improve: speed up package candidate safety tests by steipete · Pull Request #100008 · openclaw/openclaw

steipete · 2026-07-04T15:58:30Z

What Problem This Solves

The package-candidate safety test file spent five real seconds proving its forwarded-signal force-kill path and created 10,001 scan fixtures serially. This made a 45-test tooling file take 9.078 seconds of test time.

Why This Change Was Made

Accelerate only the disposable runner's existing five-second forwarded-signal failsafe while preserving the production timeout value and full process-tree behavior. Create the same 10,001 filesystem entries in bounded batches, retaining the real scan-limit proof.

User Impact

No product behavior changes. Maintainers get faster package-candidate safety validation with the same behavioral coverage.

Evidence

Audited all 45 declared cases; all cover distinct parsing, filesystem, process, download, integrity, or security contracts and remain.
Local focused: 45/45 passing.
Wall time: 13.06s -> 7.58s (42.0% faster).
Vitest file time: 9.078s -> 3.637s (59.9% faster).
External-termination case: 5.117s -> 0.135s.
Autoreview: clean, 0.98 confidence.
Focused Linux Testbox: 45/45 passing, 6.16s wrapper wall, 617,488 KB max RSS; tbx_01kwpxnn548kezvm71c62p7e7v, Actions https://github.com/openclaw/openclaw/actions/runs/28711677712.
Remote check:changed: green; tbx_01kwpxnqd660rgb32mt9se2ys6, Actions https://github.com/openclaw/openclaw/actions/runs/28711678728.
pnpm exec oxfmt --check test/scripts/resolve-openclaw-package-candidate.test.ts
git diff --check

clawsweeper · 2026-07-04T15:59:49Z

Codex review: needs maintainer review before merge. Reviewed July 4, 2026, 12:18 PM ET / 16:18 UTC.

Summary
The PR speeds up package-candidate safety tests by shortening a disposable forwarded-signal failsafe in a spawned test runner and batching artifact scan-limit fixture creation.

PR surface: Tests +26. Total +26 across 1 file.

Reproducibility: not applicable. This PR is a test-speed cleanup rather than a product bug. Source review confirms the slow current paths are the external-termination test’s 5s forwarded-signal wait and serial 10,001-file fixture setup.

Review metrics: 1 noteworthy metric.

Focused test speed: 9.078s -> 3.637s file time; 5.117s -> 0.135s external-termination case. The timing delta is the maintainer-value claim for this test-only PR and is backed by the PR body, follow-up comment, and Testbox evidence.

Stored data model
Persistent data-model change detected: serialized state: test/scripts/resolve-openclaw-package-candidate.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster ✨ media proof bonus
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Next step before merge

No repair job is needed; the protected maintainer-labeled PR should proceed through normal maintainer review and branch-protection gates.

Security
Cleared: The diff changes only one test file and adds no dependency, workflow, package-resolution, secret, install, release, or production code-execution surface.

Review details

Best possible solution:

Land the scoped test-speed change after maintainer review and exact-head branch-protection gates, while keeping production package-candidate timeout and scan contracts unchanged.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR is a test-speed cleanup rather than a product bug. Source review confirms the slow current paths are the external-termination test’s 5s forwarded-signal wait and serial 10,001-file fixture setup.

Is this the best way to solve the issue?

Yes. The patch confines timer acceleration to a disposable spawned runner, leaves the production 5s timeout constant intact, and preserves the real over-limit artifact scan proof while batching fixture creation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 6169e5ddaeb4.

Label changes

Label justifications:

P3: This is a low-risk test performance cleanup with no production behavior, config, API, dependency, or user-facing runtime change.
rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The PR body and follow-up comment include after-change timing output plus linked Testbox and Actions proof, and live Real behavior proof checks succeeded for the current head.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body and follow-up comment include after-change timing output plus linked Testbox and Actions proof, and live Real behavior proof checks succeeded for the current head.

Evidence reviewed

PR surface:

Tests +26. Total +26 across 1 file.

View PR surface stats

Area	Files	Added	Removed	Net
Source	0	0	0	0
Tests	1	31	5	+26
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	1	31	5	+26

What I checked:

Root and scoped policy read: Root AGENTS.md, test/AGENTS.md, and scripts/AGENTS.md were read; the fake-timer and script-wrapper guidance was relevant to reviewing a timer-sensitive script test change. (test/AGENTS.md:1, 6169e5ddaeb4)
Patch scope: The proposed head commit changes only test/scripts/resolve-openclaw-package-candidate.test.ts, with no production, dependency, workflow, package metadata, or persisted-state change. (test/scripts/resolve-openclaw-package-candidate.test.ts:632, 7b096fc3433c)
Production timeout remains intact: Current main still defines COMMAND_TIMEOUT_KILL_AFTER_MS as 5,000ms in the package-candidate script; the PR only changes the spawned test runner’s timer behavior. (scripts/resolve-openclaw-package-candidate.mjs:27, 6169e5ddaeb4)
Forwarded-signal test behavior preserved: The PR head still builds a parent/child process tree, sends SIGTERM to the runner, expects exit status 143, and waits for the child to die; only the disposable runner maps 5000ms timers to 25ms before dynamic import. (test/scripts/resolve-openclaw-package-candidate.test.ts:632, 7b096fc3433c)
Scan-limit proof preserved: The PR head still creates ARTIFACT_TARBALL_SCAN_MAX_ENTRIES + 1 real files and asserts the same scan-limit error; setup is batched in groups of 128 writes. (test/scripts/resolve-openclaw-package-candidate.test.ts:1356, 7b096fc3433c)
Live PR proof and state: Live PR metadata shows the head SHA is 7b096fc, the PR is mergeable but still under branch-protection state, and Real behavior proof checks completed successfully. (7b096fc3433c)

