Peter Steinberger 18dc54fb1c fix(release): allow direct recovery of failed ClawHub bootstrap children (#160180) ...

* fix(release): admit direct human ClawHub bootstrap recovery from trusted main

The first job of Plugin ClawHub New refused every non-bot dispatch, which made the existing direct-recovery branch of the approval validation unreachable. A failed bootstrap child could not be recovered once its parent completed.

Human dispatches from trusted main now pass when main contains the parent-approved bootstrap_workflow_sha. Parent and protected-tag dispatches still require the exact SHA, and the attested parent approval stays bound to that approved SHA.

* test(release): expect the approved bootstrap SHA in the parent authorization contract

Co-authored-by: Peter Steinberger <steipete@gmail.com>

2026-09-28 02:46:35 -07:00

..

actions

fix(ci): prepare kernel memory containment for semantic checks (#160014)

2026-09-28 16:00:25 +07:00

codeql

perf(plugins): reuse prepared source SDK alias facts (#150622)

2026-09-16 23:54:50 -07:00

codex/prompts

refactor: split release changelogs and synchronize docs mirrors (#145464)

2026-09-11 21:19:18 -07:00

crabbox

fix(perf): isolate external evaluator from candidate runtime (#144162)

2026-09-11 21:09:08 +08:00

images/live-media-runner

ci: preinstall ffmpeg for live media checks

2026-04-29 03:48:33 +01:00

instructions

fix(runtime): require Node builds with lossless SQLite reads (#140672)

2026-09-07 10:31:31 -07:00

ISSUE_TEMPLATE

docs(templates): ask feature requesters whether they plan to implement (#109258)

2026-07-16 18:44:41 -07:00

pr-proof

fix(openai): prioritize ChatGPT sign-in and clarify auth choices (#157792)

2026-09-24 23:10:32 -07:00

release

chore(deps): refresh dependencies through September 19 cutoff (#159401)

2026-09-27 19:33:08 -07:00

workflows

fix(release): allow direct recovery of failed ClawHub bootstrap children (#160180)

2026-09-28 02:46:35 -07:00

actionlint.yaml

fix(ios): stabilize native release qualification (#159890)

2026-09-27 19:44:26 -05:00

CODEOWNERS

feat(ci): split security review into maintainer and SecOps tiers (#152415)

2026-09-18 23:39:46 -05:00

dependabot.yml

chore(deps): enforce seven-day npm cooldowns and refresh eligible pins (#132385)

2026-08-29 02:07:05 -07:00

labeler.yml

refactor: retire the TaskFlow Webhooks plugin (#158225)

2026-09-25 20:29:15 -07:00

package-trusted-sources.json

fix: harden package URL downloads (#85578)

2026-05-23 17:28:29 +01:00

pull_request_template.md

docs: require UI screenshots in chat and PR (#147263)

2026-09-13 11:41:44 -07:00

retired-sticky-disks.json

ci: replace dependency sticky disk with exact cache (#123040)

2026-08-13 01:13:25 -07:00

security-review-policy.yml

feat(ci): split security review into maintainer and SecOps tiers (#152415)

2026-09-18 23:39:46 -05:00

zizmor.yml

chore(compat): date the annotated deprecation families and expose removal-pending debt (#114002)

2026-07-25 21:01:20 -07:00