[tianxiaochannel-oss88]

Summary

• Make TypeScript the default for new JavaScript/TypeScript-module tests and test helpers. New or migrated TS tests must be discovered, executed, and type-checked through the owning package's validation commands and relevant CI gates.
• Migrate existing .mjs tests incrementally during module maintenance. Prefer behavior and boundary assertions while retaining independently valuable security, architecture, and declared contract checks.
• Require evidence before consolidating or removing tests. Do not delete tests to reduce the JavaScript share or rewrite production code in Rust for that purpose.
• Repair the CI-blocking protected-host history-budget test by using the SHA-pinned /usr/bin/true executable for its 258 real native no-op commands instead of repeatedly hashing and launching Node.

Current head: ca72ed97a5745e0c3033d13807b418630ce06dc8, synchronized with main at a09beb0ef838f1e79e73ea3eca47e191bc609fa1 using ordinary merges. No force-push was used. The latest synchronization includes main's CodeQL scheduling PR #646; the earlier #644 dependency changes and the #646 workflow, selector, tests, and documentation are inherited, not part of this PR's authored delta.

Scope And Compatibility

The authored delta is five files, with 70 additions and two deletions:

• CONTRIBUTING.md: canonical testing policy.
• AGENTS.md: agent-facing testing and validation instructions.
• .github/PULL_REQUEST_TEMPLATE.md: testing-policy and evidence checklist items.
• packages/daemon/test/protected-host-staging.test.mjs: lightweight executable for the existing history-budget case.
• packages/daemon/test/support/protected-host-stage-fixture.mjs: explicitly pin that executable in the existing fixture.

Relative to synchronized main, no production runtime, CI configuration, dependency, timeout, retry, skip, assertion, loop count, or release metadata is changed. VERSION 0.2.1 is inherited unchanged from main; this is not a release or deployment.

The narrow repair remains in the existing .mjs native staging suite. No new test or helper is introduced, and no TS migration is claimed. Future migration must wire execution and real test type-checking together; the policy does not treat runtime transpilation or an .mjs-only glob as sufficient justification for new JavaScript tests.

CI Failure And Workload Evidence

The same history-budget case reached its existing 90-second child-process deadline in runs 41442728401 and 41448314215. Other checks did not explain those failures.

This is a deterministic fixture-workload repair, not a claim that a random flake has been statistically established:

• A local Node 22.22.1 baseline took 31,230 ms. Instrumentation observed 517 full reads of the 112,972,416-byte Node executable, totaling 58,406,739,072 bytes, for this cardinality-only scenario.
• The fixed case passed in 4,657 ms locally, and in 4,817 ms within the related suite. These are observed samples, not a CI duration guarantee.
• With an injected 180 ms delay per Node-binary read and the same 90-second parent deadline, the original timed out at 90,188 ms; the fixed case passed in 5,271 ms with only the fixture's single initial Node-binary read.
• Historical passing main/topic CI cases took approximately 59-79 seconds. No separate ten-run main experiment was conducted, and a timeout on main is not claimed.
• The repaired case also passed on hosted macOS for the preceding candidate 10460774: Daemon shard 3 logged ok 13 with duration_ms: 16596.044958 at 2026-11-02 16:31:11 UTC. That entire shard completed successfully. This historical hosted evidence predates synchronization of dependency PR chore(deps): bump the production-dependencies group across 1 directory with 7 updates #644 and does not certify current head ca72ed97.
• The preceding synchronized candidate also has hosted evidence: attempt 2 daemon shard 3 logged the same case as ok 13 with duration_ms: 20964.230125 at 2026-11-02 19:25:06 UTC. The complete staging file passed in 124.63 seconds and the entire shard passed. This evidence covers ff546e96, including the synchronized chore(deps): bump the production-dependencies group across 1 directory with 7 updates #644 dependencies, not current head ca72ed97.

Test Coverage And Gate Integrity

The case still executes 258 real ordinary native commands, closes 66 stage lifetimes, and verifies final stage registration. true resolves to the explicitly SHA-pinned system executable, not a shell builtin. Production supervisor, registry, authority checks, native Seatbelt spawning, actor waiting, and disposal remain in the exercised path.

Forced regression probes were run against both the original and repaired case paths:

• Reintroducing the actor-count cap of 256 caused both variants to fail at command 257.
• Reintroducing the stage-lifetime cap of 64 caused both variants to fail at lifetime 65.
• Detection was 2/2 before and 2/2 after across these two injected regressions, with one sample per guard and command variant. This is not a statistical reliability estimate.

No tests were added, removed, consolidated, disabled, or renamed. Repeated Node startup/hash stress is intentionally reduced in this cardinality case; the separate Node-based stage read/write, ancestor-rename, and security cases remain unchanged. This does not claim equivalence of every incidental workload characteristic.

Validation

• After synchronizing dependency PR chore(deps): bump the production-dependencies group across 1 directory with 7 updates #644 on ff546e96, corepack pnpm install --frozen-lockfile and corepack pnpm --filter @ling-stack/daemon build passed with Node 22.22.1.
• All 73/73 related tests were rerun and passed on ff546e96, with no failures or skips: protected-host staging, actor inventory, cross-registry domain, and external-workflow request runtime, using Node 22.22.1 with --test-concurrency=1. Total duration was 126,135 ms; the repaired history-budget case passed in 9,545 ms in this run.
• corepack pnpm --filter @ling-stack/daemon typecheck:ci passed. This checks the package's TypeScript source, not the existing .mjs tests.
• corepack pnpm check:docs passed: 542 Markdown files.
• corepack pnpm check:licenses passed on ff546e96: 1,245 dependency versions. The subsequent ci: align CodeQL scheduling with OpenClaw #646 synchronization does not change dependency inputs.
• corepack pnpm check:public passed: 6,615 repository files.
• git diff --check origin/main...HEAD passed.
• Main's chore(deps): bump the production-dependencies group across 1 directory with 7 updates #644 dependency update changed five package manifests and the lockfile. The daemon was rebuilt and the focused suite, typecheck, documentation, license, and public-content checks were rerun against that dependency state; the older results are not substituted for those checks.

Historical hosted CI for preceding head ff546e96: 41489003401, attempt 2 completed successfully at 2026-11-02 19:34:27 UTC. All seventeen CI jobs passed, including all four daemon shards and the required Typecheck, unit tests, and Web build aggregate. The aggregate also verified complete planned file coverage for core and daemon. The separate CodeQL run 41488995210 completed successfully. That PR watcher reported nineteen passing check contexts and required checks 1/1 green. These results do not certify the new head below. No CI override is requested or used.

Latest Main Synchronization

Before merging, a fresh readback found that main had advanced to a09beb0e via PR #646 and strict branch protection reported BEHIND. Main was merged normally into this branch as ca72ed97; no conflict, force-push, or protection override was needed. The authored delta remains the same five files, 70 additions and two deletions. The protected-host test and fixture, agent policy, and PR checklist are byte-identical to ff546e96.

On ca72ed97, node --test scripts/ci/codeql-scope.test.mjs passed 14/14 tests, corepack pnpm check:docs passed for 542 Markdown files, and git diff --check origin/main...HEAD passed. Fresh hosted CI 41548564233 completed successfully at 2026-11-03 00:21:05 UTC: all seventeen jobs passed, including all four daemon shards and the required aggregate's planned-file coverage verification. CodeQL 41548564211 completed successfully at 2026-11-02 23:56:07 UTC. All twenty registered check contexts passed on this exact head. The fresh gstack-ci-gate --expect-head ca72ed97a5745e0c3033d13807b418630ce06dc8 verdict is PASS; previous-head results are not substituted and no CI override is used.

Runner Allocation Interruption

At 2026-11-02 18:45:36 UTC, daemon shard 1 was cancelled without acquiring a runner. Daemon shard 3 was cancelled for the same reason at 18:55:37 UTC. Both jobs have empty runner names and zero execution steps. Their check annotations state:

The job was not acquired by Runner of type hosted even after multiple attempts

Additional annotations explicitly identify macOS arm64 runner capacity constraints and longer queues.

This is infrastructure evidence outside the PR, not a failing test or an established test flake. Fourteen other CI jobs, including daemon shards 0 and 2 and the real macOS helper/Seatbelt lane, passed on this head. Attempt 1 completed at 18:56:12 UTC; the required aggregate failed because daemon coverage was incomplete.

Two single-job rerun requests before workflow completion were rejected, with no retry accepted at that time. The direct REST response confirmed HTTP 403: The workflow run containing this job is already running.

After attempt 1 completed, one bounded failed-jobs rerun was accepted at 18:57:19 UTC as attempt 2. Readback confirms that only daemon shards 1 and 3 are newly queued, with new job IDs 125483283669 and 125483283379; the fourteen successful jobs retain their original execution timestamps and conclusions. The failed required aggregate must rerun after those shards complete. Retry accounting is two rejected requests and one accepted allocation retry. No source, runner label, test threshold, or assertion is changed for this interruption; it is not waived as a pass.

Both retry shards subsequently passed: shard 1 at 19:21:54 UTC and shard 3 at 19:30:57 UTC. The dependent required aggregate passed at 19:34:26 UTC, including the planned-file coverage verification. No further retry was submitted.

Review And Remaining Acceptance

The current five-file diff was read in full again against main and checked against the pre-landing checklist. The earlier independent read-only review traced the unchanged executable replacement through the real native runtime path and found no blocking coverage issue. No blocking finding is currently identified. The earlier ship/review receipt for addc77e2 is historical and does not certify this head.

This PR establishes contributor guidance, not an automatic repository-wide TS enforcement mechanism or a completed test migration. No frontend change, model prompt change, packaged GUI acceptance, Windows acceptance, or production deployment is included. Hosted platform lanes passed on current head ca72ed97; this does not certify packaged or Windows acceptance.

The pre-merge readback had main and the PR base at a09beb0e, this PR at ca72ed97, zero commits behind main, and no unresolved review threads. The owner explicitly authorized merging this PR with "合并吧". GitHub reported MERGEABLE but BLOCKED, with an automatic squash-merge request enabled at 2026-11-03 00:24:14 UTC and no merge-queue entry. The current account was allowed to update main through a PR under main-admin-only-merges; the separate protect-main ruleset had no bypass actors and required the successful CI aggregate, strict base freshness, and resolved review threads.

Merge Result

PR #643 was squash-merged at 2026-11-03 00:34:07 UTC as bea22d35e744020b5bafb03d02b1e1fc6d0ea153. After a fresh exact-head CI gate returned PASS and target/cleanliness checks passed, the standard REST merge endpoint accepted sha=ca72ed97a5745e0c3033d13807b418630ce06dc8 and merge_method=squash. No --admin, protection change, CI override, force-push, or automatic-request cancellation was used. This normal merge completed while the earlier automatic request had remained pending; it did not wait for that request to resolve by itself.

Authoritative GraphQL readback confirms state=MERGED, the merge timestamp and SHA, and main at the same merge commit. origin/main was fetched and verified to contain the merge commit. git diff --exit-code ca72ed97a5745e0c3033d13807b418630ce06dc8 bea22d35e744020b5bafb03d02b1e1fc6d0ea153 passed, confirming identical final file contents. The authored change remains five files, 70 additions and two deletions. The remote topic branch was automatically deleted and verified absent with git ls-remote. Local branches, other worktrees, active sessions, and services were left unchanged. No release or deployment was performed.

Test Plan

• Preserve the three agreed testing-policy rules and link contributor/agent/PR entrypoints.
• Diagnose the existing CI timeout without increasing deadlines or weakening assertions.
• Verify the real native path and forced regression detection before and after the fixture repair.
• Run the focused suite, daemon typecheck, documentation, license, public-content, and whitespace checks.
• Synchronize main and push the exact candidate through the managed pre-push credential guard.
• Confirm the formerly timing-out case and its full shard pass on hosted macOS for preceding candidate 10460774.
• Complete all fresh current-head CI checks and required aggregate.
• Recheck head/base freshness, review threads, and merge conditions before merging; record the final merge authorization separately.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T23:54:20.982411Z	ca72ed9	New commits
🔒 Security Review	✅ Completed 2026-11-02T23:54:42.131201Z	ca72ed9	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.