feat: track stable OpenClaw releases for MSIX builds

[xlinush]

What Problem This Solves

CI should choose the current OpenClaw stable release without a hardcoded source commit in the workflow.

Fixes #25.

User Impact

An empty openclaw_ref selects npm openclaw@latest. The selected version and source commit are verified before building and kept fixed for retries.

Extended stable and named prereleases are rejected. There is no automatic fallback. A reviewed stableVersion pin can select an older known-good stable release, and unsigned/test runs can use an explicit stable-source ref.

Official source selection must match the reviewed commit, version and tag in release-policy.json.

Why This Change Was Made

• Resolve stable to an exact published version and verified signed upstream tag/commit.
• Save the source choice once per run and validate it before reuse.
• Check the built package version against the selected source.
• Pass the selected Gateway tag to package, bundle and upgrade verification.
• Add focused source-selection tests and update the related documentation.

Evidence

Head: cc7519668d11e132a490a1e23eef08e4b52320d2.

Passed locally: 42 source-selection tests, package verification tests, workflow configuration checks, YAML validation and whitespace checks.

CI run 35281100228 is queued for this head.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 17, 2026, 6:35 PM ET / 22:35 UTC (Revision 14).

ClawSweeper review

What this changes

Windows package builds select and verify the stable OpenClaw release, preserve that selection across retries, and check package versions while retaining separate official-signing approval.

Merge readiness

✅ Ready for maintainer review

This remains useful: current main still pins the upstream source. The versioning coordination request is addressed, the PR is now ready for review, and no blocking defect was found in the reduced scope.

Priority: P2
Reviewed head: cc7519668d11e132a490a1e23eef08e4b52320d2

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, well-covered implementation with retained positive proof and no blocking correctness finding.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (linked_artifact): Previously accepted real-build proof is retained. The reviewed head additionally completed production source resolution, snapshot publication, package-cache verification, both architecture builds, and bundle composition; raw-log access was unavailable and the current upgrade run remained pending.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): Previously accepted real-build proof is retained. The reviewed head additionally completed production source resolution, snapshot publication, package-cache verification, both architecture builds, and bundle composition; raw-log access was unavailable and the current upgrade run remained pending.
Evidence reviewed	8 items	Current main still needs source selection: The fetched main workflow retains the hardcoded upstream commit in both its manual default and automatic fallback. The latest supplied release also uses the pinned release policy; no merged replacement for stable selection was established. Verified introduced workflow changes: The merge-base-to-head diff adds one source-resolution artifact, passes its commit and version into package verification, and calls the existing release-identity helper for packages, bundles, and upgrade validation. Signing authority remains separately enforced: The new resolver requires the approved commit, version, and tag for official mode. The existing signing validator independently checks both architecture artifacts against that approval before the protected signing job obtains Azure credentials.
Findings	None	None.
Security	None	None.

How this fits together

The packaging workflow turns upstream OpenClaw source into Windows MSIX packages for x64 and ARM64. Source selection feeds both builds, while the existing release policy separately controls official signing.

flowchart TD
  A[Npm stable or explicit source] --> B[Verify source identity]
  C[Reviewed release policy] --> B
  B --> D[Immutable run snapshot]
  D --> E[Verified package and architecture builds]
  E --> F[Official signing approval]
  C --> F
  F --> G[Signed Windows release]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	Production scripts +348; workflow +61/-25; tests and validation +351/-23	The growth supports verified source resolution, immutable retry selection, and rejection coverage.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #25
Summary: This is the implementation candidate for the open stable-source request; the merged versioning work supplies its foundation.

Members:

• canonical: Use stable OpenClaw releases as the source channel for MSIX releases #25 - The paired issue defines stable-source selection and explicitly links this implementation.
• partial_overlap: feat(ci): derive deterministic MSIX release versions #36 - Merged release-identity work provides the shared version mapping but does not implement automatic stable selection.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

Keep one stable-source resolver feeding both architectures, reuse the established MSIX identity contract, and retain explicit approval for official releases.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this adds agreed source-selection behavior; current main's hardcoded selection is directly visible in the workflow.

Is this the best way to solve the issue?

Yes: the reduced implementation reuses existing packaging, identity, and signing checks while isolating stable selection and retry consistency.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against ad5df933da4f.

Labels

Label justifications:

• P2: Stable-source automation is a bounded packaging improvement with no demonstrated urgent user regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): Previously accepted real-build proof is retained. The reviewed head additionally completed production source resolution, snapshot publication, package-cache verification, both architecture builds, and bundle composition; raw-log access was unavailable and the current upgrade run remained pending.
• proof: sufficient: Contributor real behavior proof is sufficient. Previously accepted real-build proof is retained. The reviewed head additionally completed production source resolution, snapshot publication, package-cache verification, both architecture builds, and bundle composition; raw-log access was unavailable and the current upgrade run remained pending.

Evidence

What I checked:

• Current main still needs source selection: The fetched main workflow retains the hardcoded upstream commit in both its manual default and automatic fallback. The latest supplied release also uses the pinned release policy; no merged replacement for stable selection was established. (.github/workflows/gateway-msix.yml:10, ad5df933da4f)
• Verified introduced workflow changes: The merge-base-to-head diff adds one source-resolution artifact, passes its commit and version into package verification, and calls the existing release-identity helper for packages, bundles, and upgrade validation. (.github/workflows/gateway-msix.yml:232, cc7519668d11)
• Signing authority remains separately enforced: The new resolver requires the approved commit, version, and tag for official mode. The existing signing validator independently checks both architecture artifacts against that approval before the protected signing job obtains Azure credentials. (scripts/Get-WorkflowSource.ps1:36, cc7519668d11)
• Affirmative upstream dependency contract: The packaging workflow checks out and builds openclaw/openclaw and uses its package version and release tags. Upstream release documentation identifies latest as regular stable, patches below 33 as regular releases, and patches 33 or above as extended stable, matching the resolver's channel boundary. (docs/reference/RELEASING.md:24, 3a9d69db306c)
• Maintainer direction and review continuity: The coordination comment requested reuse of the identity contract from merged feat(ci): derive deterministic MSIX release versions #36; the current diff does so. The previous completed review reported no findings and requested ready-for-review status, which the supplied timeline and live PR metadata now confirm. (cc7519668d11)
• Production workflow evidence: Run https://github.com/openclaw/openclaw-windows-packaging/actions/runs/35281100228 identifies the reviewed head. Its production source-resolution, snapshot upload, cached-package verification, and intermediate upload steps succeeded; upstream compilation was skipped on the cache hit. Both architecture builds and bundle composition succeeded. Installed-package upgrade validation was still running when inspected. (.github/workflows/gateway-msix.yml:240, cc7519668d11)

Likely related people:

• Dallin Romney: Raw commit 685ee93 adds scripts/Get-MSIXReleaseIdentity.ps1:29 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 685ee93b7ebb; files: scripts/Get-MSIXReleaseIdentity.ps1)
• Paul Campbell: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (13 earlier review cycles; latest 8 shown)

• reviewed 2026-09-15T22:51:38.334Z sha d11d1e0 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-15T23:11:16.030Z sha d11d1e0 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-15T23:21:18.119Z sha 51c9ede :: needs real behavior proof before merge. :: none
• reviewed 2026-09-15T23:48:12.735Z sha 51c9ede :: needs real behavior proof before merge. :: none
• reviewed 2026-09-16T08:15:37.972Z sha 51c9ede :: needs real behavior proof before merge. :: none
• reviewed 2026-09-17T18:41:05.750Z sha c2fa7fa :: blocked before merge. :: none
• reviewed 2026-09-17T19:39:37.266Z sha c2fa7fa :: needs changes before merge. :: none
• reviewed 2026-09-17T22:21:08.017Z sha cc75196 :: needs changes before merge. :: none

[xlinush]

@clawsweeper re-review

The updated requirement is stable only. The extended-stable proposal is superseded: there is no cross-channel or automatic fallback, and a compatibility pin can select only a reviewed older known-good stable release.

CI run 35032630892 successfully built OpenClaw 2026.9.4 for x64 and ARM64 and produced the bundle. The selected commit, 3a9d69db306cd7f081e06254cb89c4bcc14a7107, includes the external-management check missing from the earlier 2026.6.35 choice. Please reassess the service-removal finding against this stable source.

The latest commit only removes obsolete setup inputs reported as ignored by that run; native cache-mode: none remains enforced. The separate official-signing and authorization-withdrawal proof questions are not being dismissed by this change.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[RomneyDa]

Versioning contract coordination: PR #36 is the foundational release-identity change and now owns the agreed mapping (gateway release sequence * 1000 + MSIX rebuild revision). Please rebase #42 after #36 and call Get-MSIXReleaseIdentity.ps1 rather than retaining its independent correction/rebuild formula. #42 remains draft and should not merge with a competing release contract.