diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index 5f6b7a5f4..f8a94895f 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "6662dcf2099265b55cb35b7d70111c15e222a60e",
-  "syncedAt": "2026-04-29T23:14:47.570Z"
+  "sha": "845dd2a7d5bf90ecff3610d696d2ca2579e98ab7",
+  "syncedAt": "2026-04-29T23:16:47.543Z"
 }
diff --git a/docs/ci.md b/docs/ci.md
index ccd38d746..3ef754560 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -294,7 +294,7 @@ The `CodeQL Critical Quality` workflow is the matching non-security shard. It
 runs only error-severity, non-security JavaScript/TypeScript quality queries
 over narrow high-value surfaces on the smaller Blacksmith Linux runner. Its
 manual dispatch accepts
-`profile=all|plugin-sdk-package-contract|plugin-sdk-reply-runtime|session-diagnostics-boundary`;
+`profile=all|plugin-sdk-package-contract|plugin-sdk-reply-runtime|provider-runtime-boundary|session-diagnostics-boundary`;
 the narrow profiles are teaching/iteration hooks for running one quality shard
 in isolation without dispatching the rest of the workflow.
 Its
@@ -325,6 +325,10 @@ plugin-sdk-reply-runtime job scans Plugin SDK inbound reply dispatch, reply
 payload/chunking/runtime helpers, channel reply options, delivery queues, and
 session/thread binding helpers under the separate
 `/codeql-critical-quality/plugin-sdk-reply-runtime` category. The
+provider-runtime-boundary job scans model catalog normalization, provider auth
+and discovery, provider runtime registration, provider defaults/catalogs, and
+web/search/fetch/embedding provider registries under the separate
+`/codeql-critical-quality/provider-runtime-boundary` category. The
 ui-control-plane job scans Control UI bootstrap, local persistence, gateway
 control flows, and task control-plane runtime contracts under the separate
 `/codeql-critical-quality/ui-control-plane` category. The