Skip to content

fix(maint): reuse recent hosted gates after rebase#100663

Merged
steipete merged 2 commits into
mainfrom
codex/relax-recent-hosted-gates
Jul 6, 2026
Merged

fix(maint): reuse recent hosted gates after rebase#100663
steipete merged 2 commits into
mainfrom
codex/relax-recent-hosted-gates

Conversation

@steipete

@steipete steipete commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

What Problem This Solves

Resolves an operational problem where a controlled PR rebase always invalidates otherwise-green hosted CI/Testbox evidence, forcing maintainers to wait for the complete exact-head suite again even when the PR patch is unchanged and the prior run is recent.

Why This Change Was Made

The prepare workflow now accepts successful hosted evidence from the immediately recorded pre-rebase PR head for up to 24 hours when the local and hosted pre-sync trees match and a whitespace-preserving patch ID proves the PR diff survived the rebase unchanged. Exact-head evidence remains preferred; a terminal failure on the new head blocks reuse, and every conditional hosted workflow scheduled on the new head must also have recent green evidence on the recorded head.

User Impact

Maintainers can finish preparing recently green PRs after a clean, patch-identical rebase without waiting for a redundant full hosted suite. This changes maintainer tooling only; it does not affect the OpenClaw runtime or end users.

Evidence

  • Blacksmith Testbox tbx_01kwty5d9yzm087es5nf93am7m: 53 focused tests passed across hosted-gate verification and PR preparation, including whitespace-sensitive patch fingerprints.
  • The same Testbox lease passed pnpm check:changed for the tooling lane with zero lint warnings or errors.
  • node --check scripts/verify-pr-hosted-gates.mjs, bash -n scripts/pr-lib/gates.sh scripts/pr-lib/prepare-core.sh, and git diff --check passed.
  • Structured autoreview findings about hosted-SHA identity and target workflow cohort coverage were fixed and re-proven. A GitHub Codex finding about whitespace normalization was also fixed with verbatim patch fingerprints; the fresh follow-up autoreview was clean. The only accepted policy tradeoff is deliberate: recent pre-rebase evidence may cover a patch-identical rebase onto newer mainline code.

AI-assisted change; implementation and policy bounds reviewed by the maintainer.

@openclaw-barnacle openclaw-barnacle Bot added scripts Repository scripts size: L maintainer Maintainer-authored PR labels Jul 6, 2026
@steipete steipete self-assigned this Jul 6, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 854ce5eef2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread scripts/pr-lib/gates.sh Outdated
@steipete
steipete force-pushed the codex/relax-recent-hosted-gates branch from 854ce5e to ebf54aa Compare July 6, 2026 06:27

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ebf54aa227

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +274 to +276
if [ "$prep_sync_patch_id" != "$pre_sync_patch_id" ]; then
echo "Rebase changed the PR patch; fresh hosted evidence is required."
exit 1

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Allow exact-gate sync when rebase changes patch

When OPENCLAW_TESTBOX=1 and the rebase is not patch-identical, such as after a conflict resolution changes the diff, this exits before push_prep_head_to_pr_branch runs. The message says fresh hosted evidence is required, but the rebased head is never pushed, so GitHub cannot produce exact-head CI/Testbox for it and a later prepare-run still sees the old remote SHA. This regresses the existing exact-evidence path for non-identical rebases; continue the sync while disabling recent-evidence reuse instead of aborting here.

Useful? React with 👍 / 👎.

@clawsweeper

clawsweeper Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed July 6, 2026, 2:37 AM ET / 06:37 UTC.

Summary
The PR adds a 24-hour recent pre-rebase hosted-gate reuse path for patch-identical scripts/pr rebases, wiring --pr and --recent-sha through hosted-gate verification and adding script tests.

PR surface: Tests +379, Other +210. Total +589 across 5 files.

Reproducibility: yes. from source inspection: in the PR head, a non-patch-identical rebase under OPENCLAW_TESTBOX=1 exits before push_prep_head_to_pr_branch, leaving the remote PR branch on the old SHA. I did not run the mutating scripts/pr flow in this read-only review.

Review metrics: 2 noteworthy metrics.

  • Hosted verifier CLI surface: 1 required flag added, 1 optional fallback flag added. The verifier now requires --pr and can accept --recent-sha, so script callers and tests must stay aligned before merge.
  • Hosted gate reuse window: 24-hour recent-evidence fallback added. A time-bounded non-exact-head evidence path changes maintainer gate policy and needs the automation regression fixed before use.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🌊 off-meta tidepool
Patch quality: 🦪 silver shellfish
Result: blocked by patch quality or review findings.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P2] Fix the non-identical rebase path so it still publishes the rebased head for exact hosted gates.
  • [P2] Add a focused pr-prepare-gates regression test for changed-patch Testbox rebases.

