fix(live-proof): provide cold-checkout prerequisites to planning - #1264
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. |
clawsweeper
Bot
added
P2
|
Codex review: needs maintainer review before merge. Reviewed August 27, 2026, 11:42 AM ET / 15:42 UTC. ClawSweeper reviewWhat this changesThe PR supplies generated live-proof plans with trusted cold-checkout setup details, preserves executor command semantics, and adds focused tests and proof documentation. Regression provenancePossible regression — probable (reproduction; reviewed change). No predecessor PR is attributed. Merge readinessKeep this PR open for normal maintainer review: the introduced prompt context is narrowly sourced from the effective repository profile, and the exact-head cold-checkout proof supports the intended fix. Priority: P2 Review scores
Verification
Live VerificationCommand: Result: PASS (completed) Assertions:
How this fits togetherClawSweeper builds a review prompt from GitHub context and repository profiles, then executes declared proof plans in a separate cold checkout. This changes the trusted profile information available to the planner before it emits a terminal or browser plan. flowchart LR
A[Repository profile] --> B[Review prompt]
C[GitHub item context] --> B
B --> D[Generated proof plan]
D --> E[Cold checkout setup]
E --> F[Terminal or browser execution]
F --> G[Verification result]
Before merge
Agent review detailsSecurityNone. Review metrics
Merge-risk optionsMaintainer options:
Technical reviewBest possible solution: Retain the profile-derived cold-checkout contract and land it only after exact-head checks confirm the focused prompt and execution behavior. Do we have a high-confidence way to reproduce the issue? Yes. The retained no-build plan was replayed from a cold checkout after configured setup and failed to load the required compiled module; the final-head generated plan added the build and passed both assertions. Is this the best way to solve the issue? Yes. Supplying effective profile facts and an explicit cold-checkout contract fixes the information gap without making the executor guess or rewrite generated commands. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 2129a78a502e. LabelsLabel changes:
Label justifications:
EvidenceWhat I checked:
Likely related people:
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
HistoryReview history (3 earlier review cycles)
|
|
@clawsweeper re-review The PR body now records the disposition of the changelog finding with exact target-policy citations. This targets Please review the unchanged head |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
clawsweeper
Bot
added
merge-risk: 🚨 automation
6da6a9c to
2139278
Compare
|
@clawsweeper re-review Please review updated head |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
clawsweeper
Bot
added
rating: 🦞 diamond lobster
1 participant
Summary
Fix the missing prerequisite context behind the independently generated terminal-plan failure observed during PR1259, without changing that PR's landed command-preservation behavior.
The producer already had general build-sequencing guidance, but planning did not receive the effective
live_testexecution contract. The proof target is a separate cold checkout; the configured installation suppresses lifecycle scripts and does not inherit the controller'sdist. The retained plan directly loaded two tests that importdist/clawsweeper.js, so both imports failed before the expectations could succeed. The full historical model read trace is unavailable, so this does not claim the model never encountered build information.This patch supplies trusted effective profile context to the production prompt (including fallback resolution, actual normalized setup, install-script policy, cold-head checkout, and browser-only startup), strengthens prerequisite guidance, and shares the existing unchanged setup normalizer with execution. It does not guess or automatically repair generated commands.
No public decision schema, repository setup defaults, parser/driver command multiplicity, assertions, timeouts, or publication contracts change. Every declared entry/run still executes, including intentional repeats. OpenClaw Bay is unaffected: no lifecycle, status, public data-contract, or observer-surface change.
Rebase and review disposition
Current tested head:
213927808a1d14c11fb8507e45dcc061ceeade62Base:
2129a78a502e4e6ed3dd0c521db5034743f1757aThe independently owned PR1261 landed while this PR's prior review was being published. This branch is now rebased onto it. The sole conflict was in shared imports and adjacent additions in
test/review-prompt-context.test.ts; both owners' test blocks were retained. Runtime and changelog changes merged automatically. No additional runtime rewrite was needed.A subsequent main advance, PR1265, required only changelog conflict resolution. All incoming notes were preserved and our exact entry was retained at the end of Changed to avoid repeated top-note collisions. Runtime/prompt changes merged automatically; proof was refreshed again for the final head above.
The earlier changelog finding was a target-scope false positive and was explicitly cleared by the review of the prior head, which rated proof, patch, and overall readiness A with no findings or rank-up work. This targets
openclaw/clawsweeper, notopenclaw/openclaw; the intended ClawSweeper Unreleased entry is retained. AGENTS.md explicitly scopes release-owned changelog handling toopenclaw/openclaw, and the landed policy fix further clarifies target ownership.That earlier review/CI is history, not approval of the rewritten head. The conflict-resolved candidate and committed range received fresh independent Codex reviews, and the actual generation/cold-checkout proof below was rerun for this exact head. Current-head CI and ClawSweeper review remain required landing gates.
Current-head controlled real-behavior proof
Claim: a real generated plan supplies the build prerequisite missing from configured setup, then executes the original diagnostic command from a cold current-head checkout without hidden prebuilds or changed execution semantics.
The exercised path was production
buildReviewPrompt→ actual constrained Codex generation using the full unchanged production schema → production decision parser → productionexecuteLiveProofsetup → real tmux. The request fixed the original two test files, test-name pattern, and expectations, supplied their real current-head source context, and prohibited tools. It did not instruct the generator to build or supply an expected plan. The inner tests are the selected diagnostic fixture; the runtime proof is the outer generation/setup/execution path, not unit-test success alone.Generation completed at
2026-08-27T15:31:48.912Z. The unchangedscripts/e2e/terminal-proof-generate.mjsattested restricted read-only execution, denied outside reads and workspace writes, no writable paths, disabled child networking, and zero tool calls. When the host CLI changed, its strict version check correctly refused the new version before inference. The original official0.150.0-alpha.13CLI was then installed in task-private storage; no attestation, tool inventory, permission, or host configuration was weakened. No raw transcript or private model identifier is included.The actual, unedited generated entry was:
Its only steps were the two original
expect_outputassertions. Production parsing preserved the plan unchanged. Replay verified current source/compiled/target hashes and an exact command allowance before execution. The controller was built separately; each target was an independent cold clone at the tested head.distpnpm install --ignore-scripts --frozen-lockfiledistabsentdistabsentdist/clawsweeper.jsimportsdetail: okPositive verification is bound to
213927808a1d14c11fb8507e45dcc061ceeade62and completed at2026-08-27T15:33:55.453Z:This does not rely on the schema-v1
NOT OBSERVEDsuccessful-exit fallback. The negative replay fails during execution rather than the historical producer's expectation timeout; it proves the same prerequisite defect without claiming to explain historical status sampling.Provider/environment: local macOS real tmux; proof IDs
cold-negative-final-headandcold-positive-final-head; Node controller 24.20.0, target Node 26.7.0 on the allowlisted PATH; pinned pnpm 11.10.0; tmux 3.7c. Both runs used separate HOME/cache/tmp, the exact 17-key noncredential environment allowlist, and a dedicated task-local socket. Target isolation facts are operator telemetry, not kernel containment. Local--checkoutsemantics deliberately bypass live GitHub lookup. Fixture item number 1259 is only a diagnostic identifier; the actual controller/checkout head is this PR's tested head above.Integrity/provenance:
The committed investigation record and sanitized evidence retain the earlier initial-investigation snapshot. The current-head proof above is a separate fresh generation/replay, not relabeled old evidence. The changed profile/prompt hashes after the policy rebase are explicitly bound above. Raw diagnostics and the complete generated decision remain private; the relevant plan, observations, and integrity hashes are reproduced here.
Supporting checks and limits
All three builds and 166 focused tests passed after reconciliation, including both the landed release-policy tests and the new prerequisite-context tests. Fresh independent Codex reviews of the resolved staged candidate and committed range reported no accepted/actionable findings at their configured P0 threshold.
Earlier local full runs exposed pre-existing host Git-pruning and Homebrew/offline-fixture issues plus two timing-sensitive repair tests. These are documented in the historical investigation; no assertion, deadline, version shim, or persistent Git setting was changed to hide them. The prior head's full CI passed under the repository's declared Corepack bootstrap. This rewritten head must pass its own CI before landing; earlier green checks do not substitute.
The remaining automation risk is bounded and explicit: unusual repository build chains still depend on planner inspection. This patch supplies trusted facts rather than adding executor inference or rewriting. The proof does not guarantee unconstrained planner compliance, recording, publication, or outer review-workflow materialization. No live apply/close, manual workflow pause/dispatch, or PR1259 branch/landing mutation was performed.