Release trusted ClawPack package 0.1.9

Author: romgenie

.github/workflows/clawhub-publish.yml

@@ -41,7 +41,7 @@ jobs:
       id-token: write
     uses: openclaw/clawhub/.github/workflows/package-publish.yml@v0.18.0
     with:
-      source: ./clawpack/completetech-openclaw-mautic-plugin-0.1.8.tgz
+      source: ./clawpack/completetech-openclaw-mautic-plugin-0.1.9.tgz
       dry_run: false
       source_repo: CompleteTech-LLC-AI-Research/openclaw-mautic-plugin
       source_commit: ${{ github.sha }}

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.9 - 2026-05-26
+
+- Excluded local release helper scripts from the published ClawPack artifact to reduce ClawHub static-scan noise.
+- Documented that ClawHub still reports community ClawPack bundle releases as `artifact-only` even after official OIDC trusted publishing.
+
 ## 0.1.8 - 2026-05-26
 
 - Added GitHub Actions OIDC trusted publishing for ClawHub.

README.md

@@ -196,6 +196,8 @@ Releases are published as a ClawPack npm-pack artifact, not the older legacy zip
 Trusted publishing uses GitHub Actions OIDC; no long-lived ClawHub token is stored in repository secrets.
 The GitHub workflow publishes the checked-in `clawpack/` tarball through ClawHub's official reusable workflow so the release can use both official OIDC and the `npm-pack` artifact path.
 
+Current ClawHub behavior: the release is source-linked to the GitHub commit and passes ClawHub's source provenance readiness check, but community ClawPack bundle releases still display `artifact-only` verification with `hasProvenance=false`.
+
 For a future release:
 
 ```bash

clawpack/completetech-openclaw-mautic-plugin-0.1.8.tgz

@@ -48,7 +48,7 @@ Result:
   "name": "@completetech/openclaw-mautic-plugin",
   "displayName": "Mautic Control",
   "family": "bundle-plugin",
-  "version": "0.1.8"
+  "version": "0.1.9"
 }
 ```
 
@@ -67,7 +67,7 @@ Result: passed. ClawHub detected:
   "name": "@completetech/openclaw-mautic-plugin",
   "displayName": "Mautic Control",
   "family": "bundle-plugin",
-  "version": "0.1.8"
+  "version": "0.1.9"
 }
 ```
 

clawpack/completetech-openclaw-mautic-plugin-0.1.9.tgz

@@ -6,7 +6,7 @@ Historical/alternate handoff only. The repository is currently public, so this p
 
 - Package name: `@completetech/openclaw-mautic-plugin`
 - Plugin id: `mautic-control`
-- Version: `0.1.8`
+- Version: `0.1.9`
 - Source repository: `CompleteTech-LLC-AI-Research/openclaw-mautic-plugin`
 - Current source visibility: public
 - Branch: `main`

docs/CLAWHUB_READINESS.md

@@ -8,7 +8,7 @@ This package is configured for GitHub Actions OIDC trusted publishing.
 - Repository: `CompleteTech-LLC-AI-Research/openclaw-mautic-plugin`
 - Workflow file: `clawhub-publish.yml`
 - Artifact format: ClawPack `npm-pack` `.tgz`
-- Workflow artifact: `./clawpack/completetech-openclaw-mautic-plugin-0.1.8.tgz`
+- Workflow artifact: `./clawpack/completetech-openclaw-mautic-plugin-0.1.9.tgz`
 
 ## Workflow
 
@@ -51,6 +51,20 @@ Current limitation: ClawHub's official reusable workflow does not expose a
 the scan note for manual reviewed publishes, but trusted OIDC publishes through
 the official workflow cannot attach that note until ClawHub adds the input.
 
+## Current Verification Status
+
+The trusted workflow publish proved that ClawHub accepts the official
+OIDC workflow and records the correct source commit, but ClawHub still reports
+`verification.scope` as `artifact-only` and `hasProvenance` as `false` for this
+community `bundle-plugin` ClawPack release. The package readiness API separately
+passes the source provenance check and reports the official-channel status as the
+only blocker.
+
+Treat the current ClawHub-side limitation as: trusted GitHub Actions publishing
+is active and source-linked, but ClawHub has not upgraded community ClawPack
+bundle releases from `artifact-only` verification to provenance-backed
+verification.
+
 ## Trusted Publisher Config
 
 ClawHub trusted publisher config should report:

docs/PRIVATE_SOURCE_REVIEW_REQUEST.md

@@ -2,7 +2,7 @@
   "id": "mautic-control",
   "name": "Mautic Control",
   "description": "Typed tools for controlled Mautic REST API access, webhook inspection, optional console maintenance, and optional workspace file staging.",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "contracts": {
     "tools": [
       "mautic_status",

docs/TRUSTED_PUBLISHING.md

@@ -1,6 +1,6 @@
 {
   "name": "@completetech/openclaw-mautic-plugin",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "OpenClaw plugin for controlled Mautic API, webhook, console bridge, and workspace operations.",
   "type": "module",
   "private": false,
@@ -36,7 +36,6 @@
     "CHANGELOG.md",
     "docs/",
     "mautic/",
-    "scripts/",
     "skills/"
   ],
   "scripts": {