OpenFang adds provenance receipts while its runtime queue stays narrow

RightNow-AI/openfang PR #1276 is the inspected primary source: “fix(cli): cron create by agent name, correct create/list response par….” The related records below were inspected as supporting context rather than independent confirmation.

The facts

- RightNow-AI/openfang PR #1276 was created 2026-08-02T02:17:44Z and was open at inspection; its title is “fix(cli): cron create by agent name, correct create/list response par….” - RightNow-AI/openfang PR #1274 was created 2026-07-30T22:37:42Z and was open at inspection; its title is “fix(clawhub): forward owner handle on installs.” - RightNow-AI/openfang PR #1273 was created 2026-07-28T23:11:38Z and was open at inspection; its title is “ci: attach provenance and SBOM attestations to the published image.” - The repository reported 18077 stars, 118 open issues, default branch main, and last push 2026-07-02T08:13:12Z. - The latest tagged-release baseline checked was v0.6.9 published 2026-05-12T18:42:42Z.

What changed

RightNow-AI/openfang PR #1276 reports: …sing, data_dir in status cron create: resolve agent name -> UUID via /api/agents (help text already promised names); clear 'Unknown agent' error with fix hint cron create: parse the actual API response shape ({"result": json-string}) instead of a nonexistent top-level id, eliminating the false 'Failed:?' on success; surface real error bodies cron list: read the {jobs, total} wrapper (bare array still accepted), render schedule from schedule.expr/secs and prompt from action.message, and show agent names instead of raw UUIDs status: include data_dir in GET /api/status; CLI falls back to home_dir for older daemons (fixes 'Data dir:?') Verified: cargo clippy -D warnings clean on both crates; 196 tests passing; live daemon round trip confirmed all paths. Claude-Session: https://claude.ai/code/session_013nK3VtM7ZcEYG5mdrjQJcB Summary Changes Testing [ ] cargo clippy --workspace --all-targets -- -D warnings passes [ ] cargo test --workspace passes [ ] Live integration tested (if applicable) Security [ ] No new unsafe

RightNow-AI/openfang PR #1274 reports: Summary carry ClawHub ownerHandle through search results, TUI selection, and the install API request use ownerHandle on the ClawHub download URL when present so duplicate slugs resolve to the selected publisher keep legacy slug-only installs working and cover both camelCase and snake_case request fields Fixes #1270 Tests cargo test -p openfang-skills clawhub --lib cargo test -p openfang-api types::tests::clawhub_install_request_parses_owner_handle_aliases --lib cargo test -p openfang-cli tui::event::tests::parse_clawhub_results_preserves_owner_handle cargo check -p openfang-api -p openfang-cli cargo clippy -p openfang-skills --all-targets -- -D warnings git diff --check Note: I also tried the broader cargo clippy -p openfang-skills -p openfang-api -p openfang-cli --all-targets -- -D warnings; it reached an unrelated pre-existing warning in crates/openfang-channels/src/feishu.rs:1052 (clippy::question_mark) outside this PR's touched files.

RightNow-AI/openfang PR #1273 reports: Hi, and thanks for openfang..github/workflows/release.yml publishes the image, but the pushed manifest carries no provenance or SBOM attestation. Someone pulling it cannot check that it was built by this workflow, from this repository, at that tag. The release image is what users deploy directly, so the pushed manifest is the artifact worth being able to check. The change is two lines on the build step: BuildKit attaches both to the image manifest, so they travel with the image. **No permissions change is needed** — nothing has to gain id-token, and your tag and cache configuration are untouched. Two caveats worth stating: mode=max records the full build including build arguments, so provenance: true is the smaller option if any have ever been sensitive; and attestations add an extra manifest to the index, which the registry supports. No SLSA level claimed — the attestation is what BuildKit produces. Disclosure: I used

Why it matters

Supply-chain receipts and unambiguous package ownership are useful operator signals, but three open patches do not settle the project’s broader roadmap. The distinction prevents maintenance movement from being sold as a revival. The operator test is whether persisted state, execution authority and the visible outcome describe the same event after retries, restarts or delegation.

Current

The primary record was open when captured on 2026-08-06. The release baseline was v0.6.9 published 2026-05-12T18:42:42Z. Repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts row were checked. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/RightNow-AI/openfang/pull/1276. Supporting records are https://github.com/RightNow-AI/openfang/pull/1274 and https://github.com/RightNow-AI/openfang/pull/1273. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Verify attestations against a published image, test ambiguous ClawHub slugs, and wait for maintainer roadmap or release evidence before upgrading the project baseline. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.