verify-release skill

Verify Release

Use this when asked whether an OpenClaw release is fully released, published, promoted, smoke-tested, or live-verified. This is a verification skill, not a publish skill; use $release-openclaw-maintainer before changing release state.

Rules

current date/context, then say the resolved version.

• Resolve short suffixes like .27 to the concrete CalVer version from the

ledger. Regular beta/stable also uses the platform graph; extended-stable uses its canonical branch, npm selector, and Gateway surfaces. Do not require one track's native or ClawHub artifacts from the other.

• Resolve the track first. Both tracks use the shared GitHub Release evidence

memory as current truth.

• Verify live state. Do not trust local checkout state, release notes, or old

For version metadata, fetch from GitHub release/tag or unpack the tag tarball under /tmp.

• If the checkout is dirty or divergent, use it only for scripts/reference.

publication/verification never blocks core, GitHub finalization, main closeout, or the retrospective PR. Keep its exact run/attempt, owner, and next action visible; do not call ClawHub complete without public-byte proof.

• Verify selected npm plugins published successfully before core npm.
• Report ClawHub separately from core release readiness. Its pending or failed

• Never print secrets.
• Keep the final terse: yes/no, evidence bullets, caveats, cleanup.

Regular beta/stable checks

Use these checks only for the regular orchestrated release track.

1. GitHub release:

links when expected.

• gh release view v --repo openclaw/openclaw --json tagName,name,publishedAt,isDraft,isPrerelease,targetCommitish,url,body,assets
• Confirm stable releases are not draft/prerelease.
• Confirm release body has npm, CI, plugin npm, ClawHub, mac/appcast evidence

dSYM, dependency evidence, immutable full-validation manifest, postpublish evidence, and stable-main closeout manifest.

• Confirm assets expected for stable mac releases are uploaded: zip, dmg,

verify the checksum before trusting the release record.

• Download each immutable evidence asset and its .sha256 companion, then

1. Root npm:

npmRegistrySignaturesVerified: true and npmProvenanceAttestationMatched: true.

• npm view openclaw@ version dist-tags.latest dist.tarball dist.integrity time. --json
• latest must equal for stable.
• Record tarball, integrity, publish time.
• Confirm the release postpublish evidence records

1. Plugin publish set:

download https://api.github.com/repos/openclaw/openclaw/tarball/v into /tmp/openclaw-v-src.

• Get exact tag metadata from GitHub, not the local checkout when dirty:

with the canonical publication planners/collector from the recorded release Tooling SHA, using the exact tag's package metadata. Do not count raw publish flags: openclaw.build.bundledDist === true explicitly defers external publication even when publish flags are set. Record deferred package names and reasons separately.

• Derive the full expected npm and ClawHub package sets for the release track

publication, previously published versions, and selected recovery runs using immutable publication plans, registry readback, and workflow jobs. A selected recovery subset must not narrow the full expected release set: gh api repos/openclaw/openclaw/actions/runs//jobs --paginate.

• Reconcile expected package identities, versions, and counts across original

from that immutable publication plan. A regular beta publishes to beta; do not require it to move latest. Verify any planned mirror tags separately.

• For each expected npm plugin, verify the planned version and npm selector

1. ClawHub (independent status, not a core or closeout gate):

If pending or failed, record that state and its follow-up separately; continue core verification and closeout without waiting.

• Check the Plugin ClawHub Release workflow conclusion and publish job count.

openclaw plugins search --json.

• Use OpenClaw itself for live registry proof:

ClawHub in an isolated HOME: openclaw plugins install clawhub:@openclaw/matrix@. Prefer matrix unless that plugin is not in the expected set. ClawHub versions belong in the spec; --pin is only supported for npm installs.

• Install one official plugin at the exact requested release version from

1. Release workflows:

Full Release Validation, OpenClaw Release Checks, OpenClaw NPM Release, Plugin NPM Release, mac preflight/validation/publish when stable mac assets are expected. Report Plugin ClawHub Release independently, even when its result is still pending or failed.

• Verify conclusions for release notes evidence links:

manifest records the matching release tag, current rollback drill, stable soak, and blocking performance evidence.

• For stable, verify OpenClaw Stable Main Closeout succeeded and its

optional lanes unless the release body promised them.

• Summarize only relevant successful/failed jobs; ignore routine skipped

1. Container registries:

trusted tooling checkout to run scripts/container-registry-readback.mjs with the exact version, both ghcr.io/openclaw/openclaw and docker.io/openclaw/openclaw, and the Vercel image. Pass --include-browser when the release Dockerfile includes that variant.

• Resolve VERCELVCRIMAGE from the repository variable and use the

three registries, matching cross-registry platform descriptors, and every policy-owned moving alias at the immutable digest and descriptor set. Beta intentionally has zero moving aliases; do not require a beta container alias.

• Require every default, slim, browser, amd64, and arm64 immutable tag in all

unavailable, report Vercel live readback as a gap rather than treating the workflow conclusion as equivalent proof.

• Use existing Docker credential state for private Vercel reads. If it is

Extended-stable checks

Extended-stable has a GitHub Release with shared release evidence but no native or ClawHub artifacts. Verify it alongside the live tag, workflow, registry, provenance, and image state.

contained in extended-stable/YYYY.M.33. Only an active candidate must equal the tip. Root and every publishable official plugin must declare . Require the Git tag and a public, non-prerelease GitHub Release whose title and canonical body match the tag. Require isLatest=false, the dependency evidence, immutable Full Release Validation manifest, postpublish evidence, and their checksums. Require no native or ClawHub assets.

1. Identity: require final v at patch 33+, with no suffix,