fix: flag stale OpenClaw plugin prereleases

cmd/rampart/cli/doctor.go

@@ -1635,23 +1635,15 @@ func normalizedReleaseVersion(version string) (string, bool) {
 	if strings.Contains(version, "-g") {
 		return "", false
 	}
-	base := strings.SplitN(version, "+", 2)[0]
-	version = strings.SplitN(base, "-", 2)[0]
-	parts := strings.Split(version, ".")
-	if len(parts) != 3 {
+	parsed, ok := parseReleaseVersion(version)
+	if !ok {
 		return "", false
 	}
-	for _, part := range parts {
-		if part == "" {
-			return "", false
-		}
-		for _, r := range part {
-			if r < '0' || r > '9' {
-				return "", false
-			}
-		}
+	normalized := fmt.Sprintf("%d.%d.%d", parsed.major, parsed.minor, parsed.patch)
+	if len(parsed.prerelease) > 0 {
+		normalized += "-" + strings.Join(parsed.prerelease, ".")
 	}
-	return version, true
+	return normalized, true
 }
 
 func isGoPseudoVersion(version string) bool {

cmd/rampart/cli/doctor_test.go

@@ -682,6 +682,9 @@ func TestPluginVersionMatchesBuildVersion(t *testing.T) {
 		{"0.9.22", "0.9.22", true},
 		{"0.9.22", "v0.9.23", false},
 		{"1.0.0-rc.1", "v1.0.0-rc.1", true},
+		{"1.0.0-rc.2", "v1.0.0-rc.3", false},
+		{"1.0.0-rc.2", "v1.0.0", false},
+		{"1.0.0", "v1.0.0-rc.2", false},
 		{"0.9.22", "v1.0.0-rc.1", false},
 		{"0.9.22", "v0.9.22-staging-47fa0cf", true},
 		{"0.9.22", "v0.9.22-33-g47fa0cf", true},

docs-site/index.md

@@ -208,7 +208,7 @@ verify -> outcomes.approval
 ## What's New in v1.0
 
 - **Update checks are sane** — `rampart doctor` understands the 1.0 release line and no longer suggests downgrading release candidates to the older stable `v0.9.22` release.
-- **OpenClaw 2026.5.4 verified for launch** — Rampart uses OpenClaw's first-class plugin approval path as the single human-approval owner, with Rampart handling policy, audit, and durable allow-always persistence. [Details →](integrations/openclaw.md)
+- **OpenClaw 2026.5.6 verified for launch** — Rampart uses OpenClaw's first-class plugin approval path as the single human-approval owner, with Rampart handling policy, audit, and durable allow-always persistence. [Details →](integrations/openclaw.md)
 - **Degraded mode is explicit** — sensitive OpenClaw tools block when `rampart serve` is unavailable, while only configured lower-risk `failOpenTools` may proceed.
 - **Setup and doctor are launch-strict** — `rampart setup openclaw` installs the native plugin cleanly, repairs approval-hardening drift, and `rampart doctor` checks plugin state, serve reachability, approval timeout alignment, and version coherence.
 - **Matching and bypass regressions are tighter** — shell-wrapper normalization, URL/domain handling, path matching, and OpenClaw plugin approval/degraded-mode tests now cover the hard edges found during the 1.0 RC pass.

docs-site/integrations/openclaw.md

@@ -16,7 +16,7 @@ For sensitive tools, the recommended operating assumption is simple: if Rampart
     - **OpenClaw 2026.4.29 - 2026.5.1**: Supported for native plugin startup/interception; plugin approval delivery was not the launch baseline.
     - **OpenClaw 2026.3.28 - 2026.4.28**: Native plugin works for tool enforcement, but Rampart's polished approval path is supported on newer OpenClaw builds.
     - **OpenClaw < 2026.3.28**: Legacy shim + bridge — exec-only coverage, requires re-patching after upgrades.
-    - **Verified 1.0 launch dogfood on**: OpenClaw 2026.5.4
+    - **Verified 1.0 launch dogfood on**: OpenClaw 2026.5.6
 
     `rampart setup openclaw` auto-detects your version and uses the right method.
 

docs/ROADMAP.md

@@ -47,7 +47,7 @@ What's coming next for Rampart. Priorities shift based on feedback — [open an
 
 ### `v1.0.0`
 - Keep the integration support story boring and evidence-backed: hooks, plugins, preload/wrapper, MCP, and HTTP API should each say what is protected and what happens when policy evaluation is unavailable.
-- Treat OpenClaw `2026.5.2+` as the recommended 1.0 path for native plugin approvals, with launch dogfood verified on OpenClaw `2026.5.4`.
+- Treat OpenClaw `2026.5.2+` as the recommended 1.0 path for native plugin approvals, with launch dogfood verified on OpenClaw `2026.5.6`.
 - Keep `rampart doctor`, setup output, plugin metadata, and docs aligned so users can answer "am I protected, how, and what breaks if serve is down?" without reading source.
 
 ### After 1.0