fix(audio): pin download redirects and bound ElevenLabs bodies

[SebTardif]

What Problem This Solves

Voice Settings Whisper and Piper downloads used new HttpClient() with default redirect following. A compromised Hugging Face Location can send the desktop to an off-allowlist host. SHA-256 still rejects a swapped blob, but the request still leaves the allowlist. ElevenLabs TTS also buffered the entire HTTP body with no size cap. MiniMax already caps at 32 MiB.

Evidence

Terminal output from the patched tree:

$ dotnet test tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --filter FullyQualifiedName~AllowedAssetDownloadTests
Passed!  - Failed: 0, Passed: 3

$ dotnet test tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --filter FullyQualifiedName~ElevenLabsTextToSpeechClientTests
Passed!  - Failed: 0, Passed: 6

AllowedAssetDownload.ValidateDownloadUri accepts huggingface.co and *.huggingface.co on redirects, and rejects https://evil.example/model.bin. ElevenLabs rejects a body larger than 32 MiB.

Required proof pools

• none: Transport-only audio download redirect validation and ElevenLabs HTTP body-size admission. No WinUI controls, UI event wiring, accessibility, permissions, native dependencies, packaging, Gateway, or hardware-specific paths change. Current-head production-manager live catalog installs/re-downloads, controlled production redirect traversal, real localhost HTTP normal/boundary/overflow responses, and full build/tests directly prove the changed contract. Maintainer-approved scope assessment follows .github/proof-pools.json selection rules; this does not count an unrun interactive pool as passed.

Visual Voice Settings behavior, audible playback, valid-audio decoding, and actual ElevenLabs provider availability remain not verified, outside this diff's proof scope.

Validation

Maintainer validation on 2026-09-23 at integrated head 8631bcf4b728f30043166295671491a26eac16e4, native Windows ARM64, private .NET SDK 10.0.400. Current main a2c4647d was merged into the original contributor branch without conflicts, rebase, force-push, or replacement PR. All six audio patch file blobs are unchanged from author head a5e730d2; the net PR remains 170 additions / 7 deletions. Existing patch review is reused because integration did not change its implementation.

OPENCLAW_REPO_ROOT pointed to the isolated worktree; unique tray data/appdata directories were used. Global-state/local-appdata overrides and E2E flags were unset. No provider credentials, paid synthesis, desktop launch, gateway, or WSL activity in local proof.

.\build.ps1
dotnet build .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --verbosity quiet
dotnet build .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --verbosity quiet
dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore --logger 'trx;LogFileName=shared.trx' --results-directory $artifacts --verbosity quiet
dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore --logger 'trx;LogFileName=tray.trx' --results-directory $artifacts --verbosity quiet
dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore --filter 'FullyQualifiedName~AllowedAssetDownloadTests|FullyQualifiedName~AssetHashPinningTests|FullyQualifiedName~PiperVoiceExtractionTests|FullyQualifiedName~SingleFlightDownloadTests' --logger 'trx;LogFileName=audio-owner.trx' --results-directory $artifacts --verbosity quiet
dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore --filter 'FullyQualifiedName~ElevenLabsTextToSpeechClientTests' --logger 'trx;LogFileName=audio-tray.trx' --results-directory $artifacts --verbosity quiet

Validation at integrated head	Result
Full repo build, including native ARM64 WinUI and documentation gate	PASS
Shared suite	4,093 passed, 35 skipped, 0 failed
Tray suite	3,065 passed, 0 skipped, 0 failed
Focused redirect/integrity/extraction/single-flight suite	16 passed
Focused ElevenLabs suite	6 passed
Fresh Build and Test / CI Gate	PASS: run 35901406759

Fresh CI also passed Core/CLI, Tray/setup/integration, UI/functional/accessibility, setup/connect E2E, revocation recovery E2E, and network recovery E2E. These hosted results are not claimed as local interactive audio proof. Live final disposition: CLEAN, MERGEABLE, no formal reviews or inline review threads. ClawSweeper's latest review reports no actionable findings and sufficient transport proof; final compatibility-policy/merge approval remains with the landing maintainer.

Skipped cases are not counted as runtime proof. Prior-head results remain in separate historical artifacts and are not substituted for integrated-head validation.

