Add Hugging Face billing and prepaid Credits

[sambokai]

Summary

Adds Hugging Face as a first-class CodexBar provider for two distinct billing concepts that can be shown together when safely attributable:

• Hugging Face API authentication for reported billing-period spend, identity, period metadata, and category details.
• An authenticated Hugging Face browser session for the prepaid Credits wallet shown on the Hugging Face billing page.

Ordinary Auto mode treats API spend as authoritative and retrieves the browser wallet as auxiliary data when browser-session billing is safely available. CodexBar composes the wallet onto an API account only after an exact cross-authority identity match. Otherwise the API result and browser wallet remain separate and explicitly labeled.

Explicit API and Web selections remain isolated diagnostic/source modes.

Billing behavior

API billing

Bearer-token authentication uses:

• /api/whoami-v2 for account identity.
• /api/settings/billing/usage for the current billing period and reported category spend.

The provider exposes the spend returned by Hugging Face for that billing period. It does not claim to represent all possible Hugging Face account spending.

Token-only refresh does not trigger browser or Keychain access solely to perform identity matching.

Prepaid Credits

The prepaid wallet is separate from API billing usage.

Hugging Face currently renders this value on /settings/billing from structured server-rendered data. CodexBar parses:

• entity.currentBalanceUsd as the current wallet value.
• invoiceCreditsCents only as a legacy compatibility fallback.

A valid upstream zero is preserved as $0.00. Missing authentication, redirects to login, malformed data, or an unavailable wallet remain unavailable rather than being converted into zero.

The browser wallet is one provider-level browser-session value. It is never duplicated or cached as multiple token-account wallet snapshots.

Auto mode and account safety

API-token identity and browser-session identity are resolved independently through /api/whoami-v2.

Composition requires:

• type == "user" on both identities; and
• an exact match of Hugging Face's private opaque user id.

CodexBar does not use billing-page names, email, organization membership, display names, or wallet values as ownership proof.

Auto behavior:

1. Fetch API billing for the selected API account or accounts.
2. Retrieve the browser wallet as auxiliary data when safely available through the existing browser-session path.
3. If exactly one API account has an exact identity match, compose the wallet onto that account.
4. If identity mismatches, cannot be verified, or matches multiple accounts, fail closed for composition and show the browser wallet separately with authority-specific wording.
5. Never duplicate the provider-level browser wallet across token accounts.

A browser wallet retained after a failed Auto/API replacement is presented as browser-session data with no implication that it belongs to the current API account.

Explicit API and Web modes

Explicit API remains API-only.

Explicit or persisted Web remains browser-session-only:

• one provider-level Web fetch;
• no API token-account fan-out;
• no API account label or cache attribution on the Web wallet;
• selected API caches are not activated while Web is authoritative;
• a failed Web refresh preserves the prior Web-owned snapshot rather than exposing a retained API-account snapshot.

Cookie source Refresh validates the Web path first. Its best-effort Auto follow-up may then restore the ordinary dual-source view. If that follow-up fails after displacing a validated Web snapshot, the wallet remains visible once at provider level with browser-session attribution.

Cancellation still propagates.

Browser-session handling

Hugging Face uses CodexBar's existing shared browser-cookie infrastructure rather than a provider-specific cookie scraper.

Automatic browser-session handling:

• uses shared browser detection/import infrastructure;
• uses the existing bounded explicit-retry mechanism for user-initiated access when needed;
• caches imported cookies through the existing provider cookie cache;
• avoids introducing browser or Keychain prompts during ordinary background refresh.

Manual Cookie and Off modes remain available through the standard provider settings UI.

UI and CLI integration

The change includes:

• Hugging Face provider registration and aliases;
• official Hugging Face provider icon;
• API-token and browser-cookie settings;
• persisted Usage source selection for Auto, API, and Web;
• billing-period spend and category details;
• prepaid Credits presentation through CodexBar's existing balance model;
• compact and stacked account-menu presentation;
• wallet-only recovery presentation when no API snapshot is available;
• CLI support for API spend plus a single provider-level browser wallet without Web-to-account attribution;
• provider documentation and generated registry/manifest updates.

Intentionally out of scope

This PR does not add or claim:

• /usage-v2 inference allowance as the primary balance;
• ZeroGPU quota;
• synthetic quota or usage-history calculations;
• organization billing;
• whole-account spend coverage beyond the billing categories returned by the current API;
• Hugging Face-specific browser-cookie scraping.

Prepaid Credits, reported billing spend, and any included inference allowance are treated as distinct concepts.

Validation

Current canonical contribution head: a940f5f1b23654d75e4f934f0f633c8b3716b2c0, based on upstream 928166f899471bbdcb72210641cdec91324d0154.

Exact-head validation passed with full Xcode selected via DEVELOPER_DIR=/Applications/Xcode-beta.app/Contents/Developer:

• contained A/B final-publication harness: 1 test
• make test: 1,056 selections across 88/88 groups
• make format: 0 files formatted
• make check: SwiftLint 0 violations
• git diff --check

The only delta from the previously reviewed production head 544aa4e3588ccebc9a5159c88540df983e09d00c is the test-only final-publication harness. No production source changed.

Live verification

A contained public-safe live-proof pass was run on production head 544aa4e3588ccebc9a5159c88540df983e09d00c using a freshly built release app. Production code is unchanged at the current head, so these observations remain applicable.

Artifact provenance:

• version 0.57.1, build 141
• embedded commit 544aa4e35
• app SHA-256 649111db2452c3e9c663237b09c49200dac63adf8f5cfc14d636668a9a4ed893
• deep code-signature verification passed
• pre-run and post-run fingerprints matched; no source change occurred during the proof

Confirmed on that production head:

• Stable-Chrome Web path: normal app-mediated Chrome Safe Storage access succeeded after user approval, and explicit Web returned the browser-session prepaid-Credits result without API-account attribution.
• Matched Auto path: Auto reached api+web with both API billing data and browser Credits present. The wallet remains Web-derived authority data; CLI presents it as a separate provider-level Web field by design while account-level UI uses the matching/reconciliation rules described above.
• Invalid bearer recovery with populated state: after API and browser state were populated, a synthetic invalid bearer was rejected through the real Hugging Face path without stale API publication. The original configuration was restored byte-identically, and the next Auto refresh returned to the matched state.
• Invalid Manual Cookie path: an isolated synthetic Manual Cookie was rejected by the production Web strategy without publishing wallet data; the isolated configuration was then removed.

A true two-account mismatch using two server-issued Hugging Face credentials was not run because no secondary account/credential exists. No second account or token was created for the proof.

The live pass did not perform logout, browser-account switching, direct Keychain inspection, cookie extraction, real credential revocation, account/token creation, or source mutation. No tokens, cookies, account identifiers, balances, spend values, authenticated payloads, or private browser data are included here.

Contained A/B final-publication proof

Current head a940f5f1b23654d75e4f934f0f633c8b3716b2c0 adds a test-only contained proof in Tests/CodexBarTests/HuggingFaceRealTransportFinalPublicationTests.swift.

This is not described as live Hugging Face account proof. It uses synthetic contract-valid A/B principals and synthetic server responses intercepted by URLProtocol, while exercising the production CodexBar URLSession / ProviderHTTPClient, bundled Hugging Face plugin, identity cache, Auto reconciliation, UsageStore publication, and final StatusItemController.menuCardModel(for:) path.

Recorded execution result on the exact current head: PASS (1 test).

The two-phase assertion sequence demonstrated:

1. Matched A/A: API A plus browser A populated bearer/cookie identity caches, account snapshot state, and final api+web publication.
2. Mismatched A/B after populated state: API A remained cached while browser authority changed to a distinct valid-shaped principal B. The final account snapshot retained API usage and identity but dropped the old composed wallet and api+web attribution; the browser wallet was published separately with .unverified authority; the final menu-card model presented the browser-session wallet separately as Unverified against this API token; and no wallet remained attributed to account A.
3. The second phase issued no new bearer-A identity request, confirming the transition exercised the populated bearer identity cache rather than starting from an empty identity state.

This execution used no live Hugging Face credentials, browser cookies, Keychain data, account creation, account switching, purchased Credits, or real secondary credentials.

The deterministic partial-cancellation timing edge remains covered by the exact-head regression suite rather than invasive live-network manipulation.

Privacy and security

The submitted diff contains no real:

• API tokens;
• cookie values;
• account identifiers;
• billing balances;
• authenticated billing HTML or payloads;
• machine-specific filesystem paths.

Tests use synthetic fixtures and sanitized data only.

UI Proof / Screenshots

The following screenshots were captured during the public-safe live verification described above.

They show the implemented Hugging Face surface end to end:

1. Hugging Face registered as a first-class provider.
2. Provider settings with the authenticated api+web result, browser-cookie cache, API-token configuration, and Auto usage source.
3. Cookie source selection: Auto, Manual, and Off.
4. Usage source selection: Auto, Browser cookies, and API token.
5. The normal menu presentation showing reported billing-period spend, category breakdown, and prepaid Credits balance together.

These screenshots demonstrate the user-visible implementation and source controls. They supplement the live verification above. The cross-authority identity and mismatch safety properties are established separately by the contained A/A → A/B final-publication proof below.

Combined billing and prepaid Credits

Provider settings

First-class provider registration

Cookie source selection

Usage source selection

Related work

There is an existing Hugging Face PR, #3322, exploring a different scope around /usage-v2, inference credits, and ZeroGPU.

This PR remains billing-oriented: reported billing spend from /api/settings/billing/usage plus the explicit prepaid Credits wallet from the authenticated billing page, with bounded identity-based composition and safe separate-authority fallback.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review in progress

ClawSweeper is reviewing this revision. This supersedes any previous blocked status.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 9, 2026, 9:26 AM ET / 13:26 UTC (Revision 33).

ClawSweeper review

What this changes

Adds Hugging Face billing spend and prepaid browser-session Credits to the app and CLI, with source settings, account attribution, presentation, documentation, and tests.

Merge readiness

✅ Ready for maintainer review

The contribution remains useful and unshipped. The newly recorded A/B execution addresses the previous proof blocker, and no blocking introduced defect was found. The related inference-quota proposal does not supersede this work.

Priority: P2
Reviewed head: a940f5f1b23654d75e4f934f0f633c8b3716b2c0

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A useful integration with substantial regression coverage and sufficient runtime evidence; the prior proof gap is resolved.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The unchanged production code has recorded release-app Web, matched Auto, invalid-bearer recovery, and invalid-cookie rejection evidence. The newly recorded exact-head production-path harness additionally exercises populated A/A → A/B state through the real plugin, HTTP client, store, and final menu model, showing the old account composition removed and the replacement browser wallet separately attributed.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The unchanged production code has recorded release-app Web, matched Auto, invalid-bearer recovery, and invalid-cookie rejection evidence. The newly recorded exact-head production-path harness additionally exercises populated A/A → A/B state through the real plugin, HTTP client, store, and final menu model, showing the old account composition removed and the replacement browser wallet separately attributed.
Evidence reviewed	9 items	Repository policy and review boundary: Read the complete root AGENTS.md; the tree contains no nested AGENTS.md or maintainer-notes directory. Applied provider isolation, Chrome-only cookie import, concurrency, and test-safety guidance. Repository State also prohibits automatic closure under the current onboarding profile. No builds, tests, or live credential probes were executed; final git status was clean. Current main and release still lack this provider: Inspected the complete provider manifests on fetched main and v0.57.0; neither registers Hugging Face. Searches of main source and provider documentation also found no Hugging Face implementation. Release comparison: The v0.57.0 provider manifest contains no Hugging Face descriptor, so the latest supplied release does not deliver this addition.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar’s provider pipeline turns authenticated billing responses into menu and CLI usage displays. This addition combines bearer-token spending data with a browser wallet only when account identities match, otherwise presenting the wallet separately.

flowchart TD
  A[API token] --> C[Billing spend and API identity]
  B[Browser session] --> D[Prepaid wallet and browser identity]
  C --> E{Unique identity match}
  D --> E
  E -->|Yes| F[Account spend with wallet]
  E -->|No| G[Separate browser wallet]
  F --> H[Menu and CLI display]
  G --> H

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test growth	Production +2,881/−241 lines; tests +5,031/−73 lines	The stated scope explains the growth through dual-source fetching, attribution, app/CLI publication, and regression coverage.

Technical review

Best possible solution:

Preserve distinct spend and prepaid-wallet semantics through the existing provider infrastructure, with account composition governed by verified identity and separate browser attribution otherwise.

Do we have a high-confidence way to reproduce the issue?

Not applicable as an existing-behavior bug: this adds a provider. Contributor evidence exercises the new runtime paths, while this review inspected source without executing them.

Is this the best way to solve the issue?

Yes: the implementation reuses the provider plugin, credential, cookie, and presentation infrastructure while keeping billing spend separate from prepaid Credits; no equivalent supported implementation exists on the reviewed main.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 928166f89947.

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. The unchanged production code has recorded release-app Web, matched Auto, invalid-bearer recovery, and invalid-cookie rejection evidence. The newly recorded exact-head production-path harness additionally exercises populated A/A → A/B state through the real plugin, HTTP client, store, and final menu model, showing the old account composition removed and the replacement browser wallet separately attributed.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The unchanged production code has recorded release-app Web, matched Auto, invalid-bearer recovery, and invalid-cookie rejection evidence. The newly recorded exact-head production-path harness additionally exercises populated A/A → A/B state through the real plugin, HTTP client, store, and final menu model, showing the old account composition removed and the replacement browser wallet separately attributed.
• remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
• remove merge-risk: 🚨 security-boundary: Current PR review selected no merge-risk labels.

Label justifications:

• P2: This is a bounded provider integration improvement with no demonstrated urgent regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The unchanged production code has recorded release-app Web, matched Auto, invalid-bearer recovery, and invalid-cookie rejection evidence. The newly recorded exact-head production-path harness additionally exercises populated A/A → A/B state through the real plugin, HTTP client, store, and final menu model, showing the old account composition removed and the replacement browser wallet separately attributed.
• proof: sufficient: Contributor real behavior proof is sufficient. The unchanged production code has recorded release-app Web, matched Auto, invalid-bearer recovery, and invalid-cookie rejection evidence. The newly recorded exact-head production-path harness additionally exercises populated A/A → A/B state through the real plugin, HTTP client, store, and final menu model, showing the old account composition removed and the replacement browser wallet separately attributed.

Evidence

What I checked:

• Repository policy and review boundary: Read the complete root AGENTS.md; the tree contains no nested AGENTS.md or maintainer-notes directory. Applied provider isolation, Chrome-only cookie import, concurrency, and test-safety guidance. Repository State also prohibits automatic closure under the current onboarding profile. No builds, tests, or live credential probes were executed; final git status was clean. (AGENTS.md:1, a940f5f1b236)
• Current main and release still lack this provider: Inspected the complete provider manifests on fetched main and v0.57.0; neither registers Hugging Face. Searches of main source and provider documentation also found no Hugging Face implementation. (Sources/CodexBarCore/Providers/ProviderManifest.swift:7, 928166f89947)
• Release comparison: The v0.57.0 provider manifest contains no Hugging Face descriptor, so the latest supplied release does not deliver this addition. (Sources/CodexBarCore/Providers/ProviderManifest.swift:7, 45cda6084d64)
• Proof continuity: The comparison from production head 544aa4e to the reviewed head adds only HuggingFaceRealTransportFinalPublicationTests.swift. The captured body at sourceRevision 39a1f45e2ec013550e75de3767edc113af1fd02b69ef027ed2a788cf9e9481da records release-app Web, matched Auto, invalid-bearer recovery, and invalid-cookie rejection on the unchanged production code. (Tests/CodexBarTests/HuggingFaceRealTransportFinalPublicationTests.swift:20, a940f5f1b236)
• Recorded final-publication execution: The captured body and Add Hugging Face billing and prepaid Credits #3399 (comment) report PASS for the exact-head contained harness. Read its complete implementation: synthetic A/A then A/B responses traverse URLSession, ProviderHTTPClient, the bundled plugin, identity cache, Auto reconciliation, UsageStore, and the final menu-card model. Assertions verify removal of A’s old wallet and api+web attribution, separate unverified B publication, and reuse of the populated bearer cache. This addresses the prior review’s concrete rank-up request without requiring another real account. (Tests/CodexBarTests/HuggingFaceRealTransportFinalPublicationTests.swift:145, a940f5f1b236)
• Authority and recovery implementation: Auto first requires successful API billing, resolves the wallet and browser identity using the same normalized cookie, and composes only matching opaque user identities. Batch reconciliation strips ambiguous or superseded compositions before publication. The retained-wallet and partial-cancellation regression assertions cover the earlier concrete findings. (Sources/CodexBarCore/Providers/HuggingFace/HuggingFaceWebFetchStrategy.swift:243, a940f5f1b236)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)
• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (32 earlier review cycles; latest 8 shown)

• reviewed 2026-09-08T11:00:06.590Z sha 5201562 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-08T15:12:12.977Z sha 5201562 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-08T18:02:24.422Z sha 20c5843 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-08T20:09:13.536Z sha b25a9d8 :: needs real behavior proof before merge. :: [P2] Reconcile retained wallet balances before publishing account snapshots
• reviewed 2026-09-08T21:24:30.886Z sha 5c14dc5 :: needs real behavior proof before merge. :: [P2] Publish reconciled live state when the selected account is cancelled | [P3] Remove already-released fixes from the Unreleased notes
• reviewed 2026-09-08T22:55:43.015Z sha 544aa4e :: needs real behavior proof before merge. :: none
• reviewed 2026-09-09T07:38:02.715Z sha 544aa4e :: needs real behavior proof before merge. :: none
• reviewed 2026-09-09T11:45:39.165Z sha a940f5f :: needs real behavior proof before merge. :: none

