Codex review: needs maintainer review before merge. Reviewed May 31, 2026, 6:52 AM ET / 10:52 UTC.

Summary
The branch strips native anthropic/ prefixes during Anthropic static model-id normalization and adds regression coverage across catalog normalization, the OpenClaw wrapper, embedded static lookup, and fallback candidate resolution.

PR surface: Source +5, Tests +112. Total +117 across 5 files.

Reproducibility: yes. Source inspection on current main shows native Anthropic-prefixed ids are returned unchanged while the bundled Anthropic static catalog stores unprefixed ids, and the linked issue supplies production fallback logs showing doubled/leaked prefixes.

Review metrics: 1 noteworthy metric.

• Built-in provider normalization policies: 1 changed, 0 added, 0 removed. The changed Anthropic normalization branch affects configured model and fallback resolution before provider lookup, so maintainers should notice the compatibility surface before merge.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

• [P1] Provider/model normalization is compatibility-sensitive: existing native Anthropic config entries containing anthropic/<model> will now resolve to the unprefixed Anthropic model id before static catalog and provider lookup.
• [P1] The supplied after-fix proof exercises the real local runWithModelFallback path with redacted synthetic provider failures, but it is not a live gateway failover against production Anthropic/OpenAI/XAI credentials.

Maintainer options:

1. Merge With Explicit Compatibility Acceptance (recommended)
   The focused tests, current source path, and local runtime proof support landing once maintainers accept that native Anthropic-prefixed config entries now normalize to unprefixed Anthropic ids.
2. Request Credentialed Gateway Failover Proof
   If production parity is required before changing provider/model normalization, ask for a maintainer or contributor run with real provider credentials and redacted logs.
3. Pause For Broader Alias Policy
   If maintainers want this to be part of a cross-provider alias policy instead of a native Anthropic repair, pause this PR and move the policy decision to a separate design thread.

Next step before merge

• No automated repair is needed; maintainers should make the merge decision for the scoped compatibility and provider-routing risk.

Security
Cleared: No concrete security or supply-chain regression was found; the diff changes provider/model normalization logic and tests only.

Updated the PR body with redacted local runtime fallback proof from the real runWithModelFallback path after rebasing to 4b1e5b79435c.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/26710217022
• Updated: 2026-05-31T10:38:27.647Z

Rebased again and refreshed the PR body/proof on head 4ee13a12c08d66f556d26237ef07bd9d99ea98df. Raw Pulls API now verifies maintainer_can_modify: true.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/26710490263
• Updated: 2026-05-31T10:53:14.302Z

Maintainer verification before landing #88587.

Behavior addressed: Native Anthropic fallback refs such as anthropic/claude-haiku-4-5 are normalized to the provider-local model id before static catalog and fallback lookup, preventing doubled anthropic/anthropic/... ids and cross-provider fallback attempts carrying the Anthropic-prefixed model id.

Real environment tested: Maintainer source checkout on macOS, current origin/main after fast-forward to 5a0e67791fdc234c95c47e4945ae04b99769fef9; PR head 4ee13a12c08d66f556d26237ef07bd9d99ea98df.

Exact steps or command run after this patch: git status -sb; git pull --ff-only; gh pr view 88587 --repo openclaw/openclaw --json ...; gh pr diff 88587 --repo openclaw/openclaw --patch; git blame -L 105,121 -- packages/model-catalog-core/src/provider-model-id-normalization.ts; git fetch origin pull/88587/head:refs/remotes/origin/pr/88587; git merge-tree --write-tree origin/main origin/pr/88587; git diff --name-only f7a1d3f3f676f95b86468bbe911250b96084ea76..origin/main -- <touched files>; gh api repos/openclaw/openclaw/commits/4ee13a12c08d66f556d26237ef07bd9d99ea98df/check-runs --paginate.

Evidence after fix: PR CI completed successfully for the head SHA; only superseded duplicate auto-response / Real behavior proof runs were cancelled. ClawSweeper marked proof sufficient and ready for maintainer review. Local merge-tree against current origin/main produced a clean tree, and no PR-touched files changed on main since the PR base.

Observed result after fix: Source review confirms the production change is scoped to normalizeBuiltInProviderModelId("anthropic", ...), stripping the native anthropic/ prefix before alias/static lookup. The added tests cover catalog normalization, OpenClaw model-ref wrapper behavior, embedded static lookup arguments, and fallback candidate normalization.

What was not tested: I did not run a live gateway failover with real provider credentials from this machine, and I did not rerun the local Vitest/tsgo commands already supplied by the contributor and CI.

Thanks for the fast turnaround on this. Wanted to share an empirical data point that suggests the fix scope should be widened before merge.

TL;DR: I deployed a workaround for the issue on our pod by swapping the cost-tier model from anthropic/claude-haiku-4-5 to google/gemini-2.0-flash. Same exact bug fired — just with google/ instead of anthropic/:

Unknown model: anthropic/google/gemini-2.0-flash   (114 errors)
Unknown model: xai/google/gemini-2.0-flash         (76)
Unknown model: google/google/gemini-2.0-flash      (76)

Same shape as the Anthropic case: the prefixed model id leaks across fallback candidates, only the leading provider qualifier swaps per candidate.

Root cause confirmation: looking at the shipped normalizeBuiltInProviderModelId, only nvidia, openrouter, huggingface, and together have explicit self-prefix-strip branches. google goes through normalizeGooglePreviewModelId (which handles preview aliases but not redundant provider prefix), xai only rewrites specific reasoning-variant strings, and anthropic falls through unchanged — same gap your PR is patching.

Suggestion: would it be possible to generalize the strip rather than add an anthropic-specific branch? Something like a final pass that, regardless of provider, strips a leading ${provider}/ if the model id starts with it — covering anthropic + google + xai + any future provider without further per-provider branches. The fallback-iterator candidate-isolation fix (the second half of your PR) is already general; this would make the first half match it.

Happy to test against any candidate branch if you push one — our pod reproduces the leak deterministically on every heartbeat firing (~30/hour on each affected agent).