* feat(release): qualify frozen candidates with their own harness
Keep candidate qualification code, required coverage, and baselines frozen while independently trusted tooling authenticates admission and publication. Preserve historical recovery and verify exact qualified npm and Docker artifacts without candidate-to-publisher ancestry.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* fix(release): restore authenticated harnesses before execution
Bootstrap only from the immutable caller commit, then restore and verify the authenticated callee revision before any repository code runs. Preserve canonical origin and path guards, with real Git regression coverage. Remove duplicate coercion declarations without importing executable normalization code before bootstrap admission.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* test(release): align qualification fixtures with frozen harnesses
Provide explicit ordinary-lane workflow inputs and the complete committed bootstrap closure. Assert immutable caller seeds rather than a moving main checkout, preserving authenticated harness restoration. Keep the internal evidence script constant private.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* fix(ci): register frozen qualification dynamic entrypoints
Model the verified Node child runner and generated admission-transport fixture as exact Knip entrypoints. Keep the fixture out of production roots and preserve the hard-zero unused-file and export checks without ignores or fake imports.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* test(release): include captured baselines in plugin fixtures
Model the independent phase qualification-baseline step with empty outputs and assert both trusted baseline output bindings. Preserve the substituted candidate SHA and the scanner checks against the separately admitted source identity.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* fix(release): remove circular manifest policy dependency
Remove the retired empty-advisory helper and emit the unchanged empty wire fields at their producers. Keep strict advisory rejection and the single manifest builder.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* test(release): cover frozen catalog checkout closure
Preserve exact sparse-path, byte-integrity, and candidate-isolation assertions for both catalog dependencies. Keep them excluded from preflight materialization.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* refactor(release): remove unused evidence facade export
Keep manifest child evidence owned by the extracted manifest module; policy and state consumers use that owner directly.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* fix(release): revalidate admission before publication effects
Carry authenticated admission authority through Docker and npm publication, rechecking it after preparation and immediately before each external registry mutation. Preserve original evidence and publisher guards; deny revoked authority in recovered and multi-package publication.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* test: align release qualification coverage with main
* test: format release checklist coverage
* test: restore release fixture closure
* test: run compact admission from frozen tooling
* test: cover oldest supported upgrade baseline
* test: reconcile package acceptance coverage
* test(release): align candidate-owned dispatch docs
---------
Co-authored-by: roboclaw-bot <309084314+roboclaw-bot@users.noreply.github.com>
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
Co-authored-by: Dallin Romney <dallinromney@gmail.com>
## What Problem This Solves
CI and release tooling still carries retired selection paths, duplicate evidence projections, and single-use command factories that make its current behavior harder to follow.
## User Impact
No user-visible change. CI keeps the same jobs and gates; release receipts, manifest digests, CLI output, packaging contracts, and generated Gateway protocol bytes stay compatible. No SDK API, config, wire, or persisted-data changes.
## Why This Change Was Made
This batch removes **1,235 net production/tooling lines** (890 added, 2,125 deleted; tests excluded).
- Remove the unused extension fallback and core-impact classifier after their production caller was retired in `6a50179657`. The current planner consumes explicit targets; meaningful coverage now exercises that path. Remove unused current-planner options while retaining arguments needed by September frozen targets.
- Use the existing grouping helper and direct descriptors for CI shards; let the Docker lane constructor own its default command and remove one-use factories. Selection, lane ordering, prerequisites, and commands remain identical.
- Reuse release-policy child topology, evidence projections, and canonical JSON sorting; remove always-empty advisory machinery. Share the existing postpublication diagnostic schema while retaining the observer's `startup_failure` extension and historical receipt validation.
- Cross-OS packaging now uses the canonical package helper directly instead of maintaining a second pack/inventory implementation. That helper predates July 2026 and exists in all 36 available July-or-later release tags. Remove npm-runner forwarding and test-only APIs.
- Simplify docs translation fence/link processing and remove unused route, cursor, and split-depth state. Replace hand-written ZIP CRC with Node's implementation; remove an unreachable Swift fallback, retired cancellation adapter, and redundant timing/tarball branches.
- Keep the actual core consumer of the shared package metadata helper in Knip's graph, rather than suppressing a dead-export warning.
## Evidence
Remote proof uses [Blacksmith Testbox run 37090710184](https://github.com/openclaw/openclaw/actions/runs/37090710184), lease `tbx_01m3zt7sykcrdm1fq4m8zf4bz4`, with dependencies installed. Final source tree `3b3f07ba57325ab7da7335fd125dec0fd43216ac` matches commit `8c147759f7a8047189daf2ac0bacd4ae4f5b88d9`. After full-sync timeouts, targeted transfer plus whole-tree verification completed the proof.
- Focused TypeScript selection: **1,988 tests passed across 30 files**, about 398 seconds including the wrapper. Changed-test single-worker proof: **629 passed**; tooling shard 308.96 seconds. The root retention test passed all four cases. An additional eight-file selection passed **255 tests**, 30.16 seconds including the wrapper.
- `cd scripts/docs-i18n && go test ./...`: passed, package time 0.179 seconds.
- Base/candidate comparisons: **393 release output/error/digest comparisons**, **1,234 Docker comparisons across 727 plans**, **24 extension selection/packing comparisons**, and four Node shard-inventory profiles passed. Generated Swift protocol output is byte-identical.
- `pnpm test <changed files> --maxWorkers=1` retains the expensive real-repository ownership assertions: source-owner file 87.778 seconds; cross-OS release checks 0.971 seconds; workflow control 0.486 seconds; extension preparation 0.272 seconds. No new CI job or added test budget.
- Independent autoreview found no actionable P0/P1 regression. Final `check-changed` passed, including types, lint, package boundaries, ratchets, and all three unused-export scans. Both import-cycle checks reported **0**. Final single-worker replay of npm locks, cross-OS packaging, and release summaries: **306 tests passed**, 30.82 seconds including the wrapper.
Fixes found along the way: no separate product bug was established. Gate findings were corrected in the owning changes; tests were not weakened to conceal failures.
* feat(release): accept exact-job recorded flakes in release validation
A release lead can classify one failed Normal CI job of a Full Release
Validation run as a flake through the trusted classification workflow. The
receipt binds the exact job id and attempt, CI child run, FRV parent run and
attempt, and Release SHA, and carries a tracking issue or PR plus a reason.
Release Decision, the manifest, the publisher's live re-derivation, the step
summary, and the GitHub release notes tail treat it as a visible advisory.
Required classes and every other child stay blocking.
* docs(release): fold recorded flakes into the shared release boundaries
* fix(release): scope flake receipt discovery to the CI child run
* fix(release): require main lineage for flake receipt producers
* test(release): copy the flake classification module into tooling fixtures
* fix(release): keep advisory-only release notes verifiable
* chore(release): retire the Tideclaw alpha release track
Tideclaw alpha/nightly publication is retired. Alpha remains readable as
history (existing v*-alpha tags, published versions, changelog and
upgrade-survivor baselines, product version ordering), but it can no longer
authorize a release.
Every active release boundary now rejects an alpha version or -alpha.N tag,
the alpha npm dist-tag, and tideclaw/alpha/* workflow or tooling routes:
preparation, Full Release Validation publication selection, npm preflight,
approval receipts, core/plugin npm and ClawHub publication, native handoffs,
and finalization. Channel mappings throw for alpha instead of falling through
to latest. The Tideclaw branch routes, alpha dist-tag options, the alpha FRV
publication route, and the alpha-only Docker runtime-assets job are removed.
Beta, stable, extended-stable, and correction releases are unchanged.
The release-openclaw-nightly skill is deleted and the release skills and docs
no longer describe the alpha track.
* test(release): drop retired alpha preparation and finalization expectations
* test(release): drop remaining retired alpha references
