chore(release): prepare v0.14.8

[steipete]

Dates the v0.14.8 changelog for the patch release and adds the missing entry for the merged 30-second release-check HTTP timeout fix. The existing age v1.3.2, dependency/toolchain, and release-dispatch guard entries are retained.

Validation: Codex autoreview passed with no actionable findings. make check, actionlint, and GOWORK=off go test -count=1 ./... passed locally. CI, CodeQL, and secret scanning passed for this PR and the exact main merge commit, 5cdee49.

Release workflow: https://github.com/openclaw/crawlkit/actions/runs/33364490053

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed August 31, 2026, 2:25 AM ET / 06:25 UTC.

ClawSweeper review

What this changes

Dates the v0.14.8 changelog section and records the 30-second default timeout for release checks.

Merge readiness

⛔ Blocked until real behavior proof is added - 3 items remain

Keep open: this is a narrowly scoped release-preparation update that matches the documented v0.14.8 plan and the already-merged timeout fix. The submitted evidence does not yet include completed validation results for the exact change.

Priority: P3
Reviewed head: be26788a18e98550ec3b5392580565db0c59986d

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The changelog patch is focused and source-backed, but its claimed release validation has not yet been shown.
Proof confidence	🦪 silver shellfish (2/6)	Needs real behavior proof before merge: The changed surface is the root changelog rather than a runtime owner; the PR body says release gates are running but supplies no completed after-change validation result. Under the external-PR proof gate, completed redacted terminal output for the stated release checks is still needed. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The changed surface is the root changelog rather than a runtime owner; the PR body says release gates are running but supplies no completed after-change validation result. Under the external-PR proof gate, completed redacted terminal output for the stated release checks is still needed. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	5 items	Scoped PR change: The verified introduced delta changes only the top changelog section: one heading replacement and one timeout bullet. Timeout behavior exists in current source: Release checks create a 30-second HTTP client when callers do not provide one, matching the new changelog entry. Feature provenance: History identifies the merged timeout change as commit 1ae588d, titled "fix(releasecheck): default a 30s HTTP client instead of DefaultClient (#92)".
Findings	None	None.
Security	None	None.

How this fits together

The releasecheck package lets downstream crawler CLIs query GitHub for newer releases without hanging indefinitely. The changelog summarizes merged changes before the unified workflow creates the signed release and Go module version.

flowchart LR
A[Release-preparation commits] --> B[Versioned changelog]
B --> C[Protected main]
C --> D[Unified release workflow]
D --> E[Signed release and Go module]

Loading

Before merge

• Add real behavior proof - Needs real behavior proof before merge: The changed surface is the root changelog rather than a runtime owner; the PR body says release gates are running but supplies no completed after-change validation result. Under the external-PR proof gate, completed redacted terminal output for the stated release checks is still needed. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve merge risk (P1) - The PR body says release gates are running, but no completed validation output for this exact change is included yet.
• Complete next step (P2) - No discrete automated repair is indicated; the remaining action is to provide the claimed release-validation evidence for normal merge review.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Release-note scope	2 added, 1 changed, 0 removed across 1 file	The branch is limited to the version heading and one missing release-note entry.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Keep the concise release note, merge after the stated release gates are green for the exact merge commit, then publish only through the unified workflow.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Keep the concise release note, merge after the stated release gates are green for the exact merge commit, then publish only through the unified workflow.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR changes release documentation rather than reporting a runtime defect, and the referenced timeout behavior is directly present in current source.

Is this the best way to solve the issue?

Yes: a dated changelog section is the narrow maintainable way to prepare the documented next patch release; completed release-gate evidence should accompany it before merge.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against e4d5ceaff9f4.

Labels

Label changes:

• add P3: This is low-risk release documentation preparation with no runtime or API change.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The changed surface is the root changelog rather than a runtime owner; the PR body says release gates are running but supplies no completed after-change validation result. Under the external-PR proof gate, completed redacted terminal output for the stated release checks is still needed. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P3: This is low-risk release documentation preparation with no runtime or API change.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The changed surface is the root changelog rather than a runtime owner; the PR body says release gates are running but supplies no completed after-change validation result. Under the external-PR proof gate, completed redacted terminal output for the stated release checks is still needed. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Scoped PR change: The verified introduced delta changes only the top changelog section: one heading replacement and one timeout bullet. (CHANGELOG.md:3, be26788a18e9)
• Timeout behavior exists in current source: Release checks create a 30-second HTTP client when callers do not provide one, matching the new changelog entry. (releasecheck/releasecheck.go:217, be26788a18e9)
• Feature provenance: History identifies the merged timeout change as commit 1ae588d, titled "fix(releasecheck): default a 30s HTTP client instead of DefaultClient (fix(releasecheck): default a 30s HTTP client instead of DefaultClient #92)". (releasecheck/releasecheck.go:217, 1ae588d4fad5)
• Release plan: The repository publishing guide names v0.14.8 as the next release and says it carries the release-check timeout, dependency/toolchain updates, and dispatch guard. (docs/publishing.md:41, be26788a18e9)
• Release policy: The unified workflow is the repository release entrypoint; it runs a preflight then delegates signed publication to the shared release workflow. (.github/workflows/release-unified.yml:1, be26788a18e9)

Likely related people:

• Sebastien Tardif: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Post redacted completed output for the stated release gates on this exact head; updating the PR body should trigger a fresh review, or a maintainer can request one with @clawsweeper re-review.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.