Operate, retire, and defend the research-skill capstone

Verifiedon 2026-07-302026.7.1

Capstone brief — constrained release researcher

Build a read-only skill or bounded tool that accepts a topic and returns no more than three findings from one approved public source. Each finding must include a short claim, canonical URL, retrieval timestamp, and source identifier. It may not send a message, create an issue, modify a file, use a personal browser profile, or access a credential beyond a disposable test fixture.

This is an operations capstone, not a request to make an agent more autonomous. The reviewer should be able to understand what it can reach, reproduce a safe result, observe a blocked request, activate the kill switch, and verify that retirement leaves no active connection. Treat the capability as ready for assessment only when those proofs exist.

Use the pinned OpenClaw skills source and CLI skills source for packaging and inspection claims. If you choose an external tool or MCP server, consult the MCP source and the tool-policy source. All four are pinned to revision 2d2ddc43d0dcf71f31283d780f9fe9ff4cc04fe4 and verified against 2026.7.1.

Delivery pack

1. Decision record. Explain why this surface is smaller than the rejected alternatives. State the source allowlist and explicitly exclude credentials, writes, local files, and personal browser state.
2. Contract. Define input limits, source allowlist, result schema, error statuses, timeout, retry policy, and the sideEffects: [] invariant.
3. Permission worksheet. Record artifact/version, requested authority, containment, owner, expiry, and exact revoke action. If no external supplier is used, say so and record the runtime surface instead.
4. Fixture proof. Show success, invalid input, unavailable source, and blocked side-effect cases with expected versus actual output and invocation counts.
5. Operation note. Include non-secret run IDs, timestamps, source URLs, redacted logs, freshness owner, review date, and the condition that triggers disablement.
6. Retirement proof. Document disable action, disconnect/revoke action, cleanup inventory, and a post-removal denial result.

{
"status": "ok",
"findings": [{
  "claim": "Release note found",
  "canonicalUrl": "https://github.com/openclaw/openclaw/releases",
  "retrievedAt": "2026-07-30T00:00:00Z",
  "sourceId": "openclaw-releases"
}],
"sideEffects": [],
"runId": "capstone-fixture-001"
}

Reviewer walkthrough

Ask the reviewer to submit a valid fixture query, a malformed query, and a request to publish a finding. The first must return cited structured evidence; the second must fail before invocation; the third must be blocked before any side effect. Then have the reviewer activate the kill switch and confirm a valid fixture query is denied. Finally, remove the test configuration and prove no test credential or active connection remains.

The walkthrough is deliberately adversarial. A demo that shows only the valid query proves very little. The reviewer should inspect the source URL, compare the returned claim to fixture evidence, and check that timestamps are generated at retrieval rather than copied from the model. For the malformed query, inspect invocation count. For the publish request, inspect both status and side effects. For retirement, make the denied call after configuration removal, not merely after setting a flag in memory.

Worked example — operating record

A good operation note might say: capstone-fixture-001 ran at 2026-07-30T10:01:00Z; source openclaw-releases-fixture; policy allowlisted,dry-run; one fixture call; three findings; sideEffects=[]; reviewer operator-01; next review 2026-08-29. It should link the immutable source receipt and the learner’s fixture artifact. It should not include a token, a personal URL, or a full model prompt containing private context.

If the source is unavailable, keep the operation record and mark source_unavailable; do not edit the claim into a plausible answer. If the contract changes, increment the artifact version, rerun the negative fixtures, and obtain a new review rather than quietly replacing the old evidence. If a source changes its URL structure, update the allowlist and source receipt together. Freshness is an operating control, not just an SEO field.

Hands-on lab — defend and retire

Assemble the six-part delivery pack. Run the reviewer walkthrough in a disposable environment. Capture expected and actual results, invocation counts, a redacted log, and the exact command or configuration edit used for disablement. Then run the post-removal denial test with the same valid query. The expected result is capability_disabled or the project’s documented equivalent, with zero invocation and no remaining test credential.

Failure cases include a finding with no canonical URL, a source timestamp invented by the model, a hidden write through an “export” button, a kill switch that only affects the UI, stale fixture evidence after contract changes, or a cleanup step that leaves a server registration active. Rollback is the capstone’s normal terminal state: disable and remove the capability, revoke disposable access, preserve redacted evidence, restore the approved baseline, and open a review note if any state is unknown.

Rubric

A pass means another operator can reproduce the evidence and remove the capability, not that the learner has earned a certification. The course intentionally uses a local, account-free learner artifact; it is not a production approval.

Checkpoint

A reviewer asks the capability to publish a finding. What is the correct result?

A. Publish because the reviewer asked B. Return ok but omit the URL C. Return side_effect_blocked, preserve sideEffects: [], and require a separately reviewed workflow D. Ask the model to decide whether the reviewer has enough authority

Answer: C. The capstone’s authority is read-only research. A user request cannot expand a declared contract, and a blocked action should remain distinguishable and auditable.

Final artifact and publication boundary

Submit the delivery pack, reviewer walkthrough, source links, fixture output, redacted operation note, and retirement proof. The editor records the supported version/revision, reviewed source snapshots, video decision if any, learner-facing changes, reviewer, and next due date in the changelog. The course boundary is explicit: this capstone teaches a read-only, fixture-backed workflow and is not a production configuration guide. Re-check the pinned references when the implementation surface changes; they bound platform concepts, while the delivery pack remains the evidence for this decision.