Skip to content

fix(agents): carry provenance through active subagent wakes#92251

Closed
ooiuuii wants to merge 2 commits into
openclaw:mainfrom
ooiuuii:agent/xiaozhua/active-wake-provenance-clean
Closed

fix(agents): carry provenance through active subagent wakes#92251
ooiuuii wants to merge 2 commits into
openclaw:mainfrom
ooiuuii:agent/xiaozhua/active-wake-provenance-clean

Conversation

@ooiuuii

@ooiuuii ooiuuii commented Jun 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Refs #91356, #91330, #91333.

Carry typed inputProvenance through active subagent wake steering so resumed requester turns keep an explicit inter-session provenance signal instead of arriving as untyped queued messages.

This is intentionally narrower than the closed #91333 approach. It does not suppress automatic-mode finals based on ordinary message(action="send") receipts, and it does not infer terminal source-reply ownership from messageId, target matching, or prose.

Why

The maintainer feedback on #91330/#91333 clarified the unsafe boundary: a successful send proves delivery, but it does not prove that the send was the terminal source reply. That replacement needs an explicit terminal-source-reply contract and thread identity; this PR does not attempt that.

This patch only handles the active wake side: when a subagent completion wakes an active requester session, the runtime already knows this is an inter-session wake. The queued steering message should carry that typed provenance through the active run / reply-run bridge so downstream routing and final-selection logic can reason from explicit metadata instead of an untyped internal wake.

Changes

  • Add active-session steering options for inputProvenance.
  • Preserve the existing AgentSession.steer(text, images) call shape while allowing steer(text, { images, inputProvenance }).
  • Apply provenance to queued steering user messages with applyInputProvenanceToUserMessage.
  • Carry queue options through reply-run fallback queueing without changing the legacy no-options call shape.
  • Pass subagent_announce / completion provenance through active requester wake queue options.
  • Add regression coverage for active wake, retry/best-effort, stale-thread handoff, generated-media wake, and reply-run fallback paths.

Real behavior proof

Behavior or issue addressed: active subagent completion wakes could cross the requester-session boundary as untyped steering messages, even though the runtime already knows the wake is an inter-session subagent_announce/completion handoff.

Real environment tested: local OpenClaw source checkout at PR head c0d4598971eb73a7d6b0787fa3b0cb09b21bb592 on branch agent/xiaozhua/active-wake-provenance-clean. The after-fix runtime proof used a temporary OpenClaw test state/config on macOS with channels/cron/browser/canvas disabled and exercised the real deliverSubagentAnnouncement active-wake dispatch path. The final queue sink was instrumented only to capture the active embedded-run queue options, so no private channel, model, or credential was required.

Exact steps or command run after this patch:

# Runtime trace from the PR head; temporary proof script only, not committed.
OPENCLAW_PROOF_HEAD=$(git rev-parse HEAD)   node --import tsx .artifacts/pr-proof/pr92251-runtime-proof.mjs | tee /tmp/pr92251-runtime-proof.out

# Focused regression and CI-style gates run locally on the same PR head.
git diff --check
NODE_OPTIONS=--max-old-space-size=8192 pnpm tsgo:prod
NODE_OPTIONS=--max-old-space-size=8192 pnpm check:test-types
NODE_OPTIONS=--max-old-space-size=8192 pnpm run test:extensions:package-boundary:compile
pnpm run lint:extensions:bundled

Evidence after fix:

PR_92251_ACTIVE_WAKE_RUNTIME_PROOF_BEGIN
{
  "command": "node --import tsx .artifacts/pr-proof/pr92251-runtime-proof.mjs",
  "gitHead": "c0d4598971eb73a7d6b0787fa3b0cb09b21bb592",
  "stateLabel": "pr-92251-active-wake-proof",
  "workspaceBasename": "workspace",
  "result": {
    "delivered": true,
    "path": "steered",
    "deliveredAt": 1765460000100,
    "enqueuedAt": 1765460000000,
    "phases": [
      {
        "phase": "steer-primary",
        "delivered": true,
        "path": "steered",
        "deliveredAt": 1765460000100,
        "enqueuedAt": 1765460000000
      }
    ]
  },
  "queueCallCount": 1,
  "queueCall": {
    "sessionId": "runtime-proof-active-session",
    "text": "redacted child completion payload",
    "options": {
      "deliveryTimeoutMs": 120000,
      "inputProvenance": {
        "kind": "inter_session",
        "sourceSessionKey": "agent:subagent:redacted-child",
        "sourceChannel": "webchat",
        "sourceTool": "subagent_announce"
      },
      "steeringMode": "all",
      "debounceMs": 0,
      "waitForTranscriptCommit": true
    }
  }
}
PR_92251_ACTIVE_WAKE_RUNTIME_PROOF_END

Additional local gate evidence from the same PR head:

git diff --check: passed
pnpm tsgo:prod: passed
pnpm check:test-types: passed
pnpm run test:extensions:package-boundary:compile: passed
pnpm run lint:extensions:bundled: Found 0 warnings and 0 errors on 5904 files

Observed result after fix: the active requester wake stayed on the steered path and queued exactly one active embedded-run message. The captured queue options include explicit inputProvenance with kind: "inter_session", sourceSessionKey: "agent:subagent:redacted-child", sourceChannel: "webchat", and sourceTool: "subagent_announce", plus steeringMode: "all" and waitForTranscriptCommit: true. This shows the runtime handoff now carries provenance through the active wake boundary instead of sending an untyped steering message.

What was not tested: no live Telegram/Slack/bncr end-to-end run was performed on this machine because Docker is not installed here and no provider API env vars are present in the shell (OPENAI_API_KEY, GEMINI_API_KEY, GOOGLE_API_KEY absent). #91356 was closed as not reproducible in current core, so this PR remains framed as route/provenance boundary hardening rather than a claimed live-channel product fix.

@openclaw-barnacle openclaw-barnacle Bot added agents Agent runtime and tooling size: M proof: supplied External PR includes structured after-fix real behavior proof. labels Jun 11, 2026
This was referenced Jun 11, 2026
Closed
Closed
Closed
@clawsweeper

clawsweeper Bot commented Jun 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: stale review; fresh review needed.

Summary
The latest durable ClawSweeper review was for head e59ba5b44dc5b4851cb37ca412789345127a1983, but the PR head is now e68b577dcef7bebafa4ebfa12493ce5528219cb2. Its old verdict and PR readiness labels are no longer current.

Next step
Run or wait for a fresh ClawSweeper review on the current PR head.

Review history (1 earlier review cycle)
  • reviewed 2026-06-26T17:15:41.976Z sha e59ba5b :: needs maintainer review before merge. :: none

@clawsweeper clawsweeper Bot added rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 session-state 🚨 May lose, corrupt, stale, or mis-associate session, agent, or context state. and removed rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. labels Jun 11, 2026
@ooiuuii

ooiuuii commented Jun 11, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

Updated the Real behavior proof section with an after-fix runtime trace from PR head c0d4598971e. The trace uses a temporary local OpenClaw test state/config and exercises the real deliverSubagentAnnouncement active-wake dispatch path, with only the final embedded-run queue sink instrumented to capture the queued options. The captured active wake now includes inputProvenance.kind="inter_session", sourceSessionKey, sourceChannel="webchat", sourceTool="subagent_announce", steeringMode="all", and waitForTranscriptCommit=true.

@clawsweeper

clawsweeper Bot commented Jun 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@clawsweeper clawsweeper Bot added rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. status: 🔁 re-review loop A fresh ClawSweeper review was explicitly requested after the latest review. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. status: 🔁 re-review loop A fresh ClawSweeper review was explicitly requested after the latest review. labels Jun 11, 2026
@ooiuuii

ooiuuii commented Jun 12, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

Retrying after the previous targeted re-review fired while the PR still had queued/cancelled checks. Current gh pr checks for head c0d4598971e now shows the active checks pass/skipped only, including Real behavior proof, preflight, security-fast, Scan changed paths (precise), and the Security High/critical-quality selectors. The PR body still contains the after-fix runtime trace with the captured active wake inputProvenance.

@ooiuuii

ooiuuii commented Jun 12, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

Retrying now that the ClawSweeper execution queue has drained. Current PR checks for head c0d4598971e are pass/skipped only, and the PR body contains the after-fix runtime proof showing the active subagent wake queued with inputProvenance.kind="inter_session", sourceSessionKey, sourceChannel="webchat", sourceTool="subagent_announce", steeringMode="all", and waitForTranscriptCommit=true.

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. and removed rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Jun 12, 2026
@ooiuuii ooiuuii mentioned this pull request Jun 13, 2026
Merged
@ooiuuii

ooiuuii commented Jun 13, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

Current head c0d4598971e is merge-clean and GitHub PR checks are pass/skipped only (no non-pass checks). The previous targeted re-review workflow completed at the Actions level but the durable review still reports an internal review failure before evaluation, so please retry against the current head.

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. labels Jun 13, 2026
@gloria0021 gloria0021 mentioned this pull request Jun 14, 2026
Closed
@ooiuuii
ooiuuii force-pushed the agent/xiaozhua/active-wake-provenance-clean branch from c0d4598 to 869b782 Compare June 15, 2026 12:38
@openclaw-barnacle openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 15, 2026
@ooiuuii

ooiuuii commented Jun 15, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

Rebased onto current main and resolved the stale merge conflict in src/auto-reply/reply/reply-run-registry.ts. Current head 869b78216a48 is merge-clean and GitHub checks are pass/skipped only.

@clawsweeper

clawsweeper Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@clawsweeper clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 15, 2026
This was referenced Jun 17, 2026
Closed
Open
Open
@ooiuuii
ooiuuii force-pushed the agent/xiaozhua/active-wake-provenance-clean branch from 869b782 to e59ba5b Compare June 26, 2026 17:03
@ooiuuii
ooiuuii force-pushed the agent/xiaozhua/active-wake-provenance-clean branch from e59ba5b to e68b577 Compare June 26, 2026 17:22
@openclaw-barnacle openclaw-barnacle Bot added the scripts Repository scripts label Jun 26, 2026
@clawsweeper clawsweeper Bot added merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. and removed merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. labels Jun 26, 2026
This was referenced Jul 1, 2026
Closed
Open
@clawsweeper clawsweeper Bot removed proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. merge-risk: 🚨 session-state 🚨 May lose, corrupt, stale, or mis-associate session, agent, or context state. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Jul 6, 2026
@steipete

steipete commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

Thanks @ooiuuii for narrowing this after the earlier delivery-receipt discussion and for proving the active-wake path without claiming more than the trace showed.

The linked incident set is now closed: #91356 was closed not reproducible after a live current-main Telegram/Crabbox pass, and #91330 / #91333 were closed without adopting terminal-source-reply inference. This branch has also drifted past a safe refresh point: its merge base is 1cd6f81a46ae56d3f505253a589323542801e552, with 2 branch commits against 7,483 newer main commits. The affected run/queue/subagent surfaces have since been extensively reorganized.

Current main carries explicit inter-session provenance at the direct-agent handoff and durable generated-media queue boundaries (direct handoff, durable queue). Active steering now also has newer transcript-recorder, stale-run, injectable-backend, and queue-compatibility contracts (active steer, reply-run admission). Replaying the old AgentSession.steer overload and queue-option plumbing across those owners would need a fresh provenance contract review, not a conflict-only rebase.

Closing as stale, with thanks. If an agents/delivery owner wants active-wake provenance hardened on current main, please re-file or reopen with that owner request; the focused active-wake, retry, media, and reply-run fixtures here remain useful re-port material for a new bounded patch.

@steipete steipete closed this Jul 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

agents Agent runtime and tooling P2 Normal backlog priority with limited blast radius. proof: supplied External PR includes structured after-fix real behavior proof. scripts Repository scripts size: M

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ooiuuii @steipete