Skip to content

fix(gateway): avoid default provider auth startup prewarm#100667

Merged
steipete merged 2 commits into
mainfrom
codex/pr-88514-review
Jul 6, 2026
Merged

fix(gateway): avoid default provider auth startup prewarm#100667
steipete merged 2 commits into
mainfrom
codex/pr-88514-review

Conversation

@steipete

@steipete steipete commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

What Problem This Solves

Gateway startup still schedules a broad provider-auth discovery sweep by default. On Docker/WSL2 and macOS reports, that work consumed enough CPU and event-loop capacity to delay local RPCs and channel timers. The worker-thread mitigation reduced main-thread blocking but retained the unsolicited startup sweep.

Closes #86752.
Closes #86512.
Supersedes #88514 with a current-main replay that preserves its behavior and removes the later QA-only workaround.

Why This Change Was Made

The provider-auth prepared map is an optimization, not the source of truth: auth checks already fall through to the canonical on-demand path when no prepared state exists. This change therefore keeps the gateway lifetime sidecar and auth-profile-failure rewarm, but makes the broad startup sweep explicit opt-in.

Current main added OPENCLAW_SKIP_PROVIDER_AUTH_PREWARM solely to protect QA from startup contention. Default-off behavior makes that environment surface and its parser/tests redundant, so this replay removes them instead of leaving two controls for the same behavior.

The patch preserves Vincent Koc's original fix and co-authorship while reducing production/test surface by 30 lines net.

User Impact

  • Gateway startup no longer performs provider-auth discovery across configured agents/providers by default.
  • Model/provider auth remains correct through the existing on-demand path.
  • Auth-profile failures and config reloads still rebuild prepared provider-auth state.
  • Internal callers can still request the delayed startup warm explicitly.
  • No public config key, migration, or replacement environment variable is added.

Evidence

  • Blacksmith Testbox focused tests: 179 passed across gateway startup and QA Lab.
  • Blacksmith Testbox provider-auth fallback tests: 17 passed.
  • Blacksmith Testbox full build: passed.
  • Blacksmith Testbox live isolated Gateway: reached ready, authenticated status RPC returned runtime 2026.6.11, and the startup log remained free of provider auth state pre-warmed after crossing the former five-second timer.
  • Blacksmith Testbox pnpm check:changed: passed in 9m33s, including core/extension typechecks, lint, import-cycle, state, sidecar-loader, webhook, and pairing guards.
  • Targeted oxfmt and oxlint: passed.
  • Fresh autoreview: clean, correctness 0.91, no accepted/actionable findings.
  • Original fix(gateway): avoid default provider auth startup prewarm #88514 additionally carries live WSL2 and native Windows foreground Gateway RPC proof for this default-off contract.

Known scope: this removes the implicated default startup sweep; it does not claim to resolve every broader context-size or runtime-latency symptom reported in the linked issues.

@openclaw-barnacle openclaw-barnacle Bot added gateway Gateway runtime extensions: qa-lab size: S maintainer Maintainer-authored PR labels Jul 6, 2026
@steipete

steipete commented Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

Land-ready proof for exact head fcd391b18291390854cf4ea6b29f3cd2b747644b:

  • Deep review: gateway startup scheduling owns the change; canonical lazy auth remains in hasAuthForModelProvider; auth-failure, reload, and auth-status mutation rewarms remain intact. The default, explicit-warm, full-disable, and failure-rewarm branches were reviewed separately.
  • Blacksmith Testbox lease tbx_01kwtztg7k9c793yttzazm6stw: focused gateway startup and QA tests passed (179 tests); provider-auth fallback tests passed (17 tests); targeted oxfmt/oxlint passed; full build passed.
  • Live Testbox behavior: isolated built Gateway reached ready; authenticated status RPC returned runtime 2026.6.11; after crossing the former five-second timer, logs contained no provider auth state pre-warmed marker.
  • Broad Testbox gate: pnpm check:changed passed in 9m33s, including core/extension typechecks, core/extension lint, import-cycle, state, sidecar-loader, webhook, and pairing guards.
  • Fresh autoreview: clean, correctness 0.91, no accepted/actionable findings.
  • Native review artifacts: validated with 0 findings, behavioral sweep pass, issue proof valid, changelog present.
  • Exact-head hosted CI: all relevant checks green in run 28772014284, including QA Smoke CI.
  • Native prepare: OPENCLAW_TESTBOX=1 scripts/pr prepare-run 100667 completed with gates_mode=hosted_exact_head; prep and PR head both match the SHA above.

Known proof boundary: I did not repeat native Windows on the replay head. Original #88514 carries native Windows and WSL2 live foreground Gateway RPC proof for the same default-off scheduling contract; this replay additionally proves current-main cleanup and exact-head Linux/Testbox behavior.

No remaining blocker. Ready to merge.

@steipete
steipete merged commit 20e6983 into main Jul 6, 2026
97 checks passed
@steipete
steipete deleted the codex/pr-88514-review branch July 6, 2026 06:32
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 6, 2026
…00667)

* fix(gateway): avoid default provider auth startup prewarm

Co-authored-by: Vincent Koc <[email protected]>

* docs(changelog): credit provider auth startup fix

---------

Co-authored-by: Vincent Koc <[email protected]>
giodl73-repo pushed a commit to giodl73-repo/openclaw that referenced this pull request Jul 8, 2026
…00667)

* fix(gateway): avoid default provider auth startup prewarm

Co-authored-by: Vincent Koc <[email protected]>

* docs(changelog): credit provider auth startup fix

---------

Co-authored-by: Vincent Koc <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

extensions: qa-lab gateway Gateway runtime maintainer Maintainer-authored PR size: S

Projects

None yet

1 participant