Skip to content

refactor: simplify outbound message execution context - #139107

Merged
steipete merged 1 commit into
mainfrom
codex/deslop-message-context
Sep 5, 2026
Merged

steipete merged 1 commit into
mainfrom
codex/deslop-message-context

Conversation

@steipete

@steipete steipete commented Sep 5, 2026 •

Copy link
Copy Markdown
Contributor
Additional instructions

MUST: Keep Allow edits from maintainers enabled for this PR so maintainers can help update the branch when needed.

What Problem This Solves

Outbound message handling repeatedly copied the same resolved delivery context into separate private shapes. Send, poll, plugin dispatch, and source-delivery annotation had to keep these projections synchronized, while core send maintained two equivalent execution paths.

Why This Change Was Made

Carry the resolved action context through internal execution and use one core-send path. Keep the explicit plugin and Gateway request projections at their existing boundaries. Native and core acceptance share the same route-commit callback, preserving route-before-receipt and mirror ordering.

Production changes are +223/-428 = -205 lines; tests and support are -63 lines. The public message-action input, plugin SDK, protocol, config, and storage formats are unchanged. Poll deliberately retains its narrower requester and media context. Retry ownership, required queue persistence, scoped media reads, cancellation, dry runs, and mirror destinations retain their existing policies.

User Impact

No intended behavior change. Operators can send messages, create polls, and invoke plugin actions through the same interfaces.

Evidence

  • The baseline's 612 tests across 35 files passed. Candidate coverage passed across the same owners and channel boundaries, including all 96 channel cases. Two internal-context assertions were updated after the refactor and their 16-test files passed.
  • One broad candidate run hit a producer-lease expiry after an 80.9-second cold account-routing case. The entire 26-test file then passed in original order on both baseline and candidate, without source or timeout changes. Lease/renewal/acknowledgement code is unchanged; the original failure lacks sufficient row/clock evidence to prove its cause.
  • A 14-case process differential executed actual send/poll/plugin entry points and queue, session, transcript, media, and action-dispatch owners against a synthetic transport. Baseline and candidate observations were identical, including request whitelists, null normalization, media readers, dry runs, cancellation, authority rejection, and mirroring.
  • Full changed checks passed. Independent Codex P0–P2 review and an additional owner-boundary review found no actionable findings.

Built Gateway QA completed on an isolated Linux Testbox with Node 24.19.0, a mock OpenAI provider, and the QA channel. Both a2a-message-tool-mirror-dedupe and thread-reply-current-source-delivery passed. All 38,074 tracked source files matched the frozen local candidate before and after the run. Gateway proof run.

{"verdict":"PASS","processDifferentialCases":14,"gatewayScenarios":["a2a-message-tool-mirror-dedupe","thread-reply-current-source-delivery"],"sourceIdentityUnchanged":true}

CI refresh: rebased onto current main after the prebuilt UI admission import was repaired in #139123. All three production owner hashes still match the live proof. An unchanged Gateway event-loop recovery assertion failed once in CI and passed on the focused rerun; no assertion or timeout was changed.

@clawsweeper

clawsweeper Bot commented Sep 5, 2026 •

Copy link
Copy Markdown
Contributor

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

@steipete
steipete marked this pull request as ready for review September 5, 2026 13:14
@openclaw-barnacle openclaw-barnacle Bot added size: XL maintainer Maintainer-authored PR labels Sep 5, 2026
@clawsweeper clawsweeper Bot added P3 Low-priority cleanup, docs, polish, ergonomics, or speculative work. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Sep 5, 2026
@clawsweeper

clawsweeper Bot commented Sep 5, 2026

Copy link
Copy Markdown
Contributor

Codex review: blocked before merge. Reviewed September 5, 2026, 11:17 AM ET / 15:17 UTC.

ClawSweeper review

What this changes

Reuses resolved delivery context across message actions and consolidates core sending while preserving existing delivery interfaces.

Merge readiness

⛔ Blocked before merge - 1 item remains

This remains useful work absent from current main. No blocking correctness or security finding was identified; the maintainer-owned PR should remain open.

