Skip to content

refactor: route boot session mapping through accessor#96225

Merged
jalehman merged 2 commits into
mainfrom
josh/path3-boot-session-mapping-accessor
Jun 24, 2026
Merged

refactor: route boot session mapping through accessor#96225
jalehman merged 2 commits into
mainfrom
josh/path3-boot-session-mapping-accessor

Conversation

@jalehman

@jalehman jalehman commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What Problem This Solves

src/gateway/boot.ts still needed direct session-store snapshot/restore access for the temporary agent:main:boot mapping. That kept boot startup outside the Path 3 accessor boundary tracked by #88838.

Why This Change Was Made

This moves boot temporary session mapping preservation into a narrow named session accessor operation. The boot runner keeps the existing behavior: snapshot any prior boot mapping, run the isolated boot session, then restore the prior mapping or delete the temporary boot mapping if none existed.

User Impact

No intended user-visible behavior change. Boot startup continues to use an isolated boot session while leaving any prior boot session mapping unchanged after the boot run completes.

Evidence

  • node scripts/run-vitest.mjs src/gateway/boot.test.ts - passed, 64 tests
  • node scripts/run-vitest.mjs test/scripts/check-session-accessor-boundary.test.ts - passed, 28 tests
  • node scripts/check-session-accessor-boundary.mjs && git diff --check upstream/main..HEAD - passed
  • node scripts/run-tsgo.mjs -p tsconfig.core.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core.tsbuildinfo - passed
  • node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.core.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core-test.tsbuildinfo - passed
  • .agents/skills/autoreview/scripts/autoreview --mode branch --base upstream/main - clean, no accepted/actionable findings

Real behavior proof

Behavior addressed: Boot startup preserves/restores the temporary agent:main:boot session mapping through the new session accessor boundary: existing mappings are restored, and temporary mappings are deleted when no prior mapping existed.

Real environment tested: Local live gateway in /Users/phaedrus/Projects/clawdbot, branch build at 3cdb7fce74a88f08230028660c54c9ea15ac753f before the final conflict-free rebase, OpenClaw 2026.6.9, managed gateway on port 18789. Final pushed head c8dd6d107d7c9e3c37c4e855bc125ec3711e0c04 was then verified with focused tests, boundary guard, type probes, and autoreview against upstream/main 17066f2d7c019d92fc090762484359f751976f50.

Exact steps or command run after this patch:

# Safety and baseline checks in /Users/phaedrus/Projects/clawdbot
git status -sb
git rev-parse HEAD
pnpm openclaw gateway status --json --require-rpc
pnpm openclaw gateway call status --json
curl -fsS http://127.0.0.1:18789/healthz
curl -fsS http://127.0.0.1:18789/readyz

# Load branch build into the live checkout
git switch --detach 3cdb7fce74a88f08230028660c54c9ea15ac753f
pnpm build
pnpm openclaw gateway restart
pnpm openclaw --version
curl -fsS http://127.0.0.1:18789/healthz
curl -fsS http://127.0.0.1:18789/readyz

# Synthetic reversible boot mapping proof
node /tmp/path3-boot-mapping-proof.mjs

# Restore live service
git switch main
pnpm build
pnpm openclaw gateway restart
pnpm openclaw --version
curl -fsS http://127.0.0.1:18789/healthz
curl -fsS http://127.0.0.1:18789/readyz

# Final post-rebase proof in the Codex worktree
node scripts/run-vitest.mjs src/gateway/boot.test.ts
node scripts/run-vitest.mjs test/scripts/check-session-accessor-boundary.test.ts
node scripts/check-session-accessor-boundary.mjs && git diff --check upstream/main..HEAD
node scripts/run-tsgo.mjs -p tsconfig.core.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core.tsbuildinfo
node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.core.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core-test.tsbuildinfo
.agents/skills/autoreview/scripts/autoreview --mode branch --base upstream/main

Evidence after fix: Proof nonce path3-boot-mqrb7a2e. With a synthetic pre-existing agent:main:boot row, the live boot run restored sessionId=path3-boot-mqrb7a2e-existing and updatedAt=1700000000000 after creating isolated boot transcripts boot-2026-06-24_00-02-53-057-ece6091d.jsonl and boot-2026-06-24_00-02-53-057-ece6091d.trajectory.jsonl. With no prior boot row, the live boot run created isolated boot transcripts boot-2026-06-24_00-03-25-036-73b9c902.jsonl and boot-2026-06-24_00-03-25-036-73b9c902.trajectory.jsonl, then left no agent:main:boot mapping. Transcript headers showed cwd=/Users/phaedrus/clawd and type=session/session.started. Cleanup removed four proof transcripts, removed the temporary BOOT.md, and left finalBootMappingPresent=false and finalBootFileExists=false. The live service was restored to clean main at 6f2869c296ffc3e82ad22e0d744bdb9c73eb3177; final /healthz returned {"ok":true,"status":"live"} and final /readyz returned ready:true, no failing checks, and eventLoop.degraded:false.

Observed result after fix: The live gateway created and used isolated boot sessions while preserving a prior boot mapping when present and deleting the temporary boot mapping when absent. The proof left no synthetic boot mapping, temporary boot file, or proof transcripts behind, and the live service was restored to the saved healthy checkout.

What was not tested: The future SQLite-backed adapter/transaction implementation, doctor migration behavior, plugin SDK compatibility, fallback/dual-read behavior, and a second live service restart on the final post-rebase SHA. The final SHA was covered by focused Vitest, boundary guard, type probes, and autoreview after rebasing onto current upstream/main.

@openclaw-barnacle openclaw-barnacle Bot added gateway Gateway runtime scripts Repository scripts size: M maintainer Maintainer-authored PR labels Jun 24, 2026
@jalehman jalehman mentioned this pull request Jun 24, 2026
Closed
@clawsweeper clawsweeper Bot mentioned this pull request Jun 24, 2026
Merged
@clawsweeper

clawsweeper Bot commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 24, 2026, 9:47 AM ET / 13:47 UTC.

Summary
The branch adds a session accessor operation for temporary boot mapping preservation, removes direct file-store snapshot/restore code from the boot runner, and ratchets the session accessor boundary allowlist.

PR surface: Source +57, Tests +2, Other +2. Total +61 across 4 files.

Reproducibility: not applicable. This PR is an internal refactor preserving existing boot behavior rather than a bug report. The relevant restore/delete behavior is covered by existing boot tests and the PR body's live gateway proof.

Review metrics: none identified.

Stored data model
Persistent data-model change detected: serialized state: src/config/sessions/session-accessor.ts, unknown-data-model-change: src/config/sessions/session-accessor.ts. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #88838
Summary: This PR is a concrete implementation slice for the canonical session/transcript SQLite accessor tracker; the checkpoint PR is adjacent already-merged work.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • none.

Risk before merge

  • [P1] The protected maintainer label requires explicit maintainer handling even though the patch review found no blocking correctness issue.

Maintainer options:

  1. Decide the mitigation before merge
    Proceed with maintainer review and normal merge gates for this accessor-boundary slice, leaving SQLite adapter/importer behavior on the canonical tracker.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

  • [P2] The PR has no narrow ClawSweeper repair target and carries a protected maintainer label, so the next action is maintainer review/merge-gate handling.

Security
Cleared: The diff does not touch dependencies, workflows, secrets, permissions, downloads, publishing, or other concrete supply-chain/security-sensitive surfaces.

Review details

Best possible solution:

Proceed with maintainer review and normal merge gates for this accessor-boundary slice, leaving SQLite adapter/importer behavior on the canonical tracker.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR is an internal refactor preserving existing boot behavior rather than a bug report. The relevant restore/delete behavior is covered by existing boot tests and the PR body's live gateway proof.

Is this the best way to solve the issue?

Yes: for the stated Path 3 goal, moving the one-key temporary boot mapping lifecycle into the session accessor is the right owner boundary, while boot still owns boot prompt construction and command execution.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f1e38f2ed637.

Label changes

Label justifications:

  • P2: The PR is a normal-priority gateway/session-state migration slice with limited direct user-visible blast radius and no blocking review finding.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes after-fix live gateway proof for restoring an existing boot mapping and deleting a temporary boot mapping, plus focused post-rebase tests and boundary/type checks.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix live gateway proof for restoring an existing boot mapping and deleting a temporary boot mapping, plus focused post-rebase tests and boundary/type checks.
Evidence reviewed

PR surface:

Source +57, Tests +2, Other +2. Total +61 across 4 files.