Real behavior proof

Integrated-head maintainer runtime evidence (2026-09-23)

The artifact-only harness referenced the actual built OpenClaw.Shared.dll, invoked its internal AllowedAssetDownload.GetAsync through reflection, and compiled the unmodified production ElevenLabsTextToSpeechClient.cs directly against that assembly. The Shared assembly informational version contains exact head 8631bcf4b728f30043166295671491a26eac16e4. This is execution of production code, not a reimplementation.

Integrated Shared.dll SHA256:
6079D89034D879188FFF7B6E0B2AF1482510676DA88E2A20E249CA8D954FD299
Unchanged ElevenLabsTextToSpeechClient.cs SHA256:
8D9C5FC9D2B32C9A9581359A6C6B16B06F89A9F790B1B7F4FEB538F32A334A11

Commands, with $proof identifying the retained session-artifact harness directory:

dotnet run --project "$proof\AudioProof.csproj" --verbosity quiet
dotnet run --project "$proof\AudioProof.csproj" --verbosity quiet -- --live

Official live catalog compatibility, repeated after integration: production WhisperModelManager.DownloadModelAsync and PiperVoiceManager.DownloadVoiceAsync each downloaded, deleted from an owned temporary directory, and downloaded again. Normal TLS verification, pinned catalog hashes, redirect validation, and extraction remained enabled. No user cache was accessed. Whisper tiny is the smallest Whisper catalog entry; official release metadata identified fr_FR-siwis-low as the smallest supported Piper archive (26,522,254 bytes).

PASS Whisper tiny attempt=1: 77,691,713 bytes, pinned SHA256 matched, no .tmp
PASS Whisper tiny attempt=2: 77,691,713 bytes, pinned SHA256 matched, no .tmp
Whisper SHA256: be07e048e1e599ad46341c8d2a135645097a538221678b7acdd1b1919c6e1b21
PASS Piper fr_FR-siwis-low attempt=1: verified hash/extraction/layout, model=20,578,718 bytes
PASS Piper fr_FR-siwis-low attempt=2: verified hash/extraction/layout, model=20,578,718 bytes
PASS Piper temporary archives and .installing markers absent after both installs
Owned catalog data cleaned: True

Compatibility boundary: live downloads cover two representative assets out of ten, not every catalog asset or future upstream redirect. A future off-allowlist CDN destination intentionally fails closed instead of being requested; accommodating a legitimate new destination would require a reviewed application allowlist update, not disabling redirect checks or TLS verification.

Controlled production redirect traversal: 301/302/303/307/308 each followed a relative hop and permitted CDN hop to success. Off-allowlist, lookalike-domain, HTTP, credential-bearing, and fragment-bearing destinations were rejected after the initial request; the rejected target was never requested. A loop stopped after six requests (initial plus five redirects), missing Location was rejected, and redirect responses were disposed. The production factory uses SocketsHttpHandler.AllowAutoRedirect=false. This part uses controlled in-memory transport, not localhost HTTPS or an attacker-host request; the official downloads separately exercise real internet transport.

ElevenLabs real localhost TCP HTTP: a synthetic POST passed through the production client. No real key or user text was used.

PASS Content-Length normal response: 37 bytes preserved, audio/mpeg preserved
PASS chunked unknown-length boundary: 33,554,432 bytes accepted and preserved
PASS Content-Length overflow: 33,554,433-byte declaration rejected without sending its body
PASS chunked unknown-length overflow: 33,554,433-byte body rejected

Early rejection / allocation bound: a generated 1 GiB logical stream avoids allocating the offered body. Known-length overflow read zero body bytes. Unknown-length overflow consumed only 33,619,968 bytes (32 MiB plus one 64 KiB read), cumulatively allocated 67,117,832 bytes, and disposed the body. The harness requires allocations below 80 MiB, catching destination growth to 64 MiB or whole-body buffering. Cumulative allocation is not peak working set.

Retained evidence: session 41d6c280-f27d-481a-a9ff-a5cc8c5d2d78, files\integrated-8631bcf4: validation.log, shared.trx, tray.trx, audio-owner.trx, audio-tray.trx, fixture.log, live-catalog.log, proof-identity.json, ci-watch.log, and final-review-state.json. Reusable harness source is in sibling files\audio-proof; exact validation environment is in files\validate-audio.ps1. These are local maintainer artifacts, not public attachment links. All owned catalog assets and isolated unit settings were removed after proof.

