[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M698S1KD3N9Q4CGFC0RY94TX":3,"skill-same:01M698S1KD3N9Q4CGFC0RY94TX":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":32,"linkOnly":33,"markdownContent":34,"markdownBody":35,"frontMatter":36,"refName":37,"commitSha":38,"skillDirectory":39,"forksCount":40,"repositoryHtmlUrl":41,"repositoryHomepageUrl":42,"ownerHtmlUrl":43,"ownerBlogUrl":42,"ownerDescription":44,"updatedAt":45,"install":46,"resources":59},"01M698S1KD3N9Q4CGFC0RY94TX","release-openclaw-ci",null,"Run, watch, debug, and summarize OpenClaw full release CI, release checks, live provider gates, install\u002Fupdate proofs, and release-secret preflights.","openclaw\u002Fopenclaw","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","01M698P3FSAZ6B4R928ZF19KPT","01M698PDMDRVH56MV30D253NFP",394352,"MIT","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Frelease-openclaw-ci\u002FSKILL.md",[],[18,9,19,20,21,22,23,24,25,26,27,28,29,30,31],"release openclaw ci","ci","release","debug","run","update","install","summarize","provider","gates","live","full","watch","release checks","2026-11-10 10:12:30",false,"---\nname: release-openclaw-ci\ndescription: \"Run, watch, debug, and summarize OpenClaw full release CI, release checks, live provider gates, install\u002Fupdate proofs, and release-secret preflights.\"\n---\n\n# OpenClaw Release CI\n\nUse this with `$release-openclaw-maintainer` and `$openclaw-testing` when a release candidate needs full validation, install\u002Fupdate proof, live provider checks, or CI recovery.\n\n## Guardrails\n\n- No version bump, tag, npm publish, GitHub release, or release promotion without explicit operator approval.\n- After compaction, resume, or new steering, rewrite the effective goal and\n  current phase from the latest explicit operator instruction. Do not merge old\n  scope back into the active release.\n- Hold the release scope once a release branch or Code SHA exists. Validate and\n  ship that exact release; do not turn moving `main` into a second work queue.\n- Record **C (candidate), Q (test qualification), P (admission\u002Faggregate\u002Fverifier\u002Fpublisher),\n  rerun group, profile, effective soak, and context\u002Ftransport refs**. New\n  candidate test qualification defaults to Q=C, including the complete workflow,\n  reusable workflow, local action, script, planner, contract, and coverage closure.\n  Code SHA and Release SHA remain lifecycle roles, not extra workflow identities.\n- The candidate helper accepts an absent release tag or an existing lightweight\n  or annotated tag resolving to the exact candidate SHA. A conflicting tag or\n  failed remote lookup stops validation; never move a tag to recover.\n- Freeze C\u002FQ and independently select trusted P on main or a protected\n  publication tag. C\u002FQ need not be an ancestor of P. Missing candidate contracts\n  require a deliberate backport; never silently substitute newer main tooling.\n- Apply a release firebreak after the Code SHA is frozen. Admit only confirmed\n  product defects, wrong or unverifiable package bytes, security\n  defects, or failures that make publication impossible. Queue other findings\n  for postpublish confidence or the next beta. Dependency advisories are never\n  firebreak admissions: record them as release evidence and queue the bump on\n  `main` after publication; only known malware stops publication.\n- Frozen CI children use Q's Node shard planner and measured\n  costs, while discovering and executing tests from the candidate checkout.\n  Hosted full-release plans split measured rows above 12 minutes; preserve file\n  coverage, worker limits, and complete timing generations. An indivisible\n  over-budget owner must be split rather than increasing the release budget.\n  After the child completes, closeout runs `scripts\u002Fci-shard-timings-refresh.mts`\n  for that exact run and commits generated costs; do not hand-edit measurements.\n- Candidate tests run their own frozen Q closure; admitted P owns FRV's aggregate\n  decision and checked-in waiver policy. Main-only checks and\n  future-main scenarios are not implicit release requirements. Fixing a frozen\n  qualification harness means a new C\u002FQ, with newly bound evidence. A P-only\n  admission\u002Faggregate\u002Fverifier\u002Fpublisher repair can keep C\u002FQ and their original evidence.\n- Protected lightweight `release-publish\u002F\u003C12sha>-\u003Cprovenance-run>` tags identify\n  P, not Q. The suffix records tag-creation provenance, not the current parent.\n  Publication helpers retain their `--workflow-sha \u003CP>` argument; the FRV helper's\n  `--workflow-sha` instead selects Q and must equal C on the candidate route.\n- Touch `main` only for an operator-requested change or the smallest critical\n  main-owned blocker that prevents this release and cannot be handled from the\n  release branch. Main's CI health never gates a release. If a release-tooling\n  landing is blocked by `main` failures it does not cause, prove on a clean\n  `main` checkout that the failure already exists there, record it in the PR\n  body, and merge; during an active release an admin merge is allowed for that\n  exact case. A separate lane fixes red `main` in parallel, off the release's\n  critical path.\n- Land tooling-only fixes on `main` with the `release-fast-lane` label added\n  before the push (see [Release tooling fast lane](#release-tooling-fast-lane)): `openclaw\u002Fci-gate`\n  then runs lint, types, guards, dependencies, docs, and the changed Node rows\n  only. Land through the [native maintainer workflow](..\u002Fopenclaw-pr-maintainer\u002Freferences\u002Flanding.md).\n  That workflow owns review and landing requirements, including the advisory\n  ClawSweeper policy; the label changes only CI selection.\n- `OPENCLAW_RELEASE_RUNNER_GROUP` optionally routes validation parents and workers\n  and the Release Publish parent plus its publish children to reserved capacity\n  with unchanged labels; credentialed publish and approval jobs stay on default\n  GitHub-hosted labels. Configure eligible runners and repo\n  access first; unset preserves ordinary routing. Shared workers inherit the\n  caller group; PR\u002Fmain CI and unrelated scheduled work remain outside it.\n- Check the nightly parent for the Code SHA before dispatching a fresh main validation; it seals per-child receipts that exact-target dispatches adopt when inputs match. The nightly runs this explicit trusted-main helper route (`--sha \u003Cmain-sha> --workflow-sha \u003Cmain-sha> --trusted-workflow-ref main`), so its parent runs on a `release-ci\u002F\u003Csha12>-\u003Cid>` branch, not `main`.\n- FRV must conclude success under pinned P's\n  [checked-in waiver policy](..\u002F..\u002F..\u002Fdocs\u002Freference\u002Ffull-release-validation\u002Fevidence.md#release-tooling-waivers);\n  all other required lanes must pass. See\n  [Publication requirements](#publication-requirements). Stable tags require stable\u002Ffull\n  evidence, soak, and blocking performance. Beta-profile evidence cannot qualify\n  stable. Soak remains mandatory; performance exceptions are limited to the\n  checked-in policy. All-group\n  qualification requires all nine Linux\u002FWindows\u002FmacOS Gateway install\u002Fupgrade\n  combinations. Preserve first failures, identity, and complete evidence.\n- Selected npm plugins must publish successfully before core npm. ClawHub starts\n  at its existing dispatch point and runs independently thereafter; planning,\n  authorization, dispatch, publication, verification, and recovery never block\n  core, GitHub finalization, main closeout, or the retrospective PR. Record a\n  separate owner, exact run\u002Fattempt, status, and next action for ClawHub.\n- Native macOS, Windows, Linux, and Android publication is independent of\n  npm\u002FClawHub, GitHub finalization, and main closeout. Each platform retains\n  its own signing, qualification, artifact, and updater requirements; report\n  pending platforms accurately and repair native-only failures in parallel.\n- Do not set GitHub secrets from unvalidated 1Password candidates. If a candidate returns 401\u002F403, leave the existing secret alone and report the exact missing provider.\n- Use `$one-password` for secret reads\u002Fwrites: one persistent tmux session, targeted items only, no secret output.\n- Watch one parent run with `pnpm frv watch --run \u003Cparent>` (see [Watch](#watch)).\n  Avoid broad `gh run view` polling loops; REST quota is easy to burn.\n- Fetch logs only for failed or currently-blocking jobs. If quota is low, stop polling and wait for reset.\n- Treat live-provider flakes separately from code failures: prove key validity, provider HTTP status, retry evidence, and exact failing lane before editing code.\n- When diagnosing a live-provider failure, a model-list response proves\n  authentication, not billing or inference entitlement. Confirm the credential\n  with a real completion probe before treating it as valid. Fix the credential\n  first; do not add an alternate auth path merely to bypass a failed release\n  credential.\n- Full Release Validation separates exact-child dispatch, Release Decision,\n  and Diagnostic Drain. With `fail_fast=false`, it makes zero child\n  cancellation calls; Diagnostic Drain follows every selected child to\n  terminal unless the collector itself is cancelled or loses GitHub API\n  access. With\n  `fail_fast=true`, Release Decision may cancel only the exact still-active\n  child that owns a blocking failure.\n- Same-parent continuation requires the original root to have been dispatched\n  with `fail_fast=false`. The controller verifies that exact logged input\n  before any rerun mutation.\n- A parent that produced its own sealed candidate artifacts cannot be continued:\n  GitHub reruns make those prior-attempt artifacts unavailable. Keep the\n  candidate and qualification SHAs frozen, supersede that parent, and start a fresh\n  all-group Full Release Validation.\n- After dispatch, one immutable execution-plan artifact records the original\n  parent attempt, exact child tuples and titles, selected coverage, gates, and\n  reuse identity. The same bytes are saved under an exact run-ID cache key.\n  Decision, Drain, manifest writing, evidence validation, and final verification\n  consume the artifact for their current attempt. A collector retry restores\n  the cached plan, validates it, re-uploads its artifact, and adopts the same\n  children; missing plan state is an orchestration failure, not permission to\n  reconstruct the plan or redispatch.\n- Reused evidence is not trusted merely because plan sealing found it. Release\n  Decision repeats the sealed target SHA, evidence SHA, policy, changed paths,\n  selected run, root run, source manifest, trusted tooling identity, and\n  exact-child checks before returning `passed`.\n- Parent retries select the newest Decision and Drain artifacts independently;\n  both must bind the same immutable plan even when their source attempts differ.\n- Child retries are part of the same immutable plan only when the child run ID,\n  workflow path, ref, Q SHA, dispatch title, event, target, candidate, and\n  validation inputs remain exact. Newer child attempts replace matching jobs;\n  jobs absent from a newer attempt carry forward. A duplicate job identity,\n  missing attempt, regressed attempt, or changed tuple fails closed. `frv status`\n  and `continue` allow up to 60 seconds of read-only reconciliation when GitHub\n  temporarily returns duplicate jobs in the newest retry attempt. The run tuple\n  and attempt stay pinned; persistent duplicates and older-attempt conflicts\n  remain errors.\n- Use `pnpm frv status|watch|rerun --job|rerun --child|continue --failed|verify` for attempt-aware recovery.\n  The controller is stateless: the immutable execution plan, exact GitHub run\n  attempts, Diagnostic Drain, and final manifest are the only authorities. It\n  never writes a tag, package, registry entry, release candidate, or\n  publication.\n- Post-merge controller proof must use the reviewed landed SHA on protected\n  `main` through the non-release `FRV Proof Broker` and `FRV Proof Fixture`.\n  Dispatch the broker with the merged pull request number and exact landed\n  commit. The broker must require that pull request's merge commit to match the\n  landed commit, prove the landed commit is identical to or an ancestor of its\n  trusted workflow SHA, and repeat authority, merge, and ancestry checks\n  immediately before rerunning the fixture.\n  Require the exact fixed no-op fixture run to advance from its intentional\n  attempt-one failure to an attempt-two pass. The broker must emit its receipt\n  without creating a release candidate, release artifact, publication,\n  repository ref, replacement parent, or other workflow mutation. This is the\n  hosted GitHub targeted-job rerun proof; focused controller tests own immutable\n  plan eligibility, green-attempt preservation, same-parent collection, and\n  strict-verifier invocation. Never use a real Full Release Validation run for\n  this proof. See\n  [Full Release Validation](\u002Freference\u002Ffull-release-validation#post-merge-continuation-proof).\n- Use one release operator, one `frv watch`, and at most one\n  investigator for the current failed surface. Do not build audit-review-plan\n  trees around a single workflow transition.\n- For regular beta\u002Fstable releases, Code SHA may already contain final notes\n  and serve as Release SHA. One successful fresh full parent may qualify both\n  roles and their exact publication bytes. If notes change afterward, a later\n  Release SHA may reuse product evidence only when its complete delta from\n  Code SHA changes the selected `CHANGELOG\u002FYYYY.M.PATCH.md` and optionally\n  `CHANGELOG.md` and `CHANGELOG\u002Frecords\u002FYYYY.M.PATCH.md`, with no other paths,\n  renames, or deletions; its changed bytes still need qualification.\n- Extended-stable validates one exact branch tip; it does not reuse the regular\n  Code-SHA\u002FRelease-SHA evidence model.\n- In a sparse worktree or Testbox source sync, first confirm `package.json`,\n  `pnpm-lock.yaml`, and every source path the selected check reads. If any are\n  absent, that checkout cannot validate a release dependency or Docker lane:\n  stop and use the repo remote changed gate or a full task worktree. When the\n  inputs are present and a release fix changes `package.json` or\n  `pnpm-lock.yaml`, rebuild only the task-owned disposable box with\n  `CI=true pnpm install --frozen-lockfile`, then run an explicit\n  `require.resolve()` probe before Docker or focused tests. The CI flag permits\n  pnpm to recreate a prewarmed modules directory without an interactive\n  confirmation. Do not weaken the lockfile or label sparse-checkout failures\n  as product\u002FDocker failures.\n- If the candidate is rebased or its base SHA changes after warmup, stop the\n  task-owned box and warm a fresh one before testing. Testbox source sync is\n  relative to the warmed source tree; continuing can mix an old base file with\n  a new candidate diff and produce false lockfile or Docker failures.\n- Reused Testboxes are checked against their recorded source after their first successful run.\n  Source-only edits may reuse the lease; base, dependency, wrapper, or Testbox\n  workflow drift requires a fresh lease. Do not set\n  `OPENCLAW_TESTBOX_ALLOW_STALE=1` for release evidence.\n- For a committed release candidate with the supported capsule-aware wrapper,\n  run `node scripts\u002Fcrabbox-wrapper.mjs run --blacksmith-ref main -- \u003Ccommand>`\n  from that candidate's checkout when using Testbox. The capsule preserves\n  candidate source and frozen dependencies while `main` supplies current\n  admission limits. If the candidate lacks that wrapper contract, use the\n  exact-target release-validation route below with separate Validation and\n  Tooling SHAs. Do not dispatch candidate Testbox workflow refs or borrow\n  another checkout's wrapper.\n\n## Keep FRV off the idle path\n\nOptimize time to the next **passing** Full Release Validation. Remote FRV is\nusually the long pole; use its runtime for diagnosis, repairs, review, and\nfocused proof. This is scheduling guidance, not a new checklist, approval step,\nor demand for certainty before dispatch. Existing release gates still apply.\n\n- **Start remote qualification promptly.** Favor starting remote FRV while\n  useful local checks run alongside it, rather than finishing those checks\n  first. If the remote run passes, that overlap saves an entire cycle; if local\n  work finds a defect, the run can be superseded through the existing recovery\n  path. Uncertainty alone is not a reason to leave remote validation idle.\n- **Repair as failures arrive.** Use the watcher to spot failures and start\n  diagnosis and fixes while other lanes drain. Prioritize known non-flake\n  failures over optional confidence checks. Use independent repair lanes when\n  helpful, and integrate fixes as they become ready rather than waiting for\n  the final diagnostic report to start work.\n- **Aim to be ready when diagnostics finish.** Ideally, fixes for the drained\n  failures are already on the branch, with focused proof and review done, by\n  drain completion. This is an overlap goal, not a deadline or another gate.\n  If a repair takes longer, keep working it; avoid filling the gap with\n  redundant checks or process overhead.\n- **Fix the whole known set before the next FRV.** Include fixes for every\n  known non-flake failure affecting the next run, whether in the candidate,\n  qualification harness, or trusted tooling. The waste to avoid is knowingly\n  launching another full cycle with failure B still unfixed after fixing A.\n  This does not mean proving there are no undiscovered failures or resolving\n  unrelated issues before running again.\n- **Use retries strategically.** An eligible targeted retry can run while\n  unrelated diagnostics continue. Use the existing\n  [retry budget](#run-identity-and-retry-budget) for flakes or repaired external\n  prerequisites and retain valid green evidence. A repeat of an unchanged\n  deterministic failure buys little; fix it instead. When a fresh parent is\n  needed, include the known fixes and get it running without optional delays.\n\n## Deferred CI recovery\n\nRelease validation does not pause CI or supporting workflows. The legacy\n`OPENCLAW_RELEASE_PRIORITY_RUN` variable is ignored by current workflow\nadmission, and `pnpm frv prioritize --run` is retired. Use\n`pnpm frv prioritize --restore \u003Crecord>` to recover runs deferred by older\nworkflow revisions and clear their variable.\nKeep the required publication proofs and soak gates intact.\n\n## Continuous release readiness\n\nThe scheduled main validation (every 3 hours at :07 UTC) seals a direct-root manifest and per-child receipts for the exact main SHA.\nFor a same-day cut, land the release train on `main` (version and changelog) before the next scheduled run,\nthen cut `release\u002FYYYY.M.PATCH` at that run's SHA so the Code SHA equals the validated SHA.\nPer-child adoption matches exact target SHA, role, and dispatch inputs minus `dispatch_id`:\n`productPerformance` is adopted because its inputs are context-free and match.\nA stable candidate dispatched with `--target-ref release\u002FYYYY.M.PATCH` resolves\n`coveragePolicy=npm-stable-v1` and `ci_release_scope=npm-stable`, versus `full` scope on `main`.\n`normalCi`, plugin prerelease, and release checks are re-dispatched because their inputs add\n`target_context_ref`, plugin prerelease and release checks add `allow_frozen_target_scenario_omissions=true`, and scope differs.\nWhole-parent adoption requires byte-identical manifest `validationInputs`, including `validationPurpose`,\n`publicationSelectionJson`, `targetContextRef`, `targetVersion`, `allowUnreleasedChangelog`, and `coveragePolicy`;\na `main-qualification` nightly is never adopted wholesale by a `publish`-purpose stable candidate.\nPurpose\u002Fcontext-crossing adoption is a verifier policy follow-up.\n\n## Release tooling fast lane\n\nAdd the `release-fast-lane` label to a pull request before the push that should\nuse it; PR CI reads labels from the triggering event, and label events do not\nstart CI. For an already-pushed head, `gh pr ready --undo` then `gh pr ready`\nre-triggers PR CI with the current labels. The label narrows `openclaw\u002Fci-gate`\nonly on a canonical pull request whose changed paths are all release tooling:\n`.github\u002Fworkflows\u002F**`, `scripts\u002F**`, `test\u002Fscripts\u002F**`,\n`.agents\u002Fskills\u002Frelease-*\u002F**`, `docs\u002Freference\u002FRELEASING.md`, or independently\nchecked documentation. Admitted runs keep `security-fast`, `check-shard` (lint,\nprod\u002Ftest types, guards, dependencies, npm lock), `check-docs` when docs\nchanged, and the changed Node rows; the compact packing-policy full-plan proof\nfor planner edits is relaxed to those rows. Contracts, baseline ratchets,\nbundled protocol, Bun launcher, additional checks, build artifacts (unless a\nchanged row needs `dist`), Control UI, Windows, macOS, iOS, Android, i18n, and\nskills lanes are skipped and listed under \"Release fast lane\" in the preflight\nstep summary. A declined label (out-of-scope path, global Node input, fork,\npush, dispatch, docs-only) logs a warning and leaves ordinary selection\nuntouched. The gate stays complete: every selected lane must pass, and hourly\nfull main CI covers the merged result. The label narrows only the CI gate: fork\nheads are declined, and the [native maintainer workflow](..\u002Fopenclaw-pr-maintainer\u002Freferences\u002Flanding.md)\nstill owns review and landing requirements.\n\n## Run identity and retry budget\n\nRecord C, Q\u002Fref, P\u002Fref, target context ref, parent run id,\nattempt, and phase before watching or recovering Full Release Validation. Keep\nCode SHA and Release SHA as lifecycle roles in the ledger; they may name the\nsame commit. Record the\nimmutable Release Publish parent receipt separately from the tag's recorded source.\n\nFor the core and plugin npm mutations enforced by this foundation, re-read the\nexact protected lightweight tag and revalidate the exact parent run tuple\nimmediately before each publish or dist-tag mutation. Reject a missing, moved,\nannotated, or wrong-SHA tag; a repository, workflow, run id, attempt, tooling\nidentity, or parent-state mismatch; and any same-name branch. Never refresh\neither identity from current `main`. Treat other privileged writers as blocked\nuntil their dependent enforcement changes land.\n\n- Conceptual phases map to current inputs as follows:\n  - `beta-publish`: `release_profile=beta`, `run_release_soak=false`\n  - `postpublish-confidence`: published package inputs with\n    `run_release_soak=true` or explicit focused groups\n  - `stable-publish`: `release_profile=stable` or `full`, with soak and blocking performance\n- An `all` run without soak for an actual beta package on its matching canonical\n  release branch or beta tag records `coveragePolicy=npm-beta-v1`. It keeps\n  Linux\u002FmacOS\u002FWindows Node, Control UI, plugin, package, install\u002Fupdate,\n  Linux\u002FWindows\u002FmacOS cross-OS, QA parity, runtime-pair\u002Frestart, and tool coverage.\n  All selected tests gate npm\u002FClawHub. Native app\n  CI, performance, and published-package Telegram are deferred to confidence.\n  Beta `all` without soak also defers Package Acceptance Telegram, including\n  beta-profile checks of `main`. Record deferred checks as not run,\n  never passed. Stable\u002Ffull, soak, and focused groups retain their coverage;\n  selected children still require terminal evidence. An absent coverage policy\n  retains historical full behavior.\n- Keep at most one active parent for the same C + Q + rerun\n  group + release profile + effective soak coverage. Stable\u002Ffull always include\n  soak. Distinct coverage profiles can run independently; concurrency does not\n  cancel an older exact child automatically.\n- Parent cancellation or timeout does not settle independent descendants.\n  Preview `pnpm frv cancel --run \u003Cparent> --dry-run`, then run it without\n  `--dry-run` only for explicitly requested cancellation. The canonical owner\n  authenticates the sealed plan, exact dispatch logs, current attempts, artifact\n  producers, and recorded Telegram descendants; borrowed\u002Freused children remain\n  untouched. Repeat an incomplete result with its next command. Use `--force`\n  only when an earlier cancellation is not settling. Never infer ownership from\n  branch, title prefix, or latest-run order, or dispatch a replacement before the\n  owned tree is terminal.\n- Recover one failed surface with one diagnosis, one fix when needed, and one\n  narrow retry. Then reassess the release decision. Do not automatically\n  dispatch `rerun_group=all`.\n- Rerun a failed or timed out test job only after the lead records its\n  real-blocker-or-flake decision (see the maintainer skill's shared release\n  boundaries). Call it a flake only when the same job or failure signature has\n  passed on the same Release SHA. Before rerunning, read the failure's own\n  diagnostics, inspect same-SHA attempts, and compare the failing paths against\n  the candidate delta and recent `main` history; a fix on `main` is not present\n  on the frozen candidate until ancestry or patch equivalence proves it. An\n  identical signature repeated on the same or another candidate is deterministic\n  until a named mechanism and fix prove otherwise. A flake gets at most two\n  recorded reruns on the same Release SHA plus a fix-in-parallel issue or PR on\n  `main`; never a re-cut, tooling change, or new FRV. New dispatches reject\n  `known_flaky_jobs_json`.\n- For a supported parent, `pnpm frv rerun --run \u003Cparent-run-id> --job\n  \"\u003Cchild-key>:\u003Cexact job name>\"` reruns one executed terminal job using its accepted\n  Actions job ID. Get the child key and exact name from `frv status --json`.\n  GitHub also reruns dependent jobs. The controller waits only for that child\n  before sending the request; it does not retry unrelated failures. Without\n  `--no-follow` it then follows the whole tree through the parent reseal; pass\n  `--no-follow` to return once the new attempt is observed, then run\n  `continue --failed` to reseal.\n- `pnpm frv rerun --run \u003Cparent-run-id> --child \u003Cchild-key|run-id>\n  [--max-attempts N]` records one bounded exact-job rerun. It waits for the\n  child to finish, requires exactly one blocking failed job, sends one request\n  for that accepted Actions job ID, and returns once the new attempt exists\n  without duplicate jobs. Before the request it prints the failed job's runner\n  labels and the current `OPENCLAW_CI_RUNNER_BACKEND`; afterwards it appends\n  an audit line to `$TMPDIR\u002Fopenclaw-frv\u002F\u003Crepo>-\u003Cparent>-reruns.jsonl`. It\n  refuses a passed child, an artifact producer (use `continue --failed`), a\n  child with multiple blocking failures, and a child past its attempt budget:\n  the default 2 allows one rerun; pass `--max-attempts 3` only for a confirmed\n  flake. Start a fresh all-group FRV when multiple blocking jobs fail. Reseal\n  with `continue --failed`.\n- `pnpm frv continue --failed --run \u003Cparent-run-id>` applies the same\n  exact-job restriction to each terminal failed child and failed artifact\n  producer, even while the parent or siblings remain active. It refuses\n  multi-job recovery and directs the operator to a fresh all-group FRV. It\n  adopts active attempts and preserves green children. Once every required\n  child is green and the original parent finishes, it reruns the parent once\n  to restore the same immutable plan and seal the updated all-group manifest.\n  An early retry can invalidate the original Decision\u002FDrain pairing; the final\n  reseal and strict verification own completion.\n- GitHub ghost jobs (runnerless queued copies of the same job name) can follow\n  any rerun request, single-job or batched, and make that attempt unsealable.\n  Send at most one rerun request per child, only after the child is terminal;\n  never stack separate job reruns on one child. Duplicates can settle within\n  the controller's 60-second reconciliation window; once a command reports\n  ghost jobs (duplicates that persisted), stop rerunning that FRV: cancel the\n  attempt and start a fresh all-group FRV.\n- `continue --failed` reruns each failed child once per invocation. If a child\n  it reran fails again, it exits immediately with the attempt and remaining\n  rerun budget instead of waiting for siblings; rerun `continue --failed` only\n  for a confirmed flake within the flake budget above.\n- Each child or parent rerun mutation is sent exactly once per invocation;\n  ambiguous transport failures trigger bounded read-only reconciliation. Do\n  not blindly repeat an interrupted or timed-out command: inspect exact\n  attempts first. Targeted JSON results record the job ID, accepted source\n  attempt and observed retry attempt. Keep the command in a long-running shell\n  for its default 12-hour operation budget.\n- Inspect without mutation:\n\n  ```bash\n  pnpm frv status --run \u003Cparent-run-id>\n  pnpm frv verify --run \u003Csuccessful-parent-run-id>\n  ```\n\n- Parents whose immutable plan predates attempt-aware evidence cannot be\n  continued. This legacy-plan refusal requires a fresh all-group Full Release\n  Validation parent, subject to the owned-tree settlement rules above. Preserve\n  the old receipts; never reconstruct the old state. Attempt-aware plans retain\n  their existing parent and the targeted recovery rules above.\n\n- Controller retries are `ci`, `plugin-prerelease`, `install-smoke`,\n  `cross-os`, `live-e2e`, `package`, `qa-parity`, `qa-live`, `npm-telegram`,\n  or `performance`. Never use the removed `release-checks` handle. `qa` is\n  only a direct-child manual aggregate, not a controller retry API.\n- Filtered retries fail closed unless the filter belongs to the selected group.\n  All-group runs also accept `cross_os_suite_filter`: for example,\n  `-f cross_os_suite_filter=ubuntu,macos` excludes Windows. `npm-stable-v1` and\n  `npm-beta-v1` still qualify when explicitly filtered OS lanes are omitted, provided all\n  Linux suites remain selected and the other policy requirements hold.\n  Never turn an empty derived filter into an unfiltered broad run.\n- A new all-group parent is justified only when shared orchestration changed,\n  earlier evidence is invalid for the selected tuple, or the operator explicitly\n  requests it. Record the invalidating event.\n- Narrow child or group evidence does not by itself become publish\n  authorization. Keep it in the evidence ledger for the release owner to judge\n  against the current publish gate.\n\n## Preflight\n\nBefore full matrix dispatch, run both `pnpm ui:i18n:check` and\n`pnpm native:i18n:check` against the frozen trusted target in approved isolation.\nBind both results to that exact SHA. Report generated-locale drift as a warning\nand continue dispatch; source changes and the serialized locale-refresh workflows\ncan temporarily leave generated output behind. Do not require regeneration before\nstarting validation. FRV's normal-CI child retains the strict `control-ui-i18n`\nand `native-i18n` jobs and reports their actual results in the run summary;\na failed selected locale job blocks npm\u002FClawHub publication. PR-side checks and\nrelease-prep gates stay unchanged. Keep target execution outside the trusted\ndispatch helper—do not execute an arbitrary target checkout as helper code.\n\nBefore expensive full validation, also run `pnpm ui:build` on the same frozen\ntrusted target with its frozen dependencies in approved isolation, outside the\ntrusted dispatch helper. Record the target SHA with the successful production\nbuild, precompressed-asset verification, and startup\u002Flargest-asset budget results;\nany failure blocks fanout. Do not substitute a dev server or raise budgets to admit\nthe target.\n\nFor local full E2E proof, prepare the frozen, dependency-ready proof checkout\nwith private QA entries in the initial build:\n\n```bash\nOPENCLAW_BUILD_PRIVATE_QA=1 pnpm build\n```\n\nThen run the selected E2E command with its normal readiness checks enabled.\n`scripts\u002Flib\u002Fvitest-build-prerequisites.mts` requests private QA entries;\n`scripts\u002Frun-node.mts` triggers another full build when they are absent. This\npreflight avoids rebuilding solely for `missing_private_qa_dist`. Keep the flag\nscoped to this task-owned proof checkout and command. Publication package and\nimage bytes remain owned by the release workflows and their sealed artifacts.\n\nBefore full release validation:\n\n```bash\ngh api rate_limit --jq '.resources.core'\ngit status --short --branch\ngit rev-parse HEAD\n```\n\n### Before publication\n\nFor regular beta\u002Fstable protected publication, after evidence validation run\n`pnpm release:publish-preflight` with the intended tag, exact Full Release\nValidation run and attempt, npm dist-tag, plugin scope, and protected publication\ntooling ref. `pnpm release:candidate`\ninvokes this check with its downloaded manifests; do not redownload them or\nreplace the selected attempt. Use the report's exact dispatch command for the\nchosen publication route only after resolving every `FAIL` and owner-action\n`WARN`. Extended-stable retains its separate owner workflows and is not\nadmitted by this preflight. Alpha releases are retired.\n\nThe checklist's `--workflow-ref`\u002F`--workflow-sha` selects trusted P tooling, not\nthe candidate harness. Reuse authenticated stable package Telegram proof from\nthe exact FRV-qualified tarball; beta coverage remains deferred. Supplemental\nTelegram checks require the retained qualification ref verified at Q=C, with\nthe harness pinned to C. Never dispatch candidate checks from moving main.\nLocal Parallels uses C's checkout and dependency graph. Supplemental Telegram\nrun IDs stay in candidate evidence, not the optional publisher diagnostic input.\n\nCheck the report before retrying a failed publication: preserve the verified\n`openclaw_npm_resume_run_id` for already-published core bytes, inspect matching\ndraft\u002Fpublished release state, and identify exact orphaned plugin\u002FClawHub children\nbefore cancellation. Preflight is read-only and does not authorize publication,\ncancel children, or prove a repository secret from local credentials. Bootstrap\ncandidates need a read-only `npm whoami` probe using the repository's actual\n`NPM_TOKEN`; follow the secret-isolated step in\n[bootstrap token probe](..\u002Frelease-openclaw-maintainer\u002Freferences\u002Fpublication-recovery.md#check-the-bootstrap-token)\nand retain its run URL. Do not rotate credentials as part of a diagnostic check.\n\n## Dispatch\n\nAfter source admission, plugin compatibility readiness, and evidence reuse\nselection, dispatch source-only children alongside npm and Docker artifact\nproducers. Candidate acquisition consumes raw npm bytes while qualification\ncontinues; candidate Plugin Prerelease and Release Checks start immediately\nafter candidate verification without waiting for independent validation or\nDocker. Preserve the immutable execution plan and final artifact qualification.\n\nEach selected validation child uploads an immutable\n`full-release-child-evidence-\u003Ctarget-sha>-\u003Crole>-\u003Crun-id>-\u003Cattempt>` receipt from\ntrusted workflow tooling. The receipt retains normalized dispatch inputs,\nincluding candidate descriptors, and composes predecessor jobs across attempts.\nIts `workloadConclusion` excludes the running publisher. Collection failure\nloses reuse metadata without changing workload qualification. With\n`reuse_evidence=true`, dispatch scans at most 100 recent runs, probes at most 40\ntarget receipt inventories, and fully validates at most five matching receipts\nper role within two minutes. Other-target and other-tooling runs do not spend\nthe full-validation budget. Empty-string inputs equal absent inputs because GitHub omits them from\n`github.event.inputs`; non-empty defaults and candidate descriptor bytes must\nmatch exactly. It can adopt green children from failed, cancelled, or active\nparents only at the same Tooling SHA as the current parent, still requiring main\nancestry. Missing or different parent tooling fails closed; no paths are exempt.