ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-27 12:56:01 -06:00
Code Issues Packages Projects Releases Wiki Activity

docs(testing): define plugin scanner trust boundary

Browse Source
This commit is contained in:
Vincent Koc
2026-08-20 21:53:36 -07:00
parent dd9677012a
commit 60ab3c666e
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.agents/skills/openclaw-testing/SKILL.md
+6
View File
@@ -340,6 +340,12 @@ lanes are intentionally reserved for the separate `Plugin Prerelease` child so
PRs, main pushes, and ad hoc broad CI checks do not spend Docker/package time or
all-plugin runtime time on release-only product coverage.
`Plugin Prerelease` may execute candidate code only in secretless packaging
jobs. The trusted scanner treats uploaded immutable tarballs as inert data and
scans the exact post-build bytes; publication must consume those verified bytes
or require an identical digest. Artifact ingestion stays fail-slow so one
malformed package records its own error without hiding other package reports.
Use one operator, one transition-only watcher, and at most one investigator for
the current failed surface. Parent timeout or cancellation leaves adopted exact
children running; cancel an exact child only by explicit operator action or the