Docs(osa) slash compat and release recovery note

[St0rmz1]

Summary

Docs-only PR covering three related areas the last two releases exposed as gaps:

• Slash-command channel compatibility. Documents that /security-checkup works in the OpenClaw native control UI chat and Telegram, but not in Kilo Chat or Slack (those channels don't route OpenClaw slash commands). Kilo Chat / Slack users should invoke the plugin via natural language so the agent calls the kilocode_security_advisor tool directly. The tool description now tells the agent not to suggest /security-checkup in those channels.

• Path-agnostic update reminder. Security checkup reports now occasionally append a "stay current" footer with npm view @kilocode/openclaw-security-advisor version and the upgrade commands. The footer is applied in doCheckup at the markdown layer, so it surfaces on both the LLM-driven kilocode_security_advisor tool path and the LLM-bypassing /security-checkup slash command path — fixing an earlier approach that lived only in the tool description and would never have reached slash-command users. Cadence is roughly 1-in-5 successful reports. README has a new Staying up to date section documenting the commands.

• Release recovery banner. Documents the current partial-publish failure mode (github-actions[bot] not on the main ruleset's bypass list → every stable publish fails at the post-publish push step with GH013). Gives a clean 3-step recovery:

  1. Check what landed on origin.
  2. Common case (tag landed, only the release is missing): one gh release create --verify-tag command.
  3. Rare case (tag also missing): follow Scenario 4.

  --verify-tag is critical — without it, gh release create silently mints a missing tag at current main HEAD, pointing the release at code that was never published to npm. RELEASING.md's Branch protection section now also lists the two durable fixes (add the bot to the bypass list, or refactor stable publishes to never touch main).

Test plan

• bun run typecheck — passes
• bun run format:check — passes
• bun test — 44 pass / 0 fail

🤖 Generated with Claude Code

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• CHANGELOG.md
• RELEASING.md

---

_{Reviewed by gpt-5.4-2026-03-05 · 611,304 tokens}