chore: retire staging environment

[Patrick-Erichsen]

Summary

• Remove the staging-only deploy workflow, worker relays, Vercel build handling, and OIDC plumbing.
• Keep Test upload-triggered prepublication scans pinned to academic-chihuahua-392; keep Production workers and schedules intact.
• Fail closed on delayed Staging dispatches. Keep Vercel's staging auto-deploy deny-list while the branch is still used by an open PR.
• Update deployment/security specs for the Test + Production model.

Provider cleanup already applied

• Removed Vercel mappings for stg.clawhub.openclaw.org and stg.clawhub.ai, and removed the staging deploy hook. Test and Production mappings remain.
• Removed GitHub's Staging environment. Test and Production remain.
• Deleted the separate Convex deployment cheery-civet-733; confirmed the Staging project now has no deployments and Test (academic-chihuahua-392) and Production (wry-manatee-359) still exist. The export recommended by Convex did not complete before deletion, so Staging deployment data was removed.
• Retained the staging branch because PR #3742 still targets it; automatic Vercel deployment for that branch remains disabled.

Validation

• bun run ci:packages
• bun run ci:static
• bun run ci:unit (7,319 tests passed; 3 skipped)
• bun run ci:types-build
• bun run ci:e2e-http
• bun run ci:playwright-smoke (19 tests passed)
• Repo autoreview: clean

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Oct 1, 2026 11:55pm UTC

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR retires Staging deployment, worker routing, build handling, and edge identity while retaining Test and Production.

Example: A delayed clawhub-prepublication-publish event carries environment=staging.

• Before: Main relays the event to a worker on the staging branch.
• After: The event starts neither a Staging relay nor a Production worker.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The cleanup is useful and source review found no discrete bug, but the required authority-boundary proof is not supplied.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦐 gold shrimp (3/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Repository automation still advertises and targets an environment the PR author reports has already been decommissioned.
Reason: The collaborator-authored direction removes obsolete infrastructure, retains Test and Production, and records the changed operational intent in specs.

Merge readiness

⛔ Blocked before merge - 3 items remain

Keep this PR open: it is collaborator-authored, and current main still contains the Staging infrastructure it removes. No introduced correctness defect was found; GitHub still reports a merge conflict.

Priority: P2
Reviewed head: 76ac3f8bec7332081b26891257325489f6c587b4

Before merge

• Add real behavior proof - Authority-chain proof required: supplied dispatch mocks, workflow assertions, and identity tests do not exercise the candidate through GitHub routing or the HTTP boundary; attach redacted logs showing Test/Production success and delayed Staging events plus retired or sibling Preview identities rejected before protected I/O, including replay after retirement. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve merge risk - Before merge, establish that retired Staging events and identities cannot reach credentialed worker claims or archive issuance after the authority checks are removed.
• Complete next step - Resolve scripts/vercel-build-frontend.ts against main, preserving writeDeploymentMetadata and VITE_GA4_RELEASE cleanup from fix: keep analytics release metadata out of client hashes #3903, then validate the resolved build.

Findings

None.

Tests

• Missing end-to-end proof: Candidate workflow and HTTP evidence must show allowed Test/Production operations and retired Staging rejection before worker claims, trusted-IP accounting, or archive issuance.

Agent review details

How this fits together

Convex dispatches publish and scan events to GitHub workflows, which select deployment credentials and invoke workers; the frontend proxy separately authenticates archive and client-IP requests to Convex.

flowchart TD
  A[Convex dispatch events] --> B[Main workflow routing]
  B --> C[Test publish worker]
  B --> D[Production workers]
  B --> E[Reject retired Staging events]
  F[Frontend proxy] --> G[Convex identity checks]

Loading

Technical review

Best possible solution:

Complete the existing retirement path while preserving main’s analytics build behavior and the Test/Production authorization boundaries.

Do we have a high-confidence way to reproduce the issue?

This is an authorized environment retirement; source inspection confirms the obsolete infrastructure remains on main, and no target code was executed.

Is this the best way to solve the issue?

Best-fix verdict: best shape for the authorized retirement; deleting the dedicated path avoids retaining a second environment owner, while disabling only its workflow would leave build, worker, and identity plumbing behind.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against d044664a7636.

Merge-risk options

Maintainer options:

1. Hold for authority-boundary evidence (recommended)
   Keep this PR open until candidate-path evidence establishes allowed Test/Production effects and rejection of retired Staging events and edge identities before protected I/O.

Provenance checked

• Staging deploy, worker relays, build handling, and edge identity changes intended behavior with a stated reason (58865c4: Provide a permanent isolated Staging deployment with branch-bound edge authority and separate workers.)
• Permanent Test publish dispatch keeps the original intent (0193198: Route Test uploads through main to the fixed Test backend without enabling scheduled catalog scans.)
• Disposable Preview provisioning and retry keeps the original intent (dfca6f5: Pair PR frontends with disposable seeded Convex deployments; later provisioning recovery uses fresh retry names.)
• Publisher signal index rollout keeps the original intent (fcb0e8d: Stage indexes before activating queries; the wording changes the rehearsal environment to Test while retaining the staged-index sequence.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Verified introduction boundary: The pinned introduced diff removes Staging infrastructure without owning the unrelated base-only changes. (76ac3f8bec73)
• Retirement remains necessary on main: Fetched main still contains deploy-staging.yml, staging-build-env.ts, and the Staging worker relay. (.github/workflows/deploy-staging.yml:1, d044664a7636)
• Confirmed merge blocker: Live REST metadata reports mergeable=false and mergeable_state=dirty for the reviewed head. (76ac3f8bec73)
• Overlapping main change: The merged analytics fix fix: keep analytics release metadata out of client hashes #3903 adds writeDeploymentMetadata and VITE_GA4_RELEASE cleanup to the same frontend build function; conflict resolution must preserve both. (scripts/vercel-build-frontend.ts:28, d044664a7636)
• Worker authority boundary: The candidate excludes Staging repository dispatches before worker execution, preserves the Test relay, and pins Test worker credentials and URL to academic-chihuahua-392. (.github/workflows/prepublication-publish-checks.yml:98, 76ac3f8bec73)
• Edge identity remains fail closed: CLAWHUB_ENV=staging now resolves to no accepted Vercel environment; archive handlers reject before manifest issuance and client-IP verification returns no trusted identity. (convex/lib/clawhubVercelOidc.ts:35, 76ac3f8bec73)

Review metrics

Metric	Value	Why it matters
Patch size	+125/-2145 across 40 files	The retirement predominantly removes the obsolete deployment path and its dedicated tests.

Labels

Label changes:

• add merge-risk: 🚨 security-boundary: The patch removes Staging edge credentials and changes which environment dispatches can reach credentialed workers.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.
• remove status: ⏳ waiting on author: Current PR status label is status: 📣 needs proof.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🧂 unranked krab, so this older rating label is no longer current.

Label justifications:

• P2: This is useful deployment maintenance with no demonstrated urgent user-facing regression.
• merge-risk: 🚨 security-boundary: The patch removes Staging edge credentials and changes which environment dispatches can reach credentialed workers.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add final-effect proof for allowed Test/Production operations and retired Staging or sibling Preview identities, including replay after retirement, before protected I/O.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only; repair and merge need explicit maintainer commands such as @clawsweeper autofix or @clawsweeper automerge.

History

Review history (37 earlier review cycles; latest 8 shown)

• reviewed 2026-10-08T12:51:07.033Z sha 76ac3f8 :: needs changes before merge. :: none
• reviewed 2026-10-08T14:41:05.276Z sha 76ac3f8 :: needs changes before merge. :: none
• reviewed 2026-10-08T16:42:15.925Z sha 76ac3f8 :: needs changes before merge. :: none
• reviewed 2026-10-08T19:36:10.303Z sha 76ac3f8 :: needs changes before merge. :: none
• reviewed 2026-10-08T20:51:19.511Z sha 76ac3f8 :: needs changes before merge. :: none
• reviewed 2026-10-09T02:53:30.555Z sha 76ac3f8 :: needs changes before merge. :: none
• reviewed 2026-10-09T10:38:50.887Z sha 76ac3f8 :: needs changes before merge. :: none
• reviewed 2026-10-10T15:34:04.246Z sha 76ac3f8 :: needs changes before merge. :: none

Reviewed October 10, 2026, 11:39 AM ET / 15:39 UTC (Revision 38).