Skip to content

ci(e2e): prepare trusted OpenClaw 10.5 qualification - #13697

Draft
prekshivyas wants to merge 9 commits into
mainfrom
nemopatch/openclaw-10-5-qualification-prerequisites
Draft

prekshivyas wants to merge 9 commits into
mainfrom
nemopatch/openclaw-10-5-qualification-prerequisites

Conversation

@prekshivyas

@prekshivyas prekshivyas commented Oct 25, 2026 •

Copy link
Copy Markdown
Collaborator

Outcome

Prepare trusted E2E qualification for the OpenClaw 2026.10.5 upgrade in #12382. Admit the reviewed upgraded runtime and WeChat locks while preserving current main compatibility, and provision Python 3.13 for the Model Router job.

Reason

Full PR E2E executes these controls from trusted main. Run 40127403758 rejected the 10.5 lock before protected runtime qualification. Its Model Router job separately failed because the runner supplied Python 3.14, outside the supported range; that failure also reproduced on the exact base. Candidate-only changes cannot replace these trusted prerequisites.

Changes

  • Admit OpenClaw 2026.10.5 and WeChat 2.4.10 through the existing replacement identity fields. Retain main's OpenClaw 2026.9.2 and WeChat 2.4.9 locks, historical archives, signature verification and audit thresholds.
  • Supply complete pinned 2026.9.5 and 2026.9.7 migration graphs for the declared audit inputs, without activating those runtimes on main.
  • Reuse the reviewed dependency remediation before installed-lock verification. Both bundled npm wrappers share archive verification, replacement and rollback. An interrupted replacement can restore one verified affected backup when the live package is missing. Existing paths, ambiguous backups and unverified staging trees are preserved; cleanup removes a recognized backup only after verifying the fixed live package.
  • Extend the real 10.5 distribution harness to exercise npm/npx, Discord SDK parsing, Google Chat account parsing through patched Zod, and Slack Bolt JSON/form parsing through its patched local parser graph. Invalid account input and malformed JSON are rejected.
  • Provision Python 3.13 through the existing reviewed action pin only for Model Router. Workflow-boundary tests preserve the pin and selection boundary. Sparse checkouts include the helpers required by the trusted remediation. Product support, live assertions and deadlines remain unchanged.
  • Preserve complete runtime and plugin metadata across interrupted writes: stage and verify replacement bytes, preserve ownership and mode, then atomically rename. Sync the parent directory after replacement and on an already-patched retry. Report sync failures while preserving complete metadata. Failure and retry tests cover workspace, manifest, lock and Discord/Google Chat/Slack metadata.

Verification

Current candidate: b129839300146cb50f32002f160ca29ed8780662. Normal isolated commit and actual pre-push hooks passed, including publication validation and CLI TypeScript. The commit is GitHub Verified. Validation cannot read host credentials; SSH transport runs outside that boundary.

  • The directory-sync regression fails before the repair. All 133 focused and sibling tests passed. After moving the fault setup into the existing test helper, all 31 runtime-remediation tests and seven growth checks passed. No assertion or deadline changed.
  • The preceding atomic-write repair passed all three real 10.5 messaging consumers after injected failures and retry: Discord SDK parsing, Google Chat parsing through patched Zod, and Slack Bolt JSON/form parsing. Archive integrity and npm/npx execution remained verified. All 32 Hermes integrity tests passed on each branch.
  • Two exact-title source-shape exceptions preserve byte-level compatibility assertions. The zero-case budget and scanner remain unchanged; independent acceptance is pending.
  • The previous shared repair's broad npm run check failed in the credential-denying macOS environment. Comparison with the published parent reproduced 631 of 647 failures; 15 passed without coverage, and one candidate fixture defect was repaired. No sandbox rule, deadline or assertion was weakened. This remains a classified failed local broad run.

Parent abde906235128e41ba5f38656c9a8b63418dbd5d passed main CI on attempt 2. All 12 CLI shards, strict Pi receipts, distribution tests, audits, installer, SDK, plugin and type checks passed. The only first-attempt test failure was an unchanged terminal Ctrl-D package-contract case. Its diagnosed failed-job retry passed all 1,360 package-contract tests with ten skips; the timing cause remains unproven.

That parent also passed managed-image qualification on Docker AMD64, Docker ARM64 and rootless Podman. Each lane verified 36 authenticated model requests, zero local builds, native 9.2 post-restart PONG, external-image lifecycles, 13 cleanup checks and ten empty final inventories. Podman proved Docker absence and no invocation. All seven artifact archives and source/run/cohort identities were verified.

