feat: report the package and payload build identity from clawctl --version

[paulcam206]

Impact

Reports the installed package version/commit and bundled OpenClaw version/commit through human and JSON clawctl --version output.

The plain version output intentionally changes from one numeric line to the structured clawctl report.

Why This Change Was Made

Support needs the identity of both the packaging build and bundled payload. Local publishing now treats Git discovery as optional and bakes the actual local package version and selected payload metadata into the launcher while preserving no-change deployment behavior.

Evidence

Validated at 25bd6bc:

• .\scripts\Test-Deploy-LocalPackage.Tests.ps1: passed
• .\scripts\Test-DotNetQuality.ps1 on the complete stack
• .\scripts\Test-NativeAotCli.Tests.ps1: 17 intended scenarios passed, including version JSON
• GitHub CI runs on the current head

Stack

1. feat/clawctl json #69 JSON
2. feat: render clawctl help from the live command tree #70 dynamic help
3. feat: report the package and payload build identity from clawctl --version #71 build identity (this PR)
4. feat: wait for the gateway and report where it is listening #72 narrated gateway startup

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 17, 2026, 11:01 PM ET / September 18, 2026, 03:01 UTC (Revision 5).

ClawSweeper review

What this changes

Adds package and bundled OpenClaw versions and commits to clawctl’s text and JSON version output, including local development deployments.

Merge readiness

⛔ Blocked before merge - 1 item remains

This remains useful work absent from current main. The earlier code findings are addressed, and no new blocking defect was found in the introduced patch.

Priority: P2
Reviewed head: 25bd6bcb77b1727ac8e5a22a392a816b286fe12e

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused implementation with prior defects repaired and relevant regression coverage; the intentional text-format compatibility cost is documented.
Proof confidence	🌊 off-meta tidepool	Not applicable: The collaborator exemption applies. Reported NativeAOT scenarios exercise version rendering and JSON, while deployment identity consistency has fixture coverage; installed Windows identity comparison remains an optional improvement.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The collaborator exemption applies. Reported NativeAOT scenarios exercise version rendering and JSON, while deployment identity consistency has fixture coverage; installed Windows identity comparison remains an optional improvement.
Evidence reviewed	8 items	Review boundary and repository policy: The verified introduction boundary is 9daa288..25bd6bc. No root or nested AGENTS.md or maintainer-note directory was found. CONTRIBUTING.md was read fully; its NativeAOT, stack, metadata, and release-file guidance informed review. Current main still reports only the assembly version: Current main's version action reads the launcher's assembly version and writes one line; it does not expose package and payload commits or a version JSON document. Latest release also retains the old behavior: GitHub identifies v2026.9.4-msix.1 as the latest release, targeting ad5df93. Reading its command-line source through GitHub confirmed the same numeric assembly-version output.
Findings	None	None.
Security	None	None.

How this fits together

The Windows packaging build combines the launcher with a selected OpenClaw payload. This change carries their build identities into the launcher so support tools and users can read them through clawctl.

flowchart LR
  A[Packaging checkout] --> C[Package build]
  B[Selected payload metadata] --> C
  C --> D[Compiled build identity]
  E[Version request] --> F{JSON requested?}
  D --> F
  F --> G[Structured JSON]
  F --> H[Readable version report]

Loading

Before merge

• Resolve merge risk (P1) - Existing scripts that parse numeric-only --version output will break unless migrated to --version --json; the PR explicitly accepts this text-format change.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	Production +267/-16; tests +234/-31; documentation +36/-4	Production growth implements compiled identity reporting and local deployment identity consistency, with focused regression coverage.

Merge-risk options

Maintainer options:

1. Accept the documented text-output transition (recommended)
   Land the acknowledged report format and direct numeric-output consumers to the versioned JSON contract.
2. Preserve numeric-only text compatibility
   If existing text parsers must remain supported, retain their output contract and expose the additional identity through JSON.

Technical review

Best possible solution:

Keep identities tied to the actual packaging inputs and use the documented JSON contract for automation under the acknowledged text-output compatibility decision.

Do we have a high-confidence way to reproduce the issue?

Not applicable to this feature request; source inspection confirms that current main and the latest release lack the requested combined build-identity report.

Is this the best way to solve the issue?

Yes. Compiling the existing packaging inputs into the launcher avoids runtime identity drift, and the implementation reuses the established text renderer and source-generated JSON serialization.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against b904c90c1439.

Labels

Label justifications:

• P2: This is a bounded support and deployment diagnostics improvement.
• merge-risk: 🚨 compatibility: The intentional replacement of numeric-only version output requires existing text-parsing consumers to migrate.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The collaborator exemption applies. Reported NativeAOT scenarios exercise version rendering and JSON, while deployment identity consistency has fixture coverage; installed Windows identity comparison remains an optional improvement.

Evidence

What I checked:

• Review boundary and repository policy: The verified introduction boundary is 9daa288..25bd6bc. No root or nested AGENTS.md or maintainer-note directory was found. CONTRIBUTING.md was read fully; its NativeAOT, stack, metadata, and release-file guidance informed review. (CONTRIBUTING.md, 25bd6bcb77b1)
• Current main still reports only the assembly version: Current main's version action reads the launcher's assembly version and writes one line; it does not expose package and payload commits or a version JSON document. (src/OpenClaw.Launcher/ClawCtlCommandLine.cs, b904c90c1439)
• Latest release also retains the old behavior: GitHub identifies v2026.9.4-msix.1 as the latest release, targeting ad5df93. Reading its command-line source through GitHub confirmed the same numeric assembly-version output. (src/OpenClaw.Launcher/ClawCtlCommandLine.cs, ad5df933da4f)
• Build identity follows existing packaging inputs: Build-MSIX passes the same package version, packaging commit, payload version, and resolved payload commit used by its existing metadata record. The project generates statically referenced constants; the version action performs no new metadata-file or process lookup. (scripts/Build-MSIX.ps1:431, 25bd6bcb77b1)
• Earlier findings resolved: Git discovery is optional, deployment supplies the selected package and payload identity, and malformed Boolean options are guarded in the version action. Legacy payload metadata now falls back to unknown. Current tests cover fresh deployment, unchanged reruns, forced updates, and updated launcher identity; the persisted state schema and version-allocation policy remain unchanged. (scripts/Test-Deploy-LocalPackage.Tests.ps1:224, 25bd6bcb77b1)
• Validation and review continuity: The captured body names this head and reports successful local-deployment tests and 17 NativeAOT scenarios, including version JSON. The live body matches that evidence. The prior installed-Windows transcript suggestion remains an optional confidence improvement: this collaborator PR is exempt from the ordinary contributor proof gate, and fresh/update/no-change behavior has focused fixture coverage. No installed-package transcript was supplied or independently executed. (tests/OpenClaw.Launcher.AotSmoke/SmokeProgram.cs:169, 25bd6bcb77b1)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Optionally attach redacted Windows output comparing reported identities with installed metadata after fresh deployment, an update, and an unchanged repeat deployment.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (4 earlier review cycles)

• reviewed 2026-09-18T01:10:18.186Z sha 3341e84 :: blocked before merge. :: [P1] Keep Git discovery optional during local publishing | [P2] Supply the deployed local package and payload identity
• reviewed 2026-09-18T01:54:50.627Z sha 6e32de5 :: blocked before merge. :: [P2] Guard malformed Boolean options in the version action
• reviewed 2026-09-18T02:09:46.786Z sha 98f2899 :: blocked before merge. :: none
• reviewed 2026-09-18T02:35:21.941Z sha 78d6c0c :: blocked before merge. :: none

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: feat: report the package and payload build identity from clawctl --version This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.