Not verified (outside changed transport scope): visible Voice Settings progress/ready/error presentation, audible local playback, valid-audio decoding, and actual ElevenLabs provider availability or paid synthesis. No passing claim is made for these. Gateway proof is not applicable. The earlier interactive-pool request was reassessed against the actual unchanged UI implementation, not silently treated as satisfied.

Original contributor proof (preserved)

• Behavior or issue addressed: Audio model HTTP clients followed arbitrary redirects; ElevenLabs TTS had no response size cap.
• Real environment tested: Windows 11, .NET SDK 10.0.401, openclaw-windows-node checkout.
• Exact steps or command run after this patch:

dotnet test tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --filter FullyQualifiedName~AllowedAssetDownloadTests
dotnet test tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --filter FullyQualifiedName~ElevenLabsTextToSpeechClientTests

• Evidence after fix: terminal output from the patched tree:

Passed!  - Failed: 0, Passed: 3 - OpenClaw.Shared.Tests.dll
Passed!  - Failed: 0, Passed: 6 - OpenClaw.Tray.Tests.dll

• Observed result after fix: Whisper and Piper use AllowAutoRedirect=false and only follow HTTPS hosts on the Hugging Face / GitHub allowlist. ElevenLabs reads through a 32 MiB bounded copy, same shape as MiniMax.
• What was not tested: A live Voice Settings download against huggingface.co.

Summary

Pin Whisper/Piper download redirects and cap ElevenLabs TTS bodies.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 23, 2026, 2:43 PM ET / 18:43 UTC (Revision 6).

ClawSweeper review

What this changes

The branch checks each Whisper and Piper asset redirect against approved HTTPS hosts and caps ElevenLabs speech responses at 32 MiB.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep open. Current main and v2026.9.4 lack this hardening, and the focused patch has credible current-head transport proof. The landing owner still needs to settle CDN compatibility and the collaborator’s interactive Voice Settings proof request.

Priority: P2
Reviewed head: 8631bcf4b728f30043166295671491a26eac16e4
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The focused patch and substantial production-path traces support a normal good rating, with compatibility and interactive proof scope left for the landing owner.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (terminal): The PR body reports current-head Windows runs through the production Whisper and Piper managers, the production redirect loop with controlled redirects, and localhost HTTP through the production ElevenLabs client; observed results include successful re-downloads, rejected targets never requested, and 32 MiB boundary and overflow handling. Interactive Voice Settings and paid-provider playback remain unverified and need the separate landing disposition. No stored-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The PR body reports current-head Windows runs through the production Whisper and Piper managers, the production redirect loop with controlled redirects, and localhost HTTP through the production ElevenLabs client; observed results include successful re-downloads, rejected targets never requested, and 32 MiB boundary and overflow handling. Interactive Voice Settings and paid-provider playback remain unverified and need the separate landing disposition. No stored-data contract changes.
Evidence reviewed	10 items	Current main still follows asset redirects: The pinned main revision creates an ordinary HttpClient for Whisper downloads; Piper has the same pattern. Current main buffers the full ElevenLabs body: The pinned main revision reads the complete HTTP response as a byte array. Latest release lacks the response bound: Release v2026.9.4 still uses the unbounded ElevenLabs read; no release tag contains the PR's introducing commit.
Findings	None	None.
Security	None	None.

How this fits together

Voice Settings obtains catalogued models and voices for local speech features. The speech service sends text to ElevenLabs and passes the returned audio to playback.

flowchart LR
A[Voice Settings] --> B[Asset catalog URL]
B --> C[Redirect host check]
C --> D[Verified local model]
E[Speech text] --> F[ElevenLabs response]
F --> G[Body size check]
G --> H[Audio playback]

Loading

Decision needed

Question	Recommendation
Will the landing owner accept off-list CDN failures and the current transport-only proof for this audio change, or require isolated Voice Settings proof before merge?	Capture interactive proof: Exercise a current-head isolated Voice Settings download, error state, and playback path, then approve the restricted CDN policy.

Why: The collaborator expressly allows an explicit proof disposition, but the PR body alone does not establish who approved its scope or accepted future CDN compatibility failures. The prior rank-up move remains open through this choice.

