* fix(pr): migrate pre-cutover PR registries from extracted wrapper sources
scripts/pr review-init failed in [pr-worktree-provision] with "Client
credentials require backed-up migration custody" when the private PR
registry (<canonical>/.local/pr-state) predated the client-credential
cutover.
The trusted-anchor wrapper extracts only scripts/pr, scripts/pr-lib and
wrapper-components.txt. The state preflight forks
src/state/openclaw-agent-schema-inspection.worker.ts, which was not
listed, so the child exited 1 and the preflight reported the registry as
indeterminate. preparePrStateSchema only consulted pendingMigrations,
returned early, and the allocation lease's ordinary open then ran the
v28->v29 cutover without maintenance custody or a backup capture.
- List the forked runtime children wrapper code can launch. The
PostgreSQL bridge stays out: wrapper processes never install a
PostgreSQL engine selection and pg is not a pinned wrapper dependency.
- Make the PR wrapper inventory check follow
resolveRuntimeProcessEntrypointUrl references.
- Send an indeterminate state preflight through the existing guarded
doctor-preparation instead of treating the store as current.
- Regression: run the real provisioner from extracted wrapper sources
with the inspection child removed; the v28 registry must migrate.
* test: collect forked entrypoint names without map spread
* fix(pr): drop wrapper inventory entry deleted on main
Template caches refresh in place, so their current index is not the failed clone baseline. Check the retained PR seed through a private refreshed index, keeping dirty or untracked content and refusing missing seed metadata.
Remove a settled newly-created clone when its PR registration is lost, preserving the caller seed and checking rollback authority. Recover older proven template clones through native entry and scoped gc, while preserving local edits, review artifacts, live checkouts, and ambiguous metadata.
* fix(scripts): retire materialized PR anchors on every exit path
Materialized wrappers were retired only after fully clean supervised exits,
leaking code and dependency links on failures, signals, bootstrap exits,
unsupervised commands, and failed execs.
Keep creator ownership across the Bash and supervisor exec chain. Share
FD/path/PID identity checks, retire drained operations independently of PR
lock decisions, and restore cleanup after Bash 3.2 failed execs. Retain code
for undrained operations and sweep at most four old owned anchors at startup
using creator PIDs in new names.
PID reuse conservatively delays sweeping. Legacy names have no liveness
record and may be reclaimed after 24 hours even during a long operation.
Drained cleanup accepts the same fd-closing escapee residual as clean exits;
missing runtime or ownership evidence remains retain-only.
Cover lifecycle exits, crash-retained recovery fixtures, dependency pinning,
and bounded stale sweeping without changing lock recovery semantics.
* docs(scripts): name the stale-anchor sweep residual
A dead creator PID is the sweep's only evidence that an operation ended. Descendants that outlive a crashed or undrained supervisor by more than 24 hours can lose their anchor; their PR lock stays retained. Also replace the busy loop in the forwarded-SIGTERM supervisor test with sleep.
Reuse Git trailer formatting for source coauthor credit in both native signed candidates and signing requests. Keep binding, signature and live authority validation unchanged.
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
* fix(pr): poll mergeability without repeating full inventories
Wait on projection hints between complete observations while preserving exact-head, policy, main-composition, and final live-authority checks. Keep the existing settlement and authority deadlines.
* fix(pr): preserve GraphQL polling and REST fixture boundaries
* test(pr): schedule initial REST settlement independently
Prior-CI requalification could discard a freshly qualified REST projection
before consuming it when the carried UNKNOWN clock had expired. While
landing #173401 this claimed UNKNOWN after zero observations despite the
REST diagnostic reporting mergeable=true and blocked.
Consume the first projection of each round before the pre-read deadline
check. Keep the independent post-read 60-second expiry, local Git proof
accounting from #173283, and the 900-second/32-round authority ceiling.
An expired remote budget still refuses admission after the observation;
there is no deadline reset or change to live authority or dispatch.
Extend the existing 197-second local-proof / 61-second remote-read case
with the exact one-observation diagnostic. It reproduced the zero-read
refusal before this fix; all original no-dispatch assertions remain.
Validation: 121 tests pass across the complete merge-outcome and prior-CI
main-drift suites; the six delayed-proof controls also pass. Targeted
tooling types, typed lint, Bash syntax, ShellCheck and formatting pass.
Independent P2 review is clean.
Bind retained conflict stages to their immutable merge or rebase resolution and accept an exact mode/blob match through a Git-detected rename source. Preserve the committed index check and refuse unowned stages without mutating the index.
* fix(pr): keep admin landing live on a busy main
* fix(pr): bound failed reads and refresh admission fixtures
* fix(pr): revalidate review and security after final observation
* fix(pr): keep final inventory fresh and timeout retries usable
* fix(pr): start admission settling at the first unknown result
* fix(pr): recheck effective policy after security qualification
Restore the final policy read after awaited security work so a delegated CI-only grant cannot bypass newly tightened requirements. Cover the allowed pinned dispatch and policy-tightening refusal through the native admission owner.
* docs(pr): align admin admission retry limits
Prove unrepresented suites from complete batched check-run evidence and a stable full suite inventory, retaining the 1,000-suite limit and final authority checks.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
The tooling-root refresh ran `git fetch` and `git merge --ff-only`
through the capturing Git helper (execFileSync, 1 MiB default buffer).
A root ~4,200 commits behind fast-forwarded, then its diffstat overflowed
the buffer (spawnSync git ENOBUFS), aborting before
`pnpm install --frozen-lockfile`.
Stream both mutating steps to stderr and skip the merge diffstat. The
clean-main rechecks, single-refresh rule, and canonical-checkout refusal
are unchanged. Regression: a post-merge hook emits 1.2 MB during the
fast-forward; the old wrapper fails with the incident's ENOBUFS.
GitHub's statusCheckRollup and mergeStateStatus keep cancelled runs that a
newer run of the same workflow/event/job name superseded on the same head
(pull_request_target lanes such as ClawSweeper Dispatch draft `opened` runs
after `ready_for_review`, and Labeler). After openclaw/ci-gate passes, those
PRs are MERGEABLE/UNSTABLE and --auto-merge admission refused them.
--auto-merge now selects the immediate squash route for MERGEABLE/UNSTABLE
only after one fresh scripts/watch-pr-ci.mjs --completion rollup --once pass
at the exact prepared head exits GREEN. The watcher's classifyRollup stays
the single supersession owner and the pass also requires the attached ci.yml
run to succeed; any unsuperseded failure, hidden or paginated context, missing
run identity, pending check, moved head, or watcher error keeps refusing.
The watcher gains an opt-in --once flag: one attach and one watch observation
without waiting, with --timeout bounding only that pass's evidence reads.
This is a one-shot admission predicate, not a pinned snapshot fact: required
checks stay server-enforced at dispatch, the exact-head mutation pins the
head, and the final stability reread pins the UNSTABLE projection. Pinning
rollup contexts would extend the Octopool-allowlisted landing snapshot and
the retained-outcome schema. Accepted edge case, documented in
merge-admission.md: a new non-required failure on the same head between the
pass and dispatch is not rechecked.
Measured 2026-10-13: 8 of 80 recently merged final heads (e.g. #170738,
#170733, #170675, #170627) had only superseded same-lane cancellations;
classifyRollup classifies all four examples GREEN.
* fix(ci): report all selected failures in one PR run
Finish independent checks after diagnostic failures on upstream, forks, and retries. Preserve producer, cleanup, cancellation, and watchdog dependencies; failing runs intentionally use more runner time.
* test(ci): align workflow fixtures with failure collection
Update synthetic harnesses and condition contexts to retain real producer prerequisites while asserting that all admitted checks finish after ordinary failures. Correct the old early-stop expectations exposed by PR CI run 38347327272.
* test(ci): isolate runner fixture modes from the host environment
Use one shared fixture environment builder to remove inherited CI,
GITHUB_ACTIONS, and the retired continuation switch. Cases that exercise
CI scheduling opt in explicitly. Keep main's incomplete-report
infrastructure exit 2, and prove complete failed CI reports retain exit 1.
Reuse the existing suite-level prepared compiler for bounded reader
fixtures while preserving the original CLI, runtime and AI build admission,
reader receipts, generation ownership, cleanup, and unchanged deadlines.
Validate only the touched fixture files in both plain and CI environments.
Production code is unchanged.
* test(ci): correct native failure expectation and touched-file lint
* fix(ci): drain explicit local failed-test reruns
* fix(ci): preserve sparse runner imports and terminal test contracts
Record phase, request counters and remaining budgets before failure overwrites shared status. Preserve timeout, authority and recovery behavior so a repeated provisioning failure can be diagnosed without weakening lease checks.
* fix(pr): admit reviewed baseline successors
Preserve signed predecessor bindings and proof while explicitly admitting a new reviewed source. Revalidate installation and final preparation CAS without weakening the initial-refresh or wrapper trust contracts.
* fix(pr): revalidate baseline transition authority after replay
* ci: finish PR jobs and classify failures against main
* ci: distinguish signature and job-name failure attribution
* test(ci): avoid object spread in failure fixtures
* ci: classify differing validation scopes as unknown
Keep the common-path ownership map, execution gotchas, and safety boundaries in the scripts guide. Move detailed preparation, transport, remote-gate, admission, and recovery contracts into seven navigable references. Preserve the execution-gotchas anchor and align proof guidance with focused local checks and broad PR CI.
Validation: docs formatting, Markdown lint, internal links, scoped path/anchor checks, and independent preservation autoreview passed.
