Skip to content

fix(gateway): report draining state in readiness#94915

Merged
vincentkoc merged 1 commit into
openclaw:mainfrom
markoub:markoub/readyz-gateway-draining
Jun 22, 2026
Merged

fix(gateway): report draining state in readiness#94915
vincentkoc merged 1 commit into
openclaw:mainfrom
markoub:markoub/readyz-gateway-draining

Conversation

@markoub

@markoub markoub commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Makes /readyz report not ready while the gateway command queue is draining for restart.
  • Reuses the existing isGatewayDraining() queue state; /healthz, queue admission, restart reset, and channel readiness behavior stay unchanged.
  • Keeps the drain state outside the cached channel readiness snapshot so a cached green result cannot hide a current drain gate.
  • Out of scope: clearing stuck drain state or changing restart/queue admission semantics; current main already clears stale drain state on in-process restart via resetAllLanes().

Linked context

Which issue does this close?
Closes #78136

Which issues, PRs, or discussions are related?
Related #78144

Was this requested by a maintainer or owner?
ClawSweeper marked #78136 as source-reproducible and queueable on June 18, 2026; #78144 was closed for active-PR queue policy, not a technical rejection.

Real behavior proof (required for external PRs)

  • Behavior or issue addressed: /readyz could report ready while the command queue was rejecting new work with GatewayDrainingError.
  • Real environment tested: local OpenClaw source checkout on macOS, Node v26.3.0, temp HOME/OPENCLAW_STATE_DIR, real gateway server in minimal test-gateway mode (VITEST=1 OPENCLAW_TEST_MINIMAL_GATEWAY=1) with channels, providers, cron, browser-control, Gmail watcher, canvas host, and bundled plugins disabled.
  • Exact steps or command run after this patch: started the real gateway via startGatewayServer(), fetched /readyz, called markGatewayDraining(), fetched /readyz, called resetAllLanes(), fetched /readyz, then closed the server cleanly.
  • Evidence after fix: copied live output from the local gateway proof command:
{
  "before": { "status": 200, "body": { "ready": true, "failing": [] } },
  "draining": { "status": 503, "body": { "ready": false, "failing": ["gateway-draining"] } },
  "recovered": { "status": 200, "body": { "ready": true, "failing": [] } }
}
  • Observed result after fix: /readyz flips to HTTP 503 with gateway-draining during drain and recovers to HTTP 200 after resetAllLanes().
  • What was not tested: full Docker/Raspberry Pi restart reproduction.
  • Proof limitations or environment constraints: Blacksmith Testbox was unavailable because local Blacksmith auth is missing; the default Crabbox Azure provider was unavailable because Azure CLI/subscription is not configured. Local check:changed passed with Corepack bin prepended.
  • Before evidence: current main already has isGatewayDraining() and rejects enqueues while draining, but createReadinessChecker() had no getGatewayDraining input and only reported startup/channel/event-loop readiness; ClawSweeper's source review on Docker in-process gateway restart can leave command queue draining while healthz/readyz report OK #78136 reported the same source-level mismatch.

Tests and validation

  • pnpm install --frozen-lockfile
  • node scripts/run-vitest.mjs src/gateway/server/readiness.test.ts src/gateway/server-http.probe.test.ts src/process/command-queue.test.ts
  • git diff --check origin/main...HEAD
  • CI=1 PATH="/opt/homebrew/Cellar/corepack/0.35.0/bin:$PATH" pnpm check:changed
  • Real gateway /readyz proof described above
  • codex review --base origin/main: no regression found in the changed gateway readiness path

Risk checklist

Did user-visible behavior change? Yes

Did config, environment, or migration behavior change? No

Did security, auth, secrets, network, or tool execution behavior change? No

Highest-risk area: readiness semantics during restart drain.

Mitigation: check is transient, uncached, uses existing isGatewayDraining() state; /healthz remains shallow liveness and reset behavior remains in resetAllLanes().

Current review state

Next action: maintainer review and CI.

Waiting on: CI and maintainer review.

Bot/reviewer comments addressed: ClawSweeper's #78136 source-repro/fix-shape-clear guidance; prior #78144 shape resubmitted narrowly after queue-policy closure.

AI-assisted: Implemented with AI assistance; reviewed locally by Marko with focused tests, live gateway proof, changed gate, and Codex review.

@openclaw-barnacle openclaw-barnacle Bot added gateway Gateway runtime size: XS triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels Jun 19, 2026
@clawsweeper

clawsweeper Bot commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 22, 2026, 4:24 AM ET / 08:24 UTC.

Summary
The PR wires Gateway /readyz readiness to the existing command-queue draining flag and adds tests that keep the transient drain state uncached.

PR surface: Source +8, Tests +31. Total +39 across 3 files.

Reproducibility: yes. from source inspection: current main rejects enqueues while gatewayDraining is set, but readiness does not read isGatewayDraining(). I did not run the Docker/Raspberry Pi restart scenario in this read-only review.

Review metrics: none identified.

Stored data model
Persistent data-model change detected: persistent cache schema: src/gateway/server/readiness.test.ts. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #78136
Summary: This PR is the active fix candidate for the canonical open Gateway drain-readiness issue; the prior same-shape PR closed unmerged for queue policy, and adjacent restart issues cover different behavior.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Resolve or rerun checks-node-agentic-command-support once logs are available.
  • Wait for remaining exact-head checks before landing.

Risk before merge

  • [P1] Full Docker/Raspberry Pi double-restart reproduction was not rerun in this read-only review; source inspection and contributor live local Gateway output cover the readiness transition.
  • [P1] Exact-head CI is not clean yet: checks-node-agentic-command-support failed, and failed logs were unavailable while the workflow was still in progress.

Maintainer options:

  1. Decide the mitigation before merge
    Land this narrow readiness wiring after maintainer review and clean or explained exact-head checks, while keeping /healthz as liveness and stuck-drain cleanup in the existing restart reset path.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

  • [P2] No repair job is needed from code review; the remaining action is maintainer review plus resolving the failed and pending exact-head CI.

Security
Cleared: The diff only reads an existing in-process queue flag in readiness and adds tests; it does not touch auth, secrets, dependencies, workflows, package resolution, or code execution surfaces.

Review details

Best possible solution:

Land this narrow readiness wiring after maintainer review and clean or explained exact-head checks, while keeping /healthz as liveness and stuck-drain cleanup in the existing restart reset path.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection: current main rejects enqueues while gatewayDraining is set, but readiness does not read isGatewayDraining(). I did not run the Docker/Raspberry Pi restart scenario in this read-only review.

Is this the best way to solve the issue?

Yes. Reusing the existing command-queue drain predicate inside readiness before the cached channel snapshot is the narrowest owner-boundary fix; clearing stale drain state and shutdown health behavior stay in separate existing paths.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f2eca9439189.

Label changes

Label changes:

  • add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
  • remove rating: 🦞 diamond lobster: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

  • P2: This is a normal-priority Gateway reliability bugfix for /readyz reporting ready while command work is rejected during restart drain.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes copied live output from a real local Gateway showing /readyz changing from 200 ready to 503 gateway-draining and recovering after resetAllLanes().
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes copied live output from a real local Gateway showing /readyz changing from 200 ready to 503 gateway-draining and recovering after resetAllLanes().
Evidence reviewed

PR surface:

Source +8, Tests +31. Total +39 across 3 files.

View PR surface stats
Area Files Added Removed Net
Source 2 9 1 +8
Tests 1 31 0 +31
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 3 40 1 +39

What I checked:

Likely related people:

  • vincentkoc: Introduced the channel-backed readiness probe surface in ab5fcfcc... and recently touched the release/gateway process paths around command descendants in c645ec.... (role: readiness and recent gateway/process contributor; confidence: high; commits: ab5fcfcc0128, c645ec4555c0; files: src/gateway/server/readiness.ts, src/gateway/server.impl.ts, src/process/command-queue.ts)
  • steipete: Authored the queue drain/abort/timeout race hardening that touched src/process/command-queue.ts and restart-loop tests. (role: command-queue drain behavior contributor; confidence: medium; commits: c397a02c9ad5; files: src/process/command-queue.ts, src/cli/gateway-cli/run-loop.ts)
  • joeykrug: Authored the SIGUSR1 in-process restart reset work that this PR relies on for clearing stale execution and queue state after restart. (role: adjacent restart reset lifecycle contributor; confidence: medium; commits: 4e9f933e88e4; files: src/process/command-queue.ts, src/cli/gateway-cli/run-loop.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@openclaw-barnacle openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels Jun 19, 2026
@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. labels Jun 19, 2026
@vincentkoc
vincentkoc force-pushed the markoub/readyz-gateway-draining branch 7 times, most recently from 286b1d8 to eb4cb57 Compare June 22, 2026 08:12
@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. and removed rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. labels Jun 22, 2026
@vincentkoc
vincentkoc force-pushed the markoub/readyz-gateway-draining branch 4 times, most recently from 8639e9b to a1741a3 Compare June 22, 2026 09:48
@vincentkoc
vincentkoc force-pushed the markoub/readyz-gateway-draining branch from a1741a3 to 0e8d189 Compare June 22, 2026 09:53
@vincentkoc
vincentkoc merged commit b08555e into openclaw:main Jun 22, 2026
93 checks passed
@vincentkoc

Copy link
Copy Markdown
Member

Merged via squash.

Thanks @markoub!

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 23, 2026
Merged via squash.

Prepared head SHA: 0e8d189
Co-authored-by: markoub <[email protected]>
Co-authored-by: vincentkoc <[email protected]>
Reviewed-by: @vincentkoc
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gateway Gateway runtime P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. proof: supplied External PR includes structured after-fix real behavior proof. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: XS status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Docker in-process gateway restart can leave command queue draining while healthz/readyz report OK

2 participants