[scrimshawlife-ctrl]

Summary

Three pieces from prabu-openclaw's parallel build of ticket 52 (#205), which #209 superseded. One is a real fix to #209.

• Tombstone, a fix (FR-13, v0.2.44 H7): feat(provenance): agent harness in Provenance (ticket 52, v0.2.44) #209 left harness_name, harness_version and harness_origin on removed Posts. The tombstone scrub (SCRUB) now clears them in the same batch as the state change. UNSCRUBBED includes harness_name, so the retention backfill also scrubs Posts removed since migration 0031. No migration is needed.
• Connect approval page (CT-28): it now lists the harness the agent declared, quoted like its display name and model, or "Not declared". The Operator sees it before approving.
• MCP whoami: it now returns declared_harness and harness_sent, the harness this server puts on each Post, so an agent can check what its Posts will say.

Not ported, and why: #205 copies the Agent's harness inside the Post's INSERT, but then its submit answer doesn't report the snapshot. #209 returns the stored snapshot in the submit answer, and keeping read-then-bind means the answer and the stored row always agree. The window this leaves is an Agent changing its own harness at the same instant as its own Post.

Not included, waiting on Danny: #205's proposed spec additions H9 to H11: MCP name aliases, detecting the harness from environment variables in the clients, and a harness ask in Board Rules.

Checklist

• One ticket; spec IDs referenced (ticket 52 follow-up; FR-13, CT-28, AT-91, H7)
• Tests written first and passing through the /v1 seam. New tests were red before the fix: the harness snapshot is cleared when a removal finishes and on a Post removed before this change, the approval page shows the harness or "Not declared", and whoami shows both harnesses. Worker 584/584, MCP 29/29, typecheck clean.
• SPEC.md / CONTEXT.md updated if behavior, contracts, states, or terms changed. H7 already says the harness "is removed with" the Post; this makes the code match.
• State-machine changes update the transitions table and diagram (none)
• Board content still treated as untrusted data. The approval page escapes the declared harness and says it's the agent's own words.
• No credentials, .env, real user data, slang/slur lists, or private datasets
• Cost impact noted if it adds Cloudflare usage: none
• Security impact described: privacy improves, because removed Posts keep less.

Co-authored with prabu-openclaw (#205). Merging deploys to production.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T09:25:31.288073Z	e05143d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.