[bkudiess]

Original implementation by @bkudiess. Review repairs and additional verification by Roboclaw.

Work sessions

Linked for team reference; these sessions aren’t public.

• Discussion, implementation and verification

Landing status (2026-11-09): preparing for author review, not merge-ready. Current head 4ff81a1e25f0 incorporates current main and is conflict-free. Fresh CI is in progress. Green current-head CI and a fresh ClawSweeper Platinum assessment are still required.

Depends on #2057 (feat: web-aligned Inbox for the footer bell and notifications page). This is layer 2 of 4. The branch remains cumulative; the dependency must land first and the stack must be reconciled before the next landing.

What Problem This Solves

The Inbox from #2057 only showed local app notifications, so pending approvals, failed or overdue automations and expired model-provider accounts that the Gateway knows about never reached the bell or the Inbox page.

User Impact

User impact: the bell and Inbox now show what is waiting on the Gateway, matching the web Control UI: pending command/plugin/system approvals (with an expiry countdown, scope or effect text, command preview and Open chat for exec, or Open Dashboard for non-exec approvals), failed or overdue automations and expired or missing model-provider accounts (each with Ask OpenClaw plus a link to Automations or Models). The badge turns amber while an approval waits. Approve/deny from the Inbox is intentionally not here yet (layer 3); exec approvals are still decided in chat, while non-exec approvals are reviewed in the Dashboard.

Why This Change Was Made

• OpenClawGatewayClient now raises typed PendingApprovalRequested/PendingApprovalResolved for exec, plugin and openclaw approval events. The existing exec-to-chat translation is unchanged.
• A new App-owned InboxGatewaySource observes the operator client supplied by GatewayConnectionManager (no new connection). On connect it hydrates *.approval.list (when the client has approval scope), requests cron.list/cron.status and reads models.authStatus. Approvals leave on resolve, disconnect, or a local-clock deadline fixed when they arrive (the Gateway's own lifetime measured on this machine), so a Gateway with a skewed clock cannot end them early or keep them forever. Late replies from an earlier connection epoch are dropped. Automation and account rules mirror the web UI's sidebar-attention-items.ts, including provider alias grouping and refreshing when a credential reaches its expiry.
• InboxFeed combines app notifications and Gateway facts. InboxProjection still owns order, tabs, dismissible set and badge for both, so the rows, tab counts and badge always agree.
• Ask OpenClaw sends a localized "explain this failure" prompt to the main conversation through the chat provider and opens it. If chat is not connected, it opens Connection settings instead of silently doing nothing.
• Approval commands, Gateway errors and prompts are untrusted display data. They are shown as plain selectable text and never logged or exported; logs record only method names and exception types.

Gaps and follow-ups (data the native client does not expose yet)

• Approval decisions from the Inbox, This PC alerts, Do not disturb and actionable toasts: layers 3 and 4.
• Mentions (mentions.list), outbox/held messages and Gateway update errors/warnings: no native client producer yet. The projection already classifies them when a producer publishes them.
• Scope-upgrade (admin access) requests: no native producer yet.
• Dismissals of automation/account rows are session-scoped (cleared when the Gateway client changes) rather than persisted like the web UI's local storage.
• Layer-1 review note (metadata labels for outbox, update, scope-upgrade) stays deferred until those producers exist.

Evidence

Earlier rating-repair evidence

Earlier native screenshots

Exact source, test assertions and limits. These are current successful states, not a pre-repair comparison.

Public asset bytes match the inspected PNGs. Browser rendering verification remains unavailable. The static DND footer, where present, does not prove native toast suppression or packaged privacy behavior.

The latest test-only correction waits within the existing observation budget for the exact row action to be visible and enabled, retains that native button handle, then invokes once outside the poll. It does not retry an action, increase a timeout, weaken an outcome check or change product behavior. Independent source review found no confirmed defect; the current native fixture suite passed 84/84 with zero skips.

Adds three real-client protocol facts and two mounted native journeys for live approval redaction on page/bell, real local expiry, initial/reconnect inventory hydration, native navigation and the actual restricted Ask OpenClaw send. These tests use the existing authenticated synthetic Gateway, not live providers or command execution. Complete meaningful text, gap-free native visible ranges and every finite positive viewport rectangle are required. Provider-supported Character round trips may remove only strictly zero-content outer positions; FindText is not used. Source, closure and joined-fixture reviews found no remaining confirmed finding. Current native execution and inspected images are documented in this source-bound proof comment.

The shared secret-redaction repair and original age-clock case remain unchanged. Prior CI and clock pictures retain their original source labels below.

Prior repair evidence (historical)

Cron inventory reads include all pages with consistent revision checks. Reconnects retain original approval deadlines. Non-exec approvals open the Dashboard instead of an unrelated chat.

Earlier author evidence (historical)

Live fixture-Gateway run of the pushed commit: a real top-level exec.approval.requested event lands in the bell flyout with an amber badge, the expanded row shows the countdown, command preview, host and Open chat, and the row and badge clear when the approval is denied in chat or times out.

After the approval's local deadline passed, both the flyout and the page showed Nothing waiting and the badge cleared (observed in the live window at 5117ece1; the earlier 4501042c timeout screenshot shows the same empty state).

Change Type

• Bug fix
• Feature
• Refactor
• Docs or instructions
• Tests or validation
• Security hardening
• Chore or infrastructure

Scope

• Tray or WinUI UX
• Windows node capability
• Local MCP or winnode
• Gateway, connection, or pairing
• Setup or onboarding
• Permissions, privacy, or security
• Tests, CI, or docs

Required proof pools

• windows-winui-interactive: new Inbox row states (approval countdown, Ask OpenClaw, Automations/Models links) need current-head visual and accessibility proof in the isolated WinUI app.

Validation

Current readiness revision

Head 4ff81a1e25f03dda55737eeada7fd89f87f13734, tree ee0045b6d7ed3d9fcb0ed5823f3e829f41fef849, main b31d7d5e8bfb722d5ef77ae5b8c0586ccd9bc12e. Build and Test 42583501417 is in progress. This is a new source revision, not an unchanged retry.

The reviewed test-only Settings repair waits for the expected page and the original owned, visible Forward control in its required enabled state. Both theme cases, all explicit assertions, single Back/Forward actions and existing budgets remain. The ledger format correction preserves both guard tests. No production behavior or historical crash cause is claimed.

Not verified / blocked: final current CI, current UI/proof receipts and fresh ClawSweeper rating. Previously retained security/runtime/compatibility and second-model limits remain visible below. Separate private crash capture is parked. One bounded non-memory comparison is being prepared only to classify the still-blocking ordinary UI crash; no assertion, timeout, exception handling or test selection is weakened.

Previous source-bound results and failures

Previous source-bound validation

Latest terminal readback: Current full CI completed with only UI and CI Gate failed. Core/Tray and all WSL E2E gates passed. Ordinary UI aborted after 245 passes/6 skips with reported host exit 0xC000027B while a reasoning-picker case was active. Exact-current-head hardware run 42576535676 passed all three full builds and Shared/Tray suites: Azure Shared 4,939/25 existing skips, each ARM64 Shared 4,940/24, and Tray 5,445/zero skips on each host. Source-bound non-memory metadata and sequence are retained; the crash cause remains unclassified, with no blind rerun or memory capture.

Head 6d47bf66caf2e8c6d128f0ea0f15cfedc19f637f, tree 2b0e2ffecae40c1ea24f86dc3fe603007a3d4957, incorporating main b5c37e14. Build and Test 42575157510 completed with failure. GitHub reported the reconciled branch mergeable; required checks and proof still govern review readiness.

Earlier head 1f46289 passed full fixture UI 87/87 and all five new feed-admission cases. Shared failed solely on the ledger reference. Ordinary UI aborted after 175 passes/3 skips with reported host exit 0xC000027B while a reasoning-picker case was active; activity does not establish cause. The failure is retained, and this new source must pass its own full UI gate.

The completed preceding/current source-bound Tray suite passed 5,445 cases with zero skips. Fixture profile integration passed 48/48, Functional UI 19/19, and the existing portable-profile compatibility case passed. These boundaries do not prove native OS toast authority, packaged privacy or DND-specific upgrade behavior.

The ledger correction preserves both real guard tests: one valid Type.Method stays in the machine-readable column, and the companion guard is named in the invariant. No production behavior, assertions, filters, cycles or timeouts are relaxed. Earlier test compiler/analyzer and positive-GUID-fixture corrections are included.

Three-host run 42571519795 on L1 tree bebd585e passed all builds/cleanup and metadata 19/19 per host, then failed the same ledger check (Azure Shared 4,902 passed/1 failed/25 skips; each ARM64 4,903/1/24). Tray was not reached. Earlier run 42569076140 passed full build/Shared/Tray on pre-main tree d2b8fa95; it remains supporting correction evidence, not a later-head pass.

Not verified / blocked: current passing full validation and fresh ClawSweeper assessment; all layer-specific proof and second-model limits below remain open. A passing UI run does not establish a historical crash cause. Separate main-only crash capture remains parked, with no memory capture performed.

Earlier diagnostic-source validation (historical)

Current head 1f651c951fa7cca90813bdbb9b6b336f1b208cf9, tree e76770e5674ebcdc3729bf2defe92eef0fdb6be8, main parent 1c7901f6cb1e743ad42e8528780824ffd23af214. CI run 42562512876 completed with failure. Current-source results below do not validate the later local corrections.

• Shared test-project compilation failed with CS0619: the synchronous throwing lambda selected xUnit's obsolete async overload. The local correction explicitly types it as Action, preserving the body and all 19 diagnostic-case assertions.
• Tray test-project compilation failed with xUnit2013 at two exact-one collection assertions. The local correction uses Assert.Single on the same collection at the same points; no assertion is relaxed.
• These corrections passed bounded source closure reviews. They are not yet changes to this published PR head, and no Shared/Tray pass is claimed for it.
• Native diagnostic self-tests: 29 passed. Functional UI: 19/19 passed. Fixture profile/app integration: 48/48 passed.

Ordinary UI passed 710 cases / 7 existing skips, including all three Back-to-app mouse/Enter/Escape cases and all five new pure voice/selector observation cases. Mounted Gateway fixture UI passed 84/84, zero skips. Latest-stable portable profile compatibility passed 1/1; Local AI profile proof passed 12/12. These passing UI results do not override the Shared/Tray compilation failures or establish the cause of other runs’ native crashes.

Exact-source three-host full build/Shared/Tray closeout remains pending; another layer’s candidate result is not substituted for this tree.

No test filters, cycle counts, visible assertions, exception-handling outcomes or timeouts were relaxed. Independent source reviews covered components and composition, but native compiler/runtime evidence remains decisive. Private crash classification and the separate Windows runtime proof pools remain open. Prior screenshots and results below keep their original source identities.

Earlier combined-source native results

Current head 7808cec06642680e5c2d242046a4cdad5c3124e4, tree ce4bb2634367014a6d2b81038dfa644cd2841209, with main parent a39bd70aab55bfdc0053b278756a87c8a3305bcf. Current CI run 42554759061 completed with failure. GitHub tested synthetic merge ba8af633 against main a39bd70a, not the branch tip alone.

• Shared: 4,937 passed / 8 existing skips / 0 failed. Tray: 5,397 passed / 0 skipped / 0 failed.

• Diagnostic self-tests: 29 passed. Failure-lifecycle owner: 18 passed. Inbox/Settings composition: 7 passed. Fixture profile/app integration: 48/48 passed. Functional UI: 19/19 passed.

• Mounted Gateway fixture UI: 83/84 passed, 1 failed, zero skips.

• Latest-stable portable-profile compatibility: 1/1 passed. It does not establish installer/Store or DND-specific upgrade behavior.

• Ordinary UI: 665 passed / 7 existing skips / 0 failed, including all three Back-to-app mouse/Enter/Escape cases. Current focus screenshots remain separately uninspected.

• The sole mounted failure is selected-agent acknowledgement during cycle 2 of the twelve-cycle session-switch fact. There is no completed acknowledgement sample after the research activation, so the evidence does not establish that the selection stayed on main. Failure capture timed out, but owned stop, drain and disposal completed and the suite returned its full TRX.

Exact-source three-host full build/Shared/Tray closeout remains pending. The native assistant-selector operation/exception boundary is receiving narrow diagnostics and a one-shot SelectionItem contract clarification; no product selection cause or fix is claimed.

No assertions, cycle counts, test filters or timeouts were relaxed. No unchanged rerun was used to clear these failures. New local candidates are not included in the published source above. Previous screenshots and results below retain their historical source identities.

Earlier verified native validation

PR head 8b20cf4467d450404bcd4159cafd3c40056923a2, tree 7a2614c0a26bbc2574167421c7c3ef26adc4178b. CI run 42526534251 tested merge e26dc2af607d70baec2250dcff6859c84ae79e79 with main e70292487958be9e70170e2f3affe7afc42056e8, not the branch tip alone.

• Shared: 4,928 passed / 8 permitted skips / 0 failed, including all three new real-client feed protocol facts.
• Tray: 5,379 passed / 0 skipped / 0 failed.
• Fixture profile/app integration: 38/38 passed.
• Mounted Gateway fixture UI: 84/84 passed, zero skips. The new live feed, expiry, reconnect, destination and actual single-send assertions all passed.
• Latest-stable portable-profile compatibility: 1/1 passed. This is not installer/Store or DND-specific upgrade proof.
• Axe.Windows: 21 passed / 13 permitted skips. Permitted ordinary skips do not clear custom native proof pools.
• Ordinary in-process UI lane: 664 passed / 7 permitted skips. Build, core/CLI, setup, WSL recovery, packaging and the final CI Gate passed.

The complete three-PR proof delta and merged fixture admission passed independent source reviews. Required local commands were attempted but could not execute on the Linux coordinator; the native results above are separately identified. Historical crashes and failures remain retained below, not declared fixed from a later green run.

Earlier validation and original author results

The earlier layer-two green run predates the new feed journeys. The preceding integrated run had an ordinary UI host crash, a historical voice-tail timeout, an immediate Ask lookup failure and an incomplete fixture lane stopped at its 15-minute bound. Those failures are retained; the current passing run does not establish their root causes.

Earlier author validation (historical)

Run on head 5117ece1 (rebased on layer 1 8b7bec92) source (Windows 11 ARM64, .NET SDK 10.0.403), OPENCLAW_REPO_ROOT set to the worktree:

• ./build.ps1: passed (Shared, Cli, WinNodeCli, SetupEngine, WinUI; docs and proof-pool validation passed).
• dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj: passed 4892, failed 0, skipped 25 (existing opt-in integration/MXC/GPU skips).
• dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj: passed 5318, failed 0, skipped 0.
• Focused: GatewayPendingApprovalTests + OpenClawGatewayClientApprovalTranslationTests (31 passed); InboxGatewayItemsTests, InboxGatewaySourceTests, InboxProjectionTests (55 passed), covering cron/model-auth rules, alias grouping, expiry refresh, hydration, late replies after disconnect, client swaps, dismissal recurrence and feed routing. LocalizationValidationTests and DiagnosticsPageContractTests (single Inbox feed guard) pass inside the Tray run.
• Rubber-duck review: one blocking finding (late replies after a disconnect could restore stale rows) and four non-blocking findings (model-auth flight leaking across clients, dismissals carrying across Gateways, expiring credentials refreshing late, provider aliases). All five were fixed with regression tests before this push.

