Keep package checks independent of Linux. Consume the successful producer artifact ID, including retained outputs on failed-job reruns, and preserve exact-revision verification without polling on an allocated Mac.
#179387 made the schema reject agents.defaults.heartbeat, so Gateway
fixtures that still wrote heartbeat: { every: "0m" } failed startup.
The performance workflow keeps the key only for candidates whose schema
still accepts it.
Use two command-local checkout workers while preserving the complete planner input tree and existing fetch and lifecycle policy. Add a reproducible materialization benchmark and document its local measurements and limitations.
Reuse the required Xcode SwiftLint and SwiftFormat phases after successful
current builds. Retain standalone diagnostics after failed or skipped builds
and for historical/frozen targets, including formatting after lint failure.
Keep every build target, simulator suite, runner and job unchanged.
Five interleaved local CI-shaped warm pairs improved the generation/build
segment median from 52.08s to 46.23s and p95 from 64.30s to 52.06s. Hosted
wall-time savings remain for the next natural CI run to measure.
Validation: 800 workflow/planner tests, 21 focused final admission cases,
complete iOS build-for-testing, targeted types/lint/format, workflow validation
and independent P2 review passed.
Run the same checks in two managed slots, retaining aggregate failures and
fatal cancellation cleanup. Keep frozen targets on their original commands.
Reuse fresh database-worker rows only when the complete current and historical
source maps match. Always validate current credential writers; changed snapshots
retain full historical analysis and the existing cache identity checks.
The local frozen-input full command fell from 713.31s to 505.67s, with 29% less
recorded CPU work. Both runs retain the same three inherited UI max-lines
failures. Focused boundary, queue and planner tests, typecheck, lint, formatting,
actionlint, script erasability and independent P2 review passed.
Start both native phases after preflight and wait for the same-run runtime only after app test compilation. Preserve every native test partition, exact-checkout verification, producer-failure handling, retained successful output, runner, and job deadline.
Natural hourly 39539608388 published the runtime seven minutes before Linux verification ended. Replaying its existing setup and compilation projects an 11.6-minute earlier native finish with the same three jobs and build/test work. Local Swift builds with and without dist, wrapper and artifact fixtures, focused workflow/planner/manifest checks, targeted types/lint, pinned workflow validation, docs links, and P2 review passed.
Moves the security-review workflow's primary and fallback GitHub App token steps to upstream v3.3.0 (64ab729a6294000f5aa4a4bc0b73d1f32bc45510), split out of the seven-day dependency refresh in #178071.
* fix(release): recover FRV before plan seal
Checkpoint exact attempt-one preparation inputs before execution-plan sealing so a retry can recover pre-seal failures without rebuilding authority from live state. Bind the eventual sealer attempt into the immutable plan and authenticate it at publication and cancellation boundaries.
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* fix(release): keep plan cache writes attempt-scoped
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* fix(release): authenticate preseal checkpoint layout
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* test(release): type cached plan fixture explicitly
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
---------
Co-authored-by: roboclaw-bot <309084314+roboclaw-bot@users.noreply.github.com>
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* feat(ios): add bounded release resource diagnostics
* fix(ios): guard signal forwarding after failed spawn
* fix(ios): make delayed resource observations explicit
* fix(ios): align CPU deltas with process observations
* fix(test): treat the env-gated Agents API live proof as optional shard evidence
test/gateway-agentsapi.live.test.ts (new since 2026.10.4) skips its only case
unless OPENCLAW_LIVE_AGENTS_API=1, which the native live test-harness shard
never sets, so the shard's no-passing-assertions guard failed it on every
2026.10.5 candidate once the other harness tests went green. Register it in
the existing whole-file opt-in map like the other env-gated live proofs.
(cherry picked from commit 761ef64bd5)
* fix(test): decode the Codex CLI JSON error after plugin uninstall
The live Codex npm plugin lane matched the expected post-uninstall error
against raw --json stdout, where quotes are escaped, so the correct
owner-plugin-not-activatable error never matched. Decode the canonical CLI
error message first, as the 2026.10.4 release line does (a9fd56df7d).
(cherry picked from commit e8772a9703)
* fix(test): scope CLI announcement barrier to parent probe
(cherry picked from commit d5c0db78de)
(cherry picked from commit a48d4a8fae)
* test(live): wait out the crash-loop breaker before the orphan settles
The native subagent restart live proof SIGKILLs the Gateway three times in
about two minutes. The third unclean boot trips the documented restart-loop
breaker (3 unclean boots within 5 minutes, #166238), which pauses restart
settlement, including interrupted subagent recovery (#166846), until the
unclean window drains. The orphan assertion added with the #169144 backport
only waited 30 seconds, so the nonannouncing child was still `running`.
Wait up to 360 seconds for the orphan settlement so the proof covers the
breaker pause and the automatic resume after its window. Assertions are
unchanged. 2026.10.4 passed because it predates the breaker pause, startup
subagent reconciliation, and this assertion.
Deterministic proof: the quiet-child e2e twin with SIGKILL restarts and an
exec-blocked child passes with one prior kill; with two warm-up kills it logs
"restart-loop breaker tripped" and the parent continuation never arrives
within 60 seconds; with a 400-second wait it settles and passes (338s).
(cherry picked from commit 1a4c2a0ebc)
* test(qa-lab): skip user-role runtime carriers in visible-child send proof
The sessions_send visible-child proof timed out on every 2026.10.5
candidate: its synthetic provider picked the latest user item that lacked
the legacy <<<BEGIN_OPENCLAW_INTERNAL_CONTEXT>>> marker as the user prompt.
Since #168546 (backport 8d66b946cd), OpenAI-compatible Responses
endpoints, including mock-openai, keep runtime context in a user-role
"OpenClaw runtime context:" carrier after the user turn instead of a
developer message. The fixture then read that carrier as the prompt, never
saw the "send" prompt on turn 2, answered PARENT_READY again, and the test
waited for PARENT_DONE until timeout.
Captured provider requests: v2026.10.4 sends the turn-2 carrier with role
developer; the 10.5 tip sends it with role user. Reverting a293f2e850
(#168410) left the failure unchanged.
Select the prompt with the shared qa-lab isInternalRuntimeContextCarrierText
helper, which already accepts current and legacy carrier shapes.
(cherry picked from commit d3a06e7e57)
* test(buzz): skip real reconnect backoff in cold-start recovery
(cherry picked from commit fa2049a369)
* fix(release): let the Telegram release lane finish its 25 scenarios
The isolated Telegram candidate job hit its 60-minute limit at scenario 24/25
on every 2026.10.5 candidate (about 62 minutes needed at 102-108s per packaged
Gateway start). main carries the same Telegram scenario set and job, so
raise the job budget to 90 minutes; the calling release-checks job keeps its
210-minute bound.
Also carry the 2026.10.4 release-line fixture fix for
telegram-prepared-delivery-recovery (8b78670080): keep the audit receipt in
the shared Gateway workspace and create it up front so the isolated SUT can
append without EACCES. main still writes it under the private tempRoot.
(cherry picked from commit 3cb49f0c4c, adapted to main's runner anchor)
* test(gateway): probe startup readiness on fresh connections
The deferred-fleet startup test failed twice in 2026.10.5 FRV #12 with
`fetch failed` / `read ECONNRESET`. Its Gateway shares the test process's
event loop. A /healthz or /readyz probe could reuse a keep-alive socket
that Undici still treated as live; when the request was written and a
synchronous main-thread startup stall followed, the server's idle-timer
callback ran before the poll phase read the request and destroyed the
socket with the request unread, so the kernel reset the connection.
main still probes with default keep-alive fetches. Probe with
`Connection: close`, matching existing Gateway test probes. Assertions are
unchanged.
(cherry picked from commit e3c63f2de4, adapted to main's probe sites)
* test(live): expect review effort for Skill Workshop background reviews in the Ultra lane
Since #161057 the Skill Workshop counts iterations per session, so Ultra probe
sessions trigger a background review after idling. The review runs under its
own skill-workshop-review: run and does not inherit the session's thinking
level, so the lane's every-request-is-max assertion failed on 2026.10.5
whenever a review reached the provider.
On main, #173889 pins review runs to thinkLevel "low" (review-run.ts), which
the OpenAI stream wrapper sends as effort "low". Expect that effort for review
runs; Ultra runs and their sessions must still be max, and independent
heartbeats stay medium.
The live file is over the line cap, so the Ultra wire effort policy moves to
a sibling helper with its observation type, and the deterministic review
cases run in the normal helper suite.
(cherry picked from commit ca1521329f, adapted to main's review thinking level)
* test(release): forward-port 2026.10.4-line upgrade-survivor and runtime-smoke harness fixes
Release-line harness fixes that 2026.10.1-2026.10.5 carried but main never
received:
- cron-scheduled-authority: seed the cron authority specimen through the
published baseline's own SQLite writer (seedPublishedCronJobs) instead of a
raw cron/jobs.json that current candidates treat as a retired pre-July
store; drop owner fields for pre-2026.7.1 baselines
(usesCronOwnerAtBaseline). The dispatcher passes the package root to
seedState, and the scenario now requires a published baseline.
- bundled plugin runtime smoke: join deferred read-only update discovery via
update.status before the package-manager child watchdog. main still defers
install discovery (`<manager> root -g`) until after ready, so it can race
the watchdog's no-package-manager-children check.
Skips the codex npm plugin live source-reply grep from the release commit:
main already probes dynamic-tool-source-reply.ts and dynamic-tools.ts.
(cherry picked from commit fcdf0d1b2c, codex grep hunk dropped; cron seed
test adapted to main's executable-mode fixture writes)
Keep native policy fixtures under shared test isolation through execution and
cleanup so node-service mocks cannot replace their selected CLI. Preserve all
cancellation, authority, and response-order assertions from the shared-owner
cutover in #177795.
Use an exact-checkout runtime artifact from the Linux build for macOS policy
tests. Install seven workspace dependency closures and omit unused plugin,
UI, and sealed-worker output instead of rebuilding the full workspace on Mac.
Proof: 21 native tests across five suites, 36 focused workflow/planner tests,
76 checkout tests, targeted types/lint/format, workflow validation, and P2 review.
Native exec policy fixtures now use the real CLI after #177795. Install the full workspace and build the runtime before this native test phase; retain filtered dependency installs for other phases and older targets.
Proven with the sandboxed native cwd, socket cancellation and skill-trust suites (10 tests / 32 cases), workflow regression, targeted types/lint, workflow checks and clean P2 review. No native authority, cancellation or timeout changes.
Refresh canonical main through the existing pinned checkout after full-history bootstrap and artifact download, before dependency setup or worker-memory admission. Keep the terminal freshness guard unchanged.
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
* fix(ci): retain locale work after publication deferral
Cache complete per-locale translation memory within its canonical baseline and generation policy. Reuse only source-hash-compatible entries on the next main run while preserving zero-fallback and stale-publication gates.
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
* test(ci): validate the locale memory cache writer
Qualify the exact data-only locale cache paths, immutable key, upstream-main admission and mandatory zero-fallback artifact boundary in the central cache-write guard.
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
* fix(ci): catch up locale artifacts without a shared cache
Replace the translation-memory cache with same-run, identity-bound TM artifacts. Reconcile once on fresh canonical main, preserve canonical corrections and forced refresh, and leave strict validation and the terminal publisher freshness checks unchanged.
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
* test(ci): prove locale finalizer credentialed effects
Exercise real workflow steps, artifact admission, generator requests, strict validation and local Git publication. Retain nearest denied-producer and malformed-artifact controls, and replace the argument-only forced-refresh cases with output proof. Route the long composition through the existing release-proof inventory while retaining fast PR contracts.
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
---------
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
* feat: localize public conversation controls
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
* fix(i18n): preserve public-reader catalog order and mock exports
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
* fix(ci): serialize selected singleton test jobs
Normalize one-group projections only after packing while preserving the previous two-worker ceiling and existing capacity qualifications. Add deterministic failing-base coverage and retain the original four-target assertion.
Verified all 146 planner tests on the exposing localization inventory (109.81s wall), 183 focused planner/capacity tests in the repair checkout, targeted types/lint/format, and independent P0-P2 autoreview. No capacity, timing, memory, build, or runner budget is widened.
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
* perf(i18n): avoid eager locale matcher compilation
Construct only the regexes needed during system-locale selection instead of compiling a second full rule collection at startup. Canonical language prefixes are already lowercase. Regenerate the boot module manifest through its cold/warm capture owner.
Focused locale and public-reader boundaries pass, along with targeted types, lint, format and independent P0-P2 review. New-route gzip is 1049987 bytes under its unchanged 1050000-byte ceiling. Chat gzip remains over the unchanged ceiling and requires the pending budget decision; this is not passing CI evidence.
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
* chore(ui): adjust approved Chat boot byte ceiling
Vincent approved the Chat gzip ceiling adjustment from 1490000 to 1500000 bytes on 2026-10-19. Retain every other request, byte, catalog, and startup baseline limit unchanged.
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
* perf(ui): load catalog popup with existing sidebar menus
Keep retained catalog state eager, but supply its popup renderer from the existing lazy sidebar menu module. First open requests that same loader; view replacement, trigger retargeting, mutation authority and focus remain unchanged. Regenerate the boot manifest through cold/warm capture.
Nine focused owner/mounted tests, strict same-toolchain performance comparison, and independent P0-P2 review pass. New Session is 1049972 bytes under its unchanged1050000 limit; no additional ceiling adjustment. Full build and static checks are being collected separately.
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
---------
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
Moves openclaw CI macOS jobs to the macOS 27 (`xcode-27`) runners; Swift CodeQL stays on macos-26-intel until github/codeql#22742 adds macOS 27 tracing. Deployment floors stay explicit (native app macOS 26.2, shared Swift packages macOS 15, Tauri macOS 13.0).
Admin-merged with three exact-head failures that are inherited from main and not changed by this PR: control-ui-performance (chat boot gzip 1,490,252 B vs 1,490,000 B ceiling, identical on base and head), the OpenAI Decision platform case (matches pinned-main job 117822757020), and the startup-core fixture cold-import race introduced on main by #175989. Autoreview scoped-clean through P2.
The official Docker images were built on Debian 12 bookworm, whose coreutils 9.1 lacks mv --exchange/--no-copy, so Doctor's btrfs NOCOW repair was always skipped in containers (e.g. Synology NAS). Build, runtime and sandbox images now use Debian 13 trixie (coreutils 9.7) with pinned digests and the NOCOW repair utilities; Node stays on 24 to match release CI. Installer test coverage keeps bookworm alongside trixie. Default/slim image +6.1 MB, browser +32.9 MB. Verified: default/slim/browser builds, isolated Gateway, Chromium, and a real btrfs NOCOW repair.
Fixes#171930
* chore(tooling): type check with tsrs instead of tsgo
Switch scripts/run-tsgo.mts (pnpm tsgo, every tsgo:* lane and the CI
type-graph shards) to the pinned tsrs 0.16.0-ts7.1.0-dev.20260929 native
binary. Hosts tsrs ships no binary for (Windows, Intel macOS) keep running
tsgo. tsgo (typescript@7.1.0-dev) also keeps declaration emit, the plugin
SDK consumer check, the core boundary inventory and tsgo:profile.
Requested-by: obviyus (@obviyus)
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Co-authored-by: Kimiyu-186 <202845257+Kimiyu-186@users.noreply.github.com>
* fix(tooling): clear TS 7.1 circularity errors and keep tsgo for releases
TypeScript 7.1 (tsrs and current tsgo nightlies) reports TS5115 on zod's
inferred z.json() nested in z.record() and on postcss-selector-parser's
self-referential Selector type. Give the codex plugin one explicitly typed
JSON schema, and keep the CSS audit scripts off Selector-typed values.
Add OPENCLAW_TYPECHECKER=tsgo as the explicit tsgo fallback and use it for
every type-check lane in Full Release Validation.
Requested by Peter Steinberger.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com>
Co-authored-by: Kimiyu-186 <202845257+Kimiyu-186@users.noreply.github.com>
* fix(tooling): honor invocation typechecker overrides
Use the prepared environment for compiler selection and provenance. Add red/green regressions and keep watchdog fixtures rooted in their own compiler install.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
* fix(test): install the default checker in declaration fixtures
Use the existing private package materializer for tsrs and its optional native dependency. The SDK consumer regression failed on the published head and passes with the complete fixture toolchain.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
* fix(tooling): preserve ordinary Go profiling requests
Select Go for prepared pprof arguments and keep metrics on the same compiler. Fail explicitly forced tsrs profiling instead of silently omitting CPU and heap profiles. Preserve both environment and CLI profiling contracts with owning-boundary regressions.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
* docs: avoid overlapping the formatter tooling guidance
Drop the redundant tsrs annotation from the shared tooling-guide line. The command names are unchanged and the dedicated testing documentation already describes backend selection, so main can retain its newer formatter policy without a conflict.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
* fix(test): run changed-format checks through the package script
Restore the changed-file formatter regression test after the formatter selector wrapper replaced the direct oxfmt package command. Keep real misformatted failure, formatted success, deleted-path handling, and CI parity.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
* fix(test): wait for acquisition admission before cancelling
Keep a retained caller on the held download and wait for the cancelling caller's real abandonment subscription. Initial version probes did not establish waiter admission and could deadlock the cancellation fixture. Preserve all existing installation and shared-download assertions.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
---------
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Co-authored-by: Kimiyu-186 <202845257+Kimiyu-186@users.noreply.github.com>
Co-authored-by: obviyus <22031114+obviyus@users.noreply.github.com>
Related: #176053 (merged; it trims root `AGENTS.md` under the cap)
## What Problem This Solves
Fixes: PRs fail CI on their first push for generated files, docs lint and size caps that a seconds-fast local check would have caught, and root `AGENTS.md` regrows past the 20,000-character cap that OpenClaw loads whole.
## User Impact
No product change. Contributors and agents see these failures at commit time with the regen command, not after a CI round trip. A tracked `AGENTS.md` over the workspace bootstrap cap now fails CI.
## Why This Change Was Made
- **Pre-commit freshness checks.** `git-hooks/pre-commit` (installed by `pnpm install`) now runs existing `--check` scripts, chosen from staged paths and run in parallel: `lint:docs` on changed docs, `protocol:check`, `native:i18n:verify`, `config:docs:check`, the line-cap ratchet, and the new AGENTS.md size check. Each failure prints its fix command. Typecheck, lint and tests stay with hosted CI, and commits replayed by merge, rebase, cherry-pick or revert skip the checks. The content guard (`guard-staged-content.mjs`) runs the step and redacts its output with its existing redactor, so blocked private literals are never echoed. The hook judges only the bytes being committed: checks that import the working-tree code graph (protocol, native i18n, config docs, AGENTS.md size) are skipped with a one-line note when any tracked file has unstaged edits, `lint:docs` is skipped only when its own files or config are dirty, and the line-cap ratchet reads the index and always runs. Plain `node` package scripts start without pnpm. Path predicates live in their owners: `changed-lanes.mts` (also used by `check:changed` for the line-cap ratchet) and `hasProtocolGenerationInput` shared with CI's check family scope.
- **AGENTS.md size check.** `scripts/check-agents-md-size.mts` reads the cap from `resolveBootstrapMaxChars()` instead of copying the number. It runs in the hook, `pnpm check` and the CI check-docs job.
Left out on purpose, because each is too slow or already red on `main` for unrelated files: max-lines ratchet (~30 s), knip unused files (92 s), madge cycles (22 s), Control UI i18n (16 s), plugin SDK API diff (two full builds).
## Evidence
Back-test against first-push CI failures from a 90-day sample of merged PRs (26 rows; 2 retired checks; detached worktrees at each failing head):
| Row | CI failure | Hook before | Hook after |
|---|---|---|---|
| #122960 | docs MD051 link fragments | pass | **fail**, same 3 errors as CI |
| #112339 | Swift protocol models drift | pass | **fail**, same drift |
| #115577 | native i18n inventory drift | pass | **fail**, same message |
| #165543 | config baseline hash | pass | **fail**, same hash mismatch |
| #151896 | line-cap growth 3557 → 3676 | pass | **fail**, same counts |
The other 19 live rows need typecheck, tests, UI build or slow audits, which stay in hosted CI by design.
Size check back-test: it first fails at bb7d32e55d (#167739, 20,414 chars), and fails again at b19d5542f6 (#173903) after the earlier trim.
Freshness step wall time, median of 3 on a warm checkout (before = previous head 7aae97981b, after = this head):
| Staged change | Checks | Before | After |
|---|---|---|---|
| nothing | none | 0.17 s | 0.28 s |
| `CHANGELOG.md` | none | 0.20 s | 0.24 s |
| one docs page | lint:docs | 0.92 s | 1.13 s |
| one `src/**/*.ts` | line-cap | 1.29 s | 1.42 s |
| a scoped `AGENTS.md` | size check | 0.92 s | 1.07 s |
| protocol schema `.ts` | protocol, line-cap | 4.77 s | 4.39 s |
| Android Kotlin source | protocol, native i18n | 4.41 s | 4.48 s |
| plugin manifest | config docs | 8.19 s | 8.97 s |
Spawning `node` directly saves about 0.1–0.3 s per check against `pnpm -s`; the after column also pays one extra `git diff` for the unstaged-input rule. Most of the remaining time is in the checks themselves. `protocol:check` and `config:docs:check` are not cached: their inputs are transitive imports across `src/`, `packages/` and every plugin manifest, and no existing owner lists them reliably.
Checks run: new and existing hook tests, including `test/git-hooks-pre-commit-freshness.test.ts` (real guard, real freshness step and a real `node` runner: a partly staged docs page with a blocked literal in its unstaged edit is skipped; a staged protocol schema with an unstaged edit in an imported owner outside the trigger list skips `protocol:check` while the line-cap ratchet still runs; and a failing check that prints a private literal is redacted), `test/scripts/check-staged-freshness.test.ts`, `changed-lanes.test.ts`, `check.test.ts`, `tsgo:scripts`, `tsgo:test:root`, oxlint, oxfmt. All commits went through the new hook.
**Merge danger:** two-way door; a revert restores the previous hook and CI step. No state, config or published contract changes. Blast radius: every local commit in this repository (adds about 0.3 s to 9 s depending on staged paths) and the CI check-docs job. #176053 has landed, so the size check passes on `main`.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
* ci: default daily tests to Bun and retain dual release validation
* test(ci): align fixtures with the daily Bun policy
* fix(ci): preserve Node-only gateway test routing
Resolve split gateway membership through the existing CI inventories and make the native-launch artifact assertion independent of directory enumeration order.
* test(ci): align Gateway routing with fork-fixed contracts
Replace the infra/integration name split with the existing weighted
allocator over the unchanged target inventory. Commit advisory target
weights; new tests still enter the inventory with a default weight.
Keep worker limits and the existing aggregate gate. Count all three
hosted jobs in admission and restore a 30-minute deadline for every row.
Three hourly runs measured 23.28/12.70, 26.22/15.75, and 25.80/24.87
minutes (35.98, 41.97, and 50.67 total job-minutes). Replaying per-file
spans, project overhead, and the single runtime-build owner projects:
10.82/11.58/17.57, 12.85/13.98/18.30, and 16.43/18.70/20.16 minutes.
For the latest workload, the critical path drops about 5.6 minutes (22%)
at a cost of about 4.6 extra job-minutes. The slowest row has 9.84 minutes
of deadline margin. These are projections, not post-change CI results;
the latest infra run includes eight failed cases and already has #175774.
Evidence: all 88 targets occur exactly once in the dry-run partition.
The old runner fails the new numeric-shard regression. Focused runner,
workflow, admission and allocator tests pass (41 selected tests), as do
targeted types, script/test lint, format, syntax and workflow validation
with pinned actionlint and zizmor. Final P2 review is scoped-clean.
No CI dispatches or reruns were used for proof.
* fix(cli): offline auth commands use the selected engine
* test(cli): update async auth and startup fixtures
* test(cli): document async auth fixture isolation
* fix(cli): prepare agent deletion auth ownership asynchronously
* fix(cli): preserve offline config and auth write boundaries
* fix(cli): keep log diagnostics independent of database credentials
* fix(cli): allow synchronous PostgreSQL access for one-shot commands
Install an immutable process role before executable CLI startup so offline
commands and Doctor repairs can use the existing synchronous bridge. Keep
Gateway and unset main-thread access restricted to explicit admission, and
reject embedded Gateway startup from a process classified as a one-shot.
Preserve the Gateway role for interactive setup paths that can host a session
Gateway. Keep worker behavior unchanged and document the CLI exception.
Stacked on the offline engine-selection work in #174857.
* test(cli): isolate process identity in entrypoint simulations
Keep process-lifetime role immutability real in subprocess coverage while
allowing the existing in-process entry and cleanup fixtures to simulate
separate CLI and Gateway processes.
* fix(cli): select PostgreSQL before one-shot state access
* fix(cli): recover Doctor config before selecting storage
* fix(cli): keep PostgreSQL discovery off SQLite snapshots
* fix(doctor): repair PostgreSQL session state through its engine owner
* fix(cli): complete PostgreSQL Doctor parity and conformance proof
* fix(doctor): prepare PostgreSQL schemas through engine admission
* fix(doctor): inspect PostgreSQL state through its read owners
* fix(doctor): inspect PostgreSQL before maintenance without runtime leases
* ci: budget PostgreSQL infrastructure conformance for complete recovery coverage
* fix(doctor): retain maintenance custody during lease admission
* fix(doctor): inspect healthy PostgreSQL recovery state
* fix(doctor): inspect PostgreSQL media through its owner
* test(cli): allow PostgreSQL recovery capture to finish
* fix(cli): preserve diagnostic storage owners
* test(models): prove PostgreSQL catalog reads through its worker
* test(cli): align PostgreSQL proof tooling with final owners
* fix(doctor): preserve offline config recovery ownership
* fix(doctor): preserve unresolved-config output contracts
* fix(cli): preserve transport and service storage owners
* fix(cli): select the configured owner for mixed config edits
* fix(cli): preserve target owners and PostgreSQL read snapshots
* fix(cli): include snapshot modules in offline tooling
* test(cli): document lifecycle preflight mock isolation
* fix(cli): preserve updater and redirected config ownership
* fix(config): discard rejected source environment during admission
Keep the existing PostgreSQL target inventory and split it into infra/state and integration jobs. Both use the same pinned image and extensions, retain 30-minute budgets, and aggregate through the existing postgres-conformance gate. The prior job consumed 30m20s, including 25m05s in infra before later groups.
