docs(release): align entry path with public shell

Author: Gk0Wk

docs/releases/2026-03-14-first-usable-version-acceptance-checklist.md

@@ -4,7 +4,8 @@ Use this checklist before sharing the current install-demo baseline as the **fir
 
 - [ ] Default install path stays `openclaw plugins install .\plugins\openclaw-clawguard`
 - [ ] Optional tarball path stays local-only and unpublished
-- [ ] Smoke path works on `/plugins/clawguard/dashboard`, `/plugins/clawguard/checkup`, `/plugins/clawguard/approvals`, `/plugins/clawguard/audit`, and `/plugins/clawguard/settings`, with repeatable HTTP-level regression coverage on the plugin-owned direct-route surface
+- [ ] Browser-facing smoke path works on `/clawguard`, `/clawguard/checkup`, `/clawguard/approvals`, `/clawguard/audit`, and `/clawguard/settings`
+- [ ] Protected backing routes remain available under `/plugins/clawguard/*` for the public shell and regression coverage
 - [ ] Demo order stays fake-only across `exec`, outbound, and workspace mutation examples
 - [ ] Public wording says **install-demo only / unpublished / fake-only**
 - [ ] Public wording does **not** claim GA, registry publish, real outbound proof, real money movement, or broad workspace coverage

docs/releases/2026-03-14-first-usable-version-announcement-draft.md

@@ -13,11 +13,11 @@ What you can do today:
 1. Install locally from the repo root with `openclaw plugins install .\plugins\openclaw-clawguard`
 2. Restart OpenClaw
 3. Open:
-   - `/plugins/clawguard/dashboard`
-   - `/plugins/clawguard/checkup`
-   - `/plugins/clawguard/approvals`
-   - `/plugins/clawguard/audit`
-   - `/plugins/clawguard/settings`
+   - `/clawguard`
+   - `/clawguard/checkup`
+   - `/clawguard/approvals`
+   - `/clawguard/audit`
+   - `/clawguard/settings`
 4. Walk through a narrow fake-only demo across risky `exec`, minimal outbound review points where host-level direct sends stay on the hard-block path, and workspace mutation actions currently limited to `write` / `edit` / `apply_patch`
 
 What this proves:

docs/releases/2026-03-14-first-usable-version-release-note-internal-draft.md

@@ -14,14 +14,15 @@ It does **not** broaden runtime scope. It packages the current codebase and unre
 
 ### Runtime / operator surface
 
-- OpenClaw native plugin install from local repo path
-- Optional local tarball path for demo packaging only
-- Plugin-owned pages:
-  - `/plugins/clawguard/dashboard`
-  - `/plugins/clawguard/checkup`
-  - `/plugins/clawguard/approvals`
-  - `/plugins/clawguard/audit`
-  - `/plugins/clawguard/settings`
+- OpenClaw native plugin install from local repo path
+- Optional local tarball path for demo packaging only
+- Plugin-owned public shell browser path:
+  - `/clawguard`
+  - `/clawguard/checkup`
+  - `/clawguard/approvals`
+  - `/clawguard/audit`
+  - `/clawguard/settings`
+- Protected backing routes remain under `/plugins/clawguard/*`
 - Pending-action + allow-once-retry approval loop
 - Audit closure for the current demo flows
 
@@ -56,12 +57,13 @@ It does **not** broaden runtime scope. It packages the current codebase and unre
 
 ### Smoke
 
-1. Restart OpenClaw
-2. Open `/plugins/clawguard/dashboard`
-3. Open `/plugins/clawguard/checkup`
-4. Open `/plugins/clawguard/approvals`
-5. Open `/plugins/clawguard/audit`
-6. Open `/plugins/clawguard/settings`
+1. Restart OpenClaw
+2. Run `openclaw dashboard --no-open`
+3. Replace the official tokenized dashboard URL path with `/clawguard`
+4. Open `/clawguard/checkup`
+5. Open `/clawguard/approvals`
+6. Open `/clawguard/audit`
+7. Open `/clawguard/settings`
 
 ### Demo order
 
@@ -75,7 +77,7 @@ It does **not** broaden runtime scope. It packages the current codebase and unre
 ## What this version proves
 
 - We have a repeatable local install story for the OpenClaw plugin baseline
-- We have a stable operator smoke path on plugin-owned routes
+- We have a stable operator smoke path on the plugin-owned public shell surface, backed by protected plugin routes
 - We can explain the current approval / audit loop without implying nonexistent resume or embedded Control UI features
 - We can truthfully describe the current scope without implying publish, GA, or broad runtime completeness
 - Current local validation baseline remains:
@@ -100,7 +102,7 @@ It does **not** broaden runtime scope. It packages the current codebase and unre
 - Say **fake-only** whenever demo scenarios are mentioned
 - Say **minimal outbound review points**, not host-level approvals or complete outbound lifecycle
 - Say **workspace mutation demo surface currently means `write` / `edit` / `apply_patch`**, not broad workspace governance
-- Say **direct plugin routes**, not embedded Control UI
+- Say **public shell entry path `/clawguard*` backed by protected plugin routes**, not embedded Control UI
 
 ## Validation
 

docs/releases/2026-03-14-first-usable-version-release-note-public-draft.md

@@ -8,39 +8,44 @@
 
 This first usable version is a **small, local OpenClaw install demo package**.
 
-It gives new users one honest path to try ClawGuard today:
-
-- install the plugin locally,
-- restart OpenClaw,
-- open the plugin-owned dashboard / checkup / approvals / audit / settings pages,
-- and walk through a few **fake-only** approval and audit scenarios.
+It gives new users one honest path to try ClawGuard today:
+
+- install the plugin locally,
+- restart OpenClaw,
+- open the plugin-owned public shell entry and move through dashboard / checkup / approvals / audit / settings,
+- and walk through a few **fake-only** approval and audit scenarios.
 
 ## What users can do today
 
 - Install from the repo root with:
   - `openclaw plugins install .\plugins\openclaw-clawguard`
-- Optionally build one **local-only** tarball for demo packaging:
-  - `pnpm --dir plugins\openclaw-clawguard pack`
-- Restart OpenClaw and smoke:
-  - `/plugins/clawguard/dashboard`
-  - `/plugins/clawguard/checkup`
-  - `/plugins/clawguard/approvals`
-  - `/plugins/clawguard/audit`
-  - `/plugins/clawguard/settings`
+- Optionally build one **local-only** tarball for demo packaging:
+  - `pnpm --dir plugins\openclaw-clawguard pack`
+- Restart OpenClaw and enter through the public shell:
+  - run `openclaw dashboard --no-open`
+  - replace the official tokenized dashboard URL path with `/clawguard`
+  - or open `/clawguard#token=<gateway-token>` directly on the same origin
+- Smoke:
+  - `/clawguard`
+  - `/clawguard/checkup`
+  - `/clawguard/approvals`
+  - `/clawguard/audit`
+  - `/clawguard/settings`
 - Run a narrow demo surface across:
   - risky `exec`
   - minimal outbound review points, where host-level direct sends stay on the hard-block path and tool-level approvals remain on `message` / `sessions_send`
   - workspace mutation actions currently limited to `write` / `edit` / `apply_patch`
 
 ## Recommended smoke path
 
-1. Open `/plugins/clawguard/dashboard`
-2. Open `/plugins/clawguard/checkup`
-3. Open `/plugins/clawguard/approvals`
-4. Open `/plugins/clawguard/audit`
-5. Open `/plugins/clawguard/settings`
-6. Run one fake-only risky `exec` example
-7. If needed, add one fake-only outbound example and one fake-only workspace mutation example
+1. Run `openclaw dashboard --no-open`
+2. Replace the official tokenized dashboard URL path with `/clawguard`
+3. Open `/clawguard/checkup`
+4. Open `/clawguard/approvals`
+5. Open `/clawguard/audit`
+6. Open `/clawguard/settings`
+7. Run one fake-only risky `exec` example
+8. If needed, add one fake-only outbound example and one fake-only workspace mutation example
 
 ## Recommended demo order
 
@@ -64,7 +69,7 @@ It gives new users one honest path to try ClawGuard today:
 ## What this version proves
 
 - ClawGuard has a **usable local OpenClaw plugin install path**
-- The plugin can serve its own operator pages under `/plugins/clawguard/*`
+- The plugin can serve its own protected operator pages under `/plugins/clawguard/*`, with `/clawguard*` as the supported browser-facing entry path
 - The current approval + audit loop is understandable enough for a first install demo
 - The current demo surface can explain a narrow set of fake-only flows across `exec`, outbound, and workspace mutation actions
 - The current repository validation baseline is green:

docs/releases/unreleased/2026-03-20-docs-public-shell-entry-posture.md

@@ -0,0 +1,31 @@
+---
+type: docs
+scope: docs
+audience: public
+summary: Align release and acceptance drafts to the /clawguard public-shell entry path
+breaking: false
+demo_ready: true
+tests:
+  - pnpm test -- --run tests/integration/openclaw-clawguard-plugin.test.ts
+artifacts:
+  - docs/releases/2026-03-14-first-usable-version-release-note-public-draft.md
+  - docs/releases/2026-03-14-first-usable-version-release-note-internal-draft.md
+  - docs/releases/2026-03-14-first-usable-version-announcement-draft.md
+  - docs/releases/2026-03-14-first-usable-version-acceptance-checklist.md
+---
+
+## What changed
+
+The first-usable-version public draft, internal draft, announcement draft, and acceptance checklist now treat `/clawguard*` as the browser-facing user entry path. They also keep `/plugins/clawguard/*` explicitly framed as protected backing routes rather than the primary user-facing smoke path.
+
+## Why it matters
+
+Recent runtime work made `/clawguard*` the supported no-core-patch browser entry flow. Leaving the older release drafts on raw `/plugins/clawguard/*` wording would keep pointing users at the route family that still returns `401` when opened directly without gateway auth.
+
+Aligning the release docs to the public shell posture keeps the outward story consistent with the actual browser path and with the current security boundary.
+
+## Demo posture / limitations
+
+This does not remove the protected `/plugins/clawguard/*` routes. They remain part of the implementation surface and regression path behind the public shell.
+
+This remains Alpha install-demo only, local-only, unpublished, and fake-only.