openclaw
diff --git a/‎.agents/skills/openclaw-ci-limits/SKILL.md‎
Lines changed: 14 additions & 9 deletions b/‎.agents/skills/openclaw-ci-limits/SKILL.md‎
Lines changed: 14 additions & 9 deletions
diff --git a/‎.agents/skills/release-openclaw-mac/SKILL.md‎
Lines changed: 51 additions & 10 deletions b/‎.agents/skills/release-openclaw-mac/SKILL.md‎
Lines changed: 51 additions & 10 deletions
@@ -13,13 +13,17 @@ registration edge limit.
 
 - The scarce resource is Blacksmith runner registrations, not Blacksmith vCPU
   capacity.
-- GitHub runner registrations are capped at 1,500 per 5 minutes per repository,
-  organization, or enterprise. The `openclaw` organization shares one bucket.
+- GitHub runner registrations for `openclaw` currently report a 10,000 per
+  5-minute bucket in `actions_runner_registration`. Verify the live bucket
+  before each tuning pass because GitHub can change it. The `openclaw`
+  organization shares one bucket.
 - Core REST quota does not draw down this bucket. Check
   `actions_runner_registration` separately; core quota can be healthy while
   runner registration is throttled.
-- Use 1,000 registrations per 5 minutes as the operating target. Leave the last
-  third for other repos, retries, and burst overlap.
+- Use about 60% of the live bucket as the operating target. With the current
+  10,000-registration bucket, keep planned Blacksmith burst load under 6,000
+  registrations per 5 minutes and leave the rest for other repos, retries, and
+  burst overlap.
 - Jobs that route, notify, summarize, choose shards, or run short CodeQL quality
   scans should stay on GitHub-hosted runners unless measured evidence says
   Blacksmith is required.
@@ -87,9 +91,10 @@ admission. The debounce only suppresses pushes that arrive while
 registrations are spent even if a later push cancels the run. If timing is
 uncertain, count every sequential push in the window.
 
-Reject a change unless the org-level worst case stays below 1,000 registrations
-per 5 minutes with headroom for ClawSweeper, ClawHub, Clownfish, OpenClaw RTT,
-and Clawbench.
+Reject a change unless the org-level worst case stays below about 60% of the
+live bucket. With the current 10,000-registration bucket, keep planned
+Blacksmith burst load under 6,000 registrations per 5 minutes with headroom for
+ClawSweeper, ClawHub, Clownfish, OpenClaw RTT, and Clawbench.
 
 ## Safe Levers
 
@@ -127,8 +132,8 @@ These are intentionally guarded by `test/scripts/ci-workflow-guards.test.ts`:
 - `runner-admission` on `ubuntu-24.04` with
   `OPENCLAW_MAIN_CI_DEBOUNCE_SECONDS=90`.
 - `preflight` and `security-fast` needing `runner-admission`.
-- CI matrix caps: fast/check lanes at 8, compact Node PR plan at current caps,
-  Windows and Android at 2.
+- CI matrix caps: fast/check lanes at 12, Node test shards at 24, Windows and
+  Android at 2.
 - `build-artifacts` on `blacksmith-16vcpu-ubuntu-2404`.
 - lower-weight Node/check shards on `blacksmith-4vcpu-ubuntu-2404`.
 - heavy retained Linux/Android shards on `blacksmith-8vcpu-ubuntu-2404`.
 
@@ -5,7 +5,7 @@ description: "Run or recover OpenClaw macOS release signing, notarization, appca
 
 # OpenClaw Mac Release
 
-Use with `$release-openclaw-maintainer`, `$release-openclaw-ci`, `$one-password`, and `$release-private` if it exists when stable macOS assets, private mac preflight, notarization, appcast promotion, or mac release recovery is involved.
+Use with `$release-openclaw-maintainer`, `$release-openclaw-ci`, `$one-password`, and `$release-private` if it exists when stable macOS assets, release-ops mac preflight, notarization, appcast promotion, or mac release recovery is involved.
 
 ## Credentials
 
@@ -23,7 +23,7 @@ Use with `$release-openclaw-maintainer`, `$release-openclaw-ci`, `$one-password`
 
 ## GitHub Secrets
 
-Target private repo environment: `openclaw/releases-private`, env `mac-release`.
+Target release-ops repo environment: `openclaw/releases`, env `mac-release`.
 
