fix(ci): restore main validation gates (#107697)

* fix(ci): allow Unreleased notes for main validation

* test(ci): cover release smoke changelog intent

* test(ci): require release changelog policy propagation

* docs(agents): require review init after pushes

* chore(ci): prune stale max-lines baseline

* refactor(system-agent): split operation modules

* refactor(bonjour): keep ciao classification type private

* fix(bonjour): remove stale local classification alias

test/scripts/full-release-validation-at-sha.test.ts

@@ -55,6 +55,9 @@ describe("full-release-validation-at-sha", () => {
     const source = readFileSync("scripts/full-release-validation-at-sha.mjs", "utf8");
     expect(source).toContain("ref: targetSha");
     expect(source).toContain("target_context_ref: targetContextRef");
+    expect(source).toContain(
+      'args.inputs.allow_unreleased_changelog ??= args.targetRef ? "false" : "true"',
+    );
   });
 
   it("rejects missing option values", () => {
@@ -113,6 +116,9 @@ describe("full-release-validation-at-sha", () => {
     expect(() => parseArgs(["-f", "release_profile=minimum"])).toThrow(
       "release_profile must be beta, stable, or full",
     );
+    expect(() => parseArgs(["-f", "allow_unreleased_changelog=maybe"])).toThrow(
+      "allow_unreleased_changelog must be true or false",
+    );
   });
 
   it("reserves the candidate ref for the resolved --sha", () => {

test/scripts/install-smoke-no-push-workflow.test.ts

@@ -269,10 +269,11 @@ describe("install smoke no-push root image transport", () => {
       packages: "read",
     });
     expect(caller.with).toMatchObject({
+      allow_unreleased_changelog:
+        "${{ needs.resolve_target.outputs.allow_unreleased_changelog == 'true' }}",
       ref: "${{ needs.resolve_target.outputs.revision }}",
       run_bun_global_install_smoke: true,
     });
-    expect(caller.with).not.toHaveProperty("allow_unreleased_changelog");
   });
 
   it("passes package changelog intent only to current-tree smoke scripts", () => {

test/scripts/plugin-prerelease-test-plan.test.ts

@@ -657,6 +657,48 @@ describe("scripts/lib/plugin-prerelease-test-plan.mjs", () => {
     );
   });
 
+  it("allows Unreleased notes only for current-tree release checks", () => {
+    const workflow = parse(readFileSync(".github/workflows/openclaw-release-checks.yml", "utf8"));
+    const fullReleaseSource = readFileSync(".github/workflows/full-release-validation.yml", "utf8");
+    const resolveTarget = workflow.jobs.resolve_target;
+    const captureInputs = resolveTarget.steps.find(
+      (step: WorkflowStep) => step.name === "Capture selected inputs",
+    );
+    const currentTreeAllowance =
+      "${{ needs.resolve_target.outputs.allow_unreleased_changelog == 'true' }}";
+
+    expect(workflow.on.workflow_dispatch.inputs.allow_unreleased_changelog).toEqual({
+      default: false,
+      description:
+        "Allow current-tree packaging to use Unreleased notes; release branches and tags stay strict",
+      required: false,
+      type: "boolean",
+    });
+    expect(resolveTarget.outputs.allow_unreleased_changelog).toBe(
+      "${{ steps.inputs.outputs.allow_unreleased_changelog }}",
+    );
+    expect(captureInputs?.run).toContain('RELEASE_REF_INPUT" == "main"');
+    expect(captureInputs?.run).toContain('RELEASE_REF_INPUT" == "refs/heads/main"');
+    expect(captureInputs?.run).toContain("release/[0-9]{4}");
+    expect(captureInputs?.run).toContain("extended-stable/[0-9]{4}");
+    expect(captureInputs?.run).toContain("tideclaw/alpha/");
+    expect(captureInputs?.run).toContain("refs/tags/");
+    expect(captureInputs?.run).toContain("RELEASE_ALLOW_UNRELEASED_CHANGELOG_INPUT");
+    expect(captureInputs?.run).toContain("allow_unreleased_changelog=false");
+    expect(workflow.jobs.install_smoke_release_checks.with.allow_unreleased_changelog).toBe(
+      currentTreeAllowance,
+    );
+    expect(workflow.jobs.live_repo_e2e_release_checks.with.allow_unreleased_changelog).toBe(
+      currentTreeAllowance,
+    );
+    expect(workflow.jobs.docker_e2e_release_checks.with.allow_unreleased_changelog).toBe(
+      currentTreeAllowance,
+    );
+    expect(fullReleaseSource).toContain(
+      "ALLOW_UNRELEASED_CHANGELOG: ${{ inputs.target_context_ref == '' && (inputs.allow_unreleased_changelog || inputs.ref == 'main' || inputs.ref == 'refs/heads/main') }}",
+    );
+  });
+
   it("keeps runtime tool coverage blocking in release checks", () => {
     const releaseChecksSource = readFileSync(
       ".github/workflows/openclaw-release-checks.yml",

test/scripts/release-no-push-workflow.test.ts

@@ -372,11 +372,14 @@ describe("release validation no-push transport", () => {
       'if [[ "$source_sha" != "$PACKAGE_REF" ]]',
     );
     expect(live.with).toMatchObject({
+      allow_unreleased_changelog:
+        "${{ needs.resolve_target.outputs.allow_unreleased_changelog == 'true' }}",
       shared_image_artifact_namespace: "release-live",
       shared_image_policy: "no-push-artifact",
     });
-    expect(live.with).not.toHaveProperty("allow_unreleased_changelog");
     expect(docker.with).toMatchObject({
+      allow_unreleased_changelog:
+        "${{ needs.resolve_target.outputs.allow_unreleased_changelog == 'true' }}",
       package_artifact_digest: "${{ needs.prepare_release_package.outputs.artifact_digest }}",
       package_artifact_id: "${{ needs.prepare_release_package.outputs.artifact_id }}",
       package_artifact_name: "${{ needs.prepare_release_package.outputs.artifact_name }}",
@@ -390,7 +393,6 @@ describe("release validation no-push transport", () => {
       shared_image_artifact_namespace: "release-docker",
       shared_image_policy: "no-push-artifact",
     });
-    expect(docker.with).not.toHaveProperty("allow_unreleased_changelog");
     expect(acceptance.with).toMatchObject({
       artifact_digest: "${{ needs.prepare_release_package.outputs.artifact_digest }}",
       artifact_id: "${{ needs.prepare_release_package.outputs.artifact_id }}",