pdurlej/platform

Fork 0

fix(matrix): restore mobile discovery routing #822

Merged

Iskra merged 2 commits from codex/matrix-discovery-hotfix into main

2026-06-26 11:03:59 +02:00

codex commented

2026-06-23 08:14:40 +02:00

Collaborator

Canary status: missing — fire canary via python -m platformctl.tools.run_review before merge

Summary

Persist the live Matrix mobile-discovery hotfix that restored Element iOS homeserver discovery after the runtime fix on rs2000.

Changes

Add the Traefik file-provider Matrix/Element route that exists on runtime.
Serve /.well-known/matrix/client for pdurlej.com, matrix.pdurlej.com, and element.pdurlej.com through matrix-well-known.
Force Matrix discovery responses to application/json with CORS headers.
Document the mobile discovery triage path in the matrix-well-known runbook.

Verification

Runtime https://pdurlej.com/.well-known/matrix/client returns HTTP 200, Content-Type: application/json, and CORS headers.
Runtime https://matrix.pdurlej.com/.well-known/matrix/client returns HTTP 200, Content-Type: application/json, and CORS headers.
Runtime https://element.pdurlej.com/.well-known/matrix/client returns HTTP 200, Content-Type: application/json, and CORS headers.
Runtime https://matrix.pdurlej.com/_matrix/client/versions returns HTTP 200.
YAML parses with PyYAML for config/traefik/dynamic/*.yml.
Matrix password reset was performed live for @pdurlej:pdurlej.com; new password is stored in macOS Keychain under matrix.pdurlej.com / pdurlej.
Offline bcrypt verification passed: Keychain password matches the Synapse stored hash. No Matrix login session was created for verification.

Test plan

Canary/full review before merge because this touches edge routing and a Matrix discovery trust boundary.
After merge, run the same three .well-known/matrix/client header probes from a Tailnet client.

Spec sources read

AGENTS.md — repo operating contract and Forgejo rules.
docs/forgejo-agent-operations.md — Forgejo identity/write contract.
.forgejo/pull_request_template.md — PR body requirements.
compose/apps/compose.yaml — matrix-well-known service definition.
modules/matrix-well-known/module.yaml — module purpose and exposure.
modules/matrix-well-known/runbook.md — recovery and triage doc updated by this PR.
modules/traefik/runbook.md — dynamic config runtime mount path.

Risk / class

class/security-sensitive: edge routing, Tailnet allowlist, and Matrix discovery trust boundary.
tier/full: route behavior affects login/discovery for Matrix clients.

Out of scope

No Synapse restart.
No public exposure expansion; ts-allowlist@file remains on Matrix/Element routes.
No database schema changes.
No secret values are committed or printed.

Canary status: missing — fire canary via `python -m platformctl.tools.run_review` before merge ## Summary Persist the live Matrix mobile-discovery hotfix that restored Element iOS homeserver discovery after the runtime fix on rs2000. ## Changes - Add the Traefik file-provider Matrix/Element route that exists on runtime. - Serve `/.well-known/matrix/client` for `pdurlej.com`, `matrix.pdurlej.com`, and `element.pdurlej.com` through `matrix-well-known`. - Force Matrix discovery responses to `application/json` with CORS headers. - Document the mobile discovery triage path in the matrix-well-known runbook. ## Verification - [x] Runtime `https://pdurlej.com/.well-known/matrix/client` returns HTTP 200, `Content-Type: application/json`, and CORS headers. - [x] Runtime `https://matrix.pdurlej.com/.well-known/matrix/client` returns HTTP 200, `Content-Type: application/json`, and CORS headers. - [x] Runtime `https://element.pdurlej.com/.well-known/matrix/client` returns HTTP 200, `Content-Type: application/json`, and CORS headers. - [x] Runtime `https://matrix.pdurlej.com/_matrix/client/versions` returns HTTP 200. - [x] YAML parses with PyYAML for `config/traefik/dynamic/*.yml`. - [x] Matrix password reset was performed live for `@pdurlej:pdurlej.com`; new password is stored in macOS Keychain under `matrix.pdurlej.com / pdurlej`. - [x] Offline bcrypt verification passed: Keychain password matches the Synapse stored hash. No Matrix login session was created for verification. ## Test plan - [ ] Canary/full review before merge because this touches edge routing and a Matrix discovery trust boundary. - [ ] After merge, run the same three `.well-known/matrix/client` header probes from a Tailnet client. ## Spec sources read - `AGENTS.md` — repo operating contract and Forgejo rules. - `docs/forgejo-agent-operations.md` — Forgejo identity/write contract. - `.forgejo/pull_request_template.md` — PR body requirements. - `compose/apps/compose.yaml` — `matrix-well-known` service definition. - `modules/matrix-well-known/module.yaml` — module purpose and exposure. - `modules/matrix-well-known/runbook.md` — recovery and triage doc updated by this PR. - `modules/traefik/runbook.md` — dynamic config runtime mount path. ## Risk / class - `class/security-sensitive`: edge routing, Tailnet allowlist, and Matrix discovery trust boundary. - `tier/full`: route behavior affects login/discovery for Matrix clients. ## Out of scope - No Synapse restart. - No public exposure expansion; `ts-allowlist@file` remains on Matrix/Element routes. - No database schema changes. - No secret values are committed or printed.

