openclaw
diff --git a/‎.agents/skills/autoreview/SKILL.md‎
Lines changed: 10 additions & 9 deletions b/‎.agents/skills/autoreview/SKILL.md‎
Lines changed: 10 additions & 9 deletions
diff --git a/‎.agents/skills/autoreview/scripts/autoreview‎
Lines changed: 8 additions & 17 deletions b/‎.agents/skills/autoreview/scripts/autoreview‎
Lines changed: 8 additions & 17 deletions
diff --git a/‎.agents/skills/crabbox/SKILL.md‎
Lines changed: 23 additions & 0 deletions b/‎.agents/skills/crabbox/SKILL.md‎
Lines changed: 23 additions & 0 deletions
diff --git a/‎.agents/skills/openclaw-release-ci/SKILL.md‎
Lines changed: 4 additions & 1 deletion b/‎.agents/skills/openclaw-release-ci/SKILL.md‎
Lines changed: 4 additions & 1 deletion
diff --git a/‎.agents/skills/openclaw-release-maintainer/SKILL.md‎
Lines changed: 7 additions & 0 deletions b/‎.agents/skills/openclaw-release-maintainer/SKILL.md‎
Lines changed: 7 additions & 0 deletions
diff --git a/‎.crabbox.yaml‎
Lines changed: 4 additions & 0 deletions b/‎.crabbox.yaml‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎.github/actions/setup-node-env/action.yml‎
Lines changed: 3 additions & 1 deletion b/‎.github/actions/setup-node-env/action.yml‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎.github/actions/setup-pnpm-store-cache/action.yml‎
Lines changed: 77 additions & 0 deletions b/‎.github/actions/setup-pnpm-store-cache/action.yml‎
Lines changed: 77 additions & 0 deletions
diff --git a/‎.github/labeler.yml‎
Lines changed: 5 additions & 0 deletions b/‎.github/labeler.yml‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎.github/workflows/crabbox-hydrate.yml‎
Lines changed: 9 additions & 2 deletions b/‎.github/workflows/crabbox-hydrate.yml‎
Lines changed: 9 additions & 2 deletions
@@ -23,10 +23,11 @@ Use when:
 - Prefer small fixes at the right ownership boundary; no refactor unless it clearly improves the bug class.
 - Keep going until the selected review path returns no accepted/actionable findings.
 - If a review-triggered fix changes code, rerun focused tests and rerun the review helper.
-- Default to Codex review. If Codex is unavailable or exits with an error, the helper falls back to the first configured CLI from `claude -p`, `pi -p`, `opencode run`, `droid exec`, or `copilot`. Prefer Codex for final closeout because it uses native review mode; non-Codex reviewers use a Codex-inspired generated diff prompt. The helper runs nested Codex review in yolo/full-access mode by default; use `--no-yolo` only when intentionally testing sandbox behavior.
+- Default to Codex review with no fallback. Prefer Codex for final closeout because it uses native review mode; non-Codex reviewers use a Codex-inspired generated diff prompt. Use `--fallback-reviewer auto|claude|pi|opencode|droid|copilot` only when a second-model fallback is explicitly wanted and authenticated. The helper runs nested Codex review in yolo/full-access mode by default; use `--no-yolo` only when intentionally testing sandbox behavior.
 - Stop as soon as the review command/helper exits 0 with no accepted/actionable findings. Do not run an extra direct `codex review` just to get a nicer "clean" line, a second opinion, or clearer closeout wording.
 - Treat the helper's successful exit plus absence of actionable findings as the clean review result, even if the underlying Codex CLI output is terse.
 - If rejecting a finding as intentional/not worth fixing, add a brief inline code comment only when it explains a real invariant or ownership decision that future reviewers should know.
+- If creating or updating a PR while rejecting any autoreview finding, record the rejected finding and reason in the PR description so later reviewers can distinguish intentional design decisions from missed review output.
 - Do not push just to review. Push only when the user requested push/ship/PR update.
 - For OpenClaw maintainers, keep autoreview validation Crabbox/Testbox-aware when maintainer validation mode is enabled (`OPENCLAW_TESTBOX=1` or `AUTOREVIEW_OPENCLAW_MAINTAINER_VALIDATION=1`). A review pass may inspect files and run cheap non-Node probes, but it must not start local `pnpm`, Vitest, `tsgo`, `npm test`, or `node scripts/run-vitest.mjs` from a Codex/worktree review unless the operator explicitly requested local proof. For runtime proof, use existing evidence or route through Crabbox/Testbox and report the id. Do not apply this rule to ordinary contributors who do not have maintainer Testbox access.
 
