$ the-wire ยท showcase
Unified secret redaction and SSRF policy ownership, plus queue fixes to stop the DLQ bleed
By RepoJournal ยท Filed ยท About OpenClaw
![openclaw-docs-sync[bot]](https://avatars.githubusercontent.com/u/13697529?v=4)
OpenClaw unified secret-redaction and SSRF policy ownership to close a stale-redaction gap, while Clawsweeper throttled exact-review admission and deduped duplicate receipts to stop dead-lettering finished reviews at 20-30 per hour.
OpenClaw consolidated secret-redaction ownership under a single canonical redactor. Memory-host errors, including payment, card, and CVV coverage, now redact through the existing core facade instead of the stale local pattern table, while ACP error redaction flows through one barrel so the injected redactor no longer depends on module load order. This removes a class of security holes where sensitive data could leak through a stale fallback table [1]. Separately, the channel-turn dispatch naming layers were flattened, preserving dispatch contracts but removing export collisions; plugin SDK consumers should see no breaking change, though stale docs now point to the turn-defining modules [2]. Assistant avatars no longer render in chat transcripts unless explicitly set [3].
Clawsweeper's exact-review publication lane has been dead-lettering finished Codex reviews at roughly 20-30 per hour, with the dead-letter queue growing monotonically (retry_exhausted 719 -> 724 over 21 minutes) [4]. The fix keeps throttled batches on the transient retry budget, so they no longer exhaust and land in the DLQ. Additionally, scheduled exact-review admission dropped from 450/hour with a 120-item burst to 300/hour with a 30-item burst, reserving GitHub App quota for ingress, routing, apply, publication, and support lanes; typed throttle completions now pause scheduled and background admission without blocking interactive exact-event admission [5]. To cut the per-item API calls, apply now batches all label mutations into one `gh issue edit` per event and caches the repository label catalog [6]. Ingress deduplicates PR receipts across `opened` and `ready_for_review`, fixing the double-๐ฆ๐ comments first reported in openclaw/openclaw#120966 [7]. As containment, hot target-fanout cadence is temporarily reduced from every 5 minutes to every 20 minutes, while other intake cadences remain unchanged [8].
The hot target-fanout reduction is a temporary containment measure; core hot intake, normal fanout, and audit schedules are untouched [8].
Action items
- โ Monitor the exact-review DLQ for a return to the 20-30/hr dead-letter rate; verify the fix holds before the next deploy window. openclaw/clawsweeper [immediate]
- โ Deploy the unified redactor change early to close the stale-pattern SSRF/secret leak path in production. openclaw/openclaw [immediate]
- โ Review any code importing channel-turn dispatch names that were flattened for export collisions. openclaw/openclaw [plan]
References
- [1] fix(security): unify secret-redaction and SSRF policy ownership (#121335) โ openclaw/openclaw
- [2] refactor(channels): flatten channel-turn dispatch naming layers (#121308) โ openclaw/openclaw
- [3] fix(ui): remove assistant avatars from chat transcripts (#121405) โ openclaw/openclaw
- [4] fix(publication): keep throttled batch publications on the transient retry budget โ openclaw/clawsweeper
- [5] fix(queue): preserve GitHub quota headroom โ openclaw/clawsweeper
- [6] fix(apply): batch exact publication labels โ openclaw/clawsweeper
- [7] fix(webhook): dedupe pull request receipts across opened and ready_for_review โ openclaw/clawsweeper
- [8] fix(review): reduce hot target fanout cadence โ openclaw/clawsweeper
