[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M698QPZVKEDH5HY9TZFF2P83":3,"skill-same:01M698QPZVKEDH5HY9TZFF2P83":70},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":30,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":46,"ownerHtmlUrl":47,"ownerBlogUrl":46,"ownerDescription":48,"updatedAt":49,"install":50,"resources":63},"01M698QPZVKEDH5HY9TZFF2P83","openclaw-ci-limits",null,"Manage OpenClaw GitHub Actions and Blacksmith CI capacity, runner-registration budgets, fanout caps, main-push single-flight, shard sizing, hosted-runner offload, queue health, and safe ramp-down\u002Framp-up changes. Use when tuning `.github\u002Fworkflows\u002F*`, `docs\u002Fci.md`, CI runner labels, matrix `max-parallel`, ClawSweeper\u002FBlacksmith burst protection, CodeQL runner placement, or investigating slow\u002Fqueued OpenClaw CI.","openclaw\u002Fopenclaw","openclaw","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F252820863?v=4","01M698P3FSAZ6B4R928ZF19KPT","01M698PDMDRVH56MV30D253NFP",394302,"MIT","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fopenclaw-ci-limits\u002FSKILL.md",[],[9,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36],"ci","limits","openclaw ci limits","matrix","tuning","safe","max","shard","fanout","when","workflows","codeql","main","github actions","labels","up","actions","burst","runner","2026-11-10 10:12:30",false,"---\nname: openclaw-ci-limits\ndescription: Manage OpenClaw GitHub Actions and Blacksmith CI capacity, runner-registration budgets, fanout caps, main-push single-flight, shard sizing, hosted-runner offload, queue health, and safe ramp-down\u002Framp-up changes. Use when tuning `.github\u002Fworkflows\u002F*`, `docs\u002Fci.md`, CI runner labels, matrix `max-parallel`, ClawSweeper\u002FBlacksmith burst protection, CodeQL runner placement, or investigating slow\u002Fqueued OpenClaw CI.\n---\n\n# OpenClaw CI Limits\n\nUse this skill for CI capacity changes, not ordinary test failure triage. The\ngoal is to keep OpenClaw fast while distinguishing runner registration, runner\navailability, Blacksmith control-plane health, and downstream queue drains.\n\n## Core Facts\n\n- Full main-tier CI runs hourly; ordinary main pushes run `security-fast`.\n  A green push is not evidence that the full suite passed. Ordinary PRs defer\n  Windows, macOS Node\u002FSwift, iOS build\u002Fsimulator, real-Gateway UI, published-driver\n  update, Knip, and most architecture proof. Import-cycle and Kysely guards\n  remain blocking. Use `docs\u002Fci\u002Fscope-and-routing\u002Fselection.md` and the current\n  manifest for exact event, owner, and release-fallback selection; do not restore\n  deferred lanes while tuning capacity. Android screenshots remain release-only.\n- Do not assume the scarce resource. Prove whether pressure is runner\n  registrations, eligible runner availability, Blacksmith capacity\u002Fcontrol\n  plane, workflow dependencies, test runtime, or a downstream queue writer.\n- GitHub runner registrations for `openclaw` currently report a 10,000 per\n  5-minute bucket in `actions_runner_registration`. Verify the live bucket\n  before each tuning pass because GitHub can change it. The `openclaw`\n  organization shares one bucket.\n- Core REST quota does not draw down this bucket. Check\n  `actions_runner_registration` separately; core quota can be healthy while\n  runner registration is throttled.\n- Use about 60% of the live bucket as the operating target. With the current\n  10,000-registration bucket, keep planned Blacksmith burst load under 6,000\n  registrations per 5 minutes and leave the rest for other repos, retries, and\n  burst overlap.\n- Jobs that route, notify, summarize, choose shards, or run short CodeQL quality\n  scans should stay on GitHub-hosted runners unless measured evidence says\n  Blacksmith is required.\n\n## Runner Cost Policy\n\n- Use the smallest runner that completes the required workload reliably. Keep\n  short control jobs hosted and ordinary trusted development proof local.\n- Treat physical 8-vCPU and larger runners as exceptions, not a default or generic retry. Record the\n  command and measured peak memory, a smaller-runner OOM, or a controlled\n  comparison showing lower total billed cost. Low CPU use alone does not prove\n  a memory-heavy job can move down. Preserve resource-based worker limits.\n- Routine OpenClaw Testboxes use the 4-class with a 60-minute total-job\n  default, including hydration. Keep the 15-minute idle ceiling. Shorter\n  deadlines are welcome for known short commands; do not request four hours\n  automatically or upsize only to obtain more time. Select\n  `.github\u002Fworkflows\u002Fci-check-high-memory-testbox.yml` explicitly only for a\n  named memory-heavy command; see `docs\u002Freference\u002Ftest\u002Fremote-proof.md`.\n  That workflow has at most four concurrent leases inside the shared 32-slot\n  Testbox pool. The high-memory profile uses 8 vCPUs; both profiles preserve\n  their pre-November 3 physical CPU and RAM. All Testbox profiles cap idle time at 15 minutes.\n- Allocate through the current OpenClaw wrapper with workflow ref `main`;\n  the source capsule preserves the checkout being tested. Do not dispatch an\n  old workflow ref to bypass spending limits. Queue age is checked before\n  checkout; an admitted lease keeps its job and idle deadlines.\n- Do not promote an entire workflow family because one command needs more RAM.\n  Keep proven high-memory CI rows scoped to their owning planner and evidence;\n  remeasure before changing their allocation. A 32-class label is not proof of\n  32 available CPUs. Compare observed resources and total billed job cost.\n\n## Rejected Experiments\n\n- **UI blobless sparse checkout (2026-10-16):** Excluding native mobile\u002FmacOS\n  app trees removed 48.31 MiB of logical tracked content, but did not qualify as\n  a runner-cost improvement. In\n  [run 38866595993](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns\u002F38866595993),\n  the Blacksmith UI E2E checkout took 56s and the hosted browser checkout 58s;\n  same-run full UI checkouts took 22–38s. These are small, unpaired samples,\n  not a measured billing delta. Keep the full source checkout. Reconsider only\n  with lower complete checkout time and billed cost, including filtered fetch,\n  lazy materialization, and trusted-harness export; fewer logical bytes alone\n  do not establish savings.\n- **Declaration-fixture owner selection (2026-10-02):**\n  `test\u002Fscripts\u002Ftsdown-declaration-fixture.ts` derives real source copies from its runtime\n  entrypoint closures, so product PRs that edit one do not select the four declaration suites\n  built on it. [PR #162614](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fpull\u002F162614)\n  broke `write-unified-entry-dts` that way; hourly scheduled CI\n  ([run 36979748808](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns\u002F36979748808))\n  caught it about 35 minutes after merge and `0a188c4f038f0` repaired the\n  fixture within the hour. Declaring the owners as `new URL(..., import.meta.url)`\n  literals reaches the suites only below aggressive selection's 20-importer\n  hub cutoff: the incident owner and seven others are hubs, so the replayed\n  #162614 diff still selected none. Replaying all 92 main commits from the\n  prior 30 days that touched an owner through the canonical PR planner options,\n  URL literals newly covered 12 (+35 rows, +1,689 class-vCPU-minutes). Full\n  coverage, such as a policy watch over the same list, newly selects the suites\n  for 81 and starts `build-artifacts` (median 330s on the 16-class across 12 PR\n  runs) for 69, because the suites are build owners in `ci-build-manifest.mjs`:\n  +242 rows and +11,628 class-vCPU-minutes, a median +161 (+8%) per affected\n  PR. That buys one escaped owner break in seven weeks, so keep the plain\n  paths; hourly scheduled CI, tooling-owner PRs and release validation own this\n  proof. Reconsider with a materially higher escape rate or a selection that\n  does not also start `build-artifacts`.\n- **Boundary asynchronous input preparation (2026-09-26):** Adding the existing\n  `CompilerInputSnapshot.prepare()` calls at the three declaration\u002Fboundary\n  callers increased full cold validation from 464.21s to 544.68s on the same\n  four-CPU\u002F15.42-GiB Testbox; warm validation increased from 12.62s to 14.63s.\n  All 125 plugin checks and the canary passed, but CPU use also increased.\n  The six caller additions were removed. Do not repeat this as an assumed\n  speedup; any different use needs measured end-to-end benefit.\n- **Windows pnpm store (2026-09-20):** Original receipts from\n  [run 35547255790](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns\u002F35547255790)\n  measured median complete setup at 45.295s cold versus 52.738s restored\n  (+16.4%), despite reusing all 1,453 packages with zero downloads. The\n  763.8-MiB archive took 23.601–26.980s to restore; producer setup\u002Fsave added\n  62.527s. All seven native jobs passed, but the qualification reducer failed\n  on a 24-KiB reported-RAM difference. No assertions were relaxed or jobs\n  rerun. The exactly RAM-matched subset was still 11.3% slower; that is\n  descriptive evidence, not a replacement passing qualification. Keep normal\n  Windows setup uncached. Reconsider only with net complete-setup savings,\n  including restore, extraction, frozen reconciliation, and producer work.\n- **Hosted Mac exact dependencies (2026-09-01):** The same-head publisher and\n  consumer in [run 33458856298](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns\u002F33458856298)\n  successfully saved and restored a 1.66-GB dependency archive, but setup took\n  142s versus 86s with the ordinary store cache. Extraction took 82s versus 27s;\n  install improved only from 43s to 35s. Keep hosted Mac jobs on the ordinary\n  store cache. Reconsider only with measured total setup savings, including\n  transfer, extraction and frozen reconciliation, not a successful cache hit.\n- **Actions-artifact checkout (2026-08-16):** Do not recommend replacing the\n  shared Blacksmith Git fetch with a preflight-produced workspace or `.git`\n  artifact. [PR #124818](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fpull\u002F124818)\n  measured a 16s Blacksmith checkout baseline versus 7s hosted. The best direct\n  artifact variant cost 1s to pack, 3s to upload, and 11s median to restore;\n  including the serial prefix left only about 1s median improvement and\n  regressed Blacksmith's fast-fetch runs. The official artifact client was\n  worse: [run 31971531521](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns\u002F31971531521)\n  measured 22s median download plus 2s materialization. Blacksmith's fast\n  Actions-cache path does not imply fast Actions-artifact downloads. Reconsider\n  only with measured end-to-end proof for a different transport, including its\n  producer cost and fast-fetch regressions.\n\n## First Checks\n\nBefore changing CI, collect current pressure:\n\n```bash\ngh api rate_limit --jq '{core:.resources.core,graphql:.resources.graphql,search:.resources.search,actions_runner_registration:.resources.actions_runner_registration}'\ngh run list -R openclaw\u002Fopenclaw --limit 20 --json databaseId,status,conclusion,workflowName,event,headBranch,createdAt,updatedAt,url\ngh run list -R openclaw\u002Fclawsweeper --limit 20 --json databaseId,status,conclusion,workflowName,event,headBranch,createdAt,updatedAt,url\ngh api repos\u002Fopenclaw\u002Fclawsweeper\u002Factions\u002Fruns\u002F\u003Crun-id>\u002Fjobs --paginate --jq '.jobs[] | {id,name,status,conclusion,labels,created_at,started_at,completed_at,runner_name,runner_group_name}'\nblacksmith testbox list --all\ncurl -fsS https:\u002F\u002Fclawsweeper.openclaw.ai\u002Fapi\u002Fstatus | jq '{generated_at,fleet,diagnostics:{errors:.diagnostics.errors}}'\ncurl -fsS https:\u002F\u002Fclawsweeper.openclaw.ai\u002Fapi\u002Fexact-review-queue | jq '{generated_at,review:.lanes.review,publication:.lanes.publication,state_writer,state_append}'\nnode scripts\u002Fci-run-timings.mjs --latest-main\nnode scripts\u002Fci-run-timings.mjs --recent 10\n```\n\nFor a suspicious queued run, inspect its jobs. A run-level `queued` status does\nnot reveal whether the job is waiting on dependencies or has no eligible\nrunner. Compare `created_at`, `started_at`, `labels`, and `runner_name`. Recheck\nstale queued runs live before canceling them; cancel only runs proven obsolete.\n\nTestbox `warmup` confirms lease creation, not runner readiness. An initial\n`queued` snapshot without `providerMetadata.runURL` does not establish a capacity\nshortage. Use that URL to inspect the exact workflow once associated. An assigned\n`check` runner performing setup is hydration; a confirmed admission or capacity\nqueue follows the existing stop-owned-allocation policy. Do not infer association\nfrom the newest workflow run or wait on a confirmed capacity queue.\n\n`scripts\u002Fci-run-timings.mjs` start delay can include workflow dependency wait\nplus runner queue time. It is trend evidence, not runner-pressure proof alone.\n\nRead:\n\n- `.github\u002Fworkflows\u002Fci.yml`\n- `.github\u002Fworkflows\u002Fcodeql-critical-quality.yml`\n- `docs\u002Fci.md`\n- `test\u002Fscripts\u002Fci-workflow-guards.test.ts`\n- `test\u002Fscripts\u002Fci-workflow-planning.test.ts`\n- `test\u002Fscripts\u002Fci-workflow-evidence.test.ts`\n- touched planner files under `scripts\u002Flib\u002F*ci*`, `scripts\u002Flib\u002F*test-plan*`, or\n  `scripts\u002Fci-changed-scope.mjs`\n\n## Diagnose The Bottleneck\n\nClassify the issue before changing caps:\n\n- **Runner-registration throttle:** many jobs queued before runner assignment,\n  Blacksmith\u002FGitHub reports 403\u002F429 or spam-style 422 responses from\n  `generate-jitconfig`, and API core quota is still healthy. Treat 422 as this\n  signal only when the request payload is otherwise valid. Fix burstiness and\n  Blacksmith job count.\n- **Blacksmith capacity:** Blacksmith dashboard shows actual concurrency caps or\n  unavailable capacity. Do not solve this with GitHub workflow fanout alone.\n- **Blacksmith Testbox control plane:** list, warm, status, or run calls time out\n  before a lease is returned. This is separate from Actions runner registration\n  and Actions job capacity. Trusted source may use the documented local\n  fallback; untrusted source stays blocked.\n- **Unavailable runner label:** a job is queued with a custom `runs-on` label,\n  `started_at` and `runner_name` remain empty, and no eligible runner exists.\n  Restore an available hosted or registered label; fanout cannot fix it.\n- **Workflow dependency wait:** the job is queued but required predecessors are\n  not terminal. Fix or wait for the dependency; do not call the whole delay\n  runner queue pressure.\n- **OpenClaw test runtime:** jobs start quickly but one lane dominates wall time.\n  Use `$openclaw-test-performance` instead of runner tuning.\n- **Real failing CI:** one job fails after starting. Use `$github:gh-fix-ci` or\n  `$openclaw-testing`, not this skill.\n- **ClawSweeper review backlog:** review pending\u002Fready grows while publication\n  and state writers remain healthy. Tune review admission\u002Fworkers in\n  `openclaw\u002Fclawsweeper`.\n- **ClawSweeper publication backlog:** publication pending\u002Fready and oldest age\n  grow, net drain is zero or negative, or dead letters rise. Inspect publication\n  batches, state-writer coordination, and GitHub mutation latency first.\n- **State materializer\u002Fappend backlog:** `state_append.pending_rows`,\n  `pending_bytes`, or oldest age grows while the materializer is queued or\n  absent. Recover that sole drain first; more review workers make it worse.\n\n## Registration Budget Math\n\nEstimate worst-case registrations for a change before editing:\n\n```text\nnew Blacksmith registrations ~= number of Blacksmith jobs that can become queued\ninside one 5 minute window\n```\n\nFor matrix jobs, count every row that can start in the 5-minute window.\n`strategy.max-parallel` only caps simultaneous rows; short rows can turn over\nand register more runners before the window resets. Use job duration, retries,\nand queue turnover to justify any lower estimate. Add non-matrix Blacksmith jobs\nsuch as `preflight`, `security-fast`, `build-artifacts`, and platform lanes.\n\nFor repeated pull-request pushes, multiply by the number of runs expected to\nreach Blacksmith admission in the same 5-minute window, including runs canceled\nafter admission. Canonical `main` uses two run-number-parity slots. Each slot\nkeeps one active non-canceling run and one coalesced pending tip. Budget for up\nto two active main matrices plus their two pending tips entering the next\nadmission wave, not every intermediate merge.\n\nReject a change unless the org-level worst case stays below about 60% of the\nlive bucket. With the current 10,000-registration bucket, keep planned\nBlacksmith burst load under 6,000 registrations per 5 minutes with headroom for\nClawSweeper, ClawHub, Clownfish, OpenClaw RTT, and Clawbench.\n\nNative compact plans admit 90 rows and GitHub-hosted plans 96; final Node caps remain 70 push and 130 PR rows.\nThe current automatic main\u002FPR source has a conservative union of 71 potentially\nself-hosted non-Node rows, including five core-lint stripes for fork PRs,\nfive type stripes, five Windows rows, and thirteen UI E2E rows. Retain an 84-row\nallowance with thirteen rows reserved: `4 × 154 + 21 × 214 = 5,110` for the\nfour-main\u002F21-PR arrival envelope, leaving 890 below the 6,000 reference target.\nThe six extension-lint rows remain hosted. Manual\u002Ffrozen releases and other\nworkflows are outside this envelope. This is conditional planning, not live\norganization-wide capacity proof; older 5,010\u002F5,085\u002F5,160 examples below describe\nhistorical inventories and do not replace this source-audited reserve.\n\n## Safe Levers\n\nPrefer these in order:\n\n1. Preserve cancel-in-progress for superseded pull-request heads.\n2. Preserve canonical `main` as two non-canceling parity slots; each slot's\n   default pending run coalesces to the newest tip.\n3. Move high-frequency, short, non-build jobs to `ubuntu-24.04`.\n4. Reduce matrix rows by bundling related tests inside one runner job when the\n   combined job stays under timeout and keeps useful failure names.\n5. Lower `strategy.max-parallel` for bursty Blacksmith matrices.\n6. Right-size runners from timing evidence. Use fewer\u002Flarger jobs only when\n   elapsed time improves enough to justify registration count.\n7. Split truly slow tests with `$openclaw-test-performance`; do not hide a slow\n   test problem by registering more runners.\n\nDo not:\n\n- add another Blacksmith installation expecting a higher registration bucket;\n- move CodeQL Critical Quality back to Blacksmith;\n- raise all `max-parallel` values at once;\n- make manual `workflow_dispatch` runs cancel normal push\u002FPR validation;\n- delete coverage just to reduce runner count;\n- treat cancelled superseded pull-request runs as failures without checking the\n  newest run for the same ref.\n- cancel old queued runs from a stale snapshot; re-query the exact run first and\n  preserve any current run that still owns live work.\n\n## Current OpenClaw Knobs\n\nThese are intentionally guarded by the `ci-workflow-guards`,\n`ci-workflow-planning`, and `ci-workflow-evidence` tests under `test\u002Fscripts\u002F`:\n\n- Current-target Control UI locale checks share an already-selected public\n  artifact producer on real PR\u002Fpush\u002Fschedule events. Keep verification before\n  generators, settle the existing strict\u002Fadvisory outcomes after build diagnostics,\n  and route the logical locale gate to that explicit result. Dispatches, frozen\n  and compatibility targets, and standalone locale selections retain their job.\n  Hosted row accounting omits only the shared locale row; no build is newly selected.\n\n- `CI` concurrency key version, PR cancellation, and canonical `main`'s two\n  non-canceling parity slots, each with one coalesced pending tip.\n- `preflight` starts immediately without a debounce or standalone admission job.\n  `security-fast` waits for its hosted budget decision and still runs after\n  preflight failure unless the workflow was canceled. The protected `vitest-cache-warm` workflow\n  publishes the immutable semantic dependency archive after setup succeeds,\n  in an independent short job. Dependency and code publishers serialize per\n  backend\u002Fplatform\u002Fref without a workflow-wide lock or cross-platform dependency.\n  Hybrid adds a bounded hosted tooling\u002Fcontract\u002FUI seed and native SDK archive,\n  without repeating the full Linux build. Docs-only pushes skip warming. The split\n  adds one Blacksmith registration per eligible warmer admission, not per CI job;\n  include short-publisher turnover in burst estimates. Preflight and downstream Node jobs are\n  restore-only consumers on eligible self-hosted runners. Exact misses and\n  hosted paths, including Mac Node jobs, use the ordinary pnpm-store cache.\n- Ordinary canonical same-repository hybrid first attempts keep `preflight`,\n  `pr-failure-report`, and `ci-gate` on hosted Ubuntu. October 15's 26-PR sample\n  found 148 minutes of Blacksmith preflight queueing, with a 12.9-minute p75.\n  Fork first attempts, RunsOn, and admitted qualification\u002Frelease dispatches\n  retain their existing routes. Count these mandatory hosted controls before\n  optional offload; keep the 45-row ceiling and all job\u002Fworker limits.\n  Core lint uses the 16-class on canonical automatic first attempts with an\n  unset, `blacksmith`, or `hybrid` backend, including fork PRs. Admitted\n  qualifications retain their existing routes. The first packed lint row took\n  621s on the 8-class; retain four\n  actual CPUs for that row. The second packed row later exceeded its existing\n  15-minute limit on the 8-class, so it uses the same 16-class. This adds no\n  jobs or registrations and keeps the deadline and complete stripe inventory. The gate has no checkout or dependency setup; retries, ordinary\n  manual dispatches, noncanonical contexts, and the GitHub override stay hosted.\n  Core lint additionally retains hosted routing for frozen targets. Normal hybrid\n  main\u002Fsame-repository PRs add two lint assignments; fork PRs can add six because\n  their logical GitHub check profile emits five lint rows. These fit the fresh\n  71-row union and reserved 84-row non-Node allowance described above.\n  Automatic canonical RunsOn and fork hybrid first-attempt `preflight` uses\n  the existing 4-class, matching default Blacksmith preflight. The former 16-class\n  placement addressed hosted queue stalls. October 13 observations found 610\n  4-class runs with no OOMs and 113s p95 duration; full and changed manifest plans\n  also fit two CPUs and 4 GiB without swap with unchanged outputs. Keep the\n  logical planner profile, cache trust, and 20-minute deadline. Hybrid\u002FRunsOn\n  retries, manual dispatches, noncanonical contexts, and the `github` override\n  retain hosted routing. Monitor assignment latency before claiming rollout savings.\n  `security-fast` stays hosted\n  outside eligible hybrid first attempts and when the bounded hosted plan is admitted. Security hooks use pinned installed packages\n  and local hook definitions, without remote Git initialization. The `github`\n  outage override remains intact. Ordinary same-repository hybrid controls add\n  at most one Blacksmith security registration when optional hosted admission is\n  closed, none when admitted; fork hybrid first attempts retain up to three,\n  and normal Blacksmith runs retain their existing control registrations. All occur in the reserved non-Node inventory.\n  Selected baseline ratchets and Node rows start independently after preflight.\n  Keep the standalone ratchet owner and exact merge-parent\u002Fbase checks; the final\n  gate still requires every selected ratchet to pass. Same-repository\n  hybrid first attempts use the existing 4-class for the ratchet job, with its\n  measured 91-second bound adding at most 6.07 class-vCPU-minutes and no jobs.\n  Preserve the existing hosted fallbacks and deadline.\n  The existing `check-plan` prerequisite uses the 16-class for shared compiler\n  snapshot memory on canonical automatic first attempts with an unset,\n  `blacksmith`, or `hybrid` backend, including fork PRs. Same-repository hybrid\n  PR first attempts instead use hosted planning with the existing serial\n  compiler discovery mode; reserve that mandatory row before optional offloads.\n  Never move the complete compiler snapshot onto the smaller hosted runner.\n  Fork core type stripes\n  with an unset or `blacksmith` backend also use the 16-class on those attempts;\n  hybrid health admission retains its existing placement rules. These routes\n  add paid assignments, not jobs. Preserve logical GitHub stripe coverage,\n  restore-only PR caches, and same-repository cache trust. The GitHub override,\n  retries, ordinary manual and frozen targets, RunsOn planners, and noncanonical\n  contexts retain hosted planning. Admitted qualification dispatches keep their\n  existing routes. Fork standalone ratchets stay hosted. See\n  `docs\u002Fci\u002Frunners.md` for the current routing and `docs\u002Fci\u002Frouting-costs.md`\n  for measured latency and cost; older 4-class planner estimates no longer apply.\n  Optional compiler\u002Fcheck offloads reject observed hosted assignment waits at\n  sixty seconds; the former three-minute cutoff exceeded the latency objective.\n  API and job deadlines remain unchanged.\n  PR jobs finish after sibling failures. `pr-failure-report` waits for the\n  planned jobs and reuses `ci-known-main-red.mjs` to classify each failed or\n  timed-out job against the newest completed scheduled main CI run. Matching\n  job names\u002Fshards and supported failure signatures are pre-existing; a main\n  pass or different signature is new; missing jobs or evidence are unknown.\n  Job-name-only matches are labeled in the reason; check their failing tests\n  against main before attributing the failure.\n  Its table and JSON output reach `openclaw\u002Fci-gate`; the existing gate result\n  and known-main-red allowance stay unchanged. Superseded-run cancellation,\n  runner routes, concurrency and fanout caps remain unchanged. The report\n  consumes one existing non-Node reserve slot: the 71-row union\n  leaves thirteen inside the unchanged 84-row allowance and 5,110 bound.\n\n- Automatic canonical hybrid first attempts count every selected hosted row in\n  preflight. `HYBRID_HOSTED_BASE_ROW_LIMIT = 40` admits at most two optional\n  rows within `HYBRID_HOSTED_ROW_LIMIT = 45`: security and browser-extension\n  E2E. Control UI unit rows retain the 8-class on eligible first attempts.\n  Above 40 base rows, retain the optional rows' existing\n  Blacksmith routes; an eligible base above 45 warns with counts and retains\n  the complete base manifest. The budget limits optional admission, not coverage.\n  Record base\u002Ftotal rows and compare the actual workflow expansion in guards.\n  This never expands test coverage or workers; Control UI E2E shards, QA,\n  real-Gateway, Android, and compiler-heavy jobs retain their existing routes.\n  Frozen\u002Fmanual targets, retries and fully hosted fallback\n  manifests remain outside this first-attempt limit, including existing >45-row\n  fallbacks. Do not change the backend variable or existing caps to enable it.\n- Current extension-package-boundary checks request the 16-class in both the\n  additional-check matrix and shared SDK producer; frozen targets retain the\n  32-class. The existing two-CPU compiler reserve admits two children on the\n  observed four-CPU 16-class allocation. Keep that resource guard authoritative.\n  Compare equivalent workloads and cache states before claiming savings;\n  historical 16\u002F32-class runs also differed in compiler optimization. See\n  `docs\u002Fci\u002Frouting-costs.md` for sizing evidence. No jobs, registrations,\n  permissions, compiler checks, or hosted eligibility are added.\n  The package-boundary row has a 40-minute whole-job budget: three hosted\n  four-CPU attempts hit the former 20-minute limit, with about 19 minutes in\n  SDK preparation and 126 compiles before final validation\u002Fcanary\u002Fcleanup.\n  One completed both compile and canary but still exceeded the job deadline.\n  Two hosted release validations then passed both checks (128 plugins) and\n  were cancelled at the former 30-minute limit.\n  Compiler concurrency, complete inventory, receipt guards, canary, and routing\n  remain unchanged.\n- The Plugin SDK API diff row also has a 30-minute whole-job budget. Two hosted\n  runs spent 722 and 725 seconds rendering the base, then hit the former\n  20-minute deadline during the candidate render. Keep both complete revision\n  renders and the existing eight-CPU\u002F24-GiB floor for two render workers;\n  smaller hosts remain serial. Other additional-check groups retain 20 minutes.\n- Current fast plugin\u002Fchannel contract families each share one checkout\u002Fsetup.\n  Their two weighted process envelopes run sequentially with unchanged include\n  lists and package commands; channel invocations retain four project slots and\n  one worker per project. Any nonzero exit stops admission of the next envelope.\n  Frozen targets retain their original separate rows.\n- CI matrix caps: fast\u002Fcheck lanes at 12, Node test shards at 130 only for\n  PR first attempts, including forks, on a non-frozen Blacksmith or hybrid Node plan, and otherwise 96. When selected outside ordinary PRs, Windows stays at 5.\n  Android uses 4 for canonical Blacksmith push\u002FPR first attempts, including forks, otherwise 2.\n  Hosted plans, RunsOn, retries, main, and all manual\u002Fqualification dispatches\n  retain 96. This removes a second admission wave for 97–130-row PRs without\n  adding jobs or planned vCPU-minutes. Keep the 130\u002F70 final PR\u002Fmain row caps and 90 native\u002F96 hosted compact\n  caps and 5,110-registration arrival envelope; it already counts every PR row\n  inside five minutes. Actual provider capacity and the wall need native proof. Native compact profiles have an enforced 90-row budget and hosted profiles 96; plugin\n  fallback has a 50-row budget, and the final Node matrix enforces 70 push or\n  130 PR rows, including precise plans. Preflight reserves actual appended\n  plugin Node rows in compact admission so existing hosted tooling compaction\n  can meet that tighter budget; dist rows remain outside the Node budget and\n  inside the compact cap. Excess inventory fails preflight.\n- When selected outside ordinary PRs, Windows consumes the complete two package-script inventories and balances\n  whole files into up to five rows. Current measured inputs need five to keep\n  the longest prediction below 420 seconds (four predict 489, five predict 412). Each\n  row retains serial projects and shared file fixtures. Self-hosted Windows uses\n  four Vitest workers; hosted fallback uses one. Selected files enable file\n  parallelism while single-file project budgets remain unchanged.\n  Group by canonical project metadata; keep runtime consumers in one preparation\n  row. Elapsed file costs include imports\u002Fhooks instead of concurrent case sums.\n  Frozen targets without the planner retain their original two rows. Native\n  runner capacity must be measured; a max-parallel setting is not capacity proof.\n  Budget three additional non-Node registrations: the conservative full-tier\n  envelope becomes `4 × 153 + 21 × 213 = 5,085`, with 915 below the historical\n  6,000 target. Earlier 5,010 calculations below describe the two-row inventory;\n  do not spend PR proof savings or raise the final 70\u002F130 Node caps.\n- PRs and exact-head PR fallback dispatches omit the Docker published-upgrade\n  survivor, while retaining owner-selected Docker lanes. They omit QA smoke,\n  real-Gateway UI, named built-process verifiers, and the explicit complete-file\n  process-proof inventory. Main\u002Fordinary manual CI retains that proof, including\n  Full Release Validation's exact-target normal_ci child. PR unit\u002Fboundary and\n  mocked-Gateway owners stay selected; no blanket E2E suffix filter is permitted.\n- macOS Swift main-tier and PR `release_gate` CI runs complete app tests\n  plus lint\u002Fschema guards in `tests`, alongside independent OpenClawKit trait,\n  OpenClawKit test, and Swabble test graphs in `packages`.\n  Ordinary full-scope manual validation adds independent release compilation,\n  moves the guards to `release`, and retains health renders in `tests`.\n  All phases use Xcode 27 on GitHub-hosted `xcode-27` (preview macOS 27),\n  `max-parallel: 2`, and the existing 30-minute budget. The toolchain rollout\n  changes no hosted\u002FBlacksmith placement, job counts, coverage, or Swift 6.3\n  source-language minimum. Require complete native proof and old\u002Fnew job timings.\n  The existing package split adds one hosted job and no Blacksmith registrations;\n  measure complete hosted timing including duplicated setup. Packages do not\n  restore or save app build products. Build caches stay phase-owned; the sole eligible shared\n  SwiftPM cache writer is regular `tests` or full-validation `release`.\n  Debug test\u002Fpackage builds disable indexing and use Swift line-table debug\n  information, retaining coverage and source-line backtraces. Test build caches\n  use the v7 profile; Release flags and v6 caches remain unchanged. Local debug\n  builds retain full debugger metadata.\n- Android regular CI uses four test\u002Flint rows, including benchmark compilation\n  in the Kotlin-lint row when benchmark\u002Fbuild\u002Fdependency inputs change or the\n  changed-path manifest is unusable. Full manual validation retains all six\n  rows and memory-bounded phone\u002FWear\u002Fbenchmark builds without duplicate lint.\n  Canonical Blacksmith push\u002FPR first attempts, including forks, overlap four rows.\n  The GitHub override, retries, manual dispatches, schedules, and noncanonical\n  repositories retain two; frozen task contracts and npm native deferral are unchanged.\n- iOS admitted main pushes and PR `release_gate` CI run one required Debug build\n  and Swift lint smoke; hourly main-tier CI retains the tests phase. Ordinary\n  PRs defer both. Ordinary full-scope manual validation retains Release\n  and Debug\u002Fnative-test phases, both screenshot shards, and the evidence reducer.\n  Frozen full-manual targets keep their Debug-only contract without screenshots;\n  npm qualification still defers native jobs. All iOS build phases and screenshot\n  shards use Xcode 27 on GitHub-hosted `xcode-27` from the first attempt.\n  All four Periphery scans use the same toolchain and retain the checksum-pinned\n  3.8.0 release pending native compatibility proof for both app scans and both\n  shared consumers. Preserve zero findings and exact-USR intersection; selecting\n  the new runner is not compatibility proof.\n  The conservative full-tier non-Node inventory, including Control UI performance, is\n  87 rows, or 88 for historical UI targets. Excluding those four hosted rows\n  plus all three macOS Swift phases and the always-hosted aggregate gate leaves at\n  most 80 potentially eligible jobs. The enforced Node caps therefore give\n  150 registrations per main run and 210 per PR:\n  `4 × 150 + 21 × 210 = 5,010` in the retained peak arrival envelope.\n  The old 19-arrival estimate is obsolete. The remaining 990 below\n  the 6,000 reference target must cover adjacent repositories, releases and\n  carryover; the bounded 2026-09-02 census did not prove that upper bound.\n  Treat a single PR concurrency trial separately from a global rollout.\n  A shared-token quota response does not establish organization-wide usage.\n  Budget all six npm qualification jobs and the actual full-release children;\n  ordinary manual check rows can still use Blacksmith outside hybrid mode.\n- Canonical PR Node tests use one precise changed-target job when possible;\n  broad, deleted or unknown changes fall back to the compact full-suite plan\n  plus affected plugin coverage. Current PR planner errors fail preflight.\n  Targeted plans retain the full built-artifact\n  boundary gate. `main` uses compact integration; manual and release runs use\n  full named shards.\n- `RELEASE_ONLY_TOOLING_SHARDS` in the Node planner owns the complete\n  `core-tooling` family: ordinary tooling stripes plus the isolated\u002FDocker\n  catalogs. Matching non-E2E\u002Fnon-live maintainer leaves in mixed fast configs\n  join the same tier. Preserve their ordinary, isolated or fake-timer config,\n  process pins and product neighbors; reduced groups need subset timing identities.\n  The five `test\u002Fscripts\u002F*.e2e.test.ts` product integration gates stay outside\n  this tier. Product-only canonical PRs omit the family in precise and compact\n  fallback plans. Tooling tests or owners select the full family: `scripts\u002F**`,\n  `src\u002Fscripts\u002F**`, `test\u002F**`, `.github\u002F**`, `config\u002F**`, root package\u002Fpnpm inputs,\n  tooling configs, and other tooling facts owned by\n  `scripts\u002Ftest-projects.test-support.mts`, including Docker, agent\u002FCrabbox,\n  app script\u002FFastlane and extension script\u002Fpackage inputs. Directly changed\n  tooling tests therefore retain PR coverage. Keep each config's complete\n  inventory, exclusions, process metadata, timing floors and runner policy.\n  Every CI manual dispatch includes the family; Full Release Validation's\n  frozen-candidate `normal_ci` child executes it before regular publication\n  admission. An independent duplicate release test is not required: these same\n  tests supply that proof. Fork repositories retain full tooling because they\n  do not use canonical targeting. Main already omitted named tooling shards;\n  it now also omits maintainer leaves formerly retained by fast configs,\n  including on tooling-owner changes. A regression introduced by a later main\n  merge is invisible to main CI until an affected PR or full validation runs it. Existing\n  `ci-gate` aggregates selected jobs, without requiring tooling proof against a\n  later main revision. Report historical file-seconds, emitted rows, runner-class\n  counts and predicted longest jobs separately; fewer test-seconds do not prove\n  a workflow wall-time saving.\n  CI's plugin flag stays false even on dispatch because Plugin Prerelease owns\n  that separate sweep. Plugin-sensitive PR changes override that exclusion in\n  both precise and fallback plans, including bundled metadata coverage. Do not infer release inclusion from a shard name or\n  conflate regular full-campaign publication with approved preflight-only beta\n  exceptions. Product security, migration, storage, protocol, SDK and\n  update-correctness tests are outside this move.\n- The combined Node matrix admits compact and plugin descriptors by estimated\n  duration within the same cap. Catch-all, QA and provider configs use the\n  existing 90-file envelope budget with native Vitest sharding; retain complete\n  config discovery, exclusions and process isolation. Count every appended\n  plugin row, including the five added QA\u002Fprovider rows, in the burst envelope.\n- Precise and fallback plugin groups retain separate child processes, including process-bounded\n  configs. Compatible envelopes, including repeated configs, run one at a time\n  within 300 predicted seconds without a pair-count limit; expanded serial compact\n  jobs use 210. Envelopes with identical preparation mode, runner and dist\n  requirements share one build before their separate sequential processes;\n  packing charges that preparation once. Different preparation modes stay\n  separate. Each job retains the 20-file database-worker ceiling and 300-second\n  estimated budget; observed hosted durations must be reported separately.\n  The earlier 124-envelope inventory projected 50 extension rows and\n  125\u002F119\u002F130 PR Node rows on Blacksmith\u002Fhybrid\u002FGitHub, with 57\u002F46\u002F55 push Node\n  rows and 77\u002F71\u002F82 compact PR rows. Those are historical inventory projections;\n  validate the current inventory against the unchanged 50\u002F130\u002F70\u002F90\n  extension\u002FPR\u002Fpush\u002Fcompact caps. Each original envelope retains\n  its file\u002Fprocess bounds, native shard arguments and worker limits. The complete supplemental boundary list runs in one job\n  with four concurrent checks and one full-root focused-rule scan.\n- Measured Blacksmith chat\u002Fsession, Gateway core-3 and infrastructure storage\u002Fstate\n  outliers reuse the existing file splitter. Preserve serial execution, worker\n  pins and complete timing-history floors; no blanket increase in sharding.\n- Blacksmith and hybrid compact bins with multiple ordinary groups request the\n  existing 32-vCPU class and two child slots with an initial 360s aggregate budget.\n  Final compaction can combine already-admitted parallel bins within 500s;\n  it does not promote serial jobs or change worker limits. Preserve the separate\n  300s ordered two-slot queue bound and runtime preparation charge.\n  Gateway-exclusive serial bins and native numbered tooling bins use a 300s test\n  budget; hourly hybrid main validation packs its tooling rows within 420s plus\n  60s setup to keep headroom under its 77-row cap. Native tooling rows containing\n  the partitioned changed-Node planner proof retain a 150s test budget through\n  initial and measured packing. The partition keeps\n  two workers and serial outer admission. Ordinary self-hosted bins share promoted capacity across logical\n  classes; the existing group exchange fills stranded slots without raising caps.\n  Parallel admission also bounds the ordered two-slot queue at 300 test seconds;\n  matrix predictions use that same queue. Admission retains aggregate work caps\n  and separately charges the measured 60s runtime preparation.\n  Hosted hourly tooling retains its 720s total budget (660s work plus 60s setup)\n  with complete hosted file prices and no native wall observations.\n  Compatible two-slot bins use the time budget without the ten-group cutoff;\n  serial bins retain that cutoff. Blacksmith serial bins retain 200\u002F276s, hybrid serial bins retain 210s,\n  exclusive bins retain 150s by default, and groups above their serial cap stay alone.\n  Complete ordinary hybrid bins containing only non-build CLI groups may use\n  250s and co-locate split siblings, provided each original child still fits\n  150s. Keep file splits, workers, process isolation and other profiles unchanged.\n  Initial packing separates runtime consumers from ordinary groups. Complete\n  hybrid main and PR runtime-placement observations apply only after file splitting;\n  precise changed-file templates retain their original capacity and floors.\n  Typed observations preserve configs, environment, complete files and build mode.\n  Prefer an exact measurement; otherwise use the maximum compatible contained\n  workload as an advisory floor, never sum overlaps or treat globs as whole files.\n  Whole pinned runtime groups may move to existing compatible ordinary jobs under\n  a 360s budget including the 60s build reserve. Keep runner anchors,\n  test partitions, invocation counts and worker limits. An ordinary recipient\n  becomes serial, explicitly retaining its old parallel groups' two-worker budget\n  while preserving their prepared timing identities and complete parent\n  generations. The CI executor applies the smaller of the\n  supplied job ceiling and group cap. This may add one runtime preparation while\n  reducing requested process slots; measure the tradeoff without adding jobs or\n  registrations. Equal maximum estimates prefer more recipient headroom.\n  Reapply shared family, group-count and budget admission to both replacements;\n  never suppress coverage or count a runtime subset as a complete parent.\n  An unfit optimization retains the runnable plan and its truthful estimate.\n  Compare recipients with the donor job's fixed anchor, not only its group class.\n  Exclusive, private-QA, dist and hosted policies stay unchanged.\n  Affordable generated CLI runtime children may share one preparation in an\n  exclusive serial bin within the same 150s budget; fixed stripe families remain\n  separate. Other hybrid exclusive\u002Fdist sharing is unchanged. Complete inventories\n  remain intact.\n  The canonical shard executor admits two CI children only with at least eight\n  available CPUs and 24 GiB actual memory; otherwise it admits one. Inner project\n  parallelism stays one during outer overlap and each overlapping child keeps two Vitest workers.\n  A serial changed-extension envelope may overlap two source-only Telegram database-worker\n  singleton processes, retaining two workers per process, only with scheduler-owned caches,\n  at least two actual CPUs and 7.5 GiB effective memory (the smaller of physical memory and\n  a positive finite process constraint). Require self-hosted Linux, an explicit current-target\n  receipt (`FROZEN_TARGET=false`), and one unchanged Node invocation from the canonical\n  runtime selector; `bun-compatible` can still select Node. Other shapes, runtimes and\n  unknown\u002Finsufficient capacity retain one inner process. Use the actual inner-cap receipt\n  in timing identity; parallel envelopes never supply serial singleton or wrapper-overhead\n  prices. Keep conservative serial placement until qualified exact parallel measurements exist.\n  Gateway methods use four workers in serial, non-frozen self-hosted jobs with\n  at least eight actual CPUs and 28 GiB memory, with the existing two-worker\n  fallback elsewhere. Keep its worker-specific timing identity and require\n  three original-shard replays plus sampled memory evidence when changing it.\n  The Gateway server-isolated\u002Fdatabase-worker family keeps two workers, including\n  roomy serial self-hosted jobs, to leave cold-startup headroom within its existing\n  test deadlines. Preserve host admission and fallback rules, other groups' pins,\n  hosted planning, complete inventory, cleanup, and old timing generations until\n  refit. The historical eight-worker qualification does not establish headroom\n  for the current fixture cohort.\n  The primary GitHub profile remains serial at 210s. Failed-job-only hybrid\n  retries retain the original wider matrix on hosted Ubuntu, clamp to one child,\n  and keep two workers per child; they can exceed the eight-minute normal-run\n  objective without changing existing deadlines. Fewer jobs must retain native\n  elapsed-time, actual memory and cleanup proof; requested labels are not capacity.\n- The whole Blacksmith agent-support group requests `blacksmith-32vcpu-ubuntu-2404`.\n  Its file inventory and resource-derived worker policy remain unchanged.\n- Precisely selected serial CLI, Gateway client\u002Fserver, and embedded-agent jobs\n  use the 16-class when every group has one qualified config, one or two explicit\n  files, and a two-worker pin or fallback. An explicit wider pin disqualifies the\n  group. Keep build, dist, memory, large-runner anchors, and unqualified configs\n  at planned capacity; resource-gated tooling tests are not qualified by this rule.\n  Apply capacity after packing; preserve inventories, runtime selection, timing\n  identities, and process boundaries. Full families retain their planned capacity.\n  RunsOn inherits the hybrid choice for these retained Blacksmith jobs.\n  The exact singleton `gateway-core` selection of\n  `src\u002Fgateway\u002Fmcp-app-extension-runtime.test.ts` and `agents-core` selection of\n  `src\u002Fagents\u002Fcli-runner.helpers.test.ts` also qualify under these guards.\n  Their five-file serial replay at `137e7b2abc87` passed 56 tests on each of Bun\n  and Node, using four CPUs and 15.42 GiB RAM. Whole-machine peaks were 5.00 and\n  5.22 GiB, with zero OOM kills and at most 268 KiB swap use. Other files in those\n  configs and unbounded or parallel infra selections retain planned capacity.\n  Native billed savings remain unverified.\n  The isolated LLM-boundary cache-stability file also qualifies when it is the\n  group's only file, under the same serial, worker, and preparation guards.\n  Its complete current-source replay passed all 19 tests with four CPUs,\n  12 GiB RAM, no swap, 4.23 GiB peak, and zero OOMs. Other isolated files,\n  including siblings in the same job, retain their planned capacity.\n  The singleton `src\u002Fgateway\u002Fboard-store.test.ts` selection also qualifies as the\n  job's only group, with an explicit two-worker pin, two-worker fallback, and\n  unchanged 28-GiB worker-admission threshold. Its five-test replay passed through\n  the CI shard executor in 40.78 seconds on four CPUs and 15.42 GiB RAM. Maximum\n  process RSS was 3.17 GiB, not an aggregate VM peak. Keep all other database-worker\n  selections and mixed jobs at planned capacity; native billed savings are unverified.\n- Source-only serial Blacksmith tooling bins use the 16-class after packing,\n  retaining logical classes, names, file inventories, and two-worker pins.\n  Keep the 32-class for compiler\u002Fartifact capacity files, explicit runner or\n  memory anchors, builds, dist, mixed configs, and parallel jobs. Require complete\n  file lists; unknown envelopes retain their planned runner. The final capacity\n  rule does not change hosted or hybrid plans, packing, timing identities, or\n  registration counts. Tooling files use the shared worker scheduler; price their\n  current file costs by effective workers without dividing the longest file.\n  Docker helper fixtures retain their separate serial config. This does not\n  promote hosted or hybrid tooling as a family; capacity alone is not a measured speedup.\n  Hybrid compiler fixtures and worker-artifact CI keep their per-file 32-class floor.\n  The latter needs eight CPUs \u002F 24 GiB for all six cases, and its two-CPU screen\n  exceeded the existing memory reserve before the three resource-gated cases ran.\n- Numbered tooling measurements in `toolingFileSeconds` drive file packing with\n  native profile costs; a hosted fallback scales measured Blacksmith costs.\n  The daily refit samples successful jobs from the newest five contributing\n  completed PR CI runs, including workflows where other jobs failed.\n  Those measurements describe the PR merge-ref and update exact compact and tooling identities;\n  main compact and release sampling retain their existing provenance. Preserve\n  independent-run medians, runner profiles and partial-plan history. An explicit\n  `--tooling-run \u003Cid>` seed records its source and may use one successful run.\n  Verbose-only case sums are conservative packing costs when cases overlap,\n  not measured file walls. Do not discount them to make row caps pass.\n- Eligible main\u002Frelease Docker seed jobs request `blacksmith-16vcpu-ubuntu-2404`;\n  ordinary manual dispatch retains hosted routing. The weighted\n  scheduler and serial declaration compiler policy stay unchanged.\n  Hourly main-tier CI and admitted main pushes select the published-upgrade\n  survivor independently of changed paths. Main pushes require\n  `OPENCLAW_CI_ON_PUSH=true` to admit full CI. Ordinary manual and full release\n  validation select all five lanes when supported by the target, retaining\n  `legacy-operator-state` with `auto-auth`. Full Release Validation reaches this\n  proof through `normal_ci`; expanded Package Acceptance scenarios alone do not\n  replace its restart mode. PRs and exact-head PR fallbacks select the four\n  non-survivor lanes through `resolveChangedDockerSeedLanes`' exact owner map.\n- `run_control_ui_performance` selects production UI, plugin browser, workspace\n  package, dependency\u002Fbuild\u002Fpolicy inputs and their relative import graph,\n  including tooling. Workspace package aliases require conservative package\n  ownership. Test-only files and unrelated runtime changes omit this lane;\n  manual runs, unknown paths and older planners retain coverage. Preserve the\n  target's existing performance-script capability checks.\n- Partial PR UI unit selections target three files per job within the existing\n  three-row cap and three-worker limit. Full UI owners and manual validation\n  retain their established shards, runtime policy and first-row WebKit checks.\n- Eligible Control UI E2E rows request the 16-vCPU class with unchanged live\n  backend\u002Fevent routing. Compact plans use six mocked Control UI shards with four\n  workers each, matching four observed CPUs per runner and retaining 24 aggregate\n  worker slots. Private source-server projects remain serial. The conditional\n  browser-extension row keeps its existing reuse and routing rules. Hourly main\n  uses the same compact plan without a changed-path inventory. Non-main full\n  manual, noncanonical, compatibility, and other unknown-path inventories retain twelve Control UI\n  shards plus one browser-extension row. Historical targets without the named-project contract retain four total rows on\n  Blacksmith or fourteen on GitHub\u002Fhybrid. Failed-job-only retries retain their\n  previously emitted matrix, including older six-shard Control UI plans; PR and\n  hybrid push retries use hosted Ubuntu. The 25-minute timeout, max-parallel 14\n  and conservative registration ceiling stay unchanged. The browser-extension row\n  stays on 8 unless the bounded hybrid plan admits it to hosted Ubuntu. The twelve-row 4:38 result in historical run 33695337496 used the\n  32-class with eight reported CPUs; it does not prove timing on the current\n  16-class route or refresh stale timing weights.\n- Current-target real-Gateway jobs use the 16-class and existing two-row planner\n  split; frozen or unclassified targets retain the 32-class. Ordinary PRs omit\n  them. Private preparation builds runtime, QA, and Control UI artifacts with\n  SDK declaration generation disabled; `build-artifacts` owns SDK declarations\n  and validation. Preserve browser workers, complete inventory, build-before-test\n  ordering, routing, deadlines, and caps. Further sizing changes require complete\n  job qualification, including preparation and desktop transport proof.\n- Current-target `build-artifacts` uses the existing 16-class after a complete\n  four-CPU\u002F15.42-GiB compute proof, including the unchanged parallel verifier wave.\n  SDK declaration generation uses one compiler program with its existing heap\n  budget and native headroom.\n  Eligible frozen or unclassified targets also request 16-class; hosted fallbacks, job counts,\n  concurrency and deadlines stay unchanged. Measured compute fit does not prove\n  queue savings; observe the next exact-head CI cycle.\n- Normal canonical hybrid first attempts use the existing four-part QA smoke\n  plan, removing two repeated checkouts, setups and private runtime builds.\n  Canonical `main` push\u002Fschedule first attempts on that plan use the 8-class\n  only with explicit non-frozen, non-compatibility classification. A cold private\n  runtime build and all 24 scenarios passed on two usable CPUs under a 7-GiB\n  no-swap cap (5.96-GiB peak, no OOMs). This does not qualify older backport\n  source: those targets may build with higher compiler concurrency. Other\n  contexts retain the shared 16-class\u002Fhosted\u002Frelease-group routing.\n  Blacksmith profiles retain four parts; GitHub profiles and fresh hybrid\n  retry\u002Fmanual plans retain six. Failed-job-only retries retain their original\n  matrix. Keep the complete scenario inventory, separate Matrix run, worker\n  limits, stagger, cleanup and deadlines. Measure the four-part jobs natively;\n  summed build intervals are not a wall-time saving estimate.\n  Main selection uses the existing QA\u002Fchannel\u002Fpackaging\u002Forchestration\n  owners. Manual and Full Release Validation retain the full profile; unknown\n  paths or older selectors retain supported coverage. Integration detection\n  outside these owners now waits for manual\u002Frelease validation. The burden\n  analysis projects about 1,526 Blacksmith vCPU-minutes\u002Fhour saved across Docker\n  and QA; zero failures in 20 Docker and 80 QA main jobs is limited evidence,\n  not a measured post-change saving. Keep backend settings, caps, budgets and\n  timeouts unchanged, and verify actual emitted rows and timings.\n- Full hybrid check plans may share central formatting and scripts lint with\n  existing core lint stripe 1 when its full command inventory contains only those\n  commands. Retain both original core stripes, the exact central selection and\n  changed paths, sequential execution, one lint thread and the 15-minute budget.\n  UI, root-test and wrapper guards keep their separate central row. Require\n  another remaining check row for the existing gate; targeted and other runner\n  profiles retain their layout. Run shared central lint after a core failure so\n  its diagnostics and failure remain visible. This removes one registration and\n  setup, without enlarging runner capacity or relaxing a check.\n- Current GitHub\u002Fhybrid test types use five canonical core stripe jobs plus\n  the central extensions\u002Fscripts\u002Froot tail. Eligible core-change PRs keep the\n  same rows: each validates the complete graph boundary and intersects selected\n  consumers with its original stripe. Empty intersections stay empty; ambiguous\n  selection falls back to every canonical graph across those same stripes.\n  Check existence only for compiler inputs: deleted Markdown and UI CSS paths\n  do not widen accompanying code changes; deleted compiler inputs retain full coverage.\n  Frozen targets retain two paired rows for stripes 1+2 and 3+4 sequentially,\n  with stripe 5 in the central row. Keep at most two compiler children per\n  stripe and one builder per child. A failing stripe stops its row; other\n  matrix rows keep running. Pure Blacksmith and targets without stripe support\n  retain the central path. Keep row caps and deadlines unchanged; measure actual\n  hosted completion rather than inferring wall-time savings from partitioning.\n- CPU-heavy test-type, core test-type stripe, and runtime-topology jobs in `ci.yml`\n  request `blacksmith-16vcpu-ubuntu-2404`. The separate `openclaw-npm-preflight.yml`\n  jobs retain `blacksmith-32vcpu-ubuntu-2404`. The 2026-09-01 x64 probe\n  [run 33538827388](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns\u002F33538827388)\n  measured requested 8\u002F16\u002F32 labels delivering 2\u002F4\u002F8 CPUs respectively. Treat\n  larger requests as a measured capacity workaround, never as worker counts.\n  Keep existing routing, fanout, and resource-based worker limits; reassess\n  sizing after provider allocation changes. See `docs\u002Fci.md` for the full table.\n- lower-weight Node\u002Fcheck shards on `blacksmith-4vcpu-ubuntu-2404`.\n- heavy retained Linux\u002FAndroid shards on `blacksmith-8vcpu-ubuntu-2404`.\n- CodeQL Critical Quality on `ubuntu-24.04` with no `blacksmith-` labels.\n- Where repository variables are available, `OPENCLAW_CI_RUNNER_BACKEND=github`\n  routes configurable `ci.yml` jobs to their existing GitHub-hosted fallback\n  labels. Unset or `blacksmith` preserves the normal Blacksmith-first route.\n  Fork first attempts cannot honor an unavailable override; they use Blacksmith\n  Node runners, check planning, core type stripes, and core lint stripes where\n  the current routing permits. Their logical GitHub profile and cache trust stay\n  unchanged. Fork retries use hosted runners.\n- Vitest transform and Node compile caches are restore-only in CI and use\n  immutable Actions caches; the main-push\u002Fdaily\u002Fdispatch warmer is their sole\n  writer. Build, QA and test orchestration consume its shared Node compile seed.\n  PRs create no runtime-cache archives.\n- Full compiled-worker seeds retain separate prebuild and postbuild archives.\n  The existing protected warmer publishes its already-prepared postbuild full\n  generation; only selected artifact-producer source verifiers restore it.\n  Runtime workers use separate live\u002Fcache slots so they cannot replace that\n  full seed. Keep byte, topology, runtime and exact output-path validation, the\n  uncached path when no archive arrives, and existing job\u002Fworker limits.\n\nWhen changing one knob, update `docs\u002Fci.md` and the guard test in the same PR.\n\n## Blacksmith Outage Circuit Breaker\n\nUse the repository variable only after confirming a Blacksmith outage or\nunavailable runner capacity. Do not set it merely for a failing test that has\nalready started.\n\n```bash\ngh variable set OPENCLAW_CI_RUNNER_BACKEND --repo openclaw\u002Fopenclaw --body github\n```\n\nWhere the override is available, degraded `ci.yml` jobs use the same hosted\nlabels and non-Blacksmith paths as manual dispatches and fork retries.\nBlacksmith-only Docker and sticky steps stay off, dependency setup uses the\nordinary Actions pnpm-store cache, and Android's large build uses separate\nlow-memory Gradle processes. Standard 4-core hosted runners make builds and\ntest lanes slower. Those jobs consume GitHub-hosted concurrency instead of\nBlacksmith registrations. Fork first attempts with unavailable repository\nvariables still use Blacksmith and must remain in the registration budget.\n\nFlip back after the outage by deleting the variable:\n\n```bash\ngh variable delete OPENCLAW_CI_RUNNER_BACKEND --repo openclaw\u002Fopenclaw\n```\n\nScheduled health detection and automatic flipping are a follow-up, not part of\nthe current circuit breaker.\n\n## Validation\n\nFor docs\u002Fskill-only changes, check the edited Markdown, its source claims and\nlinks, and `git diff --check`; runtime suites are unnecessary. For workflow or\nplanner changes, use the changed-file plan and focused tests for the touched\ncontract. These are available checks, not a mandatory bundle for every edit:\n\n```bash\nnode scripts\u002Frun-vitest.mjs test\u002Fscripts\u002Fci-workflow-guards.test.ts test\u002Fscripts\u002Fci-workflow-planning.test.ts test\u002Fscripts\u002Fci-workflow-evidence.test.ts\nnode --import tsx scripts\u002Fcheck-workflows.mts\nnode scripts\u002Fdocs-list.js\n.\u002Fnode_modules\u002F.bin\u002Foxfmt --check .github\u002Fworkflows\u002Fci.yml .github\u002Fworkflows\u002Fcodeql-critical-quality.yml docs\u002Fci.md test\u002Fscripts\u002Fci-workflow-guards.test.ts test\u002Fscripts\u002Fci-workflow-planning.test.ts test\u002Fscripts\u002Fci-workflow-evidence.test.ts test\u002Fscripts\u002Fci-workflow.test-support.ts .agents\u002Fskills\u002Fopenclaw-ci-limits\u002FSKILL.md .agents\u002Fskills\u002Fopenclaw-ci-limits\u002Fagents\u002Fopenai.yaml\ngit diff --check\n```\n\nIf `pnpm docs:list` tries to reconcile dependencies in a linked Codex worktree,\nstop and use `node scripts\u002Fdocs-list.js`.\n\nFollow the [shared review setup](..\u002Fautoreview\u002FSKILL.md) and the\n[maintainer landing workflow](..\u002Fopenclaw-pr-maintainer\u002Freferences\u002Flanding.md)\nfor review, proof, and authorized landing. Bind any CI watcher to the PR's full\n40-character head SHA:\n\n```bash\npython3 \"$HOME\u002F.agents\u002Fskills\u002Fautoreview\u002Fscripts\u002Fautoreview\" --mode branch --base origin\u002Fmain\nnode scripts\u002Fwatch-pr-ci.mjs \u003Cpr> \u003Chead-sha> --repo openclaw\u002Fopenclaw\n```\n\nFocused local proof; PR CI = broad proof. Testbox only for CI\u002Flocal gaps, immediate grant.\nObserve existing CI; never dispatch\u002Frerun\u002Fre-push just for green.\nCI fails → `pnpm test:ci-failed \u003Cpr>`; read classification, fix new failures →\n`pnpm test:ci-failed \u003Cpr> --run` until local pass → push once. Never local full-suite CI repair.\nProven red-main repairs: maintainer workflow direct-main rule. Other changes:\nnative PR route under existing user authorization. Never combine\n`OPENCLAW_TESTBOX=1` with `OPENCLAW_PR_GATES_REMOTE=github`.\n\n## Post-Land Monitoring\n\nAfter merge, watch at least one fresh main cycle and the adjacent repos:\n\n```bash\ngh run list -R openclaw\u002Fopenclaw --limit 20 --json databaseId,status,conclusion,workflowName,event,headBranch,createdAt,updatedAt,url\nfor repo in openclaw\u002Fclawsweeper openclaw\u002Fclawhub openclaw\u002Fclownfish openclaw\u002Fopenclaw-rtt openclaw\u002Fclawbench; do\n  gh run list -R \"$repo\" --limit 12 --json databaseId,status,conclusion,workflowName,event,headBranch,createdAt,updatedAt,url\ndone\ncurl -fsS https:\u002F\u002Fclawsweeper.openclaw.ai\u002Fapi\u002Fexact-review-queue | jq '.'\n```\n\nReport:\n\n- exact PR\u002Fcommit landed;\n- expected registration reduction or added headroom;\n- CI run status and slowest\u002Fqueued jobs;\n- queued job labels, runner assignment, and dependency state for any outlier;\n- Blacksmith Actions runner evidence separately from Testbox control-plane\n  health;\n- ClawSweeper queue pending, dispatching, leased, oldest pending age;\n- publication net drain\u002Fdead letters, state-writer queued\u002Fwaiting, and state\n  append rows\u002Fbytes\u002Foldest item;\n- any real failures that remain outside runner registration.\n","# OpenClaw CI Limits\n\nUse this skill for CI capacity changes, not ordinary test failure triage. The\ngoal is to keep OpenClaw fast while distinguishing runner registration, runner\navailability, Blacksmith control-plane health, and downstream queue drains.\n\n## Core Facts\n\n- Full main-tier CI runs hourly; ordinary main pushes run `security-fast`.\n  A green push is not evidence that the full suite passed. Ordinary PRs defer\n  Windows, macOS Node\u002FSwift, iOS build\u002Fsimulator, real-Gateway UI, published-driver\n  update, Knip, and most architecture proof. Import-cycle and Kysely guards\n  remain blocking. Use `docs\u002Fci\u002Fscope-and-routing\u002Fselection.md` and the current\n  manifest for exact event, owner, and release-fallback selection; do not restore\n  deferred lanes while tuning capacity. Android screenshots remain release-only.\n- Do not assume the scarce resource. Prove whether pressure is runner\n  registrations, eligible runner availability, Blacksmith capacity\u002Fcontrol\n  plane, workflow dependencies, test runtime, or a downstream queue writer.\n- GitHub runner registrations for `openclaw` currently report a 10,000 per\n  5-minute bucket in `actions_runner_registration`. Verify the live bucket\n  before each tuning pass because GitHub can change it. The `openclaw`\n  organization shares one bucket.\n- Core REST quota does not draw down this bucket. Check\n  `actions_runner_registration` separately; core quota can be healthy while\n  runner registration is throttled.\n- Use about 60% of the live bucket as the operating target. With the current\n  10,000-registration bucket, keep planned Blacksmith burst load under 6,000\n  registrations per 5 minutes and leave the rest for other repos, retries, and\n  burst overlap.\n- Jobs that route, notify, summarize, choose shards, or run short CodeQL quality\n  scans should stay on GitHub-hosted runners unless measured evidence says\n  Blacksmith is required.\n\n## Runner Cost Policy\n\n- Use the smallest runner that completes the required workload reliably. Keep\n  short control jobs hosted and ordinary trusted development proof local.\n- Treat physical 8-vCPU and larger runners as exceptions, not a default or generic retry. Record the\n  command and measured peak memory, a smaller-runner OOM, or a controlled\n  comparison showing lower total billed cost. Low CPU use alone does not prove\n  a memory-heavy job can move down. Preserve resource-based worker limits.\n- Routine OpenClaw Testboxes use the 4-class with a 60-minute total-job\n  default, including hydration. Keep the 15-minute idle ceiling. Shorter\n  deadlines are welcome for known short commands; do not request four hours\n  automatically or upsize only to obtain more time. Select\n  `.github\u002Fworkflows\u002Fci-check-high-memory-testbox.yml` explicitly only for a\n  named memory-heavy command; see `docs\u002Freference\u002Ftest\u002Fremote-proof.md`.\n  That workflow has at most four concurrent leases inside the shared 32-slot\n  Testbox pool. The high-memory profile uses 8 vCPUs; both profiles preserve\n  their pre-November 3 physical CPU and RAM. All Testbox profiles cap idle time at 15 minutes.\n- Allocate through the current OpenClaw wrapper with workflow ref `main`;\n  the source capsule preserves the checkout being tested. Do not dispatch an\n  old workflow ref to bypass spending limits. Queue age is checked before\n  checkout; an admitted lease keeps its job and idle deadlines.\n- Do not promote an entire workflow family because one command needs more RAM.\n  Keep proven high-memory CI rows scoped to their owning planner and evidence;\n  remeasure before changing their allocation. A 32-class label is not proof of\n  32 available CPUs. Compare observed resources and total billed job cost.\n\n## Rejected Experiments\n\n- **UI blobless sparse checkout (2026-10-16):** Excluding native mobile\u002FmacOS\n  app trees removed 48.31 MiB of logical tracked content, but did not qualify as\n  a runner-cost improvement. In\n  [run 38866595993](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns\u002F38866595993),\n  the Blacksmith UI E2E checkout took 56s and the hosted browser checkout 58s;\n  same-run full UI checkouts took 22–38s. These are small, unpaired samples,\n  not a measured billing delta. Keep the full source checkout. Reconsider only\n  with lower complete checkout time and billed cost, including filtered fetch,\n  lazy materialization, and trusted-harness export; fewer logical bytes alone\n  do not establish savings.\n- **Declaration-fixture owner selection (2026-10-02):**\n  `test\u002Fscripts\u002Ftsdown-declaration-fixture.ts` derives real source copies from its runtime\n  entrypoint closures, so product PRs that edit one do not select the four declaration suites\n  built on it. [PR #162614](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fpull\u002F162614)\n  broke `write-unified-entry-dts` that way; hourly scheduled CI\n  ([run 36979748808](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns\u002F36979748808))\n  caught it about 35 minutes after merge and `0a188c4f038f0` repaired the\n  fixture within the hour. Declaring the owners as `new URL(..., import.meta.url)`\n  literals reaches the suites only below aggressive selection's 20-importer\n  hub cutoff: the incident owner and seven others are hubs, so the replayed\n  #162614 diff still selected none. Replaying all 92 main commits from the\n  prior 30 days that touched an owner through the canonical PR planner options,\n  URL literals newly covered 12 (+35 rows, +1,689 class-vCPU-minutes). Full\n  coverage, such as a policy watch over the same list, newly selects the suites\n  for 81 and starts `build-artifacts` (median 330s on the 16-class across 12 PR\n  runs) for 69, because the suites are build owners in `ci-build-manifest.mjs`:\n  +242 rows and +11,628 class-vCPU-minutes, a median +161 (+8%) per affected\n  PR. That buys one escaped owner break in seven weeks, so keep the plain\n  paths; hourly scheduled CI, tooling-owner PRs and release validation own this\n  proof. Reconsider with a materially higher escape rate or a selection that\n  does not also start `build-artifacts`.\n- **Boundary asynchronous input preparation (2026-09-26):** Adding the existing\n  `CompilerInputSnapshot.prepare()` calls at the three declaration\u002Fboundary\n  callers increased full cold validation from 464.21s to 544.68s on the same\n  four-CPU\u002F15.42-GiB Testbox; warm validation increased from 12.62s to 14.63s.\n  All 125 plugin checks and the canary passed, but CPU use also increased.\n  The six caller additions were removed. Do not repeat this as an assumed\n  speedup; any different use needs measured end-to-end benefit.\n- **Windows pnpm store (2026-09-20):** Original receipts from\n  [run 35547255790](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns\u002F35547255790)\n  measured median complete setup at 45.295s cold versus 52.738s restored\n  (+16.4%), despite reusing all 1,453 packages with zero downloads. The\n  763.8-MiB archive took 23.601–26.980s to restore; producer setup\u002Fsave added\n  62.527s. All seven native jobs passed, but the qualification reducer failed\n  on a 24-KiB reported-RAM difference. No assertions were relaxed or jobs\n  rerun. The exactly RAM-matched subset was still 11.3% slower; that is\n  descriptive evidence, not a replacement passing qualification. Keep normal\n  Windows setup uncached. Reconsider only with net complete-setup savings,\n  including restore, extraction, frozen reconciliation, and producer work.\n- **Hosted Mac exact dependencies (2026-09-01):** The same-head publisher and\n  consumer in [run 33458856298](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns\u002F33458856298)\n  successfully saved and restored a 1.66-GB dependency archive, but setup took\n  142s versus 86s with the ordinary store cache. Extraction took 82s versus 27s;\n  install improved only from 43s to 35s. Keep hosted Mac jobs on the ordinary\n  store cache. Reconsider only with measured total setup savings, including\n  transfer, extraction and frozen reconciliation, not a successful cache hit.\n- **Actions-artifact checkout (2026-08-16):** Do not recommend replacing the\n  shared Blacksmith Git fetch with a preflight-produced workspace or `.git`\n  artifact. [PR #124818](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fpull\u002F124818)\n  measured a 16s Blacksmith checkout baseline versus 7s hosted. The best direct\n  artifact variant cost 1s to pack, 3s to upload, and 11s median to restore;\n  including the serial prefix left only about 1s median improvement and\n  regressed Blacksmith's fast-fetch runs. The official artifact client was\n  worse: [run 31971531521](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns\u002F31971531521)\n  measured 22s median download plus 2s materialization. Blacksmith's fast\n  Actions-cache path does not imply fast Actions-artifact downloads. Reconsider\n  only with measured end-to-end proof for a different transport, including its\n  producer cost and fast-fetch regressions.\n\n## First Checks\n\nBefore changing CI, collect current pressure:\n\n```bash\ngh api rate_limit --jq '{core:.resources.core,graphql:.resources.graphql,search:.resources.search,actions_runner_registration:.resources.actions_runner_registration}'\ngh run list -R openclaw\u002Fopenclaw --limit 20 --json databaseId,status,conclusion,workflowName,event,headBranch,createdAt,updatedAt,url\ngh run list -R openclaw\u002Fclawsweeper --limit 20 --json databaseId,status,conclusion,workflowName,event,headBranch,createdAt,updatedAt,url\ngh api repos\u002Fopenclaw\u002Fclawsweeper\u002Factions\u002Fruns\u002F\u003Crun-id>\u002Fjobs --paginate --jq '.jobs[] | {id,name,status,conclusion,labels,created_at,started_at,completed_at,runner_name,runner_group_name}'\nblacksmith testbox list --all\ncurl -fsS https:\u002F\u002Fclawsweeper.openclaw.ai\u002Fapi\u002Fstatus | jq '{generated_at,fleet,diagnostics:{errors:.diagnostics.errors}}'\ncurl -fsS https:\u002F\u002Fclawsweeper.openclaw.ai\u002Fapi\u002Fexact-review-queue | jq '{generated_at,review:.lanes.review,publication:.lanes.publication,state_writer,state_append}'\nnode scripts\u002Fci-run-timings.mjs --latest-main\nnode scripts\u002Fci-run-timings.mjs --recent 10\n```\n\nFor a suspicious queued run, inspect its jobs. A run-level `queued` status does\nnot reveal whether the job is waiting on dependencies or has no eligible\nrunner. Compare `created_at`, `started_at`, `labels`, and `runner_name`. Recheck\nstale queued runs live before canceling them; cancel only runs proven obsolete.\n\nTestbox `warmup` confirms lease creation, not runner readiness. An initial\n`queued` snapshot without `providerMetadata.runURL` does not establish a capacity\nshortage. Use that URL to inspect the exact workflow once associated. An assigned\n`check` runner performing setup is hydration; a confirmed admission or capacity\nqueue follows the existing stop-owned-allocation policy. Do not infer association\nfrom the newest workflow run or wait on a confirmed capacity queue.\n\n`scripts\u002Fci-run-timings.mjs` start delay can include workflow dependency wait\nplus runner queue time. It is trend evidence, not runner-pressure proof alone.\n\nRead:\n\n- `.github\u002Fworkflows\u002Fci.yml`\n- `.github\u002Fworkflows\u002Fcodeql-critical-quality.yml`\n- `docs\u002Fci.md`\n- `test\u002Fscripts\u002Fci-workflow-guards.test.ts`\n- `test\u002Fscripts\u002Fci-workflow-planning.test.ts`\n- `test\u002Fscripts\u002Fci-workflow-evidence.test.ts`\n- touched planner files under `scripts\u002Flib\u002F*ci*`, `scripts\u002Flib\u002F*test-plan*`, or\n  `scripts\u002Fci-changed-scope.mjs`\n\n## Diagnose The Bottleneck\n\nClassify the issue before changing caps:\n\n- **Runner-registration throttle:** many jobs queued before runner assignment,\n  Blacksmith\u002FGitHub reports 403\u002F429 or spam-style 422 responses from\n  `generate-jitconfig`, and API core quota is still healthy. Treat 422 as this\n  signal only when the request payload is otherwise valid. Fix burstiness and\n  Blacksmith job count.\n- **Blacksmith capacity:** Blacksmith dashboard shows actual concurrency caps or\n  unavailable capacity. Do not solve this with GitHub workflow fanout alone.\n- **Blacksmith Testbox control plane:** list, warm, status, or run calls time out\n  before a lease is returned. This is separate from Actions runner registration\n  and Actions job capacity. Trusted source may use the documented local\n  fallback; untrusted source stays blocked.\n- **Unavailable runner label:** a job is queued with a custom `runs-on` label,\n  `started_at` and `runner_name` remain empty, and no eligible runner exists.\n  Restore an available hosted or registered label; fanout cannot fix it.\n- **Workflow dependency wait:** the job is queued but required predecessors are\n  not terminal. Fix or wait for the dependency; do not call the whole delay\n  runner queue pressure.\n- **OpenClaw test runtime:** jobs start quickly but one lane dominates wall time.\n  Use `$openclaw-test-performance` instead of runner tuning.\n- **Real failing CI:** one job fails after starting. Use `$github:gh-fix-ci` or\n  `$openclaw-testing`, not this skill.\n- **ClawSweeper review backlog:** review pending\u002Fready grows while publication\n  and state writers remain healthy. Tune review admission\u002Fworkers in\n  `openclaw\u002Fclawsweeper`.\n- **ClawSweeper publication backlog:** publication pending\u002Fready and oldest age\n  grow, net drain is zero or negative, or dead letters rise. Inspect publication\n  batches, state-writer coordination, and GitHub mutation latency first.\n- **State materializer\u002Fappend backlog:** `state_append.pending_rows`,\n  `pending_bytes`, or oldest age grows while the materializer is queued or\n  absent. Recover that sole drain first; more review workers make it worse.\n\n## Registration Budget Math\n\nEstimate worst-case registrations for a change before editing:\n\n```text\nnew Blacksmith registrations ~= number of Blacksmith jobs that can become queued\ninside one 5 minute window\n```\n\nFor matrix jobs, count every row that can start in the 5-minute window.\n`strategy.max-parallel` only caps simultaneous rows; short rows can turn over\nand register more runners before the window resets. Use job duration, retries,\nand queue turnover to justify any lower estimate. Add non-matrix Blacksmith jobs\nsuch as `preflight`, `security-fast`, `build-artifacts`, and platform lanes.\n\nFor repeated pull-request pushes, multiply by the number of runs expected to\nreach Blacksmith admission in the same 5-minute window, including runs canceled\nafter admission. Canonical `main` uses two run-number-parity slots. Each slot\nkeeps one active non-canceling run and one coalesced pending tip. Budget for up\nto two active main matrices plus their two pending tips entering the next\nadmission wave, not every intermediate merge.\n\nReject a change unless the org-level worst case stays below about 60% of the\nlive bucket. With the current 10,000-registration bucket, keep planned\nBlacksmith burst load under 6,000 registrations per 5 minutes with headroom for\nClawSweeper, ClawHub, Clownfish, OpenClaw RTT, and Clawbench.\n\nNative compact plans admit 90 rows and GitHub-hosted plans 96; final Node caps remain 70 push and 130 PR rows.\nThe current automatic main\u002FPR source has a conservative union of 71 potentially\nself-hosted non-Node rows, including five core-lint stripes for fork PRs,\nfive type stripes, five Windows rows, and thirteen UI E2E rows. Retain an 84-row\nallowance with thirteen rows reserved: `4 × 154 + 21 × 214 = 5,110` for the\nfour-main\u002F21-PR arrival envelope, leaving 890 below the 6,000 reference target.\nThe six extension-lint rows remain hosted. Manual\u002Ffrozen releases and other\nworkflows are outside this envelope. This is conditional planning, not live\norganization-wide capacity proof; older 5,010\u002F5,085\u002F5,160 examples below describe\nhistorical inventories and do not replace this source-audited reserve.\n\n## Safe Levers\n\nPrefer these in order:\n\n1. Preserve cancel-in-progress for superseded pull-request heads.\n2. Preserve canonical `main` as two non-canceling parity slots; each slot's\n   default pending run coalesces to the newest tip.\n3. Move high-frequency, short, non-build jobs to `ubuntu-24.04`.\n4. Reduce matrix rows by bundling related tests inside one runner job when the\n   combined job stays under timeout and keeps useful failure names.\n5. Lower `strategy.max-parallel` for bursty Blacksmith matrices.\n6. Right-size runners from timing evidence. Use fewer\u002Flarger jobs only when\n   elapsed time improves enough to justify registration count.\n7. Split truly slow tests with `$openclaw-test-performance`; do not hide a slow\n   test problem by registering more runners.\n\nDo not:\n\n- add another Blacksmith installation expecting a higher registration bucket;\n- move CodeQL Critical Quality back to Blacksmith;\n- raise all `max-parallel` values at once;\n- make manual `workflow_dispatch` runs cancel normal push\u002FPR validation;\n- delete coverage just to reduce runner count;\n- treat cancelled superseded pull-request runs as failures without checking the\n  newest run for the same ref.\n- cancel old queued runs from a stale snapshot; re-query the exact run first and\n  preserve any current run that still owns live work.\n\n## Current OpenClaw Knobs\n\nThese are intentionally guarded by the `ci-workflow-guards`,\n`ci-workflow-planning`, and `ci-workflow-evidence` tests under `test\u002Fscripts\u002F`:\n\n- Current-target Control UI locale checks share an already-selected public\n  artifact producer on real PR\u002Fpush\u002Fschedule events. Keep verification before\n  generators, settle the existing strict\u002Fadvisory outcomes after build diagnostics,\n  and route the logical locale gate to that explicit result. Dispatches, frozen\n  and compatibility targets, and standalone locale selections retain their job.\n  Hosted row accounting omits only the shared locale row; no build is newly selected.\n\n- `CI` concurrency key version, PR cancellation, and canonical `main`'s two\n  non-canceling parity slots, each with one coalesced pending tip.\n- `preflight` starts immediately without a debounce or standalone admission job.\n  `security-fast` waits for its hosted budget decision and still runs after\n  preflight failure unless the workflow was canceled. The protected `vitest-cache-warm` workflow\n  publishes the immutable semantic dependency archive after setup succeeds,\n  in an independent short job. Dependency and code publishers serialize per\n  backend\u002Fplatform\u002Fref without a workflow-wide lock or cross-platform dependency.\n  Hybrid adds a bounded hosted tooling\u002Fcontract\u002FUI seed and native SDK archive,\n  without repeating the full Linux build. Docs-only pushes skip warming. The split\n  adds one Blacksmith registration per eligible warmer admission, not per CI job;\n  include short-publisher turnover in burst estimates. Preflight and downstream Node jobs are\n  restore-only consumers on eligible self-hosted runners. Exact misses and\n  hosted paths, including Mac Node jobs, use the ordinary pnpm-store cache.\n- Ordinary canonical same-repository hybrid first attempts keep `preflight`,\n  `pr-failure-report`, and `ci-gate` on hosted Ubuntu. October 15's 26-PR sample\n  found 148 minutes of Blacksmith preflight queueing, with a 12.9-minute p75.\n  Fork first attempts, RunsOn, and admitted qualification\u002Frelease dispatches\n  retain their existing routes. Count these mandatory hosted controls before\n  optional offload; keep the 45-row ceiling and all job\u002Fworker limits.\n  Core lint uses the 16-class on canonical automatic first attempts with an\n  unset, `blacksmith`, or `hybrid` backend, including fork PRs. Admitted\n  qualifications retain their existing routes. The first packed lint row took\n  621s on the 8-class; retain four\n  actual CPUs for that row. The second packed row later exceeded its existing\n  15-minute limit on the 8-class, so it uses the same 16-class. This adds no\n  jobs or registrations and keeps the deadline and complete stripe inventory. The gate has no checkout or dependency setup; retries, ordinary\n  manual dispatches, noncanonical contexts, and the GitHub override stay hosted.\n  Core lint additionally retains hosted routing for frozen targets. Normal hybrid\n  main\u002Fsame-repository PRs add two lint assignments; fork PRs can add six because\n  their logical GitHub check profile emits five lint rows. These fit the fresh\n  71-row union and reserved 84-row non-Node allowance described above.\n  Automatic canonical RunsOn and fork hybrid first-attempt `preflight` uses\n  the existing 4-class, matching default Blacksmith preflight. The former 16-class\n  placement addressed hosted queue stalls. October 13 observations found 610\n  4-class runs with no OOMs and 113s p95 duration; full and changed manifest plans\n  also fit two CPUs and 4 GiB without swap with unchanged outputs. Keep the\n  logical planner profile, cache trust, and 20-minute deadline. Hybrid\u002FRunsOn\n  retries, manual dispatches, noncanonical contexts, and the `github` override\n  retain hosted routing. Monitor assignment latency before claiming rollout savings.\n  `security-fast` stays hosted\n  outside eligible hybrid first attempts and when the bounded hosted plan is admitted. Security hooks use pinned installed packages\n  and local hook definitions, without remote Git initialization. The `github`\n  outage override remains intact. Ordinary same-repository hybrid controls add\n  at most one Blacksmith security registration when optional hosted admission is\n  closed, none when admitted; fork hybrid first attempts retain up to three,\n  and normal Blacksmith runs retain their existing control registrations. All occur in the reserved non-Node inventory.\n  Selected baseline ratchets and Node rows start independently after preflight.\n  Keep the standalone ratchet owner and exact merge-parent\u002Fbase checks; the final\n  gate still requires every selected ratchet to pass. Same-repository\n  hybrid first attempts use the existing 4-class for the ratchet job, with its\n  measured 91-second bound adding at most 6.07 class-vCPU-minutes and no jobs.\n  Preserve the existing hosted fallbacks and deadline.\n  The existing `check-plan` prerequisite uses the 16-class for shared compiler\n  snapshot memory on canonical automatic first attempts with an unset,\n  `blacksmith`, or `hybrid` backend, including fork PRs. Same-repository hybrid\n  PR first attempts instead use hosted planning with the existing serial\n  compiler discovery mode; reserve that mandatory row before optional offloads.\n  Never move the complete compiler snapshot onto the smaller hosted runner.\n  Fork core type stripes\n  with an unset or `blacksmith` backend also use the 16-class on those attempts;\n  hybrid health admission retains its existing placement rules. These routes\n  add paid assignments, not jobs. Preserve logical GitHub stripe coverage,\n  restore-only PR caches, and same-repository cache trust. The GitHub override,\n  retries, ordinary manual and frozen targets, RunsOn planners, and noncanonical\n  contexts retain hosted planning. Admitted qualification dispatches keep their\n  existing routes. Fork standalone ratchets stay hosted. See\n  `docs\u002Fci\u002Frunners.md` for the current routing and `docs\u002Fci\u002Frouting-costs.md`\n  for measured latency and cost; older 4-class planner estimates no longer apply.\n  Optional compiler\u002Fcheck offloads reject observed hosted assignment waits at\n  sixty seconds; the former three-minute cutoff exceeded the latency objective.\n  API and job deadlines remain unchanged.\n  PR jobs finish after sibling failures. `pr-failure-report` waits for the\n  planned jobs and reuses `ci-known-main-red.mjs` to classify each failed or\n  timed-out job against the newest completed scheduled main CI run. Matching\n  job names\u002Fshards and supported failure signatures are pre-existing; a main\n  pass or different signature is new; missing jobs or evidence are unknown.\n  Job-name-only matches are labeled in the reason; check their failing tests\n  against main before attributing the failure.\n  Its table and JSON output reach `openclaw\u002Fci-gate`; the existing gate result\n  and known-main-red allowance stay unchanged. Superseded-run cancellation,\n  runner routes, concurrency and fanout caps remain unchanged. The report\n  consumes one existing non-Node reserve slot: the 71-row union\n  leaves thirteen inside the unchanged 84-row allowance and 5,110 bound.\n\n- Automatic canonical hybrid first attempts count every selected hosted row in\n  preflight. `HYBRID_HOSTED_BASE_ROW_LIMIT = 40` admits at most two optional\n  rows within `HYBRID_HOSTED_ROW_LIMIT = 45`: security and browser-extension\n  E2E. Control UI unit rows retain the 8-class on eligible first attempts.\n  Above 40 base rows, retain the optional rows' existing\n  Blacksmith routes; an eligible base above 45 warns with counts and retains\n  the complete base manifest. The budget limits optional admission, not coverage.\n  Record base\u002Ftotal rows and compare the actual workflow expansion in guards.\n  This never expands test coverage or workers; Control UI E2E shards, QA,\n  real-Gateway, Android, and compiler-heavy jobs retain their existing routes.\n  Frozen\u002Fmanual targets, retries and fully hosted fallback\n  manifests remain outside this first-attempt limit, including existing >45-row\n  fallbacks. Do not change the backend variable or existing caps to enable it.\n- Current extension-package-boundary checks request the 16-class in both the\n  additional-check matrix and shared SDK producer; frozen targets retain the\n  32-class. The existing two-CPU compiler reserve admits two children on the\n  observed four-CPU 16-class allocation. Keep that resource guard authoritative.\n  Compare equivalent workloads and cache states before claiming savings;\n  historical 16\u002F32-class runs also differed in compiler optimization. See\n  `docs\u002Fci\u002Frouting-costs.md` for sizing evidence. No jobs, registrations,\n  permissions, compiler checks, or hosted eligibility are added.\n  The package-boundary row has a 40-minute whole-job budget: three hosted\n  four-CPU attempts hit the former 20-minute limit, with about 19 minutes in\n  SDK preparation and 126 compiles before final validation\u002Fcanary\u002Fcleanup.\n  One completed both compile and canary but still exceeded the job deadline.\n  Two hosted release validations then passed both checks (128 plugins) and\n  were cancelled at the former 30-minute limit.\n  Compiler concurrency, complete inventory, receipt guards, canary, and routing\n  remain unchanged.\n- The Plugin SDK API diff row also has a 30-minute whole-job budget. Two hosted\n  runs spent 722 and 725 seconds rendering the base, then hit the former\n  20-minute deadline during the candidate render. Keep both complete revision\n  renders and the existing eight-CPU\u002F24-GiB floor for two render workers;\n  smaller hosts remain serial. Other additional-check groups retain 20 minutes.\n- Current fast plugin\u002Fchannel contract families each share one checkout\u002Fsetup.\n  Their two weighted process envelopes run sequentially with unchanged include\n  lists and package commands; channel invocations retain four project slots and\n  one worker per project. Any nonzero exit stops admission of the next envelope.\n  Frozen targets retain their original separate rows.\n- CI matrix caps: fast\u002Fcheck lanes at 12, Node test shards at 130 only for\n  PR first attempts, including forks, on a non-frozen Blacksmith or hybrid Node plan, and otherwise 96. When selected outside ordinary PRs, Windows stays at 5.\n  Android uses 4 for canonical Blacksmith push\u002FPR first attempts, including forks, otherwise 2.\n  Hosted plans, RunsOn, retries, main, and all manual\u002Fqualification dispatches\n  retain 96. This removes a second admission wave for 97–130-row PRs without\n  adding jobs or planned vCPU-minutes. Keep the 130\u002F70 final PR\u002Fmain row caps and 90 native\u002F96 hosted compact\n  caps and 5,110-registration arrival envelope; it already counts every PR row\n  inside five minutes. Actual provider capacity and the wall need native proof. Native compact profiles have an enforced 90-row budget and hosted profiles 96; plugin\n  fallback has a 50-row budget, and the final Node matrix enforces 70 push or\n  130 PR rows, including precise plans. Preflight reserves actual appended\n  plugin Node rows in compact admission so existing hosted tooling compaction\n  can meet that tighter budget; dist rows remain outside the Node budget and\n  inside the compact cap. Excess inventory fails preflight.\n- When selected outside ordinary PRs, Windows consumes the complete two package-script inventories and balances\n  whole files into up to five rows. Current measured inputs need five to keep\n  the longest prediction below 420 seconds (four predict 489, five predict 412). Each\n  row retains serial projects and shared file fixtures. Self-hosted Windows uses\n  four Vitest workers; hosted fallback uses one. Selected files enable file\n  parallelism while single-file project budgets remain unchanged.\n  Group by canonical project metadata; keep runtime consumers in one preparation\n  row. Elapsed file costs include imports\u002Fhooks instead of concurrent case sums.\n  Frozen targets without the planner retain their original two rows. Native\n  runner capacity must be measured; a max-parallel setting is not capacity proof.\n  Budget three additional non-Node registrations: the conservative full-tier\n  envelope becomes `4 × 153 + 21 × 213 = 5,085`, with 915 below the historical\n  6,000 target. Earlier 5,010 calculations below describe the two-row inventory;\n  do not spend PR proof savings or raise the final 70\u002F130 Node caps.\n- PRs and exact-head PR fallback dispatches omit the Docker published-upgrade\n  survivor, while retaining owner-selected Docker lanes. They omit QA smoke,\n  real-Gateway UI, named built-process verifiers, and the explicit complete-file\n  process-proof inventory. Main\u002Fordinary manual CI retains that proof, including\n  Full Release Validation's exact-target normal_ci child. PR unit\u002Fboundary and\n  mocked-Gateway owners stay selected; no blanket E2E suffix filter is permitted.\n- macOS Swift main-tier and PR `release_gate` CI runs complete app tests\n  plus lint\u002Fschema guards in `tests`, alongside independent OpenClawKit trait,\n  OpenClawKit test, and Swabble test graphs in `packages`.\n  Ordinary full-scope manual validation adds independent release compilation,\n  moves the guards to `release`, and retains health renders in `tests`.\n  All phases use Xcode 27 on GitHub-hosted `xcode-27` (preview macOS 27),\n  `max-parallel: 2`, and the existing 30-minute budget. The toolchain rollout\n  changes no hosted\u002FBlacksmith placement, job counts, coverage, or Swift 6.3\n  source-language minimum. Require complete native proof and old\u002Fnew job timings.\n  The existing package split adds one hosted job and no Blacksmith registrations;\n  measure complete hosted timing including duplicated setup. Packages do not\n  restore or save app build products. Build caches stay phase-owned; the sole eligible shared\n  SwiftPM cache writer is regular `tests` or full-validation `release`.\n  Debug test\u002Fpackage builds disable indexing and use Swift line-table debug\n  information, retaining coverage and source-line backtraces. Test build caches\n  use the v7 profile; Release flags and v6 caches remain unchanged. Local debug\n  builds retain full debugger metadata.\n- Android regular CI uses four test\u002Flint rows, including benchmark compilation\n  in the Kotlin-lint row when benchmark\u002Fbuild\u002Fdependency inputs change or the\n  changed-path manifest is unusable. Full manual validation retains all six\n  rows and memory-bounded phone\u002FWear\u002Fbenchmark builds without duplicate lint.\n  Canonical Blacksmith push\u002FPR first attempts, including forks, overlap four rows.\n  The GitHub override, retries, manual dispatches, schedules, and noncanonical\n  repositories retain two; frozen task contracts and npm native deferral are unchanged.\n- iOS admitted main pushes and PR `release_gate` CI run one required Debug build\n  and Swift lint smoke; hourly main-tier CI retains the tests phase. Ordinary\n  PRs defer both. Ordinary full-scope manual validation retains Release\n  and Debug\u002Fnative-test phases, both screenshot shards, and the evidence reducer.\n  Frozen full-manual targets keep their Debug-only contract without screenshots;\n  npm qualification still defers native jobs. All iOS build phases and screenshot\n  shards use Xcode 27 on GitHub-hosted `xcode-27` from the first attempt.\n  All four Periphery scans use the same toolchain and retain the checksum-pinned\n  3.8.0 release pending native compatibility proof for both app scans and both\n  shared consumers. Preserve zero findings and exact-USR intersection; selecting\n  the new runner is not compatibility proof.\n  The conservative full-tier non-Node inventory, including Control UI performance, is\n  87 rows, or 88 for historical UI targets. Excluding those four hosted rows\n  plus all three macOS Swift phases and the always-hosted aggregate gate leaves at\n  most 80 potentially eligible jobs. The enforced Node caps therefore give\n  150 registrations per main run and 210 per PR:\n  `4 × 150 + 21 × 210 = 5,010` in the retained peak arrival envelope.\n  The old 19-arrival estimate is obsolete. The remaining 990 below\n  the 6,000 reference target must cover adjacent repositories, releases and\n  carryover; the bounded 2026-09-02 census did not prove that upper bound.\n  Treat a single PR concurrency trial separately from a global rollout.\n  A shared-token quota response does not establish organization-wide usage.\n  Budget all six npm qualification jobs and the actual full-release children;\n  ordinary manual check rows can still use Blacksmith outside hybrid mode.\n- Canonical PR Node tests use one precise changed-target job when possible;\n  broad, deleted or unknown changes fall back to the compact full-suite plan\n  plus affected plugin coverage. Current PR planner errors fail preflight.\n  Targeted plans retain the full built-artifact\n  boundary gate. `main` uses compact integration; manual and release runs use\n  full named shards.\n- `RELEASE_ONLY_TOOLING_SHARDS` in the Node planner owns the complete\n  `core-tooling` family: ordinary tooling stripes plus the isolated\u002FDocker\n  catalogs. Matching non-E2E\u002Fnon-live maintainer leaves in mixed fast configs\n  join the same tier. Preserve their ordinary, isolated or fake-timer config,\n  process pins and product neighbors; reduced groups need subset timing identities.\n  The five `test\u002Fscripts\u002F*.e2e.test.ts` product integration gates stay outside\n  this tier. Product-only canonical PRs omit the family in precise and compact\n  fallback plans. Tooling tests or owners select the full family: `scripts\u002F**`,\n  `src\u002Fscripts\u002F**`, `test\u002F**`, `.github\u002F**`, `config\u002F**`, root package\u002Fpnpm inputs,\n  tooling configs, and other tooling facts owned by\n  `scripts\u002Ftest-projects.test-support.mts`, including Docker, agent\u002FCrabbox,\n  app script\u002FFastlane and extension script\u002Fpackage inputs. Directly changed\n  tooling tests therefore retain PR coverage. Keep each config's complete\n  inventory, exclusions, process metadata, timing floors and runner policy.\n  Every CI manual dispatch includes the family; Full Release Validation's\n  frozen-candidate `normal_ci` child executes it before regular publication\n  admission. An independent duplicate release test is not required: these same\n  tests supply that proof. Fork repositories retain full tooling because they\n  do not use canonical targeting. Main already omitted named tooling shards;\n  it now also omits maintainer leaves formerly retained by fast configs,\n  including on tooling-owner changes. A regression introduced by a later main\n  merge is invisible to main CI until an affected PR or full validation runs it. Existing\n  `ci-gate` aggregates selected jobs, without requiring tooling proof against a\n  later main revision. Report historical file-seconds, emitted rows, runner-class\n  counts and predicted longest jobs separately; fewer test-seconds do not prove\n  a workflow wall-time saving.\n  CI's plugin flag stays false even on dispatch because Plugin Prerelease owns\n  that separate sweep. Plugin-sensitive PR changes override that exclusion in\n  both precise and fallback plans, including bundled metadata coverage. Do not infer release inclusion from a shard name or\n  conflate regular full-campaign publication with approved preflight-only beta\n  exceptions. Product security, migration, storage, protocol, SDK and\n  update-correctness tests are outside this move.\n- The combined Node matrix admits compact and plugin descriptors by estimated\n  duration within the same cap. Catch-all, QA and provider configs use the\n  existing 90-file envelope budget with native Vitest sharding; retain complete\n  config discovery, exclusions and process isolation. Count every appended\n  plugin row, including the five added QA\u002Fprovider rows, in the burst envelope.\n- Precise and fallback plugin groups retain separate child processes, including process-bounded\n  configs. Compatible envelopes, including repeated configs, run one at a time\n  within 300 predicted seconds without a pair-count limit; expanded serial compact\n  jobs use 210. Envelopes with identical preparation mode, runner and dist\n  requirements share one build before their separate sequential processes;\n  packing charges that preparation once. Different preparation modes stay\n  separate. Each job retains the 20-file database-worker ceiling and 300-second\n  estimated budget; observed hosted durations must be reported separately.\n  The earlier 124-envelope inventory projected 50 extension rows and\n  125\u002F119\u002F130 PR Node rows on Blacksmith\u002Fhybrid\u002FGitHub, with 57\u002F46\u002F55 push Node\n  rows and 77\u002F71\u002F82 compact PR rows. Those are historical inventory projections;\n  validate the current inventory against the unchanged 50\u002F130\u002F70\u002F90\n  extension\u002FPR\u002Fpush\u002Fcompact caps. Each original envelope retains\n  its file\u002Fprocess bounds, native shard arguments and worker limits. The complete supplemental boundary list runs in one job\n  with four concurrent checks and one full-root focused-rule scan.\n- Measured Blacksmith chat\u002Fsession, Gateway core-3 and infrastructure storage\u002Fstate\n  outliers reuse the existing file splitter. Preserve serial execution, worker\n  pins and complete timing-history floors; no blanket increase in sharding.\n- Blacksmith and hybrid compact bins with multiple ordinary groups request the\n  existing 32-vCPU class and two child slots with an initial 360s aggregate budget.\n  Final compaction can combine already-admitted parallel bins within 500s;\n  it does not promote serial jobs or change worker limits. Preserve the separate\n  300s ordered two-slot queue bound and runtime preparation charge.\n  Gateway-exclusive serial bins and native numbered tooling bins use a 300s test\n  budget; hourly hybrid main validation packs its tooling rows within 420s plus\n  60s setup to keep headroom under its 77-row cap. Native tooling rows containing\n  the partitioned changed-Node planner proof retain a 150s test budget through\n  initial and measured packing. The partition keeps\n  two workers and serial outer admission. Ordinary self-hosted bins share promoted capacity across logical\n  classes; the existing group exchange fills stranded slots without raising caps.\n  Parallel admission also bounds the ordered two-slot queue at 300 test seconds;\n  matrix predictions use that same queue. Admission retains aggregate work caps\n  and separately charges the measured 60s runtime preparation.\n  Hosted hourly tooling retains its 720s total budget (660s work plus 60s setup)\n  with complete hosted file prices and no native wall observations.\n  Compatible two-slot bins use the time budget without the ten-group cutoff;\n  serial bins retain that cutoff. Blacksmith serial bins retain 200\u002F276s, hybrid serial bins retain 210s,\n  exclusive bins retain 150s by default, and groups above their serial cap stay alone.\n  Complete ordinary hybrid bins containing only non-build CLI groups may use\n  250s and co-locate split siblings, provided each original child still fits\n  150s. Keep file splits, workers, process isolation and other profiles unchanged.\n  Initial packing separates runtime consumers from ordinary groups. Complete\n  hybrid main and PR runtime-placement observations apply only after file splitting;\n  precise changed-file templates retain their original capacity and floors.\n  Typed observations preserve configs, environment, complete files and build mode.\n  Prefer an exact measurement; otherwise use the maximum compatible contained\n  workload as an advisory floor, never sum overlaps or treat globs as whole files.\n  Whole pinned runtime groups may move to existing compatible ordinary jobs under\n  a 360s budget including the 60s build reserve. Keep runner anchors,\n  test partitions, invocation counts and worker limits. An ordinary recipient\n  becomes serial, explicitly retaining its old parallel groups' two-worker budget\n  while preserving their prepared timing identities and complete parent\n  generations. The CI executor applies the smaller of the\n  supplied job ceiling and group cap. This may add one runtime preparation while\n  reducing requested process slots; measure the tradeoff without adding jobs or\n  registrations. Equal maximum estimates prefer more recipient headroom.\n  Reapply shared family, group-count and budget admission to both replacements;\n  never suppress coverage or count a runtime subset as a complete parent.\n  An unfit optimization retains the runnable plan and its truthful estimate.\n  Compare recipients with the donor job's fixed anchor, not only its group class.\n  Exclusive, private-QA, dist and hosted policies stay unchanged.\n  Affordable generated CLI runtime children may share one preparation in an\n  exclusive serial bin within the same 150s budget; fixed stripe families remain\n  separate. Other hybrid exclusive\u002Fdist sharing is unchanged. Complete inventories\n  remain intact.\n  The canonical shard executor admits two CI children only with at least eight\n  available CPUs and 24 GiB actual memory; otherwise it admits one. Inner project\n  parallelism stays one during outer overlap and each overlapping child keeps two Vitest workers.\n  A serial changed-extension envelope may overlap two source-only Telegram database-worker\n  singleton processes, retaining two workers per process, only with scheduler-owned caches,\n  at least two actual CPUs and 7.5 GiB effective memory (the smaller of physical memory and\n  a positive finite process constraint). Require self-hosted Linux, an explicit current-target\n  receipt (`FROZEN_TARGET=false`), and one unchanged Node invocation from the canonical\n  runtime selector; `bun-compatible` can still select Node. Other shapes, runtimes and\n  unknown\u002Finsufficient capacity retain one inner process. Use the actual inner-cap receipt\n  in timing identity; parallel envelopes never supply serial singleton or wrapper-overhead\n  prices. Keep conservative serial placement until qualified exact parallel measurements exist.\n  Gateway methods use four workers in serial, non-frozen self-hosted jobs with\n  at least eight actual CPUs and 28 GiB memory, with the existing two-worker\n  fallback elsewhere. Keep its worker-specific timing identity and require\n  three original-shard replays plus sampled memory evidence when changing it.\n  The Gateway server-isolated\u002Fdatabase-worker family keeps two workers, including\n  roomy serial self-hosted jobs, to leave cold-startup headroom within its existing\n  test deadlines. Preserve host admission and fallback rules, other groups' pins,\n  hosted planning, complete inventory, cleanup, and old timing generations until\n  refit. The historical eight-worker qualification does not establish headroom\n  for the current fixture cohort.\n  The primary GitHub profile remains serial at 210s. Failed-job-only hybrid\n  retries retain the original wider matrix on hosted Ubuntu, clamp to one child,\n  and keep two workers per child; they can exceed the eight-minute normal-run\n  objective without changing existing deadlines. Fewer jobs must retain native\n  elapsed-time, actual memory and cleanup proof; requested labels are not capacity.\n- The whole Blacksmith agent-support group requests `blacksmith-32vcpu-ubuntu-2404`.\n  Its file inventory and resource-derived worker policy remain unchanged.\n- Precisely selected serial CLI, Gateway client\u002Fserver, and embedded-agent jobs\n  use the 16-class when every group has one qualified config, one or two explicit\n  files, and a two-worker pin or fallback. An explicit wider pin disqualifies the\n  group. Keep build, dist, memory, large-runner anchors, and unqualified configs\n  at planned capacity; resource-gated tooling tests are not qualified by this rule.\n  Apply capacity after packing; preserve inventories, runtime selection, timing\n  identities, and process boundaries. Full families retain their planned capacity.\n  RunsOn inherits the hybrid choice for these retained Blacksmith jobs.\n  The exact singleton `gateway-core` selection of\n  `src\u002Fgateway\u002Fmcp-app-extension-runtime.test.ts` and `agents-core` selection of\n  `src\u002Fagents\u002Fcli-runner.helpers.test.ts` also qualify under these guards.\n  Their five-file serial replay at `137e7b2abc87` passed 56 tests on each of Bun\n  and Node, using four CPUs and 15.42 GiB RAM. Whole-machine peaks were 5.00 and\n  5.22 GiB, with zero OOM kills and at most 268 KiB swap use. Other files in those\n  configs and unbounded or parallel infra selections retain planned capacity.\n  Native billed savings remain unverified.\n  The isolated LLM-boundary cache-stability file also qualifies when it is the\n  group's only file, under the same serial, worker, and preparation guards.\n  Its complete current-source replay passed all 19 tests with four CPUs,\n  12 GiB RAM, no swap, 4.23 GiB peak, and zero OOMs. Other isolated files,\n  including siblings in the same job, retain their planned capacity.\n  The singleton `src\u002Fgateway\u002Fboard-store.test.ts` selection also qualifies as the\n  job's only group, with an explicit two-worker pin, two-worker fallback, and\n  unchanged 28-GiB worker-admission threshold. Its five-test replay passed through\n  the CI shard executor in 40.78 seconds on four CPUs and 15.42 GiB RAM. Maximum\n  process RSS was 3.17 GiB, not an aggregate VM peak. Keep all other database-worker\n  selections and mixed jobs at planned capacity; native billed savings are unverified.\n- Source-only serial Blacksmith tooling bins use the 16-class after packing,\n  retaining logical classes, names, file inventories, and two-worker pins.\n  Keep the 32-class for compiler\u002Fartifact capacity files, explicit runner or\n  memory anchors, builds, dist, mixed configs, and parallel jobs. Require complete\n  file lists; unknown envelopes retain their planned runner. The final capacity\n  rule does not change hosted or hybrid plans, packing, timing identities, or\n  registration counts. Tooling files use the shared worker scheduler; price their\n  current file costs by effective workers without dividing the longest file.\n  Docker helper fixtures retain their separate serial config. This does not\n  promote hosted or hybrid tooling as a family; capacity alone is not a measured speedup.\n  Hybrid compiler fixtures and worker-artifact CI keep their per-file 32-class floor.\n  The latter needs eight CPUs \u002F 24 GiB for all six cases, and its two-CPU screen\n  exceeded the existing memory reserve before the three resource-gated cases ran.\n- Numbered tooling measurements in `toolingFileSeconds` drive file packing with\n  native profile costs; a hosted fallback scales measured Blacksmith costs.\n  The daily refit samples successful jobs from the newest five contributing\n  completed PR CI runs, including workflows where other jobs failed.\n  Those measurements describe the PR merge-ref and update exact compact and tooling identities;\n  main compact and release sampling retain their existing provenance. Preserve\n  independent-run medians, runner profiles and partial-plan history. An explicit\n  `--tooling-run \u003Cid>` seed records its source and may use one successful run.\n  Verbose-only case sums are conservative packing costs when cases overlap,\n  not measured file walls. Do not discount them to make row caps pass.\n- Eligible main\u002Frelease Docker seed jobs request `blacksmith-16vcpu-ubuntu-2404`;\n  ordinary manual dispatch retains hosted routing. The weighted\n  scheduler and serial declaration compiler policy stay unchanged.\n  Hourly main-tier CI and admitted main pushes select the published-upgrade\n  survivor independently of changed paths. Main pushes require\n  `OPENCLAW_CI_ON_PUSH=true` to admit full CI. Ordinary manual and full release\n  validation select all five lanes when supported by the target, retaining\n  `legacy-operator-state` with `auto-auth`. Full Release Validation reaches this\n  proof through `normal_ci`; expanded Package Acceptance scenarios alone do not\n  replace its restart mode. PRs and exact-head PR fallbacks select the four\n  non-survivor lanes through `resolveChangedDockerSeedLanes`' exact owner map.\n- `run_control_ui_performance` selects production UI, plugin browser, workspace\n  package, dependency\u002Fbuild\u002Fpolicy inputs and their relative import graph,\n  including tooling. Workspace package aliases require conservative package\n  ownership. Test-only files and unrelated runtime changes omit this lane;\n  manual runs, unknown paths and older planners retain coverage. Preserve the\n  target's existing performance-script capability checks.\n- Partial PR UI unit selections target three files per job within the existing\n  three-row cap and three-worker limit. Full UI owners and manual validation\n  retain their established shards, runtime policy and first-row WebKit checks.\n- Eligible Control UI E2E rows request the 16-vCPU class with unchanged live\n  backend\u002Fevent routing. Compact plans use six mocked Control UI shards with four\n  workers each, matching four observed CPUs per runner and retaining 24 aggregate\n  worker slots. Private source-server projects remain serial. The conditional\n  browser-extension row keeps its existing reuse and routing rules. Hourly main\n  uses the same compact plan without a changed-path inventory. Non-main full\n  manual, noncanonical, compatibility, and other unknown-path inventories retain twelve Control UI\n  shards plus one browser-extension row. Historical targets without the named-project contract retain four total rows on\n  Blacksmith or fourteen on GitHub\u002Fhybrid. Failed-job-only retries retain their\n  previously emitted matrix, including older six-shard Control UI plans; PR and\n  hybrid push retries use hosted Ubuntu. The 25-minute timeout, max-parallel 14\n  and conservative registration ceiling stay unchanged. The browser-extension row\n  stays on 8 unless the bounded hybrid plan admits it to hosted Ubuntu. The twelve-row 4:38 result in historical run 33695337496 used the\n  32-class with eight reported CPUs; it does not prove timing on the current\n  16-class route or refresh stale timing weights.\n- Current-target real-Gateway jobs use the 16-class and existing two-row planner\n  split; frozen or unclassified targets retain the 32-class. Ordinary PRs omit\n  them. Private preparation builds runtime, QA, and Control UI artifacts with\n  SDK declaration generation disabled; `build-artifacts` owns SDK declarations\n  and validation. Preserve browser workers, complete inventory, build-before-test\n  ordering, routing, deadlines, and caps. Further sizing changes require complete\n  job qualification, including preparation and desktop transport proof.\n- Current-target `build-artifacts` uses the existing 16-class after a complete\n  four-CPU\u002F15.42-GiB compute proof, including the unchanged parallel verifier wave.\n  SDK declaration generation uses one compiler program with its existing heap\n  budget and native headroom.\n  Eligible frozen or unclassified targets also request 16-class; hosted fallbacks, job counts,\n  concurrency and deadlines stay unchanged. Measured compute fit does not prove\n  queue savings; observe the next exact-head CI cycle.\n- Normal canonical hybrid first attempts use the existing four-part QA smoke\n  plan, removing two repeated checkouts, setups and private runtime builds.\n  Canonical `main` push\u002Fschedule first attempts on that plan use the 8-class\n  only with explicit non-frozen, non-compatibility classification. A cold private\n  runtime build and all 24 scenarios passed on two usable CPUs under a 7-GiB\n  no-swap cap (5.96-GiB peak, no OOMs). This does not qualify older backport\n  source: those targets may build with higher compiler concurrency. Other\n  contexts retain the shared 16-class\u002Fhosted\u002Frelease-group routing.\n  Blacksmith profiles retain four parts; GitHub profiles and fresh hybrid\n  retry\u002Fmanual plans retain six. Failed-job-only retries retain their original\n  matrix. Keep the complete scenario inventory, separate Matrix run, worker\n  limits, stagger, cleanup and deadlines. Measure the four-part jobs natively;\n  summed build intervals are not a wall-time saving estimate.\n  Main selection uses the existing QA\u002Fchannel\u002Fpackaging\u002Forchestration\n  owners. Manual and Full Release Validation retain the full profile; unknown\n  paths or older selectors retain supported coverage. Integration detection\n  outside these owners now waits for manual\u002Frelease validation. The burden\n  analysis projects about 1,526 Blacksmith vCPU-minutes\u002Fhour saved across Docker\n  and QA; zero failures in 20 Docker and 80 QA main jobs is limited evidence,\n  not a measured post-change saving. Keep backend settings, caps, budgets and\n  timeouts unchanged, and verify actual emitted rows and timings.\n- Full hybrid check plans may share central formatting and scripts lint with\n  existing core lint stripe 1 when its full command inventory contains only those\n  commands. Retain both original core stripes, the exact central selection and\n  changed paths, sequential execution, one lint thread and the 15-minute budget.\n  UI, root-test and wrapper guards keep their separate central row. Require\n  another remaining check row for the existing gate; targeted and other runner\n  profiles retain their layout. Run shared central lint after a core failure so\n  its diagnostics and failure remain visible. This removes one registration and\n  setup, without enlarging runner capacity or relaxing a check.\n- Current GitHub\u002Fhybrid test types use five canonical core stripe jobs plus\n  the central extensions\u002Fscripts\u002Froot tail. Eligible core-change PRs keep the\n  same rows: each validates the complete graph boundary and intersects selected\n  consumers with its original stripe. Empty intersections stay empty; ambiguous\n  selection falls back to every canonical graph across those same stripes.\n  Check existence only for compiler inputs: deleted Markdown and UI CSS paths\n  do not widen accompanying code changes; deleted compiler inputs retain full coverage.\n  Frozen targets retain two paired rows for stripes 1+2 and 3+4 sequentially,\n  with stripe 5 in the central row. Keep at most two compiler children per\n  stripe and one builder per child. A failing stripe stops its row; other\n  matrix rows keep running. Pure Blacksmith and targets without stripe support\n  retain the central path. Keep row caps and deadlines unchanged; measure actual\n  hosted completion rather than inferring wall-time savings from partitioning.\n- CPU-heavy test-type, core test-type stripe, and runtime-topology jobs in `ci.yml`\n  request `blacksmith-16vcpu-ubuntu-2404`. The separate `openclaw-npm-preflight.yml`\n  jobs retain `blacksmith-32vcpu-ubuntu-2404`. The 2026-09-01 x64 probe\n  [run 33538827388](https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Factions\u002Fruns\u002F33538827388)\n  measured requested 8\u002F16\u002F32 labels delivering 2\u002F4\u002F8 CPUs respectively. Treat\n  larger requests as a measured capacity workaround, never as worker counts.\n  Keep existing routing, fanout, and resource-based worker limits; reassess\n  sizing after provider allocation changes. See `docs\u002Fci.md` for the full table.\n- lower-weight Node\u002Fcheck shards on `blacksmith-4vcpu-ubuntu-2404`.\n- heavy retained Linux\u002FAndroid shards on `blacksmith-8vcpu-ubuntu-2404`.\n- CodeQL Critical Quality on `ubuntu-24.04` with no `blacksmith-` labels.\n- Where repository variables are available, `OPENCLAW_CI_RUNNER_BACKEND=github`\n  routes configurable `ci.yml` jobs to their existing GitHub-hosted fallback\n  labels. Unset or `blacksmith` preserves the normal Blacksmith-first route.\n  Fork first attempts cannot honor an unavailable override; they use Blacksmith\n  Node runners, check planning, core type stripes, and core lint stripes where\n  the current routing permits. Their logical GitHub profile and cache trust stay\n  unchanged. Fork retries use hosted runners.\n- Vitest transform and Node compile caches are restore-only in CI and use\n  immutable Actions caches; the main-push\u002Fdaily\u002Fdispatch warmer is their sole\n  writer. Build, QA and test orchestration consume its shared Node compile seed.\n  PRs create no runtime-cache archives.\n- Full compiled-worker seeds retain separate prebuild and postbuild archives.\n  The existing protected warmer publishes its already-prepared postbuild full\n  generation; only selected artifact-producer source verifiers restore it.\n  Runtime workers use separate live\u002Fcache slots so they cannot replace that\n  full seed. Keep byte, topology, runtime and exact output-path validation, the\n  uncached path when no archive arrives, and existing job\u002Fworker limits.\n\nWhen changing one knob, update `docs\u002Fci.md` and the guard test in the same PR.\n\n## Blacksmith Outage Circuit Breaker\n\nUse the repository variable only after confirming a Blacksmith outage or\nunavailable runner capacity. Do not set it merely for a failing test that has\nalready started.\n\n```bash\ngh variable set OPENCLAW_CI_RUNNER_BACKEND --repo openclaw\u002Fopenclaw --body github\n```\n\nWhere the override is available, degraded `ci.yml` jobs use the same hosted\nlabels and non-Blacksmith paths as manual dispatches and fork retries.\nBlacksmith-only Docker and sticky steps stay off, dependency setup uses the\nordinary Actions pnpm-store cache, and Android's large build uses separate\nlow-memory Gradle processes. Standard 4-core hosted runners make builds and\ntest lanes slower. Those jobs consume GitHub-hosted concurrency instead of\nBlacksmith registrations. Fork first attempts with unavailable repository\nvariables still use Blacksmith and must remain in the registration budget.\n\nFlip back after the outage by deleting the variable:\n\n```bash\ngh variable delete OPENCLAW_CI_RUNNER_BACKEND --repo openclaw\u002Fopenclaw\n```\n\nScheduled health detection and automatic flipping are a follow-up, not part of\nthe current circuit breaker.\n\n## Validation\n\nFor docs\u002Fskill-only changes, check the edited Markdown, its source claims and\nlinks, and `git diff --check`; runtime suites are unnecessary. For workflow or\nplanner changes, use the changed-file plan and focused tests for the touched\ncontract. These are available checks, not a mandatory bundle for every edit:\n\n```bash\nnode scripts\u002Frun-vitest.mjs test\u002Fscripts\u002Fci-workflow-guards.test.ts test\u002Fscripts\u002Fci-workflow-planning.test.ts test\u002Fscripts\u002Fci-workflow-evidence.test.ts\nnode --import tsx scripts\u002Fcheck-workflows.mts\nnode scripts\u002Fdocs-list.js\n.\u002Fnode_modules\u002F.bin\u002Foxfmt --check .github\u002Fworkflows\u002Fci.yml .github\u002Fworkflows\u002Fcodeql-critical-quality.yml docs\u002Fci.md test\u002Fscripts\u002Fci-workflow-guards.test.ts test\u002Fscripts\u002Fci-workflow-planning.test.ts test\u002Fscripts\u002Fci-workflow-evidence.test.ts test\u002Fscripts\u002Fci-workflow.test-support.ts .agents\u002Fskills\u002Fopenclaw-ci-limits\u002FSKILL.md .agents\u002Fskills\u002Fopenclaw-ci-limits\u002Fagents\u002Fopenai.yaml\ngit diff --check\n```\n\nIf `pnpm docs:list` tries to reconcile dependencies in a linked Codex worktree,\nstop and use `node scripts\u002Fdocs-list.js`.\n\nFollow the [shared review setup](..\u002Fautoreview\u002FSKILL.md) and the\n[maintainer landing workflow](..\u002Fopenclaw-pr-maintainer\u002Freferences\u002Flanding.md)\nfor review, proof, and authorized landing. Bind any CI watcher to the PR's full\n40-character head SHA:\n\n```bash\npython3 \"$HOME\u002F.agents\u002Fskills\u002Fautoreview\u002Fscripts\u002Fautoreview\" --mode branch --base origin\u002Fmain\nnode scripts\u002Fwatch-pr-ci.mjs \u003Cpr> \u003Chead-sha> --repo openclaw\u002Fopenclaw\n```\n\nFocused local proof; PR CI = broad proof. Testbox only for CI\u002Flocal gaps, immediate grant.\nObserve existing CI; never dispatch\u002Frerun\u002Fre-push just for green.\nCI fails → `pnpm test:ci-failed \u003Cpr>`; read classification, fix new failures →\n`pnpm test:ci-failed \u003Cpr> --run` until local pass → push once. Never local full-suite CI repair.\nProven red-main repairs: maintainer workflow direct-main rule. Other changes:\nnative PR route under existing user authorization. Never combine\n`OPENCLAW_TESTBOX=1` with `OPENCLAW_PR_GATES_REMOTE=github`.\n\n## Post-Land Monitoring\n\nAfter merge, watch at least one fresh main cycle and the adjacent repos:\n\n```bash\ngh run list -R openclaw\u002Fopenclaw --limit 20 --json databaseId,status,conclusion,workflowName,event,headBranch,createdAt,updatedAt,url\nfor repo in openclaw\u002Fclawsweeper openclaw\u002Fclawhub openclaw\u002Fclownfish openclaw\u002Fopenclaw-rtt openclaw\u002Fclawbench; do\n  gh run list -R \"$repo\" --limit 12 --json databaseId,status,conclusion,workflowName,event,headBranch,createdAt,updatedAt,url\ndone\ncurl -fsS https:\u002F\u002Fclawsweeper.openclaw.ai\u002Fapi\u002Fexact-review-queue | jq '.'\n```\n\nReport:\n\n- exact PR\u002Fcommit landed;\n- expected registration reduction or added headroom;\n- CI run status and slowest\u002Fqueued jobs;\n- queued job labels, runner assignment, and dependency state for any outlier;\n- Blacksmith Actions runner evidence separately from Testbox control-plane\n  health;\n- ClawSweeper queue pending, dispatching, leased, oldest pending age;\n- publication net drain\u002Fdead letters, state-writer queued\u002Fwaiting, and state\n  append rows\u002Fbytes\u002Foldest item;\n- any real failures that remain outside runner registration.\n",{"name":5,"description":7},"c37e3897be60e2db9db3aefba9cee92bcb193b51",".agents\u002Fskills\u002Fopenclaw-ci-limits",82862,"https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw","https:\u002F\u002Fopenclaw.ai","https:\u002F\u002Fgithub.com\u002Fopenclaw","Your personal, open source AI assistant.","2026-11-11 08:46:30",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add openclaw\u002Fopenclaw --skill openclaw-ci-limits",{"tool":56,"command":57},"bunx","bunx skills add openclaw\u002Fopenclaw --skill openclaw-ci-limits",{"tool":59,"command":60},"pnpm","pnpm dlx skills add openclaw\u002Fopenclaw --skill openclaw-ci-limits","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fopenclaw-ci-limits\u002FSKILL.md",true,[64],{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"agents\u002Fopenai.yaml","REFERENCE","参考文档",281,"https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fopenclaw-ci-limits\u002Fagents\u002Fopenai.yaml",[71,77,100,118,140,164],{"skillNo":72,"name":73,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":37},"01M698VP84FNM6G9MR1HPX7MF7","lobster","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fextensions\u002Flobster\u002FSKILL.md",[],[73],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":37},"01M698YY8QGQ7S8TJNKJG6VTPH","xurl","xurl CLI for authenticated X posts, replies, reads\u002Fsearch, DMs, media upload, followers, auth status, or raw v2 API calls.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Fxurl\u002FSKILL.md",[],[79,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99],"for","api","calls","replies","posts","upload","tap","install","brew","node","Media","search","npm","status","auth","cli",{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":37},"01M698YWT1CJ0WK88WB909R9RT","weather","Current weather and forecasts with web_fetch, falling back to wttr.in curl for locations, rain, temperature, travel planning.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Fweather\u002FSKILL.md",[],[102,107,108,91,109,92,110,111,112,113,114,115,84,116,117],"travel planning","travel","fetch","curl","https","help","planning","web","back","temperature","with",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":129,"publishedAt":37},"01M698YV2Q0R0JJKAWGFS21K0N","visualize","Create inline visuals for code and explanations, or author persistent OpenClaw dashboard widgets with show_widget.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Fvisualize\u002FSKILL.md",[124],{"categoryNo":125,"categoryName":126,"taxonomyType":127,"taxonomyTypeDesc":128},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[120,130,131,132,133,84,117,134,135,136,137,138,9,139],"widgets","openclaw dashboard","author","inline","show","code","create","visuals","dashboard","widget",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":154,"publishedAt":37},"01M698YS2TRJH9ENG28HD9CD87","trello","Manage Trello boards, lists, and cards via the Trello REST API.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Ftrello\u002FSKILL.md",[146,151],{"categoryNo":147,"categoryName":148,"taxonomyType":149,"taxonomyTypeDesc":150},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":152,"categoryName":153,"taxonomyType":127,"taxonomyTypeDesc":128},"01JBSEEDCAT000000000000030","开发工程师",[142,111,155,156,157,158,159,160,91,92,161,110,85,162,163],"cloud","manage","via","rest api","token","atlassian","jq","REST","developer",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":170,"publishedAt":37},"01M698YQ9Q3M4W78EWV2KSCSVW","tmux","Control tmux sessions\u002Fpanes for interactive CLIs: list, capture output, send keys, paste text, monitor prompts.","https:\u002F\u002Fgithub.com\u002Fopenclaw\u002Fopenclaw\u002Fblob\u002Fmain\u002Fskills\u002Ftmux\u002FSKILL.md",[],[166,91,171,172,84,173,174,175,176,177,178,179,92,180,181,182,183,184,185],"send","darwin","keys","paste","output","control","prompts","interactive","list","capture","panes","text","monitor","sessions","linux"]