Review fixes (dual-model review of the Inbox stack, 5117ece1), each with a regression test:

• Out-of-range epoch-ms times (for example 9007199254740991) are rejected at parse time or clamped through one GatewayUnixTime helper, instead of throwing in date conversion and freezing every Gateway Inbox item until disconnect (GatewayPendingApprovalTests.TryParse_RejectsTimestampsBeyondTheRepresentableRange, InboxGatewayItemsTests.Builders_IgnoreTimestampsBeyondTheRepresentableRange, NextModelAuthRefreshAt_ClampsAFarExpiryInsteadOfThrowing).
• Approval expiry and countdown use a local deadline (arrival plus the Gateway's lifetime; non-positive lifetime = expired, repeats keep the first deadline), so Gateway clock skew no longer expires approvals early or hides them (LocalDeadline_MeasuresTheGatewayLifetimeOnTheLocalClock, ApprovalsFromASkewedGatewayClock_UseTheirLifetimeOnTheLocalClock, RepeatedApprovalRequests_KeepTheirOriginalDeadline).
• Host gateway is labelled Gateway (localized in all six locales with the app's existing Gateway terms) instead of "This computer", because the Gateway may be remote.
• The command preview shows the complete command in a scrollable, selectable block (no line cap or ellipsis) in both the flyout and the page; control, bidirectional and invisible formatting characters are shown as visible \u{XXXX} escapes (DisplayCommand_KeepsTheWholeCommandAndRevealsHiddenCharacters, DiagnosticsPageContractTests.InboxApprovalRows_LabelTheGatewayHostAndShowTheWholeCommand). Layer 3 adds the decision guard.
• WorkspaceWindow no longer creates a fallback InboxFeed that subscribed to the notification service and never unsubscribed.
• Rebased on layer 1's binding fix: InboxView no longer unbinds itself on Unloaded; the flyout and page hosts own the binding.

Real Behavior Proof

Earlier mounted feed-proof limits

• Source: 8b20cf4467d450404bcd4159cafd3c40056923a2, tree 7a2614c0a26bbc2574167421c7c3ef26adc4178b. The current native fixture suite passed; inspected source-bound captures are embedded above.
• The two mounted journeys passed complete redacted command/metadata, countdown/expiry, connection-bound list hydration, automation/account destinations and one actual automation explanation send. The account Ask button is checked for presence; that account prompt is not sent by the native journey.
• Synthetic authenticated Gateway input is distinct from deployed Gateway, provider, installer/Store, original-head mutation and full requested second-model proof. Those limits remain open.

Historical behavior evidence and its original limits

The shared age-clock pictures belong to layer 1’s identified CI merge. Current feed proof above belongs to this layer. The original author’s historical evidence is retained below without relabelling its source.

Earlier author behavior proof (historical)

• Environment tested: Windows 11 ARM64 desktop, current Debug build (win-arm64), isolated fixture profile via scripts\run-gateway-fixture.ps1 -Scenario chat-interactive -Interaction approval. Synthetic Gateway; no provider or command executed.
• PR head or commit tested: head 5117ece1 build for the flyout plus page run (Gateway host label, full scrollable command, synchronized countdowns, removal at the local deadline). The earlier Open chat navigation and deny-removal runs used the same approval path at 4501042c and its predecessor.
• Exact steps or command run: started the fixture; sent a chat message via local MCP app.chat.send to trigger the fixture's top-level exec.approval.requested; opened the Inbox page (app.navigate notifications) and the bell flyout; expanded the row in both; waited for the approval's deadline. Earlier runs: denied in chat, and clicked Open chat from the page.
• Evidence after fix: screenshots above; UI Automation tree at 5117ece1 showed the row Command approval needed, echo fixture-only with no dismiss button, Expires in 0:33 in both surfaces, the command inside a scroll area, the host text Gateway, and Open chat.
• Observed result: badge amber 1 while the approval waited; Approvals tab count 1; Open chat selected the approval's conversation; after Deny and after the timeout the badge and row cleared (Inbox Help: Nothing waiting).
• Screenshot or artifact links verified? (Yes/No/N/A): Yes
• Not verified or blocked: *.approval.list hydration (the fixture does not implement it), failed/overdue automation rows and model-auth rows (the fixture has no failing cron job or models.authStatus data), and Ask OpenClaw against a live Gateway are covered by unit tests only. No real native/WSL Gateway run.

Security Impact

• New permissions or capabilities? (Yes/No): No
• Secrets or tokens handling changed? (Yes/No): Yes, display-only redaction uses the shared sanitizer; stored credentials and observed raw approval identity are unchanged.
• New or changed network calls? (Yes/No): Yes
• Command or tool execution surface changed? (Yes/No): No
• Data access scope changed? (Yes/No): No
• If any answer is Yes, explain the risk and mitigation: on connect the existing operator connection now also reads exec/plugin/openclaw.approval.list (only with approval or admin scope), cron.list/cron.status and models.authStatus, and re-reads auth status every 5 minutes or at a credential's expiry. These are read-only RPCs the web UI already uses. Approval text and Gateway errors are rendered as plain text, never logged or exported (no telemetry changes). Ask OpenClaw sends a chat message only when the user clicks it.

Compatibility and Migration

• Backward compatible? (Yes/No): Yes
• Config or environment changes? (Yes/No): Yes
• Migration needed? (Yes/No): No
• If yes, list the exact upgrade steps: optional OPENCLAW_INBOX_GATEWAY_REQUEST_TIMEOUT_MS overrides the 15 s Inbox read timeout. Older Gateways that do not advertise these methods are skipped or fail quietly; the new IOperatorGatewayClient events have default no-op accessors so existing implementers still compile.

Review Conversations

Current repair review is separate from the earlier author reviews. Confirmed source findings are addressed with regressions; remaining runtime requests stay open. Fresh ClawSweeper review will be requested after the current native evidence is complete. Existing review checkboxes remain unchecked until verified.

• I replied to or resolved every bot review conversation addressed by this PR.
• I left unresolved only conversations that still need maintainer judgment.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge.

What this changes

This PR adds Gateway approvals, automation failures, and provider-account alerts to the native Inbox.

Example: The Gateway requests approval for curl https://example.test/run?token=fixture-secret ; echo fixture-end with a 45-second lifetime.

• Before: The native bell does not show the Gateway approval.
• After: The Inbox shows the redacted command, a countdown and Open chat, then removes the expired row.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Useful implementation with current native behavior evidence and no confirmed code finding; the explicit landing hold remains separate from patch quality.
Proof confidence	🐚 platinum hermit (4/6) ✨ media proof bonus	Sufficient (screenshot): Current-head source-bound native screenshots and mounted journeys exercise the shipped app's approval display, redaction, countdown/expiry, initial and reconnect hydration, navigation and accepted automation explanation send through the production client against an authenticated synthetic Gateway; account explanation sending and deployed-provider behavior are not claimed.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Feature · Worth it: Yes · Fix scope: Complete
User problem: Gateway approvals, failed automations and expired provider accounts do not reach the native bell or Inbox.
Reason: The collaborator-authored direction supplies actionable Gateway information through existing native surfaces; later approval-decision features remain explicitly separate.

Merge readiness

⛔ Blocked before merge - 1 item remains

Keep open: this maintainer-authored feature remains absent from main, and its explicit landing hold remains active; no new actionable code defect was found.

Priority: P2
Reviewed head: 8b20cf4467d450404bcd4159cafd3c40056923a2

Before merge

• Await maintainer action - Clear the recorded landing hold after feat: web-aligned Inbox for the footer bell and notifications page #2057 lands, the cumulative stack is reconciled, and the explicitly retained second-model and runtime gates are satisfied.

Findings

None.

Tests

• Missing end-to-end proof: Deployed-Gateway/provider execution and original-head negative controls remain unverified; the inspected native evidence exercises authenticated synthetic Gateway input.

