Add repair-only PR intake

[Jhacarreiro]

Summary

• add deterministic repair-only PR intake for open PRs with current objective repair signals
• create repair-pr jobs from failed checks, dirty merge state, changes requested, or unresolved current review threads
• teach repair workers to inspect source PR refs instead of treating source PRs as canonical material
• preserve generated repair-pr jobs during broad jobs state publishes
• avoid treating transient GitHub UNKNOWN mergeability as an actionable repair signal by itself
• avoid treating CANCELLED checks as repair-triggering signals
• route repair-pr jobs as PR repair work instead of cluster repair

Pre-publication checks

• checked relevant upstream open PRs before publishing; no overlapping repair-only intake PR found
• compared relevant upstream PRs (#fix: resolve Windows Codex spawn failures for local review runs #250, feat: support CLAWSWEEPER_CODEX_LOGIN_METHOD for local OAuth runs #251, feat: add local-review command for offline branch review #253, feat(local-review): add claude CLI (-p) review engine (alternative to codex) #274, fix(review): gate exact reviews by provider lease #281, feat(repair): add Crabbox PR lease commands #164); only file overlap was package.json with fix(review): gate exact reviews by provider lease #281, both adding different scripts
• rebased on current upstream/main a1f5103
• sanitized diff for local-only names, paths, hosts, private services, and secrets

Real behavior proof

Cancelled-check gating proof:

corepack pnpm run repair:pr-intake -- --repo openclaw/clawsweeper --author Jhacarreiro --dry-run --limit 20 --include-review-comments-only

Excerpt:

{
  "status": "ok",
  "scanned": 1,
  "candidates": 0,
  "dry_run": true,
  "jobs": []
}

This confirms the intake no longer creates durable repair jobs from CANCELLED-only checks.

PR-repair job shape proof, written to /tmp only so no real queue state was mutated:

corepack pnpm run repair:pr-intake -- --repo openclaw/clawsweeper --author hxy91819 --limit 10 --no-comments --out-dir /tmp/pr-intake-proof/jobs/openclaw/inbox --force

Excerpt:

{
  "status": "ok",
  "repo": "openclaw/clawsweeper",
  "author": "hxy91819",
  "scanned": 1,
  "candidates": 1,
  "dry_run": false,
  "jobs": [
    {
      "status": "written",
      "job": "../../../../tmp/pr-intake-proof/jobs/openclaw/inbox/repair-pr-openclaw-clawsweeper-281.md",
      "number": 281,
      "signals": [
        { "kind": "merge_state", "detail": "mergeStatusStatus=DIRTY" }
      ]
    }
  ]
}

cluster_id: repair-pr-openclaw-clawsweeper-281
job_intent: pr_repair
- https://github.com/openclaw/clawsweeper/pull/281

This shows generated PR-intake jobs are durable preserved jobs with a deliberate pr_repair intent and PR-repair work classification, not cluster repair.

Verification

• pnpm run build:repair
• node --test test/repair/pr-repair-intake.test.ts test/repair/action-session.test.ts test/repair/job-intent.test.ts test/repair/git-publish.test.ts test/repair/run-worker.test.ts

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 15, 2026, 8:03 AM ET / 12:03 UTC.

Summary
This PR adds a repair:pr-intake CLI that scans an author's open PRs for objective repair signals, emits durable repair-pr- jobs with pr_repair intent, preserves those jobs during jobs publishes, and removes --ephemeral from repair Codex subprocess calls.

Reproducibility: not applicable. this is a feature PR, not a bug report. Source inspection plus the PR body's terminal proof cover the main changed behavior: cancelled-only scans produce zero candidates and generated jobs use job_intent: pr_repair.

Review metrics: 2 noteworthy metrics.

• Diff size: 11 files changed, +581/-10. The PR touches enough repair runtime and test surface that reviewers should evaluate the generated job lifecycle, not only the new CLI file.
• Codex invocation changes: 7 --ephemeral removals. This is a cross-cutting repair runtime behavior change that unit tests alone do not settle.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Have a repair-lane maintainer make the merge call on durable repair-pr- intake and the non-ephemeral Codex subprocess behavior.

Risk before merge

• [P1] Merging enables durable repair-pr- jobs that can enqueue repair automation for open PRs; the supplied proof covers signal gating and job shape, but not a full live state publish to dispatch to repair completion cycle.
• [P1] Removing --ephemeral from all touched repair Codex subprocess calls changes repair runtime invocation behavior, so repair-lane operators should be comfortable with that compatibility tradeoff before landing.

