Skip to content

fix(gateway): guard fast-path startup migrations#93118

Merged
vincentkoc merged 11 commits into
openclaw:mainfrom
openperf:fix/93032-cron-zero-jobs-gateway-fast-path
Jun 15, 2026
Merged

fix(gateway): guard fast-path startup migrations#93118
vincentkoc merged 11 commits into
openclaw:mainfrom
openperf:fix/93032-cron-zero-jobs-gateway-fast-path

Conversation

@openperf

@openperf openperf commented Jun 15, 2026 •
edited by vincentkoc
Loading

Copy link
Copy Markdown
Member

Summary

  • Run the shared CLI startup bootstrap for both gateway foreground entry paths, so state and cron migrations complete before the server and scheduler load.
  • Converge the selected config, state directory, dotenv sources, config env, and shell fallback before startup controls are evaluated, with explicit source precedence and late-drift rejection.
  • Guard every startup mutation boundary: state migration, doctor/cron repair, suspicious-config recovery, future-version reset, and managed-proxy refresh.
  • Keep invalid config from supplying service markers, include roots, selectors, destructive overrides, or migration paths; preserve valid invocation/trusted-env selectors across reset and migration.
  • Add focused regression coverage for fast-path bootstrap, env alias precedence, runtime path repinning, recovery/reset guards, proxy hook cleanup, and cron migration timing.

Why this shape

The original direct cron-repair call fixed the immediate symptom but left the gateway fast path bypassing the shared startup contract. Review found that the same split path could apply or act on config-derived startup state before validation and could retain superseded env/proxy state. This repair moves the behavior to the shared gateway startup boundary and makes the selected runtime state explicit before any config-dependent mutation.

Verification

  • Changed-surface tests: 431 passed across 6 shards.
  • Isolated config I/O regressions: 6 passed, 5 skipped.
  • src/cli/run-main.exit.test.ts: 132 passed.
  • src/cli/gateway-cli/run.option-collisions.test.ts: 55 passed.
  • Changed-file oxlint and oxfmt checks, git diff --check, privacy scan, and CLI bootstrap import guard: passed.
  • Direct local tsdown build with a 12 GB Node heap: passed.
  • Fresh exhaustive full-branch autoreview: clean.

Proof gaps: the full src/config/io.best-effort.test.ts file is blocked locally by the shared checkout missing @openclaw/llm-core; the standard build wrapper is blocked because this shell lacks pnpm; Testbox is blocked because blacksmith is unavailable; default Crabbox selected Azure and is blocked by expired Azure CLI authentication. No live macOS LaunchAgent upgrade proof was run.

Release note

Gateway foreground startup now runs guarded state/config migrations before loading scheduler state, so legacy cron jobs are available on the first post-upgrade gateway start instead of requiring a second restart or manual doctor command.

Fixes #93032

@openclaw-barnacle openclaw-barnacle Bot added cli CLI command changes commands Command implementations size: XS labels Jun 15, 2026
@clawsweeper

clawsweeper Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 15, 2026, 12:12 PM ET / 16:12 UTC.

Summary
The branch adds an awaited legacy cron-store repair call during gateway run startup and adds direct tests for the cron repair helper's migrate/no-op behavior.

PR surface: Source +15, Tests +30. Total +45 across 2 files.

Reproducibility: no. live managed-service upgrade reproduction was run in this read-only review, but the source path is high confidence: current main can skip CLI preflight on gateway run, then cron can cache an empty SQLite load.

Review metrics: 1 noteworthy metric.

  • Startup migration hook: 1 added. Gateway start now performs a persistent legacy cron migration before cron can load, which is compatibility-relevant even without new config.

Stored data model
Persistent data-model change detected: migration/backfill/repair: src/cli/gateway-cli/run.ts, migration/backfill/repair: src/commands/doctor/cron/index.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P2] Maintainers should either accept the documented lack of full managed-service upgrade proof or request one before merge.

Risk before merge

  • [P1] Merging this changes upgrade-time gateway startup behavior by running and potentially archiving legacy cron files before the gateway binds; maintainers should explicitly accept that side effect.
  • [P1] The PR proof exercises the production helper with real SQLite temp storage but does not prove a full v2026.5.28-to-v2026.6.6 managed-service restart path.

Maintainer options:

  1. Accept The Focused Hotfix (recommended)
    Maintainers can land this after accepting that gateway startup now runs the canonical idempotent cron migration before cron can load.
  2. Add Gateway Upgrade Proof
    Before merge, add a narrow gateway fast-path or live service proof showing legacy jobs.json is imported before first cron startup after upgrade.
  3. Pause For Startup Ownership Review
    If gateway startup should not perform doctor-owned state repair, pause this PR and choose a broader startup migration ownership model.

Next step before merge

  • [P2] Human review should accept or reject the upgrade-time gateway startup migration side effect and decide whether the focused helper proof is enough before merge.

Security
Cleared: No concrete security or supply-chain concern was found; the diff touches gateway startup ordering and cron tests, not secrets, dependencies, CI, or package execution.

Review details

Best possible solution:

Land the existing-helper fast-path migration after maintainer acceptance of the startup migration side effect; add a service-level upgrade proof only if maintainers want lower release risk before merge.

Do we have a high-confidence way to reproduce the issue?

No live managed-service upgrade reproduction was run in this read-only review, but the source path is high confidence: current main can skip CLI preflight on gateway run, then cron can cache an empty SQLite load.

Is this the best way to solve the issue?

Yes, likely: reusing the existing idempotent doctor helper before gateway cron can load is narrower than duplicating migration logic in cron runtime or replacing the gateway fast path. The remaining question is maintainer acceptance of the startup side effect and proof gap.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 85a635368e2f.

Label changes

Label justifications:

  • P1: The linked regression can silently suppress scheduled cron work after upgrade while the gateway appears healthy.
  • merge-risk: 🚨 compatibility: The diff changes upgrade-time startup behavior by running and archiving legacy cron state during gateway run.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The contributor proof gate is not applicable because the PR author is a repository member; the body still includes focused production-helper SQLite proof and notes the missing full service upgrade test.
Evidence reviewed

PR surface:

Source +15, Tests +30. Total +45 across 2 files.

View PR surface stats
Area Files Added Removed Net
Source 1 15 0 +15
Tests 1 30 0 +30
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 2 45 0 +45

Acceptance criteria:

  • [P1] node scripts/run-vitest.mjs src/commands/doctor/cron/index.test.ts.
  • [P1] optional: gateway fast-path upgrade proof with a legacy jobs.json-only store before cron startup.

What I checked:

Likely related people:

  • steipete: Authored and merged the cron SQLite migration that moved cron persistence into the shared SQLite state model and established doctor migration as the compatibility boundary. (role: feature-history contributor; confidence: high; commits: 005da57957c9, 91e7de565de3, 26e6286740e0; files: src/cron/store.ts, src/commands/doctor/cron/index.ts, src/gateway/server-cron-lazy.ts)
  • MonkeyLeeT: Authored the merged PR that added the non-interactive legacy cron migration helper path through doctor config preflight, which this PR reuses for gateway fast path startup. (role: legacy migration preflight contributor; confidence: high; commits: 21aa297434e4, e5defe84d48c, ee962f7e2e94; files: src/commands/doctor/cron/index.ts, src/commands/doctor-config-preflight.ts)
  • jalehman: Merged the earlier legacy cron auto-migration PR that introduced the preflight compatibility path this PR extends. (role: merger/reviewer; confidence: medium; commits: 21aa297434e4; files: src/commands/doctor/cron/index.ts, src/commands/doctor-config-preflight.ts)
  • vincentkoc: Current blame for the gateway command function points to a recent current-main commit by Vincent Koc, and the live PR timeline shows Vincent assigned to this PR. (role: recent area contributor and assigned reviewer; confidence: medium; commits: 5b18b7560e67; files: src/cli/gateway-cli/run.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P1 High-priority user-facing bug, regression, or broken workflow. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. labels Jun 15, 2026
@vincentkoc vincentkoc self-assigned this Jun 15, 2026
@openperf
openperf force-pushed the fix/93032-cron-zero-jobs-gateway-fast-path branch from 9862c52 to c4a8329 Compare June 15, 2026 15:58
@vincentkoc
vincentkoc force-pushed the fix/93032-cron-zero-jobs-gateway-fast-path branch from c4a8329 to 8bb16f7 Compare June 15, 2026 17:48
@vincentkoc vincentkoc added the proof: override Maintainer override for the external PR real behavior proof gate. label Jun 15, 2026
@vincentkoc vincentkoc changed the title fix(cron): run legacy cron store migration in gateway fast path fix(gateway): guard fast-path startup migrations Jun 15, 2026
@vincentkoc

vincentkoc commented Jun 15, 2026

Copy link
Copy Markdown
Member

land-ready maintainer repair is pushed at 8bb16f716c04f3e703d580e3239260fd599fbc3d.

Proof:

  • changed-surface tests: 431 passed across 6 shards
  • isolated config I/O regressions: 6 passed, 5 skipped
  • src/cli/run-main.exit.test.ts: 132 passed
  • src/cli/gateway-cli/run.option-collisions.test.ts: 55 passed
  • changed-file oxlint/oxfmt, git diff --check, privacy scan, and CLI bootstrap import guard: passed
  • direct local tsdown build with a 12 GB Node heap: passed
  • fresh exhaustive full-branch autoreview: clean

Known proof gaps: the full src/config/io.best-effort.test.ts file is blocked by the shared checkout missing @openclaw/llm-core; the standard build wrapper is blocked because this shell lacks pnpm; Testbox is blocked because blacksmith is unavailable; default Crabbox selected Azure and is blocked by expired Azure CLI authentication. No live macOS LaunchAgent upgrade proof was run.

@vincentkoc

vincentkoc commented Jun 15, 2026

Copy link
Copy Markdown
Member

CI/proof addendum before landing:

Landing with the existing proof: override after the exhaustive local proof and clean autoreview recorded above; the queued CI run remains linked for post-land visibility.

@vincentkoc
vincentkoc merged commit df521a6 into openclaw:main Jun 15, 2026
45 of 52 checks passed
@vincentkoc vincentkoc mentioned this pull request Jun 15, 2026
Closed
@github-actions github-actions Bot mentioned this pull request Jun 15, 2026
Open
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 16, 2026
@openperf
fix(gateway): guard fast-path startup migrations (openclaw#93118)
196ca71 
* fix(cron): run legacy cron store migration in gateway fast path

* fix(cli): run gateway startup migrations

* fix(gateway): guard startup migrations and config selection

* fix(gateway): reconcile final startup environment

* fix(gateway): preserve guarded startup env semantics

* fix(gateway): guard service-mode recovery candidates

* fix(config): reconcile normalized env precedence

* fix(cli): clear replaced proxy signal handlers

* fix(gateway): reject invalid final config

* test(gateway): cover invalid future config reset guard

* test(cli): remove unused recovery state
crh-code pushed a commit to crh-code/openclaw that referenced this pull request Jun 18, 2026
@openperf @crh-code
fix(gateway): guard fast-path startup migrations (openclaw#93118)
df972d0 
* fix(cron): run legacy cron store migration in gateway fast path

* fix(cli): run gateway startup migrations

* fix(gateway): guard startup migrations and config selection

* fix(gateway): reconcile final startup environment

* fix(gateway): preserve guarded startup env semantics

* fix(gateway): guard service-mode recovery candidates

* fix(config): reconcile normalized env precedence

* fix(cli): clear replaced proxy signal handlers

* fix(gateway): reject invalid final config

* test(gateway): cover invalid future config reset guard

* test(cli): remove unused recovery state
This was referenced Jun 18, 2026
Merged
Open
This was referenced Jul 1, 2026
Closed
Merged
badgerbees pushed a commit to badgerbees/openclaw that referenced this pull request Jul 8, 2026
@openperf @badgerbees
fix(gateway): guard fast-path startup migrations (openclaw#93118)
0edeff7 
* fix(cron): run legacy cron store migration in gateway fast path

* fix(cli): run gateway startup migrations

* fix(gateway): guard startup migrations and config selection

* fix(gateway): reconcile final startup environment

* fix(gateway): preserve guarded startup env semantics

* fix(gateway): guard service-mode recovery candidates

* fix(config): reconcile normalized env precedence

* fix(cli): clear replaced proxy signal handlers

* fix(gateway): reject invalid final config

* test(gateway): cover invalid future config reset guard

* test(cli): remove unused recovery state
@steipete steipete mentioned this pull request Jul 9, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@vincentkoc vincentkoc

Labels

cli CLI command changes commands Command implementations merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P1 High-priority user-facing bug, regression, or broken workflow. proof: override Maintainer override for the external PR real behavior proof gate. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: XL status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug] v2026.6.6: Cron scheduler loads 0 jobs after upgrade — SQLite WAL not committed at first startup

2 participants

@openperf @vincentkoc