chore(setup): bump gateway LKG to 2026.6.5

[github-actions]

Gateway LKG update

• Previous pinned LKG: 2026.6.1
• Candidate latest: 2026.6.5
• Updated file: src/OpenClaw.SetupEngine/GatewayLkgVersion.cs

This is the standing automation PR used to review and validate gateway LKG bumps before merge.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 10, 2026, 4:48 AM ET / 08:48 UTC.

Summary
This PR updates the setup engine's default gateway LKG constant from 2026.6.1 to 2026.6.5.

Reproducibility: not applicable. this is a version-only automation PR, not a bug report. Source inspection verifies the default setup pin changes only through the LKG constant.

Review metrics: 2 noteworthy metrics.

• Diff size: 1 file modified; 1 insertion, 1 deletion. The patch is limited to the embedded gateway LKG version constant.
• Default gateway target: 2026.6.1 -> 2026.6.5. This is the only behavior change and it affects the package setup installs by default.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Run or link the Windows/WSL gateway setup smoke for openclaw 2026.6.5 before undrafting or merging.

Risk before merge

• [P1] Merging changes the default package installed by setup from openclaw 2026.6.1 to 2026.6.5 for fresh/default installs, so maintainers should validate the Windows/WSL setup path before undrafting or merging.
• [P1] I did not run the repository Windows build/tests or a live setup smoke in this read-only review, so runtime compatibility of the new gateway package remains the main merge uncertainty.

Maintainer options:

1. Validate the candidate setup path (recommended)
   Run the required build/tests plus a Windows/WSL setup install smoke that exercises the default 2026.6.5 gateway install before undrafting or merging.
2. Accept the version-only bump
   Maintainers can intentionally merge after normal CI if they accept npm-latest compatibility risk for the next setup default.
3. Keep the standing draft open
   If 2026.6.5 has unresolved gateway regressions, leave this draft open until the automation refreshes it to a later candidate.

Next step before merge

• [P2] No code repair is indicated; maintainers should validate, undraft, and merge this standing LKG bump only if the 2026.6.5 setup smoke is acceptable.

Security
Cleared: No concrete security regression was found: the diff only changes the pinned package version, npm latest for openclaw resolves to 2026.6.5 with integrity/provenance metadata, and no workflow, secret, permission, or installer URL surface changes are included.

Review details

Best possible solution:

Merge the version-only bump after the required repo validation and a setup install smoke show 2026.6.5 works as the default; otherwise leave the standing draft for the next LKG refresh.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a version-only automation PR, not a bug report. Source inspection verifies the default setup pin changes only through the LKG constant.

Is this the best way to solve the issue?

Yes, conditionally; updating the single documented LKG constant is the narrowest maintainable path for this standing automation. The remaining question is validation of the external gateway package before merge, not a different code approach.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 0e61fa287afb.

Label changes

Label changes:

• add P3: This is a low-risk standing setup maintenance bump, not an urgent regression or user-reported outage.
• add merge-risk: 🚨 compatibility: Changing the default gateway package can break fresh/default setup if the new npm release is incompatible with the Windows setup path.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a repository automation bot draft PR, so the external-contributor real-behavior-proof gate does not apply; maintainer setup validation is still the merge gate.

Label justifications:

• P3: This is a low-risk standing setup maintenance bump, not an urgent regression or user-reported outage.
• merge-risk: 🚨 compatibility: Changing the default gateway package can break fresh/default setup if the new npm release is incompatible with the Windows setup path.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a repository automation bot draft PR, so the external-contributor real-behavior-proof gate does not apply; maintainer setup validation is still the merge gate.

Evidence reviewed

Acceptance criteria:

• [P1] ./build.ps1.
• [P1] dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore.
• [P1] dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore.
• [P1] dotnet test ./tests/OpenClaw.SetupEngine.Tests/OpenClaw.SetupEngine.Tests.csproj --no-restore.
• [P1] Run a Windows/WSL setup install smoke using the default gateway version and confirm openclaw --version reports 2026.6.5.

What I checked:

• Current main pin: Current main still has GatewayLkgVersion.LkgVersion set to 2026.6.1, so the requested 2026.6.5 bump is not already implemented on main. (src/OpenClaw.SetupEngine/GatewayLkgVersion.cs:6, 0e61fa287afb)
• PR head pin: The PR head changes only the same LkgVersion constant to 2026.6.5. (src/OpenClaw.SetupEngine/GatewayLkgVersion.cs:6, 0ee5f617a5cb)
• Documented LKG workflow: DEVELOPMENT.md documents this constant as the pinned setup version and describes the standing draft PR workflow for bumping it when npm latest advances. (DEVELOPMENT.md:541, 0e61fa287afb)
• Automation source: The gateway-lkg-update workflow resolves npm latest, rewrites only GatewayLkgVersion.cs, and creates or updates a standing draft PR with the previous and candidate versions. (.github/workflows/gateway-lkg-update.yml:27, 0e61fa287afb)
• Setup consumption path: SetupEngine applies the embedded LKG to config when no explicit gateway version is set, and InstallCliStep passes that version to the HTTPS install script. (src/OpenClaw.SetupEngine/SetupSteps.cs:1101, 0e61fa287afb)
• Focused unit coverage: Existing tests verify ResolveLkgVersion and ApplyToConfig use the embedded constant, so this version-only diff should not require test rewrites. (tests/OpenClaw.SetupEngine.Tests/GatewayLkgVersionTests.cs:6, 0e61fa287afb)

Likely related people:

• Ranjesh Jaganathan: Introduced the gateway LKG pinning workflow and later hardened updater validation around GatewayLkgVersion and the related workflow/tests. (role: feature owner; confidence: high; commits: 45df0763e1ca, dcc77f55e2c9; files: src/OpenClaw.SetupEngine/GatewayLkgVersion.cs, .github/workflows/gateway-lkg-update.yml, tests/OpenClaw.SetupEngine.Tests/GatewayLkgVersionTests.cs)
• github-actions[bot]: The current main LKG line was last changed by the standing gateway LKG automation from the same automated update path. (role: recent automation actor; confidence: medium; commits: 0769ca0ea1e3, 0ee5f617a5cb; files: src/OpenClaw.SetupEngine/GatewayLkgVersion.cs)
• Christine Yan: The current file history/blame shows the surrounding GatewayLkgVersion implementation in the release/import commit that contains most of the setup engine source. (role: adjacent setup contributor; confidence: medium; commits: 85445c78066b; files: src/OpenClaw.SetupEngine/GatewayLkgVersion.cs, src/OpenClaw.SetupEngine/Program.cs, src/OpenClaw.SetupEngine/SetupSteps.cs)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.