chore(setup): bump gateway LKG to 2026.7.1-2

[github-actions]

Gateway LKG update

• Previous pinned LKG: 2026.6.11
• Candidate latest: 2026.7.1-2
• Updated file: src/OpenClaw.SetupEngine/GatewayLkgVersion.cs

This is the standing automation PR used to review and validate gateway LKG bumps before merge.

[clawsweeper]

Codex review: found issues before merge. Reviewed August 8, 2026, 10:23 AM ET / 14:23 UTC.

ClawSweeper review

What this changes

The PR changes Easy Setup’s default Gateway version from 2026.6.11 to 2026.7.1-2 when no version is explicitly configured.

Merge readiness

⛔ Blocked by patch quality or review findings - 9 items remain

This PR must not land: current main replaced the direct LKG constant with a validated release policy that explicitly rejects 2026.7.1-2, and the active collaborator hold remains. A release owner should close this draft unless sponsoring a new policy-based promotion.

Priority: P1
Reviewed head: 0944998c8b2f97060d563810ed3537f565df5f77
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	PR readiness rating was derived from proof quality, review findings, security review, and reviewer confidence.
Proof confidence	🌊 off-meta tidepool	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🧂 unranked krab (1/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Evidence reviewed	7 items	Current policy rejects the proposed version: Current main records 2026.7.1-2 as an evidence-rejected release, while 2026.6.34 is the validated recommendation. Current regression coverage: The policy tests assert that resolving the exact evidence-rejected version throws an unattested-release error containing the provenance failure. Maintainer-approved release policy: The accepted ADR requires exact Windows setup, pairing, restart/reconnect, recovery, and Gateway-to-node proof before promotion, and states that 2026.7.1-2 lacks SLSA provenance and stable release-validation evidence.
Findings	1 actionable finding	[P1] Keep rejected Gateway 2026.7.1-2 out of the default pin
Security	Needs attention	Do not install an evidence-rejected Gateway package: The proposed default selects 2026.7.1-2 even though current policy records missing SLSA provenance and stable release-validation evidence, weakening the setup supply-chain gate.

How this fits together

Easy Setup selects a Gateway package before installing an app-owned WSL Gateway and pairing the tray operator and Windows node. Configuration flows through the embedded release policy, which either selects a validated version or stops setup before installation.

flowchart LR
  A[Setup configuration] --> B[Gateway release policy]
  B --> C{Validated release?}
  C -->|Yes| D[WSL Gateway installation]
  D --> E[Health, pairing, and recovery]
  C -->|No| F[Configuration error]
  E --> G[Connected Windows node]

Loading

Decision needed

Question	Recommendation
Should the release owner close this rejected 2026.7.1-2 automation draft, or sponsor a fresh policy-based promotion for a later Gateway candidate?	Close the rejected draft: Retain current main’s validated 2026.6.34 recommendation and close this branch because 2026.7.1-2 is rejected by policy.

Why: The explicit collaborator hold and current policy both prohibit automatic release selection; only a release owner can accept the required compatibility and supply-chain evidence.

Before merge

• Keep rejected Gateway 2026.7.1-2 out of the default pin (P1) - Current main specifically marks this release rejected for missing provenance and stable validation evidence, and its focused policy test rejects the exact version. Promoting it through the obsolete direct pin would bypass that gate and default fresh setup to a candidate whose supplied acceptance run failed during wizard restart.
• Resolve security concern: Do not install an evidence-rejected Gateway package - The proposed default selects 2026.7.1-2 even though current policy records missing SLSA provenance and stable release-validation evidence, weakening the setup supply-chain gate.
• Resolve merge risk (P1) - Merging would make a Gateway release that current main rejects for missing provenance and stable validation evidence the default setup package.
• Resolve merge risk (P1) - The recorded candidate run failed during Gateway wizard restart and pairing recovery, so fresh Windows/WSL setup could roll back after installation.
• Resolve merge risk (P1) - The branch is dirty against current main because the direct pin owner was removed in favor of the release-policy boundary.
• Complete next step (P2) - A release owner must decide whether to close the held draft or sponsor a new policy-based promotion; the current direct-pin patch has no safe mechanical repair.
• Improve patch quality - Resolve the security review concern or explain why the changed path is safe.
• Improve patch quality - Address the highest-priority review finding and re-run the changed-surface validation.

Findings

• [P1] Keep rejected Gateway 2026.7.1-2 out of the default pin — src/OpenClaw.SetupEngine/GatewayLkgVersion.cs:6
• [medium] Do not install an evidence-rejected Gateway package — src/OpenClaw.SetupEngine/GatewayLkgVersion.cs:6

Agent review details

Security

Needs attention: This changes the externally installed Gateway package to a version current main records as lacking required provenance and release-validation evidence.

Review metrics

Metric	Value	Why it matters
Default release surface	1 production file, +1/-1	The single-line change controls the Gateway package selected for default Easy Setup.

Merge-risk options

Maintainer options:

1. Close the failed candidate draft (recommended)
   Keep the validated policy selection on main and close this direct pin because its candidate is rejected and the branch no longer matches the release-policy architecture.
2. Re-propose only through the evidence gate
   A new policy update would need an approved release candidate, provenance, exact-version Windows/WSL setup and recovery proof, and explicit release-owner acceptance.

Technical review

Best possible solution:

Keep the current validated 2026.6.34 recommendation and rejected status for 2026.7.1-2; evaluate any future candidate through a fresh release-policy update with complete evidence.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main explicitly identifies 2026.7.1-2 as rejected, its focused policy test rejects it, and the supplied real setup run recorded the restart failure.

Is this the best way to solve the issue?

No. A direct fallback pin bypasses the current release-policy gate; a future promotion must update that policy only after the required evidence is accepted.

Full review comments:

• [P1] Keep rejected Gateway 2026.7.1-2 out of the default pin — src/OpenClaw.SetupEngine/GatewayLkgVersion.cs:6
  Current main specifically marks this release rejected for missing provenance and stable validation evidence, and its focused policy test rejects the exact version. Promoting it through the obsolete direct pin would bypass that gate and default fresh setup to a candidate whose supplied acceptance run failed during wizard restart.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 9f9a8eda6340.

Labels

Label changes:

• add merge-risk: 🚨 security-boundary: The proposed installed package lacks the provenance and stable release-validation evidence required by current policy.

Label justifications:

• P1: Promoting the failed and rejected candidate would affect default Windows/WSL Gateway setup.
• merge-risk: 🚨 compatibility: The proposed default conflicts with current main’s validated-release selection and would replace the package selected for new setups.
• merge-risk: 🚨 availability: Recorded acceptance runs failed during Gateway restart and pairing recovery, causing setup rollback.
• merge-risk: 🚨 security-boundary: The proposed installed package lacks the provenance and stable release-validation evidence required by current policy.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Evidence

Security concerns:

• [medium] Do not install an evidence-rejected Gateway package — src/OpenClaw.SetupEngine/GatewayLkgVersion.cs:6
  The proposed default selects 2026.7.1-2 even though current policy records missing SLSA provenance and stable release-validation evidence, weakening the setup supply-chain gate.
  Confidence: 0.98

What I checked:

• Current policy rejects the proposed version: Current main records 2026.7.1-2 as an evidence-rejected release, while 2026.6.34 is the validated recommendation. (src/OpenClaw.SetupEngine/GatewayReleasePolicy.cs:132, 9f9a8eda6340)
• Current regression coverage: The policy tests assert that resolving the exact evidence-rejected version throws an unattested-release error containing the provenance failure. (tests/OpenClaw.SetupEngine.Tests/GatewayReleasePolicyTests.cs:85, 9f9a8eda6340)
• Maintainer-approved release policy: The accepted ADR requires exact Windows setup, pairing, restart/reconnect, recovery, and Gateway-to-node proof before promotion, and states that 2026.7.1-2 lacks SLSA provenance and stable release-validation evidence. (docs/adr/0001-gateway-release-policy.md:38, 9f9a8eda6340)
• Feature-history provenance: Current-main history identifies the validated-release policy change and subsequent candidate-artifact validation work as the latest policy-area commits. (src/OpenClaw.SetupEngine/GatewayReleasePolicy.cs:126, e295df266c72)
• Recorded real-run failure and active hold: The supplied exact-head acceptance report recorded the candidate’s wizard-restart failure and rollback; collaborator comments explicitly say not to merge this pin pending a disposition and release-owner acceptance. (fa55ae3150b2)
• Branch is superseded structurally, not by the proposed version: Main deleted the direct LKG file and added the policy owner, so the one-line branch cannot cleanly merge into the current design. (src/OpenClaw.SetupEngine/GatewayLkgVersion.cs:6, 9f9a8eda6340)

Likely related people:

• Dallin Romney: Recent main history attributes the validated Gateway release-policy implementation and follow-up candidate-validation work to this area. (role: current release-policy author; confidence: high; commits: e295df266c72, 9f9a8eda6340; files: src/OpenClaw.SetupEngine/GatewayReleasePolicy.cs, docs/adr/0001-gateway-release-policy.md)
• shanselman: A collaborator review explicitly holds this candidate pending upstream disposition and Windows/WSL acceptance evidence. (role: reviewer with explicit release hold; confidence: high; files: src/OpenClaw.SetupEngine/GatewayLkgVersion.cs)
• bkudiess: The current discussion’s detailed setup/connect run recorded the candidate restart failure, rollback, and unresolved release gate. (role: acceptance-evidence author; confidence: high; files: src/OpenClaw.SetupEngine/GatewayLkgVersion.cs)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (57 earlier review cycles; latest 8 shown)

• reviewed 2026-08-06T03:01:36.392Z sha fa55ae3 :: found issues before merge. :: [P1] Keep the failed candidate out of the default LKG pin
• reviewed 2026-08-06T05:20:46.789Z sha fa55ae3 :: found issues before merge. :: [P1] Keep the failed candidate out of the default LKG pin
• reviewed 2026-08-06T08:15:00.704Z sha af6f5c5 :: found issues before merge. :: [P1] Do not promote an unproven gateway build to LKG
• reviewed 2026-08-06T14:55:52.148Z sha af6f5c5 :: found issues before merge. :: [P1] Keep the failed candidate out of the default LKG pin
• reviewed 2026-08-07T07:57:12.479Z sha 0944998 :: found issues before merge. :: [P1] Keep the failed candidate out of the default LKG pin
• reviewed 2026-08-07T12:51:28.957Z sha 0944998 :: found issues before merge. :: [P1] Do not promote the failed candidate to LKG
• reviewed 2026-08-07T16:00:55.617Z sha 0944998 :: found issues before merge. :: [P1] Do not promote the failed candidate to LKG
• reviewed 2026-08-07T21:27:11.142Z sha 0944998 :: found issues before merge. :: [P1] Do not promote the failed candidate to LKG

[shanselman]

GitHub Copilot maintainer-assistant review — this is automated feedback, not a comment written personally by Scott.

Reviewed head: 59ac51a4061488aa4f7dcc1466bec3b76301f017

The one-line implementation is correct, but an LKG promotion means “last known good,” not merely “latest published.” The candidate 2026.7.1 currently has an unresolved upstream report of complete gateway startup failure after upgrade, and this draft has no current-head Windows/WSL easy-setup acceptance evidence. The prior signed Windows installer promotion did not exercise this exact gateway pin.

Please keep this draft until a release owner supplies both:

1. a disposition for the upstream startup report (fixed, proven inapplicable to Ubuntu/WSL, or accepted with a documented rationale); and
2. current-head Windows acceptance against exactly 2026.7.1.

Suggested acceptance matrix:

• fresh easy setup into a clean app-owned WSL distro;
• gateway starts and passes health checks;
• tray connects and pairing/device-token flow completes;
• repair/re-run against an existing managed distro;
• uninstall/rollback leaves no broken state;
• required repository build, shared tests, and tray tests report real non-zero counts.

Please include the exact installed gateway version and redacted setup/gateway-health output in the PR. Once that evidence is present, the centralized one-line pin is the right implementation and should be straightforward to land.

[shanselman]

Maintainer hold: do not merge the current 2026.7.1-2 pin. It has unresolved startup and release-provenance blockers on the Windows/WSL upgrade path. We are also not repinning this automation PR to 2026.6.33, because repair can downgrade users who already have 7.x state. We will reassess against the new gateway release expected Tuesday.

[bkudiess]

PR #987 exact-head proof: HOLD

Candidate: Gateway LKG 2026.7.1-2
PR head: fa55ae3150b2837a25e13ce1d3eda9025fef316f
Verdict: HOLD. Do not merge or auto-accept. Explicit release-owner acceptance remains required after all blockers are resolved.

Validation

Lane	Result
Exact PR head and clean worktree	PASS
Full repository build	PASS
GatewayLkgVersionTests	3 passed, 0 failed
OpenClaw.SetupEngine.Tests	703 passed, 0 failed
OpenClaw.Shared.Tests	3,399 passed, 0 failed, 32 skipped
OpenClaw.Tray.Tests	2,053 passed, 0 failed
Canonical isolated setup/connect E2E	0 passed, 2 failed during fixture setup

Real behavior proof

The source-preserving custom run used unique distro OpenClawE2E-3d5d2472, isolated tray data roots, a dynamic gateway port, and a setup config that omitted both Gateway.Version and Gateway.InstallUrl.

1. The default LKG policy selected 2026.7.1-2.

2. The installer completed, and openclaw --version returned OpenClaw 2026.7.1-2 (0790d9f).

3. The isolated gateway service started and returned HTTP 200.

4. SetupEngine paired the operator and node. The node registered 9 capability categories and 30 commands.

5. During run-wizard, the isolated gateway emitted shutdown, closed with WebSocket code 1012 (service restart), and the reconnect/replay path failed with:

   WizardFatalException: The managed WSL gateway is not listening; no pairing credential was sent.

6. Setup rolled back and unregistered the unique distro.

7. The stock E2ESetupFixture independently reproduced the same failure on a second unique distro, OpenClawE2E-a2ad26a7. Both selected setup/connect tests failed during fixture initialization, and fixture teardown unregistered the distro.

Evidence:

• runtime-3d5d2472/runtime-verdict.json
• runtime-3d5d2472/logs/initial-setup-console.sanitized.log (install/version: lines 83-98; health: 112-141; pairing/capabilities: 151-301; restart failure: 445-508)
• canonical-tests/canonical-setup-connect.trx
• canonical-tests/e2e-setup-engine-errors.txt

Cleanup and isolation

• Both proof-created distros are absent.
• No proof-owned keepalive, run marker, VHD, process, isolated tray data, or identity residue remains.
• Shared OpenClawGateway remained Running before and after both runs.
• Git remained clean at the exact PR head.
• The custom run's post-rollback product uninstall returned exit code 1 because windows-node-context treated the already-unregistered distro as an error. Exact-target fallback cleanup succeeded, and independent final-state verification passed. This is an additional uninstall-idempotency issue, not a successful uninstall result.
• Sanitization audit found no unredacted credentials or persisted credential files.

Upstream disposition

The explicit collaborator hold remains active:

• chore(setup): bump gateway LKG to 2026.7.1-2 #987 (comment)
• chore(setup): bump gateway LKG to 2026.7.1-2 #987 (comment)

The primary issue matching the hold's unnamed startup report is openclaw/openclaw#108435. It remains open and labeled P0/crash-loop/release-blocker. The original reporter stated that OpenClaw 2026.7.1-2 (0790d9f) did not resolve the stock-install issue:

• [Bug]: update to openclaw 2026.7.1: gateway fails to start w/ error openclaw#108435 (comment)

The Ubuntu-specific sibling report is openclaw/openclaw#107607. Its stale closure is not an engineering disposition proving the issue inapplicable to Ubuntu/WSL.

The candidate tag predates later startup repairs, including dead-owner migration-lease recovery commit a1a507ddaf56f3b852bfebfa4178245da68d63dd. The candidate therefore does not satisfy the hold's required upstream fixed/inapplicable/accepted disposition.

Not verified / blocked

• Visible WinUI setup proof was not captured because this session had no computer-use surface. The canonical current SetupEngine E2E route was exercised instead and failed before isolated tray launch.
• Isolated tray MCP app.status/app.nodes, winnode, stop/start/restart recovery, and managed-local repair were blocked by setup rollback.
• Same-version rerun was not treated as acceptance after initial setup failure.
• No supported in-place 2026.6.11 to 2026.7.1-2 setup contract exists: the setup pipeline cleans/recreates an existing target distro rather than upgrading it. No improvised shared-state mutation was attempted.
• Rollback after a fully successful setup was not reached.

Release-owner decision

HOLD. The exact candidate failed the current isolated setup route twice, the upstream startup disposition remains unresolved, cleanup returned a product-uninstall error after rollback, and most recovery/repair/upgrade acceptance items remain blocked. A future candidate requires fresh exact-head evidence and explicit release-owner acceptance.