Summary

Describe the problem and fix in 2-5 bullets:

• Problem: Barnacle can remove proof: sufficient after ClawSweeper accepts real-behavior proof because Barnacle only trusts PR-body proof or proof: override.
• Why it matters: ClawSweeper automerge can get stuck when the label is stripped and the required Real behavior proof check does not consume ClawSweeper's exact-head verdict.
• What changed: The shared proof policy now recognizes ClawSweeper clawsweeper-verdict:pass markers only when they match the PR number and current head SHA; Barnacle preserves proof: sufficient for that exact-head verdict, and the required proof check accepts it.
• What did NOT change (scope boundary): This does not weaken body-based proof validation, maintainer override behavior, or stale proof removal when the ClawSweeper verdict is missing or for a different head.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #
• Related fix(models): respect auth order in picker label #83581
• This PR fixes a bug or regression

Real behavior proof (required for external PRs)

External contributors must show after-fix evidence from a real OpenClaw setup. Unit tests, mocks, lint, typechecks, snapshots, and CI are supplemental only. Screenshots are encouraged even for CLI, console, text, or log changes; terminal screenshots and copied live output count. Be mindful of private information like IP addresses, API keys, phone numbers, non-public endpoints, or other private details when providing evidence.

• Behavior or issue addressed: Barnacle proof-label synchronization and the required proof check now honor an exact-head ClawSweeper pass verdict.
• Real environment tested: Local OpenClaw checkout on macOS with Node/pnpm repo test wrappers.
• Exact steps or command run after this patch: pnpm test test/scripts/real-behavior-proof-policy.test.ts test/scripts/barnacle-auto-response.test.ts; pnpm exec oxfmt --check --threads=1 .github/workflows/real-behavior-proof.yml scripts/github/real-behavior-proof-policy.mjs scripts/github/real-behavior-proof-check.mjs scripts/github/barnacle-auto-response.mjs test/scripts/real-behavior-proof-policy.test.ts test/scripts/barnacle-auto-response.test.ts; git diff --check origin/main...HEAD.
• Evidence after fix (screenshot, recording, terminal capture, console output, redacted runtime log, linked artifact, or copied live output): Focused tests passed: 2 Vitest shards, 2 test files, 50 tests. Format check and diff whitespace check passed.
• Observed result after fix: Tests prove exact-head ClawSweeper verdict markers are accepted only for the matching PR/head and Barnacle preserves proof: sufficient on synchronize when the marker is valid.
• What was not tested: A live GitHub Actions run against a PR comment marker before opening this PR.
• Before evidence (optional but encouraged): PR fix(models): respect auth order in picker label #83581 timeline showed Barnacle removing proof: sufficient after ClawSweeper applied it, while Real behavior proof remained failing.

Root Cause (if applicable)

For bug fixes or regressions, explain why this happened, not just what changed. Otherwise write N/A. If the cause is unclear, write Unknown.

• Root cause: Barnacle and the Real behavior proof workflow used the structured PR body proof policy but did not read ClawSweeper's durable exact-head verdict marker.
• Missing detection / guardrail: No test covered the cross-bot contract where ClawSweeper accepts proof in a marker and Barnacle later reevaluates labels on synchronize.
• Contributing context (if known): Barnacle intentionally removes stale proof: sufficient on PR updates, but it had no way to distinguish stale labels from an exact-head ClawSweeper pass.

Regression Test Plan (if applicable)

For bug fixes or regressions, name the smallest reliable test coverage that should catch this. Otherwise write N/A.

• Coverage level that should have caught this:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file: test/scripts/real-behavior-proof-policy.test.ts; test/scripts/barnacle-auto-response.test.ts
• Scenario the test should lock in: Exact-head ClawSweeper pass markers count as proof only for the matching PR/head, and Barnacle preserves proof: sufficient on synchronize when that marker exists.
• Why this is the smallest reliable guardrail: The bug was in local proof-policy and Barnacle label synchronization logic, so unit/tooling tests cover the contract without needing a live PR.
• Existing test that already covers this (if any): None before this PR.
• If no new test is added, why not: N/A

User-visible / Behavior Changes

Automerge/proof automation can now proceed from an exact-head ClawSweeper proof verdict instead of racing over proof: sufficient label churn.

Diagram (if applicable)

Before:
ClawSweeper pass marker -> proof: sufficient -> Barnacle synchronize check -> label removed
PR body lacks structured proof -> Real behavior proof check fails

After:
ClawSweeper pass marker for current head -> Barnacle preserves proof: sufficient
ClawSweeper pass marker for current head -> Real behavior proof check passes

Security Impact (required)

• New permissions/capabilities? (Yes/No) Yes
• Secrets/tokens handling changed? (Yes/No) No
• New/changed network calls? (Yes/No) Yes
• Command/tool execution surface changed? (Yes/No) No
• Data access scope changed? (Yes/No) Yes
• If any Yes, explain risk + mitigation: The proof workflow reads PR issue comments using the existing app token so it can find ClawSweeper's marker. The marker is accepted only when the PR number and exact 40-character head SHA match, limiting stale or copied-marker risk.

Repro + Verification

Environment

• OS: macOS
• Runtime/container: Local repo Node/pnpm test wrappers
• Model/provider: N/A
• Integration/channel (if any): GitHub Actions/Barnacle/ClawSweeper automation
• Relevant config (redacted): N/A

Steps

1. Add a ClawSweeper pass verdict marker for a matching PR number and head SHA.
2. Run the proof policy and Barnacle auto-response tests.
3. Confirm mismatched head SHAs are rejected and matching markers preserve proof: sufficient.

Expected

• Matching exact-head ClawSweeper pass markers count as sufficient proof.
• Mismatched markers do not count.
• Barnacle preserves proof: sufficient only when the exact-head marker exists.

Actual

• Focused tests passed with those assertions.

Evidence

Attach at least one:

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

Human Verification (required)

What you personally verified (not just CI), and how:

• Verified scenarios: Focused proof-policy tests and Barnacle label-sync tests passed locally.
• Edge cases checked: Marker SHA mismatch does not count as proof.
• What you did not verify: Live GitHub Actions execution before opening this PR.

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

If a bot review conversation is addressed by this PR, resolve that conversation yourself. Do not leave bot review conversation cleanup for maintainers.

Compatibility / Migration

• Backward compatible? (Yes/No) Yes
• Config/env changes? (Yes/No) No
• Migration needed? (Yes/No) No
• If yes, exact upgrade steps: N/A

Risks and Mitigations

• Risk: A copied ClawSweeper marker could otherwise be mistaken for proof.
  • Mitigation: The parser requires both the PR number and exact current head SHA to match.