Before merge

• Resolve merge risk (P1) - An official asset that begins redirecting to an off-list CDN will now fail to download; the live compatibility run covered two of ten catalog assets, so the landing owner must accept the fail-closed policy and its application-update path.
• Resolve merge risk (P1) - The collaborator requested isolated Voice Settings progress, ready/error, and playback proof or an explicit maintainer disposition. The PR documents transport proof and unverified interactive behavior, but no explicit landing-owner disposition is visible.
• Complete next step (P2) - The landing owner must explicitly approve or mitigate off-list CDN failures and disposition the isolated Voice Settings proof request before merge.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Code and test delta	production +110/-7 lines; tests +60/-0 lines	The production growth implements redirect checks and bounded streaming; committed tests cover URI predicates and declared-length overflow.
Live catalog coverage	2 of 10 assets downloaded and re-downloaded	The reported runs establish representative compatibility while leaving other catalog redirect chains unobserved.

Merge-risk options

Maintainer options:

1. Verify the user path (recommended)
   Capture isolated Voice Settings behavior at this head and explicitly approve the restricted CDN update policy.
2. Accept the documented limits
   Explicitly accept transport-only proof and the possibility that a future official CDN redirect will require an application update.

Technical review

Best possible solution:

Keep per-hop HTTPS host enforcement and bounded response reading, establish ownership of future CDN allowlist updates, and settle the Voice Settings proof scope before release.

Do we have a high-confidence way to reproduce the issue?

Yes. Current-main source clearly permits automatic asset redirects and buffers the full ElevenLabs body; this read-only review did not execute a failing current-main run.

Is this the best way to solve the issue?

Yes. Validating each redirect before network I/O and bounding declared and streamed response bodies directly address the reported paths; the remaining question is the intended compatibility and proof policy.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a2c4647d4289.

Labels

Label changes:

No label changes.

Label justifications:

• P2: This focused security and resource-bound improvement has limited demonstrated user impact.
• merge-risk: 🚨 compatibility: A future off-list CDN redirect could stop a model or voice download that the previous client followed.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body reports current-head Windows runs through the production Whisper and Piper managers, the production redirect loop with controlled redirects, and localhost HTTP through the production ElevenLabs client; observed results include successful re-downloads, rejected targets never requested, and 32 MiB boundary and overflow handling. Interactive Voice Settings and paid-provider playback remain unverified and need the separate landing disposition. No stored-data contract changes.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body reports current-head Windows runs through the production Whisper and Piper managers, the production redirect loop with controlled redirects, and localhost HTTP through the production ElevenLabs client; observed results include successful re-downloads, rejected targets never requested, and 32 MiB boundary and overflow handling. Interactive Voice Settings and paid-provider playback remain unverified and need the separate landing disposition. No stored-data contract changes.

Evidence

What I checked:

• Current main still follows asset redirects: The pinned main revision creates an ordinary HttpClient for Whisper downloads; Piper has the same pattern. (src/OpenClaw.Shared/Audio/WhisperModelManager.cs:125, a2c4647d4289)
• Current main buffers the full ElevenLabs body: The pinned main revision reads the complete HTTP response as a byte array. (src/OpenClaw.Tray.WinUI/Services/TextToSpeech/ElevenLabsTextToSpeechClient.cs:85, a2c4647d4289)
• Latest release lacks the response bound: Release v2026.9.4 still uses the unbounded ElevenLabs read; no release tag contains the PR's introducing commit. (src/OpenClaw.Tray.WinUI/Services/TextToSpeech/ElevenLabsTextToSpeechClient.cs:85, 3c43751b2bac)
• Introduced redirect enforcement: The PR disables automatic redirects, validates the initial URI and each redirect target before the next request, and limits redirect count. (src/OpenClaw.Shared/Audio/AllowedAssetDownload.cs:13, 8631bcf4b728)
• Introduced response bound: The PR rejects declared lengths above 32 MiB and checks accumulated bytes when the length is unknown. (src/OpenClaw.Tray.WinUI/Services/TextToSpeech/ElevenLabsTextToSpeechClient.cs:105, 8631bcf4b728)
• Existing asset integrity contract: The catalog documentation requires pinned URLs and hashes, fail-closed verification, and a real download check for asset changes. (docs/AUDIO_MODEL_ASSETS.md:18, 8631bcf4b728)

