[Chipagosfinest]

Codex usage JSON can attach an ownership-compatible dashboard cache beside fresh OAuth usage even when the cached balances and limits are months old. A QA capture paired current OAuth usage with a 65-day-old dashboard whose weekly reset was already in the past.

Changes:

• Attach the optional cached openaiDashboard only when its updatedAt is within the preceding 15 minutes, allowing timestamps up to 60 seconds ahead for clock skew. Expired caches and those more than 60 seconds ahead are omitted.
• Keep ownership validation and cleanup intact; age alone does not delete the shared cache. Live web dashboard results are unchanged.
• Add fixed-clock age regressions and preserve the synthetic clock in existing ownership/parity tests.
• Docs + CHANGELOG updated.

Validation uses synthetic auth homes and per-test dashboard caches; no real provider probes or Keychain access.

• Docker swift:6.3-noble (Linux ARM64, libsqlite3-dev + Python): all 12 CLIOpenAIDashboardCacheTests pass, including age cases at 0, 60, 900, 901, 5,616,000 (65 days), and -60 seconds. The actual cache test suite and its credential fixture were copied into TestsLinux inside the isolated container.
• Red/green control: without the age guard, exactly the 901-second, 65-day, and future-dated cases fail; recent-cache and existing ownership tests pass. With the guard, the entire focused suite passes. Expired authorized caches remain on disk.
• Full Docker Linux suite passed: 1,228 tests in 164 suites (61.252 seconds test execution), including the cache regression suite.
• make check passed with the installed Python 3.13 on PATH and TOOLCHAIN_DIR=/Library/Developer/CommandLineTools; SwiftFormat and strict SwiftLint passed.
• swift build --product CodexBarCLI passed natively on macOS. App-dependent macOS tests could not build locally because this CLT-only Mac lacks Xcode's actool; macOS CI remains the gate for those suites.
• source ~/.config/council/openrouter.env && council review --base upstream/main: 0 retained findings on the submitted commit. Independent read-only review also found no concrete defects.

Duplicate search refreshed before implementation: no exact match for the optional CLI cache attachment. #4718 / #4707 address serve snapshot refresh behavior.

Earlier shipped CLI behavior and stable-cache upgrade proof (before clock-skew allowance)

Ran the installed stable 0.83.0 CLI and the freshly built CLI at c7062634745db4be16f82e33baff5821361b144b through their real usage --provider codex --source oauth --json entry point, each in a fresh process. A loopback HTTP fixture supplied current OAuth primary/weekly usage (10% / 20%) through the existing chatgpt_base_url config option. This exercises OAuth HTTP fetch → provider mapping → disk-cache ownership and age policy → usage JSON serialization. No attachment helper or prebuilt command-output injection is used.

The home, Codex auth/config, and Application Support cache are synthetic; the process gets a clean environment with Keychain access disabled. No real account or remote provider request is used. These are fixture-driven integration results, not live OpenAI service proof.

The same cache bytes are first read successfully by the installed stable binary, then passed unchanged to the patched binary. SHA-256 comparisons verify that the dashboard cache, CLI settings, Codex config and synthetic auth file remain unchanged after every invocation. This covers upgrade compatibility with a stable-readable existing cache and settings without touching the user's real cache/settings.

Command for both binaries (paths point to the synthetic fixture):

CodexBarCLI usage --provider codex --source oauth --json

Terminal output projected to non-sensitive behavior fields:

{"binary": "stable-0.83.0", "cache": "recent", "exit": 0, "source": "oauth", "usageUpdatedAt": "2026-11-01T06:00:41Z", "dashboardAttached": true, "cacheUnchanged": true, "settingsUnchanged": true, "dashboardUpdatedAt": "2026-11-01T05:59:40Z"}
{"binary": "patched-c706263", "cache": "recent", "exit": 0, "source": "oauth", "usageUpdatedAt": "2026-11-01T06:00:42Z", "dashboardAttached": true, "cacheUnchanged": true, "settingsUnchanged": true, "dashboardUpdatedAt": "2026-11-01T05:59:40Z"}
{"binary": "stable-0.83.0", "cache": "expired-65-days", "exit": 0, "source": "oauth", "usageUpdatedAt": "2026-11-01T06:00:43Z", "dashboardAttached": true, "cacheUnchanged": true, "settingsUnchanged": true, "dashboardUpdatedAt": "2026-08-28T06:00:40Z"}
{"binary": "patched-c706263", "cache": "expired-65-days", "exit": 0, "source": "oauth", "usageUpdatedAt": "2026-11-01T06:00:44Z", "dashboardAttached": false, "cacheUnchanged": true, "settingsUnchanged": true}
{"binary": "stable-0.83.0", "cache": "future", "exit": 0, "source": "oauth", "usageUpdatedAt": "2026-11-01T06:00:45Z", "dashboardAttached": true, "cacheUnchanged": true, "settingsUnchanged": true, "dashboardUpdatedAt": "2026-11-01T07:00:40Z"}
{"binary": "patched-c706263", "cache": "future", "exit": 0, "source": "oauth", "usageUpdatedAt": "2026-11-01T06:00:47Z", "dashboardAttached": false, "cacheUnchanged": true, "settingsUnchanged": true}

All six commands exited 0. Every response retained source: "oauth", primary usage 10%, weekly usage 20%, and a current usage.updatedAt. The recent cache attaches in both binaries. Only the patched CLI omits the 65-day-old and future-dated cache. All six runs preserved the cache and settings byte-for-byte.

Reproduction fixture (synthetic data only, macOS)

Build the PR CLI with swift build --product CodexBarCLI, retain the normal installed 0.83.0 app, then run this Python fixture from the repository root:

import base64, datetime as dt, hashlib, http.server, json, pathlib, subprocess, tempfile, threading, time
root = pathlib.Path(tempfile.mkdtemp(prefix='codexbar-cache-cli-proof-'))
home = root / 'home'; codex = home / '.codex'; codex.mkdir(parents=True)
cache = home / 'Library/Application Support/com.steipete.codexbar/openai-dashboard.json'; cache.parent.mkdir(parents=True)
config = root / 'config.json'
config.write_text(json.dumps({'version':1,'providers':[{'id':'codex','enabled':True,'source':'oauth','cookieSource':'off','extrasEnabled':False}]}))
def stamp(t): return dt.datetime.fromtimestamp(t, dt.timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ')
def enc(v): return base64.urlsafe_b64encode(json.dumps(v).encode()).rstrip(b'=').decode()
now = int(time.time())
jwt = enc({'alg':'none'})+'.'+enc({'email':'fixture@example.com','exp':now+86400,'https://api.openai.com/auth':{'chatgpt_account_id':'acct-fixture','chatgpt_plan_type':'pro'}})+'.fixture'
(codex/'auth.json').write_text(json.dumps({'tokens':{'access_token':jwt,'refresh_token':'synthetic-refresh','id_token':jwt,'account_id':'acct-fixture'},'last_refresh':stamp(now)}))
requests=[]
class Handler(http.server.BaseHTTPRequestHandler):
    def log_message(self,*args): pass
    def do_GET(self):
        requests.append(self.path)
        if self.path.endswith('/usage'):
            payload={'account_id':'acct-fixture','plan_type':'pro','rate_limit':{'primary_window':{'used_percent':10,'reset_at':int(time.time())+3600,'limit_window_seconds':18000},'secondary_window':{'used_percent':20,'reset_at':int(time.time())+86400,'limit_window_seconds':604800}}}
            self.send_response(200)
        else:
            payload={};self.send_response(404)
        data=json.dumps(payload).encode();self.send_header('Content-Type','application/json');self.send_header('Content-Length',str(len(data)));self.end_headers();self.wfile.write(data)
server=http.server.ThreadingHTTPServer(('127.0.0.1',0),Handler)
threading.Thread(target=server.serve_forever,daemon=True).start()
(codex/'config.toml').write_text('chatgpt_base_url = "http://127.0.0.1:'+str(server.server_port)+'/backend-api/"\n')
env={'HOME':str(home),'CFFIXED_USER_HOME':str(home),'CODEX_HOME':str(codex),'CODEXBAR_CONFIG':str(config),'CODEXBAR_DISABLE_KEYCHAIN_ACCESS':'1','CODEXBAR_SUPPRESS_TEST_KEYCHAIN_ACCESS':'1','PATH':'/usr/bin:/bin:/usr/sbin:/sbin','TMPDIR':str(root),'TERM':'dumb'}
def digest(p): return hashlib.sha256(p.read_bytes()).hexdigest()
settings={p:digest(p) for p in [config,codex/'config.toml',codex/'auth.json']}
rows=[]
try:
    for state,age in [('recent',60),('expired-65-days',65*86400),('future',-3600)]:
        snapshot={'signedInEmail':'fixture@example.com','accountID':'acct-fixture','creditEvents':[],'dailyBreakdown':[],'usageBreakdown':[],'creditsRemaining':42,'secondaryLimit':{'usedPercent':25,'windowMinutes':10080,'resetsAt':stamp(now-age+86400)},'updatedAt':stamp(now-age)}
        cache.write_text(json.dumps({'accountEmail':'fixture@example.com','snapshot':snapshot}));original=digest(cache)
        for label,binary in [('stable-0.83.0','/Applications/CodexBar.app/Contents/Helpers/CodexBarCLI'),('patched-c706263',str(pathlib.Path('.build/debug/CodexBarCLI').resolve()))]:
            before=time.time();result=subprocess.run([binary,'usage','--provider','codex','--source','oauth','--json'],env=env,text=True,capture_output=True,timeout=40)
            (root/(state+'-'+label+'.json')).write_text(result.stdout)
            (root/(state+'-'+label+'.stderr')).write_text(result.stderr)
            assert result.returncode==0,(state,label,result.returncode,result.stderr[:400],result.stdout[:400])
            output=json.loads(result.stdout);row=output[0] if isinstance(output,list) else output
            attached=row.get('openaiDashboard') is not None
            expected=label.startswith('stable') or state=='recent'
            summary={'binary':label,'cache':state,'exit':result.returncode,'source':row.get('source'),'usageUpdatedAt':row.get('usage',{}).get('updatedAt'),'dashboardAttached':attached,'cacheUnchanged':cache.exists() and digest(cache)==original,'settingsUnchanged':all(digest(p)==v for p,v in settings.items())}
            if attached: summary['dashboardUpdatedAt']=row['openaiDashboard'].get('updatedAt')
            print(json.dumps(summary),flush=True);rows.append(summary)
            assert attached==expected,('wrong attachment',summary,root)
            assert summary['cacheUnchanged'] and summary['settingsUnchanged'],summary
            assert row['usage']['primary']['usedPercent']==10 and row['usage']['secondary']['usedPercent']==20,row
    (root/'summary.json').write_text(json.dumps(rows,indent=2))
    print('PASS: stable-release cache reused byte-for-byte; fresh OAuth usage retained; cache/settings/auth unchanged in all six runs.')
finally:
    server.shutdown()
    print('Fixture evidence:',root)

Proposed cutoff for maintainer review

The requested bug fix permits a bounded age policy; this patch proposes 15 minutes as that default. A supplemental dashboard supplies mutable balances and reset limits, so an ownership match alone is insufficient to present it beside a newly measured quota. The optional supplement can be omitted without weakening the fresh usage result, triggering a web login, or deleting historical cache data. The bound is checked against attachment time rather than the usage timestamp, so an old usage measurement cannot make an old cache appear fresh. Timestamps up to 60 seconds ahead are tolerated for clock skew; those further ahead fail closed.

This is the author's concrete policy proposal for maintainer review, not a claim that upstream previously approved this cutoff. Maintainers retain the normal decision on accepting that default; no merge is requested by this validation handoff.

Earlier CI and review state (c706263, before clock-skew allowance)

CI run 41278764208 passed on c7062634745db4be16f82e33baff5821361b144b: full macOS tests, Linux x64/ARM64 builds/tests/smoke checks, musl build/smoke check, lint, and aggregate gate. GitGuardian passed; main-only cache pruning was skipped normally.

ClawSweeper review 2 found no actionable code defects and accepted the terminal/upgrade proof as sufficient. Its sole remaining item is maintainer approval of the proposed 15-minute default; the PR is labeled proof: sufficient and status: ⏳ waiting on maintainer. No maintainer approval is claimed.

There are no inline review threads. GitHub reports a clean, mergeable PR; upstream main remains 897bff31731bb4b21b105f6e8bf4c32a8a8bf095, included in this branch. No merge performed.

Review fixes (2026-11-01)

• Clock-skew tolerance: caches stamped up to 60 s after now (for example after a small NTP correction) now attach. Caches stamped further ahead are still dropped. Before this, any future timestamp was rejected.
• The bounds are named constants: openAIDashboardCacheMaxAge (15 min) and openAIDashboardCacheFutureTolerance (60 s).
• Reverted the unrelated import Foundation reorder.
• CHANGELOG bullet now cites #4882. It conflicts textually with fix(dashboard): flag Claude's unavailable model breakdown as a warning #4877's ### Fixed bullet; resolve by keeping both.

Tests: CLIOpenAIDashboardCacheTests, 12 passed. The parameterised age test now covers -61 and -3600 (dropped) and -60 (attached).

Real behavior proof

Current-head native macOS CLI proof at eeb0e1d65941346a132b69b6a726c11f4541cde7 (documentation-only follow-up to b14654258). Built this worktree with swift build --product CodexBarCLI and invoked the actual executable twice through usage --provider codex --source oauth --json in fresh processes. No production code or command output was injected.

Each run uses an isolated synthetic home (HOME and CFFIXED_USER_HOME aligned), synthetic Codex auth/config, and an ownership-compatible dashboard cache. chatgpt_base_url routes OAuth to a loopback fixture returning fresh 10% / 20% usage; optional reset-credit requests return 404. Keychain access is disabled and browser cookies are off. No real accounts or remote provider probes are involved. Identity fields are redacted below; no emails, account IDs, tokens, IP addresses, or personal paths are published. JSON is pretty-printed with all non-identity CLI fields preserved.

The first cache is seeded 30 seconds ahead and attaches; the second is seeded 120 seconds ahead and openaiDashboard is absent. The recorded timestamp differences include process startup time. SHA-256 assertions verify dashboard cache, settings, Codex config, and auth remain byte-identical after each run. Both commands exit 0 with fresh primary/weekly usage.

HEAD: eeb0e1d65941346a132b69b6a726c11f4541cde7
Command: CodexBarCLI usage --provider codex --source oauth --json

Fixture: +30 seconds; cache.updatedAt=2026-11-01T22:09:13Z
Raw CLI stdout (identity fields redacted; no behavior fields removed):
[
  {
    "openaiDashboard": {
      "dailyBreakdown": [],
      "updatedAt": "2026-11-01T22:09:13Z",
      "accountID": "[REDACTED]",
      "signedInEmail": "[REDACTED]",
      "creditEvents": [],
      "secondaryLimit": {
        "windowMinutes": 10080,
        "usedPercent": 25,
        "resetsAt": "2026-11-02T22:08:43Z"
      },
      "usageBreakdown": [],
      "creditsRemaining": 42
    },
    "source": "oauth",
    "usage": {
      "primary": {
        "windowMinutes": 300,
        "resetDescription": "3:08\u202fPM",
        "usedPercent": 10,
        "resetsAt": "2026-11-01T23:08:46Z"
      },
      "secondary": {
        "windowMinutes": 10080,
        "resetDescription": "tomorrow, 2:08\u202fPM",
        "usedPercent": 20,
        "resetsAt": "2026-11-02T22:08:46Z"
      },
      "updatedAt": "2026-11-01T22:08:46Z",
      "tertiary": null,
      "dataConfidence": "exact",
      "accountEmail": "[REDACTED]",
      "loginMethod": "pro",
      "identity": {
        "loginMethod": "pro",
        "accountEmail": "[REDACTED]",
        "providerID": "codex"
      },
      "planObservation": {
        "source": "usage_response",
        "rawPlan": "pro",
        "observedAt": "2026-11-01T22:08:46Z"
      }
    },
    "rateWindowLabels": {
      "primary": "Session",
      "secondary": "Weekly"
    },
    "provider": "codex",
    "pace": {
      "primary": {
        "summary": "70% in reserve | Expected 80% used | Lasts until reset | 1.5\u00d7 headroom",
        "stage": "farBehind",
        "willLastToReset": true,
        "expectedUsedPercent": 80,
        "deltaPercent": -70
      },
      "secondary": {
        "summary": "66% in reserve | Expected 86% used | Lasts until reset | 1.5\u00d7 headroom",
        "stage": "farBehind",
        "willLastToReset": true,
        "expectedUsedPercent": 86,
        "deltaPercent": -66
      }
    },
    "version": "0.163.0"
  }
]
{"exit": 0, "dashboardAttached": true, "cacheAheadOfUsageSeconds": 27.0, "cacheUnchanged": true, "settingsConfigAuthUnchanged": true}

Fixture: +120 seconds; cache.updatedAt=2026-11-01T22:10:46Z
Raw CLI stdout (identity fields redacted; no behavior fields removed):
[
  {
    "provider": "codex",
    "usage": {
      "primary": {
        "windowMinutes": 300,
        "resetDescription": "3:08\u202fPM",
        "resetsAt": "2026-11-01T23:08:47Z",
        "usedPercent": 10
      },
      "dataConfidence": "exact",
      "accountEmail": "[REDACTED]",
      "tertiary": null,
      "updatedAt": "2026-11-01T22:08:47Z",
      "planObservation": {
        "observedAt": "2026-11-01T22:08:47Z",
        "source": "usage_response",
        "rawPlan": "pro"
      },
      "secondary": {
        "windowMinutes": 10080,
        "resetDescription": "tomorrow, 2:08\u202fPM",
        "resetsAt": "2026-11-02T22:08:47Z",
        "usedPercent": 20
      },
      "loginMethod": "pro",
      "identity": {
        "providerID": "codex",
        "loginMethod": "pro",
        "accountEmail": "[REDACTED]"
      }
    },
    "version": "0.163.0",
    "rateWindowLabels": {
      "secondary": "Weekly",
      "primary": "Session"
    },
    "pace": {
      "secondary": {
        "deltaPercent": -66,
        "stage": "farBehind",
        "expectedUsedPercent": 86,
        "willLastToReset": true,
        "summary": "66% in reserve | Expected 86% used | Lasts until reset | 1.5\u00d7 headroom"
      },
      "primary": {
        "deltaPercent": -70,
        "stage": "farBehind",
        "expectedUsedPercent": 80,
        "willLastToReset": true,
        "summary": "70% in reserve | Expected 80% used | Lasts until reset | 1.5\u00d7 headroom"
      }
    },
    "source": "oauth"
  }
]
{"exit": 0, "dashboardAttached": false, "cacheAheadOfUsageSeconds": 119.0, "cacheUnchanged": true, "settingsConfigAuthUnchanged": true}
Synthetic HTTP requests: ["/backend-api/wham/usage", "/backend-api/wham/rate-limit-reset-credits", "/backend-api/wham/usage", "/backend-api/wham/rate-limit-reset-credits"]

PASS: both fresh-process CLI runs reached the synthetic OAuth usage endpoint; +30s attached, +120s omitted; fresh 10% / 20% usage and persisted fixture bytes preserved.

Validation: native CLI build and both synthetic integration cases passed. Existing fixed-clock CLIOpenAIDashboardCacheTests already cover the inclusive 60-second allowance and rejection at 61 seconds, so no additional unit cases were needed. Local make test-fast FILTER=CLIOpenAIDashboardCacheTests cannot build because this CLT-only Mac lacks Xcode's actool; exact-head macOS CI remains the unit-test gate. make check passed with Python 3.13 and TOOLCHAIN_DIR=/Library/Developer/CommandLineTools, including SwiftFormat and strict SwiftLint (zero violations).

Current-head CI run 41355639931 passed on eeb0e1d65941346a132b69b6a726c11f4541cde7: macOS tests and plugin checks, Linux x64/ARM64 builds/tests/smoke checks, musl build/smoke checks, lint, and the aggregate gate. GitGuardian passed; main-only cache pruning was skipped normally. gh pr checks --watch completed successfully.

ClawSweeper's current-head re-review accepts the shipped-CLI proof as sufficient and reports no actionable findings. Its remaining items are maintainer action/decision on the bounds.

The earlier c706263 trace above remains historical upgrade/stale-cache evidence; this current-head trace supplies the previously missing clock-skew proof. The proposed freshness bounds still require steipete's owner decision; no approval or resolution is claimed.

🤖 Generated with Claude Code

[Chipagosfinest]

@clawsweeper re-review

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/41279005311
• Updated: 2026-11-01T06:00:04.237Z

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T05:58:01.638933Z	c706263	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: blocked before merge.

What this changes

This PR omits supplemental cached OpenAI dashboards older than 15 minutes or more than 60 seconds ahead of attachment time.

Example: OAuth returns fresh 10% session and 20% weekly usage alongside an ownership-compatible, 65-day-old dashboard cache.

• Before: Usage JSON includes the historical dashboard balances and limits.
• After: Usage JSON omits openaiDashboard, preserves fresh quotas, and leaves the cache file intact.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and supported by shipped-CLI and stable-cache compatibility evidence; the unapproved output default caps overall readiness.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (terminal): Contributor-supplied native macOS usage CLI traces exercise OAuth HTTP fetch, disk-cache ownership and age evaluation, and JSON serialization: historical comparisons prove stale-cache omission, and current-head output proves slightly future caches attach while farther-future caches are omitted.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Needs a maintainer decision · Fix scope: Complete
User problem: Fresh Codex usage JSON can include months-old dashboard balances and reset limits.
Reason: Preventing stale supplemental values is useful, but the new 15-minute default and clock-skew allowance lack a recorded owner decision.

Merge readiness

⛔ Blocked before merge - 2 items remain

This PR addresses a source-confirmed stale-cache bug with a focused patch and sufficient CLI proof; the proposed freshness bounds still need an owner decision.

Priority: P2
Reviewed head: eeb0e1d65941346a132b69b6a726c11f4541cde7
Owner decision: Required. See Decision needed.

Decision needed

• Question: Should supplemental Codex usage JSON omit otherwise authorized dashboard caches after 15 minutes, while accepting timestamps up to 60 seconds ahead?
• Recommendation: Accept the proposed bounds: Keep the bounded optional supplement while preserving fresh usage and historical cache bytes.
• Why: This introduces an output default, and neither the inspected discussion nor ownership-policy history records maintainer approval of these bounds.

Before merge

• Await maintainer action - steipete should accept the 15-minute maximum age and 60-second future allowance or specify replacement bounds.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

None.

Agent review details

How this fits together

The CLI supplements successful Codex usage results with a disk-cached dashboard after shared account-ownership validation, then serializes the optional supplement into usage JSON.

flowchart LR
  A[Usage command] --> B[Codex provider fetch]
  B --> C[Fresh usage result]
  D[Dashboard disk cache] --> E[Ownership validation]
  C --> E
  E --> F[Cache age check]
  F --> G[Usage JSON]

Loading

Technical review

Best possible solution:

Retain the narrow attachment-time check and cache preservation, with freshness bounds explicitly accepted by the feature owner.

Do we have a high-confidence way to reproduce the issue?

Main's attachment path has no age guard, and the supplied native CLI comparison demonstrates a 65-day-old dashboard attached beside current OAuth usage; no target code was executed during this read-only review.

Is this the best way to solve the issue?

The patch fixes the attachment boundary directly without deleting historical data, adding configuration, or changing shared ownership decisions; the numerical freshness policy remains an owner choice.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 897bff31731b.

Provenance checked

• Supplemental dashboard attachment keeps the original intent (b731b4c: Centralize ownership-sensitive consumers behind explicit allowed effects and cleanup decisions; the commit does not establish an intentional unlimited-age guarantee.)
• Ownership and worked-example tests keeps the original intent (5c7c70e: Isolate runtime and test state; explicit fixture clocks preserve the existing synthetic snapshots and ownership assertions.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Focused introduced change: The patch adds an inclusive age check after cachedDashboardReuse authorization and preserves the existing unauthorized-cache cleanup branch. (Sources/CodexBarCLI/CLIHelpers.swift:354, eeb0e1d65941)
• Current-main failure path: Main returns any ownership-authorized cached snapshot without checking its timestamp; the production usage command invokes this fallback only when no live dashboard is present. (Sources/CodexBarCLI/CLIHelpers.swift:349, 897bff31731b)
• Current-head behavior and upgrade evidence: The complete PR body supplies native shipped-CLI output at the reviewed head: a cache approximately 27 seconds ahead attaches, one approximately 119 seconds ahead does not, and both retain fresh 10%/20% usage and unchanged persisted fixture bytes. Earlier stable-0.83.0 comparisons cover recent and 65-day-old caches. (eeb0e1d65941)
• Linked historical CLI trace: The contributor's linked terminal artifact compares main with the initial patch through the actual usage CLI and confirms stale-cache omission without modifying cache or settings. (4882-cli-output.txt:3, 38a1c90a9b0b)
• Ownership-policy provenance: The ownership refactor explicitly centralized attach/display-only/fail-closed decisions across app and CLI consumers; this patch preserves that authority and cleanup contract. GitHub commit metadata supplied the original patch where local historical blobs were unavailable. (Sources/CodexBarCLI/CLIHelpers.swift:354, b731b4cc0c9a)
• Previous finding resolved: The only change since the previous reviewed head documents the 60-second allowance and rejection of farther-future timestamps. (docs/cli.md:78, eeb0e1d65941)

Likely related people:

• Peter Steinberger: Raw commit 5c7c70e adds Tests/CodexBarTests/CodexDashboardWorkedExampleParityTests.swift:351 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 5c7c70e96644; files: Tests/CodexBarTests/CodexDashboardWorkedExampleParityTests.swift)
• Ratul Sarna: Raw commit b731b4c adds Sources/CodexBarCLI/CLIHelpers.swift:226 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: b731b4cc0c9a; files: Sources/CodexBarCLI/CLIHelpers.swift)

Review metrics

Metric	Value	Why it matters
Patch scope	Production +12/-1; tests +68/-19; documentation +8/-0	The small production change reuses the existing attachment owner; test edits preserve deterministic ownership coverage and add age boundaries.

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient.
• add status: ⏳ waiting on maintainer: Only explicit maintainer approvals or decisions remain; merge is still blocked.
• remove status: 📣 needs proof: Current PR status label is status: ⏳ waiting on maintainer.

Label justifications:

• P2: Historical supplemental balances and limits can accompany fresh usage JSON, but the primary usage fetch remains functional.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on maintainer: Only explicit maintainer approvals or decisions remain; merge is still blocked.
• proof: sufficient: Contributor real behavior proof is sufficient.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (3 earlier review cycles)

• reviewed 2026-11-01T05:58:46.432Z sha c706263 :: needs real behavior proof before merge. :: none
• reviewed 2026-11-01T06:04:40.308Z sha c706263 :: blocked before merge. :: none
• reviewed 2026-11-01T20:12:02.067Z sha b146542 :: needs real behavior proof before merge. :: [P3] Document the 60-second future-timestamp allowance

Reviewed November 1, 2026, 5:11 PM ET / 22:11 UTC (Revision 4).

[Chipagosfinest]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/41279425024
• Updated: 2026-11-01T06:06:05.604Z

[Chipagosfinest]

Native Mac CLI proof against freshly fetched main 897bff317 and head c70626347: built both CLIs, then ran six fresh-process usage --provider codex --source oauth --json commands against synthetic loopback OAuth and the same cache fixture.

Cache	Main attaches dashboard	Head attaches dashboard
Recent	yes	yes
65 days old	yes	no
Future timestamp	yes	no

All commands exit 0 and retain fresh 10% / 20% quotas. Cache, auth, and config remain byte-identical after every command. Actual CLI trace · 12 focused tests passed, including six age cases · provenance. No real account data or product-code changes.

[Chipagosfinest]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/41345723892
• Updated: 2026-11-01T20:13:34.219Z

[Chipagosfinest]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/41356008233
• Updated: 2026-11-01T22:13:22.491Z