fix(repair): single status-check rollup; stale failures no longer block finalization

[steipete]

Summary

Unify the three repair-lane interpretations of GitHub's statusCheckRollup behind src/repair/status-check-rollup.ts. The shared owner now selects the latest check per case-normalized workflow/name, parses and matches ignored names case-insensitively, and applies one timestamp precedence (started*, then created*, then completed*, with an untimestamped pending rerun kept visible).

Comment-router, post-flight, and finalizer keep their lane-specific blocker policy. The intended finalizer bug fix is explicit: once a newer run of a check succeeds, an older failed run of the same check no longer creates a stale needs_checks blocker.

Drift re-verification

Re-verified on fresh origin/main at e13791786799f6a51a39806938847bbc48948e5e:

• comment-router-utils.ts deduplicated case-insensitive workflow/name identities, but preferred completion timestamps before start timestamps.
• post-flight.ts deduplicated the same identities, preferred start/creation timestamps before completion timestamps, and treated an untimestamped pending rerun as newest.
• finalize-open-prs.ts did not deduplicate at all and matched ignored names case-sensitively.

The new module owns those drift-prone mechanics once. Representative router and post-flight policy fixtures pin their unchanged decisions; dedicated unit cases pin casing, timestamp-field precedence, and untimestamped pending behavior.

Finalizer liveness trace

Verdict: live.

The dedicated repair-finalize-open-prs.yml workflow was deleted in #964, but the report path remains live. Every completed repair cluster worker run triggers .github/workflows/repair-publish-results.yml (and the workflow also supports manual dispatch). After building repair code and downloading a publishable worker artifact, its Publish result ledger step runs:

pnpm run repair:finalize-open-prs -- --write-report

That package script executes dist/repair/finalize-open-prs.js. In this live --write-report mode, module initialization invokes loadPublishedRecords, listOpenPullRequests, hydratePullRequest (fetchPullRequestView plus fetchReviewThreadState, with mergeability refresh when needed), and classifyPullRequest. Classification invokes the buggy summarizeChecks; its result feeds the PR's checks, needs_checks blocker, recommended next action, and overall summarize report. writeReports then emits results/finalize-open-prs.json and .md, and the following repair:publish-result invocation reads that JSON into the published Open PR Finalizer Queue.

The removed workflow's dispatch path is not invoked by this live command: --write-report leaves dispatchRepairs false, so selectDispatchCandidates, executeDispatches, and dispatchRepair do not run. They remain reachable only when the still-exposed CLI is explicitly called with dispatch/execute flags.

Behavior proof

Committed proof: docs/proof/status-check-rollup/ packages the real-GitHub classification pair, redacted 26-entry payload, report-only finalizer output, runnable harness, local provenance, and Docker-backed Crabbox provenance. The inline summary below remains the concise result.

The regression test was added before the production fix. Against fresh origin/main, an older failure plus a newer success of the same CI / unit check produced this red run verbatim:

$ pnpm run build && pnpm run build:repair && pnpm run build:dashboard
$ tsc -p tsconfig.json
$ tsc -p tsconfig.repair.json
$ tsc -p tsconfig.dashboard.json
✖ finalizer ignores an older failed run after the same check succeeds (720.7655ms)
ℹ tests 1
ℹ suites 0
ℹ pass 0
ℹ fail 1
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 1299.237208

✖ failing tests:

test at test/repair/finalize-open-prs.test.ts:10:1
✖ finalizer ignores an older failed run after the same check succeeds (720.7655ms)
  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
  
  2 !== 1
  
      at TestContext.<anonymous> (file:///Users/steipete/.codex/worktrees/clawsweeper-unify-status-check-rollup/test/repair/finalize-open-prs.test.ts:57:12)
      at Test.runInAsyncScope (node:async_hooks:227:14)
      at Test.run (node:internal/test_runner/test:1382:25)
      at Test.start (node:internal/test_runner/test:1242:17)
      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
    generatedMessage: true,
    code: 'ERR_ASSERTION',
    actual: 2,
    expected: 1,
    operator: 'strictEqual',
    diff: 'simple'
  }

At committed head 10d0801364df699b697fad5cea1ba59a52b91cae, the exact same regression is green (verbatim):

✔ finalizer ignores an older failed run after the same check succeeds (168.182875ms)
ℹ tests 1
ℹ suites 0
ℹ pass 1
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 399.764708

Focused repair proof: 62 passed, 0 failed, covering the finalizer regression, router and post-flight equivalence fixtures, ignored-name casing, timestamp precedence, and untimestamped pending reruns.

Validation

• pnpm run build:all — passed
• pnpm run test:no-build — passed (3,282 tests; 3,273 passed, 9 skipped, 0 failed)
• pnpm run lint — passed
• pnpm run format:check — passed
• pnpm run check:active-surface — passed
• pnpm run check:dashboard-queue-boundary — passed
• pnpm run check:limits — passed
• Pre-commit Codex autoreview — clean, no accepted/actionable findings
• Committed branch Codex autoreview against origin/main — clean, no accepted/actionable findings

Docker container full-suite proof

Environment: Crabbox provider=local-container, image node:24-bookworm, Node 24.19.0, Git 2.39.5, pnpm 11.10.0 through Corepack. A checksum-verified static jq 1.8.1 was installed into $HOME/.local/bin in both fresh containers:

jq-linux-amd64: OK
jq-1.8.1

Current origin/main baseline at e13791786799f6a51a39806938847bbc48948e5e, lease cbx_72566c5500ea: exactly the three partial-clone blob-hydration tests were selected. Verbatim test output:

✖ restricted PR review can inspect changed blobs from a genuine blobless clone offline (156.458274ms)
✖ missing partial-clone objects are fetched in one bounded network request (83.715602ms)
✖ review hydration enforces per-review byte limits without fetching oversized blobs (163.813559ms)
ℹ tests 3
ℹ suites 0
ℹ pass 0
ℹ fail 3
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 464.550836

✖ failing tests:

test at test/review-blob-hydration.test.ts:101:1
✖ restricted PR review can inspect changed blobs from a genuine blobless clone offline (156.458274ms)
  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
  
  false !== true
  
      at TestContext.<anonymous> (file:///tmp/clawsweeper-main-baseline/test/review-blob-hydration.test.ts:122:12)
      at Test.runInAsyncScope (node:async_hooks:227:14)
      at Test.run (node:internal/test_runner/test:1382:25)
      at Test.start (node:internal/test_runner/test:1242:17)
      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
    generatedMessage: true,
    code: 'ERR_ASSERTION',
    actual: false,
    expected: true,
    operator: 'strictEqual',
    diff: 'simple'
  }

test at test/review-blob-hydration.test.ts:177:1
✖ missing partial-clone objects are fetched in one bounded network request (83.715602ms)
  AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
  + actual - expected
  
    {
  +   blobs: 0,
  +   hydrated: false
  -   blobs: 12,
  -   hydrated: true
    }
  
      at TestContext.<anonymous> (file:///tmp/clawsweeper-main-baseline/test/review-blob-hydration.test.ts:203:12)
      at Test.runInAsyncScope (node:async_hooks:227:14)
      at Test.run (node:internal/test_runner/test:1382:25)
      at Test.processPendingSubtests (node:internal/test_runner/test:960:18)
      at Test.postRun (node:internal/test_runner/test:1522:19)
      at node:internal/test_runner/test:1285:31
      at node:internal/process/task_queues:151:7
      at AsyncResource.runInAsyncScope (node:async_hooks:227:14)
      at AsyncResource.runMicrotask (node:internal/process/task_queues:148:8)
      at async Test.processPendingSubtests (node:internal/test_runner/test:960:7) {
    generatedMessage: true,
    code: 'ERR_ASSERTION',
    actual: { hydrated: false, blobs: 0 },
    expected: { hydrated: true, blobs: 12 },
    operator: 'deepStrictEqual',
    diff: 'simple'
  }

test at test/review-blob-hydration.test.ts:212:1
✖ review hydration enforces per-review byte limits without fetching oversized blobs (163.813559ms)
  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
  
  false !== true
  
      at TestContext.<anonymous> (file:///tmp/clawsweeper-main-baseline/test/review-blob-hydration.test.ts:233:14)
      at Test.runInAsyncScope (node:async_hooks:227:14)
      at Test.run (node:internal/test_runner/test:1382:25)
      at Test.processPendingSubtests (node:internal/test_runner/test:960:18)
      at Test.postRun (node:internal/test_runner/test:1522:19)
      at Test.run (node:internal/test_runner/test:1447:12)
      at async Test.processPendingSubtests (node:internal/test_runner/test:960:7) {
    generatedMessage: true,
    code: 'ERR_ASSERTION',
    actual: false,
    expected: true,
    operator: 'strictEqual',
    diff: 'simple'
  }

PR head 10d0801364df699b697fad5cea1ba59a52b91cae, full-suite lease cbx_f215cbbe1560: 3,282 tests, 3,271 passed, 8 skipped, and exactly the same three failures. There were zero jq: command not found occurrences. Verbatim full-run tail:

ℹ tests 3282
ℹ suites 0
ℹ pass 3271
ℹ fail 3
ℹ cancelled 0
ℹ skipped 8
ℹ todo 0
ℹ duration_ms 266174.816729

✖ failing tests:

test at test/review-blob-hydration.test.ts:101:1
✖ restricted PR review can inspect changed blobs from a genuine blobless clone offline (208.874538ms)
  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
  
  false !== true
  
      at TestContext.<anonymous> (file:///work/crabbox/cbx_f215cbbe1560/clawsweeper/test/review-blob-hydration.test.ts:122:12)
      at Test.runInAsyncScope (node:async_hooks:227:14)
      at Test.run (node:internal/test_runner/test:1382:25)
      at Test.start (node:internal/test_runner/test:1242:17)
      at startSubtestAfterBootstrap (node:internal/test_runner/harness:387:17) {
    generatedMessage: true,
    code: 'ERR_ASSERTION',
    actual: false,
    expected: true,
    operator: 'strictEqual',
    diff: 'simple'
  }

test at test/review-blob-hydration.test.ts:177:1
✖ missing partial-clone objects are fetched in one bounded network request (132.003528ms)
  AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal:
  + actual - expected
  
    {
  +   blobs: 0,
  +   hydrated: false
  -   blobs: 12,
  -   hydrated: true
    }
  
      at TestContext.<anonymous> (file:///work/crabbox/cbx_f215cbbe1560/clawsweeper/test/review-blob-hydration.test.ts:203:12)
      at Test.runInAsyncScope (node:async_hooks:227:14)
      at Test.run (node:internal/test_runner/test:1382:25)
      at Test.processPendingSubtests (node:internal/test_runner/test:960:18)
      at Test.postRun (node:internal/test_runner/test:1522:19)
      at Test.run (node:internal/test_runner/test:1447:12)
      at async Test.processPendingSubtests (node:internal/test_runner/test:960:7) {
    generatedMessage: true,
    code: 'ERR_ASSERTION',
    actual: { hydrated: false, blobs: 0 },
    expected: { hydrated: true, blobs: 12 },
    operator: 'deepStrictEqual',
    diff: 'simple'
  }

test at test/review-blob-hydration.test.ts:212:1
✖ review hydration enforces per-review byte limits without fetching oversized blobs (278.223558ms)
  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
  
  false !== true
  
      at TestContext.<anonymous> (file:///work/crabbox/cbx_f215cbbe1560/clawsweeper/test/review-blob-hydration.test.ts:233:14)
      at Test.runInAsyncScope (node:async_hooks:227:14)
      at Test.run (node:internal/test_runner/test:1382:25)
      at Test.processPendingSubtests (node:internal/test_runner/test:960:18)
      at Test.postRun (node:internal/test_runner/test:1522:19)
      at Test.run (node:internal/test_runner/test:1447:12)
      at async Test.processPendingSubtests (node:internal/test_runner/test:960:7) {
    generatedMessage: true,
    code: 'ERR_ASSERTION',
    actual: false,
    expected: true,
    operator: 'strictEqual',
    diff: 'simple'
  }
[ELIFECYCLE] Command failed with exit code 1.
[ELIFECYCLE] Test failed. See above for more details.

The three failures are environmental in the bare container. Its Debian Bookworm Git 2.39.5 does not return an <object-id> missing batch row for the fixture's GIT_NO_LAZY_FETCH=1 git cat-file --batch-check probe. It instead attempts a promisor lazy fetch, emits fatal: could not fetch <object-id> from promisor remote, and returns no batch row, so hydratePullRequestReviewBlobs fails closed before its bounded explicit fetch. These tests should be capability/env-gated in a follow-up; this PR does not change them.

Container delta versus current main: zero failures.

Real gh production-boundary trace

This proof used the authenticated GitHub CLI 2.97.0 against the real GitHub API, not the regression test's fake executable. The live subject was open PR #1099 at head 1aa53a6a09e543e4a6e4906f7e3cc0bf34a4bd65. Its case-normalized ClawSweeper Dispatch / dispatch identity contains older cancelled runs, a later successful run, and later acceptable skipped reruns. URLs are redacted; Actions run and job IDs are retained.

[
  {"workflowName":"ClawSweeper Dispatch","name":"dispatch","status":"COMPLETED","conclusion":"CANCELLED","startedAt":"2026-08-10T15:46:40Z","completedAt":"2026-08-10T15:46:41Z","actionsRunId":"31405430931","jobId":"93510453087"},
  {"workflowName":"ClawSweeper Dispatch","name":"dispatch","status":"COMPLETED","conclusion":"CANCELLED","startedAt":"2026-08-10T15:46:42Z","completedAt":"2026-08-10T15:46:43Z","actionsRunId":"31405432821","jobId":"93510462224"},
  {"workflowName":"ClawSweeper Dispatch","name":"dispatch","status":"COMPLETED","conclusion":"SKIPPED","startedAt":"2026-08-10T15:51:27Z","completedAt":"2026-08-10T15:51:27Z","actionsRunId":"31405849078","jobId":"93511873241"},
  {"workflowName":"ClawSweeper Dispatch","name":"dispatch","status":"COMPLETED","conclusion":"SKIPPED","startedAt":"2026-08-10T15:51:27Z","completedAt":"2026-08-10T15:51:27Z","actionsRunId":"31405849118","jobId":"93511874745"},
  {"workflowName":"ClawSweeper Dispatch","name":"dispatch","status":"COMPLETED","conclusion":"SKIPPED","startedAt":"2026-08-10T15:51:28Z","completedAt":"2026-08-10T15:51:27Z","actionsRunId":"31405850201","jobId":"93511876958"},
  {"workflowName":"ClawSweeper Dispatch","name":"dispatch","status":"COMPLETED","conclusion":"SKIPPED","startedAt":"2026-08-10T15:51:39Z","completedAt":"2026-08-10T15:51:28Z","actionsRunId":"31405851663","jobId":"93511932492"},
  {"workflowName":"ClawSweeper Dispatch","name":"dispatch","status":"COMPLETED","conclusion":"SUCCESS","startedAt":"2026-08-10T15:46:46Z","completedAt":"2026-08-10T15:46:55Z","actionsRunId":"31405434030","jobId":"93510469023"}
]

The production report-only entry point was run at this PR head with an exact branch prefix:

$ pnpm run repair:finalize-open-prs -- --repo openclaw/clawsweeper --head-prefix codex/disk-full-incident --write-report
dispatch.enabled=false
dispatch.execute=false
dispatch.candidates=[]
summary.needs_checks=0
pr=1099
checks.total=14
checks.counts={"SKIPPED":2,"SUCCESS":12}
checks.blockers=[]
needs_checks=null

For the before/after contrast, the exact pre-change summarizeChecks logic from parent e13791786799f6a51a39806938847bbc48948e5e was executed as a local one-off harness, not committed, beside head 10d0801364df699b697fad5cea1ba59a52b91cae. Both classifications consumed the same real 26-entry statusCheckRollup payload; the relevant repeated identity is listed above. Verbatim redacted pair:

{
  "oldPreChangeCommit": "e13791786799f6a51a39806938847bbc48948e5e",
  "old": {
    "total": 26,
    "counts": {"CANCELLED":3,"SKIPPED":6,"SUCCESS":17},
    "blockers": [
      "ClawSweeper Dispatch / dispatch:CANCELLED",
      "ClawSweeper Dispatch / dispatch:CANCELLED"
    ],
    "needs_checks": "needs_checks:ClawSweeper Dispatch / dispatch:CANCELLED; ClawSweeper Dispatch / dispatch:CANCELLED"
  },
  "newHeadCommit": "10d0801364df699b697fad5cea1ba59a52b91cae",
  "new": {
    "total": 14,
    "counts": {"SKIPPED":2,"SUCCESS":12},
    "blockers": [],
    "needs_checks": null
  }
}

Automation-risk disposition

This behavior change means a stale failed run of a re-run check no longer vetoes finalization after a newer run of the same case-normalized workflow/check identity establishes the current acceptable state. That is the correct GitHub check semantics: the newest run for an identity is current, and it is the same rule already applied by the router and post-flight lanes. The blast radius is limited to finalizer check classifications (checks, needs_checks, recommended action, and summary) that feed the published Open PR Finalizer Queue; current failures and pending reruns still block, and no report schema, dispatch policy, or queue action changed. If this interpretation proves unsafe, reverting 10d0801364df699b697fad5cea1ba59a52b91cae restores the former per-entry processing and stale-failure veto.

OpenClaw Bay

No Bay change is needed. This is a repair-only interpretation fix; it changes no Worker contract, report schema, queue/lifecycle contract, dashboard code, or observer/action boundary. The existing finalizer report contains corrected check counts and blockers under the same shape.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 10, 2026, 4:17 PM ET / 20:17 UTC.

ClawSweeper review

What this changes

This PR centralizes repair status-check selection so newer runs replace stale failures in finalization, comment routing, and post-flight checks.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

Keep open: current main still evaluates every finalizer check run, while this PR selects the latest normalized run and supplies sufficient production-boundary proof. Likely related people: Peter Steinberger (high) and Dwin Gharibi (medium).

Priority: P2
Reviewed head: bd127dbe47c467b7107c7618dabfc26fa44ef7d3

Review scores

Measure	Result	What it means
Overall readiness	🦞 diamond lobster (5/6)	Focused shared logic, extensive regression coverage, and a committed production-boundary trace provide strong merge confidence.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (linked_artifact): A Docker-backed Crabbox run at an unchanged functional-source head fetched a real GitHub check payload and exercised the production report-only finalizer, observing stale blockers fall from two to zero.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): A Docker-backed Crabbox run at an unchanged functional-source head fetched a real GitHub check payload and exercised the production report-only finalizer, observing stale blockers fall from two to zero.
Evidence reviewed	6 items	Current main still has the defect: Current main's finalizer iterates the raw status-check list and does not deduplicate repeated workflow/check identities before creating blockers. Shared implementation is narrow and applied to all consumers: The new rollup normalizes workflow/check identities, picks the latest timestamped run, and marks ignored names before the three existing callers apply their own policies. Real production-boundary proof is sufficient: The committed Docker-backed Crabbox record fetched a real 26-check GitHub payload, exercised the production report-only finalizer, and observed stale blockers fall from two to zero without enabling dispatch.
Findings	None	None.
Security	None	None.

How this fits together

Repair automation reads GitHub pull-request checks before publishing repair results or deciding whether a repair can progress. The shared rollup now feeds the finalizer, comment router, and post-flight gate while each retains its own blocker policy.

flowchart LR
  A[GitHub check runs] --> B[Shared status-check rollup]
  B --> C[Latest normalized run]
  C --> D[Comment router]
  C --> E[Post-flight gate]
  C --> F[Report-only finalizer]
  F --> G[Published repair queue]

Loading

Before merge

• Resolve merge risk (P1) - A single rollup now affects three repair decisions, so unusual GitHub payload shapes beyond the captured 26-entry real payload could change automation outcomes.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	production +93/-113; tests +202/-1	The refactor removes duplicated selection logic while adding focused regression coverage for identity, timestamps, ignored names, and finalizer behavior.
Affected files	20 files affected	Four repair source files change; most remaining additions are committed proof artifacts rather than runtime code.

Merge-risk options

Maintainer options:

1. Complete the current automation checks (recommended)
   Wait for the active required checks to finish successfully before landing the shared repair-lane decision change.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Wait for required checks to finish successfully and retain the committed real-GitHub report-only finalizer proof.

Technical review

Best possible solution:

Keep one case-normalized rollup as the shared selection owner, preserve the committed production-boundary proof, and land after the current required checks complete.

Do we have a high-confidence way to reproduce the issue?

Yes—source-reproducible with high confidence. Current main retains the raw-check finalizer path, and the committed real-GitHub payload demonstrates the stale-blocker result before the fix and the cleared result after it.

Is this the best way to solve the issue?

Yes. Extracting the already-similar selection rules into one tested helper is the narrowest maintainable repair while preserving each caller's blocker policy.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 2b5b345063ef.

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. A Docker-backed Crabbox run at an unchanged functional-source head fetched a real GitHub check payload and exercised the production report-only finalizer, observing stale blockers fall from two to zero.
• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): A Docker-backed Crabbox run at an unchanged functional-source head fetched a real GitHub check payload and exercised the production report-only finalizer, observing stale blockers fall from two to zero.
• remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🦞 diamond lobster, so this older rating label is no longer current.

Label justifications:

• P2: This is a bounded repair-automation classification bug that can delay or misstate repair finalization but is not a user-facing emergency.
• merge-risk: 🚨 automation: The changed check-selection rule directly influences the repair finalizer, comment router, post-flight behavior, and published repair queue.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): A Docker-backed Crabbox run at an unchanged functional-source head fetched a real GitHub check payload and exercised the production report-only finalizer, observing stale blockers fall from two to zero.
• proof: sufficient: Contributor real behavior proof is sufficient. A Docker-backed Crabbox run at an unchanged functional-source head fetched a real GitHub check payload and exercised the production report-only finalizer, observing stale blockers fall from two to zero.

Evidence

What I checked:

• Current main still has the defect: Current main's finalizer iterates the raw status-check list and does not deduplicate repeated workflow/check identities before creating blockers. (src/repair/finalize-open-prs.ts:296, 2b5b345063ef)
• Shared implementation is narrow and applied to all consumers: The new rollup normalizes workflow/check identities, picks the latest timestamped run, and marks ignored names before the three existing callers apply their own policies. (src/repair/status-check-rollup.ts:8, bd127dbe47c4)
• Real production-boundary proof is sufficient: The committed Docker-backed Crabbox record fetched a real 26-check GitHub payload, exercised the production report-only finalizer, and observed stale blockers fall from two to zero without enabling dispatch. (docs/proof/status-check-rollup/artifacts/crabbox-local-container-stdout.log:15, bd127dbe47c4)
• Proof remains applicable to the current head: No source or repair-test files changed after the functional fix commit through the current PR head; later commits only record proof material. (src/repair/status-check-rollup.ts:8, bd127dbe47c4)
• Feature-history provenance: Blame attributes the shared rollup and its timestamp policy to the functional fix commit; earlier main history includes Peter Steinberger's repair check-policy work and Dwin Gharibi's recent adjacent repair update. (src/repair/status-check-rollup.ts:17, 10d0801364df)
• Not already implemented on main: Neither the PR head nor its functional commit is an ancestor of current main, and current main has no shared rollup implementation. (src/repair/finalize-open-prs.ts:296, 2b5b345063ef)

Likely related people:

• Peter Steinberger: Introduced this shared rollup and authored multiple earlier main-branch changes to repair check handling and finalization behavior. (role: long-running repair-area contributor; confidence: high; commits: 10d0801364df, 60919a0c674d, 5f5138800cc5; files: src/repair/status-check-rollup.ts, src/repair/finalize-open-prs.ts, src/repair/comment-router-utils.ts)
• Dwin Gharibi: Recent main history shows work in the same repair paths, making this a useful secondary routing contact. (role: recent adjacent contributor; confidence: medium; commits: 7a9d33bed755; files: src/repair/comment-router-utils.ts, src/repair/post-flight.ts)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (3 earlier review cycles)

• reviewed 2026-08-10T19:13:23.114Z sha 10d0801 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-10T19:46:20.464Z sha 10d0801 :: needs real behavior proof before merge. :: none
• reviewed 2026-08-10T19:58:20.235Z sha 10d0801 :: needs real behavior proof before merge. :: none

[steipete]

/review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/31425822503
• Updated: 2026-08-10T19:47:40.371Z