fix: unblock development reports after QQbot externalization

[vincentkoc]

Related: #287

Additional instructions

Maintainer edits use repository write permissions on this same-repository branch; GitHub's fork-only Allow edits from maintainers toggle does not apply. This is a draft; required CI, the latest ClawSweeper findings/Rank-up dispositions, and final maintainer approval remain landing gates.

What Problem This Solves

Resolves a problem where development dashboard runs stop on the retired bundled QQ Bot source package, then encounter registration-capture failures in surviving source-packed plugins.

Why This Change Was Made

Remove the obsolete openclaw-qqbot fixture and its owned selection, exception, npm shim/lock, inventory, tests, and generated projections. Preserve the separate Tencent qqbot Git fixture at 7ceb7f0913d15417c5a74d82442a672ef0382c64, including its valid upstream plugin ID openclaw-qqbot.

Adopt the already-landed inspector source repair from openclaw/plugin-inspector#70 through the existing source resolver. Ordinary CLI smoke stays on the older published @openclaw/plugin-inspector@0.3.24; that registry artifact contains source 92db8c57, not the adopted repair.

Thanks to @steipete for investigating the externalized QQ Bot fixture in #287. This separately reviewed replacement preserves existing Tencent Git coverage instead of adding that PR's different Tencent npm fixture and diagnostic helper. Its branch is untouched; it remains open until replacement landing and equivalence are confirmed. This does not adopt the unrelated refresh in #295 or Tencent pin update in #216.

User Impact

The supported development selection becomes seven source-packed fixtures; the full/default inventory becomes 59. Existing generators produce the tracked full/default README and reports, with development output kept separate. No new executable path, dependency, option, host pin, timeout, policy threshold, fallback, workflow, or release is introduced.

Evidence

All local fixture execution ran in disposable credential-free containers with networking disabled during capture, synthetic, and native execution. Public dependency preparation was separate, with install scripts disabled.

Proof	Observed result
Preserved regression evidence	Missing obsolete source-package failure and intended membership-test failures preserved; the source-adoption assertion fails on old 92db8c57 and passes on adopted 84ede904. Existing source-routing test file passes 5/5, including a real missing-registration nonzero exit.
One workflow-shaped development suite	All 19 stages, unfiltered 203/203 tests, no failures/skips. Exact selected seven source packs, strict contract smoke, coverage and policy checks pass.
Actual development workspace execution	All 53 steps exit zero without timeout; eight capture and eight synthetic artifacts, 67 captured registrations; 79 pass, zero fail, 20 explicit existing blocked outcomes. WhatsApp setup remains no-register-export.
Ordinary and source CLI checks	Both full-config smokes scan 59 with zero breakages. Separate source surface uses an explicit separate plugin root: 42 hooks, 57 registrars, 338 SDK exports, 22 manifest contracts, zero missing static/runtime surface. Scanner-byte agreement is not runtime/package-publication parity.
Fresh development output	All 11 write/native/policy stages pass; seven fixtures, zero hard breakages; policy zero failures and 20 existing allowed-blocked warnings.
Fresh full/default output	All 59 payloads available, zero acquisition failures/fallbacks. All 13 write/native/coverage/policy stages pass; 59 fixtures, zero hard breakages; policy zero failures, one warning, seven passes. Default execution intentionally has zero artifacts, not copied development results.
Native lifecycle proof, each lane	Saved native report preserves three baseline plus three measured captured/loaded child records, all exit zero, two descriptors each, finite nonnegative full and full:register, measured captured count six/lifecycle count three, zero failures and no fallback. This is the native probe, not all fixture lifecycles or native tool-contract acceptance.
README/UI and provenance	Actual GitHub README checked at 1440x900 and 390x844, including native phases, mobile table scrolling and exact-head issue-report links. Nine screenshot hashes verified; maintainer accepted the views. Current local run URL is blank, not an older Actions run.
Independent review	Combined source/generated review found no concrete defect at 395e1e756e69ff501483b44befaf0af8d9cdf860, tree 4d0693f5ae4599ed101ca913ac6c23f6d712e0d6. Final base merge below preserves that entire tree.