codex added 1 commit

2026-06-23 08:14:40 +02:00

fix(matrix): restore mobile discovery routing

canary-required / collect-diff (pull_request) Successful in 5s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 19s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 17s

Details

python-ci / Python 3.11 (pull_request) Successful in 42s

Details

python-ci / Python 3.12 (pull_request) Successful in 44s

Details

python-ci / Python 3.13 (pull_request) Successful in 44s

Details

canary-required / canary (pull_request) Successful in 19s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 5s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 19s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 2m38s

Details

985bb46b93

codex added the

class/security-sensitive

risk/exposure

risk/runtime

tier/full

labels

2026-06-23 08:15:10 +02:00

patchwarden commented

2026-06-23 08:20:19 +02:00

First-time contributor

Patchwarden PR sanity

Operator signal: 🛑 STOP - reviewer finding(s) must be addressed or explicitly accepted.

Automerge signal: ❌ NOT READY - no unattended merge or APPROVED review should be published.

Verdict: 🛑 STOP - a model reviewer reported actionable findings.

Next step: Address the reviewer finding(s), or leave a human decision explaining why the risk is accepted.

PR: 822
Commit: 6efc251b57af7fad724349c6c292814eda5add48
Status: advisory_findings
Reviewer health: findings
Security-sensitive label: present
Authority: Patchwarden policy signal; branch protection and automerge controller remain merge authority.
Model mix: glm-5.2:cloud, deepseek-v4-pro:cloud, kimi-k2.7:cloud

What I checked

Changed files: 2
Deterministic blocker scan: clean
Model reviewer lanes: 3
Comment contract: this comment is updated in place via a hidden Patchwarden marker.

Approval Handoff

State: not_ready_reviewer_findings
Action: address reviewer finding(s) or leave a human decision before any unattended approval.
Boundary: branch protection and the automerge controller remain merge authority.

Signal Board

Legend: ✅ evidence is sufficient; 🟡 controller still has work; ⚠️ automation retries first; 🛑/❌ do not approve or merge.

Lane	Signal	Meaning
🧪 Deterministic sanity	✅ `clean`	No deterministic blockers found.
🧠 Model reviewers	❌ `findings`	Address reviewer finding(s) before approval.
🛡️ Patchwarden approval	❌ `not_ready_reviewer_findings`	No unattended APPROVED review should be published.
🚦 Unattended automerge	❌ `ineligible`	Outside the narrow safe-docs/status unattended lane.
🙋 Owner attention	🔁 `automation first`	Retry, repair, or inspect automation before asking the owner.

Scope blocker: non-doc/status path(s): config/traefik/dynamic/matrix-element-restore.yml, modules/matrix-well-known/runbook.md
Risk label blocker: class/security-sensitive, risk/exposure, risk/runtime, tier/full
Security-sensitive blocker: class/security-sensitive is present.
🧭 Merge authority: branch protection and automerge controller remain authoritative.

Required Fixes

No deterministic blockers.

Reviewer Details

Model reviewer lanes

`global-glm` / `glm-5.2:cloud`

Status: ok
Verdict: NOT_OK
high Canary explicitly missing on a security-sensitive edge routing change
- Evidence: PR description states: 'Canary status: missing — fire canary via python -m platformctl.tools.run_review before merge' and Test plan has unchecked '[ ] Canary/full review before merge because this touches edge routing and a Matrix discover
- Next: Run the canary/full review before merge and record the result; do not merge on a self-declared missing canary for a tier/full security-sensitive change.
medium CORS middleware sets Access-Control-Allow-Origin: * without an explicit OPTIONS/preflight route
- Evidence: config/traefik/dynamic/matrix-element-restore.yml defines matrix-well-known-json middleware with Access-Control-Allow-Origin: *, Access-Control-Allow-Methods: GET, OPTIONS, but no router rule matches OPTIONS method explicitly and no mid
- Next: Verify nginx config for matrix-well-known handles OPTIONS with 204/200 and the configured CORS headers, or add an explicit OPTIONS router; otherwise browser preflight may 404/405 and Element web clients could fail discovery.
medium customResponseHeaders Content-Type may mask upstream misconfiguration
- Evidence: matrix-well-known-json middleware forces Content-Type: application/json via customResponseHeaders on all three well-known routers (matrix-well-known-root/host/element). If matrix-well-known serves a 404/HTML error page, Traefik will still
- Next: Confirm matrix-well-known nginx returns 200 JSON for /.well-known/matrix/client and /.well-known/matrix/server on all three hosts, and consider only setting Content-Type on 2xx via a more targeted middleware or header regex.
low matrix-client router lacks matrix-well-known-json middleware and may shadow well-known on matrix.pdurlej.com
- Evidence: matrix-client rule Host(matrix.pdurlej.com) && (PathPrefix(/_matrix) || PathPrefix(/_synapse/client))has no explicit priority; matrix-well-known-host has priority 450 forHost(matrix.pdurlej.com) && PathPrefix(/.well-known/matrix/`
- Next: Set an explicit priority on matrix-client consistent with the well-known routers to make ordering deterministic across the file provider.

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
low Overly permissive CORS header on well-known endpoint
- Evidence: config/traefik/dynamic/matrix-element-restore.yml line 10 sets Access-Control-Allow-Origin: *for the well-known middleware. The route is currently protected byts-allowlist@file, but if that middleware is ever removed or misconfigured,
- Next: Add a comment in the YAML noting that the wildcard origin is safe only because the route is behind the Tailscale allowlist, and that removing the allowlist would require restricting the origin.

`redteam` / `kimi-k2.7:cloud`

Status: error
Verdict: -
Note: Ollama HTTP 404: {"error": "model 'kimi-k2.7:cloud' not found"}
Findings: none

Policy notes

Patchwarden PR sanity is the first merge-lane signal for this PR.
Models produce findings; Patchwarden/policy produces decisions.
Model findings alone do not fail the status check; they require human or agent disposition.
Formal approval is separate from this comment and requires clean reviewer health.
Automerge remains delegated to branch protection and the automerge pilot.

# Patchwarden PR sanity **Operator signal:** 🛑 STOP - reviewer finding(s) must be addressed or explicitly accepted. **Automerge signal:** ❌ NOT READY - no unattended merge or APPROVED review should be published. **Verdict:** 🛑 STOP - a model reviewer reported actionable findings. **Next step:** Address the reviewer finding(s), or leave a human decision explaining why the risk is accepted. - PR: `822` - Commit: `6efc251b57af7fad724349c6c292814eda5add48` - Status: `advisory_findings` - Reviewer health: `findings` - Security-sensitive label: `present` - Authority: Patchwarden policy signal; branch protection and automerge controller remain merge authority. - Model mix: `glm-5.2:cloud`, `deepseek-v4-pro:cloud`, `kimi-k2.7:cloud` ## What I checked - Changed files: `2` - Deterministic blocker scan: `clean` - Model reviewer lanes: `3` - Comment contract: this comment is updated in place via a hidden Patchwarden marker. ## Approval Handoff - State: `not_ready_reviewer_findings` - Action: address reviewer finding(s) or leave a human decision before any unattended approval. - Boundary: branch protection and the automerge controller remain merge authority. ## Signal Board - Legend: ✅ evidence is sufficient; 🟡 controller still has work; ⚠️ automation retries first; 🛑/❌ do not approve or merge. | Lane | Signal | Meaning | | --- | --- | --- | | 🧪 Deterministic sanity | ✅ `clean` | No deterministic blockers found. | | 🧠 Model reviewers | ❌ `findings` | Address reviewer finding(s) before approval. | | 🛡️ Patchwarden approval | ❌ `not_ready_reviewer_findings` | No unattended APPROVED review should be published. | | 🚦 Unattended automerge | ❌ `ineligible` | Outside the narrow safe-docs/status unattended lane. | | 🙋 Owner attention | 🔁 `automation first` | Retry, repair, or inspect automation before asking the owner. | - Scope blocker: non-doc/status path(s): `config/traefik/dynamic/matrix-element-restore.yml`, `modules/matrix-well-known/runbook.md` - Risk label blocker: `class/security-sensitive`, `risk/exposure`, `risk/runtime`, `tier/full` - Security-sensitive blocker: `class/security-sensitive` is present. 🧭 Merge authority: branch protection and automerge controller remain authoritative. ## Required Fixes No deterministic blockers. ## Reviewer Details <details> <summary>Model reviewer lanes</summary> ### `global-glm` / `glm-5.2:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`high`** Canary explicitly missing on a security-sensitive edge routing change - Evidence: `PR description states: 'Canary status: missing — fire canary via `python -m platformctl.tools.run_review` before merge' and Test plan has unchecked '[ ] Canary/full review before merge because this touches edge routing and a Matrix discover` - Next: Run the canary/full review before merge and record the result; do not merge on a self-declared missing canary for a tier/full security-sensitive change. - **`medium`** CORS middleware sets Access-Control-Allow-Origin: * without an explicit OPTIONS/preflight route - Evidence: `config/traefik/dynamic/matrix-element-restore.yml defines matrix-well-known-json middleware with `Access-Control-Allow-Origin: *`, `Access-Control-Allow-Methods: GET, OPTIONS`, but no router rule matches OPTIONS method explicitly and no mid` - Next: Verify nginx config for matrix-well-known handles OPTIONS with 204/200 and the configured CORS headers, or add an explicit OPTIONS router; otherwise browser preflight may 404/405 and Element web clients could fail discovery. - **`medium`** customResponseHeaders Content-Type may mask upstream misconfiguration - Evidence: `matrix-well-known-json middleware forces `Content-Type: application/json` via customResponseHeaders on all three well-known routers (matrix-well-known-root/host/element). If matrix-well-known serves a 404/HTML error page, Traefik will still` - Next: Confirm matrix-well-known nginx returns 200 JSON for /.well-known/matrix/client and /.well-known/matrix/server on all three hosts, and consider only setting Content-Type on 2xx via a more targeted middleware or header regex. - **`low`** matrix-client router lacks matrix-well-known-json middleware and may shadow well-known on matrix.pdurlej.com - Evidence: `matrix-client rule `Host(`matrix.pdurlej.com`) && (PathPrefix(`/_matrix`) || PathPrefix(`/_synapse/client`))` has no explicit priority; matrix-well-known-host has priority 450 for `Host(matrix.pdurlej.com) && PathPrefix(/.well-known/matrix/` - Next: Set an explicit priority on matrix-client consistent with the well-known routers to make ordering deterministic across the file provider. ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - **`low`** Overly permissive CORS header on well-known endpoint - Evidence: `config/traefik/dynamic/matrix-element-restore.yml line 10 sets `Access-Control-Allow-Origin: *` for the well-known middleware. The route is currently protected by `ts-allowlist@file`, but if that middleware is ever removed or misconfigured,` - Next: Add a comment in the YAML noting that the wildcard origin is safe only because the route is behind the Tailscale allowlist, and that removing the allowlist would require restricting the origin. ### `redteam` / `kimi-k2.7:cloud` - Status: `error` - Verdict: `-` - Note: Ollama HTTP 404: {"error": "model 'kimi-k2.7:cloud' not found"} - Findings: none </details> ## Policy notes - Patchwarden PR sanity is the first merge-lane signal for this PR. - Models produce findings; Patchwarden/policy produces decisions. - Model findings alone do not fail the status check; they require human or agent disposition. - Formal approval is separate from this comment and requires clean reviewer health. - Automerge remains delegated to branch protection and the automerge pilot.

Iskra commented

2026-06-24 03:01:08 +02:00

Collaborator

Iskra judgment

Field	Value
Target	`pdurlej/platform#pull_request#822`
Priority	p1
Action	patchwarden_candidate
Scores	reach 4 / impact 4 / confidence 4
Piotr fit	high
Effort	small
Labels	`judge/p1`, `judge/patchwarden-candidate`
Judge	`iskra` via `openclaw`

Rationale: This PR persists a live Matrix mobile-discovery runtime fix touching public well-known routing, CORS, and exposure-sensitive service configuration, so it is important and review-worthy before merge.

Caveat: The packet explicitly says the canary is missing, so merge should wait for the review canary and a quick route/header sanity check.

Structured openclaw.judge.v0 payload

<!-- openclaw.judge.v0 -->
{
  "confidence": 4,
  "effort_hint": "small",
  "escalation": {
    "kind": "patchwarden_review",
    "reason": "Runtime-facing and exposure-sensitive routing changes should get focused verification before merge."
  },
  "evidence_refs": [
    {
      "note": "Public repository metadata, labels, target snapshot, and dry-run packet excerpt only.",
      "type": "snapshot",
      "value": "issue-or-pr-title-body-labels-and-target-snapshot"
    },
    {
      "note": "Packet reports runtime verification for Matrix well-known endpoints but also notes the merge canary is missing.",
      "type": "check",
      "value": "dry-run-packet-verification-and-missing-canary-status"
    }
  ],
  "impact": 4,
  "judge_actor": {
    "name": "iskra",
    "runtime": "openclaw"
  },
  "judged_at": "2026-06-24T01:01:00Z",
  "labels_to_apply": [
    "judge/p1",
    "judge/patchwarden-candidate"
  ],
  "piotr_fit": "high",
  "priority": "p1",
  "rationale_summary": "This PR persists a live Matrix mobile-discovery runtime fix touching public well-known routing, CORS, and exposure-sensitive service configuration, so it is important and review-worthy before merge.",
  "reach": 4,
  "recommended_next_action": "patchwarden_candidate",
  "rerun_reason": "no_prior_judgment",
  "schema": "openclaw.judge.v0",
  "target": {
    "kind": "pull_request",
    "number": 822,
    "repo": "pdurlej/platform"
  },
  "target_snapshot": {
    "body_hash": "sha256:f803a72b556c7f7cb60453b64d7eb2322a3f69c42027df492c686ef04edf8ec9",
    "commit_count": 1,
    "evidence_hash": "sha256:d1be1b8917765079ce1845ef3aa8c2855ffa4eae9d6a377edc2daa294924254b",
    "head_sha": "985bb46b936c1dfaba59998f3a85c27981e75a02",
    "labels": [
      "class/security-sensitive",
      "risk/exposure",
      "risk/runtime",
      "tier/full"
    ],
    "labels_hash": "sha256:ccb97b636e01f144d54399b7906f6527bee71dc38e2cffe2cf448e69a4b165ea",
    "state": "open",
    "title_hash": "sha256:305f509bf006d25f3ebe2340ab0b578f5a846df53de1ec92ae6130917a660ba8",
    "updated_at": "2026-06-23T08:20:19+02:00"
  },
  "top_caveat": "The packet explicitly says the canary is missing, so merge should wait for the review canary and a quick route/header sanity check."
}
<!-- /openclaw.judge.v0 -->

### Iskra judgment | Field | Value | | --- | --- | | Target | `pdurlej/platform#pull_request#822` | | Priority | p1 | | Action | patchwarden_candidate | | Scores | reach 4 / impact 4 / confidence 4 | | Piotr fit | high | | Effort | small | | Labels | `judge/p1`, `judge/patchwarden-candidate` | | Judge | `iskra` via `openclaw` | **Rationale:** This PR persists a live Matrix mobile-discovery runtime fix touching public well-known routing, CORS, and exposure-sensitive service configuration, so it is important and review-worthy before merge. **Caveat:** The packet explicitly says the canary is missing, so merge should wait for the review canary and a quick route/header sanity check. <details> <summary>Structured openclaw.judge.v0 payload</summary> ```json  { "confidence": 4, "effort_hint": "small", "escalation": { "kind": "patchwarden_review", "reason": "Runtime-facing and exposure-sensitive routing changes should get focused verification before merge." }, "evidence_refs": [ { "note": "Public repository metadata, labels, target snapshot, and dry-run packet excerpt only.", "type": "snapshot", "value": "issue-or-pr-title-body-labels-and-target-snapshot" }, { "note": "Packet reports runtime verification for Matrix well-known endpoints but also notes the merge canary is missing.", "type": "check", "value": "dry-run-packet-verification-and-missing-canary-status" } ], "impact": 4, "judge_actor": { "name": "iskra", "runtime": "openclaw" }, "judged_at": "2026-06-24T01:01:00Z", "labels_to_apply": [ "judge/p1", "judge/patchwarden-candidate" ], "piotr_fit": "high", "priority": "p1", "rationale_summary": "This PR persists a live Matrix mobile-discovery runtime fix touching public well-known routing, CORS, and exposure-sensitive service configuration, so it is important and review-worthy before merge.", "reach": 4, "recommended_next_action": "patchwarden_candidate", "rerun_reason": "no_prior_judgment", "schema": "openclaw.judge.v0", "target": { "kind": "pull_request", "number": 822, "repo": "pdurlej/platform" }, "target_snapshot": { "body_hash": "sha256:f803a72b556c7f7cb60453b64d7eb2322a3f69c42027df492c686ef04edf8ec9", "commit_count": 1, "evidence_hash": "sha256:d1be1b8917765079ce1845ef3aa8c2855ffa4eae9d6a377edc2daa294924254b", "head_sha": "985bb46b936c1dfaba59998f3a85c27981e75a02", "labels": [ "class/security-sensitive", "risk/exposure", "risk/runtime", "tier/full" ], "labels_hash": "sha256:ccb97b636e01f144d54399b7906f6527bee71dc38e2cffe2cf448e69a4b165ea", "state": "open", "title_hash": "sha256:305f509bf006d25f3ebe2340ab0b578f5a846df53de1ec92ae6130917a660ba8", "updated_at": "2026-06-23T08:20:19+02:00" }, "top_caveat": "The packet explicitly says the canary is missing, so merge should wait for the review canary and a quick route/header sanity check." }  ``` </details>

Iskra added the

judge/p1

judge/patchwarden-candidate

labels

2026-06-24 03:01:08 +02:00

Iskra referenced this pull request from pdurlej/judging-claw

2026-06-24 03:01:09 +02:00

[Judging Claw] patchwarden_candidate for pdurlej/platform#822 (p1) #137

Iskra commented

2026-06-25 03:00:56 +02:00

Collaborator

Iskra judgment

Field	Value
Target	`pdurlej/platform#pull_request#822`
Priority	p1
Action	patchwarden_candidate
Scores	reach 4 / impact 4 / confidence 4
Piotr fit	high
Effort	small
Labels	`judge/p1`, `judge/patchwarden-candidate`
Judge	`iskra` via `openclaw`

Rationale: This PR preserves a live Matrix discovery runtime fix with security-sensitive routing exposure, so it remains high-priority and needs focused Patchwarden review before merge.

Caveat: The packet still reports the canary as missing, so merge should wait for the review canary and route/header sanity check.

Structured openclaw.judge.v0 payload

<!-- openclaw.judge.v0 -->
{
  "confidence": 4,
  "effort_hint": "small",
  "escalation": {
    "kind": "patchwarden_review",
    "reason": "Security-sensitive runtime routing change should keep Patchwarden review before merge."
  },
  "evidence_refs": [
    {
      "note": "Public repository metadata, prior judgment summary, and dry-run packet only.",
      "type": "snapshot",
      "value": "pr-title-body-labels-target-snapshot-and-prior-judgment-summary"
    }
  ],
  "impact": 4,
  "judge_actor": {
    "name": "iskra",
    "runtime": "openclaw"
  },
  "judged_at": "2026-06-25T00:00:00Z",
  "labels_to_apply": [
    "judge/p1",
    "judge/patchwarden-candidate"
  ],
  "piotr_fit": "high",
  "priority": "p1",
  "rationale_summary": "This PR preserves a live Matrix discovery runtime fix with security-sensitive routing exposure, so it remains high-priority and needs focused Patchwarden review before merge.",
  "reach": 4,
  "recommended_next_action": "patchwarden_candidate",
  "rerun_reason": "target_changed",
  "schema": "openclaw.judge.v0",
  "target": {
    "kind": "pull_request",
    "number": 822,
    "repo": "pdurlej/platform"
  },
  "target_snapshot": {
    "body_hash": "sha256:f803a72b556c7f7cb60453b64d7eb2322a3f69c42027df492c686ef04edf8ec9",
    "commit_count": 1,
    "evidence_hash": "sha256:8cf667d5e0eee62d05970a46a59e108a8ed6f8e8f5e7441ecbd96fcdfd44de7c",
    "head_sha": "985bb46b936c1dfaba59998f3a85c27981e75a02",
    "labels": [
      "class/security-sensitive",
      "judge/p1",
      "judge/patchwarden-candidate",
      "risk/exposure",
      "risk/runtime",
      "tier/full"
    ],
    "labels_hash": "sha256:eb51aebb19fe313e5b3542ec9db84cc2625340321d026805190f06b8c7ce301c",
    "state": "open",
    "title_hash": "sha256:305f509bf006d25f3ebe2340ab0b578f5a846df53de1ec92ae6130917a660ba8",
    "updated_at": "2026-06-24T03:01:09+02:00"
  },
  "top_caveat": "The packet still reports the canary as missing, so merge should wait for the review canary and route/header sanity check."
}
<!-- /openclaw.judge.v0 -->

### Iskra judgment | Field | Value | | --- | --- | | Target | `pdurlej/platform#pull_request#822` | | Priority | p1 | | Action | patchwarden_candidate | | Scores | reach 4 / impact 4 / confidence 4 | | Piotr fit | high | | Effort | small | | Labels | `judge/p1`, `judge/patchwarden-candidate` | | Judge | `iskra` via `openclaw` | **Rationale:** This PR preserves a live Matrix discovery runtime fix with security-sensitive routing exposure, so it remains high-priority and needs focused Patchwarden review before merge. **Caveat:** The packet still reports the canary as missing, so merge should wait for the review canary and route/header sanity check. <details> <summary>Structured openclaw.judge.v0 payload</summary> ```json  { "confidence": 4, "effort_hint": "small", "escalation": { "kind": "patchwarden_review", "reason": "Security-sensitive runtime routing change should keep Patchwarden review before merge." }, "evidence_refs": [ { "note": "Public repository metadata, prior judgment summary, and dry-run packet only.", "type": "snapshot", "value": "pr-title-body-labels-target-snapshot-and-prior-judgment-summary" } ], "impact": 4, "judge_actor": { "name": "iskra", "runtime": "openclaw" }, "judged_at": "2026-06-25T00:00:00Z", "labels_to_apply": [ "judge/p1", "judge/patchwarden-candidate" ], "piotr_fit": "high", "priority": "p1", "rationale_summary": "This PR preserves a live Matrix discovery runtime fix with security-sensitive routing exposure, so it remains high-priority and needs focused Patchwarden review before merge.", "reach": 4, "recommended_next_action": "patchwarden_candidate", "rerun_reason": "target_changed", "schema": "openclaw.judge.v0", "target": { "kind": "pull_request", "number": 822, "repo": "pdurlej/platform" }, "target_snapshot": { "body_hash": "sha256:f803a72b556c7f7cb60453b64d7eb2322a3f69c42027df492c686ef04edf8ec9", "commit_count": 1, "evidence_hash": "sha256:8cf667d5e0eee62d05970a46a59e108a8ed6f8e8f5e7441ecbd96fcdfd44de7c", "head_sha": "985bb46b936c1dfaba59998f3a85c27981e75a02", "labels": [ "class/security-sensitive", "judge/p1", "judge/patchwarden-candidate", "risk/exposure", "risk/runtime", "tier/full" ], "labels_hash": "sha256:eb51aebb19fe313e5b3542ec9db84cc2625340321d026805190f06b8c7ce301c", "state": "open", "title_hash": "sha256:305f509bf006d25f3ebe2340ab0b578f5a846df53de1ec92ae6130917a660ba8", "updated_at": "2026-06-24T03:01:09+02:00" }, "top_caveat": "The packet still reports the canary as missing, so merge should wait for the review canary and route/header sanity check." }  ``` </details>

Iskra referenced this pull request from pdurlej/judging-claw

2026-06-25 03:00:57 +02:00

[Judging Claw] patchwarden_candidate for pdurlej/platform#822 (p1) #142

codex referenced this pull request

2026-06-25 12:36:28 +02:00

goal(patchwarden): enable unattended merge-safety loop for eligible Platform PRs #823

codex added the

owner-attention

status:operator-needed

labels

2026-06-26 01:00:18 +02:00

codex commented

2026-06-26 09:34:05 +02:00

Author

Collaborator

Role: executor
Intent: checkpoint
Needs owner: yes

Read-only Matrix discovery smoke after live operator option B approval:

https://pdurlej.com/.well-known/matrix/client -> 200, Content-Type: application/json, Access-Control-Allow-Origin: *
https://matrix.pdurlej.com/.well-known/matrix/client -> 200, Content-Type: application/json, Access-Control-Allow-Origin: *
https://element.pdurlej.com/.well-known/matrix/client -> 200, Content-Type: application/json, Access-Control-Allow-Origin: *
https://matrix.pdurlej.com/_matrix/client/versions -> 200, Content-Type: application/json

I attempted the approved merge as codex, but Forgejo returned 405 User not allowed to merge PR. PR #822 remains green/mergeable and ready for a merge-capable actor.

Note: https://element.pdurlej.com/health returns 404; that is outside this Matrix discovery fix and should be tracked separately if we want manifest health parity.

Next: merge-capable actor can merge #822, or we repair the W6d merge actor/token lane first.

**Role:** executor **Intent:** checkpoint **Needs owner:** yes Read-only Matrix discovery smoke after live operator option B approval: - `https://pdurlej.com/.well-known/matrix/client` -> `200`, `Content-Type: application/json`, `Access-Control-Allow-Origin: *` - `https://matrix.pdurlej.com/.well-known/matrix/client` -> `200`, `Content-Type: application/json`, `Access-Control-Allow-Origin: *` - `https://element.pdurlej.com/.well-known/matrix/client` -> `200`, `Content-Type: application/json`, `Access-Control-Allow-Origin: *` - `https://matrix.pdurlej.com/_matrix/client/versions` -> `200`, `Content-Type: application/json` I attempted the approved merge as `codex`, but Forgejo returned `405 User not allowed to merge PR`. PR #822 remains green/mergeable and ready for a merge-capable actor. Note: `https://element.pdurlej.com/health` returns `404`; that is outside this Matrix discovery fix and should be tracked separately if we want manifest health parity. **Next:** merge-capable actor can merge #822, or we repair the W6d merge actor/token lane first.

codex added 1 commit

2026-06-26 10:45:55 +02:00

Merge remote-tracking branch 'origin/main' into codex/matrix-discovery-hotfix

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 17s

Details

canary-required / canary (pull_request) Successful in 16s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 16s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 1m3s

Details

6efc251b57

Iskra approved these changes

2026-06-26 11:03:59 +02:00

Iskra left a comment

Operator live approval present for #822: read-only Matrix smoke passed, branch is current, and all latest CI/Patchwarden contexts are green. Approval recorded by Iskra as merge actor.