draft: coalesce matching exact-review ingress

[brokemac79]

Summary

Rebased and revalidated b8ffe5580b901f37a836f26d8abd2f948a21f557 on current
main (3ecc41e30f9da8aa4dfda1b2561c4883cab68cfd). This preserves both
exact-review ingress routes while allowing the durable queue to collapse one
proven same-event delivery before dispatch.

Peter approved this safe shape and requested a rebase/reverification in
his review.
This PR is ready for maintainer look, not a merge request or gate change.

Problem

For OpenClaw PR #110767,
push a1e94e165a58a0ac86ec30744ddca8499937e3d3 entered the durable control
plane both through the direct
pull_request run
and the legacy
pull_request_target run.
The later lease-deferred run
did not invoke Codex, but still consumed queue, runner, cache, Actions, and
Bay control-plane work.

Closing #703 correctly
preserved the reliability fallback. This patch keeps it; it canonicalizes only
the paired delivery, never a head SHA alone.

Implementation

• Direct pull_request intake and the documented target dispatcher compute
  the same versioned SHA-256 identity from repository, PR number, action, head
  SHA, update timestamp, body, and label.
• The queue records one opaque receipt per route for seven days. It suppresses
  only a matching admitted counterpart on the same resolved target branch.
• A fallback-first item can be promoted only by its matching, live-head-
  verified direct delivery. Delayed counterparts cannot replace a newer
  revision, completed review, or legacy-only update.
• An unadmitted fallback receipt never suppresses verified direct intake.
  Receipt migration preserves pre-schema direct admissions and the supported
  rollback/re-upgrade path; current unadmitted direct receipts use a distinct
  sentinel until queue acceptance.
• Direct source authority retains ingress identity across a transient live-head
  verification retry. Maintainer commands and later body/revision updates are
  not suppressed.

Validation and proof

node --test test/dashboard-worker.test.ts                         # 227/227 pass
node --test --test-name-pattern "target dispatcher documents opt-in cross-route identity|sweep workflow executes only durable queue leases without runner-side admission" test/clawsweeper.test.ts  # 2/2 pass
pnpm run lint:dashboard
pnpm run build:all
pnpm exec oxfmt --check dashboard/exact-review-queue.ts docs/target-dispatcher.md test/clawsweeper.test.ts test/dashboard-worker.test.ts
git diff --check
git diff --cached --check

actionlint is unavailable on this Windows host. The focused workflow/parser
tests passed, and the extracted dispatcher/legacy Bash blocks passed bash -n.

Docker Desktop 29.5.2 / Crabbox local-container proof passed on the committed
worktree: lease cbx_fe569c2c4dcb, image
mcr.microsoft.com/playwright:v1.60.0-noble. It runs the actual Worker with
wrangler dev --local, the Durable Object emulator, and the current extracted
dispatcher/legacy workflow blocks. It proves direct-then-legacy and
legacy-then-direct yield one queue admission; direct-only and legacy-only stay
admissible; a body revision becomes revision 2; a default-branch change does
not cross-route-coalesce; and a maintainer command reaches its expected local
app-credential boundary. It has no production credentials or GitHub mutation.
The container receives a raw synced workspace, so its diagnostic Git HEAD is
empty; the committed source SHA above is the force-pushed PR head.

Codex review closeout:

• codex review --uncommitted: accepted and tested the delayed legacy-only
  identity edge and rollback/re-upgrade receipt migration; final run clean.
• codex review --base origin/main: clean — no actionable bugs against
  3ecc41e30f9da8aa4dfda1b2561c4883cab68cfd.

#674 and terminal behavior

This preserves and credits #674:
it proposed separate per-item generation, live terminal-target checks, and
terminal reconciliation. #674 is closed without merge. This focused ingress
patch deliberately does not reimplement that terminal/reconciliation work or
hide terminal state in Bay; any remaining terminal behavior stays a separate
maintainer decision and follow-up.

Risk and rollout

The .github/workflows/sweep.yml change carries normal GitHub OAuth/workflow
scope risk. The target-dispatcher envelope is opt-in and fails open: absent or
invalid metadata preserves legacy admission. Only a SHA-256 receipt is stored,
not PR content. Roll out the documented dispatcher fields to a target only
after this PR lands and observe paired delivery counts; do not enable a gate,
dispatch Actions manually, or merge automatically.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 26, 2026, 10:55 AM ET / 14:55 UTC.

ClawSweeper review

What this changes

This PR adds a shared SHA-256 ingress identity so matching direct-webhook and target-dispatcher pull-request deliveries collapse to one durable exact-review queue admission while independent updates remain eligible.

Merge readiness

⚠️ Ready for maintainer review - 3 items remain

Keep this PR open for normal maintainer review. The supplied discussion records approved direction to retain both ingress routes while coalescing only proven same-event deliveries, and the branch includes focused runtime proof and clean checks; no discrete patch defect is established from the reviewed evidence.

Priority: P2
Reviewed head: b8ffe5580b901f37a836f26d8abd2f948a21f557

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The PR has strong focused runtime proof and a coherent implementation, while its durable-storage and workflow compatibility boundary still merits normal maintainer review.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (live_output): The PR includes after-fix local Worker and Durable Object runtime output for both route orders and key non-coalescing cases, and the supplied GitHub state marks that proof sufficient.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The PR includes after-fix local Worker and Durable Object runtime output for both route orders and key non-coalescing cases, and the supplied GitHub state marks that proof sufficient.
Evidence reviewed	5 items	Approved product direction: The supplied maintainer comment approves preserving both delivery routes and coalescing proven same-event deliveries at the durable queue through an opaque cross-route identity envelope, with a rebase and admission-path revalidation requested before review. Cross-route queue implementation: The PR adds route-tagged ingress metadata and a durable ingress receipt table so the queue can coalesce only matching direct-webhook and target-dispatcher admissions. Workflow-to-queue contract: The workflow validates a 64-character dispatcher fingerprint and forwards it only for pull-request target-dispatcher payloads; malformed or absent metadata preserves the legacy path.
Findings	None	None.
Security	None	None.

How this fits together

Exact review receives pull-request events through both the direct GitHub webhook and an optional target-repository dispatcher. Both routes feed the Durable Object queue, which authorizes, deduplicates, leases, and later dispatches review work to the sweep workflow.

flowchart LR
  A[Direct GitHub webhook] --> C[Exact-review Worker]
  B[Target dispatcher] --> C
  C --> D[Route-aware ingress identity]
  D --> E[Durable exact-review queue]
  E --> F[Source-authority and live-head checks]
  F --> G[Leased review run]
  G --> H[Review publication]

Loading

Before merge

• Resolve merge risk (P1) - The direct webhook, target-dispatcher documentation, workflow payload, and Durable Object must continue producing the same canonical identity tuple; a future drift could either retain duplicate review work or suppress an intended counterpart.
• Resolve merge risk (P1) - The PR changes durable queue receipt persistence and GitHub workflow ingress. Existing deployments need the documented opt-in dispatcher fields and paired-delivery observation during rollout.
• Complete next step (P2) - No actionable defect was found for an automated repair; the remaining step is maintainer review of the durable queue and workflow compatibility boundary.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch surface	6 files affected; 1,100 added, 7 removed	The change spans the Worker, Durable Object, workflow, dispatcher documentation, and focused tests, so the route contract must be reviewed end-to-end.
Focused runtime coverage	2 test files expanded; 773 test lines added in dashboard-worker coverage	The tests target ordering, retry, fallback, migration, and admission cases around the durable queue boundary.

Merge-risk options

Maintainer options:

1. Merge with staged paired-delivery observation (recommended)
   Accept the approved compatibility design, deploy the documented dispatcher envelope opt-in, and monitor that matching dual-route deliveries produce one queue admission while legacy-only traffic remains admissible.
2. Pause for a contract walkthrough
   Keep the PR open if reviewers need to re-check the canonical identity fields and seven-day receipt migration before accepting the workflow-to-Durable-Object compatibility boundary.

Technical review

Best possible solution:

Merge only after maintainer review confirms the identity tuple remains the single documented contract across both routes, then roll it out opt-in and observe paired delivery counts while preserving legacy-only fallback behavior.

Do we have a high-confidence way to reproduce the issue?

No fresh current-main reproduction was run during this read-only review. The supplied incident identifies the duplicated dual-route delivery path, and the branch's local Worker/Durable Object proof exercises that source-level path in both delivery orders.

Is this the best way to solve the issue?

Yes. The approved design keeps the reliability fallback and coalesces only a matching, versioned identity at the durable queue, which is narrower and safer than disabling one ingress route outright.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 5196f34e7b69.

Labels

Label justifications:

• P2: This is a bounded exact-review automation improvement with real control-plane cost and compatibility implications, but no demonstrated urgent user-facing outage.
• merge-risk: 🚨 compatibility: The new persisted receipt and identity contract must preserve legacy-only delivery, existing receipts, and upgrade/rollback behavior.
• merge-risk: 🚨 automation: The PR changes the GitHub workflow payload that feeds durable exact-review admission and can affect review-run dispatch volume.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR includes after-fix local Worker and Durable Object runtime output for both route orders and key non-coalescing cases, and the supplied GitHub state marks that proof sufficient.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR includes after-fix local Worker and Durable Object runtime output for both route orders and key non-coalescing cases, and the supplied GitHub state marks that proof sufficient.

Evidence

What I checked:

• Approved product direction: The supplied maintainer comment approves preserving both delivery routes and coalescing proven same-event deliveries at the durable queue through an opaque cross-route identity envelope, with a rebase and admission-path revalidation requested before review.
• Cross-route queue implementation: The PR adds route-tagged ingress metadata and a durable ingress receipt table so the queue can coalesce only matching direct-webhook and target-dispatcher admissions. (dashboard/exact-review-queue.ts:93, b8ffe5580b90)
• Workflow-to-queue contract: The workflow validates a 64-character dispatcher fingerprint and forwards it only for pull-request target-dispatcher payloads; malformed or absent metadata preserves the legacy path. (.github/workflows/sweep.yml:271, b8ffe5580b90)
• Current source-authority foundation: The merged stale-review supersession work established the current source-authority and durable queue behavior that this PR extends rather than replaces. (dashboard/worker.ts:1071, 7be64b5dbf7c)
• After-fix runtime proof: The PR body reports a local Worker plus Durable Object runtime run covering both route orders, single-route fallback, body revisions, default-branch separation, and maintainer-command handling; the GitHub context also marks the proof sufficient and all listed checks successful. (test/dashboard-worker.test.ts:15094, b8ffe5580b90)

Likely related people:

• snowzlmbot: Authored the merged source-authority and stale exact-review supersession work that forms the queue behavior this PR extends. (role: recent exact-review queue contributor; confidence: high; commits: 7be64b5dbf7c; files: dashboard/worker.ts, dashboard/exact-review-queue.ts)
• steipete: The supplied PR discussion records direction approval for retaining both ingress routes and coalescing only proven same-event deliveries. (role: product-direction approver; confidence: high; files: .github/workflows/sweep.yml, dashboard/exact-review-queue.ts)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-07-19T14:23:38.510Z sha 1dcd391 :: needs real behavior proof before merge. :: none
• reviewed 2026-07-19T15:05:16.324Z sha 1dcd391 :: needs real behavior proof before merge. :: none
• reviewed 2026-07-19T17:38:21.298Z sha 2f5e742 :: needs maintainer review before merge. :: none
• reviewed 2026-07-19T18:20:01.797Z sha 2f5e742 :: needs maintainer review before merge. :: none
• reviewed 2026-07-26T14:50:42.233Z sha b8ffe55 :: needs maintainer review before merge. :: none

[brokemac79]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The durable review comment was published and its verdict was queued for target-serialized routing.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29698533802
• Updated: 2026-07-19T18:24:32.428Z

[steipete]

Maintainer decision (relayed from @steipete): direction approved. Keep both delivery routes and coalesce proven same-event deliveries at the durable queue via the opaque cross-route identity envelope as proposed. Please proceed out of draft; one coordination note — the queue DO has moved substantially since Jul 19 (state-append window, supersession handling in #749's lane, batch publication), so rebase against current main and re-verify the admission path before requesting review.

[brokemac79]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Review in progress
• Detail: The exact-review queue leased this run; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/30207014035
• Updated: 2026-07-26T14:53:37.876Z