feat: track stable OpenClaw releases for MSIX builds

[xlinush]

What Problem This Solves

CI should choose the current OpenClaw stable release without a hardcoded source commit in the workflow.

Fixes #25.

User Impact

An empty openclaw_ref selects npm openclaw@latest. The selected version and source commit are verified before building and kept fixed for retries.

Extended stable and named prereleases are rejected. There is no automatic fallback. A reviewed stableVersion pin can select an older known-good stable release, and unsigned/test runs can use an explicit stable-source ref.

Source selection checks the MSIX release-version rules before building. Unsupported corrections such as -1, -10 and -64 are rejected for channel selection, explicit refs, policy pins and retries. Official source selection must match the reviewed commit, version and tag in release-policy.json.

Why This Change Was Made

• Resolve stable to an exact published version and verified signed upstream tag/commit.
• Save the source choice once per run and validate it before reuse.
• Reject versions the MSIX release-identity helper cannot represent before building.
• Check the built package version against the selected source and pass the selected tag through package, bundle and upgrade verification.
• Build ARM64 payloads using ARM64 Node.js on a Windows ARM64 runner. npm's --cpu flag selects dependencies but does not change process.arch in their install scripts. With stable 2026.9.5, the previous x64-hosted ARM64 job selected the ARM64 Koffi binary, then ran an x64 install check and fell into a failing source build.
• Reject Node/target architecture mismatches before installation or staging changes, validate the recorded install architecture on cache reuse, and run the CLI smoke test for both payload architectures. No install scripts are skipped and no dependency versions are overridden.
• Add focused tests and update the related documentation.

Evidence

Head: 5730ca0284cfd19707ac34eee9a81e80b2470ccb.

CI run 35663788374 passed, including host checks, native x64 and ARM64 payload installation and MSIX composition, the combined bundle, Windows install/upgrade checks, and the final CI gate. CodeQL also passed.

The saved source selection is stable OpenClaw 2026.9.5, commit ec9c1a13db8938e5a3eaa51fca2e981cde2395a9. The tested MSIX identity is 2026.9.503.0. Upgrade evidence confirms successful fresh standalone/bundle installation and all six transitions from v0.0.0.0, v0.0.0.1, and v2026.9.4-msix.1, with the same package family and retained LocalState.

Passed locally: 45 source-selection tests, MSIX release-identity and package verification suites; payload/runtime, Gateway isolation plugin, cache-key, workflow configuration and signing-input suites. Documentation checks report zero findings; workflow architecture wiring and git diff --check passed.

The correction regression failed before its fix. The architecture regression also failed before the fix: the old payload script accepted an ARM64 target while running x64 Node. Coverage checks the actual npm lifecycle architecture, cold and cached mismatch rejection before staging/output mutation, cached-install architecture metadata, and payload/plugin validation. The payload fixture suite passed in both native architecture jobs in CI.

Official signing/publication and local installation were not run.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 21, 2026, 6:46 PM ET / 22:46 UTC (Revision 17).

ClawSweeper review

What this changes

The PR selects and freezes a verified stable OpenClaw release for Windows package builds, checks its identity throughout packaging, and builds ARM64 payloads with ARM64 Node.js.

Merge readiness

✅ Ready for maintainer review

The work remains necessary: main and the latest release still use a hardcoded source pin. No blocking introduced defect was found, and the maintainer’s shared-versioning requirement is addressed.

Priority: P2
Reviewed head: 5730ca0284cfd19707ac34eee9a81e80b2470ccb

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A coherent implementation with focused regression coverage and no blocking source finding; native packaging validation is still running.
Proof confidence	🌊 off-meta tidepool	Not applicable: The author is a COLLABORATOR, so the external-contributor proof gate does not apply. Earlier stable-build evidence remains relevant, but current native ARM64 packaging and upgrade results are still pending; source selection does not replace downstream signing authorization.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The author is a COLLABORATOR, so the external-contributor proof gate does not apply. Earlier stable-build evidence remains relevant, but current native ARM64 packaging and upgrade results are still pending; source selection does not replace downstream signing authorization.
Evidence reviewed	10 items	Still needed on main: The pinned main workflow retains the required openclaw_ref default and automatic fallback to commit 3a9d69db306cd7f081e06254cb89c4bcc14a7107; automatic stable selection is not already implemented. Latest release comparison: The workflow at v2026.9.4-msix.3 also retains the hardcoded source selection. Signing authority remains policy-owned: Fresh selections and replayed snapshots must match the requested selector and run identity. Official selections additionally match approvedCommit, payloadPackageVersion, and gatewayTag. The downstream signing validator still checks both package architectures before the protected signing job requests credentials.
Findings	None	None.
Security	None	None.

How this fits together

The packaging workflow turns upstream OpenClaw source into x64 and ARM64 Windows packages. Source selection feeds both builds, while the reviewed release policy separately controls official signing.

flowchart LR
  A[Npm stable or explicit ref] --> C[Verify source identity]
  B[Reviewed release policy] --> C
  C --> D[Immutable run snapshot]
  D --> E[Native x64 and ARM64 builds]
  E --> F[Packages and bundle]
  F --> G[Official signing checks]
  B --> G

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Net line growth	Production scripts +361; workflow +43; tests/checks +426; docs +37	Production growth implements verified source resolution and replay, while focused tests cover rejected identities and native installation architecture.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #25
Summary: This PR is the implementation candidate for the open stable-source request; the merged release-identity PR supplies a distinct foundation.

Members:

• canonical: Use stable OpenClaw releases as the source channel for MSIX releases #25 - The open issue defines stable selection and explicitly identifies this implementation PR.
• adjacent_distinct: feat(ci): derive deterministic MSIX release versions #36 - The merged PR owns release identity, which this branch now reuses rather than replacing.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

Keep one immutable stable-source selection for both architectures and retries, with release identity and official signing controlled by their existing policy owners.

Do we have a high-confidence way to reproduce the issue?

Not applicable to the central feature request; source inspection confirms that main still requires a hardcoded upstream pin. The reported ARM64 install failure was not reproduced by this review.

Is this the best way to solve the issue?

Yes. A single source resolver feeding the existing identity and signing owners is a coherent solution, and matching Node’s architecture addresses native install-script behavior without overriding dependencies.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 288521d5fcc9.

Labels

Label justifications:

• P2: This is a bounded packaging improvement with no demonstrated urgent regression in released installations.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The author is a COLLABORATOR, so the external-contributor proof gate does not apply. Earlier stable-build evidence remains relevant, but current native ARM64 packaging and upgrade results are still pending; source selection does not replace downstream signing authorization.

Evidence

What I checked:

• Still needed on main: The pinned main workflow retains the required openclaw_ref default and automatic fallback to commit 3a9d69db306cd7f081e06254cb89c4bcc14a7107; automatic stable selection is not already implemented. (.github/workflows/gateway-msix.yml:10, 288521d5fcc9)
• Latest release comparison: The workflow at v2026.9.4-msix.3 also retains the hardcoded source selection. (.github/workflows/gateway-msix.yml:10, ee41ab70e76c)
• Signing authority remains policy-owned: Fresh selections and replayed snapshots must match the requested selector and run identity. Official selections additionally match approvedCommit, payloadPackageVersion, and gatewayTag. The downstream signing validator still checks both package architectures before the protected signing job requests credentials. (scripts/Get-WorkflowSource.ps1:31, 5730ca0284cf)
• Maintainer direction and review continuity: The member review at feat: track stable OpenClaw releases for MSIX builds #42 (comment) requested reuse of the release-identity owner from feat(ci): derive deterministic MSIX release versions #36. The current source validator calls that helper, including its current correction limits. The previous completed review reported no concrete findings; the current branch also retains the stable-only direction documented in Use stable OpenClaw releases as the source channel for MSIX releases #25. (scripts/OpenClawSource.ps1:36, 5730ca0284cf)
• Architecture and cache cutover: Build-Payload rejects mismatched Node architecture before staging changes, records that architecture for reuse validation, and smoke-tests both targets. The existing payload cache key hashes Build-Payload.ps1, so this change invalidates older staged-install caches. Both workflow targets now use matching Node binaries. (scripts/Build-Payload.ps1:40, 5730ca0284cf)
• Upstream dependency contract: The dependency signal is the resolver’s interpretation of upstream release versions and its execution of selected upstream source. The upstream release policy defines latest as regular stable and patch 33 onward as extended-stable, matching the resolver’s distinction. GitHub reports v2026.9.5 as a verified annotated tag targeting this commit. (docs/reference/RELEASING.md:24, ec9c1a13db89)

Likely related people:

• RomneyDa: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• paulcam206: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (16 earlier review cycles; latest 8 shown)

• reviewed 2026-09-15T23:48:12.735Z sha 51c9ede :: needs real behavior proof before merge. :: none
• reviewed 2026-09-16T08:15:37.972Z sha 51c9ede :: needs real behavior proof before merge. :: none
• reviewed 2026-09-17T18:41:05.750Z sha c2fa7fa :: blocked before merge. :: none
• reviewed 2026-09-17T19:39:37.266Z sha c2fa7fa :: needs changes before merge. :: none
• reviewed 2026-09-17T22:21:08.017Z sha cc75196 :: needs changes before merge. :: none
• reviewed 2026-09-17T22:35:19.972Z sha cc75196 :: needs maintainer review before merge. :: none
• reviewed 2026-09-21T21:27:25.139Z sha 730c1a6 :: needs maintainer review before merge. :: none
• reviewed 2026-09-21T22:24:58.668Z sha a2919dc :: needs maintainer review before merge. :: none

[xlinush]

@clawsweeper re-review

The updated requirement is stable only. The extended-stable proposal is superseded: there is no cross-channel or automatic fallback, and a compatibility pin can select only a reviewed older known-good stable release.

CI run 35032630892 successfully built OpenClaw 2026.9.4 for x64 and ARM64 and produced the bundle. The selected commit, 3a9d69db306cd7f081e06254cb89c4bcc14a7107, includes the external-management check missing from the earlier 2026.6.35 choice. Please reassess the service-removal finding against this stable source.

The latest commit only removes obsolete setup inputs reported as ignored by that run; native cache-mode: none remains enforced. The separate official-signing and authorization-withdrawal proof questions are not being dismissed by this change.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[RomneyDa]

Versioning contract coordination: PR #36 is the foundational release-identity change and now owns the agreed mapping (gateway release sequence * 1000 + MSIX rebuild revision). Please rebase #42 after #36 and call Get-MSIXReleaseIdentity.ps1 rather than retaining its independent correction/rebuild formula. #42 remains draft and should not merge with a competing release contract.