feat: add publisher feed model API

[giodl73-repo]

Summary

• expose publisher-only detail and feed routes; ClawHub publishers represent both people and organizations, so there is no parallel accounts API
• reuse the canonical public-publisher visibility resolver and preserve legacy ownerUserId ownership during migration
• publish coherent bounded publisher snapshots with monotonic stored revisions
• page immutable snapshots through opaque publisher/sequence/offset cursors and reject stale or malformed cursors
• fail explicitly with 503 no-store when the bounded snapshot cannot prove completeness instead of silently truncating
• keep publisher entries discovery-only with no install, trust, approval, official, or scan authority

API

• GET /api/v1/publishers/{publisherId}
• GET /api/v1/publishers/{publisherId}/feed?limit=<1..100>&cursor=

All pages for one cursor chain carry the same feedId, sequence, and generatedAt. Publisher feed responses are private, no-store so shared caches cannot bypass stale-cursor checks.

Review fixes

Addresses Patrick's exact-head review:

• canonical linked/legacy-user visibility is shared with existing public publisher surfaces
• legacy ownerUserId-only skills and packages are merged and deduplicated
• request-time sequence 0 and silent bounded-scan completion are replaced by persisted coherent revisions and explicit capacity failure
• equal-timestamp ordering is resolved before publication, not across a lossy source-page boundary
• origin-relative URLs reject protocol-relative forms, backslashes, and control characters
• summaries are Unicode-safe bounded and snapshot content keys store only SHA-256 digests
• hard publisher deletion removes the stored feed publication

Validation

• focused schema, projection, HTTP, and OpenAPI tests: 22 passed
• targeted type-aware oxlint
• schema package build
• git diff --check
• full TypeScript check reaches only the existing missing yauzl typings in scripts/staging-seed/snapshotIo.ts
• final Codex review: no discrete correctness issue identified

Contract dependency

The matching publisher-only and pagination contract is being updated in openclaw/rfcs#39.

Real behavior proof

Behavior or issue addressed:
The public publisher detail endpoint, bounded publisher-feed pagination, revision refresh, and stale-cursor rejection work against a real Convex runtime. The proof run also exposed and fixed a Convex-only failure caused by multiple paginated queries in one mutation.

Real environment tested:
WSL2 Ubuntu 24.04, exact PR head 2172b6badd2b433e8c305de870a2af47b823be28, disposable anonymous local Convex deployment, and repository dev fixtures. HTTP actions were exercised over loopback; no shared, staging, or production deployment was targeted.

Exact steps or command run after this patch:

1. bunx convex dev --once --typecheck=disable --codegen disable
2. bunx convex run --no-push devSeed:seedLocalFixtures '{"reset":false}'
3. Request publisher detail, then request the first feed page with limit=1 and its opaque continuation cursor.
4. Publish an additional local fixture, refresh the first page, and replay the old cursor.

Evidence after fix:

DETAIL HTTP/1.1 200 OK
publisher={kind:user, handle:local, displayName:"Local Dev"}
feedUrl=/api/v1/publishers/[redacted-local-id]/feed

FIRST_PAGE HTTP/1.1 200 OK
schemaVersion=1 sequence=1 entryCount=1 entryKinds=[plugin] nextCursorPresent=true

CONTINUATION HTTP/1.1 200 OK
sameFeedId=true sameSequence=true sameGeneratedAt=true entryCount=1 nextCursorPresent=true

CONTENT_CHANGE seedPadelSkill=ok
REFRESHED HTTP/1.1 200 OK
oldSequence=1 newSequence=2 sequenceAdvanced=true entryCount=1

STALE_CURSOR HTTP/1.1 409 Conflict
cache-control: no-store
Publisher feed cursor is stale; restart from the first page

Observed result after fix:
Publisher detail and both feed pages returned 200. The continuation preserved feed identity, sequence, and generation time. A real content change advanced the stored revision from 1 to 2, and replaying the previous cursor returned 409 with Cache-Control: no-store.

