Defaults the homepage and skills catalog to canonical Trending with New, Featured, and Official feeds, eligible public counts, stable pagination, and local-auth runtime coverage.
Ships the fail-closed skills.sh catalog control plane validated by the bounded 500-row permanent Test gate. No production ingestion, schedule, visibility, or bulk scanning is enabled.
A second preview deploy-key consumer runs --preview-create on raw branch
names; Convex replaces same-name previews by delete-and-create, so it was
deleting Vercel's fresh deployments mid-push (get_config_hashes and
wait_for_schema 404s on every PR preview today; confirmed via the Convex
team audit log create/delete pairs seconds apart). Suffix all Vercel-built
preview names with -vercel so no other consumer can collide with them.
* test: make ClawScan process-tree timeout test deterministic
The timeout test raced its 500ms deadline against the fixture writing
descendant.pid, and treated zombies as live processes via kill(pid, 0).
Under parallel coverage runs it flaked. Now waits for the pid barrier,
drives the timeout with fake timers, and treats zombie state as exited.
* ci: retry transient convex preview provisioning failures
Fresh Convex preview deployments intermittently 404 on get_config_hashes
while provisioning, failing the whole Vercel preview build after the
CLI's internal retries. Retry the preview deploy step up to 3 attempts
with 20s/40s backoff; other steps keep fail-fast behavior.
* fix: restore promotion bar icon geometry token
77459acc dropped border-radius: var(--oc-radius-inset) from
.promotion-bar-icon while folding the removed fallback rule into it,
breaking the ui-design-contract test on main.
* ci: retry preview pipeline under fresh preview names
Retrying --preview-create under the same name leaves two deployments and
convex run --preview-name can resolve to the dead one (seen live: seed
failed with missing functions after a successful retry). Each retry now
reruns deploy plus seed under <branch>-retry-N so resolution is unique.
Closes CLAW-526.\n\nSummary:\n- create pending skill versions and plugin releases that remain hidden until TruffleHog and ClawScan pass\n- preserve older CLI response compatibility while newer CLI output explains pending security checks\n- run prepublication worker promotion/blocking for skills and plugins\n- add local-auth coverage for clean skill/plugin publish and secret-positive skill rejection\n\nValidation on PR head d2482434:\n- local: bunx tsc -p packages/schema/tsconfig.json --noEmit\n- local: bunx tsc -p packages/clawhub/tsconfig.json --noEmit\n- local: bunx vitest run convex/lib/skillPublish.test.ts convex/publishAttempts.test.ts convex/skills.versions.public.test.ts convex/packages.public.test.ts packages/schema/src/schemas.test.ts scripts/security/run-prepublication-worker.test.ts scripts/security/prepublication-worker-workflow.test.ts\n- local: bun run ci:static\n- local: bun run ci:types-build && bun run ci:packages\n- GitHub: pr-gates, static, unit, packages, types-build, e2e-http, old-cli-publish, playwright-smoke, secret scanning, CodeQL, and Vercel preview passed\n\nKnown CI note:\n- unrelated local-auth shards continued to rotate failures under the already-diagnosed local Convex starvation issue; ignored per maintainer instruction.
* feat: make home catalog featured-first
* fix: order plugins before skills on home
* feat: refine featured catalog landing page
* fix: seed featured catalog previews
* fix: reduce official creator shelf
Implements CLAW-541: an artifact-only OSS ClawScan path at the canonical worker seam while preserving the legacy production default. Includes strict artifact validation, complete secret-safe diagnostics, required VirusTotal wiring, and focused route/failure coverage.
Patrick Erichsen