Development suite command:

node scripts/run-static-suite.mjs \
  --openclaw ./openclaw --policy dashboard --profile-runs 3 \
  --plugin-inspector-smoke --openclaw-track development \
  --fixture-set openclaw-beta --plugin-track source-pack

Exact inputs and output binding

• Tested source: c60398861b74da037dc3399c8efb8b7f384e0cc7; generated commit 395e1e756e69ff501483b44befaf0af8d9cdf860.
• Current signed head: c99c600a8b32fe31a6f2dca09edf4ffee384700b. Mechanical merge of output-only main 6b9357f694521aaa4f9feaada516145f49b1acf7, using --no-log; full message contains no CI-skip directive. Entire tree remains 4d0693f5ae4599ed101ca913ac6c23f6d712e0d6. Tests are attributed to their actual source input, not relabeled as new runs.
• Inspector source: 84ede904fd6e766a9fc4de002f39af87d90c1916, tree 10168a46665e659a4efafc86f1f640d255b7ad92, explicitly bound through CRABPOT_PLUGIN_INSPECTOR_DIR.
• Development host: 89fcceb655c193604bfef0f73e5c23871ea0c3dd, tree 4f382d75663aa4ecb55394ea0f298b3d47a48c2d; Node 24.20.0, npm 11.19.0, pnpm 12.3.4. Accepted frozen registration/native scope, not a latest-whole-host behavior claim.
• Default host unchanged: 5570c5ffac86acb74979c7314da6f3364781985a, tree 5db1e058954c3776e4f91f341394c0efbad8ad03; Node 22.23.2/npm 10.9.8, inherited exact-lock dependencies.
• Default metadata: local:default, 59, 2026-09-08T12:52:00.642Z. Separate development metadata: local:development, seven, 2026-09-08T12:41:59.767Z. Both have empty current run URLs. The separately labeled baseline remains main at b326861d5c1e with its own historical run.
• Verified default README: SHA256 2dbd428472296ccb0dec43544256ff3cad52721f11bf9021b396e0d629269868; remote readback matches committed/exported bytes. All 28 generated changes match their default archive.
• Registry 0.3.24 tarball SHA1 90c31206506a9d99f5475676c69e632b58cc2403. Actual cached executable/package bytes match it, with zero local npm matches; capture hash matches old source92db and differs from adopted A. No same-version source package shadowing is claimed as registry proof.
• Executable production delta: +1/-1, net zero. Tests: +11/-4. Fixture metadata, deleted obsolete lock and generated output are counted separately.

Fixture Impact

• Updates fixture manifest membership by removing the obsolete mapping
• Updates submodule pins
• Updates source adoption and corresponding contract expectations; smoke logic unchanged
• Docs only

Fixture Verification

• Unfiltered npm test command's Node test suite, through the single combined runner: 203/203; no separate duplicate run
• node scripts/sync-fixtures.mjs --check through the combined runner
• node scripts/run-contract-smoke.mjs through the combined runner
• Strict selected-fixture smoke after materialization

Notes

• Existing gaps remain visible: default 358 issues/nine P0; development 18 static inspector gaps/11 P1 and 20 existing blocked outcomes. Refreshed latest npm metadata includes a Discord P2 manifest-field observation. No all-gap or Discord runtime claim.
• Public memory-lancedb dependency preparation reported three high-severity findings. Five later offline audit artifacts are warnings; their zero findings are not live security-audit or security-clean proof. No dependency remediation is claimed.
• Later ordinary two-run check profiling reuses native scratch filenames. Six native observations are preserved in the saved native report and matching inspection receipt, not in six surviving native scratch JSON files. Both default profile-comparison warnings remain; historical deltas are not controlled performance-improvement claims.
• No live credentials, provider/model calls, channels, app-server protocol proof, npm publication, version/tag, manual workflow dispatch, or deployment. Source-only adoption does not release A in package0.3.24.
• Exact-head hosted Default Track, unoverridden source-cache adoption, applicable ClawSweeper findings/Rank-up dispositions, and final maintainer approval remain required. Normal post-landing scheduled development checkout/publication and default/development dashboard verification are still pending; this draft does not claim complete scheduled-dashboard recovery.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 8, 2026, 9:17 AM ET / 13:17 UTC.

ClawSweeper review

What this changes

Removes the retired bundled QQbot fixture, adopts the inspector’s registration-capture repair, and refreshes fixture expectations, documentation, and reports.

Merge readiness

⛔ Blocked before merge - 3 items remain

This remains useful work: current main retains the failing development selection, and the related alternative is unmerged. No concrete blocking defect was found in the introduced patch.