\nDispatch logs identify reused children, explain each evaluated rejection, and\nsummarize skipped runs and fresh dispatches. The current-parent adoption witness\nand immutable execution plan bind each selection. Collectors and final verification\nrecheck the live child attempt and conclusion, same tooling, main ancestry, inputs,\nartifact identity\u002Fdigest\u002Fexpiry, and successful trusted seal\u002Fupload steps. A newer\nattempt invalidates reuse; do not rerun an adopted child to repair a collector.\nCurrent-parent source\u002Fpublication admission and the separate successful-parent\nchangelog reuse path remain unchanged. Artifact producers retain their existing\nsealed receipts. Candidate admission does not widen this per-child receipt\nreuse contract: a divergent Q runs fresh children; whole-parent authenticated\nevidence reuse retains its separate original-Q contract.\n\nAn early standalone product-performance run is optional beta confidence. If\nuseful, start it against the frozen Code SHA in parallel with release work:\n\n```bash\n# Optional beta confidence; stable\u002Ffull qualification requires blocking performance.\nfail_on_regression=false\ngh workflow run openclaw-performance.yml \\\n  --repo openclaw\u002Fopenclaw \\\n  --ref main \\\n  -f target_ref=\u003Ccode-sha> \\\n  -f profile=release \\\n  -f repeat=3 \\\n  -f deep_profile=false \\\n  -f live_openai_candidate=false \\\n  -f fail_on_regression=\"$fail_on_regression\"\n```\n\n- Do not add a separate mandatory prepublish wait for this optional beta signal.\n- Compare available Kova, gateway startup, and CLI startup metrics with earlier\n  release evidence or clawgrit reports before publish\u002Fcloseout.\n- Record regressions in release evidence and investigate their product impact.\n  Stable\u002Ffull qualification requires blocking performance subject only to the\n  checked-in policy’s exact Kova grants. Retain failed reports; a failed-job\n  grant does not authorize a not-run exemption.\n- `npm-beta-v1` defers the performance child. Every selected child still needs\n  terminal evidence and must prove artifact-only publication.\n\nUse the canonical helper for reviewed candidate qualification. It alone first\nruns the lightweight `admit-qualification` operation on\n`openclaw-release-prepare.yml` at P, then dispatches FRV at Q=C. P records the\noperator attestation, complete normalized inputs, and data-only frozen Q coverage;\nthe immutable descriptor travels in the existing `trusted_workflow_json` envelope.\nDo not execute candidate code in P's admission step or hand-assemble the envelope.\n\n```bash\nPUBLISHER_SHA=\"\u003Crecorded-full-trusted-main-ancestor-sha>\"\nPUBLICATION_SELECTION='{\"route\":\"normal\",\"npmDistTag\":\"latest\",\"publishOpenclawNpm\":true,\"pluginPublishScope\":\"all-publishable\",\"plugins\":[]}'\npnpm ci:full-release \\\n  --sha \u003Ccode-sha> \\\n  --target-ref release\u002FYYYY.M.PATCH \\\n  --trusted-workflow-ref candidate \\\n  --admission-workflow-sha \"$PUBLISHER_SHA\" \\\n  --admission-workflow-ref main \\\n  --request-file \u003Cprivate-request-file> \\\n  -f validation_purpose=publish \\\n  -f publication_selection_json=\"$PUBLICATION_SELECTION\"\n```\n\nQ defaults to C; an explicit `--workflow-sha` must equal C. P can instead use\nan existing protected `release-publish\u002F*` tag with its exact SHA. Review the\ncandidate and coverage before dispatch: admission records that operator\nattestation, not a bot exception. Scheduled main qualification explicitly uses\n`--trusted-workflow-ref main` and retains its trusted-main semantics.\n\nAn existing `--request-file` reconciles the original request without changing\nits route, Q\u002FP identities, or inputs. `--reconcile-request \u003Cfile>` is read-only.\nOnly `--resume-request \u003Cfile>` can continue a candidate request after admission\nand before its first FRV POST. If Q ref creation succeeded but readback failed,\nresume verifies the existing exact Q=C ref and empty workflow inventory, then\nreuses it without a second ref POST. Missing\u002Fmoved refs or uncertain\u002Fnonempty\ninventories block. Read-only reconciliation verifies an uncertain prepared ref\nbefore suggesting resume; it does not rewrite or advance the request. Every\nresume revalidates authenticated admission and signer authority after recovery\ninventory reads, then checks the ref immediately before dispatch. Stable\u002Fchecklist\nwrappers relay the helper’s verified recovery advice, never infer safety from raw\nuncertain state. Run the explicit resume command when offered, then rerun the wrapper.\nAn attempted or uncertain FRV POST remains observation-only and never retries. Keep\noriginal producer and current consumer identities when reusing evidence.\n\nSelect `npmDistTag=beta` for beta publication and `route=prepared` only for an\nintended prepared-button consumer. The source-admission result does not qualify\nregistry state or authorize publishing. Nonpublish investigations use explicit\n`validation_purpose=diagnostic` without publication selection; recurring main\nqualification uses `main-qualification`, and exact published-package confidence\nuses `postpublish-confidence`. Keep coverage\u002Fprofile selection independent.\n\nFor regular `release\u002F*` validation, never raw-dispatch the workflow without\n`target_context_ref` (the helper's `--target-ref` records it). Canonical\n`release\u002F*` and `extended-stable\u002F*` workflow refs remain supported routes, but\ntheir Telegram child must retain the exact parent workflow ref and SHA through\nOIDC and attestation. Trusted-workflow release-branch CI passes `target_ref` +\n`release_candidate_ref`; never `release_gate` there — it requires workflow head\n== target. (The PR-head ci.yml fallback below is a different dispatch and does\nuse `release_gate=true`.)\n\nThe release branch may advance after the Code SHA is frozen. The helper accepts\nthat frozen SHA only while it remains an ancestor of the canonical release\nbranch and its package version is either the branch's final version or a\nmatching beta prerelease. Extended-stable branches and all tags require\nan exact package-version match.\nFor fresh candidate qualification, retain Q=C and pass P separately. Missing\nfrozen contracts fail closed and require deliberate candidate backports, not\nfallback to main. The explicit historical\u002Fcross-revision route remains\n`--trusted-workflow-ref main --workflow-sha \u003Crecorded-main-tooling-sha>`\n(or a protected tooling tag). New requests on this route are diagnostic,\nmain-qualification, or postpublish-confidence only, never publish qualification.\nExisting historical publish requests reopen before this new-dispatch restriction\nand preserve their original trusted-main ancestry contract; they are not\ncandidate-owned evidence. Never refresh either route's\nrecorded identity from moving main. Evidence reuse remains enabled unless the\noperator deliberately selects `-f reuse_evidence=false`.\n\nIf final notes were already committed before fresh full qualification, retain\nthat Code SHA as Release SHA and use the same successful parent\u002Fattempt and\nits exact prepared bytes for candidate and publication checks. Required gates\nand final channel-specific SDK review still apply. Publishers consume the sealed\nacknowledgement; the candidate helper retains its explicit argument when needed.\n\nOnly if notes change after qualification, commit the selected release entry and\nany matching record\u002Findex updates, then\noptionally run the helper against the new Release SHA with reuse. That parent must report\n`policy=split-changelog-release-v1`, `evidenceSha=\u003Ccode-sha>`, and the complete\n`changedPaths`: the selected `CHANGELOG\u002FYYYY.M.PATCH.md` is required, with only\n`CHANGELOG.md` and `CHANGELOG\u002Frecords\u002FYYYY.M.PATCH.md` permitted alongside it.\nEntry\u002Frecord additions or modifications are permitted; index changes must be\nmodifications. Renames, deletions, other releases, and docs source edits require\nfresh product qualification. Historical root-only receipts retain\n`changelog-only-release-v1`. The split path should reuse the product matrix instead of\ndispatching child lanes. Npm preflight and package\u002Finstall acceptance still run\nagainst the exact Release SHA and its new tarball bytes.\n\nCurrent all-group FRV also owns read-only core and selected-plugin npm\nsource\u002Fbuild\u002Fqualification plus Docker preparation. Use its successful run as\n`preflight_run_id`; the candidate\nhelper defaults to that run. Do not dispatch a second npm preflight unless\nrecovering historical separate evidence. Regular final qualification records\nSDK reports for both `beta` and `latest`; review the acknowledgement for the\nactual publication channel. Prepared descriptors live in `publicationArtifacts`\nin the exact final manifest. Release Prepare adopts the manifest's plugin npm\ndescriptor and prepares only ClawHub; it never repacks plugin npm after FRV.\nProduct evidence reuse never substitutes Code-SHA\npackage or image bytes for the final Release SHA. For failed independent npm\nqualification, use `pnpm frv continue --failed`:\nfailed npm jobs retry on their original run, successful preparation jobs\nand diagnostic children carry forward, and the parent verifies the resulting\nreceipts. Failure alone is not a continuation rejection. Frozen workflows\nexecute their original receipt logic; a local controller upgrade does not\nretrofit that logic, and final verification still owns the recovery result.\n\nThe SHA-pinned helper infers `beta` for matching beta release candidates and\n`stable` for stable\u002Fcorrection versions, then passes the\nC\u002FQ\u002FP run identity. Canonical beta `all` without soak\nuses `npm-beta-v1`; `main` and non-beta targets do not qualify for that\npolicy. Run deferred native, performance, Telegram, broad live QA, and E2E as\npostpublish confidence with the exact published package and\n`run_release_soak=true` or explicit groups. Stable and full profiles force the\nrelease soak. Native artifact publication still requires its own build,\nsigning, notarization, and promotion gates. Use a narrow `rerun_group` after\nfocused fixes; never widen automatically.\nAt seal time the parent records the SDK evidence digest from the qualified npm\nreceipt and resolves per-package npm plans against the registry. The manifest's\n`publishInputs` supplies publisher\u002Fpreflight defaults. SDK API changes still\nneed the operator's acknowledgement; sealed evidence does not grant authority.\nMutation owners recheck live publication authority, selectors, and immutable bytes.\n\n### Publication requirements\n\nPublish with `release_profile=from-validation` to consume the sealed profile.\nThe selected FRV run must conclude **success**. Stable publication requires\nstable\u002Ffull evidence, soak, and blocking performance.\nDecide blocker or flake for every failed test. Rerun flakes on the same Release\nSHA at most twice and file a fix-in-parallel issue\u002FPR on `main`; never re-cut\nsolely to clear a flake. An exact eligible failed leaf may instead\nhave a reviewed [release-tooling grant](..\u002F..\u002F..\u002Fdocs\u002Freference\u002Ffull-release-validation\u002Fevidence.md#release-tooling-waivers).\nLand and pin P, then run or revalidate FRV without changing C\u002FQ. The publisher\ndoes not grant waivers or accept failed FRV. All unwaived failures and missing,\nskipped, cancelled, or unknown required coverage still block.\n\n### Publish children\n\nUse the maintainer [publication recovery guide](..\u002Frelease-openclaw-maintainer\u002Freferences\u002Fpublication-recovery.md)\nfor publication ordering and prepared\u002Fdirect recovery.\n\n- Watch every publish parent with one `pnpm release:watch --run \u003Cparent>`\n  ([contract](..\u002F..\u002F..\u002Fdocs\u002Freference\u002FRELEASING.md#watch-publication)), not a\n  hand-rolled monitor. It reports parent and child environment gates, failed\n  runs and failed `continue-on-error` jobs, and it backs off on rate limits.\n\n- `pnpm release:stable \u003Cversion>` ([orchestrated stable release](..\u002Frelease-openclaw-maintainer\u002Freferences\u002Fregular-release.md#orchestrated-stable-release))\n  dispatches the parent once, approves the parent's `npm-release` gate, prints\n  child-approval commands only for older tooling without `npm-publish` and\n  stale-child sweep commands when needed (it never mutates a child run).\n  On any refusal it prints `Next:` with\n  the exact recovery command.\n- The parent's `npm-release` approval mints the attested\n  `openclaw-release-approval-v1-\u003Cparent run>-\u003Cattempt>` receipt; bot-dispatched\n  children verify it (`scripts\u002Frelease-approval-receipt.mjs verify`) before\n  their gates. The ClawHub OIDC child skips its `clawhub-plugin-release` gate\n  on a verified receipt and uses its own publication authorization after\n  dispatch. Core-parent completion or failure must not strand already-authorized\n  ClawHub work; keep its live-authority and exact-byte checks in that lane. npm\n  children (`Plugin NPM Release`, `openclaw-npm-release.yml`) skip their\n  `npm-release` approval job on the verified-receipt route and publish in\n  `npm-publish`, with trusted publishers bound to that environment. Immediately\n  before publication they wait for the parent attempt's receipt and require\n  that attempt to remain `in_progress`. This is one human approval per release.\n  `npm-publish` has no reviewers and admits only protected\n  `release-publish\u002F\u003Csha12>-\u003Cn>` tags. Real manual\u002Frecovery npm dispatches must\n  use such a tooling tag and still need their own `npm-release` approval job;\n  the read-only OIDC preflight also uses `npm-publish` and requires that tag.\n  Artifact-only preflights keep their existing refs and have no environment.\n- Never approve a `plugin-clawhub-release.yml` child by hand. It is\n  receipt-verified on the bot route and needs no approval. The\n  `Artifact not found` line for `openclaw-clawhub-recovery-approval-\u003Crun>-1`\n  is a non-fatal probe. Historical parent-bound children could fail with\n  `parent state completed\u002Ffailure is not allowed by authorization route`\n  (2026.9.6: runs 35930335388\u002F35930341394). Recover that ClawHub surface through\n  explicit [publication recovery](..\u002Frelease-openclaw-maintainer\u002Freferences\u002Fpublication-recovery.md#interrupted-preparation-and-publication),\n  without holding or redispatching core publication. Bootstrap children\n  (`plugin-clawhub-new.yml`) always wait on `clawhub-plugin-bootstrap`. Approve\n  them after the secretless pack jobs finish\n  ([first package](..\u002Frelease-openclaw-maintainer\u002Freferences\u002Ffirst-package.md)).\n- A historical awaited v2 ClawHub child can stage most packages before one\n  failure makes its parent fail, preventing finalization of staged siblings.\n  New publication keeps that failure isolated to the ClawHub lane.\n  Reconcile the original child's `*-publish-json` artifacts before any\n  republish or parent resume. Use\n  `pnpm release:clawhub-recovery -- --version \u003Cversion> --reason '\u003Cparent failure>' --clawhub-source \u003Cisolated pinned ClawHub checkout> \u003Cpackage-publish.json>...`\n  to print exact attempt recovery commands; see the publication recovery guide\n  for the pinned source CLI and authorized execution. Public version 404s do\n  not distinguish staged from missing, and attempt status needs publisher\n  authentication. Parent receipts and live-authority revalidation remain\n  required; recovery does not turn a failed parent into successful evidence.\n- Before npm child dispatch the parent sweeps selected npm publishers for a\n  failed earlier parent's `waiting`\u002F`queued` children of the same release (core\n  by the `parent=\u003Crun>\u002F\u003Cattempt>` run title; plugin npm by the release SHA, only\n  while no other publish parent is live). The independent ClawHub lane owns\n  its corresponding sweep. Each owner attempts gate rejection and cancellation,\n  then waits up to 5 minutes per workflow.\n  Rejection denied with 403 needs a reviewer; logs and the step summary include\n  the reject\u002Fcancel commands. Unconfirmed cancellation warns. Core npm has an\n  independent publish slot and rechecks its live parent, so it does not block;\n  plugin npm retains its target-serialized slot and refuses before a new dispatch\n  if cancellation remains unconfirmed. ClawHub reconciliation, serialized slots,\n  and dispatch guards run only in its independent lane; none holds npm dispatch\n  or core completion. Do not cancel authorized ClawHub work merely because its\n  original core parent failed. A core parent failure cancels its own waiting npm\n  children. A detached ClawHub parent failure rejects its recorded child's pending\n  gate before cancellation; an unconfirmed rejection warns with reviewer commands.\n  To clean up a confirmed stale, no-longer-authorized child as a reviewer, list\n  `workflow_dispatch` runs by `github-actions[bot]` created for this release,\n  reject their gate, cancel:\n\n  ```bash\n  for s in waiting queued; do gh api \"repos\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns?status=$s&per_page=100\" \\\n    --jq '.workflow_runs[] | select(.event==\"workflow_dispatch\" and .actor.login==\"github-actions[bot]\") | select(.name | test(\"plugin-clawhub|Plugin NPM Release|openclaw-npm-release\")) | [.id,.name,.created_at] | @tsv'; done\n  env_id=$(gh api repos\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns\u002F\u003Cchild>\u002Fpending_deployments --jq '.[0].environment.id')\n  gh api -X POST repos\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns\u002F\u003Cchild>\u002Fpending_deployments \\\n    -f state=rejected -f comment=\"Reject stale release gate\" -F \"environment_ids[]=$env_id\"\n  gh run cancel \u003Cchild> --repo openclaw\u002Fopenclaw\n  ```\n\n- `gh run rerun --failed` on a plugin npm child fails its attempt-bound\n  preflight artifact readback. The parent waits for the original child to\n  settle and propagates its failure without dispatching a replacement.\n  Diagnose and fix the failed owner before explicitly recovering publication;\n  preserve successful immutable packages and evidence.\n\n### Extended-stable validation\n\nUse the same candidate-owned helper for `.33+` extended-stable validation:\nC is the exact frozen branch tip, Q=C owns its complete qualification closure,\nand independently trusted P admits and verifies it. The canonical\n`extended-stable\u002FYYYY.M.33` branch supplies context, not workflow authority.\nDeliberately backport missing contracts before freezing C.\n\n```bash\nVALIDATION_SHA=\"\u003Cexact-candidate-sha>\"\nPUBLISHER_SHA=\"\u003Crecorded-full-trusted-main-ancestor-sha>\"\nCONTEXT_REF=\"extended-stable\u002FYYYY.M.33\"\npnpm ci:full-release \\\n  --sha \"$VALIDATION_SHA\" \\\n  --target-ref \"$CONTEXT_REF\" \\\n  --admission-workflow-sha \"$PUBLISHER_SHA\" \\\n  --admission-workflow-ref main \\\n  -f validation_purpose=publish \\\n  -f publication_selection_json='{\"route\":\"extended-stable\",\"npmDistTag\":\"extended-stable\",\"publishOpenclawNpm\":true,\"pluginPublishScope\":\"all-publishable\",\"plugins\":[]}' \\\n  -f release_profile=stable \\\n  -f run_release_soak=true \\\n  -f fail_fast=false \\\n  -f rerun_group=all \\\n  -f reuse_evidence=false \\\n  -f dispatch_release_evidence=false\n```\n\nThe helper captures qualification baselines from npm before admission. An\nextended-stable candidate's primary upgrade baseline, used by cross-OS upgrade\nand the upgrade survivor lanes, is the newest published extended-stable\nrelease below it (2026.8.35 for 2026.9.33); the survivor set also keeps the\nfrozen month's newest stable predecessor (2026.9.9). Upgrades between\nextended-stable releases run the old updater's real `extended-stable` selector\nagainst the loopback candidate registry, never an explicit `--tag`.\n\nOnly the helper creates the immutable `release-ci\u002F\u003CQ-prefix>-\u003Ctimestamp>`\ntransport after admission. Never raw-dispatch, manually create its ref, or mint\na protected publication tag for Q. Reconcile an existing historical cross-revision\npublish request under its original identity; never relabel it as candidate-owned.\nA new explicit main\u002Fprotected route is diagnostic, main-qualification, or\npostpublish-confidence only and cannot replace this admitted Q=C publish proof.\n\nAccept only a complete `rerun_group=all` run with a supported exact-target\nmanifest. Bind its workflow SHA separately from the candidate SHA; require the\nmanifest target, package versions, saved `run_attempt`, and final tag to identify\nthe same candidate. Reject narrow runs, untrusted tooling, mismatched targets,\nand earlier-attempt evidence.\n\nThe all-group parent prepares core and selected plugin npm tarballs itself and\nrecords their immutable descriptors in `publicationArtifacts`. Publication\nmust consume those exact artifacts and attempts. A standalone npm or plugin npm\npreflight is diagnostic-only and cannot replace the manifest-bound evidence.\n\nProduct failures need an approved backport. Frozen-target tooling failures need\nthe smallest behavior-preserving repair. Provider, approval, runner, or log\nraces keep the candidate unchanged. Record repairs and superseded runs; any\nbranch change requires a new complete parent. Omit only an explicitly\nunsupported frozen-target scenario, never a required behavior or package.\n\n### Frozen-target test omissions\n\nUse `plugin_prerelease_node_exclude_patterns_json` only for exact `src\u002Fplugins\u002F`\ntest paths in the Plugin Prerelease Node lane. Use\n`extension_test_exclude_patterns_json` for exact `extensions\u002F` test paths in\nPlugin Prerelease extension shards. Normal CI does not own that sweep. Both\ndefault to `[]`; there is no implicit\nCodex omission. Pass JSON arrays at initial dispatch, retain the justification\nand owning fix, and report omitted coverage as not run.\n\nPreflight must discover every requested path in the selected frozen-target\nlane; nonexistent, out-of-lane, duplicate, basename, or glob inputs fail loudly.\nTrusted tooling applies exact exclusions to inline Vitest leaves while\npreserving candidate runtime preparation and restores original config bytes\nafter the shard command. Do not substitute CLI `--exclude` or a new target-side\nenvironment variable: frozen inline projects may ignore them. Inputs remain in\nthe immutable request, coverage\u002Freuse identity, and final manifest; changing\nthem requires a new request, never continuation.\n\n## Watch\n\nWatch children with the attempt-aware controller:\n\n```bash\npnpm frv watch --run \u003Cfull-release-run-id>\n```\n\nIt resolves child run IDs from the parent's dispatch-job log lines\n(`Dispatched \u003Cworkflow>: \u003Curl> (attempt N)`), never from display titles, and\nreports each parent and child attempt transition and each failed job once, with\nrunner labels. Transient GitHub 5xx or HTML\nerror bodies are retried on the next poll, never reported as job results.\nState lives in `$TMPDIR\u002Fopenclaw-frv\u002F\u003Crepo>-\u003Cparent>-watch.json` (`--state`\noverrides), so a restart after a harness or Monitor timeout does not re-report.\n`--once` takes one snapshot, `--interval \u003Cseconds>` sets polling (default 60),\nand `--json` prints NDJSON. It exits with code 1 on a newly observed current\nparent\u002Fartifact-producer blocker or a policy-blocking carried child failure,\nafter saving the notification. Resume with the same command and state to keep\nfollowing diagnostics without repeating that blocker. Otherwise, it exits once\nthe parent and every dispatched child are terminal; restart it after a later\nrerun. Use `status` for structured blockers and preview recovery with\n`continue --failed --dry-run`. Do not hand-roll bash or `gh`\nwatchers.\n\nWatch candidate events derive the frozen SHA and context ref from the sealed\nexecution plan, not monitor scratch prose or the parent's tooling SHA. The tip\nis read freshly; a changed tip labels that candidate superseded without stopping\nobservation or claiming qualification of the new tip. Missing evidence or a\nSHA-only context stays unknown. Resume a missing or exited watcher with the same\ncommand and state path: it performs reads only and suppresses already reported\nterminal and candidate events. Never redispatch merely to restore a watcher.\n\nFor the parent's Release Decision, use the transition-only summary watcher:\n\n```bash\nnode scripts\u002Frelease-ci-summary.mjs \u003Cfull-release-run-id> --watch\n```\n\nDo not start this watcher when the SHA-pinned helper is still the foreground\nowner. The helper reads the exact Release Decision artifact itself. On\n`blocked_diagnostics_running`, it exits nonzero immediately, keeps the temporary\nworkflow ref, and leaves Diagnostic Drain collecting the remaining terminal evidence.\nThe watcher behaves the same way for separately dispatched parents: it reports\nthe Release Decision blocker once and exits while the drain continues.\n\nFor a one-shot snapshot:\n\n```bash\nnode scripts\u002Frelease-ci-summary.mjs \u003Cfull-release-run-id>\n```\n\n`release-ci-summary` accepts Full Release Validation parent runs only.\nDiverged release-branch logs: `--first-parent` plus a bounded count.\nStop watchers before ending the turn or switching strategy.\n\nFor PR and child gates, read the exact workflow run, not the commit's check-run\nlist: `commits\u002F\u003Csha>\u002Fcheck-runs` keeps entries from superseded or cancelled\nruns for the same head, so a stale `cancelled` or `failure` can mask a newer\nsuccess. Resolve the newest `CI` run for the head (`actions\u002Fruns?head_sha=\u003Csha>`)\nand read `openclaw\u002Fci-gate` from that run's jobs before retrying or reporting.\n\nInterpret state precisely:\n\n- `qualifying`: no decisive blocker yet; selected children are still active.\n- `blocked_diagnostics_running`: publication is blocked; Diagnostic Drain is\n  still collecting independent failures. Diagnose now and use `frv rerun` or\n  `continue --failed` when the failed child is terminal; final parent resealing\n  still waits for complete evidence.\n- `passed`: all required policy and exact-child evidence passed.\n- `blocked_complete`: publication is blocked and all selected diagnostics are\n  terminal.\n- `orchestration_error`: GitHub API or collector failure prevented a verdict.\n  This does not mean the wrong source was used. Recover the collector against the same\n  exact children; never redispatch tests to repair collection.\n- `cancelled_with_children`: the collector was cancelled while exact children\n  remained active.\n\nRead every selected lane's actual conclusion. `passed` requires every selected\nvalidation lane to satisfy pinned P's policy, with terminal evidence and raw\nwaived failures retained; omitted coverage is not run, never passed.\n\nThe `full-release-diagnostics-\u003Crun-id>-\u003Cattempt>` artifact is the terminal\nfailure and timing manifest. Use it after an early blocker instead of\nrestarting `all` merely to discover what the still-running children found.\nThe stable `full-release-execution-plan-\u003Crun-id>` artifact is the identity\nsource within each collector attempt; retry attempts restore its immutable\nrun-ID-cached bytes first.\n\n## Failure Triage\n\n1. Confirm parent SHA and child run IDs.\n2. List failed jobs with `pnpm frv watch --run \u003Cparent> --once`; it prints each\n   failed job with its attempt, runner labels, and URL.\n3. Fetch one failed job log. If rate-limited, note reset time and avoid more REST calls.\n4. For secret-looking failures, validate a real completion from the same secret source before editing code. A successful model-list request is insufficient.\n   Claude CLI subscription credentials are a separate native auth path; prove\n   them in a clean-home CLI probe, never as a substitute for a required\n   Anthropic API-key lane.\n5. For live-cache failures, inspect whether it is missing\u002Finvalid key, empty text, provider refusal, timeout, or baseline miss. Do not weaken release gates without clear provider evidence.\n6. Decide blocker or flake for each failed test before editing. A flake requires\n   a passing occurrence of the same job or signature on this exact Release SHA.\n   First preserve the failing diagnostics, inspect every same-SHA attempt, and\n   run `git log \u003Cprevious-release-tag>..\u003Crelease-sha> -- \u003Cfailing paths>` for\n   the candidate delta and `git log \u003Crelease-sha>..origin\u002Fmain -- \u003Cfailing paths>`\n   for main-only changes. If `main` contains a repair absent from the frozen\n   candidate, treat the failure as a blocker and backport or supersede; do not\n   rerun it as inherited success. A signature repeated on another candidate is\n   deterministic until a named mechanism and fix prove otherwise. Track a fix\n   for genuine flakes on `main`; every unwaived selected job must still pass before\n   publication under pinned P's policy. Classify blockers further:\n   - confirmed product\u002Fcode failure: fix the release branch, freeze a new Code\n     SHA, and invalidate product evidence\n   - qualification harness\u002Fcontract defect: repair the candidate closure and\n     freeze new C\u002FQ; preserve the superseded evidence and its invalidation reason\n   - P-only admission\u002Fverifier\u002Fpublisher defect: preserve C\u002FQ and original\n     artifacts, repair independent trusted P, and recover the affected surface\n   - infrastructure\u002Fcredential failure: keep C\u002FQ\u002FP, repair the external\n     prerequisite, and retry only the failed surface\n   - wrapper\u002Fmonitor failure: keep the child and candidate identities; record\n     the wrapper result separately from the child result\n   - changelog\u002Frelease-note failure: change only the selected release entry and\n     permitted record\u002Findex paths under `split-changelog-release-v1`, keep Code SHA\n     evidence, and repeat Release SHA proof\n   - publish child\u002Fregistry selector failure: keep Release SHA and resume the\n     failed child; never rebuild an immutable version that already published\n   - parent failed after core npm published (for example a stale `beta`\n     dist-tag failing the completion verify): retain the successful original\n     npm run and qualified bytes, repair the selector, and reconcile the exact\n     failed parent's children before resuming the selected publication route.\n     Direct finalization normally waits for npm and Docker verification; the\n     prepared button also retains its required core checks, but neither route\n     waits for ClawHub downloads. Do not manually un-draft a release to bypass\n     required core gates. Follow\n     [publication recovery](..\u002Frelease-openclaw-maintainer\u002Freferences\u002Fpublication-recovery.md#published-version-failed-parent)\n     for direct resume or a new prepared button run.\n   - child stuck `waiting`, ClawHub `Artifact not found`, or parent failing\n     `ClawHub dispatch blocked by waiting run`: see [Publish children](#publish-children)\n     Only product or qualification-harness defects change C\u002FQ. After one diagnosis\u002Ffix\u002Fnarrow\n     retry, reassess instead of starting another all-group cycle.\n7. Runner routing: FRV-dispatched CI and Plugin Prerelease children always run\n   hosted `ubuntu-24.04` (or the release runner group). Other release lanes\n   follow `OPENCLAW_CI_RUNNER_BACKEND`, so a flip to `github` during a Blacksmith\n   outage moves them to hosted runners, except the QA Lab runtime-pair lane: it\n   fails on hosted runners and stays pinned to Blacksmith, queuing through an\n   outage. Release Checks prints a `Release runner routing` notice while the\n   flip is active. Codex extension tests run as file-bounded Plugin Prerelease\n   jobs because one hosted Codex batch took 36-60 minutes.\n   If npm preflight keeps losing Blacksmith runners, dispatch a fresh FRV with\n   `-f npm_preflight_use_github_hosted_runners=true` instead of flipping the\n   repo-wide variable.\n8. If a required PR CI run is capacity-stalled with queued jobs and no active\n   jobs, do not cancel unrelated work or accept a generic manual dispatch.\n   First verify the PR head carries the current fallback schema:\n   `gh api 'repos\u002Fopenclaw\u002Fopenclaw\u002Fcontents\u002F.github\u002Fworkflows\u002Fci.yml?ref=\u003Cpr-head-branch>'\n   --jq .content | base64 --decode | rg -q 'pull_request_number:'`. If absent,\n   refresh the PR head from `main` and use the new head SHA; let normal CI run\n   before considering another fallback.\n   From the PR head branch, dispatch the explicit exact-SHA fallback:\n   `gh workflow run ci.yml --repo openclaw\u002Fopenclaw --ref \u003Cpr-head-branch> -f\n   target_ref=\u003Cfull-pr-sha> -f pull_request_number=\u003Cpr-number> -f\n   include_android=true -f release_gate=true`.\n   It runs on GitHub-hosted runners and is accepted only when its run title is\n   `CI release gate \u003Cfull-pr-sha>`. Record the stalled Blacksmith run and the\n   fallback run in release evidence.\n   If `Blacksmith Build Artifacts Testbox` is the only remaining required gate\n   and remains queued without a runner, that completed exact fallback may cover\n   it because CI's `build-artifacts` job already builds, packages, and smoke\n   tests the artifacts. Do not use this coverage after the artifact workflow\n   starts or completes non-successfully.\n\n## Evidence\n\nRecord:\n\n- release lifecycle ledger: Code SHA and Release SHA for regular releases;\n  canonical branch, exact SHA, and immutable tag for extended-stable; C\u002FQ\u002FP,\n  original admission descriptor, and retained request for either track\n- evidence-reuse policy, coverage policy, and complete changed-path set\n- active full parent run URL, attempt, workflow SHA, and any superseded parent\n  with the exact replacement reason\n- selected child run IDs and conclusions: CI, Release Checks, Plugin Prerelease, NPM Telegram, Product Performance; record deferred confidence as not run\n- exact core and plugin npm publication artifact descriptors from the terminal manifest\n- all selected lane conclusions, including Linux\u002FWindows\u002FmacOS cross-OS\n- performance comparison result versus earlier releases when available\n- targeted local proof commands\n- frozen-target compatibility repairs or omitted inapplicable scenarios, with\n  their source PRs and invariant\n- hosted proof and its deployment prerequisites separately from local contract\n  tests; mocks do not prove Actions admission, OIDC, environment access, or publication\n- known gaps or unrelated failures\n\nFor lessons and recovery patterns, read `references\u002Frelease-ci-notes.md`.\n","# OpenClaw Release CI\n\nUse this with `$release-openclaw-maintainer` and `$openclaw-testing` when a release candidate needs full validation, install\u002Fupdate proof, live provider checks, or CI recovery.\n\n## Guardrails\n\n- No version bump, tag, npm publish, GitHub release, or release promotion without explicit operator approval.\n- After compaction, resume, or new steering, rewrite the effective goal and\n  current phase from the latest explicit operator instruction. Do not merge old\n  scope back into the active release.\n- Hold the release scope once a release branch or Code SHA exists. Validate and\n  ship that exact release; do not turn moving `main` into a second work queue.\n- Record **C (candidate), Q (test qualification), P (admission\u002Faggregate\u002Fverifier\u002Fpublisher),\n  rerun group, profile, effective soak, and context\u002Ftransport refs**. New\n  candidate test qualification defaults to Q=C, including the complete workflow,\n  reusable workflow, local action, script, planner, contract, and coverage closure.\n  Code SHA and Release SHA remain lifecycle roles, not extra workflow identities.\n- The candidate helper accepts an absent release tag or an existing lightweight\n  or annotated tag resolving to the exact candidate SHA. A conflicting tag or\n  failed remote lookup stops validation; never move a tag to recover.\n- Freeze C\u002FQ and independently select trusted P on main or a protected\n  publication tag. C\u002FQ need not be an ancestor of P. Missing candidate contracts\n  require a deliberate backport; never silently substitute newer main tooling.\n- Apply a release firebreak after the Code SHA is frozen. Admit only confirmed\n  product defects, wrong or unverifiable package bytes, security\n  defects, or failures that make publication impossible. Queue other findings\n  for postpublish confidence or the next beta. Dependency advisories are never\n  firebreak admissions: record them as release evidence and queue the bump on\n  `main` after publication; only known malware stops publication.\n- Frozen CI children use Q's Node shard planner and measured\n  costs, while discovering and executing tests from the candidate checkout.\n  Hosted full-release plans split measured rows above 12 minutes; preserve file\n  coverage, worker limits, and complete timing generations. An indivisible\n  over-budget owner must be split rather than increasing the release budget.\n  After the child completes, closeout runs `scripts\u002Fci-shard-timings-refresh.mts`\n  for that exact run and commits generated costs; do not hand-edit measurements.\n- Candidate tests run their own frozen Q closure; admitted P owns FRV's aggregate\n  decision and checked-in waiver policy. Main-only checks and\n  future-main scenarios are not implicit release requirements. Fixing a frozen\n  qualification harness means a new C\u002FQ, with newly bound evidence. A P-only\n  admission\u002Faggregate\u002Fverifier\u002Fpublisher repair can keep C\u002FQ and their original evidence.\n- Protected lightweight `release-publish\u002F\u003C12sha>-\u003Cprovenance-run>` tags identify\n  P, not Q. The suffix records tag-creation provenance, not the current parent.\n  Publication helpers retain their `--workflow-sha \u003CP>` argument; the FRV helper's\n  `--workflow-sha` instead selects Q and must equal C on the candidate route.\n- Touch `main` only for an operator-requested change or the smallest critical\n  main-owned blocker that prevents this release and cannot be handled from the\n  release branch. Main's CI health never gates a release. If a release-tooling\n  landing is blocked by `main` failures it does not cause, prove on a clean\n  `main` checkout that the failure already exists there, record it in the PR\n  body, and merge; during an active release an admin merge is allowed for that\n  exact case. A separate lane fixes red `main` in parallel, off the release's\n  critical path.\n- Land tooling-only fixes on `main` with the `release-fast-lane` label added\n  before the push (see [Release tooling fast lane](#release-tooling-fast-lane)): `openclaw\u002Fci-gate`\n  then runs lint, types, guards, dependencies, docs, and the changed Node rows\n  only. Land through the [native maintainer workflow](..\u002Fopenclaw-pr-maintainer\u002Freferences\u002Flanding.md).\n  That workflow owns review and landing requirements, including the advisory\n  ClawSweeper policy; the label changes only CI selection.\n- `OPENCLAW_RELEASE_RUNNER_GROUP` optionally routes validation parents and workers\n  and the Release Publish parent plus its publish children to reserved capacity\n  with unchanged labels; credentialed publish and approval jobs stay on default\n  GitHub-hosted labels. Configure eligible runners and repo\n  access first; unset preserves ordinary routing. Shared workers inherit the\n  caller group; PR\u002Fmain CI and unrelated scheduled work remain outside it.\n- Check the nightly parent for the Code SHA before dispatching a fresh main validation; it seals per-child receipts that exact-target dispatches adopt when inputs match. The nightly runs this explicit trusted-main helper route (`--sha \u003Cmain-sha> --workflow-sha \u003Cmain-sha> --trusted-workflow-ref main`), so its parent runs on a `release-ci\u002F\u003Csha12>-\u003Cid>` branch, not `main`.\n- FRV must conclude success under pinned P's\n  [checked-in waiver policy](..\u002F..\u002F..\u002Fdocs\u002Freference\u002Ffull-release-validation\u002Fevidence.md#release-tooling-waivers);\n  all other required lanes must pass. See\n  [Publication requirements](#publication-requirements). Stable tags require stable\u002Ffull\n  evidence, soak, and blocking performance. Beta-profile evidence cannot qualify\n  stable. Soak remains mandatory; performance exceptions are limited to the\n  checked-in policy. All-group\n  qualification requires all nine Linux\u002FWindows\u002FmacOS Gateway install\u002Fupgrade\n  combinations. Preserve first failures, identity, and complete evidence.\n- Selected npm plugins must publish successfully before core npm. ClawHub starts\n  at its existing dispatch point and runs independently thereafter; planning,\n  authorization, dispatch, publication, verification, and recovery never block\n  core, GitHub finalization, main closeout, or the retrospective PR. Record a\n  separate owner, exact run\u002Fattempt, status, and next action for ClawHub.\n- Native macOS, Windows, Linux, and Android publication is independent of\n  npm\u002FClawHub, GitHub finalization, and main closeout. Each platform retains\n  its own signing, qualification, artifact, and updater requirements; report\n  pending platforms accurately and repair native-only failures in parallel.\n- Do not set GitHub secrets from unvalidated 1Password candidates. If a candidate returns 401\u002F403, leave the existing secret alone and report the exact missing provider.\n- Use `$one-password` for secret reads\u002Fwrites: one persistent tmux session, targeted items only, no secret output.\n- Watch one parent run with `pnpm frv watch --run \u003Cparent>` (see [Watch](#watch)).\n  Avoid broad `gh run view` polling loops; REST quota is easy to burn.\n- Fetch logs only for failed or currently-blocking jobs. If quota is low, stop polling and wait for reset.\n- Treat live-provider flakes separately from code failures: prove key validity, provider HTTP status, retry evidence, and exact failing lane before editing code.\n- When diagnosing a live-provider failure, a model-list response proves\n  authentication, not billing or inference entitlement. Confirm the credential\n  with a real completion probe before treating it as valid. Fix the credential\n  first; do not add an alternate auth path merely to bypass a failed release\n  credential.\n- Full Release Validation separates exact-child dispatch, Release Decision,\n  and Diagnostic Drain. With `fail_fast=false`, it makes zero child\n  cancellation calls; Diagnostic Drain follows every selected child to\n  terminal unless the collector itself is cancelled or loses GitHub API\n  access. With\n  `fail_fast=true`, Release Decision may cancel only the exact still-active\n  child that owns a blocking failure.\n- Same-parent continuation requires the original root to have been dispatched\n  with `fail_fast=false`. The controller verifies that exact logged input\n  before any rerun mutation.\n- A parent that produced its own sealed candidate artifacts cannot be continued:\n  GitHub reruns make those prior-attempt artifacts unavailable. Keep the\n  candidate and qualification SHAs frozen, supersede that parent, and start a fresh\n  all-group Full Release Validation.\n- After dispatch, one immutable execution-plan artifact records the original\n  parent attempt, exact child tuples and titles, selected coverage, gates, and\n  reuse identity. The same bytes are saved under an exact run-ID cache key.\n  Decision, Drain, manifest writing, evidence validation, and final verification\n  consume the artifact for their current attempt. A collector retry restores\n  the cached plan, validates it, re-uploads its artifact, and adopts the same\n  children; missing plan state is an orchestration failure, not permission to\n  reconstruct the plan or redispatch.\n- Reused evidence is not trusted merely because plan sealing found it. Release\n  Decision repeats the sealed target SHA, evidence SHA, policy, changed paths,\n  selected run, root run, source manifest, trusted tooling identity, and\n  exact-child checks before returning `passed`.\n- Parent retries select the newest Decision and Drain artifacts independently;\n  both must bind the same immutable plan even when their source attempts differ.\n- Child retries are part of the same immutable plan only when the child run ID,\n  workflow path, ref, Q SHA, dispatch title, event, target, candidate, and\n  validation inputs remain exact. Newer child attempts replace matching jobs;\n  jobs absent from a newer attempt carry forward. A duplicate job identity,\n  missing attempt, regressed attempt, or changed tuple fails closed. `frv status`\n  and `continue` allow up to 60 seconds of read-only reconciliation when GitHub\n  temporarily returns duplicate jobs in the newest retry attempt. The run tuple\n  and attempt stay pinned; persistent duplicates and older-attempt conflicts\n  remain errors.\n- Use `pnpm frv status|watch|rerun --job|rerun --child|continue --failed|verify` for attempt-aware recovery.\n  The controller is stateless: the immutable execution plan, exact GitHub run\n  attempts, Diagnostic Drain, and final manifest are the only authorities. It\n  never writes a tag, package, registry entry, release candidate, or\n  publication.\n- Post-merge controller proof must use the reviewed landed SHA on protected\n  `main` through the non-release `FRV Proof Broker` and `FRV Proof Fixture`.\n  Dispatch the broker with the merged pull request number and exact landed\n  commit. The broker must require that pull request's merge commit to match the\n  landed commit, prove the landed commit is identical to or an ancestor of its\n  trusted workflow SHA, and repeat authority, merge, and ancestry checks\n  immediately before rerunning the fixture.\n  Require the exact fixed no-op fixture run to advance from its intentional\n  attempt-one failure to an attempt-two pass. The broker must emit its receipt\n  without creating a release candidate, release artifact, publication,\n  repository ref, replacement parent, or other workflow mutation. This is the\n  hosted GitHub targeted-job rerun proof; focused controller tests own immutable\n  plan eligibility, green-attempt preservation, same-parent collection, and\n  strict-verifier invocation. Never use a real Full Release Validation run for\n  this proof. See\n  [Full Release Validation](\u002Freference\u002Ffull-release-validation#post-merge-continuation-proof).\n- Use one release operator, one `frv watch`, and at most one\n  investigator for the current failed surface. Do not build audit-review-plan\n  trees around a single workflow transition.\n- For regular beta\u002Fstable releases, Code SHA may already contain final notes\n  and serve as Release SHA. One successful fresh full parent may qualify both\n  roles and their exact publication bytes. If notes change afterward, a later\n  Release SHA may reuse product evidence only when its complete delta from\n  Code SHA changes the selected `CHANGELOG\u002FYYYY.M.PATCH.md` and optionally\n  `CHANGELOG.md` and `CHANGELOG\u002Frecords\u002FYYYY.M.PATCH.md`, with no other paths,\n  renames, or deletions; its changed bytes still need qualification.\n- Extended-stable validates one exact branch tip; it does not reuse the regular\n  Code-SHA\u002FRelease-SHA evidence model.\n- In a sparse worktree or Testbox source sync, first confirm `package.json`,\n  `pnpm-lock.yaml`, and every source path the selected check reads. If any are\n  absent, that checkout cannot validate a release dependency or Docker lane:\n  stop and use the repo remote changed gate or a full task worktree. When the\n  inputs are present and a release fix changes `package.json` or\n  `pnpm-lock.yaml`, rebuild only the task-owned disposable box with\n  `CI=true pnpm install --frozen-lockfile`, then run an explicit\n  `require.resolve()` probe before Docker or focused tests. The CI flag permits\n  pnpm to recreate a prewarmed modules directory without an interactive\n  confirmation. Do not weaken the lockfile or label sparse-checkout failures\n  as product\u002FDocker failures.\n- If the candidate is rebased or its base SHA changes after warmup, stop the\n  task-owned box and warm a fresh one before testing. Testbox source sync is\n  relative to the warmed source tree; continuing can mix an old base file with\n  a new candidate diff and produce false lockfile or Docker failures.\n- Reused Testboxes are checked against their recorded source after their first successful run.\n  Source-only edits may reuse the lease; base, dependency, wrapper, or Testbox\n  workflow drift requires a fresh lease. Do not set\n  `OPENCLAW_TESTBOX_ALLOW_STALE=1` for release evidence.\n- For a committed release candidate with the supported capsule-aware wrapper,\n  run `node scripts\u002Fcrabbox-wrapper.mjs run --blacksmith-ref main -- \u003Ccommand>`\n  from that candidate's checkout when using Testbox. The capsule preserves\n  candidate source and frozen dependencies while `main` supplies current\n  admission limits. If the candidate lacks that wrapper contract, use the\n  exact-target release-validation route below with separate Validation and\n  Tooling SHAs. Do not dispatch candidate Testbox workflow refs or borrow\n  another checkout's wrapper.\n\n## Keep FRV off the idle path\n\nOptimize time to the next **passing** Full Release Validation. Remote FRV is\nusually the long pole; use its runtime for diagnosis, repairs, review, and\nfocused proof. This is scheduling guidance, not a new checklist, approval step,\nor demand for certainty before dispatch. Existing release gates still apply.\n\n- **Start remote qualification promptly.** Favor starting remote FRV while\n  useful local checks run alongside it, rather than finishing those checks\n  first. If the remote run passes, that overlap saves an entire cycle; if local\n  work finds a defect, the run can be superseded through the existing recovery\n  path. Uncertainty alone is not a reason to leave remote validation idle.\n- **Repair as failures arrive.** Use the watcher to spot failures and start\n  diagnosis and fixes while other lanes drain. Prioritize known non-flake\n  failures over optional confidence checks. Use independent repair lanes when\n  helpful, and integrate fixes as they become ready rather than waiting for\n  the final diagnostic report to start work.\n- **Aim to be ready when diagnostics finish.** Ideally, fixes for the drained\n  failures are already on the branch, with focused proof and review done, by\n  drain completion. This is an overlap goal, not a deadline or another gate.\n  If a repair takes longer, keep working it; avoid filling the gap with\n  redundant checks or process overhead.\n- **Fix the whole known set before the next FRV.** Include fixes for every\n  known non-flake failure affecting the next run, whether in the candidate,\n  qualification harness, or trusted tooling. The waste to avoid is knowingly\n  launching another full cycle with failure B still unfixed after fixing A.\n  This does not mean proving there are no undiscovered failures or resolving\n  unrelated issues before running again.\n- **Use retries strategically.** An eligible targeted retry can run while\n  unrelated diagnostics continue. Use the existing\n  [retry budget](#run-identity-and-retry-budget) for flakes or repaired external\n  prerequisites and retain valid green evidence. A repeat of an unchanged\n  deterministic failure buys little; fix it instead. When a fresh parent is\n  needed, include the known fixes and get it running without optional delays.\n\n## Deferred CI recovery\n\nRelease validation does not pause CI or supporting workflows. The legacy\n`OPENCLAW_RELEASE_PRIORITY_RUN` variable is ignored by current workflow\nadmission, and `pnpm frv prioritize --run` is retired. Use\n`pnpm frv prioritize --restore \u003Crecord>` to recover runs deferred by older\nworkflow revisions and clear their variable.\nKeep the required publication proofs and soak gates intact.\n\n## Continuous release readiness\n\nThe scheduled main validation (every 3 hours at :07 UTC) seals a direct-root manifest and per-child receipts for the exact main SHA.\nFor a same-day cut, land the release train on `main` (version and changelog) before the next scheduled run,\nthen cut `release\u002FYYYY.M.PATCH` at that run's SHA so the Code SHA equals the validated SHA.\nPer-child adoption matches exact target SHA, role, and dispatch inputs minus `dispatch_id`:\n`productPerformance` is adopted because its inputs are context-free and match.\nA stable candidate dispatched with `--target-ref release\u002FYYYY.M.PATCH` resolves\n`coveragePolicy=npm-stable-v1` and `ci_release_scope=npm-stable`, versus `full` scope on `main`.\n`normalCi`, plugin prerelease, and release checks are re-dispatched because their inputs add\n`target_context_ref`, plugin prerelease and release checks add `allow_frozen_target_scenario_omissions=true`, and scope differs.\nWhole-parent adoption requires byte-identical manifest `validationInputs`, including `validationPurpose`,\n`publicationSelectionJson`, `targetContextRef`, `targetVersion`, `allowUnreleasedChangelog`, and `coveragePolicy`;\na `main-qualification` nightly is never adopted wholesale by a `publish`-purpose stable candidate.\nPurpose\u002Fcontext-crossing adoption is a verifier policy follow-up.\n\n## Release tooling fast lane\n\nAdd the `release-fast-lane` label to a pull request before the push that should\nuse it; PR CI reads labels from the triggering event, and label events do not\nstart CI. For an already-pushed head, `gh pr ready --undo` then `gh pr ready`\nre-triggers PR CI with the current labels. The label narrows `openclaw\u002Fci-gate`\nonly on a canonical pull request whose changed paths are all release tooling:\n`.github\u002Fworkflows\u002F**`, `scripts\u002F**`, `test\u002Fscripts\u002F**`,\n`.agents\u002Fskills\u002Frelease-*\u002F**`, `docs\u002Freference\u002FRELEASING.md`, or independently\nchecked documentation. Admitted runs keep `security-fast`, `check-shard` (lint,\nprod\u002Ftest types, guards, dependencies, npm lock), `check-docs` when docs\nchanged, and the changed Node rows; the compact packing-policy full-plan proof\nfor planner edits is relaxed to those rows. Contracts, baseline ratchets,\nbundled protocol, Bun launcher, additional checks, build artifacts (unless a\nchanged row needs `dist`), Control UI, Windows, macOS, iOS, Android, i18n, and\nskills lanes are skipped and listed under \"Release fast lane\" in the preflight\nstep summary. A declined label (out-of-scope path, global Node input, fork,\npush, dispatch, docs-only) logs a warning and leaves ordinary selection\nuntouched. The gate stays complete: every selected lane must pass, and hourly\nfull main CI covers the merged result. The label narrows only the CI gate: fork\nheads are declined, and the [native maintainer workflow](..\u002Fopenclaw-pr-maintainer\u002Freferences\u002Flanding.md)\nstill owns review and landing requirements.\n\n## Run identity and retry budget\n\nRecord C, Q\u002Fref, P\u002Fref, target context ref, parent run id,\nattempt, and phase before watching or recovering Full Release Validation. Keep\nCode SHA and Release SHA as lifecycle roles in the ledger; they may name the\nsame commit. Record the\nimmutable Release Publish parent receipt separately from the tag's recorded source.\n\nFor the core and plugin npm mutations enforced by this foundation, re-read the\nexact protected lightweight tag and revalidate the exact parent run tuple\nimmediately before each publish or dist-tag mutation. Reject a missing, moved,\nannotated, or wrong-SHA tag; a repository, workflow, run id, attempt, tooling\nidentity, or parent-state mismatch; and any same-name branch. Never refresh\neither identity from current `main`. Treat other privileged writers as blocked\nuntil their dependent enforcement changes land.\n\n- Conceptual phases map to current inputs as follows:\n  - `beta-publish`: `release_profile=beta`, `run_release_soak=false`\n  - `postpublish-confidence`: published package inputs with\n    `run_release_soak=true` or explicit focused groups\n  - `stable-publish`: `release_profile=stable` or `full`, with soak and blocking performance\n- An `all` run without soak for an actual beta package on its matching canonical\n  release branch or beta tag records `coveragePolicy=npm-beta-v1`. It keeps\n  Linux\u002FmacOS\u002FWindows Node, Control UI, plugin, package, install\u002Fupdate,\n  Linux\u002FWindows\u002FmacOS cross-OS, QA parity, runtime-pair\u002Frestart, and tool coverage.\n  All selected tests gate npm\u002FClawHub. Native app\n  CI, performance, and published-package Telegram are deferred to confidence.\n  Beta `all` without soak also defers Package Acceptance Telegram, including\n  beta-profile checks of `main`. Record deferred checks as not run,\n  never passed. Stable\u002Ffull, soak, and focused groups retain their coverage;\n  selected children still require terminal evidence. An absent coverage policy\n  retains historical full behavior.\n- Keep at most one active parent for the same C + Q + rerun\n  group + release profile + effective soak coverage. Stable\u002Ffull always include\n  soak. Distinct coverage profiles can run independently; concurrency does not\n  cancel an older exact child automatically.\n- Parent cancellation or timeout does not settle independent descendants.\n  Preview `pnpm frv cancel --run \u003Cparent> --dry-run`, then run it without\n  `--dry-run` only for explicitly requested cancellation. The canonical owner\n  authenticates the sealed plan, exact dispatch logs, current attempts, artifact\n  producers, and recorded Telegram descendants; borrowed\u002Freused children remain\n  untouched. Repeat an incomplete result with its next command. Use `--force`\n  only when an earlier cancellation is not settling. Never infer ownership from\n  branch, title prefix, or latest-run order, or dispatch a replacement before the\n  owned tree is terminal.\n- Recover one failed surface with one diagnosis, one fix when needed, and one\n  narrow retry. Then reassess the release decision. Do not automatically\n  dispatch `rerun_group=all`.\n- Rerun a failed or timed out test job only after the lead records its\n  real-blocker-or-flake decision (see the maintainer skill's shared release\n  boundaries). Call it a flake only when the same job or failure signature has\n  passed on the same Release SHA. Before rerunning, read the failure's own\n  diagnostics, inspect same-SHA attempts, and compare the failing paths against\n  the candidate delta and recent `main` history; a fix on `main` is not present\n  on the frozen candidate until ancestry or patch equivalence proves it. An\n  identical signature repeated on the same or another candidate is deterministic\n  until a named mechanism and fix prove otherwise. A flake gets at most two\n  recorded reruns on the same Release SHA plus a fix-in-parallel issue or PR on\n  `main`; never a re-cut, tooling change, or new FRV. New dispatches reject\n  `known_flaky_jobs_json`.\n- For a supported parent, `pnpm frv rerun --run \u003Cparent-run-id> --job\n  \"\u003Cchild-key>:\u003Cexact job name>\"` reruns one executed terminal job using its accepted\n  Actions job ID. Get the child key and exact name from `frv status --json`.\n  GitHub also reruns dependent jobs. The controller waits only for that child\n  before sending the request; it does not retry unrelated failures. Without\n  `--no-follow` it then follows the whole tree through the parent reseal; pass\n  `--no-follow` to return once the new attempt is observed, then run\n  `continue --failed` to reseal.\n- `pnpm frv rerun --run \u003Cparent-run-id> --child \u003Cchild-key|run-id>\n  [--max-attempts N]` records one bounded exact-job rerun. It waits for the\n  child to finish, requires exactly one blocking failed job, sends one request\n  for that accepted Actions job ID, and returns once the new attempt exists\n  without duplicate jobs. Before the request it prints the failed job's runner\n  labels and the current `OPENCLAW_CI_RUNNER_BACKEND`; afterwards it appends\n  an audit line to `$TMPDIR\u002Fopenclaw-frv\u002F\u003Crepo>-\u003Cparent>-reruns.jsonl`. It\n  refuses a passed child, an artifact producer (use `continue --failed`), a\n  child with multiple blocking failures, and a child past its attempt budget:\n  the default 2 allows one rerun; pass `--max-attempts 3` only for a confirmed\n  flake. Start a fresh all-group FRV when multiple blocking jobs fail. Reseal\n  with `continue --failed`.\n- `pnpm frv continue --failed --run \u003Cparent-run-id>` applies the same\n  exact-job restriction to each terminal failed child and failed artifact\n  producer, even while the parent or siblings remain active. It refuses\n  multi-job recovery and directs the operator to a fresh all-group FRV. It\n  adopts active attempts and preserves green children. Once every required\n  child is green and the original parent finishes, it reruns the parent once\n  to restore the same immutable plan and seal the updated all-group manifest.\n  An early retry can invalidate the original Decision\u002FDrain pairing; the final\n  reseal and strict verification own completion.\n- GitHub ghost jobs (runnerless queued copies of the same job name) can follow\n  any rerun request, single-job or batched, and make that attempt unsealable.\n  Send at most one rerun request per child, only after the child is terminal;\n  never stack separate job reruns on one child. Duplicates can settle within\n  the controller's 60-second reconciliation window; once a command reports\n  ghost jobs (duplicates that persisted), stop rerunning that FRV: cancel the\n  attempt and start a fresh all-group FRV.\n- `continue --failed` reruns each failed child once per invocation. If a child\n  it reran fails again, it exits immediately with the attempt and remaining\n  rerun budget instead of waiting for siblings; rerun `continue --failed` only\n  for a confirmed flake within the flake budget above.\n- Each child or parent rerun mutation is sent exactly once per invocation;\n  ambiguous transport failures trigger bounded read-only reconciliation. Do\n  not blindly repeat an interrupted or timed-out command: inspect exact\n  attempts first. Targeted JSON results record the job ID, accepted source\n  attempt and observed retry attempt. Keep the command in a long-running shell\n  for its default 12-hour operation budget.\n- Inspect without mutation:\n\n  ```bash\n  pnpm frv status --run \u003Cparent-run-id>\n  pnpm frv verify --run \u003Csuccessful-parent-run-id>\n  ```\n\n- Parents whose immutable plan predates attempt-aware evidence cannot be\n  continued. This legacy-plan refusal requires a fresh all-group Full Release\n  Validation parent, subject to the owned-tree settlement rules above. Preserve\n  the old receipts; never reconstruct the old state. Attempt-aware plans retain\n  their existing parent and the targeted recovery rules above.\n\n- Controller retries are `ci`, `plugin-prerelease`, `install-smoke`,\n  `cross-os`, `live-e2e`, `package`, `qa-parity`, `qa-live`, `npm-telegram`,\n  or `performance`. Never use the removed `release-checks` handle. `qa` is\n  only a direct-child manual aggregate, not a controller retry API.\n- Filtered retries fail closed unless the filter belongs to the selected group.\n  All-group runs also accept `cross_os_suite_filter`: for example,\n  `-f cross_os_suite_filter=ubuntu,macos` excludes Windows. `npm-stable-v1` and\n  `npm-beta-v1` still qualify when explicitly filtered OS lanes are omitted, provided all\n  Linux suites remain selected and the other policy requirements hold.\n  Never turn an empty derived filter into an unfiltered broad run.\n- A new all-group parent is justified only when shared orchestration changed,\n  earlier evidence is invalid for the selected tuple, or the operator explicitly\n  requests it. Record the invalidating event.\n- Narrow child or group evidence does not by itself become publish\n  authorization. Keep it in the evidence ledger for the release owner to judge\n  against the current publish gate.\n\n## Preflight\n\nBefore full matrix dispatch, run both `pnpm ui:i18n:check` and\n`pnpm native:i18n:check` against the frozen trusted target in approved isolation.\nBind both results to that exact SHA. Report generated-locale drift as a warning\nand continue dispatch; source changes and the serialized locale-refresh workflows\ncan temporarily leave generated output behind. Do not require regeneration before\nstarting validation. FRV's normal-CI child retains the strict `control-ui-i18n`\nand `native-i18n` jobs and reports their actual results in the run summary;\na failed selected locale job blocks npm\u002FClawHub publication. PR-side checks and\nrelease-prep gates stay unchanged. Keep target execution outside the trusted\ndispatch helper—do not execute an arbitrary target checkout as helper code.\n\nBefore expensive full validation, also run `pnpm ui:build` on the same frozen\ntrusted target with its frozen dependencies in approved isolation, outside the\ntrusted dispatch helper. Record the target SHA with the successful production\nbuild, precompressed-asset verification, and startup\u002Flargest-asset budget results;\nany failure blocks fanout. Do not substitute a dev server or raise budgets to admit\nthe target.\n\nFor local full E2E proof, prepare the frozen, dependency-ready proof checkout\nwith private QA entries in the initial build:\n\n```bash\nOPENCLAW_BUILD_PRIVATE_QA=1 pnpm build\n```\n\nThen run the selected E2E command with its normal readiness checks enabled.\n`scripts\u002Flib\u002Fvitest-build-prerequisites.mts` requests private QA entries;\n`scripts\u002Frun-node.mts` triggers another full build when they are absent. This\npreflight avoids rebuilding solely for `missing_private_qa_dist`. Keep the flag\nscoped to this task-owned proof checkout and command. Publication package and\nimage bytes remain owned by the release workflows and their sealed artifacts.\n\nBefore full release validation:\n\n```bash\ngh api rate_limit --jq '.resources.core'\ngit status --short --branch\ngit rev-parse HEAD\n```\n\n### Before publication\n\nFor regular beta\u002Fstable protected publication, after evidence validation run\n`pnpm release:publish-preflight` with the intended tag, exact Full Release\nValidation run and attempt, npm dist-tag, plugin scope, and protected publication\ntooling ref. `pnpm release:candidate`\ninvokes this check with its downloaded manifests; do not redownload them or\nreplace the selected attempt. Use the report's exact dispatch command for the\nchosen publication route only after resolving every `FAIL` and owner-action\n`WARN`. Extended-stable retains its separate owner workflows and is not\nadmitted by this preflight. Alpha releases are retired.\n\nThe checklist's `--workflow-ref`\u002F`--workflow-sha` selects trusted P tooling, not\nthe candidate harness. Reuse authenticated stable package Telegram proof from\nthe exact FRV-qualified tarball; beta coverage remains deferred. Supplemental\nTelegram checks require the retained qualification ref verified at Q=C, with\nthe harness pinned to C. Never dispatch candidate checks from moving main.\nLocal Parallels uses C's checkout and dependency graph. Supplemental Telegram\nrun IDs stay in candidate evidence, not the optional publisher diagnostic input.\n\nCheck the report before retrying a failed publication: preserve the verified\n`openclaw_npm_resume_run_id` for already-published core bytes, inspect matching\ndraft\u002Fpublished release state, and identify exact orphaned plugin\u002FClawHub children\nbefore cancellation. Preflight is read-only and does not authorize publication,\ncancel children, or prove a repository secret from local credentials. Bootstrap\ncandidates need a read-only `npm whoami` probe using the repository's actual\n`NPM_TOKEN`; follow the secret-isolated step in\n[bootstrap token probe](..\u002Frelease-openclaw-maintainer\u002Freferences\u002Fpublication-recovery.md#check-the-bootstrap-token)\nand retain its run URL. Do not rotate credentials as part of a diagnostic check.\n\n## Dispatch\n\nAfter source admission, plugin compatibility readiness, and evidence reuse\nselection, dispatch source-only children alongside npm and Docker artifact\nproducers. Candidate acquisition consumes raw npm bytes while qualification\ncontinues; candidate Plugin Prerelease and Release Checks start immediately\nafter candidate verification without waiting for independent validation or\nDocker. Preserve the immutable execution plan and final artifact qualification.\n\nEach selected validation child uploads an immutable\n`full-release-child-evidence-\u003Ctarget-sha>-\u003Crole>-\u003Crun-id>-\u003Cattempt>` receipt from\ntrusted workflow tooling. The receipt retains normalized dispatch inputs,\nincluding candidate descriptors, and composes predecessor jobs across attempts.\nIts `workloadConclusion` excludes the running publisher. Collection failure\nloses reuse metadata without changing workload qualification. With\n`reuse_evidence=true`, dispatch scans at most 100 recent runs, probes at most 40\ntarget receipt inventories, and fully validates at most five matching receipts\nper role within two minutes. Other-target and other-tooling runs do not spend\nthe full-validation budget. Empty-string inputs equal absent inputs because GitHub omits them from\n`github.event.inputs`; non-empty defaults and candidate descriptor bytes must\nmatch exactly. It can adopt green children from failed, cancelled, or active\nparents only at the same Tooling SHA as the current parent, still requiring main\nancestry. Missing or different parent tooling fails closed; no paths are exempt.\nDispatch logs identify reused children, explain each evaluated rejection, and\nsummarize skipped runs and fresh dispatches. The current-parent adoption witness\nand immutable execution plan bind each selection. Collectors and final verification\nrecheck the live child attempt and conclusion, same tooling, main ancestry, inputs,\nartifact identity\u002Fdigest\u002Fexpiry, and successful trusted seal\u002Fupload steps. A newer\nattempt invalidates reuse; do not rerun an adopted child to repair a collector.\nCurrent-parent source\u002Fpublication admission and the separate successful-parent\nchangelog reuse path remain unchanged. Artifact producers retain their existing\nsealed receipts. Candidate admission does not widen this per-child receipt\nreuse contract: a divergent Q runs fresh children; whole-parent authenticated\nevidence reuse retains its separate original-Q contract.\n\nAn early standalone product-performance run is optional beta confidence. If\nuseful, start it against the frozen Code SHA in parallel with release work:\n\n```bash\n# Optional beta confidence; stable\u002Ffull qualification requires blocking performance.\nfail_on_regression=false\ngh workflow run openclaw-performance.yml \\\n  --repo openclaw\u002Fopenclaw \\\n  --ref main \\\n  -f target_ref=\u003Ccode-sha> \\\n  -f profile=release \\\n  -f repeat=3 \\\n  -f deep_profile=false \\\n  -f live_openai_candidate=false \\\n  -f fail_on_regression=\"$fail_on_regression\"\n```\n\n- Do not add a separate mandatory prepublish wait for this optional beta signal.\n- Compare available Kova, gateway startup, and CLI startup metrics with earlier\n  release evidence or clawgrit reports before publish\u002Fcloseout.\n- Record regressions in release evidence and investigate their product impact.\n  Stable\u002Ffull qualification requires blocking performance subject only to the\n  checked-in policy’s exact Kova grants. Retain failed reports; a failed-job\n  grant does not authorize a not-run exemption.\n- `npm-beta-v1` defers the performance child. Every selected child still needs\n  terminal evidence and must prove artifact-only publication.\n\nUse the canonical helper for reviewed candidate qualification. It alone first\nruns the lightweight `admit-qualification` operation on\n`openclaw-release-prepare.yml` at P, then dispatches FRV at Q=C. P records the\noperator attestation, complete normalized inputs, and data-only frozen Q coverage;\nthe immutable descriptor travels in the existing `trusted_workflow_json` envelope.\nDo not execute candidate code in P's admission step or hand-assemble the envelope.\n\n```bash\nPUBLISHER_SHA=\"\u003Crecorded-full-trusted-main-ancestor-sha>\"\nPUBLICATION_SELECTION='{\"route\":\"normal\",\"npmDistTag\":\"latest\",\"publishOpenclawNpm\":true,\"pluginPublishScope\":\"all-publishable\",\"plugins\":[]}'\npnpm ci:full-release \\\n  --sha \u003Ccode-sha> \\\n  --target-ref release\u002FYYYY.M.PATCH \\\n  --trusted-workflow-ref candidate \\\n  --admission-workflow-sha \"$PUBLISHER_SHA\" \\\n  --admission-workflow-ref main \\\n  --request-file \u003Cprivate-request-file> \\\n  -f validation_purpose=publish \\\n  -f publication_selection_json=\"$PUBLICATION_SELECTION\"\n```\n\nQ defaults to C; an explicit `--workflow-sha` must equal C. P can instead use\nan existing protected `release-publish\u002F*` tag with its exact SHA. Review the\ncandidate and coverage before dispatch: admission records that operator\nattestation, not a bot exception. Scheduled main qualification explicitly uses\n`--trusted-workflow-ref main` and retains its trusted-main semantics.\n\nAn existing `--request-file` reconciles the original request without changing\nits route, Q\u002FP identities, or inputs. `--reconcile-request \u003Cfile>` is read-only.\nOnly `--resume-request \u003Cfile>` can continue a candidate request after admission\nand before its first FRV POST. If Q ref creation succeeded but readback failed,\nresume verifies the existing exact Q=C ref and empty workflow inventory, then\nreuses it without a second ref POST. Missing\u002Fmoved refs or uncertain\u002Fnonempty\ninventories block. Read-only reconciliation verifies an uncertain prepared ref\nbefore suggesting resume; it does not rewrite or advance the request. Every\nresume revalidates authenticated admission and signer authority after recovery\ninventory reads, then checks the ref immediately before dispatch. Stable\u002Fchecklist\nwrappers relay the helper’s verified recovery advice, never infer safety from raw\nuncertain state. Run the explicit resume command when offered, then rerun the wrapper.\nAn attempted or uncertain FRV POST remains observation-only and never retries. Keep\noriginal producer and current consumer identities when reusing evidence.\n\nSelect `npmDistTag=beta` for beta publication and `route=prepared` only for an\nintended prepared-button consumer. The source-admission result does not qualify\nregistry state or authorize publishing. Nonpublish investigations use explicit\n`validation_purpose=diagnostic` without publication selection; recurring main\nqualification uses `main-qualification`, and exact published-package confidence\nuses `postpublish-confidence`. Keep coverage\u002Fprofile selection independent.\n\nFor regular `release\u002F*` validation, never raw-dispatch the workflow without\n`target_context_ref` (the helper's `--target-ref` records it). Canonical\n`release\u002F*` and `extended-stable\u002F*` workflow refs remain supported routes, but\ntheir Telegram child must retain the exact parent workflow ref and SHA through\nOIDC and attestation. Trusted-workflow release-branch CI passes `target_ref` +\n`release_candidate_ref`; never `release_gate` there — it requires workflow head\n== target. (The PR-head ci.yml fallback below is a different dispatch and does\nuse `release_gate=true`.)\n\nThe release branch may advance after the Code SHA is frozen. The helper accepts\nthat frozen SHA only while it remains an ancestor of the canonical release\nbranch and its package version is either the branch's final version or a\nmatching beta prerelease. Extended-stable branches and all tags require\nan exact package-version match.\nFor fresh candidate qualification, retain Q=C and pass P separately. Missing\nfrozen contracts fail closed and require deliberate candidate backports, not\nfallback to main. The explicit historical\u002Fcross-revision route remains\n`--trusted-workflow-ref main --workflow-sha \u003Crecorded-main-tooling-sha>`\n(or a protected tooling tag). New requests on this route are diagnostic,\nmain-qualification, or postpublish-confidence only, never publish qualification.\nExisting historical publish requests reopen before this new-dispatch restriction\nand preserve their original trusted-main ancestry contract; they are not\ncandidate-owned evidence. Never refresh either route's\nrecorded identity from moving main. Evidence reuse remains enabled unless the\noperator deliberately selects `-f reuse_evidence=false`.\n\nIf final notes were already committed before fresh full qualification, retain\nthat Code SHA as Release SHA and use the same successful parent\u002Fattempt and\nits exact prepared bytes for candidate and publication checks. Required gates\nand final channel-specific SDK review still apply. Publishers consume the sealed\nacknowledgement; the candidate helper retains its explicit argument when needed.\n\nOnly if notes change after qualification, commit the selected release entry and\nany matching record\u002Findex updates, then\noptionally run the helper against the new Release SHA with reuse. That parent must report\n`policy=split-changelog-release-v1`, `evidenceSha=\u003Ccode-sha>`, and the complete\n`changedPaths`: the selected `CHANGELOG\u002FYYYY.M.PATCH.md` is required, with only\n`CHANGELOG.md` and `CHANGELOG\u002Frecords\u002FYYYY.M.PATCH.md` permitted alongside it.\nEntry\u002Frecord additions or modifications are permitted; index changes must be\nmodifications. Renames, deletions, other releases, and docs source edits require\nfresh product qualification. Historical root-only receipts retain\n`changelog-only-release-v1`. The split path should reuse the product matrix instead of\ndispatching child lanes. Npm preflight and package\u002Finstall acceptance still run\nagainst the exact Release SHA and its new tarball bytes.\n\nCurrent all-group FRV also owns read-only core and selected-plugin npm\nsource\u002Fbuild\u002Fqualification plus Docker preparation. Use its successful run as\n`preflight_run_id`; the candidate\nhelper defaults to that run. Do not dispatch a second npm preflight unless\nrecovering historical separate evidence. Regular final qualification records\nSDK reports for both `beta` and `latest`; review the acknowledgement for the\nactual publication channel. Prepared descriptors live in `publicationArtifacts`\nin the exact final manifest. Release Prepare adopts the manifest's plugin npm\ndescriptor and prepares only ClawHub; it never repacks plugin npm after FRV.\nProduct evidence reuse never substitutes Code-SHA\npackage or image bytes for the final Release SHA. For failed independent npm\nqualification, use `pnpm frv continue --failed`:\nfailed npm jobs retry on their original run, successful preparation jobs\nand diagnostic children carry forward, and the parent verifies the resulting\nreceipts. Failure alone is not a continuation rejection. Frozen workflows\nexecute their original receipt logic; a local controller upgrade does not\nretrofit that logic, and final verification still owns the recovery result.\n\nThe SHA-pinned helper infers `beta` for matching beta release candidates and\n`stable` for stable\u002Fcorrection versions, then passes the\nC\u002FQ\u002FP run identity. Canonical beta `all` without soak\nuses `npm-beta-v1`; `main` and non-beta targets do not qualify for that\npolicy. Run deferred native, performance, Telegram, broad live QA, and E2E as\npostpublish confidence with the exact published package and\n`run_release_soak=true` or explicit groups. Stable and full profiles force the\nrelease soak. Native artifact publication still requires its own build,\nsigning, notarization, and promotion gates. Use a narrow `rerun_group` after\nfocused fixes; never widen automatically.\nAt seal time the parent records the SDK evidence digest from the qualified npm\nreceipt and resolves per-package npm plans against the registry. The manifest's\n`publishInputs` supplies publisher\u002Fpreflight defaults. SDK API changes still\nneed the operator's acknowledgement; sealed evidence does not grant authority.\nMutation owners recheck live publication authority, selectors, and immutable bytes.\n\n### Publication requirements\n\nPublish with `release_profile=from-validation` to consume the sealed profile.\nThe selected FRV run must conclude **success**. Stable publication requires\nstable\u002Ffull evidence, soak, and blocking performance.\nDecide blocker or flake for every failed test. Rerun flakes on the same Release\nSHA at most twice and file a fix-in-parallel issue\u002FPR on `main`; never re-cut\nsolely to clear a flake. An exact eligible failed leaf may instead\nhave a reviewed [release-tooling grant](..\u002F..\u002F..\u002Fdocs\u002Freference\u002Ffull-release-validation\u002Fevidence.md#release-tooling-waivers).\nLand and pin P, then run or revalidate FRV without changing C\u002FQ. The publisher\ndoes not grant waivers or accept failed FRV. All unwaived failures and missing,\nskipped, cancelled, or unknown required coverage still block.\n\n### Publish children\n\nUse the maintainer [publication recovery guide](..\u002Frelease-openclaw-maintainer\u002Freferences\u002Fpublication-recovery.md)\nfor publication ordering and prepared\u002Fdirect recovery.\n\n- Watch every publish parent with one `pnpm release:watch --run \u003Cparent>`\n  ([contract](..\u002F..\u002F..\u002Fdocs\u002Freference\u002FRELEASING.md#watch-publication)), not a\n  hand-rolled monitor. It reports parent and child environment gates, failed\n  runs and failed `continue-on-error` jobs, and it backs off on rate limits.\n\n- `pnpm release:stable \u003Cversion>` ([orchestrated stable release](..\u002Frelease-openclaw-maintainer\u002Freferences\u002Fregular-release.md#orchestrated-stable-release))\n  dispatches the parent once, approves the parent's `npm-release` gate, prints\n  child-approval commands only for older tooling without `npm-publish` and\n  stale-child sweep commands when needed (it never mutates a child run).\n  On any refusal it prints `Next:` with\n  the exact recovery command.\n- The parent's `npm-release` approval mints the attested\n  `openclaw-release-approval-v1-\u003Cparent run>-\u003Cattempt>` receipt; bot-dispatched\n  children verify it (`scripts\u002Frelease-approval-receipt.mjs verify`) before\n  their gates. The ClawHub OIDC child skips its `clawhub-plugin-release` gate\n  on a verified receipt and uses its own publication authorization after\n  dispatch. Core-parent completion or failure must not strand already-authorized\n  ClawHub work; keep its live-authority and exact-byte checks in that lane. npm\n  children (`Plugin NPM Release`, `openclaw-npm-release.yml`) skip their\n  `npm-release` approval job on the verified-receipt route and publish in\n  `npm-publish`, with trusted publishers bound to that environment. Immediately\n  before publication they wait for the parent attempt's receipt and require\n  that attempt to remain `in_progress`. This is one human approval per release.\n  `npm-publish` has no reviewers and admits only protected\n  `release-publish\u002F\u003Csha12>-\u003Cn>` tags. Real manual\u002Frecovery npm dispatches must\n  use such a tooling tag and still need their own `npm-release` approval job;\n  the read-only OIDC preflight also uses `npm-publish` and requires that tag.\n  Artifact-only preflights keep their existing refs and have no environment.\n- Never approve a `plugin-clawhub-release.yml` child by hand. It is\n  receipt-verified on the bot route and needs no approval. The\n  `Artifact not found` line for `openclaw-clawhub-recovery-approval-\u003Crun>-1`\n  is a non-fatal probe. Historical parent-bound children could fail with\n  `parent state completed\u002Ffailure is not allowed by authorization route`\n  (2026.9.6: runs 35930335388\u002F35930341394). Recover that ClawHub surface through\n  explicit [publication recovery](..\u002Frelease-openclaw-maintainer\u002Freferences\u002Fpublication-recovery.md#interrupted-preparation-and-publication),\n  without holding or redispatching core publication. Bootstrap children\n  (`plugin-clawhub-new.yml`) always wait on `clawhub-plugin-bootstrap`. Approve\n  them after the secretless pack jobs finish\n  ([first package](..\u002Frelease-openclaw-maintainer\u002Freferences\u002Ffirst-package.md)).\n- A historical awaited v2 ClawHub child can stage most packages before one\n  failure makes its parent fail, preventing finalization of staged siblings.\n  New publication keeps that failure isolated to the ClawHub lane.\n  Reconcile the original child's `*-publish-json` artifacts before any\n  republish or parent resume. Use\n  `pnpm release:clawhub-recovery -- --version \u003Cversion> --reason '\u003Cparent failure>' --clawhub-source \u003Cisolated pinned ClawHub checkout> \u003Cpackage-publish.json>...`\n  to print exact attempt recovery commands; see the publication recovery guide\n  for the pinned source CLI and authorized execution. Public version 404s do\n  not distinguish staged from missing, and attempt status needs publisher\n  authentication. Parent receipts and live-authority revalidation remain\n  required; recovery does not turn a failed parent into successful evidence.\n- Before npm child dispatch the parent sweeps selected npm publishers for a\n  failed earlier parent's `waiting`\u002F`queued` children of the same release (core\n  by the `parent=\u003Crun>\u002F\u003Cattempt>` run title; plugin npm by the release SHA, only\n  while no other publish parent is live). The independent ClawHub lane owns\n  its corresponding sweep. Each owner attempts gate rejection and cancellation,\n  then waits up to 5 minutes per workflow.\n  Rejection denied with 403 needs a reviewer; logs and the step summary include\n  the reject\u002Fcancel commands. Unconfirmed cancellation warns. Core npm has an\n  independent publish slot and rechecks its live parent, so it does not block;\n  plugin npm retains its target-serialized slot and refuses before a new dispatch\n  if cancellation remains unconfirmed. ClawHub reconciliation, serialized slots,\n  and dispatch guards run only in its independent lane; none holds npm dispatch\n  or core completion. Do not cancel authorized ClawHub work merely because its\n  original core parent failed. A core parent failure cancels its own waiting npm\n  children. A detached ClawHub parent failure rejects its recorded child's pending\n  gate before cancellation; an unconfirmed rejection warns with reviewer commands.\n  To clean up a confirmed stale, no-longer-authorized child as a reviewer, list\n  `workflow_dispatch` runs by `github-actions[bot]` created for this release,\n  reject their gate, cancel:\n\n  ```bash\n  for s in waiting queued; do gh api \"repos\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns?status=$s&per_page=100\" \\\n    --jq '.workflow_runs[] | select(.event==\"workflow_dispatch\" and .actor.login==\"github-actions[bot]\") | select(.name | test(\"plugin-clawhub|Plugin NPM Release|openclaw-npm-release\")) | [.id,.name,.created_at] | @tsv'; done\n  env_id=$(gh api repos\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns\u002F\u003Cchild>\u002Fpending_deployments --jq '.[0].environment.id')\n  gh api -X POST repos\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns\u002F\u003Cchild>\u002Fpending_deployments \\\n    -f state=rejected -f comment=\"Reject stale release gate\" -F \"environment_ids[]=$env_id\"\n  gh run cancel \u003Cchild> --repo openclaw\u002Fopenclaw\n  ```\n\n- `gh run rerun --failed` on a plugin npm child fails its attempt-bound\n  preflight artifact readback. The parent waits for the original child to\n  settle and propagates its failure without dispatching a replacement.\n  Diagnose and fix the failed owner before explicitly recovering publication;\n  preserve successful immutable packages and evidence.\n\n### Extended-stable validation\n\nUse the same candidate-owned helper for `.33+` extended-stable validation:\nC is the exact frozen branch tip, Q=C owns its complete qualification closure,\nand independently trusted P admits and verifies it. The canonical\n`extended-stable\u002FYYYY.M.33` branch supplies context, not workflow authority.\nDeliberately backport missing contracts before freezing C.\n\n```bash\nVALIDATION_SHA=\"\u003Cexact-candidate-sha>\"\nPUBLISHER_SHA=\"\u003Crecorded-full-trusted-main-ancestor-sha>\"\nCONTEXT_REF=\"extended-stable\u002FYYYY.M.33\"\npnpm ci:full-release \\\n  --sha \"$VALIDATION_SHA\" \\\n  --target-ref \"$CONTEXT_REF\" \\\n  --admission-workflow-sha \"$PUBLISHER_SHA\" \\\n  --admission-workflow-ref main \\\n  -f validation_purpose=publish \\\n  -f publication_selection_json='{\"route\":\"extended-stable\",\"npmDistTag\":\"extended-stable\",\"publishOpenclawNpm\":true,\"pluginPublishScope\":\"all-publishable\",\"plugins\":[]}' \\\n  -f release_profile=stable \\\n  -f run_release_soak=true \\\n  -f fail_fast=false \\\n  -f rerun_group=all \\\n  -f reuse_evidence=false \\\n  -f dispatch_release_evidence=false\n```\n\nThe helper captures qualification baselines from npm before admission. An\nextended-stable candidate's primary upgrade baseline, used by cross-OS upgrade\nand the upgrade survivor lanes, is the newest published extended-stable\nrelease below it (2026.8.35 for 2026.9.33); the survivor set also keeps the\nfrozen month's newest stable predecessor (2026.9.9). Upgrades between\nextended-stable releases run the old updater's real `extended-stable` selector\nagainst the loopback candidate registry, never an explicit `--tag`.\n\nOnly the helper creates the immutable `release-ci\u002F\u003CQ-prefix>-\u003Ctimestamp>`\ntransport after admission. Never raw-dispatch, manually create its ref, or mint\na protected publication tag for Q. Reconcile an existing historical cross-revision\npublish request under its original identity; never relabel it as candidate-owned.\nA new explicit main\u002Fprotected route is diagnostic, main-qualification, or\npostpublish-confidence only and cannot replace this admitted Q=C publish proof.\n\nAccept only a complete `rerun_group=all` run with a supported exact-target\nmanifest. Bind its workflow SHA separately from the candidate SHA; require the\nmanifest target, package versions, saved `run_attempt`, and final tag to identify\nthe same candidate. Reject narrow runs, untrusted tooling, mismatched targets,\nand earlier-attempt evidence.\n\nThe all-group parent prepares core and selected plugin npm tarballs itself and\nrecords their immutable descriptors in `publicationArtifacts`. Publication\nmust consume those exact artifacts and attempts. A standalone npm or plugin npm\npreflight is diagnostic-only and cannot replace the manifest-bound evidence.\n\nProduct failures need an approved backport. Frozen-target tooling failures need\nthe smallest behavior-preserving repair. Provider, approval, runner, or log\nraces keep the candidate unchanged. Record repairs and superseded runs; any\nbranch change requires a new complete parent. Omit only an explicitly\nunsupported frozen-target scenario, never a required behavior or package.\n\n### Frozen-target test omissions\n\nUse `plugin_prerelease_node_exclude_patterns_json` only for exact `src\u002Fplugins\u002F`\ntest paths in the Plugin Prerelease Node lane. Use\n`extension_test_exclude_patterns_json` for exact `extensions\u002F` test paths in\nPlugin Prerelease extension shards. Normal CI does not own that sweep. Both\ndefault to `[]`; there is no implicit\nCodex omission. Pass JSON arrays at initial dispatch, retain the justification\nand owning fix, and report omitted coverage as not run.\n\nPreflight must discover every requested path in the selected frozen-target\nlane; nonexistent, out-of-lane, duplicate, basename, or glob inputs fail loudly.\nTrusted tooling applies exact exclusions to inline Vitest leaves while\npreserving candidate runtime preparation and restores original config bytes\nafter the shard command. Do not substitute CLI `--exclude` or a new target-side\nenvironment variable: frozen inline projects may ignore them. Inputs remain in\nthe immutable request, coverage\u002Freuse identity, and final manifest; changing\nthem requires a new request, never continuation.\n\n## Watch\n\nWatch children with the attempt-aware controller:\n\n```bash\npnpm frv watch --run \u003Cfull-release-run-id>\n```\n\nIt resolves child run IDs from the parent's dispatch-job log lines\n(`Dispatched \u003Cworkflow>: \u003Curl> (attempt N)`), never from display titles, and\nreports each parent and child attempt transition and each failed job once, with\nrunner labels. Transient GitHub 5xx or HTML\nerror bodies are retried on the next poll, never reported as job results.\nState lives in `$TMPDIR\u002Fopenclaw-frv\u002F\u003Crepo>-\u003Cparent>-watch.json` (`--state`\noverrides), so a restart after a harness or Monitor timeout does not re-report.\n`--once` takes one snapshot, `--interval \u003Cseconds>` sets polling (default 60),\nand `--json` prints NDJSON. It exits with code 1 on a newly observed current\nparent\u002Fartifact-producer blocker or a policy-blocking carried child failure,\nafter saving the notification. Resume with the same command and state to keep\nfollowing diagnostics without repeating that blocker. Otherwise, it exits once\nthe parent and every dispatched child are terminal; restart it after a later\nrerun. Use `status` for structured blockers and preview recovery with\n`continue --failed --dry-run`. Do not hand-roll bash or `gh`\nwatchers.\n\nWatch candidate events derive the frozen SHA and context ref from the sealed\nexecution plan, not monitor scratch prose or the parent's tooling SHA. The tip\nis read freshly; a changed tip labels that candidate superseded without stopping\nobservation or claiming qualification of the new tip. Missing evidence or a\nSHA-only context stays unknown. Resume a missing or exited watcher with the same\ncommand and state path: it performs reads only and suppresses already reported\nterminal and candidate events. Never redispatch merely to restore a watcher.\n\nFor the parent's Release Decision, use the transition-only summary watcher:\n\n```bash\nnode scripts\u002Frelease-ci-summary.mjs \u003Cfull-release-run-id> --watch\n```\n\nDo not start this watcher when the SHA-pinned helper is still the foreground\nowner. The helper reads the exact Release Decision artifact itself. On\n`blocked_diagnostics_running`, it exits nonzero immediately, keeps the temporary\nworkflow ref, and leaves Diagnostic Drain collecting the remaining terminal evidence.\nThe watcher behaves the same way for separately dispatched parents: it reports\nthe Release Decision blocker once and exits while the drain continues.\n\nFor a one-shot snapshot:\n\n```bash\nnode scripts\u002Frelease-ci-summary.mjs \u003Cfull-release-run-id>\n```\n\n`release-ci-summary` accepts Full Release Validation parent runs only.\nDiverged release-branch logs: `--first-parent` plus a bounded count.\nStop watchers before ending the turn or switching strategy.\n\nFor PR and child gates, read the exact workflow run, not the commit's check-run\nlist: `commits\u002F\u003Csha>\u002Fcheck-runs` keeps entries from superseded or cancelled\nruns for the same head, so a stale `cancelled` or `failure` can mask a newer\nsuccess. Resolve the newest `CI` run for the head (`actions\u002Fruns?head_sha=\u003Csha>`)\nand read `openclaw\u002Fci-gate` from that run's jobs before retrying or reporting.\n\nInterpret state precisely:\n\n- `qualifying`: no decisive blocker yet; selected children are still active.\n- `blocked_diagnostics_running`: publication is blocked; Diagnostic Drain is\n  still collecting independent failures. Diagnose now and use `frv rerun` or\n  `continue --failed` when the failed child is terminal; final parent resealing\n  still waits for complete evidence.\n- `passed`: all required policy and exact-child evidence passed.\n- `blocked_complete`: publication is blocked and all selected diagnostics are\n  terminal.\n- `orchestration_error`: GitHub API or collector failure prevented a verdict.\n  This does not mean the wrong source was used. Recover the collector against the same\n  exact children; never redispatch tests to repair collection.\n- `cancelled_with_children`: the collector was cancelled while exact children\n  remained active.\n\nRead every selected lane's actual conclusion. `passed` requires every selected\nvalidation lane to satisfy pinned P's policy, with terminal evidence and raw\nwaived failures retained; omitted coverage is not run, never passed.\n\nThe `full-release-diagnostics-\u003Crun-id>-\u003Cattempt>` artifact is the terminal\nfailure and timing manifest. Use it after an early blocker instead of\nrestarting `all` merely to discover what the still-running children found.\nThe stable `full-release-execution-plan-\u003Crun-id>` artifact is the identity\nsource within each collector attempt; retry attempts restore its immutable\nrun-ID-cached bytes first.\n\n## Failure Triage\n\n1. Confirm parent SHA and child run IDs.\n2. List failed jobs with `pnpm frv watch --run \u003Cparent> --once`; it prints each\n   failed job with its attempt, runner labels, and URL.\n3. Fetch one failed job log. If rate-limited, note reset time and avoid more REST calls.\n4. For secret-looking failures, validate a real completion from the same secret source before editing code. A successful model-list request is insufficient.\n   Claude CLI subscription credentials are a separate native auth path; prove\n   them in a clean-home CLI probe, never as a substitute for a required\n   Anthropic API-key lane.\n5. For live-cache failures, inspect whether it is missing\u002Finvalid key, empty text, provider refusal, timeout, or baseline miss. Do not weaken release gates without clear provider evidence.\n6. Decide blocker or flake for each failed test before editing. A flake requires\n   a passing occurrence of the same job or signature on this exact Release SHA.\n   First preserve the failing diagnostics, inspect every same-SHA attempt, and\n   run `git log \u003Cprevious-release-tag>..\u003Crelease-sha> -- \u003Cfailing paths>` for\n   the candidate delta and `git log \u003Crelease-sha>..origin\u002Fmain -- \u003Cfailing paths>`\n   for main-only changes. If `main` contains a repair absent from the frozen\n   candidate, treat the failure as a blocker and backport or supersede; do not\n   rerun it as inherited success. A signature repeated on another candidate is\n   deterministic until a named mechanism and fix prove otherwise. Track a fix\n   for genuine flakes on `main`; every unwaived selected job must still pass before\n   publication under pinned P's policy. Classify blockers further:\n   - confirmed product\u002Fcode failure: fix the release branch, freeze a new Code\n     SHA, and invalidate product evidence\n   - qualification harness\u002Fcontract defect: repair the candidate closure and\n     freeze new C\u002FQ; preserve the superseded evidence and its invalidation reason\n   - P-only admission\u002Fverifier\u002Fpublisher defect: preserve C\u002FQ and original\n     artifacts, repair independent trusted P, and recover the affected surface\n   - infrastructure\u002Fcredential failure: keep C\u002FQ\u002FP, repair the external\n     prerequisite, and retry only the failed surface\n   - wrapper\u002Fmonitor failure: keep the child and candidate identities; record\n     the wrapper result separately from the child result\n   - changelog\u002Frelease-note failure: change only the selected release entry and\n     permitted record\u002Findex paths under `split-changelog-release-v1`, keep Code SHA\n     evidence, and repeat Release SHA proof\n   - publish child\u002Fregistry selector failure: keep Release SHA and resume the\n     failed child; never rebuild an immutable version that already published\n   - parent failed after core npm published (for example a stale `beta`\n     dist-tag failing the completion verify): retain the successful original\n     npm run and qualified bytes, repair the selector, and reconcile the exact\n     failed parent's children before resuming the selected publication route.\n     Direct finalization normally waits for npm and Docker verification; the\n     prepared button also retains its required core checks, but neither route\n     waits for ClawHub downloads. Do not manually un-draft a release to bypass\n     required core gates. Follow\n     [publication recovery](..\u002Frelease-openclaw-maintainer\u002Freferences\u002Fpublication-recovery.md#published-version-failed-parent)\n     for direct resume or a new prepared button run.\n   - child stuck `waiting`, ClawHub `Artifact not found`, or parent failing\n     `ClawHub dispatch blocked by waiting run`: see [Publish children](#publish-children)\n     Only product or qualification-harness defects change C\u002FQ. After one diagnosis\u002Ffix\u002Fnarrow\n     retry, reassess instead of starting another all-group cycle.\n7. Runner routing: FRV-dispatched CI and Plugin Prerelease children always run\n   hosted `ubuntu-24.04` (or the release runner group). Other release lanes\n   follow `OPENCLAW_CI_RUNNER_BACKEND`, so a flip to `github` during a Blacksmith\n   outage moves them to hosted runners, except the QA Lab runtime-pair lane: it\n   fails on hosted runners and stays pinned to Blacksmith, queuing through an\n   outage. Release Checks prints a `Release runner routing` notice while the\n   flip is active. Codex extension tests run as file-bounded Plugin Prerelease\n   jobs because one hosted Codex batch took 36-60 minutes.\n   If npm preflight keeps losing Blacksmith runners, dispatch a fresh FRV with\n   `-f npm_preflight_use_github_hosted_runners=true` instead of flipping the\n   repo-wide variable.\n8. If a required PR CI run is capacity-stalled with queued jobs and no active\n   jobs, do not cancel unrelated work or accept a generic manual dispatch.\n   First verify the PR head carries the current fallback schema:\n   `gh api 'repos\u002Fopenclaw\u002Fopenclaw\u002Fcontents\u002F.github\u002Fworkflows\u002Fci.yml?ref=\u003Cpr-head-branch>'\n   --jq .content | base64 --decode | rg -q 'pull_request_number:'`. If absent,\n   refresh the PR head from `main` and use the new head SHA; let normal CI run\n   before considering another fallback.\n   From the PR head branch, dispatch the explicit exact-SHA fallback:\n   `gh workflow run ci.yml --repo openclaw\u002Fopenclaw --ref \u003Cpr-head-branch> -f\n   target_ref=\u003Cfull-pr-sha> -f pull_request_number=\u003Cpr-number> -f\n   include_android=true -f release_gate=true`.\n   It runs on GitHub-hosted runners and is accepted only when its run title is\n   `CI release gate \u003Cfull-pr-sha>`. Record the stalled Blacksmith run and the\n   fallback run in release evidence.\n   If `Blacksmith Build Artifacts Testbox` is the only remaining required gate\n   and remains queued without a runner, that completed exact fallback may cover\n   it because CI's `build-artifacts` job already builds, packages, and smoke\n   tests the artifacts. Do not use this coverage after the artifact workflow\n   starts or completes non-successfully.\n\n## Evidence\n\nRecord:\n\n- release lifecycle ledger: Code SHA and Release SHA for regular releases;\n  canonical branch, exact SHA, and immutable tag for extended-stable; C\u002FQ\u002FP,\n  original admission descriptor, and retained request for either track\n- evidence-reuse policy, coverage policy, and complete changed-path set\n- active full parent run URL, attempt, workflow SHA, and any superseded parent\n  with the exact replacement reason\n- selected child run IDs and conclusions: CI, Release Checks, Plugin Prerelease, NPM Telegram, Product Performance; record deferred confidence as not run\n- exact core and plugin npm publication artifact descriptors from the terminal manifest\n- all selected lane conclusions, including Linux\u002FWindows\u002FmacOS cross-OS\n- performance comparison result versus earlier releases when available\n- targeted local proof commands\n- frozen-target compatibility repairs or omitted inapplicable scenarios, with\n  their source PRs and invariant\n- hosted proof and its deployment prerequisites separately from local contract\n  tests; mocks do not prove Actions admission, OIDC, environment access, or publication\n- known gaps or unrelated failures\n\nFor lessons and recovery patterns, read `references\u002Frelease-ci-notes.md`.\n",{"name":5,"description":7},"main","c6667b166c61bd125edeaab64ddc4a26f534a7e9",".agents\u002Fskills\u002Frelease-openclaw-ci",82861,"https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw","https:\u002F\u002Fopenclaw.ai","https:\u002F\u002Fgithub.com\u002Fopenclaw","Your personal, open source AI assistant.","2026-11-12 03:01:25",{"source":8,"skillName":5,"commands":47,"prompt":57,"zipAvailable":58},[48,51,54],{"tool":49,"command":50},"npx","npx skills add openclaw\u002Fopenclaw --skill release-openclaw-ci",{"tool":52,"command":53},"bunx","bunx skills add openclaw\u002Fopenclaw --skill release-openclaw-ci",{"tool":55,"command":56},"pnpm","pnpm dlx skills add openclaw\u002Fopenclaw --skill release-openclaw-ci","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Frelease-openclaw-ci\u002FSKILL.md",true,[60,66,70],{"path":61,"resourceType":62,"resourceTypeDesc":63,"sizeBytes":64,"sourceHtmlUrl":65},"agents\u002Fopenai.yaml","REFERENCE","参考文档",309,"https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Frelease-openclaw-ci\u002Fagents\u002Fopenai.yaml",{"path":67,"resourceType":62,"resourceTypeDesc":63,"sizeBytes":68,"sourceHtmlUrl":69},"references\u002Frelease-ci-notes.md",3867,"https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Frelease-openclaw-ci\u002Freferences\u002Frelease-ci-notes.md",{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"scripts\u002Fverify-provider-secrets.mjs","SCRIPT","脚本",4082,"https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Frelease-openclaw-ci\u002Fscripts\u002Fverify-provider-secrets.mjs",[77,83,105,123,145,169],{"skillNo":78,"name":79,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":32},"01M698VP84FNM6G9MR1HPX7MF7","lobster","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fextensions\u002Flobster\u002FSKILL.md",[],[79],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":32},"01M698YY8QGQ7S8TJNKJG6VTPH","xurl","xurl CLI for authenticated X posts, replies, reads\u002Fsearch, DMs, media upload, followers, auth status, or raw v2 API calls.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Fxurl\u002FSKILL.md",[],[85,90,91,92,93,94,95,96,24,97,98,99,100,101,102,103,104],"for","api","calls","replies","posts","upload","tap","brew","node","Media","search","npm","status","auth","cli",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":32},"01M698YWT1CJ0WK88WB909R9RT","weather","Current weather and forecasts with web_fetch, falling back to wttr.in curl for locations, rain, temperature, travel planning.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Fweather\u002FSKILL.md",[],[107,112,113,24,114,97,115,116,117,118,119,120,90,121,122],"travel planning","travel","fetch","curl","https","help","planning","web","back","temperature","with",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":134,"publishedAt":32},"01M698YV2Q0R0JJKAWGFS21K0N","visualize","Create inline visuals for code and explanations, or author persistent OpenClaw dashboard widgets with show_widget.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Fvisualize\u002FSKILL.md",[129],{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[125,135,136,137,138,90,122,139,140,141,142,143,9,144],"widgets","openclaw dashboard","author","inline","show","code","create","visuals","dashboard","widget",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":159,"publishedAt":32},"01M698YS2TRJH9ENG28HD9CD87","trello","Manage Trello boards, lists, and cards via the Trello REST API.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Ftrello\u002FSKILL.md",[151,156],{"categoryNo":152,"categoryName":153,"taxonomyType":154,"taxonomyTypeDesc":155},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":157,"categoryName":158,"taxonomyType":132,"taxonomyTypeDesc":133},"01JBSEEDCAT000000000000030","开发工程师",[147,116,160,161,162,163,164,165,24,97,166,115,91,167,168],"cloud","manage","via","rest api","token","atlassian","jq","REST","developer",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":175,"publishedAt":32},"01M698YQ9Q3M4W78EWV2KSCSVW","tmux","Control tmux sessions\u002Fpanes for interactive CLIs: list, capture output, send keys, paste text, monitor prompts.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Ftmux\u002FSKILL.md",[],[171,24,176,177,90,178,179,180,181,182,183,184,97,185,186,187,188,189,190],"send","darwin","keys","paste","output","control","prompts","interactive","list","capture","panes","text","monitor","sessions","linux"]