Agent review details

How this fits together

The existing operator connection supplies Gateway events and inventories to an App-owned source; a shared feed and projection produce Inbox rows, tab counts and footer badges.

flowchart TD
  Gateway[Authenticated Gateway] --> Client[Existing operator client]
  Client --> Source[Inbox Gateway source]
  Notifications[App notifications] --> Feed[Shared Inbox feed]
  Source --> Feed
  Feed --> Projection[Inbox projection]
  Projection --> Views[Bell and Inbox page]
  Views --> Actions[Chat and Settings actions]

Loading

Technical review

Best possible solution:

Land one App-owned Gateway source feeding the shared Inbox projection and view after its presentation dependency and recorded landing gates are resolved.

Do we have a high-confidence way to reproduce the issue?

Current main's notification-only flyout establishes the missing Gateway feed in source; this read-only review executed no target code.

Is this the best way to solve the issue?

The missing facts belong in a connection-bound source, with rows, counts and badges sharing one projection; the patch reuses the operator connection, pagination reader, sanitizer and navigation owners without introducing a competing connection or decision path.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against e70292487958.

Provenance checked

• Notification presentation and shared footer changes intended behavior with a stated reason (Add app notifications surface #748: The original notification surface retained local command-denial notifications; subsequent footer and workspace changes preserved shared notification presentation.)
• Approval review safety keeps the original intent (3331b5e: fix(chat): in-chat approval card can show a different command than Allow runs #1499 requires unsafe or incomplete approval disclosures to remain Deny-only and blocks stale Allow before approval RPC I/O.)
• Shared display sanitizer keeps the original intent (4806eaa: The V2 approval cutover established bounded, secret-redacted review text and concealment detection; the new layout mode retains those protections.)
• Automation inventory reader keeps the original intent (4ea07e8: feat: find conversations and settings through shared navigation search #2016 introduced bounded authenticated navigation-search catalogs; this PR reuses that owner and strengthens revision and connection consistency.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Current-main capability gap: Current main still renders the notification-service snapshot through NotificationFlyoutContent; the introduced Gateway source and combined Inbox feed supply distinct missing functionality. (src/OpenClaw.Tray.WinUI/Controls/NotificationFlyoutContent.xaml.cs:48, e70292487958)
• Explicit landing hold and dependency: The complete PR body explicitly retains a landing hold and requires feat: web-aligned Inbox for the footer bell and notifications page #2057 to land before reconciling the cumulative stack; that dependency remains open and unmerged. (8b20cf4467d4)
• Current native behavior evidence: Inspected both current screenshots linked in feat: show live Gateway approvals, automation failures and account alerts in the Inbox #2060 (comment): the bell displays the redacted command and countdown, and native chat displays the automation explanation prompt; the corresponding journeys assert expiry, reconnect hydration, destinations and an accepted chat.send receipt. (tests/OpenClaw.Tray.UITests/GatewayFixtureUiTests.InboxFeedProof.cs:18, 8b20cf4467d4)
• Validation identity and limits: https://github.com/openclaw/openclaw-windows-node/actions/runs/42526534251 completed successfully for the reviewed head; supplied proof reports 84/84 mounted fixture cases with zero skips on synthetic merge e26dc2a. Direct job-log retrieval was blocked at the Azure artifact host, so those execution counts remain attributed to the supplied report. (8b20cf4467d4)
• Security and fixture admission: The added fixture rejects approval resolution, arbitrary prompts and non-main-session explanation sends before accepting an effect; production approval navigation remains separate from decisions, and the shared sanitizer preserves raw request identity while redacting presentation. (tests/OpenClaw.Shared.Tests/GatewayFixtureProtocolTests.InboxFeed.cs:8, 8b20cf4467d4)
• Affirmative dependency contract: InboxGatewayItems explicitly names the Control UI attention rules as its oracle, and the PR consumes Gateway RPCs; the inspected upstream attention builder corroborates failure, overdue and account classification, while the released cron page contract explicitly includes snapshotRevision. (src/cron/service/list-page-types.ts, 4ffdd2047d19)