Priority: P3
Reviewed head: e469bd8a250ae5fccf04d6fa31765460def0f950

Review scores

Measure Result What it means
Overall readiness 🐚 platinum hermit (4/6) A coherent refactor with relevant Gateway proof, retained boundary coverage, and no actionable correctness finding.
Proof confidence 🐚 platinum hermit (4/6) Sufficient (live_output): The captured candidate Gateway QA verdict reports passing A2A mirror-deduplication and native thread-reply scenarios through the changed delivery path, satisfying the repository's mock-Gateway proof allowance; the process differential supplies additional parity coverage.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Verification

Check Result Evidence
Real behavior Verified Sufficient (live_output): The captured candidate Gateway QA verdict reports passing A2A mirror-deduplication and native thread-reply scenarios through the changed delivery path, satisfying the repository's mock-Gateway proof allowance; the process differential supplies additional parity coverage.
Evidence reviewed 9 items Introduced scope and merge identity: The pinned merge-base-to-head change affects only the eight supplied outbound files. Raw test-merge parents match the pinned base followed by the original PR head; its changed-file list matches the introduced scope.
Current-main necessity: The three changed production modules are identical between the pinned merge base and fetched main, so main retains the separate context projections and core-send branches.
Latest-release comparison: v2026.9.1 contains the older standalone outbound context. Its send-service blob matches fetched main, not the proposed refactor.
Findings None None.
Security None None.

How this fits together

Outbound message execution turns CLI and agent actions into plugin or Gateway deliveries. It also coordinates delivery receipts, session routes, and transcript mirrors.

flowchart TD
  A[CLI and agent actions] --> B[Resolved delivery context]
  B --> C[Delivery ownership decision]
  C --> D[Plugin or Gateway action]
  C --> E[Core send and durable queue]
  D --> F[Delivery result]
  E --> F
  F --> G[Session route and transcript mirror]
Loading

Before merge

  • Resolve merge risk (P1) - Linked Gateway-run logs were unreachable from this worker; proof assessment relies on the captured PR verdict and inspected scenario definitions.
Agent review details

Security

None.

PR surface

Source -205, Tests -63. Total -268 across 8 files.

View PR surface stats
Area Files Added Removed Net
Source 3 223 428 -205
Tests 5 165 228 -63
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 8 388 656 -268

Review metrics

Metric Value Why it matters
Production versus test LOC Production net -205; tests and support net -63 The reduction consolidates private context and execution paths while retaining behavioral boundary coverage.

Merge-risk options

Maintainer options:

  1. Decide the mitigation before merge
    Keep one internal execution context and one core-send path, with explicit plugin/RPC projections and unchanged delivery ordering.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Keep one internal execution context and one core-send path, with explicit plugin/RPC projections and unchanged delivery ordering.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR proposes a behavior-preserving refactor rather than a reported bug fix; no tests were executed during this read-only review.

Is this the best way to solve the issue?

Yes: reusing the existing resolved context removes synchronization work while keeping external projections explicit; another parallel context abstraction would retain the duplication.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 31903060a5d4.

Labels

Label changes:

  • add P3: This is a behavior-preserving internal cleanup without a demonstrated urgent user-facing defect.
  • add proof: sufficient: Contributor real behavior proof is sufficient. The captured candidate Gateway QA verdict reports passing A2A mirror-deduplication and native thread-reply scenarios through the changed delivery path, satisfying the repository's mock-Gateway proof allowance; the process differential supplies additional parity coverage.
  • add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The captured candidate Gateway QA verdict reports passing A2A mirror-deduplication and native thread-reply scenarios through the changed delivery path, satisfying the repository's mock-Gateway proof allowance; the process differential supplies additional parity coverage.

Label justifications:

  • P3: This is a behavior-preserving internal cleanup without a demonstrated urgent user-facing defect.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The captured candidate Gateway QA verdict reports passing A2A mirror-deduplication and native thread-reply scenarios through the changed delivery path, satisfying the repository's mock-Gateway proof allowance; the process differential supplies additional parity coverage.
  • proof: sufficient: Contributor real behavior proof is sufficient. The captured candidate Gateway QA verdict reports passing A2A mirror-deduplication and native thread-reply scenarios through the changed delivery path, satisfying the repository's mock-Gateway proof allowance; the process differential supplies additional parity coverage.

Evidence

What I checked:

  • Introduced scope and merge identity: The pinned merge-base-to-head change affects only the eight supplied outbound files. Raw test-merge parents match the pinned base followed by the original PR head; its changed-file list matches the introduced scope. (cadfc06c00b7)
  • Current-main necessity: The three changed production modules are identical between the pinned merge base and fetched main, so main retains the separate context projections and core-send branches. (src/infra/outbound/outbound-send-service.ts:44, 31903060a5d4)
  • Latest-release comparison: v2026.9.1 contains the older standalone outbound context. Its send-service blob matches fetched main, not the proposed refactor. (src/infra/outbound/outbound-send-service.ts:44, ad6fe23aecb9)
  • Delivery owner and callback parity: Read the complete send service, send coordinator, action runner, and message entrypoint. Queue requirements, retry ownership, cancellation, media access, and final-dispatch callbacks remain forwarded; route acceptance still precedes the caller's delivery receipt. (src/infra/outbound/outbound-send-service.ts:138, e469bd8a250a)
  • Plugin, poll, and Gateway boundaries: Gateway requests retain explicit field projection, and poll reconstructs its narrower input without send-only authority or media grants. The changed context belongs to OpenClaw's action contracts; no changed behavior or proof requires a Codex runtime contract. (src/infra/outbound/message-action-execution.ts:440, e469bd8a250a)
  • Retained behavioral coverage: Read all changed tests and support. Coverage retains plugin/core selection, requester media policy, dry runs, presentation fallback, Gateway field exclusion, and thread receipt matching; the updated lifecycle case explicitly checks route-before-receipt ordering. Tests were inspected, not executed. (src/infra/outbound/outbound-send-service.test.ts:319, e469bd8a250a)

Likely related people:

  • steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
  • Josh Avant: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
  • Eden: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@steipete
steipete force-pushed the codex/deslop-message-context branch from e469bd8 to ecad930 Compare September 5, 2026 17:07
@steipete

steipete commented Sep 5, 2026

Copy link
Copy Markdown
Contributor Author

Maintainer verification of the remaining ClawSweeper proof-access item: I directly inspected the downloaded Gateway report, per-scenario evidence, source identities, and cleanup record. The recorded run passed both scenarios with no failures or skips; the Testbox is stopped. The three changed production-file hashes still match that tested candidate after the mechanical rebase.

The captured observations were:

{"scenario":"a2a-message-tool-mirror-dedupe","status":"pass","visibleMessageToolReplies":1,"sourceReplyDelivered":true,"terminalReplyDisposition":"empty","duplicateWindowMs":8000}
{"scenario":"thread-reply-current-source-delivery","status":"pass","observedReply":"QA-THREAD-RECEIPT-OK"}

The full tracked-tree digest before and after installation/build/QA was a6e32808826d476768143f80df346c787b28ff2442fbcd5d68d42735afdc4b38 (38,074 files). The additional owner-process comparison matched all 14 cases. This is actual Gateway/process proof with synthetic channel/provider boundaries. I accept it as sufficient mitigation for the review worker's inability to fetch the linked logs.

The renewed independent P2 review is clean, and CI run 33979945202 passed on ecad930b85613023bf1601162ed7faad6afb775d.

@steipete

steipete commented Sep 5, 2026

Copy link
Copy Markdown
Contributor Author

Native prepare gates passed for ecad930b85613023bf1601162ed7faad6afb775d. The renewed review is clean, current CI is green, and the Gateway evidence-access mitigation is recorded above with inspected observations and source identities. Ready to land the 205-line production reduction.

@steipete
steipete merged commit 3e4bece into main Sep 5, 2026
181 checks passed
@steipete
steipete deleted the codex/deslop-message-context branch September 5, 2026 17:41
@steipete

steipete commented Sep 5, 2026

Copy link
Copy Markdown
Contributor Author

Merged via squash.

vincentkoc added a commit to aniruddhaadak80/openclaw that referenced this pull request Sep 5, 2026
* commit '3e4becea5e2ce38ede69e8ecf5302805ecbfc09c':
  refactor: simplify outbound message execution context (openclaw#139107)
  fix(models): keep ordinary chat selections session-scoped (openclaw#139232)
  docs: slim root agent instructions and clarify testing scope (openclaw#139236)
  test(agents): give the sibling-drain completion wait a tolerance on slow runners (openclaw#139176)
  refactor(workboard): use canonical queries for card-tree writes (openclaw#139106)
  fix(canvas): recognize versioned macOS nodes (openclaw#138958)
  fix: load GitHub connections without a default agent (openclaw#139222)
  fix(memory): explain unsafe legacy host-event path recovery (openclaw#139195)
  refactor(talk): centralize typed voice session queries (openclaw#139103)
  fix(cli): preserve command dispatch and structured errors (openclaw#139067)
  refactor(agents): consolidate reply failure summaries (openclaw#139175)
  fix(auth): keep an unset default model unchanged during login (openclaw#139218)
  perf(media): reuse validated attachment read handles (openclaw#139168)
  refactor(channels): simplify account configuration updates (openclaw#139096)
  refactor(android): remove unused updater export root (openclaw#139198)
  fix(gateway): stop admitting post-ready producers during close (openclaw#139092)
  fix(gateway): expose agent hook completion outcomes (openclaw#139155)
  fix(config): return the saved configuration after plugin install commits (openclaw#139203)
  fix(android): reduce repeated retries to unreachable gateways (openclaw#138732)
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Sep 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

maintainer Maintainer-authored PR P3 Low-priority cleanup, docs, polish, ergonomics, or speculative work. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: XL status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant