docs(transcript): scope previews and publication explicitly

[steipete]

Summary

Make the transcript skill explicit-request-only and require task scoping before any preview or publication. A transcript-generation or preview request, and ordinary PR editing permission, do not authorize publishing the transcript. Existing authorization specifically covering transcript publication remains sufficient.

The helper's preview/append modes rerender the session, so the instructions now prevent them from silently replacing an inspected trimmed artifact. Helper code is unchanged.

Validation

Frontmatter and whitespace checks passed. The actual helper modes were inspected, the helper is byte-unchanged, and the same publication contract is synchronized into the OpenClaw consumer. Independent Codex review passed with no actionable P0–P2 findings. The repository commit hook validated 55 skills; exact-head CI is checked before landing.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 5, 2026, 3:59 PM ET / 19:59 UTC.

ClawSweeper review

What this changes

The PR simplifies the agent-transcript skill, separates preview permission from publication authorization, warns against rerendering approved content, and adds a changelog entry.

Merge readiness

✅ Ready for maintainer review

The instructions accurately address the helper’s rerendering behavior, and no actionable patch defect was found. The clarification remains useful relative to the fetched main branch; owner-authored work and this repository’s conservative cleanup profile also preclude automatic closure.

Priority: P3
Reviewed head: 879c5f1315d2a043bd45c4445ed750241594e9fd

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, source-consistent clarification with no actionable correctness or security finding.
Proof confidence	🌊 off-meta tidepool	Not applicable: This owner-authored instruction change is exempt from ordinary contributor runtime proof; source inspection confirms the unchanged helper’s rerendering paths, and no unresolved authority violation requires additional final-effect proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This owner-authored instruction change is exempt from ordinary contributor runtime proof; source inspection confirms the unchanged helper’s rerendering paths, and no unresolved authority violation requires additional final-effect proof.
Evidence reviewed	7 items	Repository policy: Read the complete root AGENTS.MD, the repository’s uppercase policy file. Its opt-in transcript, content-and-destination authorization, and normal changelog guidance support this change. No nested policy or maintainer-notes directory was found. Scoped content and publication contract: The revised instructions require trimming before preview, reject unresolved sensitive content, bind publication permission to the inspected transcript and named destination, and preserve existing explicit authorization. Helper behavior supports the warning: The preview and append-body branches call renderSession on the supplied session; html likewise renders selected sessions. None consumes an edited Markdown artifact. The helper performs local rendering and file output, leaving GitHub publication to the surrounding workflow.
Findings	None	None.
Security	None	None.

How this fits together

The agent-transcript skill guides agents from local session logs to sanitized excerpts for GitHub issue and PR bodies. Its instructions control which content is previewed and when that content may be published.

flowchart TD
  A[Explicit transcript request] --> B[Local session discovery]
  B --> C[Render sanitized Markdown]
  C --> D[Trim and inspect content]
  D --> E[Local preview]
  D --> F{Publication authorized?}
  F -->|Yes| G[Insert inspected transcript]
  F -->|No| E

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Keep one explicit workflow that previews scoped content and publishes that same inspected content only under destination-specific authorization.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a runtime bug reproduction: this patch changes instructions, and source inspection confirms the documented rerendering behavior.

Is this the best way to solve the issue?

Yes. Clarifying the artifact and publication boundaries in the existing skill addresses the ambiguity without introducing another helper or changing its supported interface.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against d2790cf56f08.

Labels

Label changes:

• add P3: This is a focused workflow-instruction clarification with no helper, dependency, or persisted-state changes.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This owner-authored instruction change is exempt from ordinary contributor runtime proof; source inspection confirms the unchanged helper’s rerendering paths, and no unresolved authority violation requires additional final-effect proof.

Label justifications:

• P3: This is a focused workflow-instruction clarification with no helper, dependency, or persisted-state changes.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This owner-authored instruction change is exempt from ordinary contributor runtime proof; source inspection confirms the unchanged helper’s rerendering paths, and no unresolved authority violation requires additional final-effect proof.

Evidence

What I checked:

• Repository policy: Read the complete root AGENTS.MD, the repository’s uppercase policy file. Its opt-in transcript, content-and-destination authorization, and normal changelog guidance support this change. No nested policy or maintainer-notes directory was found. (AGENTS.MD, 879c5f1315d2)
• Scoped content and publication contract: The revised instructions require trimming before preview, reject unresolved sensitive content, bind publication permission to the inspected transcript and named destination, and preserve existing explicit authorization. (skills/agent-transcript/SKILL.md:30, 879c5f1315d2)
• Helper behavior supports the warning: The preview and append-body branches call renderSession on the supplied session; html likewise renders selected sessions. None consumes an edited Markdown artifact. The helper performs local rendering and file output, leaving GitHub publication to the surrounding workflow. (skills/agent-transcript/scripts/agent-transcript:601, 879c5f1315d2)
• Current-main comparison: The fetched main version already requires opt-in transcripts and trimming, but still gives direct preview/append instructions without explaining that those modes replace edited content by rerendering. The PR resolves that instructional ambiguity rather than adding a competing implementation. (skills/agent-transcript/SKILL.md:61, d2790cf56f08)
• Bounded change and validation: The verified introduced delta changes only the skill instructions and CHANGELOG.md: 44 additions and 76 deletions. The helper comparison and whitespace check produced no output; supplied GitHub context reports successful smoke and security checks. (879c5f1315d2)
• Feature-history routing: Available main-branch history lists Peter Steinberger on the transcript skill’s initial addition, subsequent maintenance, and opt-in change. Raw metadata confirms the opt-in commit has a recorded parent; missing historical blobs and unavailable network access prevented exact source-line attribution, so no introduction claim is made. (skills/agent-transcript/SKILL.md, 5f066c951ae6)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.