[sambokai]

Exact-head validation report (final integration head)

Head: a41b65ccf744c531c049ea52988ae58b1d90fd41 (codex/huggingface-integration)

Merged fork PRs

• FP-166 / sambokai/CodexBar#2 -> merge commit e9c23ecc0 (already landed before this pass)
• FP-167 / sambokai/CodexBar#1 -> merge commit a41b65ccf (parents b0943794f + e4593ee16; merged tree verified identical to the green FP-167 head)
• Upstream PR head confirmed to point at a41b65ccf (fork branch codex/huggingface-integration).

Portability note: the HF web credits parser needed import CoreFoundation on Linux (CFGetTypeID/CFBooleanGetTypeID). The fix landed on the integration base (b0943794f, import order corrected to satisfy swiftformat sortImports) before FP-167 was merged.

CI (fork PR #1 at FP-167 head e4593ee16, same tree as a41b65ccf)

• build-linux-cli (linux-arm64): pass
• build-linux-cli (linux-x64): pass
• build-linux-musl-cli: pass
• lint: pass
• lint-build-test (required matrix gate): pass
• swift-test-macos shard 0: pass (34m50s, incl. lint-macos formatting gate)
• swift-test-macos shard 1: pass (28m9s)

Exact-head validation (local, at a41b65ccf)

• Focused tests:
  • HuggingFace (incl. new HuggingFaceProviderDescriptorTests "automatic browser cookie imports use Chrome only"): 42 tests / 5 suites passed
  • Cookie suite (BrowserCookieOrderLabel/Status, CookieImporterOverrideIsolation, CLICookieRefresh, CookieHeader*, browser-cookie importers): 149 tests / 16 suites passed
  • Provider registry/credential/selection: 26 tests / 5 suites passed
• make check (swiftformat + swiftlint --strict): 0 formatting issues, 0 violations across 2105 files
• Full make test (sharded suite, keychain-suppressed): 1004 selections / 84 groups, all first-pass, 0 failures, 0 retries, 0 timeouts
• git diff --check against merge-base: clean

Live-proof status

Not run on this machine: no Hugging Face credential is configured (no API token, cookie header, or cookie source present in the local config; provider disabled), so the sanitized API/Web/Auto/Chrome/cache live matrix cannot execute without credentials and an authenticated session. The agreed billing-period spend + prepaid Credits model and PR #3322 were not modified.

Re-review

ClawSweeper already picked up the exact head (a41b65ccf) automatically after the push (review updated 19:02 UTC). Remaining blockers from that review are the account-composition/decision item and live behavior proof, which are outside FP-167's Chrome-only cookie-import scope.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[sambokai]

@clawsweeper re-review

FP-181 safe contained live-proof authorization is now in place. Please refresh the review against the current PR head before live credential work begins; no source, merge, or CI mutation is requested.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/34288586968
• Updated: 2026-09-08T23:00:02.915Z

[sambokai]

@clawsweeper re-review

The PR body now contains the sanitized current-head FP-181 evidence from exact head 544aa4e3588ccebc9a5159c88540df983e09d00c, including current artifact provenance, stable-Chrome Web, matched Auto, populated-state invalid-bearer recovery, and synthetic invalid-Manual-Cookie behavior. A true valid-principal A/B mismatch remains not run because no secondary Hugging Face credential exists; no account/token was created or revoked to manufacture one.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[sambokai]

@clawsweeper re-review

Recorded execution evidence for the contained A/B final-publication harness is now in the PR body for exact head a940f5f1b23654d75e4f934f0f633c8b3716b2c0.

Focused result: PASS (1 test).

The run exercised the production CodexBar URLSession/ProviderHTTPClient, bundled Hugging Face plugin, identity cache, Auto reconciliation, UsageStore publication, and final menu-card projection with synthetic contract-valid A/B principals intercepted by URLProtocol. After populated A/A state, browser B remained separate, account A lost the old composed wallet and api+web attribution, and the browser wallet published separately as unverified. No live secondary account or real secondary credential was used.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.