[Patrick-Erichsen]

Summary

A retained upload containing ordinary PCM audio can finish text inspection but remain blocked because the adapter rejects its WAV binary exclusion. Add original-byte structural evidence and independently validate it before admitting the existing exclusion.

complete canonical binary bytes
  → strict RIFF/WAVE PCM fmt+data proof
  → Go field/size/frame validation + explicit binary exclusion
  → existing integrity, YARA, reference and semantic requirements

Only visible, non-executable .wav assets with exact headers, sizes, frame arithmetic and padding qualify. Extra chunks/trailers, unknown codecs, truncated bytes, hidden/nested artifacts and malformed evidence fail closed. Raw findings, decoded line counts and semantic completeness remain unchanged.

Related: openclaw/clawhub#4046. Production activation and original publication recovery follow separately.

Evidence

• Before: The unchanged PixelLab 3.0.0 report fails component/exclusion accounting despite inspecting all126 text files.
  After: The installed candidate and actual Go adapter accept inventory127 / text126 and reconcile all147 references. All127 original files /1,101,503bytes and all58 findings remain unchanged; the WAV keeps its explicit binary exclusion and informational686-line count. Static-only reports still fail final LLM completion.
• All30 retained originals preserve their inventories, full finding payloads (except generated IDs), complete analysis-completeness payloads, suppressions and risk. The sole component delta is PixelLab's exact PCM evidence.
• 109 PCM controls (including normal populated-cache and UTF8-text negative cases),1279 installed adapter controls and861 source integration controls pass. All138 source/resource/dependency identities reconstruct exactly; all136 installed package hashes match. Full Go tests/vet, public help and docs build pass. Independent cumulative producer and consumer P0–P3 reviews are complete with no actionable findings.

Merge Danger

Door: two-way

Revert the source/runtime change before adoption if needed. No data migration or publication retry is included.

Blast Radius: scanner

Extends only the pinned producer's explicit PCM binary-exclusion contract; operational completion remains separate from a security verdict or publication approval.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.