Risk before merge

  • [P1] Merging as-is can strand scripts/pr prepare-sync-head after any non-patch-identical Testbox rebase: the tool asks for fresh hosted evidence but never publishes the rebased SHA that would trigger it.

Maintainer options:

  1. Fix the changed-patch rebase path (recommended)
    Continue the sync and publish the rebased head when the patch ID changes, while omitting recent-evidence reuse and requiring fresh exact-head hosted gates.
  2. Accept the operational regression
    Maintainers may intentionally require manual restart for changed-patch Testbox rebases, but that should be stated as the supported workflow before merge.
  3. Pause for the topology branch
    If maintainers want the open ancestry-repair PR to own this publication policy, pause this branch until the two prepare-sync paths are reconciled.

Next step before merge

  • [P1] A narrow repair can keep the new recent-evidence path while preserving exact-head hosted gates for changed-patch rebases.

Security
Cleared: No concrete security or supply-chain concern was found; the diff does not add dependencies, broaden secrets, or execute new third-party code, while the gate-automation risk is tracked separately.

Review findings

  • [P2] Continue sync when rebase changes the patch — scripts/pr-lib/prepare-core.sh:276
Review details

Best possible solution:

Keep recent-evidence reuse for patch-identical Testbox rebases, but let changed-patch rebases push the new head and require fresh exact-head hosted gates.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection: in the PR head, a non-patch-identical rebase under OPENCLAW_TESTBOX=1 exits before push_prep_head_to_pr_branch, leaving the remote PR branch on the old SHA. I did not run the mutating scripts/pr flow in this read-only review.

Is this the best way to solve the issue?

No. The patch-identical reuse design is plausible, but the best fix must preserve the existing exact-head path by pushing changed-patch rebases and only disabling recent-evidence reuse.

Full review comments:

  • [P2] Continue sync when rebase changes the patch — scripts/pr-lib/prepare-core.sh:276
    Under OPENCLAW_TESTBOX=1, a conflict-resolving or otherwise non-patch-identical rebase now exits here before push_prep_head_to_pr_branch is called. That leaves the remote PR branch on the old SHA, so the fresh hosted evidence requested by the message can never be scheduled; continue the sync and only suppress recent-evidence reuse when the patch ID changes.
    Confidence: 0.91

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 4029f1c07e7a.

Label changes

Label changes:

  • add P2: This is a bounded maintainer automation bug and improvement with limited blast radius, not an end-user runtime outage.
  • add merge-risk: 🚨 automation: The diff changes PR preparation gate automation and currently can prevent exact-head CI/Testbox evidence from being generated after changed-patch rebases.
  • add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
  • add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The external proof gate is not applied because this is a maintainer-labeled scripts PR; the PR body still lists Testbox and focused validation evidence for maintainer review.

Label justifications:

  • P2: This is a bounded maintainer automation bug and improvement with limited blast radius, not an end-user runtime outage.
  • merge-risk: 🚨 automation: The diff changes PR preparation gate automation and currently can prevent exact-head CI/Testbox evidence from being generated after changed-patch rebases.
  • rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
  • status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The external proof gate is not applied because this is a maintainer-labeled scripts PR; the PR body still lists Testbox and focused validation evidence for maintainer review.
Evidence reviewed

PR surface:

Tests +379, Other +210. Total +589 across 5 files.

View PR surface stats
Area Files Added Removed Net
Source 0 0 0 0
Tests 2 440 61 +379
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 3 260 50 +210
Total 5 700 111 +589

Acceptance criteria:

  • [P1] pnpm test test/scripts/pr-prepare-gates.test.ts test/scripts/verify-pr-hosted-gates.test.ts.
  • [P1] node --check scripts/verify-pr-hosted-gates.mjs.
  • [P1] bash -n scripts/pr-lib/gates.sh scripts/pr-lib/prepare-core.sh.
  • [P1] git diff --check.

What I checked:

  • Repository policy read: Root AGENTS.md and scripts/AGENTS.md were read fully; their script workflow and PR-review guidance apply to this maintainer-tooling PR. (AGENTS.md:1, 4029f1c07e7a)
  • PR head exits before publication on patch mismatch: On the PR head, prepare_sync_head computes pre/post rebase patch IDs and exits under OPENCLAW_TESTBOX=1 when they differ, before reaching push_prep_head_to_pr_branch. (scripts/pr-lib/prepare-core.sh:274, ebf54aa2272d)
  • Current main publishes first, then waits for exact evidence: Current main rebases and, even under OPENCLAW_TESTBOX=1, continues to call push_prep_head_to_pr_branch before writing sync state and requiring exact-head hosted gates. (scripts/pr-lib/prepare-core.sh:257, 4029f1c07e7a)
  • Push callee is the publication boundary: push_prep_head_to_pr_branch is the callee that actually publishes or verifies the prepared head; exiting before this call leaves GitHub on the old SHA. (scripts/pr-lib/push.sh:242, ebf54aa2272d)
  • Recent-evidence verifier behavior: The verifier now supports exact-head or recent-rebase evidence, blocks terminal non-success on the current head, and records the selected evidence SHA in the manifest. (scripts/verify-pr-hosted-gates.mjs:232, ebf54aa2272d)
  • Adjacent tests cover the new reuse path but not the mismatch push-through path: The tests cover whitespace-preserving patch IDs and forwarding the recorded pre-rebase SHA, but the inspected test set did not cover a non-patch-identical Testbox rebase continuing to publish for fresh exact-head gates. (test/scripts/pr-prepare-gates.test.ts:337, ebf54aa2272d)

