• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• The egg game starts only after the PR passes the real-behavior proof check.
• Before that, no creature, rarity, or ASCII portrait is rolled. The treat waits for real proof.
• This is still just collectible flavor: proof affects review readiness, not creature quality.

Best possible solution:

Land the runtime gate after aligning the public SDK wording and adding real Slack or trusted global-plugin proof that persistence works while untrusted plugins remain blocked.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection: current main rejects non-bundled openKeyedStore() calls, while the Slack thread participation cache calls that API and official external installs can be global. I did not run a live Slack reproduction in this read-only review.

Is this the best way to solve the issue?

Mostly yes: using the existing trustedOfficialInstall contract is the narrow owner-boundary fix, but the public SDK docs and real behavior proof need to catch up before merge.

Label justifications:

• P1: The linked regression breaks a real Slack channel workflow by losing persistent thread participation for official external global installs.

Full review comments:

• [P3] Update the keyed-state access contract docs — src/plugins/registry.ts:2424-2426
  This widens openKeyedStore() from bundled-only to trusted official installs, but docs/plugins/sdk-runtime.md still tells plugin authors it is "Bundled plugins only in this release." Please update that public SDK warning so the docs match the new trusted-plugin contract.
  Confidence: 0.84

Overall correctness: patch is correct
Overall confidence: 0.86

What I checked:

• Current main gate: Current main only allows keyed plugin state when the runtime record origin is bundled, which matches the linked report's root-cause path for official external plugins loaded as global. (src/plugins/registry.ts:2424, d124c5aa2005)
• PR implementation: The PR changes the runtime check to allow records where trustedOfficialInstall === true while preserving the existing throw path for other non-bundled records. (src/plugins/registry.ts:2424, df4a8a854c00)
• Trust contract source: trustedOfficialInstall is derived from global/config candidates that match recorded installs and the official external plugin catalog, not from plugin manifest self-assertion. (src/plugins/manifest-registry.ts:779, d124c5aa2005)
• Regression coverage in PR: The PR adds coverage for a trusted global plugin successfully registering and looking up keyed state, plus continued rejection for untrusted workspace and global plugins. (src/plugin-state/plugin-state-store.runtime.test.ts:95, df4a8a854c00)
• Affected Slack path: Slack thread participation persistence opens a keyed store, so current main's bundled-only gate explains the reported global-plugin fallback to in-memory state. (extensions/slack/src/sent-thread-cache.ts:74, 1912be8619fb)
• Docs mismatch: The public SDK runtime documentation still says keyed stores are bundled-plugin-only, which becomes stale after this PR's trusted official install behavior. Public docs: docs/plugins/sdk-runtime.md. (docs/plugins/sdk-runtime.md:527, d124c5aa2005)

Likely related people:

• Krzysztof Probola: Blame on the current plugin runtime state proxy and isTrustedOfficialPluginInstall helper points to commit 1912be8619fbd874e27c67b1e967161b273cff18. (role: introduced current runtime/trust plumbing in local history; confidence: medium; commits: 1912be8619fb; files: src/plugins/registry.ts, src/plugins/manifest-registry.ts)
• Peter Steinberger: Recent history around the affected Slack cache and official/trusted plugin install area includes release and trusted catalog/externalization work by this author. (role: recent adjacent contributor; confidence: medium; commits: 50a2481652b6, a86c43e1fd88, e1da91791abf; files: extensions/slack/src/sent-thread-cache.ts, src/commands/channel-setup/trusted-catalog.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against d124c5aa2005.