fix(review): bind exact reviews to the leased PR head

.github/workflows/sweep.yml

@@ -857,7 +857,12 @@ jobs:
             ${{ steps.target.outputs.target_repo_name }}-git-${{ runner.os }}-
 
       - name: Check out target repository
+        id: checkout-target
         if: ${{ steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.live-item.outputs.proceed == 'true' }}
+        env:
+          ITEM_KIND: ${{ steps.live-item.outputs.item_kind }}
+          ITEM_NUMBER: ${{ steps.target.outputs.item_number }}
+          SOURCE_HEAD_SHA: ${{ fromJSON(steps.claim-exact-review-queue.outputs.decision).sourceHeadSha || '' }}
         run: |
           set -euo pipefail
           url="https://github.com/${{ steps.target.outputs.target_repo }}.git"
@@ -887,10 +892,23 @@ jobs:
             git clone --bare --filter=blob:none --single-branch --branch "$target_branch" "$url" "$cache_dir"
             git clone --filter=blob:none --branch "$target_branch" --single-branch "$url" "$checkout_dir"
           fi
-          git -C "$checkout_dir" rev-parse --short HEAD
+          pnpm run --silent repair:exact-review-source -- \
+            --target-dir "$checkout_dir" \
+            --item-kind "$ITEM_KIND" \
+            --item-number "$ITEM_NUMBER" \
+            --base-branch "$target_branch" \
+            --source-head-sha "$SOURCE_HEAD_SHA"
+
+      - name: Requeue exact review after source drift
+        if: ${{ steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.checkout-target.outputs.source_drift == 'true' }}
+        run: echo "::notice::The leased PR source moved before review; this run is a successful no-op and the durable queue will review the latest head."
+
+      - name: Materialize Codex source for OpenClaw review
+        if: ${{ steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.live-item.outputs.proceed == 'true' && steps.checkout-target.outputs.source_drift != 'true' && steps.target.outputs.target_repo == 'openclaw/openclaw' }}
+        run: git clone --filter=blob:none --depth=1 https://github.com/openai/codex.git codex
 
       - name: Mark re-review command in progress
-        if: ${{ steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.live-item.outputs.proceed == 'true' }}
+        if: ${{ steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.live-item.outputs.proceed == 'true' && steps.checkout-target.outputs.source_drift != 'true' }}
         continue-on-error: true
         env:
           GH_TOKEN: ${{ steps.target-write-token.outputs.token }}
@@ -911,19 +929,19 @@ jobs:
             --wait-ms 120000
 
       - uses: ./.github/actions/setup-codex
-        if: ${{ env.CLAWSWEEPER_RUNNER != 'openclaw' && steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.live-item.outputs.proceed == 'true' }}
+        if: ${{ env.CLAWSWEEPER_RUNNER != 'openclaw' && steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.live-item.outputs.proceed == 'true' && steps.checkout-target.outputs.source_drift != 'true' }}
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           CLAWSWEEPER_INTERNAL_MODEL: ${{ secrets.CLAWSWEEPER_MODEL }}
         with:
           login-status: "true"
 
       - uses: ./.github/actions/setup-openclaw
-        if: ${{ steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.live-item.outputs.proceed == 'true' }}
+        if: ${{ steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.live-item.outputs.proceed == 'true' && steps.checkout-target.outputs.source_drift != 'true' }}
 
       - name: Reserve exact review lease
         id: reserve-exact-review-lease
-        if: ${{ steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.live-item.outputs.proceed == 'true' }}
+        if: ${{ steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.live-item.outputs.proceed == 'true' && steps.checkout-target.outputs.source_drift != 'true' }}
         env:
           GH_TOKEN: ${{ steps.target-write-token.outputs.token }}
           TARGET_REPO: ${{ steps.target.outputs.target_repo }}
@@ -1028,7 +1046,7 @@ jobs:
 
       - name: Review exact event item
         id: review-exact-event-item
-        if: ${{ steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.live-item.outputs.proceed == 'true' && steps.reserve-exact-review-lease.outputs.status == 'posted' }}
+        if: ${{ steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.live-item.outputs.proceed == 'true' && steps.checkout-target.outputs.source_drift != 'true' && steps.reserve-exact-review-lease.outputs.status == 'posted' }}
         continue-on-error: true
         env:
           GH_TOKEN: ${{ steps.target-read-token.outputs.token }}
@@ -1232,7 +1250,7 @@ jobs:
           fi
 
       - name: Finalize exact event action ledger
-        if: ${{ always() && steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.live-item.outputs.proceed == 'true' }}
+        if: ${{ always() && steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.live-item.outputs.proceed == 'true' && steps.checkout-target.outputs.source_drift != 'true' }}
         continue-on-error: true
         env:
           REVIEW_EXIT_CODE: ${{ steps.review-exact-event-item.outputs.exit_code || '' }}
@@ -1251,7 +1269,7 @@ jobs:
 
       - name: Create exact review artifact bundle
         id: create-exact-review-bundle
-        if: ${{ always() && steps.claim-exact-review-queue.outputs.claimed == 'true' && !cancelled() && steps.target.outputs.target_enabled == 'true' && steps.live-item.outcome == 'success' && steps.live-item.outputs.admission_retry != 'true' && steps.setup-pnpm.outcome == 'success' && steps.review-exact-event-item.outputs.superseded != 'true' && (steps.live-item.outputs.proceed != 'true' || (steps.review-exact-event-item.outcome == 'success' && steps.review-exact-event-item.outputs.retry_at == '')) }}
+        if: ${{ always() && steps.claim-exact-review-queue.outputs.claimed == 'true' && !cancelled() && steps.target.outputs.target_enabled == 'true' && steps.live-item.outcome == 'success' && steps.live-item.outputs.admission_retry != 'true' && steps.setup-pnpm.outcome == 'success' && steps.checkout-target.outputs.source_drift != 'true' && steps.review-exact-event-item.outputs.superseded != 'true' && (steps.live-item.outputs.proceed != 'true' || (steps.review-exact-event-item.outcome == 'success' && steps.review-exact-event-item.outputs.retry_at == '')) }}
         env:
           EXACT_REVIEW_ACTION_LEDGER_ROOT: ${{ env.CLAWSWEEPER_ACTION_LEDGER_OUTPUT_ROOT }}
           EXACT_REVIEW_BUNDLE_DIR: .artifacts/exact-review-bundle
@@ -1431,7 +1449,7 @@ jobs:
           exit 1
 
       - name: Release unsuccessful workflow-owned review lease
-        if: ${{ always() && steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.live-item.outputs.proceed == 'true' && steps.reserve-exact-review-lease.outputs.status != 'held' && steps.direct-exact-review-publication.outputs.accepted != 'true' && steps.queue-exact-review-publication.outcome != 'success' }}
+        if: ${{ always() && steps.claim-exact-review-queue.outputs.claimed == 'true' && steps.live-item.outputs.proceed == 'true' && steps.checkout-target.outputs.source_drift != 'true' && steps.reserve-exact-review-lease.outputs.status != 'held' && steps.direct-exact-review-publication.outputs.accepted != 'true' && steps.queue-exact-review-publication.outcome != 'success' }}
         env:
           GH_TOKEN: ${{ steps.target-write-token.outputs.token }}
           TARGET_REPO: ${{ steps.target.outputs.target_repo }}
@@ -1471,13 +1489,17 @@ jobs:
           RUN_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
           REVIEW_OUTCOME: ${{ steps.review-exact-event-item.outcome }}
           REVIEW_SUPERSEDED: ${{ steps.review-exact-event-item.outputs.superseded || 'false' }}
+          SOURCE_DRIFT: ${{ steps.checkout-target.outputs.source_drift || 'false' }}
           RESERVATION_STATUS: ${{ steps.reserve-exact-review-lease.outputs.status }}
           RETRY_AT: ${{ steps.reserve-exact-review-lease.outputs.retry_at || steps.review-exact-event-item.outputs.retry_at }}
           CLAWSWEEPER_ACTION_LEDGER_DISABLED: "1"
         run: |
           state="Failed"
           detail="The exact review did not produce a publishable artifact. The durable queue will retry it."
-          if [ "$RESERVATION_STATUS" = "superseded" ] || [ "$REVIEW_SUPERSEDED" = "true" ]; then
+          if [ "$SOURCE_DRIFT" = "true" ]; then
+            state="Waiting"
+            detail="The pull request head moved before review. The durable queue will review the latest source."
+          elif [ "$RESERVATION_STATUS" = "superseded" ] || [ "$REVIEW_SUPERSEDED" = "true" ]; then
             state="Waiting"
             detail="A newer exact-review queue owner superseded this run. This run completed as a no-op."
           elif [ "$RESERVATION_STATUS" = "held" ]; then
@@ -1505,13 +1527,17 @@ jobs:
           LIVE_OUTCOME: ${{ steps.live-item.outcome }}
           REVIEW_OUTCOME: ${{ steps.review-exact-event-item.outcome }}
           REVIEW_SUPERSEDED: ${{ steps.review-exact-event-item.outputs.superseded || 'false' }}
+          SOURCE_DRIFT: ${{ steps.checkout-target.outputs.source_drift || 'false' }}
           RESERVATION_STATUS: ${{ steps.reserve-exact-review-lease.outputs.status }}
           PUBLICATION_QUEUE_OUTCOME: ${{ steps.queue-exact-review-publication.outcome }}
           DIRECT_PUBLICATION_ACCEPTED: ${{ steps.direct-exact-review-publication.outputs.accepted }}
         run: |
           outcome=failure
           requeue_latest=false
-          if [ "$ADMISSION_RETRY" = "true" ]; then
+          if [ "$SOURCE_DRIFT" = "true" ]; then
+            outcome=success
+            requeue_latest=true
+          elif [ "$ADMISSION_RETRY" = "true" ]; then
             outcome=success
             requeue_latest=true
           elif [ "$TARGET_ENABLED" = "false" ]; then
@@ -3290,6 +3316,10 @@ jobs:
           fi
           git -C "$checkout_dir" rev-parse --short HEAD
 
+      - name: Materialize Codex source for OpenClaw review
+        if: ${{ needs.plan.outputs.target_repo == 'openclaw/openclaw' }}
+        run: git clone --filter=blob:none --depth=1 https://github.com/openai/codex.git codex
+
       - name: Mark shard start
         id: shard-start
         run: echo "started_at=$(date -u '+%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_OUTPUT"

CHANGELOG.md

@@ -18,6 +18,7 @@ checkpoint, and status-only commits are intentionally omitted.
 
 ### Changed
 
+- Exact pull-request reviews now materialize and verify the leased head with complete merge-base ancestry through a tested TypeScript guard, requeue moved heads without running review or lease cleanup, and materialize sibling Codex source for OpenClaw contract review.
 - Event-review artifact publication completes as a superseded no-op when the reviewed branch vanished upstream (force-push or deletion) instead of failing the run.
 - Worker record requests now retry transient blank/invalid 2xx bodies from the edge within the bounded budget instead of failing hydration on the first occurrence.
 - Exact reviews of items that closed after enqueue now complete as superseded no-ops, and GitHub-throttled reservations defer as held retries — neither spends the item's review-failure budget.

package.json

@@ -62,6 +62,7 @@
     "repair:spam-comment-intake": "node dist/repair/spam-comment-intake.js",
     "repair:spam-scan": "node dist/repair/spam-scanner.js",
     "repair:exact-review-bundle": "node dist/repair/exact-review-bundle-cli.js",
+    "repair:exact-review-source": "node dist/repair/exact-review-source-cli.js",
     "repair:exact-review-queue-maintenance": "node dist/repair/exact-review-queue-maintenance.js",
     "repair:scheduled-review-enqueue": "node dist/repair/scheduled-review-enqueue.js",
     "repair:exact-review-dead-letters": "node scripts/exact-review-dead-letter-operator.mjs",

src/repair/exact-review-source-cli.ts

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+
+import { materializeExactReviewSource } from "./exact-review-source.js";
+
+const args = parseArgs(process.argv.slice(2));
+const kind = itemKind(required(args.itemKind, "--item-kind"));
+const result = materializeExactReviewSource({
+  targetDir: required(args.targetDir, "--target-dir"),
+  itemKind: kind,
+  itemNumber: positiveInteger(required(args.itemNumber, "--item-number"), "--item-number"),
+  ...(kind === "pull_request" ? { baseBranch: required(args.baseBranch, "--base-branch") } : {}),
+  ...(args.sourceHeadSha ? { sourceHeadSha: args.sourceHeadSha } : {}),
+});
+
+writeOutput("status", result.status);
+writeOutput("source_drift", result.status === "source_drift" ? "true" : "false");
+if (result.status === "source_drift") {
+  writeOutput("fetched_head_sha", result.fetchedHeadSha);
+  console.error(
+    `Fetched PR head ${result.fetchedHeadSha} moved past leased source head ${result.leasedHeadSha}; skipping review so the durable queue can requeue the latest source.`,
+  );
+} else {
+  writeOutput("materialized_head_sha", result.headSha);
+  console.log(result.headSha.slice(0, 12));
+}
+
+function parseArgs(argv: readonly string[]) {
+  const parsed: {
+    targetDir?: string;
+    itemKind?: string;
+    itemNumber?: string;
+    baseBranch?: string;
+    sourceHeadSha?: string;
+  } = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const flag = argv[index];
+    const value = argv[index + 1];
+    if (value === undefined || (flag !== "--source-head-sha" && value.startsWith("--"))) {
+      throw new Error(`${flag} requires a value`);
+    }
+    if (flag === "--target-dir") parsed.targetDir = value;
+    else if (flag === "--item-kind") parsed.itemKind = value;
+    else if (flag === "--item-number") parsed.itemNumber = value;
+    else if (flag === "--base-branch") parsed.baseBranch = value;
+    else if (flag === "--source-head-sha") parsed.sourceHeadSha = value;
+    else throw new Error(`unknown argument: ${flag}`);
+    index += 1;
+  }
+  return parsed;
+}
+
+function required(value: string | undefined, flag: string): string {
+  if (!value) throw new Error(`${flag} is required`);
+  return value;
+}
+
+function itemKind(value: string): "issue" | "pull_request" {
+  if (value === "issue" || value === "pull_request") return value;
+  throw new Error("--item-kind must be issue or pull_request");
+}
+
+function positiveInteger(value: string, flag: string): number {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 1) {
+    throw new Error(`${flag} must be a positive integer`);
+  }
+  return parsed;
+}
+
+function writeOutput(name: string, value: string): void {
+  const outputPath = process.env.GITHUB_OUTPUT;
+  if (outputPath) fs.appendFileSync(outputPath, `${name}=${value}\n`, "utf8");
+  else console.log(`${name}=${value}`);
+}

src/repair/exact-review-source.ts

@@ -0,0 +1,67 @@
+import { currentHead, ensureMergeBaseAvailable } from "./git-repo-utils.js";
+import { runCommand as run } from "./command-runner.js";
+
+const gitNetworkTimeoutMs = Math.max(
+  30_000,
+  Number(
+    process.env.CLAWSWEEPER_GIT_NETWORK_TIMEOUT_MS ??
+      process.env.CLAWSWEEPER_NETWORK_COMMAND_TIMEOUT_MS ??
+      5 * 60 * 1000,
+  ),
+);
+
+export type ExactReviewSourceResult =
+  | { status: "ready"; headSha: string }
+  | { status: "source_drift"; leasedHeadSha: string; fetchedHeadSha: string };
+
+export function materializeExactReviewSource(options: {
+  targetDir: string;
+  itemKind: "issue" | "pull_request";
+  itemNumber: number;
+  baseBranch?: string;
+  sourceHeadSha?: string;
+}): ExactReviewSourceResult {
+  if (!Number.isSafeInteger(options.itemNumber) || options.itemNumber < 1) {
+    throw new Error("itemNumber must be a positive integer");
+  }
+  if (options.itemKind === "issue") {
+    return { status: "ready", headSha: currentHead(options.targetDir) };
+  }
+
+  const leasedHeadSha = String(options.sourceHeadSha ?? "")
+    .trim()
+    .toLowerCase();
+  if (!/^[0-9a-f]{40}$/.test(leasedHeadSha)) {
+    throw new Error("Exact PR review requires a valid leased source head SHA");
+  }
+  const baseBranch = String(options.baseBranch ?? "").trim();
+  if (!baseBranch) {
+    throw new Error("Exact PR review requires its base branch");
+  }
+
+  run("git", ["fetch", "--force", "origin", `refs/pull/${options.itemNumber}/head`], {
+    cwd: options.targetDir,
+    timeoutMs: gitNetworkTimeoutMs,
+  });
+  const fetchedHeadSha = run("git", ["rev-parse", "FETCH_HEAD"], {
+    cwd: options.targetDir,
+  })
+    .trim()
+    .toLowerCase();
+  if (!/^[0-9a-f]{40}$/.test(fetchedHeadSha)) {
+    throw new Error(`Fetched PR head is not a full commit SHA: ${fetchedHeadSha || "empty"}`);
+  }
+  if (fetchedHeadSha !== leasedHeadSha) {
+    return { status: "source_drift", leasedHeadSha, fetchedHeadSha };
+  }
+
+  run("git", ["checkout", "--detach", leasedHeadSha], { cwd: options.targetDir });
+  const headSha = currentHead(options.targetDir).toLowerCase();
+  if (headSha !== leasedHeadSha) {
+    throw new Error(
+      `Target checkout head ${headSha || "empty"} does not match leased source head ${leasedHeadSha}`,
+    );
+  }
+  ensureMergeBaseAvailable({ targetDir: options.targetDir, baseBranch });
+  return { status: "ready", headSha };
+}