ZeroClaw
ZeroClaw tells unattended runs whether anyone will receive the reply
ZeroClaw’s default cron delivery mode records a final answer without sending it, yet the model was never told that fact or how to suppress an empty report. Related SOP patches make scheduled procedures execute under a named owner, preserve step scope through delegation, and record tool calls.
zeroclaw-labs/zeroclaw PR #9842 is the inspected primary source: “feat(cron/heartbeat): state the delivery contract to autonomous turns.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- zeroclaw-labs/zeroclaw PR #9842 was created 2026-08-08T00:11:20Z and was open at inspection; its title is “feat(cron/heartbeat): state the delivery contract to autonomous turns.” - zeroclaw-labs/zeroclaw PR #9494 was created 2026-07-28T17:48:04Z and was open at inspection; its title is “fix(sop): drive cron-started headless runs.” - zeroclaw-labs/zeroclaw PR #9841 was created 2026-08-08T00:04:46Z and was open at inspection; its title is “fix(sop): drive headless SOP runs, and close the five defects found reviewing #9494.” - The repository reported 32526 stars, 717 open issues, default branch master, and last push 2026-08-08T00:04:44Z. - The latest tagged-release baseline checked was v0.8.4 published 2026-08-02T21:00:00Z.
What changed
zeroclaw-labs/zeroclaw PR #9842 reports: Summary **Base branch:** master **What changed and why:** A cron agent turn's entire model-visible framing was format!("[cron:{} {name}] {prompt}", job.id). That names the origin and says nothing about what happens to the reply. Two consequences, both disclosure gaps rather than plumbing gaps — the delivery machinery is already correct. **The reply may reach nobody, and the model isn't told.** DeliveryConfig::default() is mode = "none", and deliver_if_configured returns early for any non-announce mode. The final message is then recorded in the job's run history and delivered to no one. Since the model cannot see that config, it cannot tell "I reported it" from "I wrote it where nobody looks", and can end a run stating it notified someone when nothing was sent. **The NO_REPLY sentinel is unreachable on purpose.** is_no_reply_sentinel / announce_delivery_decision honor it, but it appears in no prompt text, no tool schema (crates/zeroclaw-tools has no match), and no model-facing docs. The only party able
zeroclaw-labs/zeroclaw PR #9494 reports: Summary **Base branch:** master (all contributions) **What changed and why:** A cron trigger started a run and then stranded it: the maintenance tick had no agent loop attached, so ExecuteStep was only logged as pending. Cron-started runs now go through the shared headless run driver, the same one the HTTP-decide, WS-approval, and dashboard-run surfaces already used, so a scheduled procedure actually executes and advances to a terminal state. Driving those runs exposed that the headless path had no owner contract. It fell back to the alphabetically first configured agent, so an unattended procedure ran under an unrelated agent's provider, workspace, tool surface, and risk profile. A headless step now requires an owning agent that is configured and enabled, and refuses rather than borrowing an identity; strict authoring validation blocks saving a SOP whose headless triggers reach an unowned execute step. The headless path also ran agent::run with no per-run narrowing, so an automatic step could
zeroclaw-labs/zeroclaw PR #9841 reports: Continues #9494 by @Lusitaniae (with @pedrogomesyoo's follow-up commits), rebased onto current master and carrying their four commits unchanged. This branch adds the fixes for the four blocking findings raised in review, plus one further defect found while verifying them. Summary **Base branch:** master **What changed and why:** #9494 makes cron-started headless SOP runs actually execute and gives the headless path an owner contract. Review of it raised four blocking findings, and a second review pass found a fifth defect. This branch resolves all five: 1. **Mid-response tool-scope escape.** execute_tools_sequential received one ToolDispatchContext per response, so execute_one_tool checked an exclusion snapshot taken before the batch. A response containing tool_search followed by a deferred tool the step denies executed that tool; the boundary was only re-derived for the *next* provider request. The scope is now re-derived per call against the current callable set. 2. **Shutdown double-poll panic.** shutdown_with_deadlines drained the driver handles, then on timeout aborted and
Why it matters
An autonomous run that says “notified” when its output reached only history is operational fiction. The fix is small prompt text, but it matters because it aligns the model-visible contract with the host’s actual delivery and ownership rules. The operator test is whether the visible result, retained state and authority still describe the same event after retries, background work or restart.
Current
The primary record was open when captured on 2026-08-08. The release baseline was v0.8.4 published 2026-08-02T21:00:00Z. Repository metadata, source bodies, pull requests, issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/zeroclaw-labs/zeroclaw/pull/9842. Supporting records are https://github.com/zeroclaw-labs/zeroclaw/pull/9494 and https://github.com/zeroclaw-labs/zeroclaw/pull/9841. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Expose destination and silence semantics in every unattended turn, fail closed on missing owners, and retain tool-call evidence across approval resume and daemon reload. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.