fix(apply): queue exact drift refreshes without hydration - #1258
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. |
clawsweeper
Bot
added
merge-risk: 🚨 availability
|
Codex review: needs maintainer review before merge. Reviewed August 27, 2026, 4:53 AM ET / 08:53 UTC. ClawSweeper reviewWhat this changesThis PR changes default apply drift refreshes from broad target sweeps to bounded exact-item queue events, with workflow, documentation, and focused regression coverage. Merge readinessKeep open: current main still sends drift refreshes through broad planning, while this PR routes them through the existing exact-item queue and provides current-head native Worker/Durable Object evidence for that path. Priority: P2 Review scores
Verification
Live VerificationCommand: Result: PASS (completed) Assertions:
How this fits togetherApply processes prior close results and refreshes items whose source changed. The refresh dispatch enters the durable exact-review queue, which applies admission, backpressure, leases, and then starts an exact-item review. flowchart LR
A[Apply report] --> B[Select up to five drifted items]
B --> C[Read branch and item kind]
C --> D[Exact-item event]
D --> E[Durable queue admission]
E --> F[Leased exact review]
F --> G[Review record and guarded apply]
Before merge
Agent review detailsSecurityNone. Review metrics
Merge-risk optionsMaintainer options:
Technical reviewBest possible solution: Land the narrow queue-only routing change while retaining the existing low-priority queue backpressure and lease behavior. Do we have a high-confidence way to reproduce the issue? Yes, source-reproducible: current main's workflow still emits a broad target-sweep event for every selected drifted item, while the PR's exact-item event reaches the pre-existing queue intake instead. Is this the best way to solve the issue? Yes. Reusing the established signed exact-item queue is the narrowest repair because it removes the unnecessary planner/hydration stage without introducing a bypass, new permission, or parallel queue. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 71df3a1ce714. LabelsLabel changes:
Label justifications:
EvidenceWhat I checked:
Likely related people:
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
HistoryReview history (3 earlier review cycles) |
clawsweeper
Bot
added
rating: 🦪 silver shellfish
|
@clawsweeper re-review The main PR body now contains passing actual signed Worker/native Durable Object admission proof for unchanged head |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
|
@clawsweeper re-review The main body is now native-proof-first. Both compactIssue and compactPullRequest hydrate only the first 12,000 body characters; the previous detailed native proof began at 14,235 and its HTTP/SQL trace at 19,562, beyond that window. The actual native trace now begins at 1,978, with five real curl/HMAC admissions, native SQL rows, duplicate preservation, both 401 controls, restart persistence and authority checks visible early. This is the existing passing 08:06 UTC Docker-backed local-container run, not the supplementary mocked checked-in harness. Exact head |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
clawsweeper
Bot
added
proof: sufficient
|
Merged the approved head Maintainer decision: accept the recommended bounded queue-only availability tradeoff. A repository-dispatch or intake outage remains visible and later apply can retry; broad fallback would reintroduce the demonstrated hydration overload. The existing queue retains admission, backpressure, leases and command authority. Refreshed source remains required before close. This is an explicit availability decision, not a proof waiver or acceptance of a code finding; normal maintainer merge consideration is complete. Validation: 274 focused tests passed. Exact-head full pnpm check, sparse repair build and Windows launcher CI, CodeQL, and automerge E2E passed. The exact squash-commit main CI run passed within the bounded 15-minute watch: pnpm check and Windows launcher passed; sparse repair smoke was skipped. The native Docker proof passed on the exact approved head using Crabbox provider Limits and earlier attempts remain explicit: GitHub metadata and repository-dispatch transport were controlled; this does not prove hosted GitHub delivery, deployed Cloudflare, model execution, review publication or close. No new runtime proof was run on the squash commit. Earlier AWS/harness attempts failed and remain documented. The earlier review-context cutoff omitted the native evidence; moving the actual trace earlier while preserving the full script and trace made it visible to the current sufficient-proof review. The earlier full local check still has 48 baseline fixture/offline dependency failures (3,706 passed, nine skipped); it is not relabeled green because hosted CI passed. OpenClaw Bay needs no change: existing events, decisions, lifecycle/status fields, schemas and routes are reused, and Bay remains observer-only. GitHub's existing automatic cleanup deleted this PR's remote head after merge; the local PR branch and all other existing local branches are retained. No manual branch deletion or repository-setting change was used. |
1 participant
Problem and production change
Default apply sent exact drift refreshes through broad planning. Close run 33034908558 acknowledged five dispatches, but planners failed whole-repository hydration with Durable Object overload, before admission.
