* feat(plugin-sdk): expose local state owner routing for CLI commands
* fix(workboard): route CLI mutations through the active Gateway
* fix(workboard): preserve dispatch without explicit parameters
* fix(plugin-sdk): type and account for the CLI ownership surface
* test(workboard): preserve state owner module exports
* test(workboard): prune the retired config mock allowance
* test(workboard): load plugin owners through public test surfaces
* test(workboard): type owner routing fixtures precisely
* test(workboard): type the facade export as a standalone function
* fix(workboard): report empty worker results for offline dispatch
* test(workboard): exercise Gateway lifecycle through RPC
* perf(sqlite): checkpoint shared admission across workers (WIP)
* test(sqlite): align worker fixtures with shared admission
* perf(sqlite): avoid repeated quarantine reads in retained scopes
* docs(sqlite): define single-owner database freshness
* perf(sqlite): replace runtime probes with writer publications
Checkpoint the single-owner cutover, cache invalidation regressions, and request-owned read transactions. Keep explicit migration verification. Paired measurement and final validation are still in progress.
* test(sqlite): align first-admission coverage and deletion fixtures
Route retained existing-state writer coverage through the host-owned worker project, preserve first-admission incompatibility refusal, and match the final deletion-authority contract. Keep the gateway test under its inherited line count by moving existing pure fixture helpers. Regenerate assertion allowances without adding production assertions.
* build(sqlite): include shared admission in compiled wrappers
Include the thirteen transitive admission modules required by the native wrapper import-closure proof. Carry the existing birthtime through the worker validation fixture to preserve its physical-file identity.
* test(sqlite): use the canonical settlement owner in publication proof
* fix(sqlite): complete writer custody and snapshot cache lifetimes
Preserve snapshot-local reuse without freshness queries, publish dedicated archive writes, and remove Workboard polling. Retain native authority and settlement boundaries. Checkpoint reviewed corrections and focused regression repairs; final integrated proof remains in progress.
* test(sqlite): exercise worker failure through its owner
* fix(sqlite): retain integrity and worker admission through cleanup
* fix(sqlite): preserve cleanup and explicit maintenance validation
* fix(sqlite): retain revocation and scoped worker admission
* test(sqlite): preserve reader coverage in existing fixture owners
* fix(sqlite): preserve cache receipts across sibling writers and temp DDL
* fix(sqlite): preserve migration and read-cache owners
* fix(workboard): type the replacement card-list promise
* fix(sqlite): preserve maintenance and bootstrap admission
* fix(sqlite): keep temporary trigger admission connection-local
* fix(sqlite): preserve unavailable discovery target isolation
* style(docs): normalize merged worker access spacing
* test(state): include admission lifecycle in heartbeat diagnostics mock
* test(sqlite): align CI fixtures with single-owner receipts
* fix(sqlite): avoid invalidating search on empty maintenance
* test(sqlite): exercise managed writers at authority boundaries
* test(auth): preserve staging refusal contract
* fix(sqlite): name bounded cleanup row identifiers explicitly
* refactor(sqlite): consolidate admission and scope bookkeeping
* test(sqlite): admit competing writers before grant races
* fix(sessions): preserve typed reclamation worker transport calls
* fix(state): use owned read snapshots for migration witnesses
Adapt the migration-preservation caller added on main to the single-owner SQLite cutover. Preserve a consistent multi-statement snapshot without restoring data_version probing.
* style(sessions): sort archive worker relay import
When `openclaw workboard dispatch` refuses a card whose workspace is outside the caller's allowed workspaces, name the card and point to `--admin` (which needs operator.admin) instead of a bare failure count. Authorization behavior is unchanged.
Fixes#167346.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
* fix(workboard): reject invalid list status filters
Reject mistyped status filters with allowed choices instead of silently reporting an empty board. Reuse Commander choices through the existing command instance. Reproduced through the isolated CLI; the owner regression fails before and passes after the fix.
* fix(workboard): preserve columns when renaming session boards
Track the original session-board draft alongside appearance fields and publish columns only when edited. A metadata-only save no longer overwrites concurrent column changes. Proven with two real browser tabs, a failing-before/passing-after owner regression, synthetic screenshots, related suites and changed checks. Refresh generated Control UI asset references.
* test(workboard): cover fallback-only session board saves
The fallback flag lives on each column, and the rename dirty check compares
the full structuredClone'd column snapshot, so a fallback-only edit is still
published. Pin that behavior next to the two-tab rename regression.
* chore(workboard): refresh Control UI asset references
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Remove Tasks and TaskFlow runtime, APIs, CLI, SDK surfaces and panels after the Cron, session, native execution and media completion ownership cutovers. Preserve stored rows and import provable legacy native assignments through Doctor; ambiguous ownership stays untouched with a warning.
Follows #158221, #158217, #158225, #158222, #158702 and #158776. Related: #156532. Task-specific public APIs retire immediately; retained responsibilities use their existing owners.
Maintainer-authorized administrative landing after full CI run 36312986498 attempt 2 passed on 274595e2, with subsequent actual conflicts reviewed and focused checks passing. Current PR CI preflight hits the 64 KiB changed-path metadata limit before tests (run 36335042695); its duplicate security-review status mirrors that planning failure. Review and scoped proof are recorded in the PR. Published 9.4 native import is proven; remaining native completion and 9.4 rollback witnesses are explicitly unproven.
## What Problem This Solves
Every ready card gains dispatch history even when no worker starts. Thanks to @gregbond for measuring the repeated stamps. Closes#143842.
## Why This Change Was Made
Remove the scan-only write and its unused helper. This state has one writer: card mutation records actual maintenance, claim and execution transitions.
## User Impact
Idle scans preserve ready-card history, waiting age and edit versions. Real launches still record their launch state, attempts and execution events.
## Compatibility
Existing dispatch counters, timestamps and events remain readable and unchanged. No schema, stored shape, ledger or retention change. Both dispatch guides describe this behavior. Legacy notification repair from #120999 still runs during real metadata updates.
## Evidence
Three `openclaw workboard dispatch --board intake-proof --max-starts 1 --json` calls against an isolated Gateway: zero starts, six added events before; zero card changes after. Releasing capacity records an accepted launch and reaches the local provider. Expired-claim and dependency-promotion controls pass.
## Consumers
CLI, dashboard history, waiting diagnostics and capacity explanations retain their contracts. Idle scans no longer reset waiting age.
## Invalidation
Real card mutations still publish changes; idle scans publish none.
## Tests
Registered regression fails on main and passes with the fix. All 322 owner and sibling tests pass on a fresh merge. Type, lint, formatting and static checks pass.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Adds consistent manual Workboard movement across CLI, slash commands, and agent tools while preserving operator authority and agent claim isolation.
Co-authored-by: Ross I4JU <ross@i4ju.ch>
* fix(workboard): hide archived cards in CLI list by default
The `openclaw workboard list` CLI printed soft-archived cards, while the
`workboard_list` agent tool and the `/workboard list` command both hide
cards with `metadata.archivedAt` set unless archives are requested. Users
who archived cards still saw them in CLI output and assumed archive failed.
Filter archived cards by default in the CLI list handler and add an
`--include-archived` flag mirroring the tool's `includeArchived` option, so
all three list surfaces share one default. Docs updated to match.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix(workboard): preserve json list archive visibility
* fix(workboard): preserve json list archive visibility
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
