains blocked indefinitely; operating ownership and acceptance of this delivery tradeoff are unresolved.
• Resolve merge risk (P1) - The new persistent receipt format has not been demonstrated across Worker replacement with an existing populated D1 database.
• Complete next step (P2) - Obtain approval for the delivery contract and add successful Discord delivery, deduplication/reconciliation, and persistent upgrade evidence. Screenshots or recordings can show the message; include terminal output or logs for receipts and recovery. Redact credentials and private details. Updating the PR body should trigger review; otherwise ask a maintainer to comment @clawsweeper re-review.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test growth	Production +618 lines; tests +607; proof script +196; docs +113	The added production surface is justified by strict validation, rendering, and durable delivery coordination.

Merge-risk options

Maintainer options:

1. Validate durable delivery before adoption (recommended)
   Provide successful Discord delivery, duplicate and reconciliation readback, and receipt preservation across Worker replacement before approving the operational contract.
2. Keep the integration in draft
   Pause landing while channel access or ownership of unresolved deliveries remains unsettled.

Technical review

Best possible solution:

Keep the receiver narrow, with upgrade-safe receipts and an explicitly approved operational reconciliation path that preserves duplicate prevention.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this adds a new receiver rather than repairing an established behavior; no definite patch defect was established.

Is this the best way to solve the issue?

Yes, the proposed boundary is coherent: Hermit retains Discord credentials and receipts while ClawHub produces aggregates; operational acceptance and real delivery evidence remain outstanding.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against fd6920504d12.

Labels

Label changes:

• add P2: This is a bounded operational reporting feature with no demonstrated urgent regression.
• add merge-risk: 🚨 compatibility: Durable receipt state becomes a persistent contract whose preservation across Worker replacement still needs evidence.
• add merge-risk: 🚨 message-delivery: Unreconciled sends intentionally remain blocked, and successful delivery and recovery have not yet been observed.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The reported real Carbon preflight stopped at channel access denial before the production receiver sent anything, so it does not establish Discord delivery or durable deduplication. SQLite tests mock Discord transport and remain supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P2: This is a bounded operational reporting feature with no demonstrated urgent regression.
• merge-risk: 🚨 message-delivery: Unreconciled sends intentionally remain blocked, and successful delivery and recovery have not yet been observed.
• merge-risk: 🚨 compatibility: Durable receipt state becomes a persistent contract whose preservation across Worker replacement still needs evidence.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The reported real Carbon preflight stopped at channel access denial before the production receiver sent anything, so it does not establish Discord delivery or durable deduplication. SQLite tests mock Discord transport and remain supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Repository policy: Read the full root AGENTS.md. No nested AGENTS.md files were found under the changed directories, and .agents/maintainer-notes is absent. The patch uses Carbon V2, the configured review channel, and the main request dispatcher. (AGENTS.md:1, b563b0f9a453)
• Introduced scope and current-main boundary: The verified base-to-head delta adds six files or file changes with 1,534 insertions and no deletions. Main's dispatcher has publisher-abuse notifications but no weekly search-intelligence receiver. The repository PR listing contains no merged replacement for this behavior. (src/index.ts:156, b563b0f9a453)
• Durable delivery semantics: A namespaced D1 claim precedes the Discord POST; compare-and-swap updates fence attempts. Uncertain sends only reconcile history and remain blocked when no matching message is found. (src/clawhubSearchIntelligence/delivery.ts:99, b563b0f9a453)
• Persistence compatibility coverage: The tests initialize the existing initial SQL migration and exercise immutable receipts, concurrent claims, rejected-send retries, response loss, and failed receipt writes. They do not demonstrate retaining receipts across a Worker replacement against a populated persistent D1 database. No tests or build scripts were executed during this read-only review. (tests/searchIntelligenceApi.test.ts:84, b563b0f9a453)
• Captured contributor proof: The complete supplied PR body explicitly reports HTTP 403 / Discord 50001 during channel preflight, before any message POST, and says delivery, duplicate readback, and Discord UI evidence remain pending. Captured context sourceRevision: 9f66370dc77c10dca624c18d60941cf75701d79ee84fe0a20464cdd89261af8f. The proof script distinguishes local/test-bot evidence from production deployment. (scripts/proof-search-intelligence.ts:93, b563b0f9a453)
• Companion producer contract: The PR explicitly depends on the producer at feat: deliver deterministic weekly search intelligence through Hermit clawhub#3633. Its inspected contract matches the receiver's field names, and its delivery helper posts to the new endpoint and verifies ok, delivered, and weekEnd. That companion remains open and unmerged. (convex/lib/searchDigestContract.ts:35, ca843a963ab6)

Likely related people:

• jesse-merhi: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Provide a successful production-handler run using persistent D1 and an authorized Discord bot, showing one message, repeat receipt readback, and uncertainty reconciliation.
• Demonstrate receipt preservation across Worker replacement on populated storage without altering unrelated keys.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.