Priority: P2
Reviewed head: c99c600a8b32fe31a6f2dca09edf4ffee384700b

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused repair with concrete runtime outcomes, consistent fixture coverage, and no identified code defect.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (terminal): The supplied body records real fixture materialization, production workspace capture, and native profiling in disposable credential-free containers, with zero execution failures and blocked probes preserved. Source and generated-tree identities are explicit; normal cache adoption and scheduled publication remain separate validation limits.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The supplied body records real fixture materialization, production workspace capture, and native profiling in disposable credential-free containers, with zero execution failures and blocked probes preserved. Source and generated-tree identities are explicit; normal cache adoption and scheduled publication remain separate validation limits.
Evidence reviewed	9 items	Applicable repository policy: Read the complete root AGENTS.md; no nested AGENTS.md or maintainer-notes directory was found. The patch preserves fixture-driven selection, external source ownership, and credential-free checks while updating source adoption and report/test expectations. Current main still needs the repair: Pinned main still declares the obsolete extensions/qqbot mapping and selects inspector source 92db8c57. The materializer throws when a selected source package.json is absent. Tencent coverage is retained: The qqbot fixture retains its Tencent repository, registerChannel/registerTool expectations, and unchanged submodule commit 7ceb7f0913d15417c5a74d82442a672ef0382c64. Only the separate retired fixture is removed.
Findings	None	None.
Security	None	None.

How this fits together

Crabpot checks plugin fixtures against OpenClaw host contracts and publishes compatibility dashboards. Its fixture manifest selects packages, while the separate plugin-inspector dependency supplies inspection and registration capture.

flowchart LR
  A[Fixture manifest] --> B[Selected plugin packages]
  C[OpenClaw host checkout] --> B
  B --> D[Plugin inspector]
  D --> E[Registration capture and probes]
  E --> F[Compatibility reports]
  F --> G[Dashboard]

Loading

Before merge

• Resolve merge risk (P1) - The supplied local runs explicitly selected the inspector checkout; acquisition and use through the normal pinned-cache path remain unconfirmed.
• Resolve merge risk (P1) - Scheduled development dashboard publication has not yet been demonstrated; the recorded runs establish local recovery within the stated host scope.
• Complete next step (P2) - Complete the PR’s declared unoverridden pinned-cache adoption check before landing.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Fixture selection	Full inventory 60 → 59; development selection 8 → 7	Removes the retired mapping while retaining the existing Tencent Git fixture.
Production versus test delta	Executable production +1/-1; tests +11/-4	The runtime change is a source-pin replacement; fixture metadata and generated reports account for the larger diff.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Keep the seven supported development fixtures and existing Tencent Git coverage, with the upstream capture repair adopted through the normal resolver and source/package provenance kept explicit.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Keep the seven supported development fixtures and existing Tencent Git coverage, with the upstream capture repair adopted through the normal resolver and source/package provenance kept explicit.

Do we have a high-confidence way to reproduce the issue?

Yes: the development selection reaches the source materializer’s missing-package failure, and the discussion records the failing runs. This review inspected that path without executing target code.

Is this the best way to solve the issue?

Yes: removing the retired duplicate mapping and adopting the repair from its existing dependency owner is a narrow solution that preserves Tencent coverage and avoids vendoring inspector logic.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 6b9357f69452.

Labels

Label changes:

• add P2: Repairs a bounded compatibility-reporting workflow without changing end-user channel behavior.
• add proof: sufficient: Contributor real behavior proof is sufficient. The supplied body records real fixture materialization, production workspace capture, and native profiling in disposable credential-free containers, with zero execution failures and blocked probes preserved. Source and generated-tree identities are explicit; normal cache adoption and scheduled publication remain separate validation limits.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The supplied body records real fixture materialization, production workspace capture, and native profiling in disposable credential-free containers, with zero execution failures and blocked probes preserved. Source and generated-tree identities are explicit; normal cache adoption and scheduled publication remain separate validation limits.

Label justifications:

• P2: Repairs a bounded compatibility-reporting workflow without changing end-user channel behavior.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The supplied body records real fixture materialization, production workspace capture, and native profiling in disposable credential-free containers, with zero execution failures and blocked probes preserved. Source and generated-tree identities are explicit; normal cache adoption and scheduled publication remain separate validation limits.
• proof: sufficient: Contributor real behavior proof is sufficient. The supplied body records real fixture materialization, production workspace capture, and native profiling in disposable credential-free containers, with zero execution failures and blocked probes preserved. Source and generated-tree identities are explicit; normal cache adoption and scheduled publication remain separate validation limits.