Likely related people:

• shanselman: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• RBrid: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Karen: Raw commit ff3fb35 adds src/OpenClaw.Tray.WinUI/Services/TextToSpeech/MiniMaxTextToSpeechClient.cs:36 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: ff3fb35a7d32; files: src/OpenClaw.Tray.WinUI/Services/TextToSpeech/MiniMaxTextToSpeechClient.cs)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Complete isolated Voice Settings proof or record the landing owner's explicit acceptance of that gap and the fail-closed CDN policy.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-09-14T20:50:51.365Z sha c2a95f5 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-14T21:50:55.793Z sha a5e730d :: needs real behavior proof before merge. :: none
• reviewed 2026-09-23T18:07:23.087Z sha a5e730d :: needs real behavior proof before merge. :: none
• reviewed 2026-09-23T18:22:11.875Z sha 8631bcf :: blocked before merge. :: none
• reviewed 2026-09-23T18:30:07.719Z sha 8631bcf :: blocked before merge. :: none

[karkarl]

Global repo triage reviewed exact head a5e730d2119b26ded4ae1d0b2a1079146a776f56.

Decision: NEEDS_HUMAN_TEST. Take confidence: 68%. Recommendation confidence: 98%. Risk: High compatibility.

The implementation is focused and exact-head CI is green, but the compatibility and streaming boundaries are not yet proven. Redirect tests call only ValidateDownloadUri; they do not execute the production redirect loop or successful Whisper/Piper catalog downloads. The ElevenLabs overflow test uses a known-length body rather than unknown-length streaming. The PR body also lacks the exact required proof and validation headings.

Add the required sections, run current-head Voice Settings download/re-download and normal synthesis proof under windows-winui-interactive, and add loopback tests showing off-list redirects are never requested and unknown-length oversized responses are rejected.

[karkarl]

Global triage: NEEDS_HUMAN_TEST. Take confidence 86%; recommendation confidence 96%; effort small; risk medium-high compatibility.

Reviewed exact head 8631bcf4b728. The only change since the prior reviewed head is a clean merge of current main; the audio patch itself is unchanged. The refreshed body now supplies the previously missing production redirect-loop coverage, real Whisper/Piper catalog download and re-download proof, unknown-length 32 MiB boundary/overflow coverage, and bounded-allocation evidence. That resolves the earlier transport and streaming concerns.

Remaining gate is the declared windows-winui-interactive pool: current-head visible Voice Settings progress/ready/error behavior and audible local playback are still explicitly not verified. Exact-head CI is also still pending after the main merge. Keep the pool blocked rather than treating synthetic ElevenLabs transport as audible/provider proof, and land only after current checks finish and the interactive proof is captured or explicitly dispositioned by a maintainer.

[shanselman]

Maintainer landing decision

Explicitly authorized for head 8631bcf4b728f30043166295671491a26eac16e4, integrated with main a2c4647d4289ee3adf8db334e21e7148df411a48.

The landing owner accepts the documented transport-only proof at 96% confidence and the none custom proof-pool declaration. This patch changes HTTP redirect validation and response-body admission, not WinUI controls, permissions, UI wiring, playback, native dependencies, or hardware-specific paths. Production-manager catalog install/re-download, actual production redirect traversal, and localhost HTTP known/unknown-length boundary/overflow proof directly exercise the changed contract.

The representative live catalog coverage is explicitly limited to two of ten assets. The intentional fail-closed policy for future off-list CDN redirects is accepted: a legitimate new CDN requires an application allowlist update after trusted provenance review. Do not bypass the restriction, weaken redirect security, or disable TLS verification.

This explicitly dispositions the earlier interactive Voice Settings proof request as outside this transport-only diff's required scope, not as a passed UI test. Visible Voice Settings behavior, audible playback, valid-audio decoding, and actual ElevenLabs provider availability remain unverified.

At this head, full local build passed; Shared 4,093 passed / 35 skipped, Tray 3,065 passed, and focused suites 22 passed. The production transport and official catalog proof was repeated after integration. Fresh Build and Test / CI Gate passed. The latest advisory review identifies no actionable code/security finding; its remaining compatibility and proof-scope decisions are explicitly settled above.

Proceed with normal, non-admin, exact-head-guarded squash merge. No force push, check bypass, replacement PR, or branch deletion.