What was not tested:
No public preview, staging, or production deployment and no production data. This proof covers the anonymous public HTTP contract on the exact branch code in a disposable real Convex runtime.

[vercel]

@giodl73-repo is attempting to deploy a commit to the OpenClaw Foundation Team on Vercel.

A member of the Team first needs to authorize it.

[clawsweeper]

Codex review: found issues before merge. Reviewed August 6, 2026, 9:42 PM ET / August 7, 2026, 01:42 UTC.

ClawSweeper review

What this changes

This PR adds public publisher-detail and cursor-paginated discovery-feed endpoints backed by persisted Convex publisher snapshots.

Merge readiness

⛔ Blocked by patch quality or review findings - 12 items remain

Keep open: current main does not provide this publisher-feed API, but the exact-head review still has two P1 correctness/security blockers, an index-rollout blocker, and an unresolved decision on making an unsigned public discovery API a supported contract.

Priority: P2
Reviewed head: 2172b6badd2b433e8c305de870a2af47b823be28
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The real runtime proof is strong for pagination behavior, but the remaining visibility, size-boundary, and rollout blockers make the patch not ready to merge.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (terminal): The PR body provides exact-head terminal output from a disposable real Convex runtime showing detail, continuation, revision refresh, and stale-cursor rejection after the fix.
Patch quality	🦪 silver shellfish (2/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The PR body provides exact-head terminal output from a disposable real Convex runtime showing detail, continuation, revision refresh, and stale-cursor rejection after the fix.
Evidence reviewed	7 items	Current main lacks the proposed route: Current main has no publisher-feed handler, publication table, schema constant, or documented publisher-feed route; its hosted-feed specification only describes catalog plugin, skill, and promotion feeds. Canonical public package predicate: Main's public-plugin predicate excludes soft-deleted packages, non-plugin families, private channels, and scan-blocked entries. The supplied exact-head PR diff imports only the narrower scan-block predicate in its new feed projection. Stored snapshot fields are unbounded: The source schema permits arbitrary strings for package name, display name, and summary; the proposed 400-entry publication needs a UTF-8 byte budget before a Convex document write, not only an entry count.
Findings	3 actionable findings	[P1] Use canonical public package visibility [P1] Reject oversized snapshots before persistence [P2] Stage legacy owner indexes before serving feeds
Security	Needs attention	Package visibility boundary is bypassed: The supplied feed code imports only the scan-block predicate, whereas main's canonical public package predicate also rejects private channels and non-plugin families.

How this fits together

Publisher records own public identities for people and organizations. The proposed API projects their visible skills and plugins into a stored revision, then serves stable pages to anonymous discovery clients.

flowchart LR
  A[Publisher records] --> B[Public visibility checks]
  C[Skills and packages] --> B
  B --> D[Publisher snapshot builder]
  D --> E[Stored feed revision]
  E --> F[HTTP pagination route]
  F --> G[Anonymous discovery clients]

Loading

Decision needed

Question	Recommendation
Should ClawHub support this unsigned publisher discovery feed as a public API before the matching RFC is adopted?	Sponsor and stage the contract: Approve the unsigned discovery contract, then require the visibility, capacity, and staged-index rollout repairs before merge.

Why: The patch adds a durable anonymous API contract; code review cannot choose whether that product boundary should be supported now.

Before merge

• Use canonical public package visibility (P1) - isPackageBlockedFromPublic only rejects blocked scan states. Main's isPublicPluginDoc also rejects private channels and non-plugin families, so this public feed can emit private or unsupported package metadata as plugin entries. Use that canonical predicate and add private-channel and claw-family coverage.
• Reject oversized snapshots before persistence (P1) - The 400-entry limit is not a byte limit, while the projected package strings are unbounded. A valid projection can exceed Convex's document limit when stored, causing the refresh request to fail rather than return the documented explicit capacity response. Measure the final UTF-8 payload before writing and reject it deterministically.
• Stage legacy owner indexes before serving feeds (P2) - The new legacy-owner active-updated package index is added directly to a populated table and then relied upon by this route. Convex index backfill can block deployment; deploy it staged first, wait for backfill, then activate the query in a follow-up rollout.
• Resolve security concern: Package visibility boundary is bypassed - The supplied feed code imports only the scan-block predicate, whereas main's canonical public package predicate also rejects private channels and non-plugin families.
• Resolve merge risk (P1) - Without the canonical predicate, a public discovery feed can expose private-channel or unsupported-family package metadata.
• Resolve merge risk (P1) - A 400-entry persisted snapshot can exceed Convex's document limit and turn refreshes into server failures instead of the promised explicit capacity response.
• Resolve merge risk (P1) - The unsigned public API would establish a durable external contract while its matching RFC remains open.
• Complete next step (P2) - A maintainer must decide whether this unsigned discovery endpoint should be a supported public contract and approve the staged Convex rollout before a repair branch is appropriate.
• Improve patch quality - Use the canonical public package predicate and add private-channel and claw-family regressions.
• Improve patch quality - Add a final UTF-8 snapshot-size guard with a capacity-failure test.
• Improve patch quality - Split the legacy-owner index into a staged prerequisite rollout after contract sponsorship.

Findings

• [P1] Use canonical public package visibility — convex/accountFeeds.ts:12
• [P1] Reject oversized snapshots before persistence — convex/accountFeeds.ts:15
• [P2] Stage legacy owner indexes before serving feeds — convex/schema.ts:1689
• [high] Package visibility boundary is bypassed — convex/accountFeeds.ts:12

Agent review details

Security

Needs attention: The new anonymous discovery route can disclose package metadata that the canonical public-visibility boundary excludes.

Review metrics

Metric	Value	Why it matters
Patch size	+2,064 / -111 across 24 files	The feature spans public HTTP routing, Convex storage, schema exports, OpenAPI, specifications, and tests.
Production versus tests	non-test +1,353, tests +711	The substantial new storage and API surface needs the rollout and visibility invariants resolved before the existing focused tests are enough.

Merge-risk options

Maintainer options:

1. Repair and stage the rollout (recommended)
   Reuse canonical public package visibility, reject oversized serialized snapshots before persistence, and deploy legacy-owner indexes in a staged prerequisite before activating the route.
2. Pause the public contract
   Hold the branch until a maintainer confirms whether unsigned publisher discovery is a supported API and the RFC direction is settled.

Technical review

Best possible solution:

Land the API only after maintainer sponsorship of its public contract, then split the index preparation from endpoint activation and enforce canonical visibility plus a final UTF-8 snapshot-size limit.

Do we have a high-confidence way to reproduce the issue?

Yes for the review blockers: the supplied exact-head diff plus current-main predicates show how a private-channel or non-plugin package bypasses the feed filter, and how an oversized 400-entry snapshot reaches persistence without a byte guard.

Is this the best way to solve the issue?

No. The proposed endpoint is plausible, but it must first use the existing public visibility predicate, enforce the document-size boundary, and follow a staged index rollout after a maintainer chooses the API contract.

Full review comments:

• [P1] Use canonical public package visibility — convex/accountFeeds.ts:12
isPackageBlockedFromPublic only rejects blocked scan states. Main's isPublicPluginDoc also rejects private channels and non-plugin families, so this public feed can emit private or unsupported package metadata as plugin entries. Use that canonical predicate and add private-channel and claw-family coverage.
  Confidence: 0.96
• [P1] Reject oversized snapshots before persistence — convex/accountFeeds.ts:15
  The 400-entry limit is not a byte limit, while the projected package strings are unbounded. A valid projection can exceed Convex's document limit when stored, causing the refresh request to fail rather than return the documented explicit capacity response. Measure the final UTF-8 payload before writing and reject it deterministically.
  Confidence: 0.93
• [P2] Stage legacy owner indexes before serving feeds — convex/schema.ts:1689
  The new legacy-owner active-updated package index is added directly to a populated table and then relied upon by this route. Convex index backfill can block deployment; deploy it staged first, wait for backfill, then activate the query in a follow-up rollout.
  Confidence: 0.94

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 64db9c3fae66.

Labels

Label changes:

• add merge-risk: 🚨 security-boundary: The supplied feed projection uses a narrower scan predicate than main's public-visibility predicate, risking disclosure of private or unsupported package metadata.
• remove merge-risk: 🚨 compatibility: Current PR review merge-risk labels are merge-risk: 🚨 security-boundary, merge-risk: 🚨 availability.

Label justifications:

• P2: This is a substantial new discovery API with concrete merge blockers, but it is not an active outage or data-loss incident.
• merge-risk: 🚨 security-boundary: The supplied feed projection uses a narrower scan predicate than main's public-visibility predicate, risking disclosure of private or unsupported package metadata.
• merge-risk: 🚨 availability: Unbounded snapshot serialization and non-staged indexes can respectively fail feed refreshes and block the Convex deployment.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦞 diamond lobster and patch quality is 🦪 silver shellfish.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (terminal): The PR body provides exact-head terminal output from a disposable real Convex runtime showing detail, continuation, revision refresh, and stale-cursor rejection after the fix.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides exact-head terminal output from a disposable real Convex runtime showing detail, continuation, revision refresh, and stale-cursor rejection after the fix.

Evidence

Security concerns:

• [high] Package visibility boundary is bypassed — convex/accountFeeds.ts:12
  The supplied feed code imports only the scan-block predicate, whereas main's canonical public package predicate also rejects private channels and non-plugin families.
  Confidence: 0.96

What I checked:

• Current main lacks the proposed route: Current main has no publisher-feed handler, publication table, schema constant, or documented publisher-feed route; its hosted-feed specification only describes catalog plugin, skill, and promotion feeds. (specs/hosted-catalog-feed.md:1, 64db9c3fae66)
• Canonical public package predicate: Main's public-plugin predicate excludes soft-deleted packages, non-plugin families, private channels, and scan-blocked entries. The supplied exact-head PR diff imports only the narrower scan-block predicate in its new feed projection. (convex/lib/globalStats.ts:40, 64db9c3fae66)
• Stored snapshot fields are unbounded: The source schema permits arbitrary strings for package name, display name, and summary; the proposed 400-entry publication needs a UTF-8 byte budget before a Convex document write, not only an entry count. (convex/schema.ts:1687, 64db9c3fae66)
• Existing-table index rollout: The supplied PR schema diff adds the package legacy-owner active-updated index without staging, while the applicable Convex guidance says new indexes on large existing tables block deploy until backfill completes. (convex/schema.ts:1689, 2172b6badd2b)
• Area history: Publisher ownership and visibility behavior on current main is attributed to Patrick Erichsen in the available history; Gio Della-Libera also authored the merged hosted-feed foundation commit. (convex/lib/publishers.ts:244, 87ca030c30f3)
• Release and current-main provenance: The latest release v0.23.3 contains 87ca030, while current main is 64db9c3 and has no publisher-feed implementation; this feature is neither shipped nor present only on main. (64db9c3fae66)

Likely related people:

• Patrick-Erichsen: Current publisher ownership/visibility code is attributed to Patrick, and his review established the related visibility and migration invariants. (role: recent publisher-visibility contributor and reviewer; confidence: high; commits: 87ca030c30f3; files: convex/lib/publishers.ts, convex/schema.ts, convex/lib/globalStats.ts)
• giodl73-repo: Gio authored the PR and has a merged hosted-feed foundation commit in the same discovery/publication area. (role: adjacent hosted-feed contributor; confidence: medium; commits: 5a3b050751f7; files: convex/catalogFeed.ts, specs/hosted-catalog-feed.md)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (38 earlier review cycles; latest 8 shown)

• reviewed 2026-08-06T09:23:36.705Z sha 2172b6b :: found issues before merge. :: [P1] Reuse canonical public-plugin visibility | [P1] Reject oversized snapshots before persistence | [P2] Stage the legacy package-owner index
• reviewed 2026-08-06T11:03:54.855Z sha 2172b6b :: found issues before merge. :: [P1] Reuse canonical public-plugin visibility | [P1] Reject oversized snapshots before writing them | [P2] Stage the legacy package-owner index rollout
• reviewed 2026-08-06T12:08:01.828Z sha 2172b6b :: found issues before merge. :: [P1] Filter feed packages through canonical public visibility | [P1] Reject oversized snapshots before persistence | [P2] Stage the legacy package-owner index rollout
• reviewed 2026-08-06T13:11:56.394Z sha 2172b6b :: found issues before merge. :: [P1] Use canonical public-plugin visibility | [P1] Reject oversized publications before persistence | [P2] Stage the legacy package-owner index rollout
• reviewed 2026-08-06T14:45:32.256Z sha 2172b6b :: found issues before merge. :: [P1] Filter feed packages through canonical public visibility | [P1] Reject byte-oversized snapshots before persistence | [P2] Stage the legacy package-owner index rollout
• reviewed 2026-08-06T23:37:32.744Z sha 2172b6b :: found issues before merge. :: [P1] Use canonical public-plugin visibility | [P1] Reject byte-oversized snapshots before persistence | [P2] Stage the legacy owner-index rollout
• reviewed 2026-08-06T23:44:47.099Z sha 2172b6b :: found issues before merge. :: [P1] Use canonical public-plugin visibility | [P1] Reject oversized snapshots before persistence | [P2] Stage the legacy package-owner index rollout
• reviewed 2026-08-07T00:55:57.203Z sha 2172b6b :: found issues before merge. :: [P1] Use canonical public-plugin visibility | [P1] Reject byte-oversized snapshots before persistence | [P2] Stage the legacy package-owner index rollout

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[giodl73-repo]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[Patrick-Erichsen]

This adds public account/publisher identity endpoints plus bounded discovery feeds for public skills and plugins. The discovery-only authority boundary is sound: entries contain no install candidate, integrity, official, approval, or trust fields, and downstream installation still has to resolve through the catalog path.

LOC: +1882/-77 (22 files)

The inline findings block this exact head. The most important issue is that the new endpoints bypass ClawHub's established public-publisher visibility rule, so a personal publisher linked to an inactive account can become discoverable here even though existing profile/catalog surfaces hide it.

Best-fix verdict: too narrow. The API should reuse one shared public identity/ownership resolver, preserve legacy ownership during the migration window, and either implement durable revision/pagination semantics or keep this projection experimental until the v1 contract is real.

Alternatives considered: relying on account-deletion cascades or the targeted ownership repair was rejected because current code deliberately keeps defensive visibility checks and optional legacy fields. Shipping sequence 0 / nextCursor: null as stable v1 was rejected because RFC 0009 PR #39 already requires monotonic logical revisions and opaque deterministic continuation.

Code read: convex/accountFeeds.ts, convex/httpApiV1/accountFeedsV1.ts, convex/lib/public.ts, convex/lib/publishers.ts, convex/publishers.ts, convex/maintenance.ts, convex/catalogFeed.ts, package/skill public-read helpers, schema/OpenAPI/tests, specs/account-feeds.md, specs/orgs.md, and RFC 0009 account-feed addendum at PR #39 head.

Validation: the focused 23 tests pass locally. Exact-head static, unit, types-build, packages, e2e-http, CodeQL, and Playwright smoke checks pass. The head is not fully green: secret scanning failed because the runner could not pull the TruffleHog image, moderation-star timed out amid Convex query timeouts, and Vercel requires contributor authorization. No live Convex/HTTP behavior proof was attached.

Contract dependency: RFC PR #39 is still open, so the public v1 release should be coordinated with that contract rather than claiming conformance to an unmerged rewrite.

Remaining uncertainty: I did not deploy this branch to a live Convex instance; runtime evidence is limited to exact-head CI plus focused local tests and source-level repros.

[github-actions]

This pull request has been automatically marked as stale due to inactivity.
Please update it or it will be closed.