The production workflow delta is +10/-6 lines; its behavior is:
clawsweeper_itemand existing queue-only legacy intake.source_drift_requeue, withsupersedes_in_progress: false.Real Behavior Proof
PASS: signed Worker/native Durable Object SQL, executed 2026-08-27 at 08:06 UTC. Head:
9d8d2ab6f1fe9162ecd25f62a4088c65b6f6c208. The NEW temporarybootstrap.shran actual producer/intake Bash, real curl, unmodified Worker HMAC and native workerdSqlStorage. Five admissions, five duplicates, both 401 controls, persisted restart and command/source authority passed. App, command and client exits: 0. Owned resources removed. This is separate from the old committed mock harness.Provider: approved Docker-backed Crabbox local-container; lease
cbx_a2b310396e1c, runrun_1c115b737135(no hosted run URL). Image:node:24-bookworm@sha256:4196d66a565c6f195728d9952f161f4adfe2ad753052a08b7ec7f1c5a6bda42b. Native Linux arm64, Node 24.19.0, Wrangler 4.107.0, workerd 1.20260701.1.Actual HTTP/native SQL excerpt; counts are observed SQL rows, signatures omitted:
{ "observedAt": 1787818008530, "realCurl": true, "POST": "/internal/exact-review/enqueue", "selected": [ 43367, 128515, 119583, 121477, 77508 ], "httpStatuses": [ 202, 202, 202, 202, 202 ], "storageType": "SqlStorage", "nativeItems": 5, "deliveryReceipts": 5, "stateHash": "c8225be2c17dd02cc48b9b9d28e65a2ade27d8803ee0d5a01010c3304998ee27", "duplicates": { "items": 5, "receipts": 5, "replaced": false }, "negativeControls": [ { "mode": "invalid", "status": 401, "response": { "error": "invalid_signature" } }, { "mode": "tampered", "status": 401, "response": { "error": "invalid_signature" } } ], "restart": { "sameDoId": true, "newInstance": true }, "authority": { "sourceAction": "exact_review_command", "sourceAuthoritySeq": 7 }, "outcome": { "passed": true, "proofExit": 0, "commandExit": 0, "clientExit": 0 } }Both 401 controls preserved SQL state/receipts. Restart preserved DO ID, items, receipts and state hash. A command admitted through the signed route, not SQL seeding, retained its marker, synthetic head and sequence 7 after refresh. All items stayed pending without leases/execution; full semantic trace below.
Accepted finding disposition: the 08:22:23.253Z review describes the OLD gh/curl-intercepting test-SQLite harness. The NEW uncommitted 08:06 bootstrap supplies requested native admission/restart and rank-up proof: SHA-256
d51833ed3daf2dc1c243090a979ccb4aa1e665ebcf6a468bacd092b39c493255, full bytes below. The published proof blocker remains; current-head/current-body review is required before landing. No waiver is claimed.The selector chose five of 15 drift rows in the 27-action report. Only GitHub branch/kind metadata and repository_dispatch were synthetic/captured. The wrapper adds read-only observations; no admission, crypto, storage, alarm or dispatch method is replaced. Its generated fixture key was never printed and was removed.
The local config had no account, routes, production bindings or App credentials; GitHub API was
http://127.0.0.1:9. Existing 900000 ms debounce/backoff deferred dispatch; the command exercised credential-free blocked/retry behavior. Limits: no deployed Cloudflare, production credential scopes, hosted GitHub delivery, model execution, publication or close. Closed/missing-target and backpressure controls are supplementary harness coverage, not native-run claims.Architecture, documentation and Bay
Normalization preserves target/branch/kind, event/action, timeout and non-supersession. Queue authority, executor live-state guards, broad dispatch and close policy are unchanged. The notice distinguishes dispatch acknowledgement from admission/completed review. Transport failures remain possible; existing
github.tokenand public reads stay default-OpenClaw-only.Scheduler docs cover routing, authority, explicit refresh, errors and Bay. The maintainer changelog entry preserves existing entries in ClawSweeper; OpenClaw's release-owned changelog is untouched per repository policy.
Bay: no change needed. Existing decisions,
source_drift_requeue, lifecycle/status fields, schemas and routes are reused. Bay remains public and observer-only: no browser GitHub calls or mutation controls. Proof changes no data contract.Supporting validation and honest limits
Exact-head CI 33040750328: full
pnpm check, sparse build smoke and Windows launcher checks passed. CodeQL and production-automerge E2E passed; automerge was not thereby enabled. Independent precommit review had no accepted/actionable findings. Committed-branch and fresh exact-commit landing autoreviews were clean at P0 only, not an all-severity clearance. Current ClawSweeper has no code/security findings but still blocks on proof.Supplementary: the committed harness and report fixture use intercepted gh/curl and test SQLite. The controlled proof and 274 focused tests passed: order/cap, normalization, explicit refresh, pending/leased authority, invalid identity, backpressure, no-op/comment-only/nonautomatic/missing-report guards and nonzero transport errors. Four-item probing dispatched two open fixtures, stopped one closed and one missing, leaving the fifth pending. Its long JSON is not repeated or presented as native proof.
Build/static/lint/changed-coverage/actionlint/whitespace checks passed. Local full
pnpm run checkfailed: 3,706 passed, 48 failed, nine skipped, zero cancelled. Baseline: 42 missingorigin/*fixture refs under inherited prune behavior; six offline pnpm 10.33.0 resolution failures. No config/pin/policy/timeout changes or full local retry. Hosted CI passed later. Bash 3.2 failed existingmapfile; GNU Bash 5.3.15 passed unchanged.Proof base:
f211e21fb89d00777ac07cc13c358f9f7b02a939. Saved main assessment at71df3a1ce714d737e250008597075bb5eaeb2ac4: no approved patch or drift-runtime overlap. This is static evidence, not merged-tree proof; head unchanged.Native run provenance and reproduction
Docker 29.4.0, pnpm 11.10.0, Bash 5.2.15, curl 7.88.1, jq 1.6, YAML 2.9.0. Fresh source, no hydration, host home/auth/SSH mounts, Docker socket or privilege; only the read-only transport bootstrap was bind-mounted. Workload uid 1001, no effective capabilities, seccomp 2, isolated HOME/TMPDIR and
env -i. AWS IMDS was inapplicable; provider settings unchanged.Recorded commands use relative host artifact filenames and container fixture paths. Both exact scripts follow. The lease was removed; reproduction requires a fresh lease ID and isolation inspection. Both scripts assert the head.
Process-stop 143 was intentional SIGTERM; application/client exits were 0. Both groups emptied and loopback closed. Key, container, claim, transport SSH key and owned transport directory were removed. Stop exit 0; Docker inspect exit 1 confirmed absence. Final cleanup: 08:11:03.959 UTC.
Selected native HTTP and persistence trace
Complete existing
selected-public-trace.json(7,992 bytes), without secrets/signatures. Fulltrace.jsonSHA-256:e05a193e5fba9abd82376201d73d6f310773de066cd87692343000ff0af0c014; selected projection SHA-256:64371bffd54646c73f071f0e0dccd6432b26bbf357984ad1e48a48c37613fda5.Actual semantic trace, before the executable and historical notes
{ "http": [ { "itemNumber": 43367, "requestSha256": "48f2d14dc3e4eb6fea356f6c10e2f45fbf6086717af033601b088acbafd4d082", "status": 202, "response": { "ok": true, "queued": true, "item_key": "openclaw/openclaw#43367", "superseded_publications": 0 } }, { "itemNumber": 128515, "requestSha256": "6051dd36fce12be32785aa65925877916c8e58d15a8fc4efdd1f3e2fe542b3ef", "status": 202, "response": { "ok": true, "queued": true, "item_key": "openclaw/openclaw#128515", "superseded_publications": 0 } }, { "itemNumber": 119583, "requestSha256": "b5109bffb8f576dbab896a47d990c91ecd6f92ca97629a6a2886cca8493b5ffa", "status": 202, "response": { "ok": true, "queued": true, "item_key": "openclaw/openclaw#119583", "superseded_publications": 0 } }, { "itemNumber": 121477, "requestSha256": "90544d0a23b36717f42955aabfe489f908e4dc534286b534f3118105e3f4947f", "status": 202, "response": { "ok": true, "queued": true, "item_key": "openclaw/openclaw#121477", "superseded_publications": 0 } }, { "itemNumber": 77508, "requestSha256": "783c7cc53804341b8c4cad5817b4e4240f799a4c55cd94ee8a01089d3b312943", "status": 202, "response": { "ok": true, "queued": true, "item_key": "openclaw/openclaw#77508", "superseded_publications": 0 } } ], "requestExample": { "method": "POST", "path": "/internal/exact-review/enqueue", "body": { "delivery_id": "legacy:43367:1", "decision": { "targetRepo": "openclaw/openclaw", "targetBranch": "release/proof-branch", "itemNumber": 43367, "itemKind": "issue", "sourceEvent": "issues", "sourceAction": "source_drift_requeue", "supersedesInProgress": false, "codexTimeoutMs": 1200000 } }, "bodySha256": "48f2d14dc3e4eb6fea356f6c10e2f45fbf6086717af033601b088acbafd4d082" }, "nativeSql": { "storageType": "SqlStorage", "sqliteVersion": "unavailable: workerd disallows sqlite_version()", "doId": "dae4233e87282f77ad8c0dfcb2204d25474d5c8f3e7ad241a251c614431406b3", "observedAt": 1787818008530, "alarmAt": 1787818907882, "stateHash": "c8225be2c17dd02cc48b9b9d28e65a2ade27d8803ee0d5a01010c3304998ee27", "tables": { "exact_review_queue_items": { "rows": 5, "sha256": "76a0d751c78485ccb6913fcb33ae9384c91ab3c6deab0fd24d13da6f649921c5" }, "exact_review_queue_deliveries": { "rows": 5, "sha256": "f851c870e5740733846ac9519f51871a88810fc707348552f87a86b88a7c47e6" }, "exact_review_queue_meta": { "rows": 1, "sha256": "080e609ef0949d1bde2722195e5b838eb889b30d7cc738b110b42c0885c8adf0" }, "exact_review_lifecycle_projection_v1": { "rows": 5, "sha256": "6984656344be1645bb71af1b03c5d471ae9cd7ea2ce26938f194b4808f484b77" } }, "persistedExample": { "key": "openclaw/openclaw#43367", "decision": { "targetRepo": "openclaw/openclaw", "targetBranch": "release/proof-branch", "itemNumber": 43367, "itemKind": "issue", "sourceEvent": "issues", "sourceAction": "source_drift_requeue", "supersedesInProgress": false, "codexTimeoutMs": 1200000 }, "admissionDeliveryId": "legacy:43367:1", "state": "pending", "revision": 1, "createdAt": 1787818007882, "updatedAt": 1787818007882, "nextAttemptAt": 1787818907882, "backoffReason": "dispatch_debounce", "attempts": 0 } }, "duplicates": { "statuses": [ 202, 202, 202, 202, 202 ], "deduped": [ true, true, true, true, true ], "items": 5, "receipts": 5, "itemsHash": "3fea4090d6928fe51ce81dc012187f26afa51cbf580cfd0fa31c0debfce2b72e", "replaced": false }, "signatureControls": [ { "phase": "signature_rejection", "mode": "invalid", "status": 401, "response": { "error": "invalid_signature" }, "beforeHash": "c8225be2c17dd02cc48b9b9d28e65a2ade27d8803ee0d5a01010c3304998ee27", "afterHash": "c8225be2c17dd02cc48b9b9d28e65a2ade27d8803ee0d5a01010c3304998ee27", "items": 5, "receipts": 5 }, { "phase": "signature_rejection", "mode": "tampered", "status": 401, "response": { "error": "invalid_signature" }, "beforeHash": "c8225be2c17dd02cc48b9b9d28e65a2ade27d8803ee0d5a01010c3304998ee27", "afterHash": "c8225be2c17dd02cc48b9b9d28e65a2ade27d8803ee0d5a01010c3304998ee27", "items": 5, "receipts": 5 } ], "restart": { "sameDoId": true, "newInstance": true, "beforeHash": "c8225be2c17dd02cc48b9b9d28e65a2ade27d8803ee0d5a01010c3304998ee27", "afterHash": "c8225be2c17dd02cc48b9b9d28e65a2ade27d8803ee0d5a01010c3304998ee27", "doId": "dae4233e87282f77ad8c0dfcb2204d25474d5c8f3e7ad241a251c614431406b3", "beforeInstance": "2a066c77-8749-4339-a153-fff0597e531e", "afterInstance": "77a7150f-a6c2-40de-9b07-071da0f969b6" }, "authority": { "commandResult": { "mode": "valid", "status": 202, "response": { "ok": true, "queued": true, "item_key": "openclaw/openclaw#128516", "superseded_publications": 0 } }, "refreshResult": { "mode": "valid", "status": 202, "response": { "ok": true, "queued": true, "item_key": "openclaw/openclaw#128516", "superseded_publications": 0 } }, "beforeItemsHash": "ef652d1f35197a40c6f5f3b742c3c73fc579ecfdb04dbab9fe805e1566277259", "afterItemsHash": "ef652d1f35197a40c6f5f3b742c3c73fc579ecfdb04dbab9fe805e1566277259", "preserved": { "key": "openclaw/openclaw#128516", "decision": { "targetRepo": "openclaw/openclaw", "targetBranch": "release/proof-branch", "itemNumber": 128516, "itemKind": "pull_request", "sourceEvent": "pull_request", "sourceAction": "exact_review_command", "supersedesInProgress": false, "sourceHeadSha": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "sourceHeadVerified": true, "sourceAuthoritySeq": 7, "codexTimeoutMs": 1200000, "commandStatusMarker": "<!-- clawsweeper-command-status:128516:re_review:fixture -->", "statusCommentId": 9001 }, "admissionDeliveryId": "fixture-existing-command", "state": "pending", "revision": 1, "createdAt": 1787818010244, "updatedAt": 1787818010244, "nextAttemptAt": 1787818010244, "attempts": 0, "sourceAuthorityWatermark": { "sequence": 7 } }, "dispatcher": { "state": "blocked", "reason": "workflow_status_unavailable", "checkedAt": 1787818011252, "retryAt": 1787818911252 }, "totalItems": 6, "receipts": 7, "alarmAt": 1787818911252 }, "processStops": [ { "phase": "process_stop", "sequence": 1, "group": 3754, "exit": { "code": 143, "signal": null }, "remaining": [], "loopbackClosed": true }, { "phase": "process_stop", "sequence": "final", "group": 4207, "exit": { "code": 143, "signal": null }, "remaining": [], "loopbackClosed": true } ], "processCleanup": { "phase": "process_cleanup", "ownedGroups": [ 3754, 4207 ], "remaining": [] }, "outcome": { "passed": true, "proofExit": 0, "commandExit": 0, "clientExit": 0, "stage": "complete", "processCleanupVerified": true, "containerCleanupVerified": true } }Exact executed native bootstrap
Temporary, uncommitted
bootstrap.sh: 28,234 exact bytes, SHA-256d51833ed3daf2dc1c243090a979ccb4aa1e665ebcf6a468bacd092b39c493255, unminified below. Parent independently matched all 372 source/step manifest entries to the exact head; manifest SHA-25684ecc7991f98d31de4e95298fe454b3d02dad02760d6c349352012260be04c5f. Tracked source stayed clean; no production edit.bootstrap.sh — exact executed bytes
prepare.sh — exact 503-byte source/isolation preflight
Historical failed attempts
AWS: two SSH failures and one temporary pnpm/esbuild lookup failure; all leases released. These are not proof. Container attempts: (1) exit 2, incompatible
--fresh-pr/--no-sync, app not run; (2) exit 1, observer omitted Bash's OLDPWD; (3) exit 1, workerd rejected optionalsqlite_version(). That observation was removed; SQLite version remains unavailable. Required assertions/production behavior were unchanged. Attempt 4 passed in the same container. No CI/proof rerun for this presentation update.