[RomneyDa]

What Problem This Solves

Fixes stable promotion failing during Local AI proof source hashing after #2061 adds a nested diagnostics checkout.

Observed in promotion run 42338153493: diagnostics and Tray UI tests passed, but Invoke-LocalAiVisualProof.ps1 failed hashing .ci-pipeline/. This fixes the merged #2061 approach; closed #2062 remains closed.

User Impact

The existing v2026.11.1-alpha.8 at 04f413d26531d3ea19cb108291334bb3cc5fd6e6 remains the promotion candidate. No new alpha, tag movement, or product-code change is needed. This PR fixes helper resolution; live promotion/publication remains unverified.

Why This Change Was Made

Git lists the nested .ci-pipeline/ repository as one untracked directory. The historical proof script hashes every source-manifest entry as a file, so the added checkout deterministically breaks it. Remove that nested checkout rather than weaken the source manifest or change the alpha. The workflow owns diagnostic collection, while the product checkout deliberately owns the historical alpha. Extract only the helper from immutable GITHUB_SHA into RUNNER_TEMP and invoke it with the existing bounded start time. Do not overwrite the product checkout, load moving main, skip diagnostics, or weaken the CI gate.

The helper itself, event-field filtering, and Local AI source-manifest code remain unchanged. Extraction failure throws before a stale temporary helper can execute.

Evidence

Negative control: a real nested Git checkout makes git ls-files --cached --others --exclude-standard return .ci-pipeline/; applying the same Get-FileHash loop exits 1.

The new disposable-Git regression executes the actual YAML run block, then runs the historical source-hashing algorithm and compares hashes before/after. It also checks absent/older candidate helpers, main advancing past the pinned pipeline, unchanged checkout/HEAD, timestamp forwarding, and fail-closed extraction. Three cases pass; all 34 promotion cases and actionlint pass.

Shared autoreview (Codex gpt-6.1-sol, high, branch mode against b6f158ab257aabdf04823d636076980ab614507f, P0-P3, with diagnostics and Local AI proof source context) completed scoped-clean: correct verdict, no findings, exit 0. This independent implementation/proof-plan review does not establish live Windows or release proof.

Change Type

• Bug fix
• Feature
• Refactor
• Docs or instructions
• Tests or validation
• Security hardening
• Chore or infrastructure

Scope

• Tray or WinUI UX
• Windows node capability
• Local MCP or winnode
• Gateway, connection, or pairing
• Setup or onboarding
• Permissions, privacy, or security
• Tests, CI, or docs

Required proof pools

• none: pipeline helper source resolution only; no changed Windows product/UI contract. Required Windows CI and the real promotion remain outstanding.

Validation

• pwsh -NoProfile -File scripts/test-ci-crash-metadata-source.ps1: 3 cases passed, including unchanged, hashable source manifests. Nested-checkout negative control reproduced the directory-hash failure.
• pwsh -NoProfile -File scripts/test-alpha-promotion.ps1: 34 cases plus workflow contracts passed.
• actionlint -shellcheck= -pyflakes= .github/workflows/ci.yml: passed.
• git diff --check: passed.
• pwsh -NoProfile -File scripts/test-ci-workflow-contract.ps1: updated source checks pass up to the existing Windows-only path filtering assertion; full script not green on macOS.
• pwsh -NoProfile -File build.ps1 and pwsh -NoProfile -File scripts/setup-dev.ps1 -CheckOnly: blocked, require Windows.
• dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore: macOS Windows path/API and profile-assumption failures; task-owned run stopped after 45 seconds, not a completed-suite pass.
• dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore: executed tests hit path/API and source-contract failures on macOS (including OnboardingPresentationContractTests and CiNugetCacheWorkflowTests); not a completed-suite pass.

Tests use temporary isolated tray settings. No shared Windows runtime or alpha changed.

Real Behavior Proof

• Environment tested: macOS, PowerShell, git, actionlint. No Windows event log query.
• PR head or commit tested: 7280e0fbc89466ab6314b377f7648d69b309ece7; focused tests ran on byte-identical source before commit.
• Exact steps or command run: pwsh -NoProfile -File scripts/test-ci-crash-metadata-source.ps1.
• Evidence after fix: Passed 3 pipeline crash-helper cases: absent/older candidate helper, pinned revision, unchanged hashable source manifest, and failed extraction.
• Observed result: pipeline helper executes despite missing or different alpha helper; product checkout stays unchanged; missing pinned helper fails before invocation.
• Screenshot or artifact links verified? N/A, no UI change.
• Not verified or blocked: full Windows validation, live promotion and GitHub token-only publication.

Security Impact

• New permissions or capabilities? No.
• Secrets or tokens handling changed? No.
• New or changed network calls? No. The UI checkout already fetches full Git history.
• Command or tool execution surface changed? Yes: diagnostics helper is read from the immutable workflow commit and executed from runner temp.
• Data access scope changed? No.
• If any answer is Yes, explain the risk and mitigation: no dynamic helper path or moving branch, no candidate helper execution; existing event ID/time/process whitelist and no-memory-dump behavior stay intact. Git extraction fails closed.

Compatibility and Migration

• Backward compatible? Yes, supports historical candidates missing the newer helper.
• Config or environment changes? No.
• Migration needed? No.
• If yes, list the exact upgrade steps: after landing, start a fresh promotion selecting the same existing alpha. An unchanged rerun uses the broken workflow.

Review Conversations

• I replied to or resolved every bot review conversation addressed by this PR.
• I left unresolved only conversations that still need maintainer judgment.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR extracts the pinned pipeline diagnostics helper into runner temporary storage instead of creating a nested checkout.

Example: Promote v2026.11.1-alpha.8 at 04f413d.

• Before: The nested .ci-pipeline/ checkout enters the source inventory, whose file-hashing loop cannot hash that directory.
• After: Diagnostics execute from RUNNER_TEMP while the candidate source inventory remains unchanged.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	A focused, source-verified repair with meaningful behavioral regression coverage and no identified defect; operational proof remains limited to a fixture.
Proof confidence	🦐 gold shrimp (3/6)	This maintainer-authored PR is outside the ordinary contributor proof gate; supplied macOS output exercises the actual YAML extraction block with real Git and a fixture helper, but hosted Windows diagnostics and promotion remain unverified.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Release managers cannot finish preparing the existing alpha because pipeline diagnostics introduce a directory that breaks proof source hashing.
Reason: Maintainer-authored direction authorizes a narrow repair that preserves the established candidate/pipeline ownership contract.

Regression provenance

Regression provenance — suspected predecessor, not a causality claim: source commit 1d8e42687247 by Karen; no PR verified.

Possible regression — suspected (reviewed change). No predecessor PR is attributed.

Merge readiness

✅ Ready for maintainer review

Keep open: this maintainer-authored PR repairs a source-verifiable promotion failure still present on main; no actionable code or security findings were identified.

Priority: P2
Reviewed head: 7280e0fbc89466ab6314b377f7648d69b309ece7

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: Supplied evidence covers the YAML/Git fixture rather than a current-head hosted promotion against the historical alpha.

Agent review details

How this fits together

Reusable release CI checks out historical candidate source, collects pipeline-owned crash diagnostics, and then freezes source hashes for Local AI proof.

flowchart TD
 A[Promotion dispatch] --> B[Pinned pipeline revision]
 A --> C[Historical candidate checkout]
 B --> D[Extract helper into runner temp]
 C --> E[Tray UI tests]
 D --> F[Bounded crash diagnostics]
 E --> F
 F --> G[Local AI source hashing]

Loading

Technical review

Best possible solution:

Keep the existing workflow as diagnostics owner and extract only its immutable helper outside the candidate source tree.

Do we have a high-confidence way to reproduce the issue?

The nested checkout and unconditional source-entry hashing establish the failure path in source; the linked hosted job corroborates the failing stage, and the author reports a matching negative control.

Is this the best way to solve the issue?

The patch is the smallest complete repair using existing owners: remove the contaminating checkout, preserve immutable pipeline selection, and leave candidate source and manifest validation intact.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against b6f158ab257a.

Provenance checked

• Pipeline-owned crash diagnostics changes intended behavior with a stated reason (b6f158a: Use the pinned pipeline helper when a historical candidate lacks newer diagnostics, retaining explicit infrastructure failures.)
• Always-running workflow contract validation keeps the original intent (5d19239: Keep lightweight workflow validation active and CI admission fail closed while selectively skipping heavy lanes.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Pinned introduced change: The diff removes the nested checkout, reads the helper from GITHUB_SHA, rejects extraction failure before invocation, and preserves the existing diagnostics timestamp. (.github/workflows/ci.yml:771, 7280e0fbc894)
• Current-main failure path: Main creates .ci-pipeline inside the candidate checkout, while Invoke-LocalAiVisualProof enumerates untracked entries and applies Get-FileHash to every entry without excluding directories. (scripts/Invoke-LocalAiVisualProof.ps1:33, b6f158ab257a)
• Hosted failure corroboration: Promotion job https://github.com/openclaw/openclaw-windows-node/actions/runs/42338153493/job/128300718933 passed diagnostics and subsequently failed Local AI hardware-profile capture. Raw logs could not be inspected because their Azure storage redirect is outside the network allowlist; metadata alone does not establish the exact exception.
• Behavioral regression coverage: The added regression executes the actual YAML script using disposable Git history and checks immutable helper selection, timestamp forwarding, unchanged candidate files and hashes, and rejection before stale-helper execution. (scripts/test-ci-crash-metadata-source.ps1:35, 7280e0fbc894)
• Preserved ownership and original intent: Release documentation separates candidate product source from pipeline orchestration. The merged repair fix(release): alpha promotion fails collecting newer CI diagnostics #2061 intentionally used pinned pipeline diagnostics and explicit failure; this PR preserves those requirements while correcting checkout placement. (docs/RELEASING.md:467, b6f158ab257a)
• Review state and validation limits: The reviewed head and base remain pinned as supplied, GitHub reports mergeable=true, and fast-validation and core tests passed while other checks remain pending. This review ran no builds, tests, bundled review helper, or second reviewer; the checkout remained clean. (7280e0fbc894)

Preflight source

Source unknown. Source comparison at the observed PR snapshot only. Completion is self-reported; body, policy, tests, execution, and report bytes are not verified.

Review metrics

Metric	Value	Why it matters
Workflow and regression scope	Workflow +10/-13 lines; tests +94/-15 lines	Production orchestration shrinks while the added Git fixture protects distinct source-isolation and extraction-failure cases.

Labels

Label changes:

• add P2: The defect blocks historical-alpha promotion preparation without affecting installed Companion runtime behavior.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: The defect blocks historical-alpha promotion preparation without affecting installed Companion runtime behavior.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Link hosted promotion output showing pipeline-helper execution followed by successful source hashing for the unchanged alpha candidate.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed November 7, 2026, 2:46 AM ET / 07:46 UTC.