Evidence

What I checked:

• Applicable repository policy: Read the complete root AGENTS.md; no nested AGENTS.md or maintainer-notes directory was found. The patch preserves fixture-driven selection, external source ownership, and credential-free checks while updating source adoption and report/test expectations. (AGENTS.md:1, c99c600a8b32)
• Current main still needs the repair: Pinned main still declares the obsolete extensions/qqbot mapping and selects inspector source 92db8c57. The materializer throws when a selected source package.json is absent. (crabpot.config.json:1058, 6b9357f69452)
• Tencent coverage is retained: The qqbot fixture retains its Tencent repository, registerChannel/registerTool expectations, and unchanged submodule commit 7ceb7f0913d15417c5a74d82442a672ef0382c64. Only the separate retired fixture is removed. (crabpot.config.json:42, c99c600a8b32)
• Explicit dependency boundary and remaining validation: The changed source ref feeds actual imports through loadPluginInspector and loadPluginInspectorPublicApi. The resolver checks an explicit directory and sibling checkout before preparing the pinned cache; supplied local runs used the explicit directory, and the PR expressly leaves unoverridden cache adoption pending. (scripts/plugin-inspector-source.mjs:7, c99c600a8b32)
• Adopted repair is merged and narrowly scoped: GitHub verifies fix: capture plugins that bind model auth during registration plugin-inspector#70 merged as 84ede904. The complete comparison contains one commit: credential-free model-auth stubs, rejection of credential acquisition, documentation, and tests; no dependency or workflow changes. The dependency's complete root policy was also read. (src/capture-api.js:206, 84ede904fd6e)
• Recorded behavior proof and source binding: The supplied complete PR body reports a credential-free development run with all 53 workspace steps completing, 67 registrations, 79 passing probes, zero failures, and 20 explicit blocked outcomes. It separately reports full/default generation and native lifecycle observations. Tests are attributed to c603988; generated commit 395e1e7 and reviewed head have the identical tree 4d0693f5. These observations do not establish scheduled publication recovery or package/source parity. (c99c600a8b32)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Confirm the adopted source is acquired and used through the normal pinned-cache resolver without an explicit directory or sibling checkout.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[vincentkoc]

Landing-gate disposition for c99c600a8b32fe31a6f2dca09edf4ffee384700b, addressing #300 (comment).

Pinned-cache acquisition/use: both review items and the sole Rank-up move are addressed.

Required Check https://github.com/openclaw/crabpot/actions/runs/34230280555 passed, including aggregate job 102079135340. Ubuntu, macOS, Windows and container lanes each completed all 19 stages and passed 203/203 tests, with zero failures or skips.

The three hosted report artifacts are Ubuntu 10057865168, macOS 10057870970 and Windows 10058020782. Each freshly generated workspace report contains 105 helper commands under ../../plugin-inspector/84ede904fd6e766a9fc4de002f39af87d90c1916/src/. Those paths derive from the imported inspector module's import.meta.url; they are not copied pin literals or retained local reports. The ordinary workflow supplies neither an inspector-directory override nor a sibling inspector checkout. The existing resolver enforces exact Git HEAD, source existence and the install-ready marker before returning that cache.

This is bounded hosted module-location plus resolver-contract proof. No separate cache archive, standalone checkout attestation, npm release or package/source parity is claimed. Ordinary npm CLI evidence remains the older published 0.3.24 artifact.

Scheduled development publication: staged post-merge verification is the accepted mitigation.

The natural scheduled workflow must run after landing to observe the repaired main checkout. Publication is not yet demonstrated by the local preview or PR checks. After merge, we will observe the existing schedule without manual dispatch, verify its actual checkout SHA and source/fixture inputs, inspect report artifacts and failures, then verify the published crab-development branch README/reports, provenance, seven-fixture count and links on desktop/mobile. Default output remains 59; Tencent Git coverage remains unchanged.

A green workflow alone will not establish publication recovery: report failures or fallback outcomes remain visible. Any new owner failure stops completion with its exact evidence preserved. No workflow, pin, threshold, timeout or fallback change is included in this disposition.