diff --git a/.agents/skills/auto-qa/SKILL.md b/.agents/skills/auto-qa/SKILL.md index 3b84f04d909a..c116015cbacf 100644 --- a/.agents/skills/auto-qa/SKILL.md +++ b/.agents/skills/auto-qa/SKILL.md @@ -24,7 +24,7 @@ Run a continuous, current-`main` OpenClaw product campaign. Treat a reviewer fin ## Start with the moving source 1. Read all of root `AGENTS.md`, then each scoped guide for the lanes under inspection. Read the current skill for a specialized workflow instead of reproducing stale instructions: - - `$openclaw-landable-bug-sweep` for bug acceptance and duplicate handling. + - `$openclaw-repair-sweep` for bug acceptance and duplicate handling. - `$openclaw-testing` for actual test and CI selection. - `$openclaw-qa-testing` for QA Lab, scenario catalogs, and real provider lanes. - `$control-ui-e2e` for browser and Control UI proof. diff --git a/.agents/skills/openclaw-autonomous-issue-sweep/SKILL.md b/.agents/skills/openclaw-autonomous-issue-sweep/SKILL.md deleted file mode 100644 index 6f1b9a595781..000000000000 --- a/.agents/skills/openclaw-autonomous-issue-sweep/SKILL.md +++ /dev/null @@ -1,361 +0,0 @@ ---- -name: openclaw-autonomous-issue-sweep -description: "Orchestrate 64 autonomous OpenClaw issue workers newest-to-oldest with isolated issue worktrees and resource-bounded parallelism; investigate bugs, simplify or refactor, review, land verified fixes, close already-fixed issues, and add meaningful evidence." ---- - -# OpenClaw Autonomous Issue Sweep - -Run an end-to-end maintainer campaign, not a candidate shortlist. The parent -conversation is the orchestrator: delegate discovery, investigation, coding, -testing, review, GitHub mutations, PR preparation, landing, and cleanup to -subagents. Keep parent-thread updates to concise progress and clickable URLs. - -## Authority and campaign shape - -- Spawn exactly **64 first-class subagents** unless the user requests another - count or available capacity makes that impossible; disclose the actual count. -- Use full-history forks so every subagent inherits the orchestrator's model - and **xhigh reasoning effort**. Never print, record, or disclose model - identifiers; redact subprocess banners and diagnostics before reporting. -- Begin every full-history child assignment with its explicit role and agent - identity, require inherited **xhigh reasoning effort**, and forbid - `create_goal`, visualizations, `spawn_agent`, or nested agents. Children - return evidence to the orchestrator; never downgrade their model or effort. -- Treat a request to run this workflow as authority to create lightweight, - issue-scoped isolated Git worktrees and `codex/issue-` branches, review, - fix, refactor, commit, push, create/update PRs, land eligible changes, - comment, and close issues individually. Do not ask for separate worktree or - routine-operation confirmation again. -- Never treat sweep authority as permission to publish releases, bump protocol - or SQLite schema versions, weaken security, break shipped compatibility, - change another owner's protected product surface, or execute untrusted code - with local credentials. -- Have subagents read the complete root `AGENTS.md`, relevant scoped guides, - `VISION.md`, and companion skills before acting. Use `$gitcrawl`, Octopool, - `$openclaw-pr-maintainer`, `$openclaw-testing`, `$crabbox`, and `$autoreview` - where each owns the workflow. -- Keep the parent out of operational work. It may spawn, assign, receive - results, serialize shared resources, monitor host/pool health, prewarm and - allocate needed remote leases, issue follow-up tasks, and report; it must - not inspect issues, edit code, run tests, mutate GitHub, or land PRs. - -## Coordinate 64 workers safely - -1. Assign one subagent to maintain the live open-issue queue in descending - `createdAt` order, one to coordinate landing/proof capacity, and no more - than **3** to live issue closures or other GitHub mutations. Assign the - remaining slots to issue investigations; idle coordinators also investigate. -2. Claim issues from the newest unclaimed end only; replenish workers as they - finish. Parallel completions may arrive out of order, but never knowingly - start an older unclaimed issue ahead of a newer available issue. -3. Deduplicate by canonical root cause, not merely by issue number. Let one - owner fix a shared defect and link related issues/PRs to that outcome. -4. Freeze the reviewed source SHA for each wave. Serialize only shared Git/ref - mutations: fetches, branch/ref changes, `git worktree add`/remove, PR - preparation and merges, and main-targeted pushes. Give each mutation a brief - coordinator-owned exclusive slot; do not hold it across coding, proof, - reviews, remote waits, or other independent issue work. -5. Give every independent root-cause fix its own isolated, issue-scoped - lightweight worktree and `codex/issue-` branch. Create it from the - frozen SHA, for example: - - ```bash - git worktree add -b "codex/issue-$issue_id" \ - "$campaign_worktrees/issue-$issue_id" "$frozen_main_sha" - ``` - - Reuse a repo-native isolated PR worktree when repairing an existing PR; - duplicate issues sharing one root cause share its single owner/worktree. - Share Git objects; do not clone the repository or install dependencies per - worktree merely for isolation. Never edit, switch, reset, or otherwise - mutate the shared checkout while sibling workers are active. Once isolated - worktrees exist, independent issue owners edit, inspect, and verify in - parallel within their own checkout. - -6. Keep all **64** inherited high-effort agents available, but distinguish idle - agents from active local tool users. Start with bounded waves of **4–8** - concurrently active code/test workers and continuously reduce or expand that - limit according to usable CPU/load, memory/swap pressure, checkout and temp - free disk, process count, operator-gateway health, and remote-pool capacity. - Reserve capacity for the operator; count heavyweight proof proportionally, - stop admitting new commands under sustained pressure, and resume in small - waves after recovery. Never kill unrelated operator processes. -7. Serialize merges and each Testbox lease, not independent worktree edits. A - lease has one owner and one active command; never reclaim, sync, or change - its head during a run. -8. Respect GitHub rate limits, active assignees, repository ownership, and - existing contributor work. Do not auto-assign broad-discovery candidates. -9. Replace finished workers while the queue remains. Record actual active, - parked, completed, failed, fixed, landed, verified-closed, queued-for-close, - commented, and skipped counts. Persist that campaign checkpoint for resumed - workers; never report launched, parked, or finished workers as still running. - -## Conserve GitHub capacity and host resources - -- Prefer local `$gitcrawl` archives and source history for queue discovery, - issue/PR search, duplicate clusters, comments, and previously merged work. - Check archive freshness; do not broadly sync, enrich, or re-embed merely to - start a sweep. -- Prefer `octopool gh ...` or narrowly bounded `octopool request` for - necessary live GitHub reads and mutations. Check `octopool health` and - `octopool stats` periodically; let repo-native PR wrappers retain their - required GitHub transport and authenticated identity. -- Use plain `gh` only when Octopool cannot support the operation or the - canonical maintainer wrapper requires it. Request minimal fields, reuse - results across workers, batch compatible reads, avoid unbounded pagination, - and never use `gh run watch` or frequent unchanged CI polls. -- Require a fresh live state check only before consequential mutations, final - merge decisions, or a stale/contradictory cached result. Rate-limit and - deduplicate worker requests instead of having 64 agents independently fetch - the same issue, PR, author profile, or CI rollup. -- Keep disk, CPU/load, memory pressure, active lease IDs, provider trust class, - issue-worktree ownership, active local tool count, frozen heads, and pool - capacity in the orchestration ledger. Dynamically cap concurrent code/test - workers instead of serializing every independent fix. Pause or interrupt only - campaign-owned work under host pressure, preserve each issue's claim and - isolated checkout, then resume from that recorded state when capacity returns. - Offload heavy proof before resource pressure threatens the host. -- Worktree checkout and dependency use must respect free-disk headroom. Reuse - shared Git objects and existing trusted dependency installs where safe; route - dependency-missing or heavyweight proof to the selected remote box instead - of multiplying local installs across issue checkouts. -- The parent may prewarm a trusted Crabbox/Testbox lease when a concrete heavy - proof is imminent, then hand its verified lease ID and checkout ownership to - one subagent at a time. Avoid speculative fleets, respect path-scoped lease - ownership, and stop campaign-owned leases before handoff or closeout. -- Keep untrusted contributor proof on a separate sanitized direct-AWS lease; - never transfer a credential-hydrated trusted lease to untrusted work. - -## Search for existing work on every credible issue - -Always investigate existing PRs before implementing a fix: - -1. Read the live issue body, all material comments, labels, assignments, - timeline/cross-references, repro details, affected versions, and ClawSweeper - findings. -2. Search `$gitcrawl` for the issue number, title, error text, affected - subsystem, relevant symbols, duplicate symptoms, open PRs, merged PRs, and - recently closed work. -3. Verify candidates against Octopool-backed live GitHub search, directly - linked PRs, current PR heads, `origin/main`, and commit history. Search - exact issue references and symptom/root-cause terms; do not stop at the - first plausible PR. -4. Read competing implementations deeply enough to decide whether an existing - PR already fixes the real defect, merely masks one symptom, has gone stale, - or reveals a cleaner owner-boundary refactor. -5. Preserve contributor commits, attribution, issue reporter credit, and useful - ideas whenever repairing or replacing existing work. - -Choose outcomes in this order: - -1. **Fixed on main:** prove the original failure is resolved; close with the - exact merged PR, commit, current source/test, or release proof. -2. **Existing PR is the best fix:** improve it as needed, verify the exact - final head, and land it through the repo-native maintainer workflow. -3. **Existing PR is useful but incomplete:** finish it or create a cleaner - replacement that preserves human attribution and links the original. -4. **No suitable PR:** implement the best high-confidence root-cause repair or - a justified simplifying refactor; create, verify, and land a focused PR. -5. **Bug cannot be fixed, but simplification is real:** independently land a - proven behavior-neutral refactor when it meaningfully removes complexity - without pretending the original issue was fixed. -6. **Cannot fix or close:** comment only if investigation uncovered concrete, - material evidence missing from the issue and ClawSweeper's existing review. - -## Prove the bug and choose the best design - -- Trace the actual user path from entry point through caller, canonical owner, - callee, sibling implementations, transport/lifecycle boundaries, tests, - current `main`, shipped contracts, and direct dependency source or docs. -- Personally inspect sibling `../codex` source before any Codex integration - verdict or change, as required by the root guide; another agent's report is - not sufficient for the agent making that decision. -- Require a failing regression, reproducible command, real logs, live product - behavior, dependency contract, or exact source-level proof. Never repair an - issue on title, speculation, ClawSweeper output, or a plausible diff alone. -- Prefer the correct owner-boundary refactor over a narrow guard, workaround, - new fallback, duplicate policy, extra configuration, or compatibility shim. - A larger refactor is appropriate when it fixes the whole bug class more - clearly and its behavior/ownership risk remains understood and bounded. -- While reading, look for dead branches, unused helpers, duplicate paths, - stale abstractions, obsolete tests, and complexity that can be deleted as - part of the same coherent change. -- Measure `git diff --numstat`; aim to reduce **production LOC**, excluding - tests. Production growth is acceptable only when clearly justified by fewer - concepts, better ownership, essential product behavior, or stronger safety. -- Allow small missing product affordances, such as an obviously expected CLI - command, when adjacent behavior and docs establish the contract. Reject - substantial new features, speculative redesign, new paid services, - unsupported integrations, or unrelated drive-by changes. -- Do not edit `CHANGELOG.md`; capture user impact, issue/PR references, and - human credit in the PR body or commit message. - -## Hard issue-closure gate - -An issue stays open unless every step below passes. Similar wording, adjacent -tests, merged PR dates, contributor suggestions, and confident review summaries -are not closure proof. - -1. Write down the reporter's exact **primary symptom**, desired user-visible - outcome, every separately affected surface, reported version/build SHA, and - all proposed alternatives. An optional mitigation or diagnostic suggestion - does not replace the reported primary outcome. -2. Personally trace both shipped and current behavior end to end: entry point, - canonical owner, caller, callee, dependency contract, sibling surfaces, and - existing tests. Reproduce the exact reported failure on the affected build - and prove the same user action succeeds on current `main`. Use a runnable - product or boundary-level regression; a nearby unit test, revised error text, - or an unexecuted source inspection is insufficient. -3. Prove Git ancestry rather than inferring it from dates: - - ```bash - git merge-base --is-ancestor "$fix_sha" "$current_main_sha" - git merge-base --is-ancestor "$fix_sha" "$reported_build_or_tag_sha" - git tag --contains "$fix_sha" - ``` - - The fix must be an ancestor of current `main`. Compare it against **each** - affected exact build/tag, account for diverged release branches, and identify - the first containing release when known. A merge before a release date does - not prove inclusion in that release. If the fix was already in an affected - build, assume the report still reproduces until a later causal fix is proved. - -4. Classify the candidate honestly: root-cause repair, mitigation, diagnostic - improvement, unsupported contract, workaround, or product decision. Never - close because a suggested fallback landed if the primary action still fails, - any reported surface remains broken, an owner hold exists, or documented - behavior requires an unresolved maintainer/security/product decision. -5. Require a **different, independent subagent with inherited xhigh reasoning** - to challenge the investigator's closure packet. The challenger personally - verifies the primary outcome, every affected surface, runtime owner and - contract, release ancestry, and before/after proof. The investigator cannot - self-approve; only a separate authorized closure coordinator may grant the - mutation after both reviewers agree. Any disagreement means **leave open**. -6. Immediately recheck live GitHub state, labels/owner holds, current `main`, - and exact proof. Do not close on stale state, an incomplete source map, an - indirect main-only test, changed wording without changed behavior, or any - unresolved facet. In **one sentence**, the closure comment must state the - exact fixed behavior, fix SHA/PR, first containing version when known, and - before/after evidence. -7. If a closure is challenged or an incorrectly closed issue is reopened, - **pause all closure mutations**. Audit earlier closures, correct the public - record, reopen proven mistakes, and resume only after explicit root - authorization. Continue safe investigation and verified code-fix work. - -Required evidence map: - -```text -Primary symptom -> expected outcome -> every reported surface -> affected build/tag -Entry -> caller -> canonical owner -> callee -> dependency -> sibling -> boundary proof -Fix SHA -> current-main ancestry -> each affected-build ancestry -> containing release -Affected-build failure -> current-main success -> independent challenge -> coordinator grant -``` - -Reject example: a remote command fails because its explicit working directory -does not exist on the target host. A merged change that only replaces a vague -spawn error with an accurate invalid-directory diagnostic is useful, but the -command still fails. If the primary expected outcome is successful execution, -leave the issue open; changing that explicit-directory contract may need an -owner decision. - -## Verify behavior and obtain two independent reviews - -For every non-trivial production change: - -1. Add focused regression coverage for the original bug and affected sibling - paths. Delete tests protecting removed obsolete implementation details. -2. Choose proof with `$openclaw-testing`. Live-test the real user/provider/ - channel/CLI/package/UI path whenever feasible. Route heavy, packaging, - Docker, E2E, or broad checks through `$crabbox`; report an unavailable live - prerequisite accurately instead of calling a mock live proof. -3. Classify source trust before executing anything. Never run contributor/fork - scripts, hooks, config, tests, installs, or wrappers locally or on a - credential-hydrated host; follow the sanitized untrusted-source workflow. -4. Run `$autoreview` on the complete final change until no accepted actionable - findings remain. Re-run it after any production, test, or reviewed-head - change. Treat review findings as hypotheses and verify each against source. - Prose-only skill files and other non-production internal notes do not need - autoreview; validate their structure and formatting instead. -5. Separately self-invoke an independent Codex reviewer. First verify the - installed interface with `codex exec --help`, then run a bounded read-only, - ephemeral review from a trusted checkout, for example: - - ```bash - codex exec --json --sandbox read-only --ephemeral \ - -C "$trusted_checkout" --output-last-message "$review_result" \ - "Independently inspect the frozen candidate diff and its owner, callers, - siblings, tests, current main, user behavior, and dependency contracts. - Report only concrete correctness, architecture, simplification, or - verification gaps. Do not modify files or expose secrets." \ - >/dev/null 2>/dev/null - ``` - - Point the reviewer at the exact immutable diff/head. Do not substitute the - `$autoreview` Codex engine for this separate pass. Never run that reviewer - from an untrusted project-controlled checkout. Read only the final review - result; do not emit raw model banners. Verify actionable findings, make - justified fixes, rerun proof, and refresh both independent reviews. - -6. Read the latest ClawSweeper comment and address each applicable `Rank-up -moves:` item with real evidence or an explicit reason for skipping it. - -## Publish, land, and clean up - -- Prefer an existing writable contributor PR. If its head is unsuitable or - cannot be updated safely, open a focused replacement, explain the - relationship, and preserve attribution. -- Before opening replacement PRs, verify author association, active-PR counts, - repository permission, branch policy, current auto-response exemptions, and - override labels; never assume a privileged-role exemption. Reuse or land - existing reviewed work before creating a burst of competing PRs. -- Use the actual PR template and state the user impact, canonical root cause, - rejected alternatives, production LOC delta, exact head SHA, focused/live - proof, autoreview result, independent Codex result, CI state, and credit. -- Read `$agent-transcript` for agent-created PRs, but do not include logs - without the user's explicit transcript approval. During a fully autonomous - sweep, omit transcripts rather than interrupting the user for consent. -- Open new PRs as drafts, wait for a non-null mergeability result, mark them - ready, and verify CI attached to the exact pushed head before landing. -- Autonomously land only a reproduced, high-confidence, bounded-risk repair - or behavior-neutral simplification with clean independent reviews and green - exact-head required proof. Change size alone is not the risk criterion. -- For main-targeted PRs use only the repo-native `scripts/pr` flow: initialize - review, create/validate review artifacts, run - `OPENCLAW_TESTBOX=1 scripts/pr prepare-run `, then - `scripts/pr merge-run `. Verify the canonical merge SHA afterward. -- Keep owner/security/auth/config/public-SDK/protocol/persistent-state/product - decisions outside autonomous landing when the relevant guide requires owner - judgment. Continue with the next issue instead of blocking the whole sweep. -- Close a fixed issue only after the complete **Hard issue-closure gate**, - independent challenger sign-off, coordinator grant, and fresh live recheck. - Cite the exact causal PR/commit and first containing release when known. -- Never close merely because a repro is difficult, the report is inconvenient, - the behavior might be intentional, or the PR is stale. Product-decision and - won't-implement closures require maintainer judgment. -- If no fix is possible, comment only when supplying new reproducible steps, - an exact failing owner/line, verified dependency behavior, previously - unidentified duplicate/fixing PR, a concrete workaround, or another - meaningful fact absent from prior discussion and ClawSweeper. -- Recheck live state immediately before every mutation; avoid redundant, - speculative, noisy, or duplicate comments. Handle closures individually and - follow repository limits on bulk operations. -- After verifying the canonical landed SHA and preserving contributor credit, - remove only that campaign-owned isolated worktree during a brief serialized - Git mutation slot. Delete its campaign-owned branch only when no unlanded - work depends on it; never prune unrelated worktrees, refs, or user files. - -## Parent-thread reporting - -Send concise progress plus URLs only. Prefer updates such as: - -```text -64 agents active · 41 investigated · 3 landed · 5 already-fixed issues closed -Landed: https://github.com/openclaw/openclaw/pull/123 -Closed: https://github.com/openclaw/openclaw/issues/456 -``` - -Do not narrate routine reads, pending hypotheses, unchanged CI, or candidate -URLs that are not actually ready. Count only verified merged PRs, confirmed -closures, and comments that were really posted. Continue until the user stops -the sweep, the requested boundary is reached, or the live issue queue is -genuinely exhausted. diff --git a/.agents/skills/openclaw-autonomous-issue-sweep/agents/openai.yaml b/.agents/skills/openclaw-autonomous-issue-sweep/agents/openai.yaml deleted file mode 100644 index ac7c3f2276c8..000000000000 --- a/.agents/skills/openclaw-autonomous-issue-sweep/agents/openai.yaml +++ /dev/null @@ -1,4 +0,0 @@ -interface: - display_name: "OpenClaw Autonomous Issue Sweep" - short_description: "Autonomously fix, refactor, land, and close issues" - default_prompt: "Use $openclaw-autonomous-issue-sweep to orchestrate 64 subagents through OpenClaw issues newest to oldest; reuse existing PRs, prove and land high-confidence fixes or refactors, close resolved issues, and report concise progress plus URLs." diff --git a/.agents/skills/openclaw-landable-bug-sweep/SKILL.md b/.agents/skills/openclaw-landable-bug-sweep/SKILL.md deleted file mode 100644 index cec5c3f3e715..000000000000 --- a/.agents/skills/openclaw-landable-bug-sweep/SKILL.md +++ /dev/null @@ -1,224 +0,0 @@ ---- -name: openclaw-landable-bug-sweep -description: "Find or repair a requested batch of small high-confidence non-SDK-boundary OpenClaw bugfix PRs until they are landable." ---- - -# OpenClaw Landable Bug Sweep - -Autonomous maintainer workflow for producing a requested batch of landable OpenClaw bugfix PR URLs. -Use for broad issue/PR sweeps where the bar is high and the output is PRs, not notes. -Do not use for plugin SDK/API boundary work; those need separate architecture review. - -## Mandatory orchestration contract - -- Only the original user-facing root conversation is the control plane. It - decomposes work, assigns explicit issue/PR/file ownership, directly spawns - bounded collaboration workers and independent verifiers, coordinates safety, - tracks completion, and reports actual worker-verified terminal outcomes. -- A delegated collaboration subagent is a hands-on execution owner, not another - user-facing root orchestrator. It performs its assigned work directly; this - contract must not recursively prevent workers from acting. Nested workers - require explicit root authorization plus root-tracked capacity, ownership, - and completion. Do not create separate Codex app tasks or threads. -- Workers perform all discovery, source/dependency/Codex inspection, - reproductions, issue/PR investigations, edits/refactors, tests/proof/CI, - GitHub reads/writes, comments, closures, commits, pushes, and any separately - authorized landing. The acting worker personally verifies dependency - contracts and inspects sibling `../codex` before making a Codex verdict. -- Root coordinates checkout/file ownership, serializes shared Git/ref/index - mutations and conflicting test/edit activity, tracks exact heads, and enforces - authorization, source-trust, security, ownership, and landing gates through - assigned workers. Root never switches from orchestration to execution because - a worker stalls, fails, or lacks capacity; reassign the bounded work instead. - -## Requested authority - -- The default deliverable is verified **landable PR URLs**, not merged PRs. An - explicitly requested repair-and-prepare sweep authorizes workers to repair, - refactor, verify, commit, push, and update PRs within its requested scope; - it does not authorize landing without an explicit landing request. -- `review`, `triage`, `list`, or a `landable-shortlist` alone remains read-only: - no unsolicited push, public comment, closure, replacement PR, or merge. -- An explicit autonomous `process`, `resolve`, or `fix-and-land` request for - named items also authorizes workers to close those proven fixed on current - `main` and land verified fixes through `$openclaw-pr-maintainer` and the - repo-native `scripts/pr` workflow. Preserve exact-head and ownership gates. -- Explicit full-authority unattended execution is standing approval for all - evidence-backed work within the named sweep, including necessary task-owned - or repo-managed PR worktrees, credited PR repair/replacement, proof comments, - exact-head CI repair, scoped publication, proven current-`main` closures, and - requested native landing. Never ask routine approval questions or disturb - unrelated dirty changes; the root stays orchestration-only and workers own - execution through verified completion. Preserve source-trust, direct acting- - worker Codex inspection, required exact-head CI/security/owner gates, and - explicit exact-count/scope approval for more than 50 close/reopen actions. -- Optional unavailable provider/channel live proof may be replaced only when - the user explicitly relaxes it: use failing/passing focused owner-boundary - regression, direct producer/caller/sibling/dependency-source evidence, - independent review, and green exact-head required CI; disclose the missing - live/rank-up proof. Never waive mandatory external-API, security-sensitive, - risk-required, or explicitly requested live verification. - -## Target - -Use `batch_size` from the request, defaulting to `5` and capped at `20`. -Return up to that many qualified PR URLs, each with: - -- bug summary -- why the fix is low-risk -- proof: exact-head local/Testbox/live commands or run IDs -- autoreview: clean result on the exact head being shown -- CI green on the exact pushed PR head -- issue/duplicate cleanup done or still pending - -The URLs may be existing PRs that were reviewed/fixed, or new PRs created from issues/clusters. -Do not present a PR URL until its exact published head is left-tested, autoreviewed clean, and verified green in live GitHub CI. -Refresh a PR branch only for an actual conflict, failing exact-head check or repo-native guard, explicit user request, or proven material stale-base risk; never rebase merely because `main` advanced. -If production code, tests, or the reviewed head changes after autoreview, rerun autoreview before showing the URL. -Do not pad a batch when the bounded search yields fewer qualified PRs. - -## Inputs - -- `batch_size`: requested number of landable PRs; default `5`, maximum `20`. -- `source_mode`: `discovery` or `provided-prs`; default `discovery`. -- `provided_prs`: explicit PR refs when `source_mode=provided-prs`. - -In `provided-prs` mode, inspect only the supplied PRs plus directly linked duplicate/canonical refs unless broader discovery is required to prove the best fix. - -## Companion Skills - -Use `$gitcrawl` for discovery/clustering, `$openclaw-pr-maintainer` for live GitHub mutation rules, `$github-author-context` when contributor trust matters, `$openclaw-testing` for proof choice, `$autoreview` before publishing/landing, and `$crabbox` for broad/E2E/live proof. - -## Candidate Bar - -Accept only when all are true: - -- bug or paper cut, not feature/product/support/docs-only -- root cause is proven in current code -- dependency behavior checked via upstream docs/source/types when relevant -- production/runtime diff is small, ideally much smaller than 500 LOC and always below 500 LOC -- production LOC is net-neutral or net-negative when feasible; count tests separately and justify any production increase -- tests may be larger, but focused -- no new dependency -- no new config option -- no backward-incompatible behavior -- no security/product/owner-boundary decision needed -- no plugin SDK, public plugin API, or `src/plugin-sdk/**` boundary change -- any refactor stays within the proven root cause, owner boundary, and small-sweep risk limits -- focused proof is feasible -- existing branch can be safely updated when needed, or an authorized replacement is justified - -Good examples: - -- provider parameter mismatch proven against dependency/API contract -- CLI command diverges from adjacent command behavior -- narrow runtime state/serialization bug with failing test -- issue already fixed on current `main`, with proof and closeable duplicates - -Reject: - -- feature requests, new knobs, migrations, release work, workflow policy, support -- plugin SDK/API boundary changes, including compatibility shims, new SDK methods, SDK exports, or plugin-facing channel/provider seams -- auth/security boundary changes unless explicitly assigned -- bugs requiring unavailable credentials for mandatory external-API, security, - risk-required, or explicitly requested live verification -- PRs with red CI unless you fix, update the head as needed, push, and recheck them green -- PRs whose changed head was not pushed or whose exact-head CI was not verified live -- PRs whose final head has not passed `$autoreview` -- fixes requiring an out-of-scope product, architecture, or ownership decision -- speculative reports without reproducible/provable cause -- UI/UX changes requiring product judgment - -## Sweep Loop - -1. Start clean: - - `git status -sb` - - update a clean, exclusively owned base checkout with `git pull --ff-only` only when needed and root-authorized - - never pull, switch, or mutate a shared checkout while sibling workers are active - - verify branch is expected, usually `main` -2. Build candidate clusters: - - `gitcrawl` open issues/PRs, neighbors, and search - - live `gh issue/pr view` - - include PRs linked from issues and duplicates -3. For each cluster: - - read issue/PR body, comments, labels, linked refs, current source, adjacent tests - - exclude PRs authored by wide-access maintainers until `created_at` is at least 14 days old; only a named PR or explicit maintainer-work request overrides - - identify opener/author and preserve credit - - decide: `repair-existing-pr`, `create-new-pr`, `fixed-on-main`, `duplicate`, or `reject`; close only when authorized -4. Prove before patching: - - failing test, focused repro, log/source proof, or dependency contract proof - - if already fixed on `main`, prove with current source/test/commit; close kindly only when authorized -5. Patch: - - rewrite/refactor an existing editable PR into the correct owner-boundary fix first, even when its incoming implementation is the wrong shape - - create an authorized replacement only when the original branch is uneditable or unsafe to update; preserve credit and close the source only after the replacement exists and closure is authorized - - if no PR exists, create one only when publication is authorized - - add regression test when it fits - - release-note context for user-facing fixes in PR body or commit message; credit human reporter/contributor when known -6. Review, verify, and publish: - - refresh the PR branch only for a real conflict, failing exact-head check or wrapper guard, explicit request, or demonstrated material stale-base risk - - resolve actual conflicts or CI failures rather than counting the PR as ready - - do not add `CHANGELOG.md` during normal sweep PRs; release automation generates it from PRs and commits - - left-test the exact candidate head with the smallest meaningful local/Testbox/live command that proves the bug - - run `$autoreview` until no accepted/actionable findings remain before creating, updating, or presenting the PR URL - - create/update PR with real body and proof fields when authorized - - push the exact reviewed head only when an authorized change requires publication - - verify live GitHub CI is green for that pushed head; do not count pending, red, dirty, conflicting, or externally blocked PRs in the five -7. Hygiene: - - close duplicates and fixed-on-main issues/PRs with proof only when closure is authorized; otherwise report the evidence - - mutate more than five associated items in one cluster only when the explicitly authorized bounded scope includes them; more than 50 close/reopen actions still require separate exact-count/scope approval - - comments must be kind, concrete, and include proof/PR/commit links -8. Repeat until `batch_size` landable PR URLs are ready or the bounded qualified queue is exhausted. - -## PR Body Proof - -Use the repo PR template. Include authored `## What Problem This Solves` and -`## Evidence` sections. Keep the body focused on intent and the most useful -validation evidence; inspect the code, tests, and CI before judging correctness. - -## Existing PR Rules - -- Review code path beyond the diff before trusting it. -- If PR is good: fix concrete issues, left-test and autoreview the exact head, publish authorized changes, and require exact-head green CI before showing it. -- If PR is incomplete or wrong-layer but editable: rewrite/refactor the existing PR at the root-cause owner, preserve author credit, and verify its corrected head. -- If PR is duplicate or fixed on current `main`: comment proof and close only when closure is authorized; otherwise report the evidence. -- If the source branch is uneditable or unsafe to update: create a replacement only when authorized, preserve useful commits/credit, and close the original only after the replacement exists and closure is authorized. -- If CI turns red after local proof, treat that as normal work: inspect the failing job, fix or reject, rerun, and only count the PR once green. - -## Output Ledger - -Maintain a running ledger: - -```text -accepted: -- PR URL: - source refs: - bug: - root cause: - fix: - production LOC: - test LOC: - risk: - head/base status: - left-test: - autoreview: - CI: - credit/thanks: - cleanup: - -rejected: -- ref: - reason: - -closed: -- ref: - reason: - proof/comment: -``` - -Final answer: - -- the requested number of accepted PR URLs, or the smaller qualified count with the exhausted-search reason -- 2-4 sentence explainer per PR -- proof/CI state per PR -- closed duplicates/fixed-on-main refs -- current branch/status diff --git a/.agents/skills/openclaw-landable-bug-sweep/agents/openai.yaml b/.agents/skills/openclaw-landable-bug-sweep/agents/openai.yaml deleted file mode 100644 index 073311ff1126..000000000000 --- a/.agents/skills/openclaw-landable-bug-sweep/agents/openai.yaml +++ /dev/null @@ -1,4 +0,0 @@ -interface: - display_name: "OpenClaw Landable Bug Sweep" - short_description: "Find five small non-SDK landable bugfix PRs" - default_prompt: "Use $openclaw-landable-bug-sweep to find or repair five small high-confidence non-SDK-boundary OpenClaw bugfix PRs and get them landable." diff --git a/.agents/skills/openclaw-repair-sweep/SKILL.md b/.agents/skills/openclaw-repair-sweep/SKILL.md new file mode 100644 index 000000000000..ebd8f1e8ce83 --- /dev/null +++ b/.agents/skills/openclaw-repair-sweep/SKILL.md @@ -0,0 +1,273 @@ +--- +name: openclaw-repair-sweep +description: "Orchestrate worker fleets over OpenClaw issues and PRs: prove root causes, prefer clean refactors over quick patches, land verified repairs, and close items proven fixed or no longer useful." +--- + +# OpenClaw Repair Sweep + +One skill for every autonomous issue/PR repair run, from a pasted five-item +list to a full-queue campaign. The invoking conversation is always the +orchestrator; workers in isolated worktrees — subagents or Codex CLI — do all +hands-on work. Scope, scale, and deliverable are inputs with defaults, not +separate skills. + +## Inputs and defaults + +- `scope`: `refs` (explicit pasted issue/PR list), `discovery` (bounded search + for the best qualified batch), or `queue` (entire open-issue queue, newest to + oldest). A bare invocation defaults to `discovery`; pasted refs imply `refs`; + "the whole queue" or "keep going until empty" implies `queue`. +- `batch_size`: discovery target; default `5`, cap `20`. Do not pad a batch + when the bounded search yields fewer qualified items. Ignored for `queue`. +- `workers`: fleet size. Defaults: `refs` one owner per item/cluster capped at + `8`; `discovery` `8`; `queue` `64`. An explicit request ("use 10 workers", + "64 workers") overrides the default; disclose the actual count when capacity + forces fewer. +- `focus`: optional subsystem/surface/label filter that narrows discovery or + the queue ("focus on gateway", "Telegram only"). +- Authority: invoking this skill authorizes workers to investigate, fix, + refactor, commit, push, create/update PRs, land eligible changes, comment, + and close proven items within scope — including issue-scoped worktrees — + without further routine confirmation. `review`, `triage`, or `list` wording + keeps the run read-only; a `fix only` request permits local changes and proof + but no publication. Sweep authority is never permission to publish releases, + bump protocol or SQLite schema versions, weaken security, break shipped + compatibility, change another owner's protected product surface, or execute + untrusted code with local credentials. + +Workers read the complete root `AGENTS.md`, relevant scoped guides, and +`VISION.md` before acting. Companions where each owns the workflow: +`$gitcrawl` discovery/clusters, `$openclaw-pr-maintainer` live GitHub mutation +rules, `$github-author-context` for contributor trust, `$openclaw-testing` +proof choice, `$autoreview` pre-publish review, `$crabbox` heavy/remote proof. + +## Orchestration contract + +- The parent is control plane only: decompose work, assign explicit + issue/PR/file/checkout ownership, spawn bounded workers and independent + verifiers, serialize shared mutations, track exact heads/evidence/ + authorization, and report worker-verified outcomes. It never inspects + issues, reads source, edits, tests, mutates GitHub, or lands. When a worker + stalls or fails, reassign the bounded work — the parent never takes it over. +- Workers are hands-on execution owners: discovery, source/dependency + inspection, repros, edits/refactors, tests/proof/CI, GitHub reads/writes, + comments, closures, commits, pushes, and authorized landing. A worker making + a Codex-backed verdict personally inspects sibling `../codex` first and + cites files/lines; another agent's report never substitutes. +- Spawn workers as full-history forks so each inherits the orchestrator's + model and xhigh reasoning effort; never downgrade either, and never print or + record model identifiers — redact subprocess banners before reporting. +- One bounded worker owns each item or root-cause cluster; duplicates sharing + a root cause share that owner. Deduplicate by canonical root cause, not + issue number. Separate independent workers challenge closures and + nontrivial landing proof; an investigator cannot self-approve. +- When one defect class repeats across items (blank-credential handling, + encoding slicing, unbounded caches, timeout bounds), assign the class to a + single owner who picks one canonical helper and sweeps all sibling call + sites — never parallel workers landing near-identical local patches. +- Every independent fix gets its own issue-scoped lightweight worktree and + `codex/issue-` branch created from a frozen SHA; reuse the repo-native + isolated PR worktree when repairing an existing PR. Share Git objects — do + not clone or install dependencies per worktree merely for isolation. Never + edit, switch, or mutate the shared checkout while sibling workers are + active; never stage, stash, discard, or overwrite unrelated dirty changes. +- Serialize only shared Git/ref mutations — fetches, branch/worktree ops, PR + preparation, merges, main-targeted pushes — in brief coordinator-owned + exclusive slots. Do not hold a slot across coding, proof, or remote waits. + A Testbox lease has one owner and one active command. +- Bound concurrently _active_ code/test workers by real host capacity: start + with waves of 4–8 and expand or shrink on CPU/load, memory, disk headroom, + and remote-pool health. Reserve capacity for the operator; never kill + unrelated processes. Keep the full fleet assigned — idle coordinators + investigate. Offload heavy proof remotely before pressure threatens the + host; pause only campaign-owned work, preserve claims, resume from the + recorded checkpoint. +- Classify source trust before execution. Untrusted contributor code, tests, + or wrappers never run locally or on a credential-hydrated host; use the + sanitized remote-proof path. Route heavy trusted proof to the selected + remote box. +- Before replacing a failed or interrupted worker, preserve its claimed items, + patches, checkout ownership, and evidence; hand them to exactly one + replacement without duplicating or discarding unfinished work. +- Record actual active, completed, failed, fixed, landed, verified-closed, + commented, and skipped counts; persist the checkpoint for resumed runs. + +## GitHub capacity + +- Prefer local `$gitcrawl` archives for queue discovery, search, duplicate + clusters, comments, and prior merged work. Check freshness; do not broadly + resync merely to start a sweep. +- Prefer `octopool gh ...` for necessary live reads/mutations; plain `gh` only + when Octopool or the canonical wrapper requires it. Minimal fields, batched + reads, results reused across workers, no unbounded pagination, never + `gh run watch` or unchanged-CI polling. +- Require a fresh live check only before consequential mutations, final merge + decisions, or on stale/contradictory cached state. Deduplicate worker + requests instead of letting the fleet fetch the same item independently. + +## Candidate bar + +Accept a repair only when all are true: + +- real bug or paper cut — not feature/product/support/release/workflow work +- root cause proven in current code; dependency behavior verified against + upstream docs/source/types when relevant +- repair shape is high confidence with understood, bounded behavior and + ownership risk — change size alone is not the risk criterion +- no new dependency, no new config option, no backward-incompatible behavior +- no plugin SDK/public API boundary change and no security/product/owner + decision required. For items needing such a decision, make the cheap safe + repairs anyway, push to preserve the work, and report + NEEDS-MAINTAINER-DECISION — with a read-only sibling-surface survey and a + recommendation — instead of merging or silently skipping +- focused proof is feasible + +Reject speculative reports without provable cause, UI/UX judgment calls, and +fixes needing unavailable credentials for mandatory live verification. Skip +with a terse reason; never pad with low-confidence fixes. + +## Fix shape: refactor first + +- Prefer the coherent owner-boundary refactor over a narrow guard, workaround, + fallback, duplicate policy, or compatibility shim. Clean code beats a quick + fix: when the minimal patch and the clean repair diverge, take the clean + repair while its risk stays understood and bounded. Do not substitute a + workaround when a coherent cleanup is the correct fix. +- While reading, delete connected dead branches, duplicate paths, stale + abstractions, and obsolete tests in the same coherent change. +- Measure `git diff --numstat`; aim for net-neutral or net-negative production + LOC with tests counted separately. Justify growth only by fewer concepts, + better ownership, essential behavior, or stronger safety. +- Never hardcode the reported example. Add regression coverage near the + failing surface when it fits. Small missing affordances with an established + adjacent contract are fine; substantial new features are not. +- Never edit `CHANGELOG.md`; put user impact, issue/PR refs, and human credit + in the PR body or commit message. +- After finishing its assigned items, each worker lands the best rent-paying + refactor or simplification found in the areas it touched as its own focused + PR, or states NO-FOLLOW-UP with one sentence. These passes regularly find + real bugs; hold them to the same candidate bar, proof, and review gates. + +## Outcome order per item/cluster + +Always investigate existing work first: live body/comments/labels/links, +`$gitcrawl` for duplicates and prior PRs, live search, current `main` and +history. Read competing implementations deeply enough to judge them. Then: + +1. **Fixed on main:** prove the original failure is resolved; close with the + exact merged PR/commit, current source/test, or release proof. +2. **Existing PR is the best fix:** improve as needed, verify the exact final + head, land through the repo-native maintainer workflow. +3. **Existing PR is useful but incomplete:** finish it, or create a cleaner + replacement that preserves attribution and links the original. +4. **No suitable PR:** implement the best high-confidence root-cause repair or + justified simplifying refactor; create, verify, and land a focused PR. +5. **Bug cannot be fixed, but simplification is real:** land a proven + behavior-neutral refactor without pretending the issue was fixed. +6. **Cannot fix or close:** comment only when investigation produced concrete + material evidence absent from the issue and ClawSweeper's review. + +Existing-PR rules: review the code path beyond the diff before trusting it. +Exclude wide-access maintainer-authored PRs from generic discovery until 14 +days after creation; only a named PR or explicit maintainer-work request +overrides. Rewrite an inadequate editable PR at the root-cause owner and keep +author credit; create a replacement only when the source branch is uneditable +or unsafe to update, and close the source only after the replacement exists. +Red CI is normal work: inspect, fix or reject, recheck green. + +## Broken main + +A red `main` — exact-head CI failures reproducing on unrelated PRs — is sweep +work, not an interruption, and needs no ask. Assign one worker to own the +repair: find the breaking commit, check for existing repair PRs first and +land the best one instead of duplicating a fix in flight, and prefer deleting +dead code over baselining. Every other worker rebases onto the repaired +`main` as needed and continues. + +## Closure gate + +An issue stays open unless every step passes. Similar wording, adjacent tests, +merge dates, and confident summaries are not closure proof. + +1. Write down the reporter's exact primary symptom, expected outcome, every + affected surface, and reported version/build SHA. A merged mitigation or + diagnostic does not replace the primary outcome. +2. Personally trace shipped and current behavior end to end; reproduce the + reported failure on the affected build and prove the same user action + succeeds on current `main` with a runnable boundary-level check. A nearby + unit test or unexecuted source inspection is insufficient. +3. Prove ancestry, never infer from dates: `git merge-base --is-ancestor` for + the fix SHA against current `main` and each affected build/tag, plus + `git tag --contains`. A merge before a release date does not prove + inclusion. +4. Classify honestly: root-cause repair, mitigation, diagnostic, workaround, + or product decision. Never close while the primary action still fails, any + reported surface remains broken, or an owner hold exists. +5. A different independent worker challenges the closure packet and personally + verifies outcome, surfaces, ancestry, and before/after proof; a separate + closure coordinator grants the mutation. Disagreement means leave open. +6. Recheck live state immediately before the mutation. The closure comment + states, in one sentence, the fixed behavior, fix SHA/PR, first containing + version when known, and before/after evidence. +7. If a closure is challenged or reopened, pause all closure mutations, audit + and correct the record, and resume only on explicit root authorization. + +No more than 3 workers hold live closure/mutation duty at once. More than 50 +close/reopen actions require separate exact-count approval. Product-decision +and won't-implement closures stay with maintainer judgment. + +## Verify and review + +- Choose proof with `$openclaw-testing`; live-test the real user/provider/ + channel/CLI path when feasible; route heavy, packaging, Docker, E2E, or + broad checks through `$crabbox`. Report an unavailable live prerequisite + accurately instead of calling a mock proof live. +- Run `$autoreview` on the complete final change until no accepted actionable + findings remain; rerun after any production, test, or head change. Verify + findings against source rather than accepting them blind. +- Separately self-invoke an independent Codex reviewer (`codex exec --json +--sandbox read-only --ephemeral` from a trusted checkout) against the exact + frozen head; the `$autoreview` engine does not substitute for this pass. + Read only the final result; never emit raw model banners. +- Read the latest ClawSweeper comment and address each applicable `Rank-up +moves:` item with evidence or an explicit skip reason. +- Verify live GitHub CI green on the exact pushed head before counting a PR + landable or landed; never count pending, red, or conflicting PRs. + +## Publish, land, clean up + +- Open new PRs as drafts, wait for non-null mergeability, mark ready, and + verify CI attached to the pushed head. Use the actual PR template: user + impact, canonical root cause, rejected alternatives, production LOC delta, + exact head SHA, proof, review results, CI state, and credit. Omit agent + transcripts during autonomous runs rather than interrupting for consent. +- Land main-targeted PRs only through the repo-native `scripts/pr` flow + (review-init, artifacts, `OPENCLAW_TESTBOX=1 scripts/pr prepare-run`, + `merge-run`); verify the canonical merge SHA afterward. +- Verify every claimed landing by ancestry, not GitHub state: + `git merge-base --is-ancestor origin/main`. `gh pr view --json +state` can report a stale `closed` for freshly merged PRs, and a GitHub 504 + mid-merge may still have merged — verify before retrying or re-landing. +- Refresh or rebase a PR branch only for an actual conflict, failing + exact-head check or guard, explicit request, or proven material stale-base + risk — never merely because `main` advanced. +- After a verified landing, remove only that campaign-owned worktree and + branch during a serialized mutation slot; never prune unrelated worktrees, + refs, or user files. + +## Reporting + +Parent-thread updates are concise progress plus clickable URLs: + +```text +8 agents active · 12 investigated · 3 landed · 2 already-fixed issues closed +Landed: https://github.com/openclaw/openclaw/pull/123 +``` + +Maintain a ledger per item: outcome class, assigned worker, independent +verifier, exact head, production/test LOC delta, proof/CI state, credit, and +cleanup. Count only verified merged PRs, confirmed closures, and comments +actually posted. Final answer: accepted PR URLs (or the smaller qualified +count with the exhausted-search reason) with 2–4 sentence explainers and +proof/CI state, closed refs with proof, concrete blockers or skip reasons, and +current branch/status. diff --git a/.agents/skills/openclaw-repair-sweep/agents/openai.yaml b/.agents/skills/openclaw-repair-sweep/agents/openai.yaml new file mode 100644 index 000000000000..5e6bd7a1af63 --- /dev/null +++ b/.agents/skills/openclaw-repair-sweep/agents/openai.yaml @@ -0,0 +1,4 @@ +interface: + display_name: "OpenClaw Repair Sweep" + short_description: "Fix, refactor, land, and close OpenClaw issues and PRs" + default_prompt: "Use $openclaw-repair-sweep to orchestrate workers over OpenClaw issues and PRs; prove root causes, prefer clean refactors over quick fixes, land verified repairs, and close items proven fixed or no longer useful." diff --git a/.agents/skills/openclaw-small-bugfix-sweep/SKILL.md b/.agents/skills/openclaw-small-bugfix-sweep/SKILL.md deleted file mode 100644 index f5c3957ec57a..000000000000 --- a/.agents/skills/openclaw-small-bugfix-sweep/SKILL.md +++ /dev/null @@ -1,163 +0,0 @@ ---- -name: openclaw-small-bugfix-sweep -description: Fix only small, high-certainty OpenClaw bugs from a pasted issue/PR list after deep code review. ---- - -# OpenClaw Small Bugfix Sweep - -Batch workflow for pasted OpenClaw issue/PR refs. The user's top-level -conversation is the orchestration-only parent; its bounded collaboration -subagents are hands-on execution owners. The parent coordinates them and -reports their verified results. Workers publish or land only when authorized. - -## Mandatory coordinator/worker boundary - -- The parent only assigns issue/PR owners and independent validation workers, - coordinates shared checkout/file ownership and mutation slots, tracks evidence - and authorization gates, handles genuine owner decisions, and reports results. -- The parent never directly discovers or inspects items; reads affected source, - dependencies, or sibling `../codex`; diagnoses, edits, reproduces, or tests; - runs Git/GitHub operations; comments, closes, commits, pushes, watches CI, - prepares, or lands. Delegate every operational step to collaboration subagents. -- Assign one bounded worker ownership of each item or duplicate/root-cause - cluster. Use separate workers for independent closure/landing validation and, - when useful, discovery, source history, dependency contracts, sibling paths, - regression proof, and CI follow-through. An item worker may spawn a helper - only after the root explicitly authorizes that specific helper and tracks its - scope, ownership, capacity, and completion; the item owner remains hands-on - and personally checks consequential evidence before acting. -- State each worker's execution/verification role, assigned item, file/checkout - ownership, mutation authority, and reporting obligation in its assignment. A - delegated worker reading this skill performs its assigned work itself; it does - not misclassify itself as the orchestration-only parent or recursively - delegate its entire assignment. -- Assign disjoint writable files/checkouts before parallel implementation. - Serialize shared checkout/ref/branch changes, overlapping file writes, - commits, pushes, GitHub mutations, and landing. Do not edit a shared checkout - while another worker's tests are running. Never create new worktrees without - explicit user authorization; an explicit full-authority unattended or landing - request authorizes repo-managed PR worktrees and necessary isolated task-owned - worktrees. Never stage, stash, discard, or overwrite unrelated dirty changes. -- Bound worker concurrency by available agent slots, including the parent, and - host/proof capacity. Before replacing a failed or interrupted worker, preserve - its claimed items, patches, checkout ownership, and evidence; explicitly hand - them to one replacement without duplicating or discarding unfinished work. -- Classify source trust before execution. Never run untrusted contributor code, - scripts, config, hooks, tests, or wrappers locally; use the repository's - sanitized remote-proof path. Route heavy trusted proof to the selected remote - box unless the documented trusted-backend fallback applies. -- For Codex-backed behavior, every worker making a technical verdict or taking - a related action must personally inspect the exact sibling `../codex` source - first and cite the inspected files/lines. The parent may relay those worker - findings but must not present another agent's inspection as its own verdict. -- Keep workers assigned through reproduction, repair, independent validation, - exact-head CI, authorized closure/landing, and verified terminal state. A - pending check or submitted mutation is not completion; delegate follow-up. - -This is the collaboration-subagent model used by -`openclaw-autonomous-issue-sweep`, not an invitation to create user-owned Codex -app tasks or to perform sweep work in the parent conversation. - -## Scope and authorization gate - -Keep this sweep limited to small, high-certainty root-cause repairs. Do not substitute a workaround when a coherent owner-boundary cleanup or refactor is the correct fix; escalate if that repair exceeds the explicitly requested sweep scope. - -Default flow when fixing is authorized: - -1. Review each issue deeply enough to prove current behavior and root cause. -2. Fix only high-confidence bugs whose owner-boundary repair fits the requested small-sweep scope. -3. Without explicit authorization to publish or land, stop with the dirty diff summary, touched files, and test/gate output for maintainer review. -4. When shipping is authorized, make one commit per accepted fix; put user-facing release-note context in the PR body or commit message. Never edit release-only `CHANGELOG.md`. -5. When authorized, sync for the destination: direct `main` must rebase onto latest `origin/main` without merge commits; PRs follow native landing guards and refresh/rebase only for an actual conflict, failing guard/exact-head check, explicit user request, or demonstrated material stale-base risk, never merely because `main` advanced. Push, comment with proof, and close only authorized fixed or explicitly triaged-closed issues. - -An explicit request to autonomously process or resolve a named issue/PR batch, -or to fix and land it, authorizes assigned workers to perform the scoped -root-cause fixes, commits, pushes, PR updates, proof comments, evidence-backed -fixed-on-current-`main` closures, and exact-head landings needed to resolve those -named items. A fix-only request permits local changes and proof, not publishing -or landing; review, triage, or list alone is read-only. Never batch unrelated -fixes into one commit, mutate unrelated items, exceed the requested sweep scope, -or bypass owner, security, trust, authorization, or proof gates. Do not invent -an additional personal-review gate. - -Explicit full-authority unattended execution is standing approval for assigned -workers to complete all evidence-backed, task-scoped investigation, repair, -credited PR rewrite/replacement, proof comments, CI diagnosis/fixes/reruns, -task-owned publication/worktrees, proven current-`main` closures, requested -native landing, and terminal remote verification. Resolve routine decisions -without asking the unavailable user; recover safely from transient failures -and locks. Preserve unrelated edits, exact-head required CI, source trust, -acting-worker direct Codex inspection, contributor credit, security/owner -gates, and separate exact-count/scope approval for more than 50 closures. -Only when the user explicitly relaxes unavailable **optional** provider/channel -live proof may focused failing/passing owner-boundary regression, direct -producer/caller/sibling/dependency evidence, independent review, and exact-head -green CI substitute; disclose the missing live/rank-up proof. Mandatory -external-API, security-sensitive, risk-required, or requested live proof is -never waived. Report only genuine credential, capability, or explicit safety -blockers without waiting for the user. - -## Companion Skills - -Use `$gitcrawl` first, `$openclaw-pr-maintainer` for live GitHub hygiene, `$github-deep-review` posture for source tracing, and `$openclaw-testing` for proof. - -## Loop - -For each ref, the assigned worker performs the operational loop; the parent only -coordinates its progress and receives evidence: - -1. Read live target with `gh`. -2. Check `gitcrawl` for related, duplicate, closed, or already-fixed threads. -3. Read body, comments, linked refs, changed files, current code, adjacent tests, and dependency contracts when relevant. -4. Trace the real runtime path. -5. If current `main` already fixes the claimed defect, prove current source/tests and the canonical commit/PR. Classify it `fixed-on-main`; comment with proof and close only when authorized. -6. For confirmed open issues, repair the violated invariant at its owner; include a small coherent cleanup/refactor when it is the cleanest root-cause fix. -7. For PRs, independently verify the defect, owner-boundary fix, sibling paths, and exact-head checks. Rewrite an inadequate editable PR when repair/landing is authorized; otherwise report the needed fixup. -8. Add focused regression proof when practical for local issue fixes or PR readiness checks. -9. Run the smallest meaningful gate. -10. Continue until every pasted ref is fixed, proven already resolved, landed, or classified with a concrete blocker. - -An independent worker challenges proposed fixed-on-main closures and -nontrivial repair/landing proof before an authorized item owner performs the -final mutation. Missing agreement or applicable source/dependency proof, -exact-head CI, trust routing, ownership approval, or authorization is a concrete -blocker, not permission for the parent to take over the work. - -## Skip If - -- not a bug -- config/docs/workflow/release/support/dependency/product work -- repro or root cause is uncertain -- the correct coherent root-cause repair exceeds the explicitly requested small-sweep scope; classify as `needs-human` or record a named follow-up instead of landing a workaround -- dependency behavior is guessed -- no focused proof is feasible - -Skip with terse reason. Do not pad with low-confidence fixes. - -## Fix Rules - -- owner module first; generic seam only when required -- existing patterns/helpers/types -- coherent owner-boundary cleanup/refactoring; no unrelated drive-by refactors -- prefer net-neutral or net-negative production LOC; count tests separately and add useful regression coverage -- tests near failing surface -- docs only for changed public behavior -- no commit during review/prove-only work -- when shipping is authorized, one commit per accepted fix; capture user-facing release-note context in the PR body or commit message, never `CHANGELOG.md` -- no push/create PR/comment/close/label/land/merge without authorization for that action - -## PR Rules - -- `ready-to-merge`: the root-cause fix is clean, current head is verified, and required exact-head checks are green; use the repo-native landing workflow only when merging is authorized -- `needs-ci`: proof is sound but required exact-head checks remain pending or unavailable; for an authorized land request, monitor those checks and finish landing if they pass, or report the concrete external blocker -- `needs-fixup`: repair/rewrite an editable PR when authorized; otherwise list exact files/tests and the missing authorization -- `skip`: stale, speculative, explicitly out of scope, or requiring unavailable product/security/release approval -- if a useful source PR is unsafe or uneditable, create a replacement only when explicitly authorized; preserve contributor credit and close the source only after the replacement exists - -## Output Shape - -Ledger: `fixed-local`, `fixed-on-main`, `closed-fixed-on-main`, `ready-to-merge`, `needs-fixup`, `needs-ci`, `landed`, `skipped`, `needs-human`. -Track each item's assigned worker, independent verifier, owned files/checkout, -evidence, exact head, authorization, and terminal state. -Final: worker-verified local or landed fixes, proven already-fixed items, -production/test LOC deltas, tests/gates, and concrete blockers or skip reasons.