feat: add monthly daily and stable release policy#95613
feat: add monthly daily and stable release policy#95613kevinlin-openai wants to merge 19 commits into
Conversation
|
Codex review: needs real behavior proof before merge. Reviewed July 2, 2026, 10:38 PM ET / 02:38 UTC. Summary PR surface: Source +15, Tests +2939, Docs +4, Config +1568, Other +3635. Total +8161 across 33 files. Reproducibility: not applicable. This PR adds release-policy and workflow capability rather than fixing a user-reported runtime bug. The reviewable behavior is source-checkable through workflow, policy, evidence, and test surfaces. Review metrics: 2 noteworthy metrics.
Stored data model Root-cause cluster Members:
Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything. Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Proof guidance:
Risk before merge
Maintainer options:
Next step before merge
Security Review detailsBest possible solution: Merge the npm-only strict policy foundation only after release-manager signoff, redacted official proof or an explicit waiver, stable-line bootstrap handling, and green or intentionally waived required checks. Do we have a high-confidence way to reproduce the issue? Not applicable: this PR adds release-policy and workflow capability rather than fixing a user-reported runtime bug. The reviewable behavior is source-checkable through workflow, policy, evidence, and test surfaces. Is this the best way to solve the issue? Mostly yes: the implementation centralizes release intent and evidence behind dedicated release scripts and keeps credentialed publish behind policy gates. It is not the best merge state until release owners sign off and official proof or a waiver covers the remaining token-bound paths. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 8d535fb039c5. Label changesLabel justifications:
Evidence reviewedPR surface: Source +15, Tests +2939, Docs +4, Config +1568, Other +3635. Total +8161 across 33 files. View PR surface stats
Security concerns:
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
421c8ee to
7aa9540
Compare
|
@clawsweeper re-review Addressed the operator-contract finding: |
|
🦞🧹 I asked ClawSweeper to review this item again. |
7aa9540 to
3e195b5
Compare
|
@clawsweeper re-review Rebased onto current |
|
🦞🧹 I asked ClawSweeper to review this item again. |
3e195b5 to
735b931
Compare
|
@clawsweeper re-review Addressed the legacy compatibility finding at current head: omitted or empty legacy |
|
🦞🧹 I asked ClawSweeper to review this item again. |
d1baf46 to
8ada708
Compare
8ada708 to
11c8826
Compare
1f84894 to
cfcedbd
Compare
|
@clawsweeper re-review The current head Verification: 326 changed-surface tests passed before the conflict-free rebase; post-rebase checks passed 89 policy/evidence tests, 40 package-acceptance workflow tests, workflow validation, docs/MDX/link audits, oxfmt, oxlint, and diff checks. The PR body has current proof. |
|
🦞🧹 I asked ClawSweeper to review this item again. |
bd3d19b to
734186c
Compare
|
@clawsweeper re-review Current head Post-rebase verification: 89 policy/evidence tests, type-aware lint on the changed release modules, workflow validation, docs/MDX/link/map audits, oxfmt, and diff checks pass. The full boundary command cannot run against this checkout's intentionally shared, different-lock |
|
🦞🧹 I asked ClawSweeper to review this item again. |
734186c to
2198c74
Compare
What Problem This Solves
OpenClaw cannot safely operate the new monthly daily/stable npm release model because release class, selector intent, protected policy authority, stable-line state, and publication evidence are not yet bound into one fail-closed contract.
Why This Change Was Made
This adds the
YYYY.M.PATCHrelease classifier, strict selector policy, immutable policy/publish/postpublish evidence, authenticated exact-ref verification, and stable-line lifecycle tooling for npm releases.The scope is intentionally npm-only:
The authoritative
release/stable-lines.jsongenesis remains deferred to the July bootstrap PR, so strict stable npm publication remains blocked until that metadata exists and a fresh candidate preflight is run.User Impact
Maintainers can run daily npm releases with
latestwhile preparing a trailing-month stable npm line fromstable/YYYY.M.33. Daily releases cannot accidentally advance the stable selector, and strict stable work fails closed unless the protected policy, source branch, tag, workflow runs, and immutable evidence agree.Existing legacy and non-stable platform release behavior is preserved.
Evidence
git diff --checkpass.2026.6.33stable line derived from this policy foundation completed an authenticated dry run and a publishing rehearsal fromstable/2026.6.33, produced checksummed evidence assets, and installed the generated tarball in an isolated prefix.5edaa7d6bbedd861dfd50f2da6afc88a13d73609; downloaded SHA-256 checks passed; isolated install reportedOpenClaw 2026.6.33 (5edaa7d).npmPublished: falseandfullReleaseValidationRun: null; this is classifier, packaging, checksum, and install proof, not official npm-publication proof.No authoritative stable-lines file is added by this PR.