Skip to content

fix(test): stabilize tooling guard probes#95114

Merged
vincentkoc merged 2 commits into
mainfrom
qa-sre-rpc-scripts-next-20260619
Jun 19, 2026
Merged

fix(test): stabilize tooling guard probes#95114
vincentkoc merged 2 commits into
mainfrom
qa-sre-rpc-scripts-next-20260619

Conversation

@vincentkoc

@vincentkoc vincentkoc commented Jun 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

  • release the Kitchen Sink RPC probe response reader lock after bounded stream reads
  • add focused coverage so the QA probe proves the reader is released without falling back to response.text()
  • fix stale security-sensitive guard workflow coverage after the membership check moved into the shared guard helper

Verification

  • node --check scripts/e2e/kitchen-sink-rpc-walk.mjs
  • node --check --experimental-strip-types test/scripts/kitchen-sink-rpc-walk.test.ts
  • node --check --experimental-strip-types test/scripts/security-sensitive-guard-workflow.test.ts
  • git diff --check
  • Fresh autoreview: no actionable findings

node scripts/run-vitest.mjs test/scripts/kitchen-sink-rpc-walk.test.ts was not run locally because this Codex worktree has no node_modules and exits with OPENCLAW_MISSING_VITEST; dependencies were intentionally not installed in the Codex worktree.

The first exact-head CI release gate on 2823bd6f8da failed in checks-node-core-tooling on unrelated stale guard workflow coverage (test/scripts/security-sensitive-guard-workflow.test.ts expected /memberships/ in the security-sensitive guard script after the helper had moved to scripts/github/guard-shared.mjs). This PR now includes that narrow test fix.

@vincentkoc vincentkoc self-assigned this Jun 19, 2026
@openclaw-barnacle openclaw-barnacle Bot added scripts Repository scripts size: S maintainer Maintainer-authored PR labels Jun 19, 2026
@clawsweeper

clawsweeper Bot commented Jun 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 19, 2026, 6:53 PM ET / 22:53 UTC.

Summary
The PR releases the Kitchen Sink RPC bounded stream reader after successful reads, adds focused regression coverage, and updates security-sensitive guard workflow coverage to include the shared guard helper.

PR surface: Tests +26, Other +6. Total +32 across 3 files.

Reproducibility: yes. from source inspection. Current main streams a Kitchen Sink probe response without releasing the reader, and the guard workflow test still searches only the wrapper script for a memberships endpoint now owned by the shared helper; I did not run Vitest in this read-only review.

Review metrics: none identified.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Mark the PR ready and wait for the in-progress exact-head checks to finish before landing.

Risk before merge

  • [P1] The PR was still draft and some exact-head checks were in progress during review, so landing should wait for the current head's required CI, especially core tooling, to finish.

Maintainer options:

  1. Decide the mitigation before merge
    Land the narrow script/test fix after the PR is marked ready and exact-head required checks complete successfully.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

  • [P2] The remaining action is maintainer handling for a protected draft PR plus exact-head CI completion; there is no narrow ClawSweeper repair finding to queue.

Security
Cleared: Cleared: the diff changes a local E2E helper and tests only, with no dependency, workflow-permission, secret-handling, package-resolution, or new execution-surface change.

Review details

Best possible solution:

Land the narrow script/test fix after the PR is marked ready and exact-head required checks complete successfully.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection. Current main streams a Kitchen Sink probe response without releasing the reader, and the guard workflow test still searches only the wrapper script for a memberships endpoint now owned by the shared helper; I did not run Vitest in this read-only review.

Is this the best way to solve the issue?

Yes. The PR uses the narrow local finally-release fix that matches the sibling helper invariant, and the guard test update follows the current split between security-sensitive-guard.mjs and guard-shared.mjs without changing runtime behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 7ee1dafd4fd9.

Label changes

Label justifications:

  • P3: This is a small maintainer script/test stabilization PR with limited blast radius and no user-facing runtime surface.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external contributor proof gate does not apply to this maintainer-authored PR; exact-head CI remains normal merge validation.
Evidence reviewed

PR surface:

Tests +26, Other +6. Total +32 across 3 files.

View PR surface stats
Area Files Added Removed Net
Source 0 0 0 0
Tests 2 27 1 +26
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 1 24 18 +6
Total 3 51 19 +32

What I checked:

Likely related people:

  • vincentkoc: Blame, shortlog, and focused git log history show Vincent Koc introduced and recently hardened the Kitchen Sink bounded reader, neighboring script probe bounds, and the guard shared-helper split. (role: recent area contributor; confidence: high; commits: 458904037f4e, 17e2fbfa8614, aa479ac7d8f7; files: scripts/e2e/kitchen-sink-rpc-walk.mjs, test/scripts/kitchen-sink-rpc-walk.test.ts, scripts/github/guard-shared.mjs)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P3 Low-priority cleanup, docs, polish, ergonomics, or speculative work. labels Jun 19, 2026
@vincentkoc vincentkoc changed the title fix(test): release kitchen sink probe readers fix(test): stabilize tooling guard probes Jun 19, 2026
@vincentkoc

vincentkoc commented Jun 19, 2026

Copy link
Copy Markdown
Member Author

Land-ready proof for 625e971b172abd22d012449c2cddd88d07c976d7:

  • node --check scripts/e2e/kitchen-sink-rpc-walk.mjs
  • node --check --experimental-strip-types test/scripts/kitchen-sink-rpc-walk.test.ts
  • node --check --experimental-strip-types test/scripts/security-sensitive-guard-workflow.test.ts
  • git diff --check
  • Fresh autoreview: no actionable findings
  • Manual exact-head CI release gate 27851848735: success, 127/127 jobs, head SHA 625e971b172abd22d012449c2cddd88d07c976d7

The earlier exact-head gate 27851189828 on 2823bd6f8da failed in checks-node-core-tooling on stale security-sensitive guard workflow coverage. The current head includes the narrow follow-up test fix and the fresh gate passed.

Local targeted Vitest was not run in this Codex worktree because node_modules is absent and scripts/run-vitest.mjs exits with OPENCLAW_MISSING_VITEST; dependencies were intentionally not installed in the Codex worktree.

@vincentkoc
vincentkoc marked this pull request as ready for review June 19, 2026 22:55
@vincentkoc
vincentkoc requested a review from a team as a code owner June 19, 2026 22:55
@vincentkoc
vincentkoc merged commit be7807f into main Jun 19, 2026
174 of 177 checks passed
@vincentkoc
vincentkoc deleted the qa-sre-rpc-scripts-next-20260619 branch June 19, 2026 22:55
This was referenced Jun 20, 2026
Draft
Closed
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 20, 2026
@vincentkoc
fix(test): stabilize tooling guard probes (openclaw#95114)
f7c0236 
* fix(test): release kitchen sink probe readers

* test(github): follow shared guard membership helper
lzyyzznl pushed a commit to lzyyzznl/openclaw that referenced this pull request Jun 20, 2026
@vincentkoc @lzyyzznl
fix(test): stabilize tooling guard probes (openclaw#95114)
8a3ebb5 
* fix(test): release kitchen sink probe readers

* test(github): follow shared guard membership helper
@kzzalews kzzalews mentioned this pull request Jun 20, 2026
Closed
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@vincentkoc vincentkoc

Labels

maintainer Maintainer-authored PR P3 Low-priority cleanup, docs, polish, ergonomics, or speculative work. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. scripts Repository scripts size: S status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vincentkoc