- C1: Removed weekly_strategy and meta_analysis from Elephant Alpha's SAFE_ACTIONS (orchestrator prompt and engine _ACTION_ZH) to prevent autonomous generation of scheduled reports
- C2: Removed hardcoded 0.85 confidence example from orchestrator prompt and implemented bounding validation (0.0~1.0) in _parse_strategic_decision
- C3: Expanded ADR-019 data freshness gate (_ppt_check_data_freshness) to cover /ppt weekly and /ppt strategy routes, proactively warning users of stale data
- B1 & B2: Updated SQL column names from 銷售金額 to 總業績 in openclaw_strategist_service.py and chart_generator_service.py
- B3: Removed bare except statements in DB fetchers to raise errors instead of failing silently
- B4: Implemented freshness gate (MAX(snapshot_date) < CURRENT_DATE - 2) in daily_sales_snapshot to prevent generating stale reports and send data stalled alerts
- B5: Replaced hardcoded 45.0 system load percentage with actual psutil CPU metric
Critic-approved 3-point revision (REVISE → adopted):
1. Disable weekly_insight trigger at definition (line 279-285) — EA no
longer evaluates the 6h / >=5 ai_insights condition that fired
_generate_strategy_report without force_tg_alert=True.
2. Remove the openclaw weekly/meta dispatch table branches (line 591-606).
The 5 actions (generate_strategic_analysis, generate_weekly_strategy,
generate_market_analysis, generate_pricing_strategy,
generate_meta_analysis) now fall through to the existing
`raise ValueError(f"Unrecognized step: ...")` at line 631, which
_execute_decision's try/except converts into a circuit-breaker failure.
This is the correct failure semantics critic asked for.
3. Convert _generate_strategy_report / _generate_meta_report into hard
RuntimeError raisers and drop their imports of
openclaw_strategist_service. Deep insurance: any future caller crashes
immediately instead of silently bypassing dedupe.
Evidence: ai_insights logged 35+ duplicate weekly_strategy sends in 7 days
because EA's `_generate_strategy_report` invoked
generate_weekly_strategy_report() without force_tg_alert=True, bypassing
the run_scheduler.py weekly dedupe gate.
Out of scope (per task contract):
- run_scheduler.py:115 Monday 06:00 schedule — preserved (sole owner)
- services/openclaw_strategist_service.py — owned by B-series (SQL)
- Other EA triggers (price_drop_alert / market_opportunity /
threat_escalation / code_exception / resource_optimization) — preserved
- Other dispatch branches (hermes / nemotron / auto_heal / code_fix /
price_adjustment review) — preserved
- Did NOT add force_tg_alert=True defensive layer (critic flagged as
anti-pattern)
- Did NOT touch _TRIGGER_TO_DECISION_TYPE / _ALLOWED_ACTION_TYPES
Not pushed, not deployed. D1 deployment will be issued separately and
must use `docker compose up -d --no-deps --force-recreate momo-scheduler`
(per feedback_compose_restart_vs_up).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Root cause: OPENROUTER_API_KEY not set → fallback confidence=0.60 →
always below threshold → _escalate_to_human() every 60s loop → infinite
Telegram messages, all meaningless.
Three-layer fix:
1. API Key detection: if fallback_decision triggered (reasoning contains
"Elephant Alpha unavailable"), silently skip — no Telegram, no cost,
update last_triggered to prevent infinite retry
2. Per-trigger cooldown in _check_triggers():
price_drop_alert 30min / market_opportunity 60min /
threat_escalation 15min / resource_optimization 60min
3. Escalation dedup in _escalate_to_human(): _last_escalated[] tracks
last Telegram send time per trigger type; suppresses within cooldown
Valid HITL escalations (when EA is actually online) still work correctly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
