fix: preserve exec policy layer base

.agents/skills/claw-score/SKILL.md

@@ -15,7 +15,7 @@ committed `inventory/` report tree.
 This skill owns the operational workflow for:
 
 - `taxonomy.yaml`
-- `qa/maturity-scores.yaml`
+- `docs/maturity-scores.yaml`
 - `docs/concepts/qa-e2e-automation.md`
 - `qa/scenarios/index.yaml`
 
@@ -37,35 +37,28 @@ out of this repo. If a score needs private evidence, use the redacted
   coverage IDs. Do not promote generic IDs into standalone feature names.
 - Avoid duplicate coverage-ID bundles under different feature names in one
   category.
-- `qa/maturity-scores.yaml` is the committed aggregate source for Quality,
-  Completeness, and LTS review state.
-- `extensions/qa-lab/src/scorecard-taxonomy.ts` exports
-  `qaMaturityScoresSchema` and `readValidatedQaMaturityScoreSources`; use those
-  QA Lab utilities to validate score output.
-- Generated public docs are `docs/maturity/scorecard.md` and
-  `docs/maturity/taxonomy.md`; both come from `pnpm maturity:render`. Do not
-  hand-edit generated Markdown to change score results.
-- `qa-evidence.json` artifacts provide per-run QA scorecard evidence. Release
-  profile artifacts are the source of truth for Coverage. They can enrich
-  generated artifact docs, but they are not committed as inventory.
+- `docs/maturity-scores.yaml` is the aggregate score source committed in this
+  repo. It is the only committed score data; do not add generated inventory
+  directories.
+- There is no committed maturity-doc renderer or `pnpm maturity:*` script in
+  this repo. Do not invent generated scorecard files; update the source YAML
+  and current docs directly.
+- `qa-evidence.json` artifacts provide per-run QA scorecard evidence. They can
+  enrich generated artifact docs, but they are not committed as inventory.
 
 ## Commands
 
 Run from the openclaw repo root.
 
-Validate taxonomy YAML structure and the maturity score schema after source
-edits:
+Validate YAML structure after source edits:
 
 ```bash
-node --import tsx --input-type=module <<'NODE'
-import fs from "node:fs";
-import YAML from "yaml";
-import { readValidatedQaMaturityScoreSources } from "./extensions/qa-lab/src/scorecard-taxonomy.ts";
-
-for (const file of ["taxonomy.yaml", "qa/scenarios/index.yaml"]) {
+node <<'NODE'
+const fs = require("node:fs");
+const YAML = require("yaml");
+for (const file of ["taxonomy.yaml", "docs/maturity-scores.yaml", "qa/scenarios/index.yaml"]) {
   YAML.parse(fs.readFileSync(file, "utf8"));
 }
-readValidatedQaMaturityScoreSources();
 NODE
 ```
 
@@ -90,17 +83,17 @@ When asked to score or refresh a surface:
    `.agents/skills/claw-score/references/completeness/`.
 3. Gather public repo evidence from docs, source, tests, and QA scenario
    metadata.
-4. Prefer existing release profile `qa-evidence.json` artifacts for executed
-   proof.
-5. Update `qa/maturity-scores.yaml` only for Quality, Completeness, and LTS
-   review state backed by public or redacted artifact evidence.
-6. Run the schema validation command from this skill.
+4. Prefer existing `qa-evidence.json` artifacts for executed proof. Do not use
+   discrawl or unredacted private archives.
+5. Update `docs/maturity-scores.yaml` only when the score change is backed by
+   public or redacted artifact evidence.
+6. Run the YAML validation command from this skill.
 7. Run `pnpm check:docs` if docs prose changed, and focused QA coverage checks
    if coverage IDs or profile membership changed.
 
 For subjective score changes, make the smallest defensible edit and leave the
 evidence path in the PR or task summary. Keep manual prose in current docs and
-keep score data in `qa/maturity-scores.yaml`.
+keep score data in `docs/maturity-scores.yaml`.
 
 ## Default Completeness Process
 
@@ -146,7 +139,7 @@ Default guidance:
 
 Default Completeness bands:
 
-- `Clawesome` (95-100): complete across expected workflows, variants, and
+- `Lovable` (95-100): complete across expected workflows, variants, and
   recovery branches, with only minor polish gaps.
 - `Stable` (80-95): the expected workflow set is broadly present, with only
   bounded missing branches.
@@ -159,20 +152,19 @@ Default Completeness bands:
 
 ## Score Semantics
 
-- Coverage: deterministic release validation coverage derived from the release
-  profile `qa-evidence.json.scorecard` feature fulfillment data.
+- Coverage: public or redacted proof that the feature is exercised by docs,
+  tests, QA scenarios, live lanes, or release evidence.
 - Quality: reliability, maintainability, operator safety, and regression
   confidence for the category.
 - Completeness: how much of the intended operator-visible workflow exists for
   the category. Use the default completeness process plus any surface-specific
   variation before changing this score.
-- LTS: derived from Quality, release-evidence Coverage, and
-  `human_lts_override`; do not hand-edit generated Markdown to change LTS
-  status.
+- LTS: derived from score thresholds and `human_lts_override`; do not hand-edit
+  generated Markdown to change LTS status.
 
 Bands:
 
-- `Clawesome`: 95-100
+- `Lovable`: 95-100
 - `Stable`: 80-95
 - `Beta`: 70-80
 - `Alpha`: 50-70

.agents/skills/openclaw-ci-limits/SKILL.md

@@ -1,196 +0,0 @@
----
-name: openclaw-ci-limits
-description: Manage OpenClaw GitHub Actions and Blacksmith CI capacity, runner-registration budgets, fanout caps, main-push debounce, shard sizing, hosted-runner offload, queue health, and safe ramp-down/ramp-up changes. Use when tuning `.github/workflows/*`, `docs/ci.md`, CI runner labels, matrix `max-parallel`, ClawSweeper/Blacksmith burst protection, CodeQL runner placement, or investigating slow/queued OpenClaw CI.
----
-
-# OpenClaw CI Limits
-
-Use this skill for CI capacity changes, not ordinary test failure triage. The
-goal is to keep OpenClaw fast while staying below GitHub's self-hosted runner
-registration edge limit.
-
-## Core Facts
-
-- The scarce resource is Blacksmith runner registrations, not Blacksmith vCPU
-  capacity.
-- GitHub runner registrations are capped at 1,500 per 5 minutes per repository,
-  organization, or enterprise. The `openclaw` organization shares one bucket.
-- Core REST quota does not draw down this bucket. Check
-  `actions_runner_registration` separately; core quota can be healthy while
-  runner registration is throttled.
-- Use 1,000 registrations per 5 minutes as the operating target. Leave the last
-  third for other repos, retries, and burst overlap.
-- Jobs that route, notify, summarize, choose shards, or run short CodeQL quality
-  scans should stay on GitHub-hosted runners unless measured evidence says
-  Blacksmith is required.
-
-## First Checks
-
-Before changing CI, collect current pressure:
-
-```bash
-ghx api rate_limit --jq '{core:.resources.core,graphql:.resources.graphql,search:.resources.search,actions_runner_registration:.resources.actions_runner_registration}'
-ghx run list -R openclaw/openclaw --limit 20 --json databaseId,status,conclusion,workflowName,event,headBranch,createdAt,updatedAt,url
-ghx run list -R openclaw/clawsweeper --limit 20 --json databaseId,status,conclusion,workflowName,event,headBranch,createdAt,updatedAt,url
-curl -fsS https://clawsweeper.openclaw.ai/api/status | jq '{generated_at,fleet,diagnostics:{errors:.diagnostics.errors}}'
-curl -fsS https://clawsweeper.openclaw.ai/api/exact-review-queue | jq '.'
-node scripts/ci-run-timings.mjs --latest-main
-node scripts/ci-run-timings.mjs --recent 10
-```
-
-Read:
-
-- `.github/workflows/ci.yml`
-- `.github/workflows/codeql-critical-quality.yml`
-- `docs/ci.md`
-- `test/scripts/ci-workflow-guards.test.ts`
-- touched planner files under `scripts/lib/*ci*`, `scripts/lib/*test-plan*`, or
-  `scripts/ci-changed-scope.mjs`
-
-## Diagnose The Bottleneck
-
-Classify the issue before changing caps:
-
-- **Runner-registration throttle:** many jobs queued before runner assignment,
-  Blacksmith/GitHub reports 403/429 or spam-style 422 responses from
-  `generate-jitconfig`, and API core quota is still healthy. Treat 422 as this
-  signal only when the request payload is otherwise valid. Fix burstiness and
-  Blacksmith job count.
-- **Blacksmith capacity:** Blacksmith dashboard shows actual concurrency caps or
-  unavailable capacity. Do not solve this with GitHub workflow fanout alone.
-- **OpenClaw test runtime:** jobs start quickly but one lane dominates wall time.
-  Use `$openclaw-test-performance` instead of runner tuning.
-- **Real failing CI:** one job fails after starting. Use `$github:gh-fix-ci` or
-  `$openclaw-testing`, not this skill.
-- **ClawSweeper backlog:** exact-review queue grows while CI is healthy. Tune
-  ClawSweeper workers in `openclaw/clawsweeper`, not OpenClaw CI.
-
-## Registration Budget Math
-
-Estimate worst-case registrations for a change before editing:
-
-```text
-new Blacksmith registrations ~= number of Blacksmith jobs that can become queued
-inside one 5 minute window
-```
-
-For matrix jobs, count every row that can start in the 5-minute window.
-`strategy.max-parallel` only caps simultaneous rows; short rows can turn over
-and register more runners before the window resets. Use job duration, retries,
-and queue turnover to justify any lower estimate. Add non-matrix Blacksmith jobs
-such as `preflight`, `security-fast`, `build-artifacts`, and platform lanes.
-
-For repeated pushes, multiply by the number of runs expected to reach
-Blacksmith admission in the same 5-minute window, including runs canceled after
-admission. The debounce only suppresses pushes that arrive while
-`runner-admission` is still sleeping; once Blacksmith jobs register, those
-registrations are spent even if a later push cancels the run. If timing is
-uncertain, count every sequential push in the window.
-
-Reject a change unless the org-level worst case stays below 1,000 registrations
-per 5 minutes with headroom for ClawSweeper, ClawHub, Clownfish, OpenClaw RTT,
-and Clawbench.
-
-## Safe Levers
-
-Prefer these in order:
-
-1. Add or preserve concurrency groups that cancel superseded PR and canonical
-   `main` runs before Blacksmith work starts.
-2. Keep the `runner-admission` hosted debounce for canonical `main` pushes.
-   Change `OPENCLAW_MAIN_CI_DEBOUNCE_SECONDS` only with evidence.
-3. Move high-frequency, short, non-build jobs to `ubuntu-24.04`.
-4. Reduce matrix rows by bundling related tests inside one runner job when the
-   combined job stays under timeout and keeps useful failure names.
-5. Lower `strategy.max-parallel` for bursty Blacksmith matrices.
-6. Right-size runners from timing evidence. Use fewer/larger jobs only when
-   elapsed time improves enough to justify registration count.
-7. Split truly slow tests with `$openclaw-test-performance`; do not hide a slow
-   test problem by registering more runners.
-
-Do not:
-
-- add another Blacksmith installation expecting a higher registration bucket;
-- move CodeQL Critical Quality back to Blacksmith;
-- raise all `max-parallel` values at once;
-- make manual `workflow_dispatch` runs cancel normal push/PR validation;
-- delete coverage just to reduce runner count;
-- treat cancelled superseded runs as failures without checking the newest run
-  for the same ref.
-
-## Current OpenClaw Knobs
-
-These are intentionally guarded by `test/scripts/ci-workflow-guards.test.ts`:
-
-- `CI` concurrency key version and `cancel-in-progress` for PRs and canonical
-  `main` pushes.
-- `runner-admission` on `ubuntu-24.04` with
-  `OPENCLAW_MAIN_CI_DEBOUNCE_SECONDS=90`.
-- `preflight` and `security-fast` needing `runner-admission`.
-- CI matrix caps: fast/check lanes at 8, compact Node PR plan at current caps,
-  Windows and Android at 2.
-- `build-artifacts` on `blacksmith-16vcpu-ubuntu-2404`.
-- lower-weight Node/check shards on `blacksmith-4vcpu-ubuntu-2404`.
-- heavy retained Linux/Android shards on `blacksmith-8vcpu-ubuntu-2404`.
-- CodeQL Critical Quality on `ubuntu-24.04` with no `blacksmith-` labels.
-
-When changing one knob, update `docs/ci.md` and the guard test in the same PR.
-
-## Validation
-
-For workflow-only or docs/skill-only changes in a Codex worktree:
-
-```bash
-node scripts/run-vitest.mjs test/scripts/ci-workflow-guards.test.ts
-node scripts/check-workflows.mjs
-node scripts/docs-list.js
-./node_modules/.bin/oxfmt --check .github/workflows/ci.yml .github/workflows/codeql-critical-quality.yml docs/ci.md test/scripts/ci-workflow-guards.test.ts .agents/skills/openclaw-ci-limits/SKILL.md .agents/skills/openclaw-ci-limits/agents/openai.yaml
-git diff --check
-```
-
-If `pnpm docs:list` tries to reconcile dependencies in a linked Codex worktree,
-stop and use `node scripts/docs-list.js`.
-
-For a PR before requesting maintainer approval:
-
-```bash
-.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main
-ghx pr checks <pr> -R openclaw/openclaw --watch --interval 15
-```
-
-Use hosted exact-head gates for CI workflow tuning. Do not burn local
-`pnpm test` on unrelated full-suite proof.
-
-Only after the maintainer explicitly asks you to prepare or land the PR, run the
-repo-native mutating wrapper:
-
-```bash
-scripts/pr review-init <pr>
-scripts/pr review-artifacts-init <pr>
-scripts/pr review-validate-artifacts <pr>
-OPENCLAW_TESTBOX=1 scripts/pr prepare-run <pr>
-```
-
-`prepare-run` can push a prepared commit to the PR branch. Only run
-`scripts/pr merge-run <pr>` after the maintainer has explicitly asked you to
-land the PR. Both commands mutate GitHub state.
-
-## Post-Land Monitoring
-
-After merge, watch at least one fresh main cycle and the adjacent repos:
-
-```bash
-ghx run list -R openclaw/openclaw --limit 20 --json databaseId,status,conclusion,workflowName,event,headBranch,createdAt,updatedAt,url
-for repo in openclaw/clawsweeper openclaw/clawhub openclaw/clownfish openclaw/openclaw-rtt openclaw/clawbench; do
-  ghx run list -R "$repo" --limit 12 --json databaseId,status,conclusion,workflowName,event,headBranch,createdAt,updatedAt,url
-done
-curl -fsS https://clawsweeper.openclaw.ai/api/exact-review-queue | jq '.'
-```
-
-Report:
-
-- exact PR/commit landed;
-- expected registration reduction or added headroom;
-- CI run status and slowest/queued jobs;
-- ClawSweeper queue pending, dispatching, leased, oldest pending age;
-- any real failures that remain outside runner registration.

.agents/skills/openclaw-ci-limits/agents/openai.yaml

@@ -1,4 +0,0 @@
-interface:
-  display_name: "OpenClaw CI Limits"
-  short_description: "Tune OpenClaw CI fanout and runner budgets"
-  default_prompt: "Use $openclaw-ci-limits to inspect OpenClaw CI pressure, tune runner-registration fanout safely, and document the exact validation before landing."

.github/codex/prompts/maturity-scorecard-agent.md

@@ -1,23 +0,0 @@
-# OpenClaw Maturity Scorecard Agent
-
-You are refreshing the OpenClaw maturity score source for a release scorecard.
-
-Goal: use the `$claw-score` skill to refresh `qa/maturity-scores.yaml` for every active surface in `taxonomy.yaml`, using the current repository and the release evidence artifacts in `.artifacts/maturity-evidence`.
-
-Allowed tracked paths:
-
-- `qa/maturity-scores.yaml`
-
-Hard limits:
-
-- Do not edit generated docs, taxonomy, workflows, scripts, package metadata, lockfiles, tests, or application code.
-- Do not render docs. The workflow renders docs after validating the score source.
-- Keep the score source schema valid for QA Lab maturity score validation.
-
-Required workflow:
-
-1. Use the `$claw-score` skill before editing.
-2. Read `taxonomy.yaml`, any existing maturity score file, and the release evidence artifacts.
-3. Refresh scores for every active surface in `taxonomy.yaml`.
-4. Run the QA Lab maturity score validation used by this repository.
-5. If no defensible score update is possible, leave a valid `qa/maturity-scores.yaml` and explain the uncertainty in the final message.

.github/labeler.yml

@@ -118,7 +118,6 @@
       - any-glob-to-any-file:
           - "extensions/qa-lab/**"
           - "qa/scenarios/**"
-          - "docs/maturity/**"
           - "docs/concepts/qa-e2e-automation.md"
           - "docs/concepts/personal-agent-benchmark-pack.md"
           - "docs/channels/qa-channel.md"

.github/workflows/ci-build-artifacts-testbox.yml

@@ -198,19 +198,10 @@ jobs:
             "+refs/heads/main:refs/remotes/origin/main"
 
           node_bin="$(dirname "$(node -p 'process.execPath')")"
-          link_node_tool() {
-            local tool="$1"
-            local source="$node_bin/$tool"
-            local target="/usr/local/bin/$tool"
-            if [ -e "$target" ] && [ "$(readlink -f "$source")" = "$(readlink -f "$target")" ]; then
-              return
-            fi
-            sudo ln -sf "$source" "$target"
-          }
-          link_node_tool node
-          link_node_tool npm
-          link_node_tool npx
-          link_node_tool corepack
+          sudo ln -sf "$node_bin/node" /usr/local/bin/node
+          sudo ln -sf "$node_bin/npm" /usr/local/bin/npm
+          sudo ln -sf "$node_bin/npx" /usr/local/bin/npx
+          sudo ln -sf "$node_bin/corepack" /usr/local/bin/corepack
           sudo tee /usr/local/bin/pnpm >/dev/null <<'PNPM'
           #!/usr/bin/env bash
           exec /usr/local/bin/corepack pnpm "$@"
@@ -270,6 +261,6 @@ jobs:
 
       - name: Run Testbox
         uses: useblacksmith/run-testbox@3f60ff9ceb2c10c3feefa87dc0c6490cffae059d
-        if: always()
+        if: success()
         env:
           FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

.github/workflows/ci-check-arm-testbox.yml

@@ -116,19 +116,10 @@ jobs:
             "+refs/heads/main:refs/remotes/origin/main"
 
           node_bin="$(dirname "$(node -p 'process.execPath')")"
-          link_node_tool() {
-            local tool="$1"
-            local source="$node_bin/$tool"
-            local target="/usr/local/bin/$tool"
-            if [ -e "$target" ] && [ "$(readlink -f "$source")" = "$(readlink -f "$target")" ]; then
-              return
-            fi
-            sudo ln -sf "$source" "$target"
-          }
-          link_node_tool node
-          link_node_tool npm
-          link_node_tool npx
-          link_node_tool corepack
+          sudo ln -sf "$node_bin/node" /usr/local/bin/node
+          sudo ln -sf "$node_bin/npm" /usr/local/bin/npm
+          sudo ln -sf "$node_bin/npx" /usr/local/bin/npx
+          sudo ln -sf "$node_bin/corepack" /usr/local/bin/corepack
           sudo tee /usr/local/bin/pnpm >/dev/null <<'PNPM'
           #!/usr/bin/env bash
           exec /usr/local/bin/corepack pnpm "$@"
@@ -188,6 +179,6 @@ jobs:
 
       - name: Run Testbox
         uses: useblacksmith/run-testbox@5ca05834db1d3813554d1dd109e5f2087a8d7cbc
-        if: always()
+        if: success()
         env:
           FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

.github/workflows/ci-check-testbox.yml

@@ -33,7 +33,7 @@ jobs:
       contents: read
     name: "check"
     runs-on: blacksmith-32vcpu-ubuntu-2404
-    timeout-minutes: ${{ fromJSON(inputs.timeout_minutes || '120') }}
+    timeout-minutes: ${{ fromJSON(inputs.timeout_minutes || '30') }}
     steps:
       - name: Begin Testbox
         uses: useblacksmith/begin-testbox@233448af4bfdc6fca509a7f0974411ac6d8a8043
@@ -105,19 +105,10 @@ jobs:
             "+refs/heads/main:refs/remotes/origin/main"
 
           node_bin="$(dirname "$(node -p 'process.execPath')")"
-          link_node_tool() {
-            local tool="$1"
-            local source="$node_bin/$tool"
-            local target="/usr/local/bin/$tool"
-            if [ -e "$target" ] && [ "$(readlink -f "$source")" = "$(readlink -f "$target")" ]; then
-              return
-            fi
-            sudo ln -sf "$source" "$target"
-          }
-          link_node_tool node
-          link_node_tool npm
-          link_node_tool npx
-          link_node_tool corepack
+          sudo ln -sf "$node_bin/node" /usr/local/bin/node
+          sudo ln -sf "$node_bin/npm" /usr/local/bin/npm
+          sudo ln -sf "$node_bin/npx" /usr/local/bin/npx
+          sudo ln -sf "$node_bin/corepack" /usr/local/bin/corepack
           sudo tee /usr/local/bin/pnpm >/dev/null <<'PNPM'
           #!/usr/bin/env bash
           exec /usr/local/bin/corepack pnpm "$@"
@@ -177,6 +168,6 @@ jobs:
 
       - name: Run Testbox
         uses: useblacksmith/run-testbox@3f60ff9ceb2c10c3feefa87dc0c6490cffae059d
-        if: always()
+        if: success()
         env:
           FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

.github/workflows/ci.yml

@@ -100,7 +100,6 @@ jobs:
       run_macos_node: ${{ steps.manifest.outputs.run_macos_node }}
       macos_node_matrix: ${{ steps.manifest.outputs.macos_node_matrix }}
       run_macos_swift: ${{ steps.manifest.outputs.run_macos_swift }}
-      run_ios_build: ${{ steps.manifest.outputs.run_ios_build }}
       run_android_job: ${{ steps.manifest.outputs.run_android_job }}
       android_matrix: ${{ steps.manifest.outputs.android_matrix }}
     steps:
@@ -205,7 +204,6 @@ jobs:
           OPENCLAW_CI_DOCS_CHANGED: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.docs_scope.outputs.docs_changed }}
           OPENCLAW_CI_RUN_NODE: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_node || 'false' }}
           OPENCLAW_CI_RUN_MACOS: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_macos || 'false' }}
-          OPENCLAW_CI_RUN_IOS_BUILD: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_ios_build || 'false' }}
           OPENCLAW_CI_RUN_ANDROID: ${{ github.event_name == 'workflow_dispatch' && (inputs.release_gate || inputs.include_android) && 'true' || steps.changed_scope.outputs.run_android || 'false' }}
           OPENCLAW_CI_RUN_WINDOWS: ${{ github.event_name == 'workflow_dispatch' && 'true' || steps.changed_scope.outputs.run_windows || 'false' }}
           OPENCLAW_CI_RUN_NODE_FAST_ONLY: ${{ github.event_name == 'workflow_dispatch' && 'false' || steps.changed_scope.outputs.run_node_fast_only || 'false' }}
@@ -269,8 +267,6 @@ jobs:
           const runPluginContractShards = runNodeFull || runNodeFastPluginContracts;
           const runMacos =
             parseBoolean(process.env.OPENCLAW_CI_RUN_MACOS) && !docsOnly && isCanonicalRepository;
-          const runIosBuild =
-            parseBoolean(process.env.OPENCLAW_CI_RUN_IOS_BUILD) && !docsOnly && isCanonicalRepository;
           const runAndroid =
             parseBoolean(process.env.OPENCLAW_CI_RUN_ANDROID) && !docsOnly && isCanonicalRepository;
           const runWindows =
@@ -365,7 +361,6 @@ jobs:
               runMacos ? [{ check_name: "macos-node", runtime: "node", task: "test" }] : [],
             ),
             run_macos_swift: runMacos,
-            run_ios_build: runIosBuild,
             run_android_job: runAndroid,
             android_matrix: createMatrix(
               runAndroid
@@ -1182,9 +1177,7 @@ jobs:
     timeout-minutes: ${{ matrix.timeout_minutes || 60 }}
     strategy:
       fail-fast: false
-      # The canonical main path waits for the admission debounce above, so
-      # modestly widen this large matrix without recreating registration bursts.
-      max-parallel: 16
+      max-parallel: 12
       matrix: ${{ fromJson(needs.preflight.outputs.checks_node_core_nondist_matrix) }}
     steps:
       - name: Checkout
@@ -2167,76 +2160,6 @@ jobs:
           done
           exit 1
 
-  ios-build:
-    permissions:
-      contents: read
-    name: "ios-build"
-    needs: [preflight]
-    if: needs.preflight.outputs.run_ios_build == 'true'
-    runs-on: ${{ github.event_name == 'workflow_dispatch' && 'macos-26' || (github.repository == 'openclaw/openclaw' && 'blacksmith-12vcpu-macos-26' || 'macos-26') }}
-    timeout-minutes: 45
-    steps:
-      - name: Checkout
-        env:
-          CHECKOUT_REPO: ${{ github.repository }}
-          CHECKOUT_SHA: ${{ needs.preflight.outputs.checkout_revision }}
-        run: |
-          set -euo pipefail
-          git init "$GITHUB_WORKSPACE"
-          git -C "$GITHUB_WORKSPACE" config gc.auto 0
-          git -C "$GITHUB_WORKSPACE" remote add origin "https://github.com/${CHECKOUT_REPO}.git"
-          fetch_timeout_seconds=90
-          fetch_checkout_ref() {
-            git -C "$GITHUB_WORKSPACE" \
-              -c protocol.version=2 \
-              fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
-              "+${CHECKOUT_SHA}:refs/remotes/origin/checkout" &
-            local fetch_pid="$!"
-            local elapsed=0
-            while kill -0 "$fetch_pid" 2>/dev/null; do
-              if [ "$elapsed" -ge "$fetch_timeout_seconds" ]; then
-                kill -TERM "$fetch_pid" 2>/dev/null || true
-                sleep 10
-                kill -KILL "$fetch_pid" 2>/dev/null || true
-                wait "$fetch_pid" || true
-                return 124
-              fi
-              sleep 1
-              elapsed=$((elapsed + 1))
-            done
-            wait "$fetch_pid"
-          }
-          fetch_checkout_ref
-          git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout
-
-      - name: Select Xcode 26
-        run: |
-          set -euo pipefail
-          for xcode_app in /Applications/Xcode_26.5.app /Applications/Xcode-26.5.0.app; do
-            if [ -d "$xcode_app/Contents/Developer" ]; then
-              sudo xcode-select -s "$xcode_app/Contents/Developer"
-              break
-            fi
-          done
-          xcodebuild -version
-          xcode_version="$(xcodebuild -version | awk 'NR == 1 { print $2 }')"
-          if [[ "$xcode_version" != 26.* ]]; then
-            echo "error: expected Xcode 26.x, got $xcode_version" >&2
-            exit 1
-          fi
-          swift --version
-
-      - name: Setup Node environment
-        uses: ./.github/actions/setup-node-env
-        with:
-          install-bun: "false"
-
-      - name: Install iOS Swift tooling
-        run: brew install xcodegen swiftlint swiftformat
-
-      - name: Build iOS app
-        run: pnpm ios:build
-
   android:
     permissions:
       contents: read
@@ -2310,7 +2233,7 @@ jobs:
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: ~/.android-sdk
-          key: ${{ runner.os }}-android-sdk-v1-cmdline-14742923-platform-36-build-tools-36.0.0
+          key: ${{ runner.os }}-android-sdk-v1-cmdline-14742923-platform-37.0-build-tools-36.0.0
           restore-keys: |
             ${{ runner.os }}-android-sdk-v1-
 
@@ -2340,7 +2263,7 @@ jobs:
           yes | sdkmanager --sdk_root="${ANDROID_SDK_ROOT}" --licenses >/dev/null
           sdkmanager --sdk_root="${ANDROID_SDK_ROOT}" --install \
             "platform-tools" \
-            "platforms;android-36" \
+            "platforms;android-37.0" \
             "build-tools;36.0.0"
 
       - name: Run Android ${{ matrix.task }}
@@ -2388,7 +2311,6 @@ jobs:
       - checks-windows
       - macos-node
       - macos-swift
-      - ios-build
       - android
     if: ${{ !cancelled() && always() && github.event_name != 'push' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) }}
     runs-on: ubuntu-24.04

.github/workflows/codeql-critical-quality.yml

@@ -152,7 +152,7 @@ jobs:
   quality-shards:
     name: Select Critical Quality shards
     if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 5
     outputs:
       agent: ${{ steps.detect.outputs.agent }}
@@ -333,7 +333,7 @@ jobs:
     name: Critical Quality (core-auth-secrets)
     needs: quality-shards
     if: ${{ needs.quality-shards.outputs.core_auth_secrets == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'core-auth-secrets') }}
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 25
     steps:
       - name: Checkout
@@ -356,7 +356,7 @@ jobs:
     name: Critical Quality (config-boundary)
     needs: quality-shards
     if: ${{ needs.quality-shards.outputs.config == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'config-boundary') }}
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 25
     steps:
       - name: Checkout
@@ -379,7 +379,7 @@ jobs:
     name: Critical Quality (gateway-runtime-boundary)
     needs: quality-shards
     if: ${{ needs.quality-shards.outputs.gateway == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'gateway-runtime-boundary') }}
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 25
     steps:
       - name: Checkout
@@ -402,7 +402,7 @@ jobs:
     name: Critical Quality (channel-runtime-boundary)
     needs: quality-shards
     if: ${{ needs.quality-shards.outputs.channel == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'channel-runtime-boundary') }}
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 25
     steps:
       - name: Checkout
@@ -425,7 +425,7 @@ jobs:
     name: Critical Quality (network-runtime-boundary)
     needs: quality-shards
     if: ${{ needs.quality-shards.outputs.network_runtime == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'network-runtime-boundary') }}
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 25
     steps:
       - name: Checkout
@@ -509,7 +509,7 @@ jobs:
     name: Critical Quality (agent-runtime-boundary)
     needs: quality-shards
     if: ${{ needs.quality-shards.outputs.agent == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'agent-runtime-boundary') }}
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 25
     steps:
       - name: Checkout
@@ -532,7 +532,7 @@ jobs:
     name: Critical Quality (mcp-process-runtime-boundary)
     needs: quality-shards
     if: ${{ needs.quality-shards.outputs.mcp_process == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'mcp-process-runtime-boundary') }}
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 25
     steps:
       - name: Checkout
@@ -555,7 +555,7 @@ jobs:
     name: Critical Quality (memory-runtime-boundary)
     needs: quality-shards
     if: ${{ needs.quality-shards.outputs.memory == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'memory-runtime-boundary') }}
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 25
     steps:
       - name: Checkout
@@ -578,7 +578,7 @@ jobs:
     name: Critical Quality (session-diagnostics-boundary)
     needs: quality-shards
     if: ${{ needs.quality-shards.outputs.session_diagnostics == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'session-diagnostics-boundary') }}
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 25
     steps:
       - name: Checkout
@@ -601,7 +601,7 @@ jobs:
     name: Critical Quality (plugin-sdk-reply-runtime)
     needs: quality-shards
     if: ${{ needs.quality-shards.outputs.plugin_sdk_reply == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'plugin-sdk-reply-runtime') }}
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 25
     steps:
       - name: Checkout
@@ -624,7 +624,7 @@ jobs:
     name: Critical Quality (provider-runtime-boundary)
     needs: quality-shards
     if: ${{ needs.quality-shards.outputs.provider == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'provider-runtime-boundary') }}
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 25
     steps:
       - name: Checkout
@@ -646,7 +646,7 @@ jobs:
   ui-control-plane:
     name: Critical Quality (ui-control-plane)
     if: ${{ github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' || inputs.profile == 'all') }}
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 25
     steps:
       - name: Checkout
@@ -668,7 +668,7 @@ jobs:
   web-media-runtime-boundary:
     name: Critical Quality (web-media-runtime-boundary)
     if: ${{ github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' || inputs.profile == 'all') }}
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 25
     steps:
       - name: Checkout
@@ -691,7 +691,7 @@ jobs:
     name: Critical Quality (plugin-boundary)
     needs: quality-shards
     if: ${{ needs.quality-shards.outputs.plugin == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'plugin-boundary') }}
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 25
     steps:
       - name: Checkout
@@ -714,7 +714,7 @@ jobs:
     name: Critical Quality (plugin-sdk-package-contract)
     needs: quality-shards
     if: ${{ needs.quality-shards.outputs.plugin_sdk_package == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'plugin-sdk-package-contract') }}
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 25
     steps:
       - name: Checkout

.github/workflows/codeql.yml

@@ -22,6 +22,12 @@ on:
   push:
     branches:
       - main
+    paths:
+      - ".github/actions/**"
+      - ".github/codeql/**"
+      - ".github/workflows/**"
+      - "packages/**"
+      - "src/**"
   schedule:
     - cron: "0 6 * * *"
 
@@ -49,32 +55,32 @@ jobs:
         include:
           - language: javascript-typescript
             category: core-auth-secrets
-            runs_on: ubuntu-24.04
+            runs_on: blacksmith-8vcpu-ubuntu-2404
             timeout_minutes: 25
             config_file: ./.github/codeql/codeql-core-auth-secrets-critical-security.yml
           - language: javascript-typescript
             category: channel-runtime-boundary
-            runs_on: ubuntu-24.04
+            runs_on: blacksmith-8vcpu-ubuntu-2404
             timeout_minutes: 25
             config_file: ./.github/codeql/codeql-channel-runtime-boundary-critical-security.yml
           - language: javascript-typescript
             category: network-ssrf-boundary
-            runs_on: ubuntu-24.04
+            runs_on: blacksmith-4vcpu-ubuntu-2404
             timeout_minutes: 25
             config_file: ./.github/codeql/codeql-network-ssrf-boundary-critical-security.yml
           - language: javascript-typescript
             category: mcp-process-tool-boundary
-            runs_on: ubuntu-24.04
+            runs_on: blacksmith-4vcpu-ubuntu-2404
             timeout_minutes: 25
             config_file: ./.github/codeql/codeql-mcp-process-tool-boundary-critical-security.yml
           - language: javascript-typescript
             category: plugin-trust-boundary
-            runs_on: ubuntu-24.04
+            runs_on: blacksmith-4vcpu-ubuntu-2404
             timeout_minutes: 25
             config_file: ./.github/codeql/codeql-plugin-trust-boundary-critical-security.yml
           - language: actions
             category: actions
-            runs_on: ubuntu-24.04
+            runs_on: blacksmith-8vcpu-ubuntu-2404
             timeout_minutes: 10
             config_file: ./.github/codeql/codeql-actions-critical-security.yml
     steps:

.github/workflows/crabbox-hydrate.yml

@@ -171,19 +171,10 @@ jobs:
           set -euo pipefail
 
           node_bin="$(dirname "$(node -p 'process.execPath')")"
-          link_node_tool() {
-            local tool="$1"
-            local source="$node_bin/$tool"
-            local target="/usr/local/bin/$tool"
-            if [ -e "$target" ] && [ "$(readlink -f "$source")" = "$(readlink -f "$target")" ]; then
-              return
-            fi
-            sudo ln -sf "$source" "$target"
-          }
-          link_node_tool node
-          link_node_tool npm
-          link_node_tool npx
-          link_node_tool corepack
+          sudo ln -sf "$node_bin/node" /usr/local/bin/node
+          sudo ln -sf "$node_bin/npm" /usr/local/bin/npm
+          sudo ln -sf "$node_bin/npx" /usr/local/bin/npx
+          sudo ln -sf "$node_bin/corepack" /usr/local/bin/corepack
           sudo tee /usr/local/bin/pnpm >/dev/null <<'PNPM'
           #!/usr/bin/env bash
           exec /usr/local/bin/corepack pnpm "$@"
@@ -499,7 +490,7 @@ jobs:
           if (-not $env:CRABBOX_ID -or $env:CRABBOX_ID -notmatch '^[A-Za-z0-9._-]+$') {
             Write-Error "Invalid crabbox_id"
           }
-          $actionsRoot = "C:\ProgramData\crabbox\actions"
+          $actionsRoot = Join-Path $HOME ".crabbox\actions"
           New-Item -ItemType Directory -Force $actionsRoot | Out-Null
           $state = Join-Path $actionsRoot "$env:CRABBOX_ID.env"
           $envFile = Join-Path $actionsRoot "$env:CRABBOX_ID.env.ps1"
@@ -555,7 +546,7 @@ jobs:
           if ($env:CRABBOX_KEEP_ALIVE_MINUTES -match '^[0-9]+$') {
             $minutes = [int]$env:CRABBOX_KEEP_ALIVE_MINUTES
           }
-          $stop = Join-Path "C:\ProgramData\crabbox\actions" "$env:CRABBOX_ID.stop"
+          $stop = Join-Path $HOME ".crabbox\actions\$env:CRABBOX_ID.stop"
           $deadline = (Get-Date).AddMinutes($minutes)
           while ((Get-Date) -lt $deadline) {
             if (Test-Path $stop) {
@@ -593,19 +584,10 @@ jobs:
           fi
 
           node_bin="$(dirname "$(node -p 'process.execPath')")"
-          link_node_tool() {
-            local tool="$1"
-            local source="$node_bin/$tool"
-            local target="/usr/local/bin/$tool"
-            if [ -e "$target" ] && [ "$(readlink -f "$source")" = "$(readlink -f "$target")" ]; then
-              return
-            fi
-            sudo ln -sf "$source" "$target"
-          }
-          link_node_tool node
-          link_node_tool npm
-          link_node_tool npx
-          link_node_tool corepack
+          sudo ln -sf "$node_bin/node" /usr/local/bin/node
+          sudo ln -sf "$node_bin/npm" /usr/local/bin/npm
+          sudo ln -sf "$node_bin/npx" /usr/local/bin/npx
+          sudo ln -sf "$node_bin/corepack" /usr/local/bin/corepack
           sudo tee /usr/local/bin/pnpm >/dev/null <<'PNPM'
           #!/usr/bin/env bash
           exec /usr/local/bin/corepack pnpm "$@"

.github/workflows/ios-periphery-comment.yml

@@ -27,8 +27,10 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
+            const fs = require("node:fs");
+            const os = require("node:os");
             const path = require("node:path");
-            const zlib = require("node:zlib");
+            const childProcess = require("node:child_process");
 
             const marker = "<!-- openclaw-ios-periphery-dead-code -->";
             const run = context.payload.workflow_run;
@@ -124,7 +126,10 @@ jobs:
                 archive_format: "zip",
               });
 
+              const dir = fs.mkdtempSync(path.join(os.tmpdir(), "ios-periphery-"));
+              const archivePath = path.join(dir, "artifact.zip");
               const archiveBuffer = Buffer.from(archive.data);
+              fs.writeFileSync(archivePath, archiveBuffer);
 
               const allowedArtifactFiles = new Set([
                 "periphery.json",
@@ -235,59 +240,19 @@ jobs:
                   return;
                 }
 
-                entries.set(name, {
-                  compressedSize,
-                  compressionMethod,
-                  localHeaderOffset: readUInt32(offset + 42),
-                  uncompressedSize,
-                });
+                entries.set(name, { uncompressedSize });
                 offset = nextOffset;
               }
 
-              const readZipEntry = (name, entry) => {
-                const localHeaderOffset = entry.localHeaderOffset;
-                if (
-                  localHeaderOffset + 30 > archiveBuffer.length ||
-                  readUInt32(localHeaderOffset) !== 0x04034b50
-                ) {
-                  throw new Error(`${name} has an invalid local header.`);
-                }
-
-                const localNameLength = readUInt16(localHeaderOffset + 26);
-                const localExtraLength = readUInt16(localHeaderOffset + 28);
-                const dataStart = localHeaderOffset + 30 + localNameLength + localExtraLength;
-                const dataEnd = dataStart + entry.compressedSize;
-                if (dataEnd > archiveBuffer.length) {
-                  throw new Error(`${name} exceeds archive bounds.`);
-                }
-
-                const compressed = archiveBuffer.subarray(dataStart, dataEnd);
-                let contents;
-                if (entry.compressionMethod === 0) {
-                  contents = compressed;
-                } else {
-                  try {
-                    contents = zlib.inflateRawSync(compressed, { maxOutputLength: maxEntryBytes });
-                  } catch (error) {
-                    if (error && error.code === "ERR_BUFFER_TOO_LARGE") {
-                      throw new Error(`${name} exceeded the per-file size limit while reading.`);
-                    }
-                    throw error;
-                  }
-                }
-                if (contents.length !== entry.uncompressedSize || contents.length > maxEntryBytes) {
-                  throw new Error(`${name} exceeded the per-file size limit while reading.`);
-                }
-                return contents.toString("utf8");
-              };
-
               const files = new Map();
               for (const [name, entry] of entries) {
-                let contents;
-                try {
-                  contents = readZipEntry(name, entry);
-                } catch (error) {
-                  core.warning(`Skipping ${artifactName}; ${error instanceof Error ? error.message : String(error)}`);
+                const contents = childProcess.execFileSync("unzip", ["-p", archivePath, name], {
+                  encoding: "utf8",
+                  maxBuffer: Math.max(1, entry.uncompressedSize + 1024),
+                  timeout: 5000,
+                });
+                if (Buffer.byteLength(contents, "utf8") > maxEntryBytes) {
+                  core.warning(`Skipping ${artifactName}; ${name} exceeded the per-file size limit while reading.`);
                   return;
                 }
                 files.set(name, contents);

.github/workflows/ios-periphery.yml

@@ -220,7 +220,7 @@ jobs:
         with:
           name: ios-periphery-dead-code-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ runner.temp }}/ios-periphery
-          if-no-files-found: error
+          if-no-files-found: warn
           retention-days: 14
 
       - name: Fail on dead code

.github/workflows/mantis-discord-smoke.yml

@@ -171,4 +171,4 @@ jobs:
           name: mantis-discord-smoke-${{ github.run_id }}-${{ github.run_attempt }}
           path: .artifacts/qa-e2e/mantis/
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn

.github/workflows/mantis-discord-status-reactions.yml

@@ -540,7 +540,7 @@ jobs:
           name: mantis-discord-status-reactions-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ steps.run_mantis.outputs.output_dir }}
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
       - name: Create Mantis GitHub App token
         id: mantis_app_token

.github/workflows/mantis-discord-thread-attachment.yml

@@ -547,7 +547,7 @@ jobs:
         with:
           name: mantis-discord-thread-attachment-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ steps.run_mantis.outputs.output_dir }}
-          if-no-files-found: error
+          if-no-files-found: warn
           retention-days: 14
 
       - name: Create Mantis GitHub App token

.github/workflows/mantis-slack-desktop-smoke.yml

@@ -458,7 +458,7 @@ jobs:
           name: mantis-slack-desktop-smoke-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ steps.run_mantis.outputs.output_dir }}
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
       - name: Create Mantis GitHub App token
         id: mantis_app_token

.github/workflows/mantis-telegram-desktop-proof.yml

@@ -556,7 +556,7 @@ jobs:
           name: mantis-telegram-desktop-proof-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ steps.inspect.outputs.output_dir }}
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
       - name: Create Mantis GitHub App token
         id: mantis_app_token

.github/workflows/mantis-telegram-live.yml

@@ -506,7 +506,7 @@ jobs:
           name: mantis-telegram-live-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ steps.run_mantis.outputs.output_dir }}
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
       - name: Create Mantis GitHub App token
         id: mantis_app_token

.github/workflows/maturity-scorecard.yml

@@ -1,464 +0,0 @@
-name: Maturity scorecard
-
-on:
-  workflow_dispatch:
-    inputs:
-      qa_evidence_run_id:
-        description: Optional workflow run id containing qa-evidence.json
-        required: false
-        type: string
-      ref:
-        description: OpenClaw branch, tag, or SHA containing the maturity score source
-        required: true
-        default: main
-        type: string
-      expected_sha:
-        description: Optional full SHA that ref must resolve to
-        required: false
-        default: ""
-        type: string
-  workflow_call:
-    inputs:
-      qa_evidence_run_id:
-        description: Optional workflow run id containing qa-evidence.json
-        required: false
-        default: ""
-        type: string
-      ref:
-        description: OpenClaw branch, tag, or SHA containing the maturity score source
-        required: true
-        type: string
-      expected_sha:
-        description: Optional full SHA that ref must resolve to
-        required: false
-        default: ""
-        type: string
-    secrets:
-      OPENAI_API_KEY:
-        description: OpenAI API key used by live QA profile scenarios
-        required: true
-      OPENCLAW_MATURITY_SCORECARD_AGENT_OPENAI_API_KEY:
-        description: Optional OpenAI API key used by maturity scorecard agent steps
-        required: false
-      GH_APP_PRIVATE_KEY:
-        description: Optional GitHub App private key for generated docs PR creation
-        required: false
-      GH_APP_PRIVATE_KEY_FALLBACK:
-        description: Optional fallback GitHub App private key for generated docs PR creation
-        required: false
-
-permissions:
-  actions: read
-  contents: read
-
-concurrency:
-  group: ${{ format('{0}-{1}-{2}', github.workflow, inputs.ref, inputs.qa_evidence_run_id || github.run_id) }}
-  cancel-in-progress: true
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  NODE_VERSION: "24.x"
-
-jobs:
-  validate_selected_ref:
-    name: Validate selected ref
-    runs-on: ubuntu-24.04
-    outputs:
-      selected_revision: ${{ steps.validate.outputs.selected_revision }}
-      trusted_reason: ${{ steps.validate.outputs.trusted_reason }}
-    steps:
-      - name: Checkout selected ref
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-        with:
-          persist-credentials: false
-          ref: ${{ inputs.ref }}
-          fetch-depth: 0
-
-      - name: Validate selected ref
-        id: validate
-        env:
-          EXPECTED_SHA: ${{ inputs.expected_sha }}
-          INPUT_REF: ${{ inputs.ref }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          selected_revision="$(git rev-parse HEAD)"
-          expected_sha="${EXPECTED_SHA,,}"
-          trusted_reason=""
-
-          if [[ -n "${expected_sha// }" && ! "$expected_sha" =~ ^[0-9a-f]{40}$ ]]; then
-            echo "expected_sha must be a full 40-character SHA; got: ${EXPECTED_SHA}" >&2
-            exit 1
-          fi
-          if [[ -n "${expected_sha// }" && "${selected_revision,,}" != "$expected_sha" ]]; then
-            echo "Ref '${INPUT_REF}' resolved to ${selected_revision}, expected ${EXPECTED_SHA}." >&2
-            exit 1
-          fi
-
-          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
-
-          if git merge-base --is-ancestor "$selected_revision" refs/remotes/origin/main; then
-            trusted_reason="main-ancestor"
-          elif git tag --points-at "$selected_revision" | grep -Eq '^v'; then
-            trusted_reason="release-tag"
-          elif [[ "$INPUT_REF" =~ ^release/[0-9]{4}\.[0-9]+\.[0-9]+$ ]]; then
-            git fetch --no-tags origin "+refs/heads/${INPUT_REF}:refs/remotes/origin/${INPUT_REF}"
-            release_branch_sha="$(git rev-parse "refs/remotes/origin/${INPUT_REF}")"
-            if [[ "$selected_revision" == "$release_branch_sha" ]]; then
-              trusted_reason="release-branch-head"
-            fi
-          fi
-
-          if [[ -z "$trusted_reason" ]]; then
-            echo "Ref '${INPUT_REF}' resolved to $selected_revision, which is not trusted for this secret-bearing maturity scorecard run." >&2
-            echo "Allowed refs must be on main, point to a release tag, or match a release branch head." >&2
-            exit 1
-          fi
-
-          echo "selected_revision=$selected_revision" >> "$GITHUB_OUTPUT"
-          echo "trusted_reason=$trusted_reason" >> "$GITHUB_OUTPUT"
-          {
-            echo "### Target"
-            echo
-            echo "- Requested ref: \`${INPUT_REF}\`"
-            echo "- Resolved SHA: \`$selected_revision\`"
-            echo "- Trust reason: \`$trusted_reason\`"
-          } >> "$GITHUB_STEP_SUMMARY"
-
-  generate_qa_evidence:
-    name: Generate full taxonomy QA evidence
-    needs: validate_selected_ref
-    if: ${{ inputs.qa_evidence_run_id == '' }}
-    uses: ./.github/workflows/qa-profile-evidence.yml
-    with:
-      ref: ${{ inputs.ref }}
-      expected_sha: ${{ needs.validate_selected_ref.outputs.selected_revision }}
-      qa_profile: release
-    secrets:
-      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-
-  publish:
-    name: Publish maturity docs PR
-    needs:
-      - validate_selected_ref
-      - generate_qa_evidence
-    if: ${{ always() && needs.validate_selected_ref.result == 'success' && (inputs.qa_evidence_run_id != '' || needs.generate_qa_evidence.result == 'success') }}
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    permissions:
-      actions: read
-      contents: read
-    steps:
-      - name: Checkout selected ref
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-        with:
-          ref: ${{ needs.validate_selected_ref.outputs.selected_revision }}
-          fetch-depth: 1
-          fetch-tags: false
-          persist-credentials: false
-          submodules: false
-
-      - name: Setup Node environment
-        uses: ./.github/actions/setup-node-env
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          install-bun: "false"
-
-      - name: Download provided QA evidence artifact
-        if: ${{ inputs.qa_evidence_run_id != '' }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          QA_EVIDENCE_RUN_ID: ${{ inputs.qa_evidence_run_id }}
-        run: |
-          set -euo pipefail
-          mkdir -p .artifacts/maturity-evidence
-          gh run download "$QA_EVIDENCE_RUN_ID" \
-            --repo "$GITHUB_REPOSITORY" \
-            --dir .artifacts/maturity-evidence
-
-      - name: Download generated QA evidence artifact
-        if: ${{ inputs.qa_evidence_run_id == '' }}
-        env:
-          GENERATED_ARTIFACT_NAME: ${{ needs.generate_qa_evidence.outputs.artifact_name }}
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          if [[ -z "${GENERATED_ARTIFACT_NAME:-}" ]]; then
-            echo "Generated QA evidence workflow did not expose an artifact name." >&2
-            exit 1
-          fi
-          mkdir -p .artifacts/maturity-evidence
-          gh run download "$GITHUB_RUN_ID" \
-            --repo "$GITHUB_REPOSITORY" \
-            --name "$GENERATED_ARTIFACT_NAME" \
-            --dir .artifacts/maturity-evidence
-
-      - name: Require one QA evidence file
-        id: evidence
-        env:
-          QA_EVIDENCE_RUN_ID: ${{ inputs.qa_evidence_run_id }}
-        run: |
-          set -euo pipefail
-          mapfile -t evidence_paths < <(find .artifacts/maturity-evidence -type f -name qa-evidence.json | sort)
-          if [[ "${#evidence_paths[@]}" -eq 0 ]]; then
-            echo "Expected a qa-evidence.json file in the downloaded QA evidence artifact." >&2
-            exit 1
-          fi
-          if [[ "${#evidence_paths[@]}" -gt 1 ]]; then
-            echo "Expected exactly one qa-evidence.json file, found ${#evidence_paths[@]}:" >&2
-            printf '%s\n' "${evidence_paths[@]}" >&2
-            exit 1
-          fi
-          echo "qa_evidence_path=${evidence_paths[0]}" >> "$GITHUB_OUTPUT"
-          {
-            echo "### QA evidence"
-            echo
-            echo "- Evidence path: \`${evidence_paths[0]}\`"
-            echo "- Evidence source run: \`${QA_EVIDENCE_RUN_ID:-$GITHUB_RUN_ID}\`"
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Validate QA evidence manifest
-        env:
-          QA_EVIDENCE_PATH: ${{ steps.evidence.outputs.qa_evidence_path }}
-          TARGET_SHA: ${{ needs.validate_selected_ref.outputs.selected_revision }}
-        run: |
-          set -euo pipefail
-          node --input-type=module <<'NODE'
-          import fs from "node:fs";
-          import path from "node:path";
-
-          const evidencePath = process.env.QA_EVIDENCE_PATH;
-          const targetSha = process.env.TARGET_SHA;
-          if (!evidencePath) {
-            throw new Error("QA_EVIDENCE_PATH is required");
-          }
-          if (!targetSha) {
-            throw new Error("TARGET_SHA is required");
-          }
-
-          const evidence = JSON.parse(fs.readFileSync(evidencePath, "utf8"));
-          if (evidence.profile !== "release") {
-            throw new Error(`qa-evidence.json profile must be release, got ${JSON.stringify(evidence.profile)}`);
-          }
-
-          const artifactDir = path.dirname(evidencePath);
-          const manifestNames = fs
-            .readdirSync(artifactDir)
-            .filter((name) => name.endsWith("qa-profile-evidence-manifest.json"))
-            .sort();
-          if (manifestNames.length !== 1) {
-            throw new Error(
-              `Expected exactly one QA profile evidence manifest next to qa-evidence.json, found ${manifestNames.length}`,
-            );
-          }
-
-          const manifestPath = path.join(artifactDir, manifestNames[0]);
-          const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
-          const manifestProfile = manifest.qaProfile ?? evidence.profile;
-          if (manifestProfile !== "release") {
-            throw new Error(`QA evidence manifest profile must be release, got ${JSON.stringify(manifestProfile)}`);
-          }
-          if (manifest.targetSha !== targetSha) {
-            throw new Error(`QA evidence manifest targetSha ${manifest.targetSha} does not match selected ref ${targetSha}`);
-          }
-          NODE
-
-      - name: Ensure maturity scorecard agent key exists
-        env:
-          OPENAI_API_KEY: ${{ secrets.OPENCLAW_MATURITY_SCORECARD_AGENT_OPENAI_API_KEY || secrets.OPENAI_API_KEY }}
-        run: |
-          set -euo pipefail
-          if [[ -z "${OPENAI_API_KEY:-}" ]]; then
-            echo "Missing OPENCLAW_MATURITY_SCORECARD_AGENT_OPENAI_API_KEY or OPENAI_API_KEY secret." >&2
-            exit 1
-          fi
-
-      - name: Run Codex maturity scorecard agent
-        uses: openai/codex-action@e0fdf01220eb9a88167c4898839d273e3f2609d1
-        env:
-          MATURITY_EVIDENCE_DIR: .artifacts/maturity-evidence
-          MATURITY_SCORES_PATH: qa/maturity-scores.yaml
-          MATURITY_TAXONOMY_PATH: taxonomy.yaml
-        with:
-          openai-api-key: ${{ secrets.OPENCLAW_MATURITY_SCORECARD_AGENT_OPENAI_API_KEY || secrets.OPENAI_API_KEY }}
-          prompt-file: .github/codex/prompts/maturity-scorecard-agent.md
-          model: ${{ vars.OPENCLAW_CI_OPENAI_MODEL_BARE }}
-          effort: high
-          sandbox: workspace-write
-          safety-strategy: drop-sudo
-
-      - name: Enforce focused maturity score patch
-        run: |
-          set -euo pipefail
-          git restore --staged :/
-
-          allowed='^qa/maturity-scores\.yaml$'
-          bad_tracked="$(
-            git diff --name-only HEAD -- | while IFS= read -r path; do
-              if [[ ! "$path" =~ $allowed ]]; then
-                printf '%s\n' "$path"
-              fi
-            done
-          )"
-          if [[ -n "$bad_tracked" ]]; then
-            echo "Maturity scorecard agent touched forbidden tracked paths:"
-            printf '%s\n' "$bad_tracked"
-            exit 1
-          fi
-
-          bad_untracked="$(
-            git ls-files --others --exclude-standard | while IFS= read -r path; do
-              if [[ "$path" != "qa/maturity-scores.yaml" ]]; then
-                printf '%s\n' "$path"
-              fi
-            done
-          )"
-          if [[ -n "$bad_untracked" ]]; then
-            echo "Maturity scorecard agent created forbidden untracked paths:"
-            printf '%s\n' "$bad_untracked"
-            exit 1
-          fi
-
-          if [[ ! -f qa/maturity-scores.yaml ]]; then
-            echo "Maturity scorecard agent must produce qa/maturity-scores.yaml." >&2
-            exit 1
-          fi
-
-      - name: Validate maturity score sources
-        run: |
-          node --import tsx --input-type=module <<'NODE'
-          import { readValidatedQaMaturityScoreSources } from "./extensions/qa-lab/src/scorecard-taxonomy.ts";
-
-          const { warnings } = readValidatedQaMaturityScoreSources({
-            scoresPath: "qa/maturity-scores.yaml",
-            taxonomyPath: "taxonomy.yaml",
-          });
-          for (const warning of warnings) {
-            console.error(`warning: ${warning}`);
-          }
-          NODE
-
-      - name: Render artifact docs
-        run: |
-          set -euo pipefail
-          pnpm maturity:render -- \
-            --output-dir .artifacts/maturity-docs \
-            --static-assets-dir .artifacts/maturity-docs/assets/maturity \
-            --scores qa/maturity-scores.yaml \
-            --evidence-dir .artifacts/maturity-evidence \
-            --strict-inputs
-          {
-            echo "### Maturity scorecard docs"
-            echo
-            echo "- Source validation: passed"
-            echo "- Artifact docs: \`.artifacts/maturity-docs\`"
-            echo "- Strict inputs: \`true\`"
-            echo "- QA evidence: included"
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Render committed docs preview
-        run: |
-          set -euo pipefail
-          pnpm maturity:render -- \
-            --output-dir docs \
-            --scores qa/maturity-scores.yaml \
-            --evidence-dir .artifacts/maturity-evidence \
-            --strict-inputs
-
-      - name: Create generated docs PR app token
-        if: ${{ github.event_name == 'workflow_dispatch' }}
-        id: app-token
-        continue-on-error: true
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
-        with:
-          app-id: "2729701"
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-          permission-contents: write
-          permission-pull-requests: write
-
-      - name: Create generated docs PR fallback app token
-        if: ${{ github.event_name == 'workflow_dispatch' && steps.app-token.outcome == 'failure' }}
-        id: app-token-fallback
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
-        with:
-          app-id: "2971289"
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY_FALLBACK }}
-          permission-contents: write
-          permission-pull-requests: write
-
-      - name: Open generated docs PR
-        if: ${{ github.event_name == 'workflow_dispatch' }}
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token || steps.app-token-fallback.outputs.token }}
-          QA_EVIDENCE_RUN_ID: ${{ inputs.qa_evidence_run_id }}
-          REF_INPUT: ${{ inputs.ref }}
-        run: |
-          set -euo pipefail
-          if [[ -z "${GH_TOKEN:-}" ]]; then
-            echo "Maturity scorecard PR creation requires the OpenClaw GitHub App token secrets." >&2
-            exit 1
-          fi
-
-          if [[ -z "$(git status --porcelain -- qa/maturity-scores.yaml docs/maturity/scorecard.md docs/maturity/taxonomy.md)" ]]; then
-            {
-              echo
-              echo "- Pull request: skipped; generated scorecard matches selected ref"
-            } >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          evidence_run_id="${QA_EVIDENCE_RUN_ID:-$GITHUB_RUN_ID}"
-          branch="automation/maturity-scorecard-${evidence_run_id}"
-          base_branch="${REF_INPUT:-main}"
-          if ! git ls-remote --exit-code --heads origin "$base_branch" >/dev/null 2>&1; then
-            base_branch="main"
-          fi
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          gh auth setup-git
-          git fetch --no-tags --depth=1 origin "refs/heads/${branch}:refs/remotes/origin/${branch}" || true
-          git switch -C "$branch"
-          git add qa/maturity-scores.yaml docs/maturity/scorecard.md docs/maturity/taxonomy.md
-          git commit -m "docs: update maturity scorecard"
-          git push --force-with-lease origin "$branch"
-
-          body_file=".artifacts/maturity-scorecard-pr-body.md"
-          mkdir -p "$(dirname "$body_file")"
-          cat > "$body_file" <<BODY
-          ## Summary
-
-          - render maturity scorecard docs from \`qa/maturity-scores.yaml\` and release QA evidence
-          - maturity source ref: ${REF_INPUT}
-          - QA evidence run: ${evidence_run_id}
-
-          ## Verification
-
-          - QA Lab maturity score validation passed
-          - Maturity scorecard workflow rendered docs from release profile qa-evidence.json artifacts with strict inputs
-          BODY
-
-          pr_url="$(gh pr list --head "$branch" --state open --json url --jq '.[0].url // ""')"
-          if [[ -n "$pr_url" ]]; then
-            gh pr edit "$pr_url" \
-              --title "docs: update maturity scorecard" \
-              --body-file "$body_file"
-          else
-            pr_url="$(gh pr create \
-              --base "$base_branch" \
-              --head "$branch" \
-              --title "docs: update maturity scorecard" \
-              --body-file "$body_file")"
-          fi
-          {
-            echo
-            echo "- Pull request: ${pr_url}"
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Upload maturity docs artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: maturity-scorecard-docs-${{ github.run_id }}-${{ github.run_attempt }}
-          path: .artifacts/maturity-docs/
-          retention-days: 30
-          if-no-files-found: error

.github/workflows/npm-telegram-beta-e2e.yml

@@ -273,4 +273,4 @@ jobs:
           name: npm-telegram-beta-e2e-${{ github.run_id }}-${{ github.run_attempt }}
           path: .artifacts/qa-e2e/
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn

.github/workflows/openclaw-live-and-e2e-checks-reusable.yml

@@ -609,6 +609,7 @@ jobs:
             requires_repo_e2e: true
             requires_live_suites: false
     env:
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
       OPENCLAW_E2E_WORKERS: "1"
       OPENCLAW_VITEST_MAX_WORKERS: "1"
     steps:
@@ -642,74 +643,9 @@ jobs:
           set -euo pipefail
           case "${{ matrix.suite_id }}" in
             openshell-e2e)
-              echo "OPENCLAW_E2E_OPENSHELL_CONFIG_HOME=$HOME/.config" >> "$GITHUB_ENV"
               ;;
           esac
 
-      - name: Install OpenShell CLI
-        if: |
-          (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id) &&
-          matrix.suite_id == 'openshell-e2e'
-        shell: bash
-        run: |
-          set -euo pipefail
-          export OPENSHELL_VERSION=v0.0.68
-          curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/d64542f69d06694cbd203b64929d286dd0533bbb/install.sh | sh
-          openshell --version
-
-      - name: Bootstrap OpenShell gateway
-        if: |
-          (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id) &&
-          matrix.suite_id == 'openshell-e2e'
-        shell: bash
-        run: |
-          set -euo pipefail
-          mtls_dir="$HOME/.config/openshell/gateways/openshell/mtls"
-          gateway_tls_dir="$RUNNER_TEMP/openshell-gateway-certs"
-          fallback_pid=""
-          if ! openshell --gateway openshell sandbox list >/dev/null 2>&1; then
-            rm -rf "$gateway_tls_dir"
-            openshell-gateway generate-certs \
-              --output-dir "$gateway_tls_dir" \
-              --server-san 127.0.0.1 \
-              --server-san localhost \
-              --server-san host.openshell.internal
-            rm -rf "$mtls_dir"
-            mkdir -p "$mtls_dir"
-            cp "$gateway_tls_dir/ca.crt" "$mtls_dir/ca.crt"
-            cp "$gateway_tls_dir/client/tls.crt" "$mtls_dir/tls.crt"
-            cp "$gateway_tls_dir/client/tls.key" "$mtls_dir/tls.key"
-            openshell gateway remove openshell >/dev/null 2>&1 || true
-            OPENSHELL_LOCAL_TLS_DIR="$gateway_tls_dir" nohup openshell-gateway \
-              --bind-address 0.0.0.0 \
-              --port 17670 \
-              --drivers docker \
-              --tls-cert "$gateway_tls_dir/server/tls.crt" \
-              --tls-key "$gateway_tls_dir/server/tls.key" \
-              --tls-client-ca "$mtls_dir/ca.crt" \
-              >"$RUNNER_TEMP/openshell-gateway.log" 2>&1 &
-            fallback_pid=$!
-            echo "OPENCLAW_OPENSHELL_FALLBACK_PID=$fallback_pid" >> "$GITHUB_ENV"
-            for _ in $(seq 1 30); do
-              if openshell gateway add --local --name openshell https://127.0.0.1:17670; then
-                break
-              fi
-              sleep 1
-            done
-            openshell gateway select openshell
-            for _ in $(seq 1 60); do
-              if openshell --gateway openshell sandbox list >/dev/null 2>&1; then
-                break
-              fi
-              sleep 1
-            done
-          fi
-          if [[ -z "$fallback_pid" ]]; then
-            echo "OPENCLAW_OPENSHELL_FALLBACK_PID=" >> "$GITHUB_ENV"
-          fi
-          openshell --gateway openshell sandbox list >/dev/null
-          openshell gateway list
-
       - name: Validate suite credentials
         if: inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id
         shell: bash
@@ -729,15 +665,6 @@ jobs:
           (inputs.live_suite_filter == '' || inputs.live_suite_filter == matrix.suite_id)
         run: ${{ matrix.command }}
 
-      - name: Stop fallback OpenShell gateway
-        if: always() && matrix.suite_id == 'openshell-e2e'
-        shell: bash
-        run: |
-          set -euo pipefail
-          if [[ -n "${OPENCLAW_OPENSHELL_FALLBACK_PID:-}" ]]; then
-            kill "$OPENCLAW_OPENSHELL_FALLBACK_PID" 2>/dev/null || true
-          fi
-
   validate_docker_e2e:
     needs: [validate_selected_ref, prepare_docker_e2e_image, plan_release_workflow_matrices]
     if: inputs.include_release_path_suites && inputs.docker_lanes == '' && needs.plan_release_workflow_matrices.outputs.docker_e2e_count != '0'

.github/workflows/openclaw-performance.yml

@@ -151,39 +151,11 @@ jobs:
             echo "present=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Resolve OpenClaw target ref
-        id: target
-        if: steps.lane.outputs.run == 'true'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          TARGET_REF_INPUT: ${{ inputs.target_ref }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          requested="${TARGET_REF_INPUT:-}"
-          if [[ -z "$requested" ]]; then
-            echo "checkout_ref=${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
-            echo "tested_ref=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          encoded_ref="$(node -e 'process.stdout.write(encodeURIComponent(process.argv[1]))' "$requested")"
-          if ! resolved_sha="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${encoded_ref}" --jq '.sha')"; then
-            echo "::error::Unable to resolve OpenClaw target_ref '${requested}'." >&2
-            exit 1
-          fi
-          if [[ ! "$resolved_sha" =~ ^[0-9a-f]{40}$ ]]; then
-            echo "::error::OpenClaw target_ref '${requested}' resolved to invalid SHA '${resolved_sha}'." >&2
-            exit 1
-          fi
-          echo "checkout_ref=${resolved_sha}" >> "$GITHUB_OUTPUT"
-          echo "tested_ref=${requested}" >> "$GITHUB_OUTPUT"
-
       - name: Checkout OpenClaw
         if: steps.lane.outputs.run == 'true'
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
-          ref: ${{ steps.target.outputs.checkout_ref }}
+          ref: ${{ inputs.target_ref || github.ref }}
           fetch-depth: 1
           persist-credentials: false
 

.github/workflows/openclaw-release-checks.yml

@@ -44,11 +44,6 @@ on:
         required: false
         default: false
         type: boolean
-      run_maturity_scorecard:
-        description: Render advisory maturity scorecard release docs; default release checks rely on dedicated package, QA, live, and E2E gates
-        required: false
-        default: false
-        type: boolean
       rerun_group:
         description: Release check group to run
         required: false
@@ -111,7 +106,6 @@ jobs:
       mode: ${{ steps.inputs.outputs.mode }}
       release_profile: ${{ steps.inputs.outputs.release_profile }}
       run_release_soak: ${{ steps.inputs.outputs.run_release_soak }}
-      run_maturity_scorecard: ${{ steps.inputs.outputs.run_maturity_scorecard }}
       rerun_group: ${{ steps.inputs.outputs.rerun_group }}
       live_suite_filter: ${{ steps.inputs.outputs.live_suite_filter }}
       cross_os_suite_filter: ${{ steps.inputs.outputs.cross_os_suite_filter }}
@@ -285,7 +279,6 @@ jobs:
           RELEASE_MODE_INPUT: ${{ inputs.mode }}
           RELEASE_PROFILE_INPUT: ${{ inputs.release_profile }}
           RELEASE_RUN_RELEASE_SOAK_INPUT: ${{ inputs.run_release_soak }}
-          RELEASE_RUN_MATURITY_SCORECARD_INPUT: ${{ inputs.run_maturity_scorecard }}
           RELEASE_RERUN_GROUP_INPUT: ${{ inputs.rerun_group }}
           RELEASE_LIVE_SUITE_FILTER_INPUT: ${{ inputs.live_suite_filter }}
           RELEASE_CROSS_OS_SUITE_FILTER_INPUT: ${{ inputs.cross_os_suite_filter }}
@@ -326,12 +319,6 @@ jobs:
           else
             run_release_soak=true
           fi
-          run_maturity_scorecard="$(printf '%s' "$RELEASE_RUN_MATURITY_SCORECARD_INPUT" | tr '[:upper:]' '[:lower:]')"
-          if [[ "$run_maturity_scorecard" != "true" && "$run_maturity_scorecard" != "1" && "$run_maturity_scorecard" != "yes" ]]; then
-            run_maturity_scorecard=false
-          else
-            run_maturity_scorecard=true
-          fi
           release_profile="$RELEASE_PROFILE_INPUT"
           if [[ "$release_profile" == "minimum" ]]; then
             release_profile=beta
@@ -435,7 +422,6 @@ jobs:
             printf 'mode=%s\n' "$RELEASE_MODE_INPUT"
             printf 'release_profile=%s\n' "$release_profile"
             printf 'run_release_soak=%s\n' "$run_release_soak"
-            printf 'run_maturity_scorecard=%s\n' "$run_maturity_scorecard"
             printf 'rerun_group=%s\n' "$RELEASE_RERUN_GROUP_INPUT"
             printf 'live_suite_filter=%s\n' "$RELEASE_LIVE_SUITE_FILTER_INPUT"
             printf 'cross_os_suite_filter=%s\n' "$RELEASE_CROSS_OS_SUITE_FILTER_INPUT"
@@ -458,7 +444,6 @@ jobs:
           RELEASE_MODE: ${{ inputs.mode }}
           RELEASE_PROFILE: ${{ steps.inputs.outputs.release_profile }}
           RUN_RELEASE_SOAK: ${{ steps.inputs.outputs.run_release_soak }}
-          RUN_MATURITY_SCORECARD: ${{ steps.inputs.outputs.run_maturity_scorecard }}
           RELEASE_RERUN_GROUP: ${{ inputs.rerun_group }}
           RELEASE_LIVE_SUITE_FILTER: ${{ inputs.live_suite_filter }}
           RELEASE_CROSS_OS_SUITE_FILTER: ${{ inputs.cross_os_suite_filter }}
@@ -476,7 +461,6 @@ jobs:
             echo "- Cross-OS mode: \`${RELEASE_MODE}\`"
             echo "- Release profile: \`${RELEASE_PROFILE}\`"
             echo "- Release soak lanes: \`${RUN_RELEASE_SOAK}\`"
-            echo "- Maturity scorecard docs: \`${RUN_MATURITY_SCORECARD}\`"
             echo "- Rerun group: \`${RELEASE_RERUN_GROUP}\`"
             if [[ -n "${RELEASE_LIVE_SUITE_FILTER// }" ]]; then
               echo "- Live suite filter: \`${RELEASE_LIVE_SUITE_FILTER}\`"
@@ -783,20 +767,6 @@ jobs:
       OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }}
       OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }}
 
-  maturity_scorecard_release_checks:
-    name: Render maturity scorecard release docs
-    needs: [resolve_target]
-    if: contains(fromJSON('["all","qa"]'), needs.resolve_target.outputs.rerun_group) && needs.resolve_target.outputs.run_maturity_scorecard == 'true'
-    permissions:
-      actions: read
-      contents: read
-    uses: ./.github/workflows/maturity-scorecard.yml
-    with:
-      ref: ${{ needs.resolve_target.outputs.ref }}
-      expected_sha: ${{ needs.resolve_target.outputs.revision }}
-    secrets:
-      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-
   qa_lab_parity_lane_release_checks:
     name: Run QA Lab parity lane (${{ matrix.lane }})
     needs: [resolve_target]
@@ -883,7 +853,7 @@ jobs:
           name: release-qa-parity-${{ matrix.lane }}-${{ needs.resolve_target.outputs.revision }}
           path: .artifacts/qa-e2e/
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
       - name: Record advisory status
         if: always()
@@ -989,7 +959,7 @@ jobs:
           name: release-qa-parity-${{ needs.resolve_target.outputs.revision }}
           path: .artifacts/qa-e2e/
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
       - name: Record advisory status
         if: always()
@@ -1161,7 +1131,7 @@ jobs:
           name: release-qa-runtime-parity-${{ needs.resolve_target.outputs.revision }}
           path: .artifacts/qa-e2e/
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
       - name: Record advisory status
         if: always()
@@ -1271,13 +1241,13 @@ jobs:
             --output .artifacts/qa-e2e/runtime-parity-standard-report/qa-runtime-tool-coverage-report.md
 
       - name: Upload runtime tool coverage artifacts
-        if: ${{ always() && steps.verify_runtime_parity_status.outputs.ready == 'true' }}
+        if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: release-qa-runtime-tool-coverage-${{ needs.resolve_target.outputs.revision }}
           path: .artifacts/qa-e2e/runtime-parity-standard-report/
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
   qa_live_matrix_release_checks:
     name: Run QA Lab live Matrix lane
@@ -1357,7 +1327,7 @@ jobs:
           name: release-qa-live-matrix-${{ needs.resolve_target.outputs.revision }}
           path: .artifacts/qa-e2e/
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
       - name: Record advisory status
         if: always()
@@ -1497,7 +1467,7 @@ jobs:
           name: release-qa-live-telegram-${{ needs.resolve_target.outputs.revision }}
           path: .artifacts/qa-e2e/
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
       - name: Record advisory status
         if: always()
@@ -1637,7 +1607,7 @@ jobs:
           name: release-qa-live-discord-${{ needs.resolve_target.outputs.revision }}
           path: .artifacts/qa-e2e/
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
       - name: Record advisory status
         if: always()
@@ -1780,7 +1750,7 @@ jobs:
           name: release-qa-live-whatsapp-${{ needs.resolve_target.outputs.revision }}
           path: .artifacts/qa-e2e/
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
       - name: Record advisory status
         if: always()
@@ -1920,7 +1890,7 @@ jobs:
           name: release-qa-live-slack-${{ needs.resolve_target.outputs.revision }}
           path: .artifacts/qa-e2e/
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
       - name: Record advisory status
         if: always()
@@ -1976,7 +1946,6 @@ jobs:
       - docker_e2e_release_checks
       - package_acceptance_release_checks
       - qa_lab_parity_lane_release_checks
-      - maturity_scorecard_release_checks
       - qa_lab_parity_report_release_checks
       - qa_lab_runtime_parity_release_checks
       - runtime_tool_coverage_release_checks
@@ -2062,7 +2031,6 @@ jobs:
             "docker_e2e_release_checks=${{ needs.docker_e2e_release_checks.result }}" \
             "package_acceptance_release_checks=${{ needs.package_acceptance_release_checks.result }}" \
             "qa_lab_parity_lane_release_checks=${{ needs.qa_lab_parity_lane_release_checks.result }}" \
-            "maturity_scorecard_release_checks=${{ needs.maturity_scorecard_release_checks.result }}" \
             "qa_lab_parity_report_release_checks=${{ needs.qa_lab_parity_report_release_checks.result }}" \
             "qa_lab_runtime_parity_release_checks=${{ needs.qa_lab_runtime_parity_release_checks.result }}" \
             "runtime_tool_coverage_release_checks=${{ needs.runtime_tool_coverage_release_checks.result }}" \

.github/workflows/openclaw-release-publish.yml

@@ -1466,9 +1466,9 @@ jobs:
           fi
 
       - name: Upload postpublish evidence
-        if: ${{ always() && inputs.publish_openclaw_npm }}
+        if: ${{ always() }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: openclaw-release-postpublish-evidence-${{ inputs.tag }}
           path: ${{ runner.temp }}/openclaw-release-postpublish-evidence
-          if-no-files-found: error
+          if-no-files-found: ignore

.github/workflows/opengrep-precise-full.yml

@@ -66,5 +66,5 @@ jobs:
         with:
           name: opengrep-full-sarif
           path: .opengrep-out/precise.sarif
-          if-no-files-found: error
+          if-no-files-found: warn
           retention-days: 30

.github/workflows/opengrep-precise.yml

@@ -97,5 +97,5 @@ jobs:
         with:
           name: opengrep-pr-diff-sarif
           path: .opengrep-out/precise.sarif
-          if-no-files-found: error
+          if-no-files-found: warn
           retention-days: 30

.github/workflows/qa-live-transports-convex.yml

@@ -226,7 +226,7 @@ jobs:
           name: qa-parity-${{ github.run_id }}-${{ github.run_attempt }}
           path: .artifacts/qa-e2e/
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
   run_live_runtime_token_efficiency:
     name: Run live runtime token-efficiency lane
@@ -315,7 +315,7 @@ jobs:
           name: qa-live-runtime-token-efficiency-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ steps.run_lane.outputs.output_dir }}
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
   run_live_matrix:
     name: Run Matrix live QA lane
@@ -391,7 +391,7 @@ jobs:
           name: qa-live-matrix-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ steps.run_lane.outputs.output_dir }}
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
   run_live_matrix_sharded:
     name: Run Matrix live QA lane (${{ matrix.profile }})
@@ -475,7 +475,7 @@ jobs:
           name: qa-live-matrix-${{ matrix.profile }}-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ steps.run_lane.outputs.output_dir }}
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
   run_live_telegram:
     name: Run Telegram live QA lane with Convex leases
@@ -570,7 +570,7 @@ jobs:
           name: qa-live-telegram-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ steps.run_lane.outputs.output_dir }}
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
   run_live_discord:
     name: Run Discord live QA lane with Convex leases
@@ -665,7 +665,7 @@ jobs:
           name: qa-live-discord-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ steps.run_lane.outputs.output_dir }}
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
   run_live_whatsapp:
     name: Run WhatsApp live QA lane with Convex leases
@@ -763,7 +763,7 @@ jobs:
           name: qa-live-whatsapp-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ steps.run_lane.outputs.output_dir }}
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn
 
   run_live_slack:
     name: Run Slack live QA lane with Convex leases
@@ -859,4 +859,4 @@ jobs:
           name: qa-live-slack-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ steps.run_lane.outputs.output_dir }}
           retention-days: 14
-          if-no-files-found: error
+          if-no-files-found: warn

.github/workflows/qa-profile-evidence.yml

@@ -16,7 +16,7 @@ on:
         default: ""
         type: string
       qa_profile:
-        description: Taxonomy QA profile id to run (for example release or all)
+        description: Taxonomy QA profile id to run
         required: true
         default: release
         type: string
@@ -35,10 +35,11 @@ on:
         description: Taxonomy QA profile id to run
         required: true
         type: string
-    secrets:
-      OPENAI_API_KEY:
-        description: OpenAI API key used by live QA profile scenarios
-        required: true
+      fail_on_qa_failure:
+        description: Fail the reusable workflow when the QA profile command exits non-zero
+        required: false
+        default: false
+        type: boolean
     outputs:
       artifact_name:
         description: Uploaded QA profile evidence artifact name
@@ -89,13 +90,6 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
-            // Reusable workflow jobs inherit the caller event but run as
-            // github-actions[bot]; selected ref validation still gates secrets.
-            if (context.actor === "github-actions[bot]") {
-              core.info("Skipping manual actor permission check for a reusable workflow call.");
-              core.setOutput("authorized", "true");
-              return;
-            }
             if (context.eventName !== "workflow_dispatch") {
               core.info(`Skipping manual actor permission check for ${context.eventName}.`);
               core.setOutput("authorized", "true");
@@ -250,9 +244,6 @@ jobs:
           NODE_OPTIONS: --max-old-space-size=8192
         run: node scripts/build-all.mjs qaRuntime
 
-      - name: Ensure Playwright Chromium
-        run: node scripts/ensure-playwright-chromium.mjs
-
       - name: Run QA profile
         id: run_profile
         env:
@@ -367,8 +358,8 @@ jobs:
           retention-days: 30
           if-no-files-found: error
 
-      - name: Fail if QA profile failed
-        if: always()
+      - name: Fail if configured QA gate failed
+        if: always() && (github.event_name == 'workflow_dispatch' || inputs.fail_on_qa_failure)
         env:
           QA_EXIT_CODE: ${{ steps.run_profile.outputs.qa_exit_code }}
           QA_PROFILE: ${{ steps.profile.outputs.profile }}

.github/workflows/windows-blacksmith-testbox.yml

@@ -150,7 +150,6 @@ jobs:
           git --version
 
       - name: Run Testbox
-        if: always()
         shell: bash
         run: |
           set -euo pipefail

CHANGELOG.md

@@ -2,45 +2,6 @@
 
 Docs: https://docs.openclaw.ai
 
-## 2026.6.10
-
-### Highlights
-
-- **Automatic fast mode for talks:** OpenClaw can enable fast mode for short conversational turns, then return to normal mode for longer runs with bounded fallback and delivery behavior. (#85104) Thanks @alexph-dev and @vincentkoc.
-- **More reliable model routing:** Zai model synthesis, GLM overload failover, and native reasoning-level selection now follow the active model catalog more consistently. (#94461, #93241, #94067, #94136) Thanks @Pandah97, @chrysb, @0xghost42, @zhengli0922, @openperf, @civiltox, and @BorClaw.
-- **Safer session and channel state:** channel switches reset stale origin fields, and cron delivery awareness stays attached to the target session. (#95328, #93580) Thanks @ZengWen-DT, @jalehman, @gorkem2020, and @scotthuang.
-- **Trusted policies survive hook composition:** composed hook registries keep the trusted tool policies required by approval-sensitive flows. (#94545) Thanks @jesse-merhi.
-
-### Changes
-
-- **Agent and channel runtime:** fast-mode state now survives retries, fallback transitions, progress events, and embedded/CLI/ACP normalization; session and channel routing retain the current target and delivery context. (#85104, #93580, #95328) Thanks @alexph-dev, @vincentkoc, @scotthuang, @ZengWen-DT, @jalehman, and @gorkem2020.
-- **Provider behavior:** model catalogs now supply the correct Zai base URL, overload classification, and native reasoning controls for live-discovered models. (#94461, #93241, #94067, #94136) Thanks @Pandah97, @chrysb, @0xghost42, @zhengli0922, @openperf, @civiltox, and @BorClaw.
-
-### Fixes
-
-- **Fast-mode and policy correctness:** fallback cutoffs and reset notices are bounded, repeated progress events remain visible, Codex service-tier state is normalized, and trusted policies are not lost when hook registries are composed. (#85104, #94545) Thanks @alexph-dev, @vincentkoc, and @jesse-merhi.
-- **Model and delivery edge cases:** Zai and GLM failover paths use the right runtime metadata, while stale channel-origin state no longer leaks across session changes. (#94461, #93241, #95328) Thanks @Pandah97, @chrysb, @0xghost42, @zhengli0922, @ZengWen-DT, @jalehman, and @gorkem2020.
-- **Provider plugin onboarding:** setup refreshes provider plugin registry metadata after installing setup-selected provider plugins, so auth continuation uses the newly installed provider instead of stale registry state. (#95792) Thanks @snowzlmbot.
-
-### Complete contribution record
-
-This audited record covers the complete v2026.6.9..HEAD history: 12 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.
-
-#### Pull requests
-
-- **PR #86627** Keep core doctor health in contribution order. Thanks @giodl73-repo.
-- **PR #93580** fix: preserve cron delivery awareness for target sessions. Thanks @scotthuang and @jalehman.
-- **PR #95030** refactor: add SDK transcript identity target API. Thanks @jalehman.
-- **PR #94838** refactor(copilot): complete harness lifecycle parity. Thanks @vincentkoc.
-- **PR #95328** fix(sessions): reset stale per-channel origin fields on channel switch. Related #95325. Thanks @ZengWen-DT and @jalehman and @gorkem2020.
-- **PR #94461** fix(zai): fall back to manifest baseUrl for synthesized GLM-5 models. Related #94269. Thanks @Pandah97 and @chrysb.
-- **PR #93241** fix(agents): classify Zhipu GLM overload as overloaded for failover. Related #93211. Thanks @0xghost42 and @zhengli0922.
-- **PR #94067** fix(channels): resolve native /think menu levels via runtime catalog for live-discovered models. Related #93835. Thanks @openperf and @civiltox.
-- **PR #94136** fix(zai): expose GLM-5.2 reasoning levels [AI-assisted]. Thanks @BorClaw.
-- **PR #85104** feat: fast talks auto mode. Related #85087. Thanks @alexph-dev.
-- **PR #94545** fix: keep trusted policies with hook registry. Thanks @jesse-merhi.
-- **PR #95792** fix(onboard): refresh provider plugin registry after setup installs. Related #95765. Thanks @snowzlmbot.
-
 ## 2026.6.9
 
 ### Highlights
@@ -76,7 +37,6 @@ This audited record covers the complete v2026.6.8..HEAD history: 423 merged PRs.
 
 #### Pull requests
 
-- **PR #92154** fix(qqbot): gate private group commands and close strict command visibility gaps. Thanks @sliverp.
 - **PR #90463** refactor: add session accessor seam with gateway consumer. Thanks @jalehman.
 - **PR #88656** Drop reasoning-only length turns from replay. Thanks @abel-zer0.
 - **PR #92856** feat(webui): add session workspace rail. Thanks @Solvely-Colin.

VISION.md

@@ -61,7 +61,7 @@ We prioritize secure defaults, but also expose clear knobs for trusted high-powe
 ## Plugins & Memory
 
 OpenClaw has an extensive plugin API.
-Core stays lean; optional capabilities should usually ship as plugins.
+Core stays lean; optional capability should usually ship as plugins.
 We are generally slimming down core while expanding what plugins can do.
 If a useful feature cannot be built as a plugin yet, we welcome PRs and design discussions that extend the plugin API instead of adding one-off core behavior.
 

apps/android/Config/Version.properties

@@ -2,5 +2,5 @@
 # Source of truth: apps/android/version.json
 # Generated by scripts/android-sync-versioning.ts.
 
-OPENCLAW_ANDROID_VERSION_NAME=2026.6.10
-OPENCLAW_ANDROID_VERSION_CODE=2026061001
+OPENCLAW_ANDROID_VERSION_NAME=2026.6.9
+OPENCLAW_ANDROID_VERSION_CODE=2026060901

apps/android/app/build.gradle.kts

@@ -59,7 +59,7 @@ plugins {
 
 android {
   namespace = "ai.openclaw.app"
-  compileSdk = 36
+  compileSdk = 37
 
   // Release signing is local-only; keep the keystore path and passwords out of the repo.
   signingConfigs {

apps/android/app/src/main/java/ai/openclaw/app/gateway/GatewayDiscovery.kt

@@ -49,8 +49,18 @@ import java.util.concurrent.Executors
 import kotlin.coroutines.resume
 import kotlin.coroutines.resumeWithException
 
+private fun createDnsResolver(context: Context): DnsResolver =
+  if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.CINNAMON_BUN) {
+    createContextDnsResolver(context)
+  } else {
+    createLegacyDnsResolver()
+  }
+
+@RequiresApi(Build.VERSION_CODES.CINNAMON_BUN)
+private fun createContextDnsResolver(context: Context): DnsResolver = DnsResolver(context, null)
+
 @Suppress("DEPRECATION")
-private fun createDnsResolver(): DnsResolver = DnsResolver.getInstance()
+private fun createLegacyDnsResolver(): DnsResolver = DnsResolver.getInstance()
 
 /**
  * Watches local DNS-SD and optional wide-area DNS-SD for reachable OpenClaw gateways.
@@ -61,7 +71,7 @@ class GatewayDiscovery(
 ) {
   private val nsd = context.getSystemService(NsdManager::class.java)
   private val connectivity = context.getSystemService(ConnectivityManager::class.java)
-  private val dns = createDnsResolver()
+  private val dns = createDnsResolver(context)
   private val serviceType = "_openclaw-gw._tcp."
   private val wideAreaDomain = System.getenv("OPENCLAW_WIDE_AREA_DOMAIN")
   private val logTag = "OpenClaw/GatewayDiscovery"

apps/android/benchmark/build.gradle.kts

@@ -5,7 +5,7 @@ plugins {
 
 android {
   namespace = "ai.openclaw.app.benchmark"
-  compileSdk = 36
+  compileSdk = 37
 
   defaultConfig {
     minSdk = 31

apps/android/fastlane/metadata/android/en-US/changelogs/2026060901.txt

@@ -1,3 +0,0 @@
-Adds settings detail panels, refreshes the Android overview controls, and routes exec approvals into the in-app inbox.
-
-Improves chat acknowledgement handling, gateway pairing readiness, microphone foreground-service behavior, and release screenshot reliability.

apps/android/gradle/libs.versions.toml

@@ -4,7 +4,7 @@ androidx-activity = "1.13.0"
 androidx-benchmark = "1.4.1"
 androidx-camera = "1.6.0"
 androidx-compose-bom = "2026.05.01"
-androidx-core = "1.18.0"
+androidx-core = "1.19.0"
 androidx-exifinterface = "1.4.2"
 androidx-lifecycle = "2.10.0"
 androidx-security = "1.1.0"

apps/android/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "2026.6.10",
-  "versionCode": 2026061001
+  "version": "2026.6.9",
+  "versionCode": 2026060901
 }

apps/ios/APP-REVIEW-NOTES.md

@@ -1,185 +0,0 @@
-# App Review Notes
-
-Use these steps to exercise the live OpenClaw iOS App Review Gateway.
-
-## Demo Account / Setup
-
-Use the OpenClaw iOS app with the live review Gateway setup code included in
-the `Notes` field of this App Review submission.
-
-The setup code is a single generated code string. It already contains the public
-Gateway host and setup credential.
-
-## Setup Walkthrough
-
-1. Open the OpenClaw app.
-2. Tap `Continue`.
-3. On `Connect Gateway`, tap `Set Up Manually`.
-4. In the `Setup Code` section, tap the `Paste setup code` field.
-5. Paste the setup code string from the App Review submission `Notes` field.
-6. Tap `Apply Setup Code`.
-7. If `Trust and connect` appears, tap `Trust and connect`.
-8. Wait for the `Connected` screen.
-9. On `Connected`, tap `Open OpenClaw`.
-10. Confirm the `Control` screen shows `Gateway Online`.
-11. Tap `Settings`.
-12. Tap `Approvals`.
-13. Tap `Open Notifications`.
-14. Tap `Enable Notifications`.
-15. On `Enable OpenClaw Hosted Push Relay?`, tap `Continue`.
-16. If iOS asks whether OpenClaw may send notifications, tap `Allow`.
-17. Confirm `Notifications` shows `Enabled`.
-
-## Chat
-
-1. Tap the `Chat` tab.
-2. Tap the text field labeled `Message main...`.
-3. Send this exact message:
-
-```text
-Start Apple review checklist.
-```
-
-Expected result: the assistant replies with the available App Review demos.
-
-## Approval Demo
-
-1. Tap the `Chat` tab.
-2. Tap the text field labeled `Message main...`.
-3. Send this exact message:
-
-```text
-Run the approval demo.
-```
-
-Expected result: the iPhone shows `Exec approval required` with the harmless
-command `printf 'OpenClaw App Review approval demo complete\n'`. Tap
-`Allow Once`. The chat then replies:
-
-```text
-The approval demo completed.
-```
-
-## Talk
-
-1. Tap the `Talk` tab.
-2. Tap `Start Talk`.
-3. If iOS asks for microphone access, tap `Allow`.
-4. If iOS asks for Speech Recognition access, tap `Allow`.
-5. Confirm the screen changes to `Ready to talk` and shows `Stop Talk`.
-6. Say:
-
-```text
-Summarize this review setup in one sentence.
-```
-
-Expected result: the assistant responds by voice. Tap `Stop Talk` when done.
-
-## Talk + Background Audio
-
-1. Tap the `Talk` tab.
-2. Confirm `Speakerphone` is on.
-3. Confirm `Background listening` is on.
-4. Tap `Start Talk`.
-5. If iOS asks for microphone access, tap `Allow`.
-6. If iOS asks for Speech Recognition access, tap `Allow`.
-7. Confirm `Stop Talk` is visible.
-8. Say:
-
-```text
-Tell me when you can hear me.
-```
-
-9. While Talk is active, send OpenClaw to the background by returning to the
-   Home Screen or locking the iPhone. Do not force quit the app.
-10. Continue speaking then wait for assistant audio reply.
-
-Expected result: realtime Talk audio continues while OpenClaw is backgrounded.
-Reopen OpenClaw, confirm Talk is still active, then tap `Stop Talk`.
-
-## Gateway Status
-
-1. Tap `Control`.
-2. Tap `Instances`.
-3. Confirm the screen shows `Gateway online`.
-4. Confirm at least one `agent` row is connected.
-5. Confirm the iPhone review device appears in the connected instances list.
-
-## Push Notification
-
-1. Tap the `Chat` tab.
-2. Tap the text field labeled `Message main...`.
-3. Send this exact message:
-
-```text
-Start push notification demo.
-```
-
-4. Immediately send OpenClaw to the background and lock the iPhone. Do not
-   force quit the app.
-
-Expected result: the iPhone Lock Screen receives a visible `OpenClaw`
-notification with this body:
-
-```text
-OpenClaw App Review push notification demo
-```
-
-Tap the notification and unlock the iPhone if prompted. If OpenClaw opens on
-`Control`, tap `Chat`. Expected chat reply:
-
-```text
-The push notification demo completed.
-```
-
-## Push Wake / Status
-
-1. Tap the `Chat` tab.
-2. Send this exact message:
-
-```text
-Start push wake demo.
-```
-
-3. Immediately send OpenClaw to the background and lock the iPhone. Do not
-   force quit the app.
-4. Wait for the `OpenClaw` notification on the Lock Screen. It normally appears
-   about 10 seconds after the message is sent.
-5. Tap the notification and unlock the iPhone if prompted. If OpenClaw opens on
-   `Control`, tap `Chat`.
-
-Expected result: the app reconnects to the live Gateway and Chat replies:
-
-```text
-The push wake and node status demo completed.
-```
-
-## Device Permissions
-
-1. Tap `Settings`.
-2. Tap `Permissions`.
-3. Confirm these current app controls are available:
-   - `Camera`
-   - `Location` with `Off`, `While Using`, and `Always`
-   - `Keep Awake`
-4. Expand `Privacy & Access`.
-5. Confirm these request controls are available:
-   - `Contacts` / `Request Access`
-   - `Calendar (Add Events)` / `Request Access`
-   - `Calendar (View Events)` / `Request Full Access`
-   - `Reminders` / `Request Access`
-
-## Share Sheet
-
-1. Open Safari.
-2. Navigate to `https://example.com`.
-3. Tap the Safari toolbar `More` button.
-4. Tap `Share`.
-5. Tap `OpenClaw`.
-6. Confirm the OpenClaw share extension appears and shows
-   `Edit text, then tap Send.` and `Send to OpenClaw`.
-7. Tap `Send to OpenClaw`.
-
-Expected result: the OpenClaw share extension sends the shared Safari page to
-the live review Gateway and shows `Sent to OpenClaw.` Returning to OpenClaw
-Chat shows the shared `Example Domain` page.

apps/ios/CHANGELOG.md

@@ -1,11 +1,5 @@
 # OpenClaw iOS Changelog
 
-## 2026.6.10 - 2026-06-21
-
-Maintenance update for the current OpenClaw beta release.
-
-- Improved notification cleanup, Watch app compatibility, and native file input handling.
-
 ## 2026.6.9 - 2026-06-20
 
 Maintenance update for the current OpenClaw release.

apps/ios/Config/Version.xcconfig

@@ -2,8 +2,8 @@
 // Source of truth: apps/ios/version.json
 // Generated by scripts/ios-sync-versioning.ts.
 
-OPENCLAW_IOS_VERSION = 2026.6.10
-OPENCLAW_MARKETING_VERSION = 2026.6.10
+OPENCLAW_IOS_VERSION = 2026.6.9
+OPENCLAW_MARKETING_VERSION = 2026.6.9
 OPENCLAW_BUILD_VERSION = 1
 
 #include? "../build/Version.xcconfig"

apps/ios/README.md

@@ -67,10 +67,10 @@ Release behavior:
 - App Store release uses canonical `ai.openclawfoundation.app*` bundle IDs through a temporary generated xcconfig in `apps/ios/build/AppStoreRelease.xcconfig`.
 - App Store release uses manual `Apple Distribution` signing with profile names pinned in `apps/ios/Config/AppStoreSigning.json`.
 - Fastlane owns one-time Developer Portal setup, encrypted `match` signing sync to the repo/branch pinned in `apps/ios/Config/AppStoreSigning.json`, and release handling.
-- App Store release also switches the app to `OpenClawPushMode=appStore`, which derives relay transport, official distribution, the canonical production relay, production APNs, production relay profile, `appleStrict` proof, and the App-Attest-capable entitlement file.
-- `pnpm ios:release:upload` generates App Store screenshots, uploads release notes, and attaches `apps/ios/APP-REVIEW-NOTES.md` as a rendered PDF before archiving and uploading the IPA.
-- The release archive is validated before upload by inspecting the exported IPA's signed entitlements, embedded App Store profile, and push mode. The upload fails if the IPA is not an App Store production relay build.
-- App Review submission is manual in App Store Connect. The release lane uploads a build, public metadata, and the App Review PDF attachment, but it does not submit for review or upload the App Store Connect `Notes` field.
+- App Store release also switches the app to `OpenClawPushTransport=relay`, `OpenClawPushDistribution=official`, `OpenClawPushAPNsEnvironment=production`, `OpenClawPushRelayProfile=production`, `OpenClawPushProofPolicy=appleStrict`, and the App-Attest-capable entitlement file.
+- `pnpm ios:release:upload` generates App Store screenshots and uploads release notes before archiving and uploading the IPA.
+- `pnpm ios:release` remains a compatibility alias for `pnpm ios:release:upload`; prefer the explicit upload command in new release docs and automation.
+- App Review submission is manual in App Store Connect. The release lane uploads a build and metadata, but does not submit for review.
 - The release flow does not modify `apps/ios/.local-signing.xcconfig` or `apps/ios/LocalSigning.xcconfig`.
 - `apps/ios/version.json` is the pinned iOS release version source.
 - `apps/ios/CHANGELOG.md` is the iOS-only changelog and release-note source.
@@ -83,8 +83,9 @@ Release behavior:
 
 Relay behavior for App Store builds:
 
-- App Store release builds use the canonical hosted relay at `https://ios-push-relay.openclaw.ai`.
-- App Store release builds reject custom relay URL overrides. Future self-hosted relay support should use a separate explicit release path, not the public App Store build lane.
+- Release builds default to `https://ios-push-relay.openclaw.ai`.
+- Optional custom relay override: `OPENCLAW_PUSH_RELAY_BASE_URL=https://relay.example.com`
+  This must be a plain `https://host[:port][/path]` base URL without whitespace, query params, fragments, or xcconfig metacharacters.
 
 Signing setup commands:
 
@@ -161,36 +162,41 @@ This should create `apps/ios/fastlane/.env` with non-secret App Store Connect va
 
    Use `pnpm ios:release:signing:setup` for the initial portal setup, then `MATCH_PASSWORD=... pnpm ios:release:signing:sync:push` to publish encrypted Fastlane match assets to the shared private repo.
 
-4. If you are starting a brand-new production release train, pin iOS to the current gateway version first:
+4. Optional: set a custom official relay URL for the build. If unset, the release flow uses `https://ios-push-relay.openclaw.ai`.
+
+```bash
+export OPENCLAW_PUSH_RELAY_BASE_URL=https://relay.example.com
+```
+
+5. If you are starting a brand-new production release train, pin iOS to the current gateway version first:
 
 ```bash
 pnpm ios:version:pin -- --from-gateway
 ```
 
-5. Upload the build:
+6. Upload the build:
 
 ```bash
 pnpm ios:release:upload
 ```
 
-6. Expected behavior:
+7. Expected behavior:
    - Fastlane reads `apps/ios/version.json`
    - verifies synced iOS versioning artifacts
    - resolves the next App Store Connect build number for that short version
    - generates deterministic App Store screenshots
-   - uploads release notes, screenshots, and the App Review PDF attachment to the editable App Store version
+   - uploads release notes and screenshots to the editable App Store version
    - generates `apps/ios/build/AppStoreRelease.xcconfig`
    - archives `OpenClaw`
-   - validates the exported IPA's push mode, signed entitlements, and embedded App Store profile
    - uploads the IPA to App Store Connect for TestFlight/App Review use
    - leaves App Review submission for a maintainer to complete manually
 
-7. Expected outputs after a successful run:
+8. Expected outputs after a successful run:
    - `apps/ios/build/app-store/OpenClaw-<version>.ipa`
    - `apps/ios/build/app-store/OpenClaw-<version>.app.dSYM.zip`
    - Fastlane log line like `Uploaded iOS App Store build: version=<version> short=<short> build=<build>`
 
-8. If this is a fresh clone on a maintainer machine that already works elsewhere, it is OK to copy the non-secret `apps/ios/fastlane/.env` from another trusted local clone on the same Mac. The Keychain-backed private key remains machine-local and is not stored in the repo.
+9. If this is a fresh clone on a maintainer machine that already works elsewhere, it is OK to copy the non-secret `apps/ios/fastlane/.env` from another trusted local clone on the same Mac. The Keychain-backed private key remains machine-local and is not stored in the repo.
 
 ## iOS Versioning Workflow
 
@@ -240,13 +246,13 @@ See `apps/ios/VERSIONING.md` for the detailed spec.
 - `apps/ios/Sources/OpenClaw.entitlements` derives `aps-environment` from the active build configuration/signing override.
 - App Attest relay builds use `apps/ios/Sources/OpenClawAppAttest.entitlements`; local/direct builds do not require App Attest provisioning.
 - APNs token registration to gateway happens only after gateway connection (`push.apns.register`).
-- Local/manual Debug builds default to `OpenClawPushMode=localSandbox`, direct APNs registration, and a development `aps-environment` entitlement. Local/manual Release builds default to `OpenClawPushMode=localProduction` and direct production APNs registration.
+- Local/manual builds default to `OpenClawPushTransport=direct`, `OpenClawPushDistribution=local`, and a development `aps-environment` entitlement.
 - Your selected team/profile must support Push Notifications for the app bundle ID you are signing.
 - If push capability or provisioning is wrong, APNs registration fails at runtime (check Xcode logs for `APNs registration failed`).
 - The gateway host also needs direct APNs auth configured separately with `OPENCLAW_APNS_TEAM_ID`, `OPENCLAW_APNS_KEY_ID`, and either `OPENCLAW_APNS_PRIVATE_KEY_P8` or `OPENCLAW_APNS_PRIVATE_KEY_PATH`.
 - Recommended gateway-host storage for the APNs `.p8` file is `~/.openclaw/credentials/apns/AuthKey_<KEYID>.p8` with restrictive permissions, then point `OPENCLAW_APNS_PRIVATE_KEY_PATH` at that file.
 - `apps/ios/fastlane/.env` only covers App Store Connect / Fastlane auth; it does not provide gateway APNs credentials for local direct-push testing.
-- Debug builds default to sandbox APNs through `OpenClawPushMode=localSandbox`; Release builds default to production APNs through `OpenClawPushMode=localProduction`.
+- Debug builds default to `OpenClawPushAPNsEnvironment=sandbox`; Release builds default to `production`.
 
 ## APNs Expectations For Official Builds
 
@@ -255,7 +261,7 @@ See `apps/ios/VERSIONING.md` for the detailed spec.
 - The relay registration is bound to the gateway identity fetched from `gateway.identity.get`, so another gateway cannot reuse that stored registration.
 - The app persists the relay handle metadata locally so reconnects can republish the gateway registration without re-registering on every connect.
 - If the relay base URL changes in a later build, the app refreshes the relay registration instead of reusing the old relay origin.
-- App Store release mode uses the internal `production` relay profile, production APNs, App Attest, and a StoreKit app transaction JWS during registration.
+- Production relay mode uses the `production` relay profile, production APNs, App Attest, and a StoreKit app transaction JWS during registration.
 - Gateway-side relay sending is configured through `gateway.push.apns.relay.baseUrl` in `openclaw.json`. `OPENCLAW_APNS_RELAY_BASE_URL` remains a temporary env override only.
 
 ## Official Build Relay Trust Model

apps/ios/Sources/Design/SettingsProTabActions.swift

@@ -152,7 +152,6 @@ extension SettingsProTab {
         }
         let notificationSettings = await UNUserNotificationCenter.current().notificationSettings()
         self.applyNotificationStatus(notificationSettings.authorizationStatus)
-        self.registerForRemoteNotificationsIfEnrollmentReady()
 
         let issueCount = SettingsDiagnostics.issueCount(
             gatewayConnected: self.gatewayDiagnosticConnected,
@@ -326,7 +325,6 @@ extension SettingsProTab {
             self.setupStatusText = "Tailscale is off on this device. Turn it on, then try again."
             return false
         }
-        self.gatewayController.requestLocalNetworkAccess(reason: "settings_preflight")
         self.setupStatusText = "Checking gateway reachability..."
         let ok = await TCPProbe.probe(host: trimmed, port: port, timeoutSeconds: 3, queueLabel: "gateway.preflight")
         if !ok {
@@ -419,7 +417,6 @@ extension SettingsProTab {
             let status = settings.authorizationStatus
             Task { @MainActor in
                 self.applyNotificationStatus(status)
-                self.registerForRemoteNotificationsIfEnrollmentReady()
             }
         }
     }
@@ -440,7 +437,6 @@ extension SettingsProTab {
 
     func requestNotificationAuthorizationFromSettings() {
         guard !self.isRequestingNotificationAuthorization else { return }
-        PushEnrollmentConsent.markDisclosureAccepted()
         self.isRequestingNotificationAuthorization = true
         Task {
             let granted = await (try? UNUserNotificationCenter.current().requestAuthorization(options: [
@@ -452,19 +448,12 @@ extension SettingsProTab {
             await MainActor.run {
                 self.isRequestingNotificationAuthorization = false
                 self.notificationStatus = SettingsNotificationStatus(settings.authorizationStatus)
-                guard granted else { return }
-                self.registerForRemoteNotificationsIfEnrollmentReady()
+                guard granted, self.notificationStatus.allowsNotifications else { return }
+                UIApplication.shared.registerForRemoteNotifications()
             }
         }
     }
 
-    @MainActor
-    func registerForRemoteNotificationsIfEnrollmentReady() {
-        guard PushEnrollmentConsent.disclosureAccepted else { return }
-        guard self.notificationStatus.allowsNotifications else { return }
-        UIApplication.shared.registerForRemoteNotifications()
-    }
-
     @MainActor
     func applyNotificationStatus(_ status: UNAuthorizationStatus) {
         self.notificationStatus = SettingsNotificationStatus(status)

apps/ios/Sources/Gateway/GatewayConnectionController.swift

@@ -127,8 +127,6 @@ final class GatewayConnectionController {
     private let discovery = GatewayDiscoveryModel()
     private let discoveryEnabled: Bool
     private weak var appModel: NodeAppModel?
-    private var localNetworkAccessRequested: Bool
-    private var currentScenePhase: ScenePhase = .inactive
     private var didAutoConnect = false
     private var pendingServiceResolvers: [String: GatewayServiceResolver] = [:]
     private var pendingTrustConnect: PendingTrustConnect?
@@ -139,14 +137,9 @@ final class GatewayConnectionController {
         let useTLS: Bool
     }
 
-    init(
-        appModel: NodeAppModel,
-        startDiscovery: Bool = true,
-        deferDiscoveryUntilLocalNetworkRequest: Bool = false)
-    {
+    init(appModel: NodeAppModel, startDiscovery: Bool = true) {
         self.discoveryEnabled = startDiscovery
         self.appModel = appModel
-        self.localNetworkAccessRequested = !deferDiscoveryUntilLocalNetworkRequest
 
         GatewaySettingsStore.bootstrapPersistence()
         let defaults = UserDefaults.standard
@@ -155,7 +148,7 @@ final class GatewayConnectionController {
         self.updateFromDiscovery()
         self.observeDiscovery()
 
-        if self.discoveryEnabled, self.localNetworkAccessRequested {
+        if self.discoveryEnabled {
             self.discovery.start()
         }
     }
@@ -164,29 +157,11 @@ final class GatewayConnectionController {
         self.discovery.setDebugLoggingEnabled(enabled)
     }
 
-    func requestLocalNetworkAccess(reason: String) {
-        guard self.discoveryEnabled else {
-            self.discovery.stop()
-            self.updateFromDiscovery()
-            return
-        }
-
-        self.localNetworkAccessRequested = true
-        GatewayDiagnostics.log("local network access requested reason=\(reason)")
-
-        guard self.currentScenePhase != .background else { return }
-        self.discovery.start()
-        self.updateFromDiscovery()
-        self.attemptAutoReconnectIfNeeded()
-    }
-
     func setScenePhase(_ phase: ScenePhase) {
-        self.currentScenePhase = phase
         guard self.discoveryEnabled else {
             self.discovery.stop()
             return
         }
-        guard self.localNetworkAccessRequested else { return }
 
         switch phase {
         case .background:
@@ -206,10 +181,6 @@ final class GatewayConnectionController {
             self.updateFromDiscovery()
             return
         }
-        guard self.localNetworkAccessRequested else {
-            self.requestLocalNetworkAccess(reason: "restart_discovery")
-            return
-        }
 
         self.discovery.stop()
         self.didAutoConnect = false
@@ -226,7 +197,6 @@ final class GatewayConnectionController {
         _ gateway: GatewayDiscoveryModel.DiscoveredGateway,
         forceReconnect: Bool = false) async -> String?
     {
-        self.requestLocalNetworkAccess(reason: "connect_discovered_gateway")
         let instanceId = UserDefaults.standard.string(forKey: "node.instanceId")?
             .trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
         if instanceId.isEmpty {
@@ -305,7 +275,6 @@ final class GatewayConnectionController {
         authOverride: ManualAuthOverride? = nil,
         forceReconnect: Bool = false) async
     {
-        self.requestLocalNetworkAccess(reason: "connect_manual")
         let instanceId = GatewaySettingsStore.currentInstanceID()
         let token =
             authOverride.map(\.token) ?? GatewaySettingsStore.loadGatewayToken(instanceId: instanceId)
@@ -371,7 +340,6 @@ final class GatewayConnectionController {
     }
 
     func connectLastKnown() async {
-        self.requestLocalNetworkAccess(reason: "connect_last_known")
         guard let last = GatewaySettingsStore.loadLastGatewayConnection() else { return }
         switch last {
         case let .manual(host, port, useTLS, _):

apps/ios/Sources/Gateway/GatewaySettingsStore.swift

@@ -443,54 +443,12 @@ enum GatewaySettingsStore {
 }
 
 enum GatewayDiagnostics {
-    struct ScopedLogger {
-        private let prefix: String
-
-        fileprivate init(prefix: String) {
-            self.prefix = prefix
-        }
-
-        func stage(_ message: String) {
-            GatewayDiagnostics.log("\(self.prefix): \(GatewayDiagnostics.sanitizeScopedMessage(message))")
-        }
-
-        func skipped(_ reason: String) {
-            self.stage("registration skipped reason=\(reason)")
-        }
-
-        func failed(_ stage: String, error: Error) {
-            let nsError = error as NSError
-            self
-                .stage(
-                    "\(stage) failed errorType=\(String(reflecting: type(of: error))) domain=\(nsError.domain) code=\(nsError.code)")
-        }
-    }
-
     private static let logger = Logger(subsystem: "ai.openclawfoundation.app", category: "GatewayDiag")
     private static let queue = DispatchQueue(label: "ai.openclawfoundation.app.gateway.diagnostics")
     private static let maxLogBytes: Int64 = 512 * 1024
     private static let keepLogBytes: Int64 = 256 * 1024
     private static let logSizeCheckEveryWrites = 50
     private static let logWritesSinceCheck = OSAllocatedUnfairLock(initialState: 0)
-    private static let maxScopedMessageCharacters = 320
-
-    /// Keep relay diagnostics stage-based. Push tokens, relay grants, proofs,
-    /// receipts, signed payloads, and handles must never enter this cache log.
-    static let pushRelay = ScopedLogger(prefix: "push relay")
-
-    private static func sanitizeScopedMessage(_ value: String) -> String {
-        let collapsed = value
-            .replacingOccurrences(of: "\r", with: " ")
-            .replacingOccurrences(of: "\n", with: " ")
-            .replacingOccurrences(of: "\t", with: " ")
-            .trimmingCharacters(in: .whitespacesAndNewlines)
-        guard collapsed.count > self.maxScopedMessageCharacters else {
-            return collapsed
-        }
-        let end = collapsed.index(collapsed.startIndex, offsetBy: self.maxScopedMessageCharacters)
-        return String(collapsed[..<end]) + "..."
-    }
-
     private static func isoTimestamp() -> String {
         let formatter = ISO8601DateFormatter()
         formatter.formatOptions = [.withInternetDateTime, .withFractionalSeconds]

apps/ios/Sources/Info.plist

@@ -82,10 +82,18 @@
 	<string>$(OPENCLAW_APP_GROUP_ID)</string>
 	<key>OpenClawCanonicalVersion</key>
 	<string>$(OPENCLAW_IOS_VERSION)</string>
-	<key>OpenClawPushMode</key>
-	<string>$(OPENCLAW_PUSH_MODE)</string>
+	<key>OpenClawPushAPNsEnvironment</key>
+	<string>$(OPENCLAW_PUSH_APNS_ENVIRONMENT)</string>
+	<key>OpenClawPushDistribution</key>
+	<string>$(OPENCLAW_PUSH_DISTRIBUTION)</string>
+	<key>OpenClawPushProofPolicy</key>
+	<string>$(OPENCLAW_PUSH_PROOF_POLICY)</string>
 	<key>OpenClawPushRelayBaseURL</key>
 	<string>$(OPENCLAW_PUSH_RELAY_BASE_URL)</string>
+	<key>OpenClawPushRelayProfile</key>
+	<string>$(OPENCLAW_PUSH_RELAY_PROFILE)</string>
+	<key>OpenClawPushTransport</key>
+	<string>$(OPENCLAW_PUSH_TRANSPORT)</string>
 	<key>UIApplicationSceneManifest</key>
 	<dict>
 		<key>UIApplicationSupportsMultipleScenes</key>

apps/ios/Sources/Model/NodeAppModel.swift

@@ -4102,87 +4102,42 @@ extension NodeAppModel {
     }
 
     private func registerAPNsTokenIfNeeded() async {
-        let usesRelayTransport = await self.pushRegistrationManager.usesRelayTransport
-        guard await self.canPublishAPNsRegistration(usesRelayTransport: usesRelayTransport) else {
-            return
-        }
-        guard self.gatewayConnected else {
-            if usesRelayTransport {
-                GatewayDiagnostics.pushRelay.skipped("gateway_offline")
-            }
-            return
-        }
+        guard self.gatewayConnected else { return }
         guard let token = self.apnsDeviceTokenHex?.trimmingCharacters(in: .whitespacesAndNewlines),
               !token.isEmpty
         else {
-            if usesRelayTransport {
-                GatewayDiagnostics.pushRelay.skipped("missing_apns_token")
-            }
             return
         }
+        let usesRelayTransport = await self.pushRegistrationManager.usesRelayTransport
         if !usesRelayTransport, token == self.apnsLastRegisteredTokenHex {
             return
         }
         guard let topic = Bundle.main.bundleIdentifier?.trimmingCharacters(in: .whitespacesAndNewlines),
               !topic.isEmpty
         else {
-            if usesRelayTransport {
-                GatewayDiagnostics.pushRelay.skipped("missing_topic")
-            }
             return
         }
 
         do {
             let gatewayIdentity: PushRelayGatewayIdentity?
             if usesRelayTransport {
-                guard self.operatorConnected else {
-                    GatewayDiagnostics.pushRelay.skipped("operator_offline")
-                    return
-                }
-                GatewayDiagnostics.pushRelay.stage("gateway identity request start")
+                guard self.operatorConnected else { return }
                 gatewayIdentity = try await self.fetchPushRelayGatewayIdentity()
-                GatewayDiagnostics.pushRelay.stage("gateway identity request complete")
             } else {
                 gatewayIdentity = nil
             }
-            if usesRelayTransport {
-                GatewayDiagnostics.pushRelay.stage("gateway registration payload start")
-            }
             let payloadJSON = try await self.pushRegistrationManager.makeGatewayRegistrationPayload(
                 apnsTokenHex: token,
                 topic: topic,
                 gatewayIdentity: gatewayIdentity)
             await self.nodeGateway.sendEvent(event: "push.apns.register", payloadJSON: payloadJSON)
             self.apnsLastRegisteredTokenHex = token
-            if usesRelayTransport {
-                GatewayDiagnostics.pushRelay.stage("gateway registration event published")
-            }
         } catch {
             self.pushWakeLogger.error(
                 "APNs registration publish failed: \(error.localizedDescription, privacy: .public)")
-            if usesRelayTransport {
-                GatewayDiagnostics.pushRelay.failed("registration", error: error)
-            }
         }
     }
 
-    private func canPublishAPNsRegistration(usesRelayTransport: Bool) async -> Bool {
-        guard PushEnrollmentConsent.disclosureAccepted else {
-            if usesRelayTransport {
-                GatewayDiagnostics.pushRelay.skipped("enrollment_disclosure_not_accepted")
-            }
-            return false
-        }
-        let status = await self.notificationAuthorizationStatus()
-        guard Self.isNotificationAuthorizationAllowed(status) else {
-            if usesRelayTransport {
-                GatewayDiagnostics.pushRelay.skipped("notifications_not_authorized")
-            }
-            return false
-        }
-        return true
-    }
-
     private func fetchPushRelayGatewayIdentity() async throws -> PushRelayGatewayIdentity {
         let response = try await self.operatorGateway.request(
             method: "gateway.identity.get",
@@ -5146,10 +5101,6 @@ extension NodeAppModel {
         self.setOperatorConnected(connected)
     }
 
-    func _test_canPublishAPNsRegistration(usesRelayTransport: Bool = true) async -> Bool {
-        await self.canPublishAPNsRegistration(usesRelayTransport: usesRelayTransport)
-    }
-
     nonisolated static func _test_makeWatchChatItems(from raw: [OpenClawKit.AnyCodable]) -> [OpenClawWatchChatItem] {
         self.makeWatchChatItems(from: raw)
     }

apps/ios/Sources/Onboarding/OnboardingWizardView.swift

@@ -73,16 +73,10 @@ struct OnboardingWizardView: View {
     private static let pairingAutoResumeTicker = Timer.publish(every: 2.0, on: .main, in: .common).autoconnect()
 
     let allowSkip: Bool
-    let onRequestLocalNetworkAccess: (String) -> Void
     let onClose: () -> Void
 
-    init(
-        allowSkip: Bool,
-        onRequestLocalNetworkAccess: @escaping (String) -> Void,
-        onClose: @escaping () -> Void)
-    {
+    init(allowSkip: Bool, onClose: @escaping () -> Void) {
         self.allowSkip = allowSkip
-        self.onRequestLocalNetworkAccess = onRequestLocalNetworkAccess
         self.onClose = onClose
         _step = State(
             initialValue: OnboardingStateStore.shouldPresentFirstRunIntro() ? .intro : .welcome)
@@ -237,7 +231,6 @@ struct OnboardingWizardView: View {
             }
             .onAppear {
                 self.initializeState()
-                self.requestLocalNetworkAccessIfPastIntro(reason: "onboarding_appear")
             }
             .onDisappear {
                 self.discoveryRestartTask?.cancel()
@@ -871,20 +864,10 @@ extension OnboardingWizardView {
 
     private func advanceFromIntro() {
         OnboardingStateStore.markFirstRunIntroSeen()
-        self.requestLocalNetworkAccess(reason: "onboarding_continue")
         self.statusLine = "In your OpenClaw chat, run /pair qr, then scan the code here."
         self.step = .welcome
     }
 
-    private func requestLocalNetworkAccessIfPastIntro(reason: String) {
-        guard self.step != .intro else { return }
-        self.requestLocalNetworkAccess(reason: reason)
-    }
-
-    private func requestLocalNetworkAccess(reason: String) {
-        self.onRequestLocalNetworkAccess(reason)
-    }
-
     private func navigateBack() {
         guard let target = self.step.previous else { return }
         self.connectingGatewayID = nil

apps/ios/Sources/OpenClawApp.swift

@@ -123,28 +123,8 @@ final class OpenClawAppDelegate: NSObject, UIApplicationDelegate, @preconcurrenc
         let notificationCenter = UNUserNotificationCenter.current()
         notificationCenter.delegate = self
         ExecApprovalNotificationBridge.registerCategory(center: notificationCenter)
-        Task { @MainActor in
-            await self.registerForRemoteNotificationsIfEnrollmentReady(application)
-        }
-        return true
-    }
-
-    private func registerForRemoteNotificationsIfEnrollmentReady(_ application: UIApplication) async {
-        guard PushEnrollmentConsent.disclosureAccepted else { return }
-        guard await Self.isNotificationAuthorizationAllowed() else { return }
         application.registerForRemoteNotifications()
-    }
-
-    private static func isNotificationAuthorizationAllowed() async -> Bool {
-        let settings = await UNUserNotificationCenter.current().notificationSettings()
-        switch settings.authorizationStatus {
-        case .authorized, .provisional, .ephemeral:
-            return true
-        case .denied, .notDetermined:
-            return false
-        @unknown default:
-            return false
-        }
+        return true
     }
 
     func application(_ application: UIApplication, didRegisterForRemoteNotificationsWithDeviceToken deviceToken: Data) {
@@ -646,8 +626,7 @@ struct OpenClawApp: App {
         _gatewayController = State(
             initialValue: GatewayConnectionController(
                 appModel: appModel,
-                startDiscovery: !Self.screenshotModeEnabled,
-                deferDiscoveryUntilLocalNetworkRequest: true))
+                startDiscovery: !Self.screenshotModeEnabled))
     }
 
     var body: some Scene {

apps/ios/Sources/Push/PushBuildConfig.swift

@@ -27,16 +27,7 @@ enum PushProofPolicy: String {
     case internalSimulator
 }
 
-enum PushBuildMode: String {
-    case localSandbox
-    case localProduction
-    case appStore
-    case deviceSandbox
-    case simulatorSandbox
-}
-
 struct PushBuildConfig {
-    let mode: PushBuildMode
     let transport: PushTransportMode
     let distribution: PushDistributionMode
     let relayBaseURL: URL?
@@ -63,64 +54,31 @@ struct PushBuildConfig {
     }
 
     init(bundle: Bundle = .main) {
-        self.init(readValue: { bundle.object(forInfoDictionaryKey: $0) })
+        self.transport = Self.readEnum(
+            bundle: bundle,
+            key: "OpenClawPushTransport",
+            fallback: .direct)
+        self.distribution = Self.readEnum(
+            bundle: bundle,
+            key: "OpenClawPushDistribution",
+            fallback: .local)
+        self.apnsEnvironment = Self.readEnum(
+            bundle: bundle,
+            key: "OpenClawPushAPNsEnvironment",
+            fallback: Self.defaultAPNsEnvironment)
+        self.relayProfile = Self.readEnum(
+            bundle: bundle,
+            key: "OpenClawPushRelayProfile",
+            fallback: Self.defaultRelayProfile(apnsEnvironment: self.apnsEnvironment))
+        self.proofPolicy = Self.readEnum(
+            bundle: bundle,
+            key: "OpenClawPushProofPolicy",
+            fallback: Self.defaultProofPolicy(relayProfile: self.relayProfile))
+        self.relayBaseURL = Self.readURL(bundle: bundle, key: "OpenClawPushRelayBaseURL")
     }
 
-    init(infoDictionary: [String: Any]) {
-        self.init(readValue: { infoDictionary[$0] })
-    }
-
-    private init(readValue: (String) -> Any?) {
-        self.mode = Self.readEnum(
-            readValue: readValue,
-            key: "OpenClawPushMode",
-            fallback: .localSandbox)
-        let relayBaseURLOverride = Self.readURL(
-            readValue: readValue,
-            key: "OpenClawPushRelayBaseURL")
-        switch self.mode {
-        case .localSandbox:
-            self.transport = .direct
-            self.distribution = .local
-            self.relayBaseURL = nil
-            self.apnsEnvironment = .sandbox
-            self.relayProfile = .deviceSandbox
-            self.proofPolicy = .appleDevelopment
-        case .localProduction:
-            self.transport = .direct
-            self.distribution = .local
-            self.relayBaseURL = nil
-            self.apnsEnvironment = .production
-            self.relayProfile = .production
-            self.proofPolicy = .appleStrict
-        case .appStore:