fix: accept GitHub release verifier workflow paths

[steipete]

The Homebrew handoff rejected the successful published 0.3.5 verifier because GitHub's REST API returns .github/workflows/release.yml, while the helper required .github/workflows/release.yml@main.

Accept the bare path and the existing default-branch-qualified form. Keep independent exact checks for branch, source commit, dispatch event, run title, successful completion, publication/asset freshness, and both native architecture jobs. Regression cases accept both valid forms and reject another workflow, qualifier, branch, or commit. Release notes are in #82, which lands last.

Validation: the original helper rejects actual v0.3.5 metadata; the repaired helper accepts https://github.com/openclaw/remindctl/actions/runs/34072035754. Read-only proof used a bounded one-page JSON adapter; no release or tap mutation occurred. ShellCheck, the full credential-free release harness under macOS /bin/bash, and P2 branch autoreview passed. CI: https://github.com/openclaw/remindctl/actions/runs/34104905184.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[steipete]

Verified head 1e7b9205d345ca04dc60e1a0ed9aaa8abbd7e0b8:

• The original require-published-verifier.sh v0.3.5 fails with no exact successful published verifier run found against actual published release metadata.
• The repaired helper passes against the same live release and identifies successful published verifier run https://github.com/openclaw/remindctl/actions/runs/34072035754. The read-only adapter limits each API request to one page, rejects incomplete result sets, and preserves the JSON shape. No tap or release mutation was performed.
• shellcheck -x scripts/*.sh passed.
• The full credential-free release harness passed with /bin/bash, including valid bare/qualified paths, wrong workflow/qualifier/branch/commit rejection, missing Intel rejection, and stale/equal asset timestamp rejection.
• P2 autoreview of the committed branch against origin/main is clean.

Host note: Homebrew Bash 5.3.15 stalled in heredoc_write/write even with a fresh private TMPDIR. Running the unchanged harness under macOS /bin/bash resolved it. Release notes are in #82; land that PR last.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 7, 2026, 5:20 AM ET / 09:20 UTC.

ClawSweeper review

What this changes

Accepts GitHub’s bare release-workflow path alongside the existing qualified form, adds acceptance and rejection coverage, and documents the verifier contract.

Merge readiness

✅ Ready for maintainer review

The fix remains necessary: both inspected main and v0.3.5 reject the bare workflow path. The patch is focused, preserves the independent verification gates, and has no actionable correctness findings.

Priority: P2
Reviewed head: 1e7b9205d345ca04dc60e1a0ed9aaa8abbd7e0b8

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused repair with appropriate acceptance and rejection coverage, reported real-metadata validation, and no identified blocking defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: The ordinary contributor-proof gate is exempt for this collaborator-authored PR. The supplied exact-head comment nevertheless records the production verifier rejecting then accepting actual v0.3.5 metadata through a read-only adapter; independent retrieval was unavailable. No material change to principal authority requires additional final-effect proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The ordinary contributor-proof gate is exempt for this collaborator-authored PR. The supplied exact-head comment nevertheless records the production verifier rejecting then accepting actual v0.3.5 metadata through a read-only adapter; independent retrieval was unavailable. No material change to principal authority requires additional final-effect proof.
Evidence reviewed	8 items	Current main still rejects bare paths: The fetched main revision requires the workflow path qualified with the default branch; it does not accept the bare path described in the report. Latest release retains the same restriction: The v0.3.5 source also requires the qualified workflow path, so the latest supplied release does not contain this repair. Narrow acceptance change preserves verification: The introduced allowlist accepts exactly two workflow-path representations. Dispatch event, exact source SHA, main branch, title, completion, success, freshness, and both native-job checks remain required.
Findings	None	None.
Security	None	None.

How this fits together

The release verifier checks GitHub release metadata and native verification jobs before the Homebrew handoff can proceed. Its result gates the formula update alongside separate artifact and source checks.

flowchart TD
  A[Published release metadata] --> C[Check workflow identity and freshness]
  B[GitHub workflow runs] --> C
  C --> D[Require both native jobs]
  D --> E[Repeat release and artifact checks]
  E --> F[Update Homebrew formula]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	Production +7/-2; tests +23/-9; docs +2/-0	The small production increase directly supports the documented API representation, with focused regression coverage.

Technical review

Best possible solution:

Retain the two exact accepted path forms while keeping source, branch, freshness, and native verification mandatory before the Homebrew update.

Do we have a high-confidence way to reproduce the issue?

Yes: supplying an otherwise valid workflow run with the bare path deterministically fails main’s equality check. The collaborator also reports this failure against actual v0.3.5 metadata; this review did not execute the helper.

Is this the best way to solve the issue?

Yes: accepting the two exact representations fixes the mismatch without relaxing the independent identity and freshness checks or introducing a competing verification path.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against b366b1449e63.

Labels

Label changes:

• add P2: Repairs a concrete release-operator Homebrew handoff failure with a narrow scope.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The ordinary contributor-proof gate is exempt for this collaborator-authored PR. The supplied exact-head comment nevertheless records the production verifier rejecting then accepting actual v0.3.5 metadata through a read-only adapter; independent retrieval was unavailable. No material change to principal authority requires additional final-effect proof.

Label justifications:

• P2: Repairs a concrete release-operator Homebrew handoff failure with a narrow scope.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The ordinary contributor-proof gate is exempt for this collaborator-authored PR. The supplied exact-head comment nevertheless records the production verifier rejecting then accepting actual v0.3.5 metadata through a read-only adapter; independent retrieval was unavailable. No material change to principal authority requires additional final-effect proof.

Evidence

What I checked:

• Current main still rejects bare paths: The fetched main revision requires the workflow path qualified with the default branch; it does not accept the bare path described in the report. (scripts/require-published-verifier.sh:93, b366b1449e63)
• Latest release retains the same restriction: The v0.3.5 source also requires the qualified workflow path, so the latest supplied release does not contain this repair. (scripts/require-published-verifier.sh:93, e7fad8c848a3)
• Narrow acceptance change preserves verification: The introduced allowlist accepts exactly two workflow-path representations. Dispatch event, exact source SHA, main branch, title, completion, success, freshness, and both native-job checks remain required. (scripts/require-published-verifier.sh:95, 1e7b9205d345)
• Focused regression coverage: The harness accepts bare and qualified paths and rejects another workflow, another qualifier, another branch, and another commit; existing native-job and freshness rejection cases remain. Tests were inspected, not executed during this read-only review. (scripts/test-release.sh:580, 1e7b9205d345)
• Final side-effect boundary: The Homebrew helper invokes the verifier during initial validation and again before its sole formula mutation, alongside artifact and metadata comparisons. The patch does not change credentials, principals, workflow permissions, or these rechecks. (scripts/update-homebrew.sh:90, 1e7b9205d345)
• Reported real metadata validation: The captured collaborator comment identifies the exact reviewed head and reports original-helper rejection followed by repaired-helper acceptance of actual v0.3.5 metadata and https://github.com/openclaw/remindctl/actions/runs/34072035754 through a bounded read-only adapter. It also reports ShellCheck and the macOS Bash release harness passing. Source: fix: accept GitHub release verifier workflow paths #81 (comment). Independent GitHub retrieval failed because the API was unreachable; browser retrieval also failed. These are reviewer limitations, not missing contributor evidence. (1e7b9205d345)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.