Likely related people:

• Barbara Kudiess: Raw commit 3f6765e adds src/OpenClaw.Tray.WinUI/Controls/WorkspacePaneFooter.xaml.cs:26 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 3f6765ea02f4; files: src/OpenClaw.Tray.WinUI/Controls/WorkspacePaneFooter.xaml.cs)
• Sebastien Tardif: Raw commit 3331b5e adds src/OpenClaw.Tray.WinUI/Chat/ChatEventMapper.cs:466 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 3331b5e38876; files: src/OpenClaw.Tray.WinUI/Chat/ChatEventMapper.cs)

Preflight source

Source unknown. Source comparison at the observed PR snapshot only. Completion is self-reported; body, policy, tests, execution, and report bytes are not verified.

Review metrics

Metric	Value	Why it matters
Cumulative production and test delta	Production +2824/-794; tests and support +2457/-17	Includes the presentation dependency; growth provides the shared Inbox, Gateway ingestion, localization and distinct protocol, lifecycle and native rendering coverage.

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient.
• add proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P2: A useful native notification feature with limited blast radius and no demonstrated urgent regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on maintainer: Only explicit maintainer approvals or decisions remain; merge is still blocked.
• proof: sufficient: Contributor real behavior proof is sufficient.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (4 earlier review cycles)

• reviewed 2026-11-07T03:22:33.452Z sha 4501042 :: needs changes before merge. :: [P2] [P2] Give non-exec approvals a destination that can resolve them | [P2] [P2] Identify Gateway execution without claiming it is local | [P2] [P2] Read subsequent cron pages before deriving Inbox alerts
• reviewed 2026-11-08T16:35:36.095Z sha f87dec7 :: needs maintainer review before merge. :: none
• reviewed 2026-11-08T18:42:19.257Z sha ed32036 :: needs maintainer review before merge. :: none
• reviewed 2026-11-08T19:25:48.834Z sha ed32036 :: blocked before merge. :: none

Reviewed November 8, 2026, 5:37 PM ET / 22:37 UTC (Revision 5).

[roboclaw-bot]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/42500789032
• Updated: 2026-11-08T16:37:11.727Z

[roboclaw-bot]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/42511416738
• Updated: 2026-11-08T18:43:52.237Z

[roboclaw-bot]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/42515105724
• Updated: 2026-11-08T19:27:34.188Z

[roboclaw-bot]

Current native Inbox proof (8b20cf4)

Source: PR head 8b20cf4467d450404bcd4159cafd3c40056923a2. GitHub executed CI merge e26dc2af607d70baec2250dcff6859c84ae79e79 with main e70292487958be9e70170e2f3affe7afc42056e8, not the branch tip alone. Run 42526534251.

The actual fixture TRX records 84/84 passed, zero skips. These are real mounted WinUI controls and authenticated synthetic Gateway traffic. No command, plugin operation or external provider was executed. Images show current successful scenarios, not a pre-repair binary comparison.

The two new journeys passed complete redacted command/metadata on page and bell, real 45-second local expiry despite a +3-hour producer clock, connection-bound initial/reconnect inventory, native Automations/Models destinations and exactly one accepted automation explanation send. Account Ask is checked for presence; its prompt is not sent by the native case. Full CI is green.

Live approval: redacted full command in the bell

Actual Ask OpenClaw send

The test requires the successful chat.send receipt and exact prompt in the main conversation. This frame is the sent-prompt state; it does not claim a provider answer.

Selected actual native test durations:

• InboxFeed_ListHydrationReconnectAndFailureActionsUseAuthenticatedGateway: 00:00:06.6214449
• InboxFeed_LiveApprovalIsRedactedOnPageAndBellRoutesToChatAndExpiresLocally: 00:00:48.2330725

Images were visually inspected and are byte-verified after upload. Browser rendering verification remains unavailable. Existing historical comparisons keep their original source labels.

[roboclaw-bot]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/42531247431
• Updated: 2026-11-08T22:38:55.340Z