Maintainer options:

1. Merge after repair-lane owner review (recommended)
   A maintainer familiar with repair dispatch should confirm the repair-pr- lifecycle and Codex invocation semantics are acceptable for live automation.
2. Add a live rehearsal before merge
   Maintainers can ask for a staging or scratch state-repo rehearsal that exercises intake, preservation, dispatch classification, and repair completion without touching production PRs.
3. Pause if repair-only intake is premature
   If maintainers do not want open PR repair intake outside explicit automerge/autofix commands yet, this PR should wait for a narrower policy decision.

Next step before merge

• [P2] No narrow automated repair is indicated; the remaining action is maintainer acceptance of the new durable repair-only PR intake lane.

Security
Cleared: No concrete security or supply-chain regression was found; the PR adds no dependencies or broader secret permissions, though it remains automation-sensitive.

Review details

Best possible solution:

Land this only after a repair-lane maintainer accepts the new durable repair-pr- intake semantics and the non-ephemeral Codex invocation change.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a feature PR, not a bug report. Source inspection plus the PR body's terminal proof cover the main changed behavior: cancelled-only scans produce zero candidates and generated jobs use job_intent: pr_repair.

Is this the best way to solve the issue?

Yes, with maintainer acceptance of the automation policy. The current branch reuses existing repair job frontmatter, validation, worker-lane routing, and state preservation patterns rather than adding a separate repair system.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 7779e2fe93bf.

Label changes

Label changes:

• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes after-change terminal output for cancelled-check gating and safe /tmp job generation with the intended pr_repair job shape.
• remove rating: 🧂 unranked krab: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
• remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

• P2: This is a normal-priority repair automation feature with limited repository scope but meaningful live automation impact.
• merge-risk: 🚨 automation: The diff adds a durable PR-repair intake lane and changes repair worker dispatch/classification behavior that could affect live repair automation after merge.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes after-change terminal output for cancelled-check gating and safe /tmp job generation with the intended pr_repair job shape.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-change terminal output for cancelled-check gating and safe /tmp job generation with the intended pr_repair job shape.

Evidence reviewed

What I checked:

• Repository policy: AGENTS.md was read fully and its conservative, automation-safe repair-lane guidance applies to this review. (AGENTS.md:1, 7779e2fe93bf)
• Repair signal gating: The final PR branch treats DIRTY/BLOCKED merge states, failed/error/timed-out/action-required checks, and unresolved current review threads as blocking signals, while CANCELLED and UNKNOWN are not repair-triggering by themselves. (src/repair/pr-repair-intake.ts:167, c8d747e2fa55)
• Generated job shape: Generated jobs render job_intent: pr_repair, allow fix/raise_pr work, and block close/merge actions for the source PR. (src/repair/pr-repair-intake.ts:314, c8d747e2fa55)
• Worker lane routing: The branch adds pr_repair to supported repair job intents and routes that intent to the automerge repair worker lane; action sessions also classify pr_repair and repair-pr- clusters as PR repair work. (src/repair/job-intent.ts:7, c8d747e2fa55)
• State publish preservation: The branch preserves state-only repair-pr- job files alongside existing automerge, issue, and self-heal job prefixes during broad jobs publishes. (src/repair/git-publish.ts:262, c8d747e2fa55)
• Runtime behavior change: The branch removes --ephemeral from repair Codex subprocess invocations, including the planning worker path, so this merge changes repair runtime invocation semantics. (src/repair/run-worker.ts:218, c8d747e2fa55)

Likely related people:

• Peter Steinberger: Git history shows Peter authored the current repair job-intent, repair execution, worker, and state-publish surfaces that this PR extends. (role: recent area contributor; confidence: high; commits: 10ed1f76d15d, d96112271e79, 86d0ca37755b; files: src/repair/job-intent.ts, src/repair/action-session.ts, src/repair/execute-fix-artifact.ts)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[Jhacarreiro]

Updated after ClawSweeper review: preserved repair-pr jobs during jobs publishes, stopped treating transient UNKNOWN merge state as actionable, added regression coverage, and added real dry-run proof in the PR body. This would have prevented exactly the first failed submission of this PR from sitting unhandled: the intake now detects the ClawSweeper failure/comment and plans a durable repair-pr job. @clawsweeper re-review

[Jhacarreiro]

Updated after second ClawSweeper review: CANCELLED checks no longer create repair jobs, repair-pr jobs now render job_intent:pr_repair and classify as PR repair work, and focused regressions were added for cancelled-check gating, job intent, and work kind. Added refreshed real proof in the PR body: cancelled-only dry-run now produces 0 candidates, and a safe /tmp generation produces job_intent:pr_repair. @clawsweeper re-review

[steipete]

Maintainer follow-up completed:

• Fixed PR-repair intake signal and job-intent handling.
• Added deterministic executor trust validation for the canonical source PR, cluster refs, generated branch, and truncated long-repository cluster IDs.
• Merged current main.
• Verified with full pnpm run check: 1,044 tests passed, coverage thresholds passed, formatting passed.
• Structured pre-land autoreview: no findings.