build(deps): update crawlkit to v0.16.7

[vincentkoc]

Related: #260

What Problem This Solves

Slacrawl still pins Crawlkit v0.16.4; the existing v0.16.6 contributor branch cannot be edited and now needs to differ for v0.16.7.

User Impact

User impact: no CLI or archive contract changes; Slacrawl adopts the current Crawlkit patch release.

Why This Change Was Made

Updates only go.mod and go.sum to v0.16.7. This supersedes #260 because maintainer edits are disabled and its target version is now stale. Peter Steinberger is preserved as co-author.

Evidence

• Focused Crawlkit owner packages passed.
• Module verification passed.
• Full race suite passed before the clean-tree smoke gate.
• Full local and hosted exact-head checks are tracked on this draft.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed October 2, 2026, 2:00 PM ET / 18:00 UTC (Revision 4).

ClawSweeper review

What this changes

Updates CrawlKit, Slacrawl’s shared archive library, from v0.16.4 to v0.16.7 and replaces its module checksums.

Merge readiness

⛔ Blocked before merge - 3 items remain

The v0.16.7 update remains distinct from the v0.16.6 update now shipped on main. No introduced correctness defect was found, and this member-authored PR remains eligible for maintainer handling.

Priority: P3
Reviewed head: 8f9ec83b22a95c13bdfeb9fba350139f1b0b6363

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused dependency update with supporting validation and no identified patch defect; cooldown and conflict handling remain workflow blockers.
Proof confidence	🌊 off-meta tidepool	Not applicable: The author is a repository MEMBER, so ordinary contributor runtime proof is exempt. Supplied checks support integration, while source inspection shows the new patch changes an unimported snapshot package and no Slacrawl stored-data contract.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The author is a repository MEMBER, so ordinary contributor runtime proof is exempt. Supplied checks support integration, while source inspection shows the new patch changes an unimported snapshot package and no Slacrawl stored-data contract.
Evidence reviewed	8 items	Pinned introduced change: The verified merge-base-to-head delta changes only the CrawlKit requirement and its two checksums; other dependency pins remain unchanged. Both checksum blobs were inspected. Current main and shipped baseline: Current main still requires CrawlKit v0.16.6. Its changelog records that update in v0.10.2, whose GitHub release was published at 2026-10-02T17:22:18Z. The merged #260 therefore does not implement the requested v0.16.7 update. Dependency cooldown: CONTRIBUTING.md requires dependency updates to wait at least two days after release. The reviewed head has not changed since the previous review, and the author explicitly retained the draft while waiting. At review time, 2026-10-02T17:59:58Z, even the verified tag-based minimum had not elapsed.
Findings	None	None.
Security	None	None.

How this fits together

Slacrawl uses CrawlKit for shared configuration, SQLite access, Git mirrors, terminal browsing, and control metadata. Slack-specific ingestion and archive schemas remain owned by Slacrawl.

flowchart LR
  A[Slack archive commands] --> B[Slacrawl application]
  C[Dependency version and checksums] --> D[CrawlKit shared library]
  B --> D
  D --> E[Local SQLite archive]
  D --> F[Git mirrors and terminal output]

Loading

Before merge

• Resolve merge risk (P1) - The dependency cooldown remains active: confirm completed v0.16.7 publication and wait until at least 2026-10-03T07:56:58Z, or later if publication completed later.
• Resolve merge risk (P1) - The current branch has merge conflicts; its resolution needs validation against the now-shipped v0.16.6 baseline.
• Complete next step (P2) - Confirm v0.16.7 publication and satisfy the two-day cooldown, then resolve the main-branch conflicts, validate the updated head, and mark the PR ready.

Agent review details

Security

None.

Review metrics

None.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Land a minimal, validated v0.16.6-to-v0.16.7 update after publication and cooldown requirements are satisfied, preserving existing archive and dependency contracts.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Land a minimal, validated v0.16.6-to-v0.16.7 update after publication and cooldown requirements are satisfied, preserving existing archive and dependency contracts.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates a dependency pin and does not report a reproducible Slacrawl bug.

Is this the best way to solve the issue?

Yes: changing only the module requirement and checksums is the narrowest update path, and inspection found no changed imported API or stored-data contract.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 04cfc53efaa3.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is a routine dependency patch update with no demonstrated urgent Slacrawl regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The author is a repository MEMBER, so ordinary contributor runtime proof is exempt. Supplied checks support integration, while source inspection shows the new patch changes an unimported snapshot package and no Slacrawl stored-data contract.

Evidence

What I checked:

• Pinned introduced change: The verified merge-base-to-head delta changes only the CrawlKit requirement and its two checksums; other dependency pins remain unchanged. Both checksum blobs were inspected. (go.mod:12, 8f9ec83b22a9)
• Current main and shipped baseline: Current main still requires CrawlKit v0.16.6. Its changelog records that update in v0.10.2, whose GitHub release was published at 2026-10-02T17:22:18Z. The merged build(deps): update crawlkit to v0.16.6 #260 therefore does not implement the requested v0.16.7 update. (go.mod:12, 04cfc53efaa3)
• Dependency cooldown: CONTRIBUTING.md requires dependency updates to wait at least two days after release. The reviewed head has not changed since the previous review, and the author explicitly retained the draft while waiting. At review time, 2026-10-02T17:59:58Z, even the verified tag-based minimum had not elapsed. (CONTRIBUTING.md:31, 8f9ec83b22a9)
• Verified dependency tag: The annotated v0.16.7 tag points to 33d2d16c9b97fb9c4e245cafd4bf92502588d13a and records 2026-10-01T07:56:58Z. Its two-day minimum is 2026-10-03T07:56:58Z, later than the proxy timestamp cited by the author. The GitHub release-by-tag endpoint returned 404, so completed release publication remains unverified. (33d2d16c9b97)
• Affirmative dependency boundary: Slacrawl directly imports CrawlKit store, configuration, mirror, control, progress, release-check, and TUI packages. No Go source imports CrawlKit snapshot or vector. This establishes why dependency compatibility was inspected without importing unrelated downstream policies. (internal/store/store.go:13, 8f9ec83b22a9)
• Dependency compatibility and supply-chain scope: The complete v0.16.6-to-v0.16.7 comparison changes only snapshot sidecar handling, its regression tests, and release notes. The broader v0.16.4-to-v0.16.7 file inventory leaves Slacrawl’s imported package sources unchanged. CrawlKit’s SQLite v1.59.0 and libc v1.75.7 requirements already match Slacrawl. The dependency AGENTS.md was read fully; its published-tag and downstream compatibility guidance informed this check. (snapshot/sidecar.go:119, 33d2d16c9b97)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (3 earlier review cycles)

• reviewed 2026-10-01T08:25:19.938Z sha 8f9ec83 :: blocked before merge. :: none
• reviewed 2026-10-02T06:01:08.206Z sha 8f9ec83 :: blocked before merge. :: none
• reviewed 2026-10-02T15:49:07.736Z sha 8f9ec83 :: blocked before merge. :: none

[vincentkoc]

Hold evidence:

• github.com/openclaw/crawlkit@v0.16.7 resolves publicly to 33d2d16c9b97fb9c4e245cafd4bf92502588d13a with proxy timestamp 2026-10-01T07:50:56Z.
• Exact head 8f9ec83b22a95c13bdfeb9fba350139f1b0b6363 has all hosted checks green.
• ClawSweeper found no correctness or security defect; its remaining blocker is Slacrawl’s documented two-day dependency cooldown.
• Earliest policy-compliant landing: 2026-10-03T07:50:56Z.

This PR remains draft until that time.