feat: Policy RFC Engine (proposal-only)

[Freeak88]

Summary

Adds a conservative Policy RFC Engine that scans existing ClawSweeper durable records and generates reviewable RFC-style policy proposals from repeated operational patterns.

This is proposal-only infrastructure. It does not mutate GitHub, dispatch repairs, close issues, alter apply behavior, or change scheduler/automerge paths.

What changed

• Added src/policy-rfc/ with collector, scorer, synthesizer, types, and CLI runner.
• Added pnpm run policy-rfc.
• Added focused tests for pattern extraction, scoring, rejection of one-offs, deterministic RFC generation, JSON output, and malformed-record tolerance.
• Added docs/policy-rfc-engine.md.

How to try

pnpm run policy-rfc -- --target-repo openclaw/openclaw

Generates RFC proposals from local durable records without mutating GitHub.

Validation

Passed:

• pnpm install
• pnpm run build
• pnpm run build:all
• node --test test/policy-rfc.test.ts
• targeted oxlint
• targeted oxfmt

Full pnpm test reaches the build step successfully and then fails in this local Windows / Node 22.19.0 environment. The package requires Node >=24. Visible failures include path separator / CRLF assertions, Codex spawn EPERM, pnpm ENOENT in validation subprocesses, and one repair hydration assertion. The new Policy RFC tests pass.

RFC and JSON outputs are deterministic for the same input records to ensure stable diffs and testability.

Safety

The first version is intentionally local-record only and proposal-only. It does not hook into scheduler lanes or GitHub mutation paths.

Non-Goals

• No automatic policy execution
• No scheduler integration
• No GitHub mutation
• No additional load on review shards

[steipete]

Thanks for the substantial proposal. I am not treating this as landable in the current queue. It adds a new product surface and about a thousand lines of new policy-generation code, while the latest visible checks only include the notify workflow and the PR body says full local testing was not run under this repo's required Node >=24 environment.

Before this could move forward, it needs an explicit maintainer/product decision that ClawSweeper should own a Policy RFC Engine at all, plus a current rebase and full pnpm run check on Node 24+. Until then, it should stay out of the main maintenance/perf batch.