[paulcam206]

What Problem This Solves

An arbitrary upstream source dispatched from the default branch can write caches that later trusted builds restore. Suppressing explicit cache saves alone does not constrain subprocesses or nested actions.

User Impact

Only validated main/stable payload builds receive write-capable cache tokens. Source overrides and PR builds retain read-only cache access; signing/publication jobs receive none. Existing hotfix payload overrides, rollback selectors, both architectures, and package identities remain supported.

Reviewed boundary landed; release activation remains gated: all22 approved legacy main-scoped entries were invalidated, main was freshly verified empty before admission, and this reviewed head landed on main16b7f9eb2779a1c2a554bc21af1a880b9a9eec65. The hardened packaging workflow is active again. Unsigned cold-main run38979137940 is in progress; cold/warm/override proof is not yet complete. No official signing or publication has started.

Why This Change Was Made

One source-preflight owner captures and binds the immutable selection to workflow/run/ref/event context. Mutually exclusive callers give one reusable build owner a service-enforced write or read cap. The selected-build validator requires exactly the expected successful route and matching payload/release-identity outputs; eligible versioning upgrades cannot silently skip.

The conflict repair preserves current main's hotfix/rollback contract, centralized path classification, optional Store/bundle composition, payload artifacts, and all newer runtime changes. Package/payload cache format 2 excludes pre-boundary explicit caches; implicit NuGet/upstream/CodeQL caches still require the coordinated reset.

Versioning CI now records synthetic trusted write/independent restore and a save attempt with ACTIONS_CACHE_MODE=write under a read-scoped token. The actual reusable build job also sends a direct cache-service request and requires a policy denial, not a timeout or unrelated failure. These are PR-ref service-capability tests, not a claim that main cold/warm cutover has already run.

Evidence

Head: c16ded692ebe4a1b845c03ef130bb3942fb25b76; integrated base: 9eb1eac47ffeea36f514d61784e0ff649d34f7bf. All three original contributor commits remain ancestors. Residual diff: 20 files, +1232/-736; most workflow growth moves the existing build into one shared owner. The cache-key owner/regression and one-line patch revision from #180 join the original scope. #139 is integrated with original ancestry, so signed-tag admission and cache authority are qualified together.

Local PowerShell 7 checks passed, using process-local TEMP on macOS:

• Test-OpenClawSource.Tests.ps1: 68 passed, including trusted/read-only routing, main-dispatched SHA overrides, tags, workflow context drift, immutable replay, hotfixes, rollback, and fail-closed missing snapshots.
• Test-WorkflowSigningConfiguration.ps1: selected-build contracts passed.
• Test-WorkflowJobResults.Tests.ps1: eligible skipped/failed/cancelled upgrades rejected; intentional skips retained.
• Test-PackagingRelevance.Tests.ps1, Test-OpenClawCacheKey.Tests.ps1, Test-OpenClawPackage.Tests.ps1, Test-MSIXReleaseIdentity.Tests.ps1, Test-WorkflowPackageVersion.Tests.ps1, Test-MSIXUpgradeMatrix.Tests.ps1: passed.
• Test-SigningInputs.Tests.ps1: synthetic package/bundle and captured-source authorization passed.
• Test-DocReferences.ps1: zero findings. git diff --check: passed.
• Cache invalidation regression failed before the default format bump because legacy and current keys were identical, then passed with format 2.

After integrating #139 and #180, the 68 source cases, signing-input suite, and cache-key suite passed again. Identity/workflow-version suites also passed after the revision integration. Other local results are reused only where their inputs are unchanged. Current-head CI is 38972723480. The previous run passed both architectures and 12 upgrade cases but correctly rejected candidate2026.10.400.0 equal to the installed Store baseline. The requested revision1 now derives2026.10.401.0. No guard, immutable baseline, upstream/runtime pin, or signing policy was relaxed. Naturally triggered current-head CI is authoritative for workflow parsing, service capability, Windows host/NativeAOT, x64/ARM64 package/bundle construction, all 13 upgrade scenarios, and CodeQL. Earlier-head green checks are not being used for merge admission.

Scoped service and snapshot evidence (prior head; cache/snapshot contracts unchanged)

CI run 38962691564 ran prior head 9c657cf. Both synthetic cache jobs passed. The independent read job restored the exact bytes written by the write-capable job; after ACTIONS_CACHE_MODE=write was forged, the service reported: cache write denied: token has no writable scopes. The direct CreateCacheEntry request in the actual reusable build job also passed its required service-policy-denial assertion. No cache-scanning rule or token policy was relaxed.

Downloaded that run's real immutable source artifact and replayed it with the current Get-WorkflowSource.ps1 while Invoke-RestMethod was replaced with a throwing network guard. That replay used the prior-head resolver; final-head CI must confirm the integrated signed-tag/captured-context contract. The captured packaging commit is 3de3ec103b37a5c4af5a16ad98000db316556b59 (the CI merge snapshot). Results:

Check	Observed result
Replay current snapshot	Same payload commit 383c124cc32ffee3f8e56f549b88da94d269a4af, recomputed route read-only, original bytes unchanged
Change captured PR context to main dispatch	Rejected: unexpected workflowRef; start a new workflow run
Replay actual legacy-format artifact from run 38960960544	Rejected for missing workflowRef, bytes unchanged; no re-resolution
Network calls across all cases	0

Current source-snapshot SHA-256: bdf1b9333d566c1715b395a7f5f629566aa93a000514fbbd9b9621370e962b05. Legacy snapshot SHA-256: 01612b5613b9dab2df750435e764ac3c79e417e78944722b2c68cc02bce65e4e.

The maintainer authorized the GitHub Actions-only cache cutover and the three scoped false-positive dispositions. Alerts 173, 174, and 175 were confirmed dismissed as false positives at21:47–21:48UTC on2026-10-16, after reconciling fresh8f head instances and actual service denial. That run38969891188 independently passed write persistence/read restoration/forged-client denial; job117206112599 logged the explicit no-writable-scopes policy error, and actual reusable job117206177150 passed direct reservation denial. The c16 follow-up changes only two bundle-upload conditions, not cache authority. Scanning remains enabled; current-head CodeQL and CI must still be green before landing. The approved activation window has now cleared22 main-scoped legacy cache entries and verified0 remain; the operational receipt below records the completed boundary.

Not run locally: Windows managed/NativeAOT or installed package tests, main cache reset/cold/warm builds, signing, deployment, or publication. Live service enforcement ran on GitHub, not this host. Current-head hosted architecture/upgrade gates passed. Hardened-main cold/warm/override activation is now qualified in the completed record below.

Review repair and controlled activation

Current-head follow-up restores both selective bundle-upload conditions from #146: a non-versioning PR may compose bundles for packaging proof without transferring two artifacts no later job consumes. This repairs the dropped integration conditions and preserves their measured performance intent. Packaging-relevance, selected-build, and job-result suites passed again. Versioning PRs and non-PR runs retain both uploads; no consuming upgrade/release lane is weakened.

The approved cache activation uses an explicit GitHub Actions window: let every legacy main writer settle, prevent new legacy runs during the window, enumerate and record main-scoped IDs, invalidate the approved legacy entries (including implicit/CodeQL caches), and verify no legacy entries remain. Land the reviewed boundary with no legacy cache available, then re-enable the hardened main workflow and require cold trusted, warm trusted, and arbitrary-source read-only service proof before any official release. Cold/warm main execution necessarily follows installation of the hardened workflow on main; it remains a release activation gate, not a claim made by PR-ref probes. Unexpected writers, changed inputs, denied invalidation, or missing service enforcement stop activation.

The final reviewer must assess this restored upload intent and the authorized/dispositioned security gate. All six user-listed prerequisite outcomes and final assembled-source qualification remain mandatory before official signing/publication.

Completed pre-merge cache window

At2026-10-16T22:13:32Z, main remained9eb1eac47ffeea36f514d61784e0ff649d34f7bf. The task-owned obsolete unsigned main run38969067147 was retired and confirmed terminal; no other active main workflow remained. Gateway workflow343344141 was paused and independently confirmed disabled_manually to prevent new legacy runs. A fresh main-only inventory captured22 entries, including NuGet, CodeQL, explicit package/payload, and signing-tool download caches; all22 approved IDs were deleted. A fresh API read confirmed0 entries, and main was read back unchanged. PR-ref caches, release assets, secrets, scanning rules, and user Windows state were not touched.

The activation owner verified this exact head actually merged, confirmed the resulting main tree equals the reviewed tree, and immediately re-enabled the hardened workflow. The pause is closed. At re-enablement, cold trusted, warm trusted, and explicit-source/read-only service proof were still pending. All three are now qualified below; no official release was dispatched. The only cache present before cold dispatch was a newly created CodeQL key bound to hardened main16b7f9e, not a retired legacy entry.

Final exact-head admission evidence

Head c16ded6: CI38972723480 completed SUCCESS on2026-10-16. Windows managed and NativeAOT gates, both architecture packages, both channel bundles, the selected-build validator, and all13 upgrade scenarios passed. Both retained Release/Debug TRX files report1312/1312 tests and0 failures. Current-head CodeQL is green. The complete37-context rollup is SUCCESS; GitHub reports CLEAN/MERGEABLE, with no unresolved review threads or Before-merge actions in the current-head ClawSweeper verdict.

Downloaded all13 transition receipts. Store product9NV70LV3D6XC installed baseline2026.10.400.0 and upgraded in place to2026.10.401.0: reserved family OpenClawFoundation.OpenClawGateway_rfcbke2p71se2, statusOk, localStateRetained=true. These are isolated hosted transition receipts, not the still-unrun MXC session/recovery/sign-in proof required by #171.

The current-head read-scoped service job actually restored its allowed cache, then received "cache write denied: token has no writable scopes" after the client mode was forged. The actual reusable package job independently required rejection of CreateCacheEntry by its inherited read-scoped token. The current immutable snapshot binds PR merge58c393ef6f1d678199659398e07014102cc65986/run38972723480/refs/pull/144/merge to upstream383c124cc32ffee3f8e56f549b88da94d269a4af/version2026.10.4.

Immediately before admission, main remained9eb1eac47ffeea36f514d61784e0ff649d34f7bf, the campaign-owned workflow pause remained effective, there were no active main runs, and a fresh main-cache inventory was empty. Landing uses a merge commit to preserve the integrated reviewed #139/#180 ancestry. Immediately after actual landing, the activation owner enabled hardened main. The post-merge activation runs are now qualified below. #171's installed-session proof, the remaining prerequisite outcomes, independent review of #183, and exact final assembled-source qualification still gate official signing/publication.

Completed hardened-main activation

The cold trusted build and warm trusted build both completed successfully at main 16b7f9eb2779a1c2a554bc21af1a880b9a9eec65. Actual package/x64/ARM64 cache miss/save and subsequent restore receipts identify the same cold-created entries: 9073888904, 9074067878, and 9074183685.

After #182/#183, the corrected unsigned main SHA override completed successfully at main 085043be6367b95ae7de787c32503a396a3dfc2f. It selected the read-only route, restored those same three entries, and actually executed the inherited-token cache-service denial despite a forged ACTIONS_CACHE_MODE=write. The exact denied key inventory is zero. Both architecture builds, both bundles, NativeAOT execution, and the selected-build validator passed; both retained host TRX records report 1,312/1,312 passed and zero failed.

The upstream/cache tuple is unchanged: 383c124cc32ffee3f8e56f549b88da94d269a4af, OpenClaw 2026.10.4, Node.js 24.21.0, package SHA-256 347d94798ce90d10c34b2c884a2742760bfa7eed9da5561ac9a3f1844229c6d3. The main override's immutable source snapshot replays read-only without byte changes, SHA-256 53ac1f9183034f2ea0c62d1d161139969b2f8f34f8c732cd78d30f01a8ae93fe. These unsigned manual runs intentionally skip the installed upgrade matrix, signing, and publication. They do not prove MXC recovery/sign-in or the final assembled release after #171/#153.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR restricts cache writes to validated main/stable builds and routes source overrides through read-only cache credentials.

Example: Dispatch an unsigned build from main with openclaw_ref=383c124cc32ffee3f8e56f549b88da94d269a4af.

• Before: Upstream build code could write main-scoped caches subsequently restored by trusted builds.
• After: The override uses the read-only route, whose inherited token cannot reserve a cache entry even after ACTIONS_CACHE_MODE is changed to write.

Review scores

Measure	Result	What it means
Overall readiness	🦞 diamond lobster (5/6)	The changed security boundary has production-service proof, the previous finding and operational blocker are resolved, and no new defect was identified; required CI remains authoritative for completion.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (logs): Hosted workflow execution exercises synthetic write persistence, independent exact-byte restoration, forged-client denial, and a direct reservation request from the actual reusable package job; supplied traces record policy rejection, and current-head job results confirm those assertions passed. The maintainer's completed reset receipt is independently corroborated by empty main caches and the paused workflow. Artifact-host restrictions prevented fresh log downloads without invalidating the supplied service evidence.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: An upstream source override can contaminate caches later consumed by trusted packaging builds.
Reason: The maintainer approved the scoped authority repair, integrated release prerequisites, security dispositions, and staged activation.

Merge readiness

✅ Ready for maintainer review

The completed cache window clears the previous operational blocker, and no actionable defect remains in the reviewed head; required architecture and upgrade CI is still pending.

Priority: P1
Reviewed head: c16ded692ebe4a1b845c03ef130bb3942fb25b76

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: Current-head x64/ARM64 composition and installed-upgrade CI is unfinished; hardened-main cold/warm/override execution remains the accepted post-merge release gate.

Agent review details

How this fits together

The packaging workflow captures upstream source identity, selects cache authority, builds x64 and ARM64 packages through one reusable workflow, and passes validated artifacts to separate signing and publication jobs.

flowchart LR
  A[Workflow event and source selector] --> B[Immutable source preflight]
  B --> C[Trusted write caller]
  B --> D[Override read caller]
  C --> E[Shared package and MSIX build]
  D --> E
  E --> F[Selected build validation]
  F --> G[Upgrade and release gates]

Loading

Technical review

Best possible solution:

Land the reviewed cache boundary through required CI, then complete the accepted hardened-main activation checks before any official release.

Do we have a high-confidence way to reproduce the issue?

Main checks out and executes arbitrary selected upstream code in a cache-writing job; suppressing explicit saves cannot constrain that code's direct or nested cache-service access.

Is this the best way to solve the issue?

The repair places authority in caller-scoped service credentials, preserves one reusable build owner, and validates the selected route and captured source before downstream consumers.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 9eb1eac47ffe.

Provenance checked

• Package and Windows dependency caches changes intended behavior with a stated reason (8d5e0b5: Verified package reuse and architecture-qualified dependency caching reduced repeated build work; perf: cache validated Windows dependency trees #63 extended the same approach to Windows installs.)
• Source selection, snapshots, hotfixes, and rollback keeps the original intent (9f18180: Resolve stable once and preserve immutable retry identity; subsequent release-owner changes added explicit payload overrides and separate release identity.)
• Unsigned stable-tag allowance changes intended behavior with a stated reason (11f19be: A temporary allowance unblocked unsigned upstream releases; fix: restore verified upstream release tag requirement #139 explicitly restores verification now that the selected release is signed.)
• Selective bundle uploads keeps the original intent (aadd160: Avoid transferring bundles without a downstream consumer while retaining versioning and non-PR artifacts.)
• MSIX revision changes intended behavior with a stated reason (4215593: Revision zero identifies the first packaging release; the integrated maintainer revision increment produces a candidate newer than the installed Store baseline.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Completed operational blocker: RomneyDa's receipt at fix: prevent source overrides from poisoning release caches #144 (comment) records settled legacy writers and deletion of 22 approved main-scoped caches; an independent GET returned total_count=0. (c16ded692ebe)
• Activation isolation verified: The workflow reports disabled_manually, active and queued main-run queries returned no entries, and main remains 9eb1eac; the maintainer explicitly retains post-merge cold/warm/override verification as a release gate. (docs/release-process.md:205, c16ded692ebe)
• Prior finding resolved: The only delta from the earlier 8f head restores the versioning/non-PR condition on both bundle uploads, preserving the intent of improve: skip unused PR bundle uploads #146. (.github/workflows/gateway-msix-build.yml:479, c16ded692ebe)
• Authority enforced at cache service: The supplied service traces record exact-byte write/restore and denial after forging client mode; current-head run https://github.com/openclaw/openclaw-windows-packaging/actions/runs/38972723480 independently reports successful synthetic capability jobs and the reusable package job containing the mandatory direct reservation-denial assertion. (.github/workflows/gateway-msix-build.yml:114, c16ded692ebe)
• Current validation remains in progress: Current-head CodeQL, Windows host, source preflight, and cache-capability checks passed; x64 and ARM64 composition remained in progress, so bundle and installed-upgrade completion is not yet established. (.github/workflows/gateway-msix.yml:610, c16ded692ebe)
• Accepted source and release direction: Maintainer-authored fix: restore verified upstream release tag requirement #139 explicitly ends unsigned stable-tag admission; chore: prepare the 2026.10.4 Gateway MSIX patch #180 authorizes revision 1 so the candidate upgrades the installed Store baseline, without authorizing publication. (scripts/OpenClawSource.ps1:216, c16ded692ebe)

Likely related people:

• Paul Campbell: Raw commit c4e0aa3 adds scripts/Get-OpenClawCacheKey.ps1:16 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: c4e0aa331cc2; files: scripts/Get-OpenClawCacheKey.ps1)
• Dallin Romney: Raw commit e707def adds scripts/Get-WorkflowSource.ps1:22 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: e707def0bc06; files: scripts/Get-WorkflowSource.ps1)
• Linus Huang: Raw commit 9f18180 adds scripts/OpenClawSource.ps1:208 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 9f18180d27ba; files: scripts/OpenClawSource.ps1)

Labels

Label changes:

• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

• P1: The repair closes a release-cache poisoning path reachable through main-dispatched upstream overrides.
• merge-risk: 🚨 compatibility: Stable-tag admission becomes strict and legacy workflow snapshots require a new run; the maintainer explicitly accepted these changes and the coordinated cache reset.
• merge-risk: 🚨 security-boundary: The PR changes cache authority inherited by upstream subprocesses and reusable jobs; recorded final-service denial and the completed reset support the accepted boundary.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• proof: sufficient: Contributor real behavior proof is sufficient.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (9 earlier review cycles; latest 8 shown)

• reviewed 2026-10-01T21:12:21.997Z sha 64e11c1 :: needs real behavior proof before merge. :: none
• reviewed 2026-10-01T21:59:55.168Z sha e2d470e :: needs real behavior proof before merge. :: [P2] [P2] Check out the repository before invoking the aggregate validator
• reviewed 2026-10-01T22:33:00.347Z sha e2d470e :: needs real behavior proof before merge. :: [P2] [P2] Check out the repository before invoking the aggregate validator
• reviewed 2026-10-01T23:23:30.787Z sha 371b3d6 :: needs real behavior proof before merge. :: none
• reviewed 2026-10-01T23:31:58.449Z sha 8d924f0 :: needs real behavior proof before merge. :: none
• reviewed 2026-10-02T00:25:38.875Z sha b7abfdf :: needs real behavior proof before merge. :: none
• reviewed 2026-10-16T21:38:44.724Z sha 8f2f97f :: blocked before merge. :: [P3] Restore the versioning condition on both bundle uploads
• reviewed 2026-10-16T22:06:50.181Z sha c16ded6 :: needs changes before merge. :: none

Reviewed October 16, 2026, 6:21 PM ET / 22:21 UTC (Revision 10).

[RomneyDa]

@clawsweeper re-review

Current head c16ded6 restores BOTH versioning/non-PR bundle-upload conditions identified in your last review. The packaging relevance, selected-build, and job-result suites pass again. Current CI: https://github.com/openclaw/openclaw-windows-packaging/actions/runs/38972723480 . The only code delta from reviewed8f is those two conditions.

The maintainer has now explicitly authorized the GitHub Actions cache reset and scoped alert disposition. Fresh8f CodeQL instances173–175 were reconciled with current service proof and confirmed dismissed as false positives at21:47–21:48UTC; scanning remains enabled. Exact service evidence: run38969891188 read job117206112599 logged service denial after forged client mode; actual reusable job117206177150 passed its direct denial assertion. No cache policy or source trust check changed in c16.

The updated body records the controlled activation order. We will let legacy main writers settle, prevent racing legacy runs, persist/enumerate/purge authorized main cache IDs and verify their absence, then install this reviewed boundary. Main cold/warm and arbitrary-source execution are mandatory before release activation, and can only run after the hardened workflow is on main; the merge window exposes no legacy cache. No official release has started. Please reassess the concrete upload repair, authorized security decision, and explicit staged activation rather than treating the older pending-approval note as current.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/38973897048
• Updated: 2026-10-16T22:08:27.826Z

[RomneyDa]

@clawsweeper re-review

The sole before-merge action in the current c16 review is now complete. Authorized cache-window receipt follows. Existing PR CI continues while new packaging triggers are paused; no source/permission/scanning rule has changed. The task-owned obsolete unsigned main run38969067147 settled before deletion, all other active-main run queries were empty, all22 freshly enumerated approved main-scoped cache IDs were deleted, a fresh read confirmed0, and main was independently read back unchanged.

The body records the completed pre-merge window and exact resume owner/condition. After exact-head review/CI admit the merge, this task will re-enable only the hardened main workflow and require cold/warm/explicit-source read-only service proof before official release. The earlier three CodeQL false-positive dispositions are already authorized and confirmed; scans remain enabled. Please reassess the completed operational action on unchanged head c16ded6.
{
"mainBefore": "9eb1eac47ffeea36f514d61784e0ff649d34f7bf",
"workflowId": 343344141,
"workflowState": "disabled_manually",
"legacyWriters": "none active after task-owned obsolete run settled",
"approvedScope": "refs/heads/main",
"deletedIds": [
8002764729,
9071564656,
9070459155,
9070412832,
9071319473,
9071123683,
9015580568,
9015644433,
7615622013,
7615622320,
7615622585,
7615622894,
9016720907,
9016493734,
9016241122,
8893628707,
8893585561,
8675712725,
8675569352,
8675249346,
8674573179,
8674636151
],
"deletedCount": 22,
"remainingMainCaches": 0,
"verifiedAt": "2026-10-16T15:13:32.238402-07:00"
}

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/38975426375
• Updated: 2026-10-16T22:23:24.016Z