Bug type

Behavior bug (incorrect release-validation state without a crash).

Beta release blocker

No. This affects release-candidate integrity generally; it is not a plugin compatibility blocker under the issue-form definition.

Summary

Release-candidate Telegram and Parallels checks can validate the prepared openclaw tarball while resolving companion packages such as @openclaw/ai from a different registry artifact set.

Steps to reproduce

1. Run npm preflight for a release candidate that prepares both openclaw and @openclaw/ai tarballs.
2. Consume that preflight artifact through the release-candidate checklist, npm Telegram E2E, or Parallels npm-update smoke.
3. Observe that the preflight manifest identifies only the root tarball and the downstream checks install that root tarball without binding its companion tarballs.
4. Proxy a compressed upstream npm response through the fixture registry and observe that fetch returns decoded bytes while retaining the upstream compressed Content-Length.

Expected behavior

Every release-candidate consumer validates and installs the exact root and dependency tarballs recorded by npm preflight, with matching package metadata and SHA-256 digests. Proxied registry responses advertise the decoded response length.

Actual behavior

The candidate checks can resolve a companion package from public npm instead of the prepared artifact, so a mixed package set can pass validation. The local registry can also emit a decoded response body with the compressed upstream length, allowing npm clients to truncate the response.

OpenClaw version

2026.7.1-beta.3 release-candidate tooling.

Operating system

GitHub Actions Ubuntu 24.04 plus the Parallels macOS, Windows, and Linux validation harnesses.

Install method

Prepared npm tarballs consumed through release preflight, Docker Telegram E2E, and Parallels npm-update smoke.

Model

N/A - release packaging and installation path.

Provider / routing chain

N/A - local candidate npm registry with fallback to registry.npmjs.org.

Additional provider/model setup details

N/A.

Logs

The gap was confirmed by tracing the beta.3 preflight manifest and all downstream package consumers. Focused regression tests cover manifest identity/digests, exact tarball-set rejection, candidate registry installs, and decoded proxy response lengths.

Screenshots, recordings, and evidence

The v2026.7.1-beta.3 release validation exposed the missing package-set contract. The fix is being forward-ported from the release branch with focused workflow, Docker, registry, checklist, and cross-OS harness tests.

Impact and severity

• Affected: release managers and users receiving a candidate promoted after mixed-artifact validation.
• Severity: high release-integrity risk.
• Frequency: deterministic whenever a candidate has unpublished companion packages that downstream checks do not consume from the preflight artifact.
• Consequence: validation can pass against dependencies different from those intended for publication.

Additional information

main already contains the separate Bun package-build correction. This issue tracks the remaining exact package-set contract and registry transport correctness needed by all candidate consumers.