Likely related people:

vincentkoc: Recent GitHub path history shows repeated package-candidate script and test commits, including artifact scan bounds and timeout cleanup that directly surround this PR’s test-speed changes. (role: recent area contributor; confidence: high; commits: aa0d71008590, 75fd2464ccfe, dd89898133ef; files: scripts/resolve-openclaw-package-candidate.mjs, test/scripts/resolve-openclaw-package-candidate.test.ts)
steipete: CONTRIBUTING.md lists steipete as a project maintainer, and path history includes prior test/scripts maintenance in the same package-candidate test file beyond this PR authoring event. (role: listed project maintainer and adjacent test contributor; confidence: medium; commits: 58c663920d04; files: CONTRIBUTING.md, test/scripts/resolve-openclaw-package-candidate.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (3 earlier review cycles)

reviewed 2026-07-04T16:02:23.814Z sha f01f14c :: needs real behavior proof before merge. :: none
reviewed 2026-07-04T16:08:00.426Z sha f01f14c :: needs real behavior proof before merge. :: none
reviewed 2026-07-04T16:13:06.573Z sha 7b096fc :: needs maintainer review before merge. :: none

steipete · 2026-07-04T16:08:22Z

Land-ready verification for rebased head 7b096fc3433c3ff508882e950cd83ccd287a036e:

Audited all 45 declared cases in test/scripts/resolve-openclaw-package-candidate.test.ts; all distinct parsing, filesystem, process, download, integrity, or security contracts retained.
Local focused: 45/45 passing; 13.06s -> 7.58s wall (42.0% faster), 9.078s -> 3.637s file time (59.9% faster).
The real forwarded-signal process-tree case remains; only its disposable runner's five-second failsafe is accelerated. Case time: 5.117s -> 0.135s.
The artifact-limit test still creates and scans 10,001 real filesystem entries, now with bounded parallel setup.
Focused Linux: Testbox tbx_01kwpxnn548kezvm71c62p7e7v, Actions https://github.com/openclaw/openclaw/actions/runs/28711677712, exit 0.
Remote check:changed: Testbox tbx_01kwpxnqd660rgb32mt9se2ys6, Actions https://github.com/openclaw/openclaw/actions/runs/28711678728, exit 0.
Oxfmt and git diff --check pass.
Fresh post-rebase autoreview: clean at 0.98 confidence; no accepted/actionable findings.
GitHub CI: exact-head run https://github.com/openclaw/openclaw/actions/runs/28711964477 green across all relevant jobs.

Known proof gaps: none for this test-only optimization.

steipete · 2026-07-04T16:20:50Z

Merged via squash.

Prepared head SHA: 7b096fc3433c3ff508882e950cd83ccd287a036e
Landed commit: 280e8d4876274c8d7b77c691fb8eeab917afd8fd

openclaw-barnacle Bot added size: XS maintainer Maintainer-authored PR labels Jul 4, 2026

test: accelerate package candidate safety proofs

7b096fc

steipete force-pushed the test/package-candidate-signal-fast branch from f01f14c to 7b096fc Compare July 4, 2026 16:09

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jul 4, 2026

steipete merged commit 280e8d4 into main Jul 4, 2026
80 checks passed

steipete deleted the test/package-candidate-signal-fast branch July 4, 2026 16:20

github-actions Bot mentioned this pull request Jul 4, 2026

📡 Upstream Digest — 2026-07-04 16:54 UTC curtismercier/openclaw-mods#1206

Open

This was referenced Jul 4, 2026

test: make the local pnpm test gate green on macOS hosts #100069

Merged

policy: repair required deny tool findings #99700

Merged

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 5, 2026

test: accelerate package candidate safety proofs (openclaw#100008)

a05d294

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

improve: speed up package candidate safety tests#100008

improve: speed up package candidate safety tests#100008
steipete merged 1 commit into
mainfrom
test/package-candidate-signal-fast

steipete commented Jul 4, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

steipete commented Jul 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

steipete commented Jul 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

steipete commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

steipete commented Jul 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

steipete commented Jul 4, 2026 •

edited

Loading

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

steipete commented Jul 4, 2026 •

edited

Loading