release-openclaw-ci skill

OpenClaw Release CI

Use this with $release-openclaw-maintainer and $openclaw-testing when a release candidate needs full validation, install/update proof, live provider checks, or CI recovery.

Guardrails

current phase from the latest explicit operator instruction. Do not merge old scope back into the active release.

• No version bump, tag, npm publish, GitHub release, or release promotion without explicit operator approval.
• After compaction, resume, or new steering, rewrite the effective goal and

ship that exact release; do not turn moving main into a second work queue.

• Hold the release scope once a release branch or Code SHA exists. Validate and

rerun group, profile, effective soak, and context/transport refs**. New candidate test qualification defaults to Q=C, including the complete workflow, reusable workflow, local action, script, planner, contract, and coverage closure. Code SHA and Release SHA remain lifecycle roles, not extra workflow identities.

• Record **C (candidate), Q (test qualification), P (admission/aggregate/verifier/publisher),

or annotated tag resolving to the exact candidate SHA. A conflicting tag or failed remote lookup stops validation; never move a tag to recover.

• The candidate helper accepts an absent release tag or an existing lightweight

publication tag. C/Q need not be an ancestor of P. Missing candidate contracts require a deliberate backport; never silently substitute newer main tooling.

• Freeze C/Q and independently select trusted P on main or a protected

product defects, wrong or unverifiable package bytes, security defects, or failures that make publication impossible. Queue other findings for postpublish confidence or the next beta. Dependency advisories are never firebreak admissions: record them as release evidence and queue the bump on main after publication; only known malware stops publication.

• Apply a release firebreak after the Code SHA is frozen. Admit only confirmed

costs, while discovering and executing tests from the candidate checkout. Hosted full-release plans split measured rows above 12 minutes; preserve file coverage, worker limits, and complete timing generations. An indivisible over-budget owner must be split rather than increasing the release budget. After the child completes, closeout runs scripts/ci-shard-timings-refresh.mts for that exact run and commits generated costs; do not hand-edit measurements.

• Frozen CI children use Q's Node shard planner and measured

decision and checked-in waiver policy. Main-only checks and future-main scenarios are not implicit release requirements. Fixing a frozen qualification harness means a new C/Q, with newly bound evidence. A P-only admission/aggregate/verifier/publisher repair can keep C/Q and their original evidence.

• Candidate tests run their own frozen Q closure; admitted P owns FRV's aggregate

P, not Q. The suffix records tag-creation provenance, not the current parent. Publication helpers retain their --workflow-sha argument; the FRV helper's --workflow-sha instead selects Q and must equal C on the candidate route.

• Protected lightweight release-publish/<12sha>- tags identify

main-owned blocker that prevents this release and cannot be handled from the release branch. Main's CI health never gates a release. If a release-tooling landing is blocked by main failures it does not cause, prove on a clean main checkout that the failure already exists there, record it in the PR body, and merge; during an active release an admin merge is allowed for that exact case. A separate lane fixes red main in parallel, off the release's critical path.

• Touch main only for an operator-requested change or the smallest critical

before the push (see Release tooling fast lane): openclaw/ci-gate then runs lint, types, guards, dependencies, docs, and the changed Node rows only. Land through the native maintainer workflow. That workflow owns review and landing requirements, including the advisory ClawSweeper policy; the label changes only CI selection.

• Land tooling-only fixes on main with the release-fast-lane label added

and the Release Publish parent plus its publish children to reserved capacity with unchanged labels; credentialed publish and approval jobs stay on default GitHub-hosted labels. Configure eligible runners and repo access first; unset preserves ordinary routing. Shared workers inherit the caller group; PR/main CI and unrelated scheduled work remain outside it.

• OPENCLAWRELEASERUNNER_GROUP optionally routes validation parents and workers

checked-in waiver policy; all other required lanes must pass. See Publication requirements. Stable tags require stable/full evidence, soak, and blocking performance. Beta-profile evidence cannot qualify stable. Soak remains mandatory; performance exceptions are limited to the checked-in policy. All-group qualification requires all nine Linux/Windows/macOS Gateway install/upgrade combinations. Preserve first failures, identity, and complete evidence.

• Check the nightly parent for the Code SHA before dispatching a fresh main validation; it seals per-child receipts that exact-target dispatches adopt when inputs match. The nightly runs this explicit trusted-main helper route (--sha --workflow-sha --trusted-workflow-ref main), so its parent runs on a release-ci/- branch, not main.
• FRV must conclude success under pinned P's

at its existing dispatch point and runs independently thereafter; planning, authorization, dispatch, publication, verification, and recovery never block core, GitHub finalization, main closeout, or the retrospective PR. Record a separate owner, exact run/attempt, status, and next action for ClawHub.

• Selected npm plugins must publish successfully before core npm. ClawHub starts

npm/ClawHub, GitHub finalization, and main closeout. Each platform retains its own signing, qualification, artifact, and updater requirements; report pending platforms accurately and repair native-only failures in parallel.

• Native macOS, Windows, Linux, and Android publication is independent of

Avoid broad gh run view polling loops; REST quota is easy to burn.

• Do not set GitHub secrets from unvalidated 1Password candidates. If a candidate returns 401/403, leave the existing secret alone and report the exact missing provider.
• Use $one-password for secret reads/writes: one persistent tmux session, targeted items only, no secret output.
• Watch one parent run with pnpm frv watch --run (see Watch).

authentication, not billing or inference entitlement. Confirm the credential with a real completion probe before treating it as valid. Fix the credential first; do not add an alternate auth path merely to bypass a failed release credential.

• Fetch logs only for failed or currently-blocking jobs. If quota is low, stop polling and wait for reset.
• Treat live-provider flakes separately from code failures: prove key validity, provider HTTP status, retry evidence, and exact failing lane before editing code.
• When diagnosing a live-provider failure, a model-list response proves

and Diagnostic Drain. With failfast=false, it makes zero child cancellation calls; Diagnostic Drain follows every selected child to terminal unless the collector itself is cancelled or loses GitHub API access. With failfast=true, Release Decision may cancel only the exact still-active child that owns a blocking failure.

• Full Release Validation separates exact-child dispatch, Release Decision,

with fail_fast=false. The controller verifies that exact logged input before any rerun mutation.

• Same-parent continuation requires the original root to have been dispatched

GitHub reruns make those prior-attempt artifacts unavailable. Keep the candidate and qualification SHAs frozen, supersede that parent, and start a fresh all-group Full Release Validation.

• A parent that produced its own sealed candidate artifacts cannot be continued:

parent attempt, exact child tuples and titles, selected coverage, gates, and reuse identity. The same bytes are saved under an exact run-ID cache key. Decision, Drain, manifest writing, evidence validation, and final verification consume the artifact for their current attempt. A collector retry restores the cached plan, validates it, re-uploads its artifact, and adopts the same children; missing plan state is an orchestration failure, not permission to reconstruct the plan or redispatch.

• After dispatch, one immutable execution-plan artifact records the original

Decision repeats the sealed target SHA, evidence SHA, policy, changed paths, selected run, root run, source manifest, trusted tooling identity, and exact-child checks before returning passed.

• Reused evidence is not trusted merely because plan sealing found it. Release

both must bind the same immutable plan even when their source attempts differ.

• Parent retries select the newest Decision and Drain artifacts independently;

workflow path, ref, Q SHA, dispatch title, event, target, candidate, and validation inputs remain exact. Newer child attempts replace matching jobs; jobs absent from a newer attempt carry forward. A duplicate job identity, missing attempt, regressed attempt, or changed tuple fails closed. frv status and continue allow up to 60 seconds of read-only reconciliation when GitHub temporarily returns duplicate jobs in the newest retry attempt. The run tuple and attempt stay pinned; persistent duplicates and older-attempt conflicts remain errors.

• Child retries are part of the same immutable plan only when the child run ID,

The controller is stateless: the immutable execution plan, exact GitHub run attempts, Diagnostic Drain, and final manifest are the only authorities. It never writes a tag, package, registry entry, release candidate, or publication.

• Use pnpm frv status|watch|rerun --job|rerun --child|continue --failed|verify for attempt-aware recovery.

main through the non-release FRV Proof Broker and FRV Proof Fixture. Dispatch the broker with the merged pull request number and exact landed commit. The broker must require that pull request's merge commit to match the landed commit, prove the landed commit is identical to or an ancestor of its trusted workflow SHA, and repeat authority, merge, and ancestry checks immediately before rerunning the fixture. Require the exact fixed no-op fixture run to advance from its intentional attempt-one failure to an attempt-two pass. The broker must emit its receipt without creating a release candidate, release artifact, publication, repository ref, replacement parent, or other workflow mutation. This is the hosted GitHub targeted-job rerun proof; focused controller tests own immutable plan eligibility, green-attempt preservation, same-parent collection, and strict-verifier invocation. Never use a real Full Release Validation run for this proof. See Full Release Validation.

• Post-merge controller proof must use the reviewed landed SHA on protected

investigator for the current failed surface. Do not build audit-review-plan trees around a single workflow transition.

• Use one release operator, one frv watch, and at most one

and serve as Release SHA. One successful fresh full parent may qualify both roles and their exact publication bytes. If notes change afterward, a later Release SHA may reuse product evidence only when its complete delta from Code SHA changes the selected CHANGELOG/YYYY.M.PATCH.md and optionally CHANGELOG.md and CHANGELOG/records/YYYY.M.PATCH.md, with no other paths, renames, or deletions; its changed bytes still need qualification.

• For regular beta/stable releases, Code SHA may already contain final notes

Code-SHA/Release-SHA evidence model.