Public observer API

• Status: active operator reference
• Owner: ClawSweeper dashboard maintainers
• Source of truth: dashboard/worker.ts request routing, dashboard/public-triage.ts triage projections, and their focused tests
• Last verified: openclaw/clawsweeper@647503ec44b8e777dd172adf974a945367da0d19
• Update when: a public observer route, method, query parameter, response source, or authentication boundary changes
• Checked by: pnpm run check:docs

The dashboard Worker exposes the following unauthenticated observer routes. They support current dashboard and operator diagnostics; this inventory does not promise a versioned compatibility period. Routes under /internal/, event ingest, and the GitHub webhook are mutation or trust-boundary surfaces and are deliberately not public API. ANY records a current method-agnostic routing branch, not a promise that every method will remain supported.

config/operator-documentation.json is the checked route inventory. Adding or removing a literal observer route in dashboard/worker.ts requires updating that manifest and this table. The checker excludes /api/events, because it is an ingest mutation rather than an observer route.

For egress field interpretation, use GitHub publication egress telemetry. For other fields, use Live dashboard.

The publication endpoint's batch.reason_counts groups the same retained events by outcome (superseded, retryable, permanent) and validated reason code. Each outcome includes unrecorded for historical or synthesized events without a recorded reason. Its reason counts sum to that outcome's count. A null breakdown means the breakdown is unavailable; existing outcome totals remain valid. These are publication outcome events, not unique reviews or unresolved targets. Free-text errors and fingerprints are never public reason labels.

Public observer routes are projections, not private-store serializers. Internal Durable Object state may retain item keys, repository selectors, workflow/job metadata, failure details, run links, revision digests, and sampled records for binding-authenticated workflows. The Worker allowlists fixed aggregate fields before an unauthenticated response is serialized. Unknown or malformed shapes fail closed and caught storage errors use fixed categories without interpolating the underlying exception.

The two triage APIs use schema version 2 and expose only a normalized generated_at, complete, bounded error_count, a count map keyed by closed view IDs, and static view descriptors with bounded total_count and item_limit. Every compatibility items array is empty. Their private in-memory GitHub collection may use repository, item, title, URL, query, author, assignee, label, proof-state, and diagnostic data, but the public projector drops those fields before fresh or stale cache serialization. The projector runs again on cache reads, including raw legacy cache bodies. Invalid or uncertain input returns a fixed incomplete projection with null counts; raw diagnostic text is never returned. The unauthenticated triage pages therefore have no per-item lists, filters, chips, or links. Those capabilities require a separately authenticated operator surface, which does not currently exist.

/api/triage derives view membership from labels and counts from GitHub Search total_count; it does not fetch linked-PR metadata or compute routing groups. GraphQL enrichment failures, missing enrichment auth, and enrichment truncation therefore do not make valid counts incomplete. Label/Search source failures and Search budget exhaustion still contribute to error_count and keep complete false.

/api/exact-review-queue retains closed recovery-reason counts for claim_timeout, execution_timeout, workflow_cancelled, and workflow_failed, review shed counts by backpressure, scheduled_rate, and unattributed, and the scheduled admission budget: global and per-lane token_balance (signed), burst, lane target_rate_per_hour, and the throttle pause timestamps (see Automation limits). It omits the throttle source label, and it omits per-member, per-target, ownership, fingerprint, detail, raw timing, and internal-key records. Activity is producer-composed from a complete census so queue/live overlap is counted once; incomplete or legacy shapes cannot claim a complete activity aggregate. Its optional bounded reference sample contains canonical repository, positive item_number, closed stage, and closed source fields for repositories in PUBLIC_BAY_REPOS. It may also carry a validated action descriptor: canonical public repository/run/job identifiers, a canonical start timestamp, and a bounded ordered list of fixed step kinds and closed states. A reference may carry a separate timing descriptor containing only kind=queue with the validated queue creation time or kind=run with the validated public action start time. These clocks are elapsed queue/run context, not inferred visual lane-entry times. The same sample feeds Overview cards, search, overflow lists, and detail blades. Queue references may additionally carry review_failure: { stage, reason }: closed, allowlisted categories from the observed failure of that review identity. This is not raw diagnostic text or a root cause inferred from exhaustion. Missing legacy evidence remains unavailable; new review identities must not inherit an earlier identity's cause. The field is not carried on live repair or terminal-outcome references. Live references may carry activity_kind: review | repair from the producer's closed work classification, independently of their current visual stage; absent evidence remains an unspecified live workflow. Queue and terminal references do not carry this live-only identity. Titles, raw step names, source URLs, queries, opaque keys, failure payloads, credentials, tokens, and non-allowlisted repositories are not projected.

The queue response also includes review_failure_health, a closed one-hour aggregate of failed review attempts. It reports retryable and terminal counts, affected-target and repeated-source-identity counts, fixed stage buckets, and first/last timestamps. It never publishes repository, item, run, revision, fingerprint, path, detector, or scanner-output detail. The signed operator-only /internal/exact-review/review-failures/list route retains those bounded identities for incident investigation without storing raw failure text.

The optional review_runaway_health object is a closed trailing-24-hour alert: status (healthy, degraded, or unknown), reason, window_hours, threshold_reviews_per_day, runaway_items, and sample_item_keys. Samples are at most five canonical owner/repo#number keys for repositories in PUBLIC_BAY_REPOS; private-repository runaways are counted but not named, and run, revision, and per-item review counts are not projected. A missing or malformed object projects as null.

The GitHub-egress response exposes only revision-independent closed dimensions and sanitized retention watermarks. query_complete describes retained evidence, not the existence of traffic in every clock bucket.

Local monitoring must apply the same data-minimization rule. Persist only the bounded counts, closed categories, timestamps, and allowlisted repository/item references required by the monitor. Do not archive complete raw observer responses, arbitrary response fields, titles, source URLs, failure payloads, or internal keys for later filtering.