Stop direct Claude Keychain reads and route owner CLI by profile

[ProspectOre]

Ownership shutdown + profile routing + account reconciliation

This is the remaining Claude ownership-boundary unit requested after #2484 landed. It is restacked on current main and drops the profile/cache foundation already merged through #2484, along with the #2441 test-isolation layer already on main.

Root cause

Claude Code owns the macOS Keychain item Claude Code-credentials. Claude refreshes replace that item and its ACL, so any permission previously granted to CodexBar is temporary. A later direct CodexBar read can therefore ask macOS for authorization again, regardless of the user's prompt preference.

CodexBar's own legacy cache can also retain an ACL for an older build at the same executable path. Path-only preflight therefore produced a false safe result before the secret read, at which point macOS displayed an authorization prompt for the changed code signature.

Fix

• Production CodexBar never reads Claude Code's foreign Keychain item, with or without UI.
• CodexBar-owned cache reads preflight attributes and the decrypt ACL without requesting secret data, then validate the ACL's stored code-signing requirement against the exact invoking executable. Unsafe or stale cache ACLs are treated as cache misses, allowing the selected owner source to recover without UI.
• Claude CLI sessions are owner-mediated and keyed by executable, selected profile/account scope, and normalized environment.
• The dedicated Claude /usage probe ignores ambient MCP configuration, so usage refresh does not wait for or execute unrelated user MCP servers. Normal Claude sessions are unchanged.
• Background CLI availability is keyed by executable plus that same selected profile/account scope; it cannot cross a config-profile change, active-account switch, or logout.
• PTY capture, cleanup, delegated refresh, MCP routing, and active-account reconciliation use the same selected profile environment.
• Delegated-refresh in-flight attempts and cooldown state are keyed by the selected credentials profile. A different profile cannot inherit another profile's success or cooldown; legacy global cooldown state migrates only to the process-default profile.
• Cache/file errors remain attached to their chosen credential authority instead of silently falling through to unrelated ambient credentials.
• A Claude-CLI-owned credentials file rejected after an account mismatch is quarantined per profile until its fingerprint changes, so stale OAuth cannot re-enter after owner-CLI recovery.
• OAuth refresh terminal/transient failure gates and success resets are persisted per selected credentials profile. Recovery fingerprints use only that profile's credentials file, never Claude's global Keychain item, so one profile cannot block, clear, or spuriously unblock another.
• Active-account identities hash the stable credentials-profile identifier plus Claude's account UUID, not the dynamically selected .config.json/fallback path. Existing path-based identities migrate only when they cryptographically match an observed UUID, preventing a false switch when the preferred file appears or disappears without weakening real account-switch detection.
• Active-account identity baselines are persisted per selected credentials profile; a legacy global baseline migrates only to the process-default profile.
• When a user-initiated explicit OAuth fetch finds an unchanged expired Claude-owned cache after delegated refresh, it preserves the typed owner handoff and continues through the Claude CLI usage strategy. It does not re-enable foreign Keychain reads or broaden fallback for malformed credentials or OAuth service failures.
• Fix Claude background Keychain prompts #2191's background prompt gate is preserved: background Auto does not launch Claude auth before foreground establishment; background explicit OAuth with missing credentials does not fall through to the interactive owner CLI; a user-initiated explicit OAuth action may still use owner-mediated CLI recovery; CLI runtime retains the noninteractive auth-status preflight.
• The verification-only app-Auto route rejects explicit token-account selection, constructs an ambient-account context for both passes, and reproduces the real lifecycle by establishing account-scoped CLI availability through a user-initiated owner fetch before auditing background Auto. Normal app and CLI behavior is unchanged.

Preserved functionality

Environment OAuth tokens, profile credentials files, the CodexBar-owned profile cache from #2484, owner-mediated Claude CLI recovery from user actions, selected-account routing, web fallback/extras, and account reconciliation remain available. User Claude sessions retain their normal MCP/plugin configuration; only CodexBar's dedicated usage-only probe is isolated from ambient MCP servers. The removed paths are direct production access to Claude Code's foreign Keychain item and interactive CLI fallback from scheduled background refreshes.

Regression coverage

Tests cover stable active-account identity across preferred/fallback config-file transitions, guarded migration of matching path-based identities, preservation of real switch detection for nonmatching legacy identities, profile-scoped active-account baseline selection and legacy migration, the production ownership boundary, no-read behavior under every prompt policy, explicit versus background CLI behavior, background explicit-OAuth fail-closed behavior under every prompt policy, expired Claude-owned cache handoff to the owner CLI, retained user-initiated owner-CLI recovery, profile/account-scoped session reuse and cleanup, profile/account-scoped background availability, isolated usage-probe launch arguments, serialized profile capture, profile-scoped delegated-refresh joins and cooldown migration, MCP routing, selected-account reconciliation, profile-scoped refresh-failure persistence and file-only recovery fingerprints, terminal cache/file failures, preservation of existing OAuth/web authority selection, stale same-path cache ACL rejection, and strict no-data ACL preflight behavior.

Verification

Exact head cafa839dd3e238a980ab673b2693fa6a5a6cd65a:

• canonical make test: 764/764 selections, 64/64 first-pass groups passed, zero failed groups, retries, recoveries, isolated retries, or timeouts;
• make check: SwiftFormat 0/1,661 and SwiftLint 0 violations in 1,660 files;
• delegated-refresh profile/cooldown matrix: 16 tests across 2 suites passed;
• Claude session launch regression: 7/7 tests passed;
• exact-head ownership matrix: 246 tests across 22 suites passed;
• consent-gated live owner suite: 3 tests across 1 suite passed;
• git diff --check: passed.

Redacted exact-head live proof

Inspectable redacted exact-head terminal transcript

The verifier built and signed the exact source, confirmed a clean/stable worktree snapshot, audited every first-party Release executable, temporarily set the stored background owner-CLI policy for the bounded run, and restored the original preference afterward. No account identity, credential/token, usage amount, private path, raw Keychain record, or raw unified log is included here.

• source snapshot SHA-256: c8d25b7f1fefba4ffdd18ef79bb2c2a863e26a4b1e102415100baea3cf04f5b0;
• packaged app SHA-256: 256d606977696a5ed9e6bd84c2acf07116a34c3b70e4bef685e3cd085178762a;
• packaged CLI SHA-256: efb319a35f42f5f71b961919eb588f3a5f5e4a0f25fe92bc40ace35c1311af28;
• four first-party Release executables audited; zero known foreign-reader markers;
• Claude owner authenticated: yes; provider: claude; source: claude; usage shape: dictionary;
• bounded CLI exit: 0; timed out: no (45-second bound);
• direct/owner/unowned security descendants: 0/0/0;
• unified-log visibility canary: observed;
• attributable prompt/authorization events: 0.

The live run therefore proves the packaged exact head reaches the Claude-owned usage path without a CodexBar-owned security child and without an attributable macOS Keychain authorization prompt.

[ProspectOre]

Redacted live credential-ownership proof

Exact PR head: 2ed4b72854b7a9a47aaa3e17d7e211ff04d368c7
Executed: 2026-07-21T17:12:12-07:00 (PDT)
Environment: macOS 27.0 (arm64), CodexBar 0.45.2, Claude Code 2.1.217

This proof intentionally excludes account identity, credentials, token values, usage amounts, raw Keychain records, raw CLI payloads, raw unified-log lines, and private filesystem paths. The private verifier directory was not uploaded.

Before / root cause

Redacted historical live logs showed Claude replace its owned credential item and CodexBar prompt again 15 seconds later. That proves a user ACL grant was temporary: Claude's next credential refresh replaced the item CodexBar was reading.

Exact-head results

• exact source snapshot SHA-256: cb453453c80fa443b169c89d2b67f5c9b9e0e665153a129667426d4e6aa892e8
• source snapshots before/after packaging identical: yes
• Release built by verifier: yes
• first-party Release executables audited: 4
• known foreign-reader markers: 0
• focused ownership/routing/account tests: 72 tests / 11 suites passed
• live owner-path tests: 2 tests / 1 suite passed
• owner authentication preflight: success
• live provider/source: claude / claude
• live usage payload shape: dictionary (values redacted)
• CLI exit: 0
• timeout: no
• Security descendants: 0
• unowned Security descendants: 0
• unified-log visibility canary: observed
• attributable prompt/authorization events: 0

Release executable hashes

• Contents/MacOS/CodexBar: 41d3fb4025ce8891d427c7ba226d9be9da7d941e44ee1029c166cea7e9a1094f
• Contents/Helpers/CodexBarClaudeWatchdog: d0ec8984832ff02a4db89416fa0de6a4e2d813c1a6681e920bcaf5fb6b39a56b
• Contents/Helpers/CodexBarCLI: d9f50d8329613d63295ed5a90ecd8e0f1b024c585eb38e7090acc5f22f369f63
• Contents/PlugIns/CodexBarWidget.appex/Contents/MacOS/CodexBarWidget: f05d994751ccd6e8f5ca9eb23f50faa1a8cbbc5f642b94e6b6a566664b2bab44

The manifest was rechecked against the packaged app after the run; all four hashes passed.

Broader validation

• full local suite: 728 selected cases across 61 groups, zero failures/retries/timeouts
• SwiftFormat: 0/1591 files need changes
• SwiftLint strict: 0 violations across 1590 files
• documentation links, locales, shell syntax/static analysis, and diff checks pass
• known unrelated environment caveat: stock make check encounters the repository's existing Node 25 docs/site.js ESM-mode mismatch; equivalent module-mode validation passes

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Review in progress
• Detail: The exact-review queue leased this run; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29881730304
• Updated: 2026-07-22T00:57:51.486Z

[ProspectOre]

Exact-head redacted live proof — 2026-07-21 22:27 PDT

Candidate: 3d0dc5e09f71df5887c446fb79e1412f0bea41da

Build integrity:

• verifier packaged a fresh Release bundle from a clean candidate worktree
• source snapshot SHA-256: 4f2ae006aff2748ebf6311b4699ed1bd6b090fd7668310819612a7c9e2b6a716
• 4 first-party Release executables audited
• known foreign-reader markers: 0

Logged-in Claude owner-path result:

• Claude owner authenticated: yes
• bounded timeout: 45 seconds
• timed out: no
• exit status: 0
• provider/source: claude / claude
• structured usage payload returned: yes

Runtime ownership/prompt audit:

• Security descendants: 0
• Claude-owner Security descendants: 0
• unowned Security descendants: 0
• unified-log visibility canary: observed
• attributable prompt/authorization events: 0

Automated gates on the same candidate:

• 115 tests across 15 ownership/routing/account/cache/debug/prompt-safety suites: passed
• 2 opt-in live ownership/auth tests: passed
• SwiftFormat and strict SwiftLint on the changed Swift surface: passed
• shell syntax and diff checks: passed

Behavioral boundaries covered:

• app-owned OAuth credentials retain first priority
• only typed credential absence reaches the authenticated owner CLI
• corrupt/unavailable credentials, service failures, selected accounts, and CLI-runtime OAuth remain fail-closed
• Auto remains CLI → Web; explicit OAuth never falls through to Web

Environment caveats, included for completeness:

• stock make check reaches the repository's existing Node 25 docs/site.js CommonJS-mode mismatch; the equivalent ESM-mode syntax check passes
• exact clean-source make test isolates one unrelated date-sensitive existing failure at SpendDashboardControllerTests.swift:495; all Claude-focused tests pass, and the local stabilization for that test is deliberately excluded from this PR

No account identity, token, usage amount, raw Keychain value, raw log, or private artifact path is included or uploaded.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Review in progress
• Detail: The exact-review queue leased this run; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29895927703
• Updated: 2026-07-22T06:10:56.645Z

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3d0dc5e09f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ProspectOre]

Redacted exact-head proof

This supersedes the earlier proof and validates exact head b12c844e435f0e14610e575e0641a0eb6ba37917, including the Auto-order correction that resolves ClawSweeper's prior P1 finding.

• clean source snapshot matched the exact PR head; Release binaries were built fresh from that snapshot
• focused ownership, routing, account-isolation, cache, timeout, and prompt-safety matrix: 218 tests across 22 suites passed
• broad Claude regression matrix: 637 tests across 98 suites passed, plus 19 tests across 4 secondary suites passed
• opt-in live matrix: 2 tests in 1 suite passed
• live app Auto transition exercised safe OAuth absent → authenticated owner CLI success; CLI exit 0, no timeout
• all 4 first-party Release executables audited: 0 known foreign-Keychain-reader markers
• runtime audit: owner authenticated; 0 unowned Security descendants; log canary observed; 0 attributable prompt/authorization events
• SwiftFormat, strict SwiftLint, documentation links/index, shell syntax, and diff checks passed

The public proof intentionally excludes account identity, credentials, token values, usage amounts, raw Keychain records, raw unified-log lines, and private filesystem paths.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Review in progress
• Detail: The exact-review queue leased this run; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29897322404
• Updated: 2026-07-22T06:37:22.882Z

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b12c844e43

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b00d85e90b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7e6e23ff73

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ProspectOre]

Exact-head redacted proof for 7e6e23ff73f93e903f430ffda9df667eaabaa4c7:

• clean source snapshot and freshly signed Release bundle
• focused ownership/routing/account/cache/timeout matrix: 219 tests / 22 suites passed
• opt-in live owner path: 2 tests / 1 suite passed
• live App Auto transition: safe OAuth absent → authenticated Claude owner CLI succeeded (exit 0; no timeout)
• 4 first-party Release executables audited: 0 foreign-reader markers
• process/log audit: 0 Security descendants, 0 unowned Security descendants, 0 attributable prompt/authorization events
• legacy-cache compatibility is migration-only for the exact historic default profile; custom/cross-profile cache entries remain fail-closed
• explicit OAuth recovery is tested: when safe credentials and an owner session are absent, the menu offers Open Terminal for the Claude owner login flow—not a foreign Keychain read and not silent Web switching

Raw account identity, credentials, tokens, usage values, Keychain records, logs, hashes, and local paths are intentionally excluded.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Review in progress
• Detail: The exact-review queue leased this run; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29978939185
• Updated: 2026-07-23T04:12:26.095Z

[ProspectOre]

CI follow-up: the current aggregate failure is the unrelated date-sensitive SpendDashboard test group, not the Claude ownership change. It is isolated in draft PR #2390; this branch remains unchanged.

[ProspectOre]

@clawsweeper re-review

Please publish the exact-head review for 7e6e23ff73f93e903f430ffda9df667eaabaa4c7. The prior exact-review worker completed successfully but its final result was not published; the only visible result is its stale “review started” placeholder.

[ss251]

Independent exact-head validation found a test-safety gap; focused follow-up submitted

I ran Scripts/verify_1844_live.sh from exact head 7e6e23ff73f93e903f430ffda9df667eaabaa4c7 in a clean validation clone. Release packaging succeeded, but Phase 1 stopped before the live runtime phases: 219 tests / 22 suites produced 31 issues because the standard test process inherited the installed app's persisted Claude prompt policy and could fall through to the developer's real Claude credentials path/pending-clear state.

That means this run did not reach the owner-CLI process/log audit; it did not modify the real credential or ACL, and I am not presenting it as a passing live proof. The failures are the concrete, independently useful gap now addressed by #2441 at b6f157cccb22b7c0dab79b6d9c93591f15262b32:

• isolate prompt defaults and credential-file resolution under standard tests;
• isolate pending cache-clear state per test scope;
• preserve captured prompt policy across detached delegated-refresh work;
• require CODEXBAR_ALLOW_TEST_KEYCHAIN_ACCESS=1 before live proof can inspect real user state.

Focused validation on the follow-up passed, cross-provider review completed with no remaining findings, and the P2 live-proof review thread is resolved. The unrelated SpendDashboard stabilization was deliberately removed because #2390 already owns it.

The live reproduction proving that Always Allow succeeds and then is lost after foreign-item replacement is recorded in #1823: #1823 (comment)

Once #2441 is available on this branch (or equivalent isolation is applied), the verifier should be rerun with the explicit live opt-in so Phase 1 cannot be host-state dependent and the process/log ownership audit remains meaningful.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8cf84bb793

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b12e060f93

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ProspectOre]

Verification follow-up — 9ba5485bbe4b7361d30e667ed83a9baa985fd2bf

The product code remains the same as the prior live-proof commit; this update makes the verifier reproducible from a clean macOS checkout. SwiftPM's test helper was omitting Sparkle's binary framework from its own runtime lookup path. The verifier now links the resolved framework into the helper's expected build-only lookup location.

• clean Release packaging passed
• clean-checkout framework-loader regression passed: 34 targeted tests / 3 suites
• prior redacted app-Auto live proof remains applicable to the unchanged product code (bounded owner-CLI fallback, structured result, no prompt/authorization events, and no foreign-Keychain reader markers)
• no account identities, credentials, tokens, usage values, Keychain records, raw logs, or artifact paths are published

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9ba5485bbe

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ProspectOre]

@codex review

[ProspectOre]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: d6138ae87f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 30d8655967

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ProspectOre]

@codex review

[ProspectOre]

Exact-head validation — c5950d1fec8e9ca576fe14b35baae26f41dd113a

• profile-scoped deferred-cache cleanup: 17 tests passed
• Claude profile-cache routing and migration: 6 tests passed
• account-identity reconciliation, including Auto → OAuth: 20 tests passed
• test-state isolation: 3 tests passed
• opt-in live macOS proof: 3 tests passed
  • with the safe OAuth credential intentionally absent, App Auto tried OAuth then succeeded through the authenticated Claude owner CLI
  • the test asserts direct access to Claude Code's Keychain item remains disabled

No account identities, credentials, tokens, usage values, Keychain records, or local paths are included.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 55dbe9bfdb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ProspectOre]

Exact-head update: d24a053c725864f9068f673205660eccf2045399

Addressed the new verifier-account-routing review: --app-auto-verifier now rejects explicit token-account selection and uses an ambient-account resolution scope for both lifecycle passes, so configured Claude accounts cannot bypass owner-CLI establishment. The review thread is replied to and resolved.

Fresh exact-head verification:

• make check: clean (SwiftFormat 0/1,660; SwiftLint 0/1,659)
• make test: 763/763 selections, 64/64 first-pass groups, zero retries/recoveries/failures/timeouts
• verifier isolation: 12 tests / 2 suites
• ownership matrix: 246 tests / 22 suites
• consent-gated live owner suite: 3 tests / 1 suite
• packaged live run: exit 0, provider/source claude/claude, zero direct/owner/unowned security descendants, zero attributable prompt/authorization events

The PR body contains the updated redacted hashes and proof.

@clawsweeper re-review
@codex review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Review in progress
• Detail: The exact-review queue leased this run; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/30514784636
• Updated: 2026-07-30T04:47:14.790Z

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d24a053c72

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ProspectOre]

Inspectable redacted terminal transcript for exact head d24a053c725864f9068f673205660eccf2045399 (copied from the completed verifier run; only private filesystem paths were replaced):

$ CODEXBAR_VERIFY_ROOT=<clean-worktree> <verifier>/Scripts/verify_1844_live.sh
[verify-claude-ownership] Artifacts: <redacted-private-temp-path>
[verify-claude-ownership] Phase 0: package the current source as a Release bundle
[verify-claude-ownership] Phase 0 passed
[verify-claude-ownership] Phase 1: ownership, routing, account, config, session, and prompt-safety tests
Test run with 246 tests in 22 suites passed after 75.400 seconds.
Test run with 3 tests in 1 suite passed after 0.584 seconds.
[verify-claude-ownership] Phase 1 passed
[verify-claude-ownership] Phase 2: all first-party Release executables contain no known foreign-reader markers
[verify-claude-ownership] Phase 2 passed
[verify-claude-ownership] Phase 3: bounded app-Auto owner-mediated fetch plus process and unified-log audit
candidate: d24a053c725864f9068f673205660eccf2045399
candidate-worktree: clean
source-snapshot-sha256: 85f10dd49adfe5132af85ebfca2e0cc83bd2a20d1cee018db8257aef8b06639c
release-built-by-verifier: yes
packaged-cli-sha256: 4c5a80c856616101a78628a641cd438e5f6ca9af61eb5cb5aa7abff56024ad19
packaged-app-sha256: f3cd28eef1b6518840cc468a180749ac6915f11f41d44f6a3f0246dd2c4464ad
first-party-release-executables-audited: 4
claude-owner-authenticated: yes
background-owner-cli-policy: temporary-stored-always-restored
cli-timeout-seconds: 45
cli-timed-out: 0
cli-exit: 0
live-provider: claude
live-source: claude
live-usage-type: dictionary
security-descendants: 0
claude-owner-security-descendants: 0
unowned-security-descendants: 0
unified-log-visibility-canary: observed
attributed-owned-keychain-activity-events: 72
attributed-prompt-authorization-events: 0
release-known-foreign-reader-markers: 0
[verify-claude-ownership] Phase 3 passed: owner path succeeded with no direct security child or attributable authorization event
[verify-claude-ownership] Report: <redacted-private-temp-path>/REPORT.md

Phase 3 invokes the packaged verifier-only app lifecycle once. Its ambient user-initiated .cli establishment is fail-fast: a failed establishment prevents the background Auto pass and a successful Phase 3 result. The emitted final live-source: claude is the subsequent background Auto result. Thus the terminal result above can occur only after both the ambient owner-CLI establishment and background Auto owner route succeeded in the same process. No account identity, credential/token, usage amount, private path, or raw unified log is included.

@clawsweeper re-review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2f9d771840

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ProspectOre]

Exact-head update: cafa839dd3e238a980ab673b2693fa6a5a6cd65a

Addressed both delegated-refresh profile-isolation findings:

• in-flight attempts are scoped by the selected Claude credentials profile, so a different profile cannot inherit another profile's success and sync it into the wrong cache;
• in-memory and persisted cooldowns are scoped by that same profile identifier, with legacy global cooldown state migrating only to the process-default profile.

Live verification also exposed that the dedicated /usage owner probe was starting unrelated ambient user MCP servers. The probe now passes Claude's --strict-mcp-config; normal Claude sessions and CodexBar functionality are unchanged. The exact packaged lifecycle subsequently completed within the unchanged 45-second bound.

Fresh exact-head verification:

• make check: SwiftFormat 0/1,661 files require changes; SwiftLint 0 violations in 1,660 files;
• canonical make test: 764/764 selections, 64/64 first-pass groups, zero failures, retries, recoveries, isolated retries, or timeouts;
• delegated-refresh profile/cooldown matrix: 16 tests across 2 suites passed;
• Claude session launch regression: 7/7 tests passed;
• ownership/routing matrix: 246 tests across 22 suites passed;
• consent-gated live owner suite: 3 tests across 1 suite passed;
• git diff --check: passed.

Inspectable redacted terminal transcript from the completed exact-head verifier run:

$ CODEXBAR_VERIFY_ROOT=<clean-worktree> <verifier>/Scripts/verify_1844_live.sh
[verify-claude-ownership] Phase 0: package the current source as a Release bundle
[verify-claude-ownership] Phase 0 passed
[verify-claude-ownership] Phase 1: ownership, routing, account, config, session, and prompt-safety tests
Test run with 246 tests in 22 suites passed after 65.827 seconds.
Test run with 3 tests in 1 suite passed after 0.242 seconds.
[verify-claude-ownership] Phase 1 passed
[verify-claude-ownership] Phase 2: all first-party Release executables contain no known foreign-reader markers
[verify-claude-ownership] Phase 2 passed
[verify-claude-ownership] Phase 3: bounded app-Auto owner-mediated fetch plus process and unified-log audit
candidate: cafa839dd3e238a980ab673b2693fa6a5a6cd65a
candidate-worktree: clean
source-snapshot-sha256: c8d25b7f1fefba4ffdd18ef79bb2c2a863e26a4b1e102415100baea3cf04f5b0
release-built-by-verifier: yes
packaged-cli-sha256: efb319a35f42f5f71b961919eb588f3a5f5e4a0f25fe92bc40ace35c1311af28
packaged-app-sha256: 256d606977696a5ed9e6bd84c2acf07116a34c3b70e4bef685e3cd085178762a
first-party-release-executables-audited: 4
claude-owner-authenticated: yes
background-owner-cli-policy: temporary-stored-always-restored
cli-timeout-seconds: 45
cli-timed-out: 0
cli-exit: 0
live-provider: claude
live-source: claude
live-usage-type: dictionary
security-descendants: 0
claude-owner-security-descendants: 0
unowned-security-descendants: 0
unified-log-visibility-canary: observed
attributed-owned-keychain-activity-events: 72
attributed-prompt-authorization-events: 0
release-known-foreign-reader-markers: 0
[verify-claude-ownership] Phase 3 passed: owner path succeeded with no direct security child or attributable authorization event

The verifier built and signed the exact source, confirmed a clean and stable worktree snapshot, audited all four first-party Release executables, temporarily enabled the stored background owner-CLI policy for the bounded run, and restored the original preference afterward. No account identity, credential/token, usage amount, private path, raw Keychain record, or raw unified log is included.

[ProspectOre]

@clawsweeper re-review
@codex review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Review in progress
• Detail: The exact-review queue leased this run; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/30538415778
• Updated: 2026-07-30T11:24:53.161Z

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: cafa839dd3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ProspectOre]

@steipete This remaining Claude credential-ownership layer is ready for maintainer review. Exact-head CI is fully green, all review threads are resolved, Codex found no major issues, and ClawSweeper reports sufficient live proof with no findings. GitHub currently reports the PR clean and mergeable.