auto">Codex review: keeping this open for maintainer follow-up; there is still a little grit to resolve. Reviewed July 13, 2026, 12:28 AM ET / 04:28 UTC.

Summary
Keep open. This maintainer-owned, protected issue has an open closing PR that implements the requested release-evidence boundary, so it should remain canonical until that PR lands or maintainers change direction.

Likely related people

vincentkoc — high confidence; issue assignee and release-flow contributor responsible for the linked implementation.

Reproducibility: yes. at the workflow level: current policy binds full validation to an exact SHA while changelog generation is release-owned, and the linked PR identifies the redundant revalidation path. No live release run was performed in this read-only review.

Root-cause cluster
Relationship: canonical
Canonical: #105946
Summary: This issue is the canonical release-workflow problem statement, with one open pull request acting as its candidate fix.

Members:

fixed_by_candidate: fix(release): avoid full revalidation after changelog-only cuts #105948 - The pull request explicitly closes this issue and implements the proposed product-code SHA and final release SHA separation.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Next step
An open maintainer-authored pull request already owns the implementation, so the next action is review and landing of that pull request rather than dispatching a second repair.

Review details

Best possible solution:

Land a strict two-SHA release flow that validates product code once, independently proves the final delta is changelog-only, and keeps all packaging and publication evidence bound to the exact Release SHA.

Do we have a high-confidence way to reproduce the issue?

Yes at the workflow level: current policy binds full validation to an exact SHA while changelog generation is release-owned, and the linked PR identifies the redundant revalidation path. No live release run was performed in this read-only review.

Is this the best way to solve the issue?

Yes in direction. A fail-closed Code SHA versus Release SHA boundary is narrower and more auditable than rerunning unrelated product matrices, provided every exact-release artifact and publication check remains bound to the Release SHA.

AGENTS.md: found and applied where relevant.

Remaining risk / open question:

The linked implementation must fail closed if the Code SHA to Release SHA delta contains anything beyond the permitted changelog modification; otherwise stale product-validation evidence could be reused.
Npm preflight, package acceptance, tagging, release-note provenance, and publication checks must remain bound to the exact Release SHA even when expensive product validation is reused.

Codex review notes: model internal, reasoning high; reviewed against 6ef3e87583ed.

Label changes

Label changes:

add P2: The current flow can add hours of redundant release validation and complicate release evidence, but it does not break product runtime for end users.
add impact:other: The issue materially affects maintainer release throughput and confidence in the release evidence chain, outside the more specific impact categories.
add issue-rating: 🐚 platinum hermit: Current issue advisory state selects this label.
add clawsweeper:needs-live-repro: Current issue advisory state selects this label.

Label justifications:

P2: The current flow can add hours of redundant release validation and complicate release evidence, but it does not break product runtime for end users.
impact:other: The issue materially affects maintainer release throughput and confidence in the release evidence chain, outside the more specific impact categories.

Evidence reviewed

What I checked:

Protected maintainer-owned item: The GitHub context shows author association MEMBER, self-assignment, and the protected maintainer label; OpenClaw policy requires explicit maintainer handling rather than automated cleanup closure. (AGENTS.md, 6ef3e87583ed)
Open linked implementation: The open pull request fix(release): avoid full revalidation after changelog-only cuts #105948 explicitly closes this issue and implements the Code SHA versus Release SHA evidence model. An open closing PR is an implementation candidate, not grounds to close its issue before merge. (bc502d83fd23)
Exact-SHA release contract: Repository policy requires full release validation at an exact SHA and target release branch, confirming that immutable SHA identity is a deliberate release-evidence boundary. (AGENTS.md, 6ef3e87583ed)
Release-owned changelog phase: Repository policy defines CHANGELOG.md as release-owned, supporting a distinct final changelog-cut phase instead of treating those edits as ordinary product-code changes. (AGENTS.md, 6ef3e87583ed)
Current-main status: No merged fix is identified in the supplied timeline or related-item context; the sole closing implementation remains open and unmerged. (6ef3e87583ed)

Likely related people:

vincentkoc: This person opened and owns the issue and authored the linked implementation, making them the strongest routing candidate for the release-evidence boundary. (role: feature owner and release-flow contributor; confidence: high; commits: bc502d83fd23; files: scripts/full-release-validation-at-sha.mjs)

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Uh oh!

Uh oh!

Release validation should separate product code from final changelog cuts #105946

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions