[RomneyDa]

Problem

MSIX store and official releases can override the Gateway version, but openclaw_ref currently acts only as a full-SHA assertion against stable. That prevents a hot release from packaging a patched OpenClaw branch or commit.

Outcome

• Allow openclaw_ref to select an OpenClaw branch, tag, or full commit SHA in every signing mode.
• Resolve the selected ref once and replay its exact commit from the immutable source snapshot.
• Keep reviewed stable policy as the MSIX and GitHub release-identity owner for release-mode overrides.
• Preserve the shipped Store/official gateway_version plus matching full-SHA assertion contract while rejecting branch/tag combinations and mismatched SHAs.
• Reject override payload versions newer than the stable identity.
• Extend source-selection and signing-authorization regression coverage and update release documentation.

Risk

Branch inputs can move before dispatch, but the workflow captures their resolved commit once and retries never re-resolve it. The release guide recommends a reviewed full SHA for hot releases. Artifact authorization still verifies the selected payload commit and package version before Azure credentials are requested.

Exact head: af35e39b4dad1062a40b449bf408d0791fa2be04

Validation

• pwsh -NoLogo -NoProfile -File ./scripts/Test-OpenClawSource.Tests.ps1
• TEMP=/tmp pwsh -NoLogo -NoProfile -File ./scripts/Test-SigningInputs.Tests.ps1
• pwsh -NoLogo -NoProfile -File ./scripts/Test-WorkflowSigningConfiguration.ps1
• pwsh -NoLogo -NoProfile -File ./scripts/Test-WorkflowPackageVersion.Tests.ps1
• pwsh -NoLogo -NoProfile -File ./scripts/Test-MSIXReleaseIdentity.Tests.ps1
• TEMP=/tmp pwsh -NoLogo -NoProfile -File ./scripts/Test-PackagingRelevance.Tests.ps1
• pwsh -NoLogo -NoProfile -File ./scripts/Test-DocReferences.ps1
• git diff --check

Not run locally

• Windows MSIX composition and bundle assembly
• NativeAOT execution
• Azure Artifact Signing or release publication

The pull-request workflow owns the Windows build and upgrade lanes. Signing and publication remain restricted to the authorized release workflow.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 2, 2026, 11:57 PM ET / October 3, 2026, 03:57 UTC (Revision 3).

ClawSweeper review

What this changes

Allow release operators to package an OpenClaw branch, tag, or commit while keeping stable policy responsible for MSIX and GitHub release versions.

Merge readiness

✅ Ready for maintainer review

The earlier compatibility blocker is fixed, and no remaining introduced defect was found. The capability is absent from current main and the latest release, so this member-authored PR remains useful.

Likely related people: RomneyDa, supported by prior merged source-selection and release work.

Priority: P2
Reviewed head: af35e39b4dad1062a40b449bf408d0791fa2be04

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused implementation with restored compatibility coverage and no remaining actionable finding; runtime validation was not independently executed.
Proof confidence	🌊 off-meta tidepool	Not applicable: The author is a MEMBER, so the external-contributor proof gate does not apply. Source and fixture coverage connect the changed resolver to snapshot replay and signing authorization; no material unresolved forbidden-principal path was found. Windows composition, NativeAOT, signing, and publication were not executed by this reviewer. The existing snapshot fields are reused without changing installed user-data contracts.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The author is a MEMBER, so the external-contributor proof gate does not apply. Source and fixture coverage connect the changed resolver to snapshot replay and signing authorization; no material unresolved forbidden-principal path was found. Windows composition, NativeAOT, signing, and publication were not executed by this reviewer. The existing snapshot fields are reused without changing installed user-data contracts.
Evidence reviewed	7 items	Pinned introduced change: Reviewed the seven-file introduced delta from the pinned main base to the exact PR head. The verified test merge has that main base and exact head as its recorded parents; no base-only drift is involved. Previous blocker resolved: The selector now retains Store/official GatewayVersion plus matching full-SHA assertions, rejects competing branch/tag selectors, and checks mismatches during replay. Source tests cover initial selection and zero-request replay; signing tests retain the successful assertion case and add mismatch rejection. This addresses the concrete prior finding and rank-up move. Source and signing authority: Ref overrides capture a separate stable release identity and reject newer payload versions. Replay checks selector, run ID, packaging commit, and signing mode. The existing main-only authorization job validates both architecture packages and bundles before the separate release-signing job requests Azure credentials. No new credentials, action sources, or permissions are introduced.
Findings	None	None.
Security	None	None.

How this fits together

The release source selector turns workflow inputs into a captured OpenClaw commit and package identity. Build and signing jobs consume that snapshot to produce and authorize Windows packages for both architectures.

flowchart LR
  A[Release operator inputs] --> B[Source selection]
  C[Reviewed stable policy] --> B
  B --> D[Immutable source snapshot]
  D --> E[Build Windows packages]
  D --> F[Authorize package contents]
  E --> F
  F --> G[Store artifacts or signed release]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test growth	Production +16 net lines; tests and validators +64 net lines	The production growth implements selector separation and compatibility checks, with additional regression coverage at source and signing boundaries.

Technical review

Best possible solution:

Keep one immutable source-selection owner, preserve version assertions, and derive release identity from reviewed stable policy while packaging the explicitly selected commit.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a new capability: current main demonstrably rejects release-mode branch/tag selection; the revised path was inspected but not executed.

Is this the best way to solve the issue?

Yes. Extending the existing snapshot resolver preserves one source owner and stable release identity, and the revision restores the shipped version-plus-SHA contract.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against beacce88d786.

Labels

Label changes:

• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The author is a MEMBER, so the external-contributor proof gate does not apply. Source and fixture coverage connect the changed resolver to snapshot replay and signing authorization; no material unresolved forbidden-principal path was found. Windows composition, NativeAOT, signing, and publication were not executed by this reviewer. The existing snapshot fields are reused without changing installed user-data contracts.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
• remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.
• remove merge-risk: 🚨 compatibility: Current PR review selected no merge-risk labels.

Label justifications:

• P2: This is a bounded release-operator improvement with no established urgent user regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The author is a MEMBER, so the external-contributor proof gate does not apply. Source and fixture coverage connect the changed resolver to snapshot replay and signing authorization; no material unresolved forbidden-principal path was found. Windows composition, NativeAOT, signing, and publication were not executed by this reviewer. The existing snapshot fields are reused without changing installed user-data contracts.

Evidence

What I checked:

• Pinned introduced change: Reviewed the seven-file introduced delta from the pinned main base to the exact PR head. The verified test merge has that main base and exact head as its recorded parents; no base-only drift is involved. (scripts/Get-WorkflowSource.ps1:28, af35e39b4dad)
• Previous blocker resolved: The selector now retains Store/official GatewayVersion plus matching full-SHA assertions, rejects competing branch/tag selectors, and checks mismatches during replay. Source tests cover initial selection and zero-request replay; signing tests retain the successful assertion case and add mismatch rejection. This addresses the concrete prior finding and rank-up move. (scripts/Get-WorkflowSource.ps1:28, af35e39b4dad)
• Source and signing authority: Ref overrides capture a separate stable release identity and reject newer payload versions. Replay checks selector, run ID, packaging commit, and signing mode. The existing main-only authorization job validates both architecture packages and bundles before the separate release-signing job requests Azure credentials. No new credentials, action sources, or permissions are introduced. (.github/workflows/gateway-msix.yml:949, af35e39b4dad)
• Captured-source lifecycle: The release guide explicitly preserves captured sources after channel movement or tag deletion and requires stopping a workflow when its captured release must no longer be published. The PR retains this existing lifecycle rather than introducing automatic revocation or re-resolution. (docs/release-process.md:111, af35e39b4dad)
• Current main and release still need this capability: Current main rejects branch/tag inputs in release modes and treats full SHAs as stable-payload assertions. GitHub's latest release is v2026.9.8-msix.0, targeting this same main SHA. Neither implements the new release-mode ref selector. (scripts/Get-WorkflowSource.ps1:28, beacce88d786)
• Related merged work and routing: GitHub verifies feat: allow one-run Gateway version overrides #147 as merged at e707def, authored by RomneyDa. Main history also records earlier stable-selection work by Dallin Romney. That merged work supplies version overrides and assertion compatibility, but does not supersede this PR's ref-selection capability. (scripts/Get-WorkflowSource.ps1, e707def0bc06)

Likely related people:

• RomneyDa: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-10-02T14:45:52.279Z sha 453a660 :: blocked before merge. :: [P1] Preserve the existing version-plus-SHA release assertion
• reviewed 2026-10-02T23:44:34.767Z sha 453a660 :: blocked before merge. :: [P1] Preserve the existing version-plus-SHA release assertion

[RomneyDa]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/37094952760
• Updated: 2026-10-03T03:58:30.151Z