View PR surface stats
Area Files Added Removed Net
Source 2 160 103 +57
Tests 1 2 0 +2
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 1 2 0 +2
Total 4 164 103 +61

Acceptance criteria:

  • [P1] node scripts/run-vitest.mjs src/gateway/boot.test.ts.
  • [P1] node scripts/run-vitest.mjs test/scripts/check-session-accessor-boundary.test.ts.
  • [P1] node scripts/check-session-accessor-boundary.mjs.
  • [P1] node scripts/run-tsgo.mjs -p tsconfig.core.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core.tsbuildinfo.
  • [P1] node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.core.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core-test.tsbuildinfo.

What I checked:

  • Repository policy read: Root, scripts, gateway, and test scoped AGENTS.md files were read fully; their review-depth, protected-label, wrapper, and gateway verification guidance applied to this review. (AGENTS.md:1, f1e38f2ed637)
  • Live PR state: Live GitHub metadata shows head c8dd6d1, mergeStateStatus CLEAN, mergeable MERGEABLE, protected maintainer label, and proof: sufficient. (c8dd6d107d7c)
  • Current main still needs the branch: Current main boot.ts still imports loadSessionStore/updateSessionStore and defines local snapshotSessionMapping/restoreSessionMapping helpers, so the branch is not redundant on main. (src/gateway/boot.ts:21, f1e38f2ed637)
  • PR head routes boot through accessor: At PR head, runBootOnce resolves the boot store path and wraps the agent command in preserveTemporarySessionMapping while preserving the existing BootRunResult failure handling. (src/gateway/boot.ts:128, c8dd6d107d7c)
  • Accessor implementation: The new accessor snapshots exactly one session key, runs the caller operation, then restores the prior cloned entry or deletes the temporary mapping afterward. (src/config/sessions/session-accessor.ts:1436, c8dd6d107d7c)
  • Behavior coverage: Existing boot tests cover preserving the main mapping and deleting the temporary boot mapping after a boot run, matching the behavior moved behind the accessor. (src/gateway/boot.test.ts:340, f1e38f2ed637)

Likely related people:

  • jalehman: Authored the canonical session accessor seam and recent merged gateway accessor slices that define the current owner boundary for this PR. (role: feature owner / recent area contributor; confidence: high; commits: ef47dd610c87, ae433525f0b1, b08d901dd2fc; files: src/config/sessions/session-accessor.ts, scripts/check-session-accessor-boundary.mjs, test/scripts/check-session-accessor-boundary.test.ts)
  • TurboTheTurtle: Opened the original boot-md startup session isolation PR that introduced the snapshot/restore behavior this PR preserves behind the accessor boundary. (role: introduced adjacent boot isolation behavior; confidence: medium; commits: 65ce036e5755, 53e310608b77; files: src/gateway/boot.ts, src/gateway/boot.test.ts)
  • Vincent Koc: Current local blame for the boot runner points to the latest source snapshot commit; this is useful routing context but less specific than the PR and tracker history. (role: recent area contributor; confidence: low; commits: 2ab3b223ed69; files: src/gateway/boot.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. labels Jun 24, 2026
@jalehman
jalehman force-pushed the josh/path3-boot-session-mapping-accessor branch 2 times, most recently from fae77dc to 8fe3fb8 Compare June 24, 2026 13:29
@jalehman
jalehman force-pushed the josh/path3-boot-session-mapping-accessor branch from 8fe3fb8 to c8dd6d1 Compare June 24, 2026 13:31
@jalehman
jalehman merged commit acc2a0e into main Jun 24, 2026
99 checks passed
@jalehman
jalehman deleted the josh/path3-boot-session-mapping-accessor branch June 24, 2026 13:54
@github-actions github-actions Bot mentioned this pull request Jun 24, 2026
Open
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 25, 2026
@jalehman
refactor: route boot session mapping through accessor (openclaw#96225)
677c6f9
QiuYuang pushed a commit to QiuYuang/openclaw that referenced this pull request Jul 1, 2026
@jalehman @QiuYuang
refactor: route boot session mapping through accessor (openclaw#96225)
b00f41b
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

gateway Gateway runtime maintainer Maintainer-authored PR P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. scripts Repository scripts size: M status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jalehman