Likely related people:

  • steipete: Path history, CODEOWNERS default ownership, the merged Testbox gate work, and this PR all tie this person to scripts/pr landing-gate behavior. (role: recent area contributor; confidence: high; commits: eedd309c4a07, 6e6decdeac10, b7e4e34f57e6; files: scripts/pr-lib/gates.sh, scripts/pr-lib/prepare-core.sh, test/scripts/pr-prepare-gates.test.ts)
  • vincentkoc: History shows recent release-control and hosted-gate verifier changes in the same exact-head Testbox evidence surface. (role: recent hosted-gate contributor; confidence: medium; commits: e085fa1a3ffd; files: scripts/verify-pr-hosted-gates.mjs, scripts/pr-lib/gates.sh)
  • Gustavo Madeira Santana: History shows earlier work splitting and tightening the scripts/pr workflow modules that now contain this change. (role: script workflow refactor contributor; confidence: medium; commits: 31a4b45db09f, fa2e051bb61a; files: scripts/pr, scripts/pr-lib/prepare-core.sh, scripts/pr-lib/gates.sh)
  • Josh Lehman: History shows prior work on PR-head push and GraphQL fallback behavior, which is the publication boundary affected by this regression. (role: adjacent push-path contributor; confidence: medium; commits: 3a8133d5874b; files: scripts/pr-lib/push.sh, scripts/pr)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 automation 🚨 May affect CI, automerge, proof capture, label sync, or maintainer automation. labels Jul 6, 2026
@steipete
steipete merged commit 5d9cec1 into main Jul 6, 2026
127 of 131 checks passed
@steipete
steipete deleted the codex/relax-recent-hosted-gates branch July 6, 2026 06:43
@steipete

steipete commented Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

Merged via squash.

vincentkoc added a commit to zhangqueping/openclaw that referenced this pull request Jul 6, 2026
* origin/main: (1287 commits)
  fix(android): block loopback canvas navigation (openclaw#99874)
  fix(hooks): suppress unhandled stdout/stderr stream errors in gmail watcher (openclaw#100519)
  fix(memory-core): guard qmd mcporter JSON.parse against non-JSON stdout (openclaw#98381)
  fix(build): fall back to tsx for build TypeScript scripts (openclaw#91262)
  feat(skills): suggest saving detected reusable workflows by default (openclaw#95477) (openclaw#100692)
  docs(changelog): remove generated release-note entries
  feat(telegram): offer BotFather web app flow in setup help and docs (openclaw#100540)
  fix(ios): unify Talk and Settings row typography on one branded detail row (openclaw#100515)
  feat(gateway): add persisted crash-loop breaker and fatal-config exit contract
  refactor(macos): lock and unify PortGuardian tunnel record persistence so concurrent app instances cannot lose orphan records (openclaw#100601)
  fix: stop reconnecting on protocol mismatch (openclaw#98414)
  fix(maint): reuse recent hosted gates after rebase (openclaw#100663)
  fix(ui): reopen web terminals without stale content (openclaw#100665)
  fix(browser): diagnose empty WSL2 Chrome replies (openclaw#100590)
  fix(ios): chat snaps back to bottom when scrolling to top via status-bar tap (openclaw#100502)
  Treat already-compacted CLI compaction as no-op (openclaw#99136)
  docs(changelog): remove direct main fix entry
  fix(feishu): strip internal tool-trace banners from outbound text (openclaw#98705)
  fix(message): thread --limit through to CLI formatter and surface provider pagination hints (openclaw#99089)
  fix(voyage): close response body stream when batch output JSONL parsing throws (openclaw#98840)
  ...

# Conflicts:
#	extensions/memory-wiki/package.json
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 6, 2026
* fix(maint): reuse recent hosted gates after rebase

* fix(maint): preserve whitespace in gate fingerprints
giodl73-repo pushed a commit to giodl73-repo/openclaw that referenced this pull request Jul 8, 2026
* fix(maint): reuse recent hosted gates after rebase

* fix(maint): preserve whitespace in gate fingerprints
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

maintainer Maintainer-authored PR merge-risk: 🚨 automation 🚨 May affect CI, automerge, proof capture, label sync, or maintainer automation. P2 Normal backlog priority with limited blast radius. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. scripts Repository scripts size: L status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant