openclaw
diff --git a/‎.agents/skills/openclaw-changelog-update/scripts/verify-release-notes.mjs‎
Lines changed: 90 additions & 23 deletions b/‎.agents/skills/openclaw-changelog-update/scripts/verify-release-notes.mjs‎
Lines changed: 90 additions & 23 deletions
diff --git a/‎.agents/skills/openclaw-parallels-smoke/SKILL.md‎
Lines changed: 11 additions & 1 deletion b/‎.agents/skills/openclaw-parallels-smoke/SKILL.md‎
Lines changed: 11 additions & 1 deletion
diff --git a/‎.agents/skills/release-openclaw-maintainer/SKILL.md‎
Lines changed: 62 additions & 3 deletions b/‎.agents/skills/release-openclaw-maintainer/SKILL.md‎
Lines changed: 62 additions & 3 deletions
@@ -2,6 +2,7 @@
 
 import { execFileSync } from "node:child_process";
 import { readFileSync, writeFileSync } from "node:fs";
+import { pathToFileURL } from "node:url";
 
 const repo = "openclaw/openclaw";
 const commitAssociationQueryBatchSize = 20;
@@ -221,6 +222,42 @@ function referencesIn(text) {
   return references;
 }
 
+function referenceLabelsIn(text) {
+  const labels = [];
+  for (const match of text.matchAll(
+    /(?<![A-Za-z0-9_.&-])(?:(?<owner>[A-Za-z0-9_.-]+)\/(?<name>[A-Za-z0-9_.-]+))?#(?<number>\d+)/g,
+  )) {
+    const qualifiedRepository = match.groups?.owner
+      ? `${match.groups.owner}/${match.groups.name}`
+      : undefined;
+    labels.push(
+      !qualifiedRepository || qualifiedRepository.toLowerCase() === repo
+        ? `#${match.groups?.number}`
+        : `${qualifiedRepository}#${match.groups?.number}`,
+    );
+  }
+  return labels;
+}
+
+export function renderContributionRecordEntry(entry) {
+  const references = [];
+  appendUnique(references, referenceLabelsIn(entry.title));
+  appendUnique(
+    references,
+    (entry.priorReferences ?? []).map((number) => `#${number}`),
+  );
+  appendUnique(references, entry.externalReferences ?? []);
+  for (const issue of entry.linkedIssues) {
+    appendUnique(references, [`#${issue.number}`]);
+  }
+  const related = references.length > 0 ? ` Related ${references.join(", ")}.` : "";
+  const attribution =
+    entry.thanks.length > 0
+      ? ` Thanks ${entry.thanks.map((handle) => `@${handle}`).join(" and ")}.`
+      : "";
+  return `- **PR #${entry.number}**${related}${attribution}`;
+}
+
 function closingReferencesIn(text) {
   const references = [];
   for (const match of text.matchAll(
@@ -255,26 +292,38 @@ function handlesIn(text) {
     );
 }
 
-function relatedReferencesIn(line) {
-  const related = line.match(/\bRelated ((?:#\d+)(?:, #\d+)*)\./);
-  return related ? referencesIn(related[1]) : [];
+function externalReferencesIn(text) {
+  return referenceLabelsIn(text).filter((reference) => !reference.startsWith("#"));
+}
+
+function appendUnique(values, additions) {
+  const seen = new Set(values.map((value) => value.toLowerCase()));
+  for (const value of additions) {
+    const key = value.toLowerCase();
+    if (!seen.has(key)) {
+      values.push(value);
+      seen.add(key);
+    }
+  }
 }
 
 function addContributionRecordEntry(entries, key, entry) {
   const existing = entries.get(key);
   if (!existing) {
     entries.set(key, {
       ...entry,
+      externalReferences: [...(entry.externalReferences ?? [])],
       references: [...entry.references],
       thanks: [...entry.thanks],
     });
     return;
   }
+  appendUnique(existing.externalReferences, entry.externalReferences ?? []);
   appendReferences(existing.references, entry.references);
   addHandles(existing.thanks, entry.thanks);
 }
 
-function contributionRecordFor(section) {
+export function contributionRecordFor(section) {
   const result = { legacyIssues: new Map(), pullRequests: new Map() };
   const recordStart = section.source.search(/\n### Complete contribution (?:ledger|record)\r?$/m);
   if (recordStart < 0) {
@@ -301,8 +350,10 @@ function contributionRecordFor(section) {
       const number = explicitRecord?.[1] ?? legacyRecord?.[1];
       if (number) {
         const value = Number(number);
+        const metadata = explicitRecord ? line.slice(explicitRecord[0].length) : line;
         addContributionRecordEntry(result.pullRequests, value, {
-          references: relatedReferencesIn(line),
+          externalReferences: externalReferencesIn(metadata),
+          references: referencesIn(metadata).filter((reference) => reference !== value),
           thanks: handlesIn(line),
         });
       }
@@ -345,6 +396,7 @@ function withoutRevertedContributionRecords(record, revertedReferences) {
     }
     addContributionRecordEntry(filtered.pullRequests, number, {
       ...entry,
+      externalReferences: entry.externalReferences,
       references: entry.references.filter((reference) => !revertedReferences.has(reference)),
     });
   }
@@ -1153,7 +1205,7 @@ function mergeIssues(...groups) {
   return [...entries.values()];
 }
 
-function ledgerFor(
+export function ledgerFor(
   base,
   target,
   references,
@@ -1203,6 +1255,8 @@ function ledgerFor(
   const issues = entries.filter((entry) => entry.type === "Issue");
   const legacyIssues = legacyIssuesByPullRequest(priorRecord, nodes);
   const records = pullRequests.map((entry) => {
+    const priorEntry = priorRecord.pullRequests.get(entry.number);
+    const priorReferences = priorEntry?.references ?? [];
     const titleIssues = issueEntries(referencesIn(entry.title), nodes);
     const closingIssues = issueEntries(
       entry.closingIssuesReferences?.nodes.map((issue) => issue.number) ?? [],
@@ -1212,41 +1266,31 @@ function ledgerFor(
       titleIssues,
       closingIssues,
       relationships.issuesByPullRequest.get(entry.number) ?? [],
+      issueEntries(priorReferences, nodes),
       issueEntries(legacyIssues.get(entry.number) ?? [], nodes, priorRecord.legacyIssues),
     );
-    const titleIssueNumbers = new Set(titleIssues.map((issue) => issue.number));
-    const relatedIssues = linkedIssues.filter((issue) => !titleIssueNumbers.has(issue.number));
     const thanks = [...entry.thanks];
+    addHandles(thanks, priorEntry?.thanks ?? []);
     for (const issue of linkedIssues) {
       addHandles(thanks, issue.thanks);
     }
     return {
       ...entry,
       ...editorialClassification(entry.title),
+      externalReferences: priorEntry?.externalReferences ?? [],
       linkedIssues,
-      relatedIssues,
+      priorReferences,
       thanks,
     };
   });
-  const renderEntry = (entry) => {
-    const attribution =
-      entry.thanks.length > 0
-        ? ` Thanks ${entry.thanks.map((handle) => `@${handle}`).join(" and ")}.`
-        : "";
-    const relatedIssues =
-      entry.relatedIssues.length > 0
-        ? ` Related ${entry.relatedIssues.map((issue) => `#${issue.number}`).join(", ")}.`
-        : "";
-    return `- **PR #${entry.number}** ${withSentenceEnding(entry.title)}${relatedIssues}${attribution}`;
-  };
   const ledger = [
     "### Complete contribution record",
     "",
     `This audited record covers the complete ${base}..${target} history: ${records.length} merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.`,
     "",
     "#### Pull requests",
     "",
-    ...records.map((entry) => renderEntry(entry)),
+    ...records.map((entry) => renderContributionRecordEntry(entry)),
   ].join("\n");
   return {
     entries,
@@ -1267,7 +1311,7 @@ function replaceLedger(changelog, section, ledger, pullRequests, directCommits)
   return `${changelog.slice(0, section.start)}${replacement}${changelog.slice(section.end)}`;
 }
 