 Set only after local notary auth validation:
 
@@ -35,12 +35,24 @@ Do not update these from mixed sources. All three ASC fields must come from the
 
 ## Workflow Shape
 
+- `openclaw/openclaw` is the public product repo. Its GitHub Releases page is
+  where macOS assets are ultimately attached.
+- `openclaw/openclaw` `macos-release.yml` is public handoff validation only.
+  It never signs, notarizes, or uploads macOS assets, regardless of
+  `preflight_only`.
+- `openclaw/releases` is the restricted release-ops repo. Its macOS workflows
+  sign, notarize, validate, and promote assets onto the
+  `openclaw/openclaw` GitHub release.
 - Public release branch may carry mac-only packaging fixes after the stable tag/npm are already live.
-- Use `source_ref=release/YYYY.M.PATCH` for private mac preflight/validation when building that branch variation.
+- Use `source_ref=release/YYYY.M.PATCH` for release-ops mac preflight/validation when building that branch variation.
 - Keep `tag=vYYYY.M.PATCH` pointing at the original stable release commit.
 - Real mac publish must reuse:
-  - a successful private mac preflight run for the same tag/source SHA
-  - a successful private mac validation run for the same tag/source SHA
+  - a successful release-ops mac preflight run for the same tag/source SHA
+  - a successful release-ops mac validation run for the same tag/source SHA
+- Release-ops preflight and real publish enter the protected `mac-release`
+  environment in the `build_sign_and_package` job. Operators may be able to
+  trigger the workflow while Vincent or another environment reviewer approves
+  the paused deployment before signing/notarization/promotion proceeds.
 - If preflight source SHA differs from tag SHA, validation must also use the same `source_ref`; promotion rejects mismatched proof.
 
 ## Notarization
@@ -52,10 +64,25 @@ Do not update these from mixed sources. All three ASC fields must come from the
 
 ## Dispatch
 
-Private preflight:
+Public handoff validation:
 
 ```bash
-gh workflow run openclaw-macos-publish.yml --repo openclaw/releases-private --ref main \
+gh workflow run macos-release.yml --repo openclaw/openclaw \
+  --ref release/YYYY.M.PATCH \
+  -f tag=vYYYY.M.PATCH \
+  -f preflight_only=true \
+  -f public_release_branch=release/YYYY.M.PATCH
+```
+
+- Use the public release branch as the workflow ref so the Actions list displays
+  `release/YYYY.M.PATCH`, matching prior stable macOS handoff runs.
+- Do not use `--ref main` or `--ref vYYYY.M.PATCH` for this public handoff
+  validation. The workflow checks out the tag from the `tag` input internally.
+
+Release-ops preflight:
+
+```bash
+gh workflow run openclaw-macos-publish.yml --repo openclaw/releases --ref main \
   -f tag=vYYYY.M.PATCH \
   -f source_ref=release/YYYY.M.PATCH \
   -f preflight_only=true \
@@ -64,18 +91,24 @@ gh workflow run openclaw-macos-publish.yml --repo openclaw/releases-private --re
   -f public_release_branch=release/YYYY.M.PATCH
 ```
 
-Private validation for a branch-variation preflight:
+Wait for the run to reach the `mac-release` environment approval if GitHub
+pauses it, then get approval from Vincent or another configured environment
+reviewer. Record the successful preflight run id.
+
+Release-ops validation for a branch-variation preflight:
 
 ```bash
-gh workflow run openclaw-macos-validate.yml --repo openclaw/releases-private --ref main \
+gh workflow run openclaw-macos-validate.yml --repo openclaw/releases --ref main \
   -f tag=vYYYY.M.PATCH \
   -f source_ref=release/YYYY.M.PATCH
 ```
 
+Record the successful validation run id.
+
 Real publish:
 
 ```bash
-gh workflow run openclaw-macos-publish.yml --repo openclaw/releases-private --ref main \
+gh workflow run openclaw-macos-publish.yml --repo openclaw/releases --ref main \
   -f tag=vYYYY.M.PATCH \
   -f preflight_only=false \
   -f smoke_test_only=false \
@@ -85,6 +118,14 @@ gh workflow run openclaw-macos-publish.yml --repo openclaw/releases-private --re
   -f public_release_branch=release/YYYY.M.PATCH
 ```
 
+Wait for the `mac-release` environment approval again if GitHub pauses the real
+publish run before it promotes assets.
+
+- Release-ops `openclaw/releases` publish/validate workflows run from their own
+  trusted `main` workflow ref. Real publish has a guard that rejects any other
+  workflow ref. That displayed `main` ref is expected; the public OpenClaw
+  source is selected by `tag` and optional `source_ref`.
+
 ## Verify
 
 - `gh release view vYYYY.M.PATCH --repo openclaw/openclaw` shows zip, dmg, dSYM zip, not draft, not prerelease.