chore(setup): bump gateway LKG to 2026.6.10

[github-actions]

Gateway LKG update

• Previous pinned LKG: 2026.6.9
• Candidate latest: 2026.6.10
• Updated file: src/OpenClaw.SetupEngine/GatewayLkgVersion.cs

This is the standing automation PR used to review and validate gateway LKG bumps before merge.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 26, 2026, 4:38 AM ET / 08:38 UTC.

Summary
The branch changes GatewayLkgVersion.LkgVersion from 2026.6.9 to 2026.6.10 in the setup engine.

Reproducibility: not applicable. this is a maintenance version bump, not a bug report. Source inspection shows exactly how the constant affects setup defaults, and the PR comment provides focused validation for the intended value.

Review metrics: 2 noteworthy metrics.

• Diff scope: 1 file changed, +1/-1. The patch is constrained to the embedded setup LKG constant.
• Default gateway version: 2026.6.9 -> 2026.6.10. This is the runtime-facing setup default maintainers need to validate before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Finish exact-head checks and any maintainer-required WSL setup smoke before undrafting or merging.

Risk before merge

• [P1] Merging changes the default gateway CLI version installed by setup from 2026.6.9 to 2026.6.10; an upstream installer, pairing, wizard, or WSL setup regression would affect new local setup until the LKG is rolled back.
• [P1] The PR is still draft and the visible current-head checks were not fully settled at review time; the PR discussion has focused SetupEngine test validation, but no full AGENTS.md validation or live WSL setup smoke for 2026.6.10 was visible.

Maintainer options:

1. Wait for LKG validation (recommended)
   Keep the draft PR open until exact-head checks and any maintainer-required setup smoke confirm that 2026.6.10 works as the default gateway install version.
2. Accept the routine bump
   Maintainers can merge after intentionally accepting the upstream latest package as the new setup default and deciding that the focused validation comment is sufficient.
3. Pause or roll back the candidate
   If 2026.6.10 fails setup validation, leave this PR paused or replace it with the next known-good gateway version bump.

Next step before merge

• No automated repair is needed; maintainers should decide whether the draft LKG promotion has enough exact-head setup validation to merge.

Security
Cleared: No concrete security or supply-chain regression was found; the diff only advances the official pinned gateway version constant while leaving install URL, workflow permissions, and dependency sources unchanged.

Review details

Best possible solution:

Land the one-line LKG bump only after maintainers accept 2026.6.10 as the new setup default and exact-head validation covers the default install path well enough for this release lane.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a maintenance version bump, not a bug report. Source inspection shows exactly how the constant affects setup defaults, and the PR comment provides focused validation for the intended value.

Is this the best way to solve the issue?

Yes: updating the single documented LKG constant is the narrowest maintainable path for this standing gateway LKG bump. The safer merge path is validation-gated, not a broader code change.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 6c56a83f43a6.

Label changes

Label justifications:

• P3: This is a routine maintenance bump with limited blast radius, not an urgent regression or core runtime outage.
• merge-risk: 🚨 compatibility: The PR changes the default gateway package installed by setup, so installer and pairing/setup-flow compatibility need validation before merge.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable: the author is repository automation for a standing LKG bump; the human validation comment is useful supplemental evidence but the external-contributor proof gate does not apply to this bot PR.

Evidence reviewed

What I checked:

• Current main still uses the previous LKG: Current main at 6c56a83 has LkgVersion = "2026.6.9", so the requested 2026.6.10 bump is not implemented on the default branch. (src/OpenClaw.SetupEngine/GatewayLkgVersion.cs:6, 6c56a83f43a6)
• PR diff is narrowly scoped: The PR head e882de5 changes only the LKG constant from 2026.6.9 to 2026.6.10 in one file. (src/OpenClaw.SetupEngine/GatewayLkgVersion.cs:6, e882de526b6e)
• Setup consumes the pinned version as the default: SetupEngine applies GatewayLkgVersion.ApplyToConfig(config) during CLI setup, and the install step builds the installer command from ctx.Config.Gateway.Version, so this constant changes the default gateway CLI version used by fresh setup when no explicit version is configured. (src/OpenClaw.SetupEngine/Program.cs:51, 6c56a83f43a6)
• Repository documents this standing automation path: Development docs say the pinned gateway setup version lives in GatewayLkgVersion.LkgVersion, setup/E2E consume it when Gateway.Version is unset, and .github/workflows/gateway-lkg-update.yml maintains one standing draft bump PR when upstream latest advances. (DEVELOPMENT.md:541, 6c56a83f43a6)
• Supplemental validation exists but is focused: A PR comment reports local Windows validation for the same one-line change: the focused GatewayLkgVersionTests passed, git diff --check passed, and npm latest resolved to 2026.6.10. (e882de526b6e)
• Current PR state still needs maintainer handling: GitHub reports this PR is draft, mergeable, and unstable, with CodeQL C# still in progress at review time while other visible Socket/CodeQL checks had passed or skipped neutrally. (e882de526b6e)

Likely related people:

• ranjeshj: Prior LKG pinning/updater work and the SetupEngine install path are tied to Ranjesh Jaganathan's commits and the historical LKG PR discussion that this standing bump builds on. (role: introduced behavior and setup area contributor; confidence: high; commits: 45df0763e1ca, dcc77f55e2c9, cefce3952ab1; files: src/OpenClaw.SetupEngine/GatewayLkgVersion.cs, .github/workflows/gateway-lkg-update.yml, src/OpenClaw.SetupEngine/SetupSteps.cs)
• Vincent Koc: Current-main blame for GatewayLkgVersion.cs, SetupSteps.cs, and the updater workflow points to the absorbed stack commit d392f7d. (role: current-main provenance owner; confidence: medium; commits: d392f7d4ea0d; files: src/OpenClaw.SetupEngine/GatewayLkgVersion.cs, .github/workflows/gateway-lkg-update.yml, src/OpenClaw.SetupEngine/SetupSteps.cs)
• github-actions[bot]: The same automation authored the current PR head and prior merged LKG bump commits on the documented automation/gateway-lkg-update path. (role: standing updater automation; confidence: high; commits: e882de526b6e, a8c9699f6082, c56c6da072e9; files: src/OpenClaw.SetupEngine/GatewayLkgVersion.cs)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[TheAngryPit]

Local validation on Windows for this LKG bump:

• Applied the same one-line change locally: GatewayLkgVersion.LkgVersion from 2026.6.9 to 2026.6.10.
• dotnet test tests\OpenClaw.SetupEngine.Tests\OpenClaw.SetupEngine.Tests.csproj --filter FullyQualifiedName~GatewayLkgVersionTests --verbosity minimal -> 3 passed / 0 failed / 0 skipped.
• git diff --check -> passed.
• npm latest check against https://registry.npmjs.org/openclaw/latest -> 2026.6.10, matching the pinned value in this PR.

This confirms the automation PR matches the current npm latest and the SetupEngine LKG application tests still pass locally.