[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M698QY9YDNK0QNP45YD5W6ZB":3,"skill-same:01M698QY9YDNK0QNP45YD5W6ZB":78},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":48,"ownerHtmlUrl":49,"ownerBlogUrl":48,"ownerDescription":50,"updatedAt":51,"install":52,"resources":65},"01M698QY9YDNK0QNP45YD5W6ZB","openclaw-live-updater",null,"Maintain the canonical live OpenClaw main checkout, macOS LaunchAgent-managed Gateway, local macOS app, exact-head main CI, and recurring full release validation. Use for fast-forward update heartbeats, post-update runtime verification, attributable CI repair and repo-native landing, or non-publishing Full Release Validation of current main. Do not use on Linux systemd Gateways.","openclaw\u002Fopenclaw","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","01M698P3FSAZ6B4R928ZF19KPT","01M698PDMDRVH56MV30D253NFP",394382,"MIT","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fopenclaw-live-updater\u002FSKILL.md",[],[18,19,20,9,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"openclaw live updater","updater","live","publishing","managed","for","checkout","app","runtime","local","repair","do","recurring","landing","repo","ci","gateways","gateway","linux","macos","2026-11-10 10:12:30",false,"---\nname: openclaw-live-updater\ndescription: \"Maintain the canonical live OpenClaw main checkout, macOS LaunchAgent-managed Gateway, local macOS app, exact-head main CI, and recurring full release validation. Use for fast-forward update heartbeats, post-update runtime verification, attributable CI repair and repo-native landing, or non-publishing Full Release Validation of current main. Do not use on Linux systemd Gateways.\"\n---\n\n# OpenClaw Live Updater\n\nKeep one operator-selected canonical live checkout as a read-only-to-the-agent deployment mirror: clean, standalone, full, on `main`, and fast-forwarded only. Make every repair in the controlling Codex project worktree.\n\n## Boundaries\n\n- Report only in the controlling Codex thread. Never send Slack, Discord, email, or other external messages.\n- Never release, tag, bump versions, publish npm, create a GitHub Release, rotate credentials, or weaken a gate.\n- Escalate only irreversible or materially risky security, privacy, auth, destructive migration\u002Fdata-loss, protocol-version, credential-rotation, dependency patch\u002Foverride, or product choices.\n- Diagnose ordinary update, runtime, app, CI, test, and release-validation failures; fix them through a focused PR; prove exact head; land with `scripts\u002Fpr`.\n- Never edit, stash, reset, clean, or create a branch in the live mirror.\n- Never use `launchctl submit` or create an ad-hoc KeepAlive job to run updates or Gateway lifecycle commands. A submitted job can relaunch `openclaw gateway restart` after every exit and cause a persistent restart storm, even without a plist ([#114967](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fissues\u002F114967)).\n\n## Fast Update And Maintenance\n\n1. Run the deterministic updater and retain its JSON:\n\n   ```bash\n   cd \"\u003Ccanonical-live-checkout>\"\n   node --import tsx .agents\u002Fskills\u002Fopenclaw-live-updater\u002Fscripts\u002Fupdate-main.mjs\n   ```\n\n   The helper owns the current working directory by default; it does not search parent directories or infer a clone from the user's home directory. From a controlling worktree, pass the canonical mirror explicitly with `--checkout \"\u003Ccanonical-live-checkout>\"`. Stop on any failed invariant. Do not repair the mirror destructively. The helper holds one checkout-scoped lock across update, build, Gateway proof, and Mac work. A concurrent heartbeat returns `reason: \"overlap\"`; it must not start another build. A dead owner lock may be recovered, but unreadable or unsafe lock state fails closed. Linux systemd managed Gateways are outside this helper. It refuses before Git mutation with `unsupported_gateway_control_platform` and leaves operators on the standard update CLI from [openclaw-update](..\u002Fopenclaw-update\u002FSKILL.md).\n\n2. The helper verifies one unrewritten expected origin, an owned non-symlinked standalone\u002Ffull clone, single worktree, clean `main`, fetches `origin\u002Fmain`, rechecks for concurrent changes, and merges `--ff-only`. It then uses the source runner's canonical local-build metadata contract and parser: both `dist\u002F.buildstamp` and `dist\u002F.runtime-postbuildstamp` heads, required runtime-postbuild outputs, `dist\u002Fentry.js`, Control UI index plus referenced local assets, and `dist\u002Fbuild-info.json` must all match exact `afterSha`.