-function ledgerChecks(section, pullRequests, nodes, directCommits) {
+export function ledgerChecks(section, pullRequests, nodes, directCommits) {
   const errors = [];
   if (/@undefined\b/i.test(section.source)) {
     errors.push("release section contains invalid @undefined contributor credit");
@@ -1311,6 +1355,25 @@ function ledgerChecks(section, pullRequests, nodes, directCommits) {
         errors.push(`missing Thanks @${handle} for #${entry.number}`);
       }
     }
+    const expectedReferences = [];
+    appendUnique(expectedReferences, referenceLabelsIn(entry.title));
+    appendUnique(
+      expectedReferences,
+      entry.priorReferences.map((number) => `#${number}`),
+    );
+    appendUnique(expectedReferences, entry.externalReferences);
+    appendUnique(
+      expectedReferences,
+      entry.linkedIssues.map((issue) => `#${issue.number}`),
+    );
+    const actualReferences = new Set(
+      referenceLabelsIn(line).map((reference) => reference.toLowerCase()),
+    );
+    for (const reference of expectedReferences) {
+      if (!actualReferences.has(reference.toLowerCase())) {
+        errors.push(`missing ${reference} on contribution record for PR #${entry.number}`);
+      }
+    }
   }
   const editorialProse = section.source.slice(0, ledgerStart);
   for (const entry of pullRequests) {
@@ -1402,6 +1465,8 @@ function manifestFor(options, source, ledger, directCommitRecords) {
       type: entry.type,
       editorialEligible: entry.editorialEligible,
       thanks: entry.thanks,
+      externalReferences: entry.externalReferences,
+      relatedReferences: [...new Set([...entry.priorReferences, ...referencesIn(entry.title)])],
       linkedIssues: entry.linkedIssues.map((issue) => ({
         number: issue.number,
         title: issue.title,
@@ -1620,4 +1685,6 @@ function main() {
   }
 }
 
-main();
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main();
+}
@@ -9,7 +9,17 @@ Use this skill for Parallels guest workflows and smoke interpretation. Do not lo
 
 ## Global rules
 
-- Use the snapshot most closely matching the requested fresh baseline.
+- Inventory existing VMs and snapshots before provisioning anything. When a preconfigured pristine
+  snapshot matches the requested baseline, switch to it and reuse its user, tools, and base setup.
+  Do not create a new VM, reinstall macOS, or rebuild the guest baseline for a "fresh" run.
+- "Fresh" means restoring the closest existing pristine snapshot, not creating another snapshot.
+  Do not create ad-hoc snapshots unless the user explicitly asks or no suitable baseline exists;
+  restore the original snapshot and leave the guest stopped after an ad-hoc run.
+- Inspect the snapshot state before restoring it. A pristine `poweron` snapshot can contain the
+  preconfigured logged-in session; switch to it normally so Parallels resumes that session. Do not
+  pass `--skip-resume` at test entry unless the run intentionally needs to discard the saved session
+  and boot from the login window. `--skip-resume` is acceptable for final cleanup that must leave the
+  restored source guest stopped.
 - Gateway verification in smoke runs should use `openclaw gateway status --deep --require-rpc` unless the stable version being checked does not support it yet.
 - Stable `2026.3.12` pre-upgrade diagnostics may require a plain `gateway status --deep` fallback.
 - Treat `precheck=latest-ref-fail` on that stable pre-upgrade lane as baseline, not automatically a regression.
 
@@ -1,11 +1,15 @@
 ---
 name: release-openclaw-maintainer
-description: Prepare or verify OpenClaw stable/beta releases, changelogs, release notes, publish commands, and artifacts.
+description: Prepare or verify OpenClaw stable, beta, and extended-stable releases, including backport discovery, changelogs, release notes, publish commands, and artifacts.
 ---
 
 # OpenClaw Release Maintainer
 
-Use this skill for release and publish-time workflow. Load `$release-private` if it exists before resolving Peter-owned credential locators or private host topology. Keep ordinary development changes and GHSA-specific advisory work outside this skill.
+Use this skill for release and publish-time workflow, including preparing the
+approved backport set for an extended-stable maintenance release. Load
+`$release-private` if it exists before resolving Peter-owned credential
+locators or private host topology. Keep ordinary development changes and
+GHSA-specific advisory work outside this skill.
 
 ## Respect release guardrails
 
@@ -138,9 +142,64 @@ prepare-run <PR>`.
 - When asked to announce on X, use `~/Projects/bird/bird` and follow the
   release tweet style below.
 
+## Prepare extended-stable backports
+
+When asked to create the initial `.33` extended-stable line or a later
+maintenance patch, read
+`references/extended-stable-backports.md` and follow it before version, tag, or
+publication work. Treat backport discovery and preparation as an ability of
+this release skill, not as a separate release workflow.
+
+The backport ability owns the complete mainline inventory, private-security
+reconciliation, candidate decisions, maintainer approval, coordinated staging
+PR, and proof handoff. After that PR lands, use the dedicated npm-only sequence
+below. Never route `.33+` through the regular beta/stable release sequence.
+
+## Publish extended-stable releases
+
+Use this path only for the trailing completed month's `.33+` line. Treat
+`docs/reference/RELEASING.md`,
+`scripts/openclaw-npm-extended-stable-release.mjs`, and the release workflows
+on pinned current `main` as the exact command and validation contract.
+
+1. Check out the canonical `extended-stable/YYYY.M.33` branch after the
+   approved backport PR lands. Require its tip, root package version, every
+   publishable official plugin version, and intended immutable `vYYYY.M.P` tag
+   to identify one exact release commit.
+2. Create and push `vYYYY.M.P` at that exact branch tip only after version prep
+   and focused backport proof are complete.
+3. Dispatch `openclaw-npm-release.yml` with `preflight_only=true` and
+   `npm_dist_tag=extended-stable` from the canonical branch. Save the successful
+   npm preflight run ID.
+4. Dispatch `full-release-validation.yml` from the same branch with
+   `ref=extended-stable/YYYY.M.33` and `release_profile=stable`. Save the
+   successful exact-head validation run ID.
+5. Dispatch `plugin-npm-release.yml` from the same branch with
+   `publish_scope=all-publishable`, the full release SHA as `ref`, and
+   `npm_dist_tag=extended-stable`. Require complete exact-version and selector
+   readback, then save the successful plugin run ID.
+6. Dispatch the real `openclaw-npm-release.yml` publish from the same branch
+   with the intended tag, `npm_dist_tag=extended-stable`, and all three saved
+   run IDs. The workflow must publish the exact prepared core tarball and prove
+   the referenced runs match the canonical branch and release SHA.
+7. Independently verify the exact core package, every official plugin package,
+   and all `extended-stable` selectors. If only the core selector readback
+   fails, use the `openclaw` repair command generated by the core workflow. If
+   an official-plugin selector is missing or stale for an already-published
+   version, use the approved credential-isolated release tooling for manual
+   plugin tag repair; the OIDC source workflow cannot mutate that tag. Never
+   republish an immutable version.
+8. Do not create a GitHub Release or publish macOS, Windows, Docker, mobile,
+   website, ClawHub, or private dist-tag artifacts from this path.
+
 ## Keep release channel naming aligned
 
-- `stable`: tagged releases only, published to npm `beta` by default; operators may target npm `latest` explicitly or promote later
+- `stable`: user updates resolve npm `latest`; tagged regular releases publish
+  to npm `beta` by default, then operators may target or promote to `latest`
+  explicitly
+- `extended-stable`: user updates resolve npm `extended-stable`; operators
+  publish the trailing completed month's `.33+` line from
+  `extended-stable/YYYY.M.33`
 - `beta`: prerelease tags like `vYYYY.M.PATCH-beta.N`, with npm dist-tag `beta`
 - Prefer `-beta.N`; do not mint new `-1` or `-2` beta suffixes
 - `dev`: moving head on `main`