The parent's Advisor review returned nine verified specialist reports: seven clear, one directory-sync finding repaired here, and one production-wiring false positive. This prerequisite retains main's 9.2 production Dockerfiles and runtime graph; #12382 wires the helper into its separate 10.5 image paths. The documentation now states that boundary. The failed Advisor gate is retained as evidence, not independent clearance.

This source repair changes image inputs. The current static check rejected the older Pi receipts because their source revision predates the shared metadata change. The strict check is unchanged. Both Pi jobs passed in image qualification. Their same-branch artifacts passed digest, source/run/cohort, entrypoint and credential-removal checks. The two receipts and authority hashes are staged locally; the strict receipt checker and all 17 candidate tests pass. This receipt repair is not yet committed or published; complete candidate evaluation remains required first. No unchanged retry is planned for this deterministic failure. The main CI run is now complete: 21 jobs passed, two were skipped, and only this static receipt check and its aggregate failed. All 12 CLI shards, actual distribution recovery tests, audits, installer, SDK, plugin and type checks passed. Advisor skipped after the CI failure and supplies no review clearance. Both OpenClaw producer jobs passed, and their artifact digests and source/run/cohort contracts were verified. Docker AMD64, Docker ARM64 and rootless Podman activation are running. Their cleanup evidence and independent review remain pending. Parent evidence does not qualify the new candidate.

Review notes

Self-review covers the complete four-file repair against the evaluated parent and canonical main bbdd0bcf8913a537a1126a40a144bac4def5986f. The shared writer closes the directory descriptor on failure and retries sync even when replacement bytes are already present. The change makes no all-files transaction or general power-loss guarantee. No credential, live assertion, deadline or validator changes are included.

The Model Router provider-routed inference recommendation remains required. Full default E2E for #12382 needs this prerequisite independently reviewed and landed on trusted main. Keep this PR draft until qualification and independent review pass.


Signed-off-by: Prekshi Vyas prekshiv@nvidia.com

@copy-pr-bot

copy-pr-bot Bot commented Oct 25, 2026

Copy link
Copy Markdown

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

@coderabbitai

coderabbitai Bot commented Oct 25, 2026

Copy link
Copy Markdown
Contributor

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Oct 25, 2026 •

Copy link
Copy Markdown
Contributor

Code coverage overview

Languages: TypeScript

TypeScript / code-coverage/plugin

main 63002cd nemopatch/openclaw-1... b129839 +/-
96% 97% +1%
View coverage of the 10 most impacted files.
File main 63002cd nemopatch/openclaw-1... b129839 +/-
nemoclaw/src/onboard/config.ts 98% 96% -2%
nemoclaw/src/index.ts 94% 93% -1%
nemoclaw/src/bl...print/runner.ts 95% 95% 0%
nemoclaw/src/bl...ime-identity.ts 97% 97% 0%
nemoclaw/src/bl...t-management.ts 100% 100% 0%
nemoclaw/src/co.../config-show.ts 100% 100% 0%
nemoclaw/src/commands/slash.ts 100% 100% 0%
nemoclaw/src/ru...time-context.ts 100% 100% 0%
nemoclaw/src/sh...er-boundary.cts 100% 100% 0%
nemoclaw/src/on...native-route.ts 0% 100% +100%

TypeScript / code-coverage/cli

main 63002cd nemopatch/openclaw-1... b129839 +/-
84% 86% +2%
View coverage of the 10 most impacted files.
File main 63002cd nemopatch/openclaw-1... b129839 +/-
src/lib/onboard.ts 62% 50% -12%
src/lib/actions...ess-recovery.ts 65% 81% +16%
src/lib/state/l...diness-lease.ts 66% 83% +17%
src/lib/inferen...ollama/proxy.ts 41% 61% +20%
src/lib/onboard.../application.ts 55% 84% +29%
src/lib/domain/...y/dimensions.ts 0% 72% +72%
src/lib/inferen...er/lifecycle.ts 0% 73% +73%
src/lib/actions...ry/operation.ts 0% 76% +76%
src/lib/actions...try/snapshot.ts 0% 81% +81%
src/lib/inferen...ovider/index.ts 0% 88% +88%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.


Updated October 25, 2026 14:02 UTC

@github-actions

Copy link
Copy Markdown
Contributor

PR Review Advisor finished for commit abde906. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

Request review only when Require no Advisor blockers is green.

All previous runs

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant