feat(ci): add isolated image qualification harness

[vincentkoc]

Related: #1756
Stacked on: #1778

What Problem This Solves

Image publication changes need exact-candidate proof of Fleet auth, AWS lifecycle,
transactional catalog rollback, and zero cloud residue before merge. Running
candidate code in a credential-bearing job or the default-branch cache scope
would make that proof unsafe.

Why This Change Was Made

This replaces the earlier privileged harness with a credential-isolated
workflow stacked on the AWS qualification authority. The protected
default-branch workflow_dispatch owns immutable credentialless build commands
and explicitly checks out both the protected revision and authorized candidate
SHA. It rejects candidate changes to Go modules or non-source Worker inputs,
installs only the protected lockfile, copies a bounded regular-file
worker/src tree into the protected build root, and runs only the protected Go
and Wrangler toolchains. A manifest-covered receipt binds the candidate source
and protected build-input digests; later jobs accept only that artifact ID and
digest from the exact first-attempt workflow run.

Before environment approval, a credentialless trusted admission job verifies
the exact artifact and rejects publishers without injectable CLI delegation,
pre-promotion candidate teardown, transactional receipts, compare-and-swap
rollback, and failed-revision retirement. Protected jobs execute only trusted
control tooling and treat candidate bytes as inert deploy data.

Protected deployment first creates a registry-discoverable inert candidate
bootstrap, disables workers.dev and preview URLs, and only then uploads exact
candidate bytes. A separate trusted relay exposes the sole workers.dev endpoint
and has one service binding to the private candidate. Its fixed allowlist
reconstructs only the publisher proof's lease, image, and run requests and
rejects arbitrary targets, paths, methods, queries, header overrides, content
types, oversized bodies, and absent or expired run timestamps before candidate
dispatch; expiry is rechecked immediately before the service-binding call.

After deployment and enrollment, a final protected arm job revalidates the
open PR, candidate artifact, exact candidate and relay Worker versions, binding
settings, isolation, registry claim, authority identity, policy hash, and
enrollment timestamps. A canonical execution-manifest digest binds both final
Worker versions to the candidate/deployment/authority identity before the
credentialless execute job can make its first mutation or paid call.

The executor receives only the relay URL and a distinct ephemeral executor
token. Candidate admin/shared tokens stay inside the trusted relay; AWS signing
remains in the fixed-policy authority Worker. Cloudflare and controller
credentials never enter candidate jobs or bindings. An independent protected
reaper derives and deletes the exact relay and candidate from durable run
identity without workflow artifacts.

User Impact

The reviewer-gated proof covers:

• exact open same-repository PR/SHA, protected default-branch producer SHA,
  source-derived current-run artifact with protected build-input receipt,
  private candidate deployment, and exact final candidate/relay Worker versions;
• relay rejection of arbitrary paths, methods, target changes, oversized
  bodies, header smuggling, wrong executor tokens, and expired runs before
  candidate dispatch, including a final expiry recheck at the dispatch boundary;
• spoofed shared-token promote-cas denial bounded to the exact millisecond
  request window, with unchanged candidate API readback and no operation or signer
  timestamp inside that inclusive interval;
• Fast Snapshot Restore rejection before signer dispatch;
• source, candidate-image, and promoted-image boots, sequentially and exactly
  three total;
• structured seed/promotion/rollback receipts proving base R0, candidate R1,
  and a fresh base rollback R2, with R2 distinct from R0 and R1;
• failed candidate R1 retirement, accepting a 200 readback only for the
  same AMI as a provider-only record with no catalog identity or role fields;
• a stale R0 CAS returning 409 with current R2, followed by unchanged base
  and failed-image readbacks; logs are supplemental only;
• exit 86 injected only after promoted smoke, followed by a hard-killed
  credentialless executor and protected zero-residue finalization.

PR/head/base drift is recorded as a qualification failure, never a warning.
Cleanup remains unconditional. Protected teardown first persists the authority
and registry finalization fence, then disables, verifies, and deletes the public
relay before continuing cleanup/finalization. The protected final verifier
matches run ID, candidate SHA, deployment hash, authority SHA/version, policy
hash, enrollment and expiry timestamps, finalized state, exact candidate/relay
Worker versions, and both binding digests before retiring the registry.

Limits remain fixed to one attempt, one active instance,
t3.small/t3a.small on-demand, one image/checkpoint set, no FSR or instance
profile, $10, and an absolute 120-minute authority expiry.

Evidence

• node --test --test-name-pattern='control tool fixes|executor proves|attestation gate|catalog proof|relay rejects' scripts/image-qualification-workflow.test.js - 5 passed
• exact restacked head 1ef24dd717b46991e9631082decd62a45ca87c02: node --test scripts/image-qualification-workflow.test.js - 17 passed
• exact PR 1756 head b6b4be90113f3d8930083e2f6ca836a18c81e296 source and contract inspection for transactional promotion receipts, fresh revisions, and 409 CAS conflicts
• exact pinned actions/upload-artifact/download-artifact source and docs
  inspection, including bare upload digest normalization and current-run ID downloads
• exact Wrangler 4.127.0 source inspection confirming custom commands come from
  configuration; qualification uses the protected config and binary only
• GitHub Actions API fixtures rejecting candidate-controlled producer paths and
  artifact replacement while retaining exact repo/PR/SHA checks
• node --test scripts/workflow-action-pins.test.js - 1 passed
• actionlint -shellcheck= -pyflakes= .github/workflows/image-qualification.yml .github/workflows/image-qualification-reaper.yml
• extracted build-candidate shell: shellcheck -x and bash -n
• shellcheck scripts/image-qualification-execute.sh scripts/image-qualification-crabbox-adapter.sh
• node --check scripts/image-qualification-control.mjs
• node --check scripts/image-qualification-workflow.test.js
• node --check scripts/image-qualification-controller-worker.mjs
• node --check scripts/image-qualification-relay-worker.mjs
• bash -n scripts/image-qualification-execute.sh scripts/image-qualification-crabbox-adapter.sh
• git diff --check
• all 14 restacked commits are signed at head 1ef24dd717b46991e9631082decd62a45ca87c02
• exact base b061bb5dbdb776c3c11b538204034184eb6dd8a7 after squash-merging PR 1778

No workflow was dispatched and no GitHub environment, secret, Worker, Durable
Object, AWS resource, deployment, or paid run was created.

External setup blockers for live proof:

• create a required-reviewer protected image-qualification GitHub environment;
• deploy the non-public authority from PR 1778 in a dedicated AWS sandbox
  account with the documented region/tag IAM constraints and explicit FSR deny;
• configure least-privilege CLOUDFLARE_API_TOKEN,
  CRABBOX_IMAGE_QUALIFICATION_CONTROLLER_TOKEN, CLOUDFLARE_ACCOUNT_ID, the
  authority SHA/version and canonical policy hash, AWS region, subnet,
  preprovisioned security group, base AMI, and root-volume variables;
• obtain maintainer approval to dispatch one paid attempt against the exact open
  PR 1756 candidate after the protected environment and authority are provisioned.

Production/operations delta: +2847/-0 lines. Tests: +1094/-0 lines. Docs: +147 net (+155/-8) lines.
Positive production growth implements the credential and source-derived build
boundaries, immutable deployment contract, protected recovery owner, private candidate ingress,
bounded trusted relay, exact catalog-state proof, pre-execution version fence,
and zero-residue evidence surface; normal CLI and coordinator behavior are
unchanged.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[vincentkoc]

@clawsweeper review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/33764529875
• Updated: 2026-09-03T14:02:59.294Z

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 4, 2026, 10:44 AM ET / 14:44 UTC.

ClawSweeper review

What this changes

Adds isolated GitHub Actions workflows, a private relay/controller, scripts, tests, and documentation for qualifying an exact image-publishing candidate against a credential-isolated AWS sandbox.

Merge readiness

⛔ Blocked before merge - 6 items remain

Keep open. This MEMBER-authored PR adds a new, privileged CI and AWS qualification capability; its source-level isolation design is coherent, but the required deployed authority-chain proof and maintainer decision to operate the protected environment are still absent.

Priority: P1
Reviewed head: 1ef24dd717b46991e9631082decd62a45ca87c02
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The patch has substantial source-level safety controls, but its material authority boundary remains unproven in the required deployed environment.
Proof confidence	🦪 silver shellfish (2/6)	Needs real behavior proof before merge: Authority-chain proof required: the changed production owner is the relay that injects candidate authority at dispatch, but the PR records only Node tests and explicitly states that no protected deployment or paid run occurred; it does not show deployed allowed rollback recovery or nearest-forbidden expiry/finalization rejection before candidate or AWS signer I/O. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: Authority-chain proof required: the changed production owner is the relay that injects candidate authority at dispatch, but the PR records only Node tests and explicitly states that no protected deployment or paid run occurred; it does not show deployed allowed rollback recovery or nearest-forbidden expiry/finalization rejection before candidate or AWS signer I/O. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	5 items	Introduced relay authorization boundary: The relay authenticates the executor, reconstructs a fixed allowlisted request, injects one candidate token, and rechecks expiry immediately before dispatching to the private candidate Worker. Protected workflow boundary: The introduced workflow separates protected deployment/enrollment from the credentialless executor and passes only relay URL and executor token to the execution job. Required live provider evidence: The runbook defines deployed qualification as an exact live proof with authority-owned cleanup, while the PR body explicitly states that no workflow, Worker, AWS resource, deployment, or paid run was created.
Findings	None	None.
Security	Needs attention	Prove final-effect authorization in the deployed boundary: The relay injects candidate authority immediately before dispatch to the private Worker; available evidence is static or mocked and does not show that expiry or finalization rejects before candidate or AWS signer I/O.

How this fits together

The image qualification subsystem runs a candidate Crabbox build through a protected workflow and a narrowly scoped relay. The relay forwards only approved publisher calls to a private candidate Worker, which reaches the existing AWS qualification authority and produces cleanup evidence.

flowchart LR
  A[Candidate pull request] --> B[Protected qualification workflow]
  B --> C[Sealed candidate bundle]
  C --> D[Private candidate Worker]
  E[Credentialless executor] --> F[Scoped public relay]
  F --> D
  D --> G[AWS qualification authority]
  G --> H[Rollback and cleanup evidence]

Loading

Decision needed

Question	Recommendation
Should Crabbox operate the protected AWS sandbox and GitHub environment needed to make this image-qualification harness a supported pre-merge gate?	Sponsor protected qualification: Approve the dedicated environment and sandbox, then require the scoped deployed proof before merge.

Why: This choice creates a persistent privileged CI and paid-provider operating surface; source review cannot decide whether that operational commitment is wanted.

Before merge

• Add real behavior proof - Needs real behavior proof before merge: Authority-chain proof required: the changed production owner is the relay that injects candidate authority at dispatch, but the PR records only Node tests and explicitly states that no protected deployment or paid run occurred; it does not show deployed allowed rollback recovery or nearest-forbidden expiry/finalization rejection before candidate or AWS signer I/O. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve security concern: Prove final-effect authorization in the deployed boundary - The relay injects candidate authority immediately before dispatch to the private Worker; available evidence is static or mocked and does not show that expiry or finalization rejects before candidate or AWS signer I/O.
• Resolve merge risk (P1) - Merging enables a credential-bearing workflow that creates paid AWS resources, but no deployed run proves that allowed recovery and the nearest expiry/finalization rejection both stop before candidate or AWS signer I/O.
• Resolve merge risk (P1) - The protected GitHub environment, dedicated sandbox account, secrets, and long-term reaper operation require an explicit maintainer-owned operating decision.
• Complete next step (P2) - Obtain maintainer approval for the protected environment and AWS sandbox, then attach redacted deployed proof of rollback recovery and expiry/finalization rejection before candidate or AWS signer I/O.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

• [medium] Prove final-effect authorization in the deployed boundary — scripts/image-qualification-relay-worker.mjs:273

Agent review details

Security

Needs attention: No concrete source-level bypass was found, but the new relay-to-candidate authority injection has no deployed final-effect proof.

Review metrics

Metric	Value	Why it matters
Changed surface	10 files, +4,096/-8	The PR adds a large privileged workflow and control-plane surface, so its live authority proof matters more than unit-test breadth alone.

Merge-risk options

Maintainer options:

1. Require protected live qualification (recommended)
   Before merge, approve the dedicated environment and attach redacted evidence that a deployed run recovers correctly and rejects expiry/finalization cases before final I/O.
2. Defer the operational surface
   Pause this PR if maintainers do not want to provision and continuously own the protected AWS qualification environment.

Technical review

Best possible solution:

Provision the reviewed protected environment and sandbox only after maintainer sponsorship, then retain this harness once a redacted exact-candidate run proves rollback recovery, final-effect rejection, and zero-residue teardown.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction. The required feature scenario has not been run in its real protected GitHub, Cloudflare, and AWS environment.

Is this the best way to solve the issue?

Unclear. The isolation approach is source-consistent, but it is not yet the proven best solution until maintainers accept the operating model and a deployed run validates the final authority boundary.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against b061bb5dbdb7.

Labels

Label changes:

• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• remove rating: 🧂 unranked krab: Current PR rating is rating: 🦪 silver shellfish, so this older rating label is no longer current.

Label justifications:

• P1: This introduces a privileged CI path that can create AWS resources and is intended to gate image-publication safety.
• merge-risk: 🚨 security-boundary: The relay injects candidate authority at the production dispatch boundary and reaches an AWS-signing authority.
• merge-risk: 🚨 automation: The PR adds two GitHub Actions workflows responsible for authorization, deployment, recovery, and reaping.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Authority-chain proof required: the changed production owner is the relay that injects candidate authority at dispatch, but the PR records only Node tests and explicitly states that no protected deployment or paid run occurred; it does not show deployed allowed rollback recovery or nearest-forbidden expiry/finalization rejection before candidate or AWS signer I/O. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Security concerns:

• [medium] Prove final-effect authorization in the deployed boundary — scripts/image-qualification-relay-worker.mjs:273
  The relay injects candidate authority immediately before dispatch to the private Worker; available evidence is static or mocked and does not show that expiry or finalization rejects before candidate or AWS signer I/O.
  Confidence: 0.96

What I checked:

• Introduced relay authorization boundary: The relay authenticates the executor, reconstructs a fixed allowlisted request, injects one candidate token, and rechecks expiry immediately before dispatching to the private candidate Worker. (scripts/image-qualification-relay-worker.mjs:273, 1ef24dd717b4)
• Protected workflow boundary: The introduced workflow separates protected deployment/enrollment from the credentialless executor and passes only relay URL and executor token to the execution job. (.github/workflows/image-qualification.yml:269, 1ef24dd717b4)
• Required live provider evidence: The runbook defines deployed qualification as an exact live proof with authority-owned cleanup, while the PR body explicitly states that no workflow, Worker, AWS resource, deployment, or paid run was created. (docs/features/image-bake-runbook.md:727, 1ef24dd717b4)
• Repository quality bar: VISION.md requires funded or remote providers to demonstrate real create, use, destroy, and zero-residue proof before merge; this PR has only static and mocked validation so far. (VISION.md:9, b061bb5dbdb7)
• Authority-path provenance: Current main's AWS qualification transport and controller were introduced by merged PR 1778; raw-parent inspection confirmed this is a non-root merge commit and its diff adds the authority source. (worker/src/aws-qualification-authority.ts:191, b061bb5dbdb7)

Likely related people:

• Vincent Koc: Raw commit b061bb5 adds worker/src/aws-qualification-authority.ts:191 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: b061bb5dbdb7; files: worker/src/aws-qualification-authority.ts)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Obtain maintainer approval for the protected GitHub environment and dedicated AWS sandbox.
• Attach redacted deployed evidence for allowed rollback-and-cleanup recovery through the relay and authority.
• Prove expired executor access and a request racing finalization are rejected before candidate or AWS signer I/O.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (18 earlier review cycles; latest 8 shown)

• reviewed 2026-09-04T11:48:47.065Z sha 398c4a3 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-04T12:10:40.170Z sha 1a4680e :: needs real behavior proof before merge. :: none
• reviewed 2026-09-04T12:43:44.155Z sha 1944424 :: needs real behavior proof before merge. :: [P1] Reject expired and finalized executor tokens at the relay
• reviewed 2026-09-04T12:49:28.355Z sha 809d8e8 :: needs real behavior proof before merge. :: [P1] Reject expired and finalized executor tokens before relay dispatch
• reviewed 2026-09-04T12:58:22.208Z sha 147e03b :: needs real behavior proof before merge. :: none
• reviewed 2026-09-04T13:18:19.821Z sha 151808c :: needs real behavior proof before merge. :: none
• reviewed 2026-09-04T13:27:50.985Z sha 68bd28f :: needs real behavior proof before merge. :: none
• reviewed 2026-09-04T13:48:35.652Z sha afadad8 :: needs real behavior proof before merge. :: none

