RFC 0029: clarify Control Model capability and additive scope

[giodl73-repo]

Updates RFC 0029 so the upstream review ask is explicit and bounded:

• Control Model v1 and UI artifacts are the first native-product surface.
• Hosted Control UI policy is now included as a related sibling sidecar with its own acceptance gate.
• Board Model, Config Model, Managed Configuration, and Policy lockdown remain additive sibling contracts with separate gates, not hidden Control Model v1 scope.
• Same-repository Lobster evidence is reflected: #9248 merged carry, #9384 merged SessionView adoption, and #9605 native-table follow-up.
• Capability advertisement is advisory/private and does not install renderers or authorize operations.
• The a2ui/uiDetails appendix includes a concrete mapping example and keeps actions non-executable.

Sidecar specs now linked from the RFC:

• Control Model v1: rfcs/0029/control-model-v1-spec.md
• UI artifact v1: rfcs/0029/ui-artifact-v1-spec.md
• Hosted Control UI policy v1: rfcs/0029/hosted-control-ui-policy-v1-spec.md

Implementation drafts linked from the RFC:

• CM1 foundation: RFC 0029 CM1: add Control Model session foundation openclaw#127670
• CM2 conversations/commands: RFC 0029 CM2: add Control Model conversations openclaw#127671
• CM3 UI artifacts: RFC 0029 CM3: add renderer-neutral UI artifacts openclaw#127672
• CM4 conformance/package/perf/compat/security hardening: RFC 0029 CM4: harden Control Model conformance and security openclaw#127674
• CM5 Control UI command/interaction/artifact adoption: RFC 0029 CM5: adopt Control Model in Control UI commands and artifacts openclaw#127675

Hosted policy siblings linked from the RFC:

• Umbrella issue: Host-controlled Control UI surface for embedded and managed deployments openclaw#115423
• Host Control UI policy draft: Add host Control UI policy openclaw#115408
• Hosted Gateway policy enforcement draft: Add hosted Gateway policy enforcement openclaw#116013
• Fork-only settings constraint evidence: feat(policy): expose settings constraints contract giodl73-repo/openclaw#196 through test(policy): add settings constraints examples giodl73-repo/openclaw#202

Scope guard: the hosted-policy sidecar is related and belongs in the one-shot RFC family, but it is not a Control Model v1 dependency. Each sidecar has an independent conformance and acceptance gate.

Validation: git diff --check in C:\src\openclaw-rfcs-control-model.

Renderer-path clarification (2026-08-28)

The latest revision makes the presentation paths explicit:

• product clients own their allowlisted native component catalogs;
• existing OpenClaw MCP Apps and Canvas remain sandboxed executable-UI paths;
• current OpenClaw A2UI v0.8 support is Canvas-hosted evidence, not native-catalog proof;
• A2UI may become an optional renderer dialect without becoming a Control Model v1 requirement; and
• patch streaming and dynamic vocabulary negotiation remain future contracts requiring bounded semantics and cross-client evidence.

A runnable protocol-shape prototype covers exact dialect/catalog selection, composed A2UI messages, explicit MCP App fallback, structured fallback, and fail-closed version handling. It is not claimed as renderer conformance.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 9, 2026, 1:29 AM ET / 05:29 UTC (Revision 29).

ClawSweeper review

What this changes

Adds a framework-neutral conversation-model proposal, companion contracts and adoption plans, and a runnable example of renderer selection and fallback.

Merge readiness

⛔ Blocked before merge - 3 items remain

Keep open for RFC acceptance. The contributor’s new terminal evidence resolves the prototype proof gap; the required maintainer discussion and scope decision remain outstanding. No same-repository merged replacement was established.

Priority: P3
Reviewed head: cd607785aa4b60eef260cb4d2dbba385738026d1
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The proposal has clear boundaries and sufficient example execution evidence, with one minor metadata correction remaining.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (terminal): The September 9 contributor transcript runs the changed standalone Node prototype and reports its asserted selection, fallback, and version-rejection results; this satisfies proof for the example without claiming browser rendering, Gateway authorization, or implementation conformance.
Patch quality	🐚 platinum hermit (4/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The September 9 contributor transcript runs the changed standalone Node prototype and reports its asserted selection, fallback, and version-rejection results; this satisfies proof for the example without claiming browser rendering, Gateway authorization, or implementation conformance.
Evidence reviewed	7 items	Pinned scope and current main: The verified introduction adds nine files and 2,864 lines. The current-main tree does not contain RFC 0029. The proposal explicitly remains submitted, unaccepted, and unreleased; no implementation-close provenance was established. RFC acceptance policy: README requires a maintainer-discussion thread and prohibits merging an RFC while its status is draft; acceptance precedes creating the implementation issue and updating metadata. After-change prototype evidence: The captured September 9 comment supplies direct Node execution output for supported composition, explicit MCP fallback, structured fallback, and invalid-version rejection: #62 (comment). These outputs match the inspected prototype assertions and final console messages. The contributor expressly limits the claim to example behavior, not renderer conformance.
Findings	1 actionable finding	[P3] Refresh the RFC update date
Security	None	None.

How this fits together

This repository records OpenClaw design proposals. The proposed Control Model would turn Gateway events and history into shared conversation snapshots and commands for Control UI and independently owned product interfaces.

flowchart LR
  A[Gateway events and history] --> B[Existing Gateway client]
  B --> C[Proposed Control Model]
  C --> D[Conversation snapshots]
  D --> E[OpenClaw Control UI]
  D --> F[Independent product interface]
  F --> G[Typed commands]
  G --> B

Loading

Decision needed

Question	Recommendation
Should the initial RFC acceptance cover Control Model v1 and UI artifacts while leaving hosted policy, Board Model, and Config Model independently gated?	Review the bounded initial contract: Use the required discussion to decide the conversation-model and artifact boundary while retaining separate acceptance gates for sibling contracts.

Why: The repository requires a maintainer discussion and acceptance before merge, and the proposal cannot establish that acceptance through implementation evidence or owner nominations.

Before merge

• Refresh the RFC update date (P3) - The RFC still reports last_updated: 2026-08-21, although the submitted renderer-path clarification is dated August 28. Update the metadata to the last substantive revision so readers can identify the proposal's currency. This previously reported finding remains unresolved.
• Complete next step (P2) - Link the maintainer-discussion thread, obtain and record RFC acceptance before merge, then update acceptance metadata and the substantive revision date.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

• [P3] Refresh the RFC update date — rfcs/0029-openclaw-control-model.md:6

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Proposal scope	8 Markdown files +2,701 lines; 1 standalone prototype +163 lines	The branch adds design material and an illustrative executable, without changing the OpenClaw runtime.

Technical review

Best possible solution:

An explicitly accepted, bounded conversation-model contract with independently gated sibling proposals, implementation reviews, and publication ownership.

Do we have a high-confidence way to reproduce the issue?

Not applicable to the proposed capability; the contributor has supplied a direct run demonstrating the standalone example’s selection and fallback behavior.

Is this the best way to solve the issue?

Unclear pending scope acceptance: the proposal separates shared conversation behavior from product presentation and preserves independent rollout gates, but maintainers must choose the supported contract.

Full review comments:

• [P3] Refresh the RFC update date — rfcs/0029-openclaw-control-model.md:6
  The RFC still reports last_updated: 2026-08-21, although the submitted renderer-path clarification is dated August 28. Update the metadata to the last substantive revision so readers can identify the proposal's currency. This previously reported finding remains unresolved.
  Confidence: 0.99

Overall correctness: patch is correct
Overall confidence: 0.88

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 967d9aac7472.

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. The September 9 contributor transcript runs the changed standalone Node prototype and reports its asserted selection, fallback, and version-rejection results; this satisfies proof for the example without claiming browser rendering, Gateway authorization, or implementation conformance.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The September 9 contributor transcript runs the changed standalone Node prototype and reports its asserted selection, fallback, and version-rejection results; this satisfies proof for the example without claiming browser rendering, Gateway authorization, or implementation conformance.
• remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P3: This is a design proposal awaiting acceptance, with no demonstrated urgent runtime regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The September 9 contributor transcript runs the changed standalone Node prototype and reports its asserted selection, fallback, and version-rejection results; this satisfies proof for the example without claiming browser rendering, Gateway authorization, or implementation conformance.
• proof: sufficient: Contributor real behavior proof is sufficient. The September 9 contributor transcript runs the changed standalone Node prototype and reports its asserted selection, fallback, and version-rejection results; this satisfies proof for the example without claiming browser rendering, Gateway authorization, or implementation conformance.

Evidence

What I checked:

• Pinned scope and current main: The verified introduction adds nine files and 2,864 lines. The current-main tree does not contain RFC 0029. The proposal explicitly remains submitted, unaccepted, and unreleased; no implementation-close provenance was established. (rfcs/0029-openclaw-control-model.md:24, cd607785aa4b)
• RFC acceptance policy: README requires a maintainer-discussion thread and prohibits merging an RFC while its status is draft; acceptance precedes creating the implementation issue and updating metadata. (README.md:79, 967d9aac7472)
• After-change prototype evidence: The captured September 9 comment supplies direct Node execution output for supported composition, explicit MCP fallback, structured fallback, and invalid-version rejection: RFC 0029: clarify Control Model capability and additive scope #62 (comment). These outputs match the inspected prototype assertions and final console messages. The contributor expressly limits the claim to example behavior, not renderer conformance. (rfcs/0029/prototypes/a2ui-artifact-envelope.mjs:118, cd607785aa4b)
• Re-review disposition: Submission-status wording is corrected and the new execution evidence addresses the previous proof request. The previously reported last_updated value remains 2026-08-21 despite the August 28 renderer clarification. The contributor explicitly acknowledges the maintainer-discussion link remains outstanding; that concern is retained as an acceptance decision rather than a code defect. (rfcs/0029-openclaw-control-model.md:6, cd607785aa4b)
• Security and executable boundary: The executable imports only Node assertions and operates on local example data; it does not render components, execute actions, access credentials, or perform network I/O. The artifact specification explicitly describes it as protocol-shape evidence rather than renderer conformance. (rfcs/0029/ui-artifact-v1-spec.md:500, cd607785aa4b)
• RFC process routing history: README history identifies kevinlin-openai with the RFC-process update and Dallin Romney with the sidecar-layout update. Raw commit inspection confirms the former commit's author and recorded parent; unavailable historical blobs prevent exact source-line introduction attribution. (README.md, e366ea9825a4)

Likely related people:

• kevinlin-openai: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Dallin Romney: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Link the required maintainer discussion and record its scope disposition.
• Correct the RFC's last substantive update date.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (28 earlier review cycles; latest 8 shown)

• reviewed 2026-08-26T22:44:31.862Z sha 7a8f437 :: needs real behavior proof before merge. :: [P2] Link the required maintainer discussion
• reviewed 2026-08-28T17:32:59.269Z sha daab871 :: needs real behavior proof before merge. :: [P2] Link the required maintainer discussion
• reviewed 2026-08-28T17:44:36.650Z sha daab871 :: needs real behavior proof before merge. :: [P2] Link the required maintainer discussion | [P3] Refresh the RFC update date
• reviewed 2026-08-30T18:55:43.525Z sha daab871 :: needs real behavior proof before merge. :: [P2] Link the required maintainer discussion | [P3] Refresh the RFC update date
• reviewed 2026-09-02T14:11:07.726Z sha daab871 :: needs real behavior proof before merge. :: [P2] Link the required maintainer discussion | [P3] Refresh the RFC update date
• reviewed 2026-09-03T17:01:54.030Z sha daab871 :: needs real behavior proof before merge. :: [P2] Link the required maintainer discussion | [P3] Refresh the RFC update date
• reviewed 2026-09-03T20:01:54.469Z sha daab871 :: needs real behavior proof before merge. :: [P2] Link the required maintainer discussion | [P3] Refresh the RFC update date
• reviewed 2026-09-05T16:00:18.848Z sha daab871 :: needs real behavior proof before merge. :: [P3] Refresh the RFC update date

[giodl73-repo]

@clawsweeper re-review

Addressed the submission-status findings at 939dc20:

• rfcs/0029-openclaw-control-model.md now identifies RFC 0029 as the submitted draft and keeps acceptance/release/product adoption unclaimed.
• rfcs/0029/control-model-v1-spec.md and rfcs/0029/ui-artifact-v1-spec.md now identify the sidecars as submitted draft sidecars, unaccepted/unreleased upstream.
• rfcs/0029/implementation-plan.md no longer says no upstream branch or PR was opened; it points to CM1-CM5 as upstream draft review surfaces and keeps OC6/OC7/BM2/CFG1/CFG2 proposal-gated.

Validation:

• git diff --check
• rg -n -i "does not request RFC intake|open an upstream pull request|has not been submitted|No upstream branch or PR was opened|fork-only preview" rfcs/0029-openclaw-control-model.md rfcs/0029 returned no matches.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/32642208748
• Updated: 2026-08-23T13:23:54.473Z

[giodl73-repo]

Refreshed patch-equivalently onto current main at $head. Direct Node execution of the changed prototype now provides the requested after-change evidence:

PASS supported A2UI v0.8 composition selected
PASS unsupported dialect used explicit MCP App fallback
PASS unsupported catalog/data version used structured fallback
PASS invalid A2UI version failed closed to structured fallback

Command: node rfcs/0029/prototypes/a2ui-artifact-envelope.mjs. git diff --check also passes. This demonstrates the example's selection, fallback, and version rejection; it does not claim renderer conformance or RFC acceptance. The required maintainer-discussion link remains the explicit process follow-up.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.