YM-OpenClaw

Summary¶

Track the next major development phase after the enrollment discovery, guarded navigation-agent, and registered-user detection work in #3841, #3842, and #3843. Turn the working Identity Vault prototype into a production-ready passkey lifecycle system that behaves reliably across real relying parties.

Baseline: commit c7bc58c6 establishes explicit post-login consent, model-first enrollment navigation, event-driven page readiness, deterministic accessibility-tree fallback, and ceremony capture that remains authoritative across slow model inference.

Objectives¶

• Exercise the complete lifecycle on a representative live-site matrix: password-to-passkey conversion, proactive enrollment after login/signup, and passkey-first authentication.
• Generalize behavior across reauthentication gates, SPA navigation, interstitials, conditional WebAuthn/FedCM, redirects, and slow model decisions without adding one-off site heuristics.
• Make workflow state and terminal outcomes authoritative across asynchronous browser, model, and RP events; a captured ceremony plus RP acceptance must end the flow and clear all stale guidance.
• Add safe recovery and durable user handoff for flows automation cannot finish, with no orphan tabs, stuck shims, duplicate ceremonies, or misleading success.
• Produce privacy-preserving, redacted diagnostics and a failure taxonomy that make live failures actionable without exposing credentials or authenticated page content.
• Harden browser/gateway lifecycle behavior across reconnects and restarts, and document supported configuration and operational limits.

Acceptance criteria¶

• A documented live acceptance matrix covers multiple representative RPs and every primary lifecycle behavior.
• Enrollment and sign-in complete end-to-end on the target matrix, including at least one reauthentication flow and one SPA/interstitial flow.
• Slow inference and late ceremony events cannot produce stale handoff or guidance UI after success.
• Every unsuccessful run ends in a bounded, safe, user-visible outcome with a redacted diagnostic trace.
• Reconnect/restart testing leaves credentials intact and no observer, shim, tab, or banner state orphaned.
• Pure-function regression coverage, TypeScript lint/build, and the full plugin unit suite pass; browser behavior is verified live rather than through elaborate mocks.
• Deployment/configuration documentation identifies the production-ready path and any remaining limitations.

Scope rule¶

Site-specific failures belong here only when they expose a general lifecycle, perception, navigation, or browser-integration defect. Avoid per-site selector or route patches.