\n\n   - Every successful update sets `actions.gatewayBuild` and rebuilds exact new `main` before any restart.\n   - Missing, invalid, or stale build output also forces a build, even when Git did not move.\n   - A dependency-input change, absent `node_modules`, or missing\u002Finvalid build provenance requires `pnpm install --frozen-lockfile`. When a build is required, do not install before acquiring the maintenance suspension and stopping the managed Gateway.\n   - Before mutating any entrypoint currently executed by the Gateway, invoke an exact trusted source CLI to acquire `gateway.suspend.prepare`, binding both prepare and resume to this checkout's managed LaunchAgent loopback port and service auth even when normal CLI configuration points at a remote Gateway. The LaunchAgent may execute either this checkout's `dist\u002Findex.js` or a clean detached canonical snapshot under `~\u002F.openclaw\u002Fruntime\u002Fgateway-\u003Csha>` whose commit is an ancestor of the checkout; reject every other entrypoint. Never execute snapshot code: capture an exact source control build before the Git fast-forward for its prepare and failure-resume calls, preserve any validated generated service-environment wrapper, and stop the managed LaunchAgent with native launchd bootout. If that control build is missing, first accept native proof that the snapshot job is already booted out with its port free; when the isolated snapshot is still running, build the verified clean source checkout to obtain an exact suspension client, then use only that source client for prepare and failure-resume. Never use this recovery build while launchd targets the source checkout. This atomically pauses cron scheduling, closes new work admission, and refuses while active work remains. A busy result uses the existing maintenance-drain owner with this installation's exact trusted built control client and native service binding: close admission, allow a bounded drain, refuse pending write custody, and commit recovery-preserving shutdown through the serving Gateway before native bootout. Revalidate the maintenance lock, checkout head, service definition\u002Fenvironment, and resident PID through the drain; preserve the serving process target in the committed handoff. If the serving build only supports the legacy idle-only suspension schema, defer busy work to the next heartbeat. Never replace this fence with `cron list` polling or session cancellation. Once ready, stop directly without a source launcher, install frozen dependencies when required, then build unless the exact recovery build already produced the deployment artifact; source launchers can auto-build stale output before dispatching the stop. Every external phase has a wall-clock budget: Git fetch 5 minutes, Git merge 2 minutes, dependency install 15 minutes, Gateway build 20 minutes, service control 60 seconds, probes 30 seconds, and Mac rebuild 30 minutes. Progress output never extends a budget. A timeout must drain the task-owned process tree before rollback, previous-service bootstrap, lock release, or the final `command_timeout` JSON result. If POSIX cleanup cannot prove the process group gone, skip service recovery, retain the maintenance lock against that process group, and emit `command_cleanup_failed`; after an operator terminates the group, the next heartbeat reclaims the stale lock. Resume the suspension if stop fails. If suspension RPC is unavailable on macOS, proceed only when native inspection proves this checkout's managed LaunchAgent is booted out and its configured port has no listener; never accept a loaded KeepAlive job's transient stopped state. On non-macOS hosts refuse before Git mutation with `unsupported_gateway_control_platform` and leave operators on the standard update CLI. Never treat a Linux systemd Gateway as this helper's stop-proof path. This preserves retry after a post-stop failure without weakening the live-work fence. Preserve `dist\u002FOpenClaw.app` outside `dist` for the build and restore it even when the build fails, because the JS build cleans `dist` regardless of Mac impact classification. Never mutate the live `dist` tree while an old Gateway can dynamically import from it. `pnpm build` must leave both canonical stamp heads and `dist\u002Fbuild-info.json.commit` equal to post-update `afterSha`; any missing\u002Fmismatched stamp or required artifact blocks restart.\n   - Snapshot ownership validation must never invoke Git inside the snapshot. Treat its worktree, local Git configuration, filters, hooks, attributes, and build artifacts as untrusted; prove only that the regular owned LaunchAgent entrypoint is under the canonical detached ancestor snapshot path. Snapshot validation authorizes native bootout and retargeting only. Every CLI path must reject snapshot execution and use the trusted source checkout build instead.\n   - Only after exact-SHA build proof may it restart the managed Gateway and require `gateway status --deep --require-rpc --json` plus `health --verbose --json`. A validated ancestor snapshot is suspension-only: prove the old launchd job is booted out with its port free, allowing bounded retries while launchd and the listener finish teardown, then atomically retarget only the owned LaunchAgent entrypoint to this checkout's exact `dist\u002Findex.js`, including on a retry where the build is already current. Replace the verified `ProgramArguments` array as one value; never use array-index plist mutation that can insert a duplicate argument. Preserve all other service arguments and environment unchanged. After restart, prove the loaded launchd PID owns the configured listener.\n   - After every managed restart, query Gateway logs through RPC, restrict the audit to entries emitted since that restart began, report warning summaries, and fail the pass on any error\u002Ffatal entry. If RPC verification or log retrieval fails, still inspect the local structured log for that restart window. Never accept supervisor or RPC health without this restart-window log audit.\n\n   Treat supervisor state alone as insufficient. If build or proof fails, leave the new mirror head intact and retry the stale\u002Fmissing build on the next heartbeat; never run the old `dist` against new source.\n\n   Keep the deterministic helper as the only update\u002Frestart owner: acquire its maintenance suspension fence, complete the update and exact-SHA build, restart the managed LaunchAgent through that helper, and verify with status and health. Leave only the managed Gateway LaunchAgent responsible for its lifecycle. `gateway status` and `doctor` report foreign `ai.openclaw.*` jobs; report any such job instead of creating another update job or manually removing a job whose ownership is uncertain. `doctor --fix` can remove confirmed stray lifecycle jobs when separately authorized; it is not a substitute for the suspension fence.\n\n   Re-run the canonical freshness check immediately before every `pnpm openclaw` restart or probe so the source runner cannot hide stale output with an implicit auto-build. Every pass, including a no-update\u002Fcurrent-build pass, must run deep RPC status and verbose health. If that first probe fails while the build is already exact-current, perform one managed Gateway restart and repeat both probes once. Do not rebuild a current exact-SHA artifact merely to self-heal the managed process; fail and diagnose if the one restart does not recover it.\n\n3. If changed paths can affect macOS, the helper runs `scripts\u002Frestart-mac.sh --sign --wait --target-only` with `OPENCLAW_MAC_REUSE_BUILD=1` and `SKIP_PNPM_INSTALL=1` only after the exact-SHA JS\u002FUI build completes. Packaging requires canonical source\u002Fruntime freshness and preserves the existing build timestamp and ID; it refuses stale or mismatched artifacts without rewriting dist or dependencies. Reusing those artifacts keeps the live app bundle out of any later JavaScript build cleanup. Target-only mode may stop the canonical `\u002FApplications\u002FOpenClaw.app` process and this checkout's exact `dist` process before launching the rebuilt `dist` app. It defers when another worktree, temporary bundle, test, or agent-owned OpenClaw process is active; it never kills that process. The script's immediate `OK` is not proof. The helper waits and requires the exact executable `\u003Ccanonical-live-checkout>\u002Fdist\u002FOpenClaw.app\u002FContents\u002FMacOS\u002FOpenClaw`, derived from the verified checkout, then repeats Gateway RPC and health proof.\n\n   Never kill another worktree, temporary bundle, test, or agent-owned OpenClaw process. If a foreign app prevents the exact target from staying alive, record the pending Mac attempt, report it, and retry on the next heartbeat. Escalate only after the conflict persists across repeated heartbeats; never claim Mac proof from another bundle or the short launch check. If `actions.macUiVerification` is true, exercise the changed behavior with the existing macOS\u002FUI automation workflow after delayed exact-bundle proof.\n\n4. Load `$openclaw-testing`. Resolve exact current `origin\u002Fmain`, then inspect only relevant required checks and workflow jobs whose `headSha` equals it. Ignore skipped jobs and routine noise such as Auto response, Labeler, docs agents, performance advisory jobs, and stale\u002Fcancelled runs superseded by a newer run for the same SHA.\n\n5. For an attributable failure, leave the mirror untouched. Use the controlling Codex worktree, trace the failed surface, add focused proof, run `$autoreview`, open a focused PR, and land through `$openclaw-pr-maintainer`'s exact `scripts\u002Fpr` sequence. Never weaken or bypass the failing gate. After landing, begin again at step 1 so the mirror, Gateway, app classification, and exact-head checks all converge on new `main`.\n\nIf no update, build repair, pending Mac retry, or exact-head failure exists, report a terse no-op with the SHA and proof checked.\n\n## Full Release Validation\n\nLoad `$release-openclaw-ci` and `$openclaw-testing`. This is validation only, never release preparation or publication.\n\n1. Treat 12 hours as wall-clock cadence, not per-SHA cadence. Inspect Full Release Validation runs from the last 12 hours and verify effective `release_profile=full`, `rerun_group=all`, and expected child-job shape. Any valid active or successful full\u002Fall umbrella in that window satisfies the cadence even if `main` advanced afterward. Never duplicate an active full\u002Fall run. The scheduled `Full Release Validation Nightly` (every 3 hours at :07 UTC, `stable` profile, `main-qualification`) is additional stable-profile evidence and never satisfies this full\u002Fall cadence; when both target the same SHA, the full sweep still runs and may adopt the nightly's per-child receipts.\n2. Only when the cadence is due, confirm no full\u002Fall run is active, then snapshot exact current `origin\u002Fmain` after checking mirror invariants and dispatch the trusted workflow once:\n\n   ```bash\n   MAIN_SHA=\"\u003Cexact-main-sha>\"\n   pnpm ci:full-release \\\n     -f validation_purpose=main-qualification \\\n     --sha \"$MAIN_SHA\" \\\n     --workflow-sha \"$MAIN_SHA\" \\\n     --trusted-workflow-ref main \\\n     -f provider=openai \\\n     -f mode=both \\\n     -f release_profile=full \\\n     -f rerun_group=all\n   ```\n\n3. Let the helper watch the parent to terminal and verify its release evidence. Retain its parent URL and require the recorded target SHA and children to match the dispatch snapshot. Fetch logs only for failed or blocking jobs. Do not cancel unrelated release checks.\n4. For a code or harness failure, repair and land from the Codex worktree as above. Then invoke the same helper with a new frozen exact-main tuple and the narrowest supported `rerun_group` that covers the failed child; use `live_suite_filter` for one live\u002FE2E shard. A targeted recovery run does not create a second full\u002Fall cadence dispatch.\n5. Report exact SHA, parent and child run URLs\u002FIDs, conclusions, repairs and landed PRs, targeted reruns, and any genuine proof gap. Do not write release evidence or publish artifacts unless separately authorized.\n\n## Failure Discipline\n\n- Recheck live mirror invariants before every mutation and after every fetch.\n- Attribute failures from exact SHA, job, logs, and current source. Provider or infrastructure flakes need independent proof before code edits.\n- Keep the task branch focused. No `CHANGELOG.md` change.\n- Finish with the mirror clean\u002Fon `main`, the Codex worktree clean on the expected branch, remote Testbox stopped, and every public GitHub write linked in the controlling thread.\n","# OpenClaw Live Updater\n\nKeep one operator-selected canonical live checkout as a read-only-to-the-agent deployment mirror: clean, standalone, full, on `main`, and fast-forwarded only. Make every repair in the controlling Codex project worktree.\n\n## Boundaries\n\n- Report only in the controlling Codex thread. Never send Slack, Discord, email, or other external messages.\n- Never release, tag, bump versions, publish npm, create a GitHub Release, rotate credentials, or weaken a gate.\n- Escalate only irreversible or materially risky security, privacy, auth, destructive migration\u002Fdata-loss, protocol-version, credential-rotation, dependency patch\u002Foverride, or product choices.\n- Diagnose ordinary update, runtime, app, CI, test, and release-validation failures; fix them through a focused PR; prove exact head; land with `scripts\u002Fpr`.\n- Never edit, stash, reset, clean, or create a branch in the live mirror.\n- Never use `launchctl submit` or create an ad-hoc KeepAlive job to run updates or Gateway lifecycle commands. A submitted job can relaunch `openclaw gateway restart` after every exit and cause a persistent restart storm, even without a plist ([#114967](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fissues\u002F114967)).\n\n## Fast Update And Maintenance\n\n1. Run the deterministic updater and retain its JSON:\n\n   ```bash\n   cd \"\u003Ccanonical-live-checkout>\"\n   node --import tsx .agents\u002Fskills\u002Fopenclaw-live-updater\u002Fscripts\u002Fupdate-main.mjs\n   ```\n\n   The helper owns the current working directory by default; it does not search parent directories or infer a clone from the user's home directory. From a controlling worktree, pass the canonical mirror explicitly with `--checkout \"\u003Ccanonical-live-checkout>\"`. Stop on any failed invariant. Do not repair the mirror destructively. The helper holds one checkout-scoped lock across update, build, Gateway proof, and Mac work. A concurrent heartbeat returns `reason: \"overlap\"`; it must not start another build. A dead owner lock may be recovered, but unreadable or unsafe lock state fails closed. Linux systemd managed Gateways are outside this helper. It refuses before Git mutation with `unsupported_gateway_control_platform` and leaves operators on the standard update CLI from [openclaw-update](..\u002Fopenclaw-update\u002FSKILL.md).\n\n2. The helper verifies one unrewritten expected origin, an owned non-symlinked standalone\u002Ffull clone, single worktree, clean `main`, fetches `origin\u002Fmain`, rechecks for concurrent changes, and merges `--ff-only`. It then uses the source runner's canonical local-build metadata contract and parser: both `dist\u002F.buildstamp` and `dist\u002F.runtime-postbuildstamp` heads, required runtime-postbuild outputs, `dist\u002Fentry.js`, Control UI index plus referenced local assets, and `dist\u002Fbuild-info.json` must all match exact `afterSha`.\n\n   - Every successful update sets `actions.gatewayBuild` and rebuilds exact new `main` before any restart.\n   - Missing, invalid, or stale build output also forces a build, even when Git did not move.\n   - A dependency-input change, absent `node_modules`, or missing\u002Finvalid build provenance requires `pnpm install --frozen-lockfile`. When a build is required, do not install before acquiring the maintenance suspension and stopping the managed Gateway.\n   - Before mutating any entrypoint currently executed by the Gateway, invoke an exact trusted source CLI to acquire `gateway.suspend.prepare`, binding both prepare and resume to this checkout's managed LaunchAgent loopback port and service auth even when normal CLI configuration points at a remote Gateway. The LaunchAgent may execute either this checkout's `dist\u002Findex.js` or a clean detached canonical snapshot under `~\u002F.openclaw\u002Fruntime\u002Fgateway-\u003Csha>` whose commit is an ancestor of the checkout; reject every other entrypoint. Never execute snapshot code: capture an exact source control build before the Git fast-forward for its prepare and failure-resume calls, preserve any validated generated service-environment wrapper, and stop the managed LaunchAgent with native launchd bootout. If that control build is missing, first accept native proof that the snapshot job is already booted out with its port free; when the isolated snapshot is still running, build the verified clean source checkout to obtain an exact suspension client, then use only that source client for prepare and failure-resume. Never use this recovery build while launchd targets the source checkout. This atomically pauses cron scheduling, closes new work admission, and refuses while active work remains. A busy result uses the existing maintenance-drain owner with this installation's exact trusted built control client and native service binding: close admission, allow a bounded drain, refuse pending write custody, and commit recovery-preserving shutdown through the serving Gateway before native bootout. Revalidate the maintenance lock, checkout head, service definition\u002Fenvironment, and resident PID through the drain; preserve the serving process target in the committed handoff. If the serving build only supports the legacy idle-only suspension schema, defer busy work to the next heartbeat. Never replace this fence with `cron list` polling or session cancellation. Once ready, stop directly without a source launcher, install frozen dependencies when required, then build unless the exact recovery build already produced the deployment artifact; source launchers can auto-build stale output before dispatching the stop. Every external phase has a wall-clock budget: Git fetch 5 minutes, Git merge 2 minutes, dependency install 15 minutes, Gateway build 20 minutes, service control 60 seconds, probes 30 seconds, and Mac rebuild 30 minutes. Progress output never extends a budget. A timeout must drain the task-owned process tree before rollback, previous-service bootstrap, lock release, or the final `command_timeout` JSON result. If POSIX cleanup cannot prove the process group gone, skip service recovery, retain the maintenance lock against that process group, and emit `command_cleanup_failed`; after an operator terminates the group, the next heartbeat reclaims the stale lock. Resume the suspension if stop fails. If suspension RPC is unavailable on macOS, proceed only when native inspection proves this checkout's managed LaunchAgent is booted out and its configured port has no listener; never accept a loaded KeepAlive job's transient stopped state. On non-macOS hosts refuse before Git mutation with `unsupported_gateway_control_platform` and leave operators on the standard update CLI. Never treat a Linux systemd Gateway as this helper's stop-proof path. This preserves retry after a post-stop failure without weakening the live-work fence. Preserve `dist\u002FOpenClaw.app` outside `dist` for the build and restore it even when the build fails, because the JS build cleans `dist` regardless of Mac impact classification. Never mutate the live `dist` tree while an old Gateway can dynamically import from it. `pnpm build` must leave both canonical stamp heads and `dist\u002Fbuild-info.json.commit` equal to post-update `afterSha`; any missing\u002Fmismatched stamp or required artifact blocks restart.\n   - Snapshot ownership validation must never invoke Git inside the snapshot. Treat its worktree, local Git configuration, filters, hooks, attributes, and build artifacts as untrusted; prove only that the regular owned LaunchAgent entrypoint is under the canonical detached ancestor snapshot path. Snapshot validation authorizes native bootout and retargeting only. Every CLI path must reject snapshot execution and use the trusted source checkout build instead.\n   - Only after exact-SHA build proof may it restart the managed Gateway and require `gateway status --deep --require-rpc --json` plus `health --verbose --json`. A validated ancestor snapshot is suspension-only: prove the old launchd job is booted out with its port free, allowing bounded retries while launchd and the listener finish teardown, then atomically retarget only the owned LaunchAgent entrypoint to this checkout's exact `dist\u002Findex.js`, including on a retry where the build is already current. Replace the verified `ProgramArguments` array as one value; never use array-index plist mutation that can insert a duplicate argument. Preserve all other service arguments and environment unchanged. After restart, prove the loaded launchd PID owns the configured listener.\n   - After every managed restart, query Gateway logs through RPC, restrict the audit to entries emitted since that restart began, report warning summaries, and fail the pass on any error\u002Ffatal entry. If RPC verification or log retrieval fails, still inspect the local structured log for that restart window. Never accept supervisor or RPC health without this restart-window log audit.\n\n   Treat supervisor state alone as insufficient. If build or proof fails, leave the new mirror head intact and retry the stale\u002Fmissing build on the next heartbeat; never run the old `dist` against new source.\n\n   Keep the deterministic helper as the only update\u002Frestart owner: acquire its maintenance suspension fence, complete the update and exact-SHA build, restart the managed LaunchAgent through that helper, and verify with status and health. Leave only the managed Gateway LaunchAgent responsible for its lifecycle. `gateway status` and `doctor` report foreign `ai.openclaw.*` jobs; report any such job instead of creating another update job or manually removing a job whose ownership is uncertain. `doctor --fix` can remove confirmed stray lifecycle jobs when separately authorized; it is not a substitute for the suspension fence.\n\n   Re-run the canonical freshness check immediately before every `pnpm openclaw` restart or probe so the source runner cannot hide stale output with an implicit auto-build. Every pass, including a no-update\u002Fcurrent-build pass, must run deep RPC status and verbose health. If that first probe fails while the build is already exact-current, perform one managed Gateway restart and repeat both probes once. Do not rebuild a current exact-SHA artifact merely to self-heal the managed process; fail and diagnose if the one restart does not recover it.\n\n3. If changed paths can affect macOS, the helper runs `scripts\u002Frestart-mac.sh --sign --wait --target-only` with `OPENCLAW_MAC_REUSE_BUILD=1` and `SKIP_PNPM_INSTALL=1` only after the exact-SHA JS\u002FUI build completes. Packaging requires canonical source\u002Fruntime freshness and preserves the existing build timestamp and ID; it refuses stale or mismatched artifacts without rewriting dist or dependencies. Reusing those artifacts keeps the live app bundle out of any later JavaScript build cleanup. Target-only mode may stop the canonical `\u002FApplications\u002FOpenClaw.app` process and this checkout's exact `dist` process before launching the rebuilt `dist` app. It defers when another worktree, temporary bundle, test, or agent-owned OpenClaw process is active; it never kills that process. The script's immediate `OK` is not proof. The helper waits and requires the exact executable `\u003Ccanonical-live-checkout>\u002Fdist\u002FOpenClaw.app\u002FContents\u002FMacOS\u002FOpenClaw`, derived from the verified checkout, then repeats Gateway RPC and health proof.\n\n   Never kill another worktree, temporary bundle, test, or agent-owned OpenClaw process. If a foreign app prevents the exact target from staying alive, record the pending Mac attempt, report it, and retry on the next heartbeat. Escalate only after the conflict persists across repeated heartbeats; never claim Mac proof from another bundle or the short launch check. If `actions.macUiVerification` is true, exercise the changed behavior with the existing macOS\u002FUI automation workflow after delayed exact-bundle proof.\n\n4. Load `$openclaw-testing`. Resolve exact current `origin\u002Fmain`, then inspect only relevant required checks and workflow jobs whose `headSha` equals it. Ignore skipped jobs and routine noise such as Auto response, Labeler, docs agents, performance advisory jobs, and stale\u002Fcancelled runs superseded by a newer run for the same SHA.\n\n5. For an attributable failure, leave the mirror untouched. Use the controlling Codex worktree, trace the failed surface, add focused proof, run `$autoreview`, open a focused PR, and land through `$openclaw-pr-maintainer`'s exact `scripts\u002Fpr` sequence. Never weaken or bypass the failing gate. After landing, begin again at step 1 so the mirror, Gateway, app classification, and exact-head checks all converge on new `main`.\n\nIf no update, build repair, pending Mac retry, or exact-head failure exists, report a terse no-op with the SHA and proof checked.\n\n## Full Release Validation\n\nLoad `$release-openclaw-ci` and `$openclaw-testing`. This is validation only, never release preparation or publication.\n\n1. Treat 12 hours as wall-clock cadence, not per-SHA cadence. Inspect Full Release Validation runs from the last 12 hours and verify effective `release_profile=full`, `rerun_group=all`, and expected child-job shape. Any valid active or successful full\u002Fall umbrella in that window satisfies the cadence even if `main` advanced afterward. Never duplicate an active full\u002Fall run. The scheduled `Full Release Validation Nightly` (every 3 hours at :07 UTC, `stable` profile, `main-qualification`) is additional stable-profile evidence and never satisfies this full\u002Fall cadence; when both target the same SHA, the full sweep still runs and may adopt the nightly's per-child receipts.\n2. Only when the cadence is due, confirm no full\u002Fall run is active, then snapshot exact current `origin\u002Fmain` after checking mirror invariants and dispatch the trusted workflow once:\n\n   ```bash\n   MAIN_SHA=\"\u003Cexact-main-sha>\"\n   pnpm ci:full-release \\\n     -f validation_purpose=main-qualification \\\n     --sha \"$MAIN_SHA\" \\\n     --workflow-sha \"$MAIN_SHA\" \\\n     --trusted-workflow-ref main \\\n     -f provider=openai \\\n     -f mode=both \\\n     -f release_profile=full \\\n     -f rerun_group=all\n   ```\n\n3. Let the helper watch the parent to terminal and verify its release evidence. Retain its parent URL and require the recorded target SHA and children to match the dispatch snapshot. Fetch logs only for failed or blocking jobs. Do not cancel unrelated release checks.\n4. For a code or harness failure, repair and land from the Codex worktree as above. Then invoke the same helper with a new frozen exact-main tuple and the narrowest supported `rerun_group` that covers the failed child; use `live_suite_filter` for one live\u002FE2E shard. A targeted recovery run does not create a second full\u002Fall cadence dispatch.\n5. Report exact SHA, parent and child run URLs\u002FIDs, conclusions, repairs and landed PRs, targeted reruns, and any genuine proof gap. Do not write release evidence or publish artifacts unless separately authorized.\n\n## Failure Discipline\n\n- Recheck live mirror invariants before every mutation and after every fetch.\n- Attribute failures from exact SHA, job, logs, and current source. Provider or infrastructure flakes need independent proof before code edits.\n- Keep the task branch focused. No `CHANGELOG.md` change.\n- Finish with the mirror clean\u002Fon `main`, the Codex worktree clean on the expected branch, remote Testbox stopped, and every public GitHub write linked in the controlling thread.\n",{"name":5,"description":7},"main","f1c93577085244aa96aa87b53a2df9b59d293bd7",".agents\u002Fskills\u002Fopenclaw-live-updater",82886,"https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw","https:\u002F\u002Fopenclaw.ai","https:\u002F\u002Fgithub.com\u002Fopenclaw","Your personal, open source AI assistant.","2026-11-14 03:02:00",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add openclaw\u002Fopenclaw --skill openclaw-live-updater",{"tool":58,"command":59},"bunx","bunx skills add openclaw\u002Fopenclaw --skill openclaw-live-updater",{"tool":61,"command":62},"pnpm","pnpm dlx skills add openclaw\u002Fopenclaw --skill openclaw-live-updater","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fopenclaw-live-updater\u002FSKILL.md",true,[66,72],{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"agents\u002Fopenai.yaml","REFERENCE","参考文档",345,"https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fopenclaw-live-updater\u002Fagents\u002Fopenai.yaml",{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"scripts\u002Fupdate-main.mjs","SCRIPT","脚本",131173,"https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fopenclaw-live-updater\u002Fscripts\u002Fupdate-main.mjs",[79,85,107,125,147,171],{"skillNo":80,"name":81,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":38},"01M698VP84FNM6G9MR1HPX7MF7","lobster","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fextensions\u002Flobster\u002FSKILL.md",[],[81],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":38},"01M698YY8QGQ7S8TJNKJG6VTPH","xurl","xurl CLI for authenticated X posts, replies, reads\u002Fsearch, DMs, media upload, followers, auth status, or raw v2 API calls.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Fxurl\u002FSKILL.md",[],[87,23,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106],"api","calls","replies","posts","upload","tap","install","brew","node","Media","search","npm","status","auth","cli",{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":38},"01M698YWT1CJ0WK88WB909R9RT","weather","Current weather and forecasts with web_fetch, falling back to wttr.in curl for locations, rain, temperature, travel planning.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Fweather\u002FSKILL.md",[],[109,114,115,98,116,99,117,118,119,120,121,122,23,123,124],"travel planning","travel","fetch","curl","https","help","planning","web","back","temperature","with",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":136,"publishedAt":38},"01M698YV2Q0R0JJKAWGFS21K0N","visualize","Create inline visuals for code and explanations, or author persistent OpenClaw dashboard widgets with show_widget.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Fvisualize\u002FSKILL.md",[131],{"categoryNo":132,"categoryName":133,"taxonomyType":134,"taxonomyTypeDesc":135},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[127,137,138,139,140,23,124,141,142,143,144,145,9,146],"widgets","openclaw dashboard","author","inline","show","code","create","visuals","dashboard","widget",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":161,"publishedAt":38},"01M698YS2TRJH9ENG28HD9CD87","trello","Manage Trello boards, lists, and cards via the Trello REST API.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Ftrello\u002FSKILL.md",[153,158],{"categoryNo":154,"categoryName":155,"taxonomyType":156,"taxonomyTypeDesc":157},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":159,"categoryName":160,"taxonomyType":134,"taxonomyTypeDesc":135},"01JBSEEDCAT000000000000030","开发工程师",[149,118,162,163,164,165,166,167,98,99,168,117,92,169,170],"cloud","manage","via","rest api","token","atlassian","jq","REST","developer",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":177,"publishedAt":38},"01M698YQ9Q3M4W78EWV2KSCSVW","tmux","Control tmux sessions\u002Fpanes for interactive CLIs: list, capture output, send keys, paste text, monitor prompts.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Ftmux\u002FSKILL.md",[],[173,98,178,179,23,180,181,182,183,184,185,186,99,187,188,189,190,191,36],"send","darwin","keys","paste","output","control","prompts","interactive","list","capture","panes","text","monitor","sessions"]