openclaw
diff --git a/‎.agents/skills/openclaw-ci-limits/SKILL.md‎
Lines changed: 21 additions & 18 deletions b/‎.agents/skills/openclaw-ci-limits/SKILL.md‎
Lines changed: 21 additions & 18 deletions
diff --git a/‎.agents/skills/openclaw-live-updater/scripts/update-main.mjs‎
Lines changed: 4 additions & 1 deletion b/‎.agents/skills/openclaw-live-updater/scripts/update-main.mjs‎
Lines changed: 4 additions & 1 deletion
diff --git a/‎.github/actions/create-generated-pr-tokens/action.yml‎
Lines changed: 7 additions & 3 deletions b/‎.github/actions/create-generated-pr-tokens/action.yml‎
Lines changed: 7 additions & 3 deletions
diff --git a/‎.github/actions/publish-generated-pr/action.yml‎
Lines changed: 4 additions & 3 deletions b/‎.github/actions/publish-generated-pr/action.yml‎
Lines changed: 4 additions & 3 deletions
@@ -1,6 +1,6 @@
 ---
 name: openclaw-ci-limits
-description: Manage OpenClaw GitHub Actions and Blacksmith CI capacity, runner-registration budgets, fanout caps, main-push debounce, shard sizing, hosted-runner offload, queue health, and safe ramp-down/ramp-up changes. Use when tuning `.github/workflows/*`, `docs/ci.md`, CI runner labels, matrix `max-parallel`, ClawSweeper/Blacksmith burst protection, CodeQL runner placement, or investigating slow/queued OpenClaw CI.
+description: Manage OpenClaw GitHub Actions and Blacksmith CI capacity, runner-registration budgets, fanout caps, main-push single-flight, shard sizing, hosted-runner offload, queue health, and safe ramp-down/ramp-up changes. Use when tuning `.github/workflows/*`, `docs/ci.md`, CI runner labels, matrix `max-parallel`, ClawSweeper/Blacksmith burst protection, CodeQL runner placement, or investigating slow/queued OpenClaw CI.
 ---
 
 # OpenClaw CI Limits
@@ -84,12 +84,11 @@ and register more runners before the window resets. Use job duration, retries,
 and queue turnover to justify any lower estimate. Add non-matrix Blacksmith jobs
 such as `preflight`, `security-fast`, `build-artifacts`, and platform lanes.
 
-For repeated pushes, multiply by the number of runs expected to reach
-Blacksmith admission in the same 5-minute window, including runs canceled after
-admission. The debounce only suppresses pushes that arrive while
-`runner-admission` is still sleeping; once Blacksmith jobs register, those
-registrations are spent even if a later push cancels the run. If timing is
-uncertain, count every sequential push in the window.
+For repeated pull-request pushes, multiply by the number of runs expected to
+reach Blacksmith admission in the same 5-minute window, including runs canceled
+after admission. Canonical `main` is single-flight: one run completes while
+GitHub's default single pending slot is replaced by the newest push. Count one
+active main matrix plus its next pending matrix, not every intermediate merge.
 
 Reject a change unless the org-level worst case stays below about 60% of the
 live bucket. With the current 10,000-registration bucket, keep planned
@@ -100,10 +99,9 @@ ClawSweeper, ClawHub, Clownfish, OpenClaw RTT, and Clawbench.
 
 Prefer these in order:
 
-1. Add or preserve concurrency groups that cancel superseded PR and canonical
-   `main` runs before Blacksmith work starts.
-2. Keep the `runner-admission` hosted debounce for canonical `main` pushes.
-   Change `OPENCLAW_MAIN_CI_DEBOUNCE_SECONDS` only with evidence.
+1. Preserve cancel-in-progress for superseded pull-request heads.
+2. Preserve canonical `main` single-flight without canceling its running
+   integration cycle; GitHub's default pending slot coalesces to the newest tip.
 3. Move high-frequency, short, non-build jobs to `ubuntu-24.04`.
 4. Reduce matrix rows by bundling related tests inside one runner job when the
    combined job stays under timeout and keeps useful failure names.
@@ -120,18 +118,20 @@ Do not:
 - raise all `max-parallel` values at once;
 - make manual `workflow_dispatch` runs cancel normal push/PR validation;
 - delete coverage just to reduce runner count;
-- treat cancelled superseded runs as failures without checking the newest run
-  for the same ref.
+- treat cancelled superseded pull-request runs as failures without checking the
+  newest run for the same ref.
 
 ## Current OpenClaw Knobs
 
 These are intentionally guarded by `test/scripts/ci-workflow-guards.test.ts`:
 
-- `CI` concurrency key version and `cancel-in-progress` for PRs and canonical
-  `main` pushes.
-- `runner-admission` on `ubuntu-24.04` with
-  `OPENCLAW_MAIN_CI_DEBOUNCE_SECONDS=90`.
-- `preflight` and `security-fast` needing `runner-admission`.
+- `CI` concurrency key version, PR cancellation, and non-canceling canonical
+  `main` single-flight with one coalesced pending tip.
+- `preflight` and hosted `security-fast` start immediately without a debounce
+  or standalone admission job. On Node-relevant canonical main pushes,
+  preflight also owns the sole dependency sticky-disk write and 8 GiB prune
+  before fanout; replacement visibility is proved only by a later exact-marker
+  restore because Blacksmith snapshot promotion can lag job completion.
 - CI matrix caps: fast/check lanes at 12, Node test shards at 28, Windows and
   Android at 2.
 - Canonical PR Node tests use one precise changed-target job when possible;
@@ -142,6 +142,9 @@ These are intentionally guarded by `test/scripts/ci-workflow-guards.test.ts`:
 - lower-weight Node/check shards on `blacksmith-4vcpu-ubuntu-2404`.
 - heavy retained Linux/Android shards on `blacksmith-8vcpu-ubuntu-2404`.
 - CodeQL Critical Quality on `ubuntu-24.04` with no `blacksmith-` labels.
+- Vitest/test compile caches are restore-only in CI and use immutable Actions
+  caches; the daily/dispatch warmer is their sole writer. Build compile cache
+  writes rotate at most once per UTC day. PRs create no runtime-cache archives.
 
 When changing one knob, update `docs/ci.md` and the guard test in the same PR.
 
 
@@ -38,6 +38,7 @@ const DEFAULT_EXPECTED_ORIGIN = "openclaw/openclaw";
 const FULL_SHA_RE = /^[0-9a-f]{40}$/u;
 const GATEWAY_READINESS_ATTEMPTS = 3;
 const GATEWAY_READINESS_RETRY_DELAY_MS = 5_000;
+const GATEWAY_CLI_TIMEOUT_MS = 30_000;
 const GATEWAY_STOP_PROOF_ATTEMPTS = 100;
 const GATEWAY_STOP_PROOF_RETRY_DELAY_MS = 100;
 const GATEWAY_SUSPEND_TIMEOUT_MS = 10_000;
@@ -1013,7 +1014,7 @@ export function parseLaunchctlArguments(output) {
     : [];
 }
 
-function runBuiltGatewayCli(checkout, args, deployment, options = {}) {
+export function runBuiltGatewayCli(checkout, args, deployment, options = {}) {
   const observedDeployment = deployment ?? readManagedGatewayLaunchAgent(checkout);
   const sourceEntrypoint = path.join(checkout, "dist/index.js");
   let managedDeployment = observedDeployment;
@@ -1105,7 +1106,9 @@ function runBuiltGatewayCli(checkout, args, deployment, options = {}) {
       cwd: workingDirectory ?? path.dirname(path.dirname(entrypoint)),
       encoding: "utf8",
       env,
+      killSignal: "SIGKILL",
       stdio: ["ignore", "pipe", options.stderr ?? "inherit"],
+      timeout: options.timeoutMs ?? GATEWAY_CLI_TIMEOUT_MS,
     });
   } finally {
     rmSync(overlayPath, { force: true });
 
@@ -8,12 +8,15 @@ inputs:
   contents-private-key:
     description: GitHub App private key with contents write access.
     required: true
-  pull-request-app-id:
-    description: GitHub App id with pull-request write access.
+  pull-request-client-id:
+    description: GitHub App client id with pull-request write access.
     required: true
   pull-request-private-key:
     description: GitHub App private key with pull-request write access.
     required: true
+  pull-request-contents-permission:
+    description: Optional contents permission for pull-request operations that require repository write access.
+    required: false
 
 outputs:
   contents-token:
@@ -40,8 +43,9 @@ runs:
       id: pull-request-token
       uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
       with:
-        app-id: ${{ inputs.pull-request-app-id }}
+        client-id: ${{ inputs.pull-request-client-id }}
         private-key: ${{ inputs.pull-request-private-key }}
         owner: ${{ github.repository_owner }}
         repositories: ${{ github.event.repository.name }}
+        permission-contents: ${{ inputs.pull-request-contents-permission }}
         permission-pull-requests: write
@@ -8,8 +8,8 @@ inputs:
   contents-private-key:
     description: GitHub App private key with contents write access.
     required: true
-  pull-request-app-id:
-    description: GitHub App id with pull-request write access.
+  pull-request-client-id:
+    description: GitHub App client id with pull-request write access.
     required: true
   pull-request-private-key:
     description: GitHub App private key with pull-request write access.
@@ -57,8 +57,9 @@ runs:
       with:
         contents-client-id: ${{ inputs.contents-client-id }}
         contents-private-key: ${{ inputs.contents-private-key }}
-        pull-request-app-id: ${{ inputs.pull-request-app-id }}
+        pull-request-client-id: ${{ inputs.pull-request-client-id }}
         pull-request-private-key: ${{ inputs.pull-request-private-key }}
+        pull-request-contents-permission: ${{ inputs.auto-merge == 'true' && 'write' || '' }}
 
     - name: Publish generated pull request
       shell: bash