[vincentkoc]

@clawsweeper re-review

Please review exact head 240f169fee6d9668aeaf8dfea65abd2a5e24bf8e, stacked on feat/aws-qualification-broker at 0ff824c6022f2010464ea66baba066fb4588598d. Focus on the candidate/credential boundary, partial-deploy and abandoned-run recovery, exact publisher rollback evidence, and zero-residue teardown.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[vincentkoc]

@clawsweeper re-review

Please review exact head 2535a5b359b91fcc508fd9337b660b7e4db136bd stacked on feat/aws-qualification-broker@0ff824c6022f2010464ea66baba066fb4588598d.

The prior CodeQL findings are repaired by moving candidate compilation to an unprivileged pull_request workflow and returning opaque controller errors. Focus on the credential/cache boundary, exact artifact authorization, protected cleanup/reaper behavior, candidate rollback proof, and zero-residue verification.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[vincentkoc]

@clawsweeper re-review

Please review exact head 7bed7d299fa3bf595d53d4e877de89b01f58330f stacked on feat/aws-qualification-broker@0ff824c6022f2010464ea66baba066fb4588598d.

This head repairs the exact admission finding: a credentialless trusted job now verifies the immutable artifact and rejects publishers without the ordered transactional rollback contract before protected deployment. The protected deploy repeats the check before its first side effect, and the contract admits the actual PR 1756 publisher.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/33863724153
• Updated: 2026-09-04T10:33:41.593Z

[vincentkoc]

@clawsweeper re-review

Please review exact head 687a0aa5daeec7147ec03aa27eedb3c6fc109950 stacked on feat/aws-qualification-broker@0ff824c6022f2010464ea66baba066fb4588598d.

This head repairs the remaining exact-head findings:

• candidate API receipts/readbacks, not logs, now prove seeded default state, exact rollback revision, and failed-revision retirement;
• PR/head/base drift is retained as a qualification failure while cleanup still runs unconditionally, and final authority attestations must match every protected identity/timestamp/finalized expectation;
• a protected arm job re-reads the exact final Cloudflare Worker version and bindings immediately before credentialless execution, with that version bound into the execution-manifest digest.

No workflow, deployment, cloud resource, environment, secret, or paid run was created.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/33865021742
• Updated: 2026-09-04T10:49:36.624Z

[vincentkoc]

@clawsweeper re-review

Please review exact head d78f197c0340f972e9380654ab596e3e105ea537 stacked on feat/aws-qualification-broker@0ff824c6022f2010464ea66baba066fb4588598d.

This signed follow-up repairs the exact 687a0aa5 P1: candidate artifact
discovery now accepts both the bare workflow path observed from the live GitHub
Actions API and the ref-qualified form, while retaining exact event,
conclusion, repository, PR, candidate SHA, artifact run, and artifact digest
checks. Focused workflow tests cover both accepted forms and reject a different
workflow.

The protected-path deployment proof remains externally blocked and was not
dispatched.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/33865590842
• Updated: 2026-09-04T10:58:58.238Z

[vincentkoc]

@clawsweeper re-review

Exact head: 388da8fc68a2477b6152b6d309eee2fddcb6d3bd
Exact stacked base: 0ff824c6022f2010464ea66baba066fb4588598d

This head makes the candidate Worker private, adds a bounded trusted relay with
one candidate service binding and a distinct executor token, verifies both
Workers immediately before execution, and deletes both through protected
finalization/reaping. Focused relay abuse, workflow, pin, actionlint, shellcheck,
syntax, formatting, and diff checks pass. No cloud workflow was dispatched.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[vincentkoc]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/33878335859
• Updated: 2026-09-04T13:30:36.749Z

[vincentkoc]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/33880393188
• Updated: 2026-09-04T13:51:46.766Z

[vincentkoc]

@clawsweeper re-review

Exact restacked head: 1ef24dd717b46991e9631082decd62a45ca87c02
Exact base after PR 1778 merged: b061bb5dbdb776c3c11b538204034184eb6dd8a7

The restacked diff remains 10 files and +4096/-8; all 14 commits are signed. node --test scripts/image-qualification-workflow.test.js passes all 17 tests.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/33885709173
• Updated: 2026-09-04T14:47:14.430Z

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: feat(ci): add isolated image qualification harness This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.