fix: forward skill evaluation correlation (#123425)

docs/plugins/hooks.md

@@ -248,6 +248,13 @@ api.on(
 );
 ```
 
+When evaluation input includes `correlationId`, OpenClaw forwards it to the
+evaluator event for both manual and apply-triggered evaluations. This value is
+caller-supplied correlation metadata, not authenticated identity or proof of
+authorization. An authorization plugin must mint or replace the value through
+a trusted entry point, bind it to the intended operation, and validate and
+consume it itself.
+
 Stored outcomes identify the evaluator, plugin id, plugin package version,
 status, and returned result. Timeouts and thrown errors are recorded as
 attributed error outcomes; they do not fail the whole evaluation. Applying a

src/plugins/hook-skill.types.ts

@@ -15,6 +15,8 @@ export type PluginHookSkillBundleSnapshot = {
 };
 
 export type PluginHookSkillProposalEvaluateEvent = {
+  /** Caller-supplied correlation metadata; not authenticated identity or authorization proof. */
+  correlationId?: string;
   proposal: {
     id: string;
     kind: PluginHookSkillProposalKind;

src/skills/workshop/service-evaluation.test.ts

@@ -123,6 +123,7 @@ describe("Skill Workshop proposal evaluation", () => {
     });
     const hookEvent = hookMocks.evaluate.mock.calls[0]?.[0] as PluginHookSkillProposalEvaluateEvent;
     expect(hookEvent).toMatchObject({
+      correlationId: "optimization-run-1",
       proposal: {
         id: proposal.record.id,
         revision: "v1",

src/skills/workshop/service-evaluation.ts

@@ -96,6 +96,7 @@ export async function evaluateSkillProposal(
   const rawOutcomes = bundles
     ? await runSkillProposalEvaluators(
         {
+          ...(correlationId ? { correlationId } : {}),
           proposal: {
             id: read.record.id,
             kind: read.record.kind,