Backport the missing scheduler, documentation, and focused regression proof from #103095 so stable/full release-path runs execute OpenWebUI exactly once on the dedicated lane while legacy aggregate aliases remain compatible.
Partial backport of ff28c1f66639f00b8aab00ae81b9b73788c2ac06; the workflow and workflow-test portions were already present on this release branch, while the skill-only documentation remains main-only.
The synced Full Release Validation umbrella dispatches children with a
dispatch_id and adopts runs by exact name (#102858), so ci.yml,
npm-telegram-beta-e2e.yml, and plugin-prerelease.yml need the matching
input; applies that commit's hunks plus its ci-workflow-guards update,
syncs scripts/ci-live-command-retry.sh, and ports the guard test blocks
that pin the synced workflow text.
Backports the release pipeline speedups from main (ace2407acd and
ancestors) so the 2026.7.1 train benefits immediately:
- metadata-only evidence reuse with input/harness/child-run matching
- Docker runtime-assets preflight runs in parallel with lanes
- release/* umbrella runs supersede in-progress duplicates
- beta profile treats live-provider suites as advisory
Syncing the umbrella workflow also picks up the main-only dispatch
idempotency and transient-read retries (#102858, #102896).
* feat(secrets): resolve SecretRef model credentials at egress via process-local sentinels
SecretRef-managed model-provider credentials now travel as opaque
oc-sent-v1 sentinels through auth storage, stream options, and SDK
config; the guarded model fetch injects real values into headers and
URLs immediately before the SSRF-guarded send and fails closed on
unknown sentinels. packages/ai adapters converge on the host guarded
fetch where the SDK supports custom fetch and unwrap at construction
where it does not. Resolved values (and their percent-encoded forms)
register for exact-value log redaction. Kill switch:
OPENCLAW_SECRET_SENTINELS=off. Also fixes a pre-existing unhandled
rejection race in capNonOkResponseBodyLazily (pipeThrough writer leak).
* test(plugin-sdk): update public surface budget
The wrapper probes `crabbox --version` and `crabbox run --help` once each with a
snappy 5s timeout to enumerate providers before delegating. A cold Crabbox — the
first call right after a version bump, or one on a loaded machine — can exceed
that timeout while rendering `run --help` (52KB, emitted on stderr in 0.36) or
doing first-run init, and can emit nothing on that first call. When that happens
both guards fire and hard-exit the wrapper ("selected binary failed basic
--version/--help sanity checks" or "could not parse provider list from --help;
refusing to run"), which blocks ALL remote validation (`pnpm check:changed`,
remote `pnpm test` lanes) even though the binary is fine.
Retry each metadata probe once with a generous 20s timeout when the first attempt
is killed or returns empty. The warm path is unchanged (one ~instant probe); only
a slow/empty first probe pays for the retry, after which the sanity/provider-list
guards judge the recovered result. Add a regression test: a fake Crabbox whose
`run --help` is slower than the default probe timeout (and, like 0.36, writes help
to stderr) is now recovered by the retry instead of hard-failing.
Vincent Koc