@@ -51,11 +52,11 @@ git fetch origin
 codex review --base origin/main
 ```
 
-Do not pass any prompt with `--base`. Some Codex CLI versions reject both inline
-and stdin prompt forms, including the helper's `codex review --base <ref> -`,
-with `--base <BRANCH> cannot be used with [PROMPT]`. If the helper hits this
-error, run plain `codex review --base <ref>` and report that the helper prompt
-injection was skipped.
+Do not pass any prompt with `--base`, `--commit`, or `--uncommitted`. Codex CLI
+review targets and custom review prompts are mutually exclusive: target modes
+generate their own review prompt internally. Use plain target review for native
+Codex closeout, or use custom prompt review (`codex review -`) only when you
+intentionally want a generated diff prompt instead of native target review.
 
 If an open PR exists, use its actual base:
 
@@ -116,13 +117,13 @@ The helper:
 - use `--mode commit --commit <ref>` for already-committed work, especially clean `main` after landing
 - should be left in `--mode auto` or forced to `--mode branch` for PR/branch work; do not force `--mode local` after committing
 - supports `--reviewer codex|claude|pi|opencode|droid|copilot|auto`; `auto` means Codex first
-- supports `--fallback-reviewer auto|claude|pi|opencode|droid|copilot|none`; default is configured CLI fallback
+- supports `--fallback-reviewer auto|claude|pi|opencode|droid|copilot|none`; default is `none`
 - falls back only when Codex is unavailable or exits nonzero, not when Codex reports findings
 - writes only to stdout unless `--output` or `AUTOREVIEW_OUTPUT` is set
 - supports `--dry-run`, `--parallel-tests`, and commit refs
 - runs nested review with `--dangerously-bypass-approvals-and-sandbox --sandbox danger-full-access` by default
-- injects maintainer-only OpenClaw validation policy into native Codex review when `OPENCLAW_TESTBOX=1` or `AUTOREVIEW_OPENCLAW_MAINTAINER_VALIDATION=1`, so local memory-heavy Node/Vitest checks are avoided in favor of Crabbox/Testbox proof
-- branch mode may fail on Codex CLI versions that reject `--base` plus the helper's stdin prompt; on that exact parser error, rerun plain `codex review --base <ref>` instead of falling back to a non-Codex reviewer
+- with `OPENCLAW_TESTBOX=1` or `AUTOREVIEW_OPENCLAW_MAINTAINER_VALIDATION=1`, disables auto local `pnpm run check` and routes Codex through generated prompt review (`codex review -`) so the no-local-heavy-tests policy is included; native Codex target review cannot accept extra prompt text
+- non-Codex reviewers receive the generated diff prompt and maintainer validation policy text when maintainer validation is active
 - keeps accepting `--full-access`; use `--no-yolo` or `AUTOREVIEW_YOLO=0` to opt out
 - still accepts legacy `CODEX_REVIEW_*` env vars when the matching `AUTOREVIEW_*` var is unset
 - prints `autoreview clean: no accepted/actionable findings reported` when the selected review command exits 0
 
@@ -11,9 +11,9 @@ Options:
   --base REF                 Base ref for branch review. Default: PR base or origin/main.
   --commit REF               Commit ref for commit review. Default: HEAD.
   --reviewer codex|claude|pi|opencode|droid|copilot|auto
-                              Review engine. Default: Codex with configured fallback on error.
+                              Review engine. Default: Codex.
   --fallback-reviewer auto|claude|pi|opencode|droid|copilot|none
-                              Fallback when Codex is unavailable or exits nonzero. Default: auto.
+                              Fallback when Codex is unavailable or exits nonzero. Default: none.
   --codex-bin PATH           Codex binary. Default: codex.
   --claude-bin PATH          Claude binary. Default: claude.
   --pi-bin PATH              Pi binary. Default: pi.
@@ -44,7 +44,7 @@ mode=auto
 base_ref=
 commit_ref=HEAD
 reviewer=${AUTOREVIEW_REVIEWER:-${CODEX_REVIEW_REVIEWER:-auto}}
-fallback_reviewer=${AUTOREVIEW_FALLBACK_REVIEWER:-${CODEX_REVIEW_FALLBACK_REVIEWER:-auto}}
+fallback_reviewer=${AUTOREVIEW_FALLBACK_REVIEWER:-${CODEX_REVIEW_FALLBACK_REVIEWER:-none}}
 codex_bin=${CODEX_BIN:-codex}
 claude_bin=${CLAUDE_BIN:-claude}
 pi_bin=${PI_BIN:-pi}
@@ -58,7 +58,6 @@ parallel_tests=
 parallel_tests_auto=false
 dry_run=false
 codex_review_prompt=
-codex_review_stdin_prompt=false
 codex_review_prompt_file=false
 openclaw_maintainer_validation=${AUTOREVIEW_OPENCLAW_MAINTAINER_VALIDATION:-${OPENCLAW_TESTBOX:-0}}
 
@@ -249,13 +248,8 @@ OpenClaw maintainer autoreview validation policy:
 - If remote validation is not necessary for the finding, state the targeted proof that should be run instead of starting local tests.
 EOF
 )
-  if [[ "$review_kind" == local ]]; then
-    review_cmd+=(-)
-    codex_review_stdin_prompt=true
-  else
-    review_cmd=("$codex_bin" "${codex_args[@]}" review -)
-    codex_review_prompt_file=true
-  fi
+  review_cmd=("$codex_bin" "${codex_args[@]}" review -)
+  codex_review_prompt_file=true
 fi
 
 printf 'autoreview target: %s\n' "$review_kind"
@@ -278,8 +272,8 @@ if [[ "$reviewer" == auto || "$reviewer" == codex ]]; then
   printf 'review:'
   printf ' %q' "${review_cmd[@]}"
   printf '\n'
-  if [[ "$codex_review_stdin_prompt" == true || "$codex_review_prompt_file" == true ]]; then
-    printf 'review policy: OpenClaw maintainer Crabbox/Testbox-aware validation prompt injected\n'
+  if [[ "$codex_review_prompt_file" == true ]]; then
+    printf 'review policy: OpenClaw maintainer validation active; using generated prompt review because Codex target review cannot accept extra prompt text\n'
   fi
 else
   printf 'review: %s prompt review\n' "$reviewer"
@@ -337,11 +331,8 @@ run_review() {
     rm -f "$prompt_file"
     prompt_file=
     return "$status"
-  elif [[ "$codex_review_stdin_prompt" == true ]]; then
-    printf '%s\n' "$codex_review_prompt" | "${review_cmd[@]}" 2>&1 | tee "$review_output"
-  else
-    "${review_cmd[@]}" 2>&1 | tee "$review_output"
   fi
+  "${review_cmd[@]}" 2>&1 | tee "$review_output"
 }
 
 diff_for_review() {
 
@@ -45,6 +45,10 @@ pnpm crabbox:run -- --help | sed -n '1,120p'
   shim can be stale.
 - Check `.crabbox.yaml` for direct-provider defaults. Omitting `--provider`
   means brokered AWS today.
+- The brokered AWS default is a Linux developer image in `eu-west-1`; the repo
+  config pins hot `eu-west-1a/b/c` placement so Fast Snapshot Restore can apply.
+  If warmup drifts well past the minute-scale path, verify image promotion,
+  region/AZ placement, and FSR state before blaming OpenClaw.
 - For broad OpenClaw maintainer `pnpm` gates, prefer the repo wrapper with
   `--provider blacksmith-testbox` or the repo Testbox helpers when the standing
   Testbox policy applies.
@@ -78,6 +82,25 @@ Use these only when the task needs an existing non-Linux host. OpenClaw broad
 Linux validation uses the repo Crabbox config unless a provider is explicitly
 requested.
 
+Native brokered Windows is available for Windows-specific proof. Use the AWS
+developer image in `us-west-2` on demand; it has the expected OpenClaw developer
+toolchain and Docker image cache. Keep broad Linux gates on Linux/Testbox unless
+the bug is Windows-specific:
+
+```sh
+../crabbox/bin/crabbox warmup \
+  --provider aws \
+  --target windows \
+  --windows-mode normal \
+  --region us-west-2 \
+  --market on-demand \
+  --timing-json
+```
+
+The hydrate workflow assumes Docker should already be baked into Linux images
+and only installs it as a fallback. Do not add per-run Docker installs to proof
+commands unless the image probe shows Docker is actually missing.
+
 When the user explicitly asks for brokered macOS runners, use Crabbox AWS
 macOS only after confirming the deployed coordinator supports EC2 Mac host
 lifecycle/image routes and the operator has AWS EC2 Mac Dedicated Host quota
 
@@ -28,7 +28,10 @@ git status --short --branch
 git rev-parse HEAD
 ```
 
-If env lacks keys, use `$one-password` to inject or set them, then rerun the script. The script prints only provider status and HTTP class, never tokens.
+1Password service-account values are the first source for release provider
+preflight. Inject those exact targeted keys first, then run the verifier; use
+ambient env only when it was already intentionally injected for this release.
+The script prints only provider status and HTTP class, never tokens.
 
 ## Dispatch
 
 
@@ -170,6 +170,13 @@ live`; keep it clearly beta and avoid implying stable promotion.
   CI, validation, or internal release mechanics unless the release is explicitly
   about those. Peter prefers concrete user wins: features, integrations,
   workflow improvements, and practical reliability fixes.
+- Do not feature QA parity, test coverage, release gates, or validation lanes in
+  user-facing launch tweets. Keep them for release notes or maintainer proof
+  unless the operator explicitly asks for validation-focused copy.
+- Do not feature plugin-author or developer tooling such as SDK helpers,
+  tool-plugin scaffolding, build/validate/init commands, or internal CLI
+  plumbing in general user-facing launch tweets unless the operator explicitly
+  asks for developer-focused copy.
 - Tone: high-signal, slightly cheeky, confident, not corporate. One joke is
   enough. Avoid punching down, insulting users, or promising what was not
   verified.
 
@@ -6,6 +6,10 @@ capacity:
   strategy: most-available
   fallback: on-demand-after-120s
   hints: true
+  availabilityZones:
+    - eu-west-1a
+    - eu-west-1b
+    - eu-west-1c
   regions:
     - eu-west-1
     - eu-west-2
 
@@ -40,6 +40,7 @@ runs:
       id: pnpm-cache
       uses: ./.github/actions/setup-pnpm-store-cache
       with:
+        node-version: ${{ inputs.node-version }}
         pnpm-version: ${{ inputs.pnpm-version }}
         cache-key-suffix: ${{ inputs.cache-key-suffix }}
 
@@ -58,14 +59,15 @@ runs:
         if command -v bun &>/dev/null; then bun -v; fi
 
     - name: Capture node path
-      if: inputs.install-deps == 'true'
       shell: bash
       run: |
         node_bin="$(dirname "$(node -p 'process.execPath')")"
         if command -v cygpath >/dev/null 2>&1; then
           node_bin="$(cygpath -u "$node_bin")"
         fi
+        # zizmor: ignore[github-env] node_bin comes from trusted actions/setup-node output in this composite action.
         echo "NODE_BIN=$node_bin" >> "$GITHUB_ENV"
+        echo "$node_bin" >> "$GITHUB_PATH"
 
     - name: Install dependencies
       if: inputs.install-deps == 'true'
 
@@ -5,6 +5,10 @@ inputs:
     description: pnpm version to activate via corepack.
     required: false
     default: "11.0.8"
+  node-version:
+    description: Expected Node.js version already installed by actions/setup-node.
+    required: false
+    default: "24.x"
   cache-key-suffix:
     description: Suffix appended to the cache key.
     required: false
@@ -41,12 +45,85 @@ runs:
       env:
         COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
         PNPM_VERSION: ${{ inputs.pnpm-version }}
+        REQUESTED_NODE_VERSION: ${{ inputs.node-version }}
       run: |
         set -euo pipefail
         if [[ ! "$PNPM_VERSION" =~ ^[0-9]+(\.[0-9]+){1,2}([.-][0-9A-Za-z.-]+)?$ ]]; then
           echo "::error::Invalid pnpm-version input: '$PNPM_VERSION'"
           exit 2
         fi
+
+        requested_node="${REQUESTED_NODE_VERSION:-${NODE_VERSION:-}}"
+        requested_node="${requested_node#v}"
+
+        node_version_matches() {
+          local actual="$1"
+          local requested="$2"
+          if [[ -z "$requested" ]]; then
+            return 0
+          fi
+          case "$requested" in
+            *x)
+              [[ "${actual%%.*}" == "${requested%%.*}" ]]
+              ;;
+            *.*.*)
+              [[ "$actual" == "$requested" ]]
+              ;;
+            *.*)
+              [[ "$actual" == "$requested".* ]]
+              ;;
+            *)
+              [[ "${actual%%.*}" == "$requested" ]]
+              ;;
+          esac
+        }
+
+        active_node_version="$(node -p 'process.versions.node' 2>/dev/null || true)"
+        if ! node_version_matches "$active_node_version" "$requested_node"; then
+          node_roots=()
+          for root in \
+            "${RUNNER_TOOL_CACHE:-}" \
+            "${AGENT_TOOLSDIRECTORY:-}" \
+            "${ACTIONS_RUNNER_TOOL_CACHE:-}" \
+            "/opt/hostedtoolcache" \
+            "/home/runner/_work/_tool" \
+            "/Users/runner/hostedtoolcache" \
+            "/c/hostedtoolcache/windows"
+          do
+            if [[ -d "$root/node" ]]; then
+              node_roots+=("$root/node")
+            elif [[ "$(basename "$root")" == "node" && -d "$root" ]]; then
+              node_roots+=("$root")
+            fi
+          done
+
+          node_bin=""
+          for node_root in "${node_roots[@]}"; do
+            while IFS= read -r candidate; do
+              candidate_version="$("$candidate" -p 'process.versions.node' 2>/dev/null || true)"
+              if node_version_matches "$candidate_version" "$requested_node"; then
+                node_bin="$candidate"
+                break 2
+              fi
+            done < <(find "$node_root" \( -name node -o -name node.exe \) -type f 2>/dev/null | sort -r)
+          done
+
+          if [[ -n "$node_bin" ]]; then
+            echo "Using Node $("$node_bin" -p 'process.versions.node') from $node_bin"
+            export PATH="$(dirname "$node_bin"):$PATH"
+            hash -r
+          fi
+        fi
+
+        active_node_version="$(node -p 'process.versions.node' 2>/dev/null || true)"
+        if ! node_version_matches "$active_node_version" "$requested_node"; then
+          echo "::error::Expected Node '${requested_node}', but active node is '${active_node_version:-missing}' at $(command -v node || true)"
+          exit 1
+        fi
+
+        node -v
+        command -v node
+        command -v corepack
         corepack enable
         for attempt in 1 2 3; do
           if corepack prepare "pnpm@$PNPM_VERSION" --activate; then
 
@@ -286,6 +286,11 @@
   - changed-files:
       - any-glob-to-any-file:
           - "extensions/oc-path/**"
+"extensions: policy":
+  - changed-files:
+      - any-glob-to-any-file:
+          - "extensions/policy/**"
+          - "docs/cli/policy.md"
 "extensions: open-prose":
   - changed-files:
       - any-glob-to-any-file:
 
@@ -62,17 +62,20 @@ jobs:
           sudo ln -sf "$node_bin/corepack" /usr/local/bin/corepack
           sudo ln -sf "$pnpm_bin" /usr/local/bin/pnpm
 
-      - name: Ensure Docker is available
+      - name: Ensure Docker is running
         shell: bash
         run: |
           set -euo pipefail
 
           if ! command -v docker >/dev/null 2>&1; then
+            echo "docker not found; installing fallback engine"
             curl -fsSL https://get.docker.com | sudo sh
           fi
 
           if command -v systemctl >/dev/null 2>&1; then
-            sudo systemctl start docker
+            sudo systemctl start docker || true
+          elif command -v service >/dev/null 2>&1; then
+            sudo service docker start || true
           fi
 
           if [ -S /var/run/docker.sock ]; then
@@ -82,6 +85,10 @@ jobs:
             sudo chmod 666 /var/run/docker.sock
           fi
 
+          docker version
+          docker buildx version || true
+          docker compose version || true
+
       - name: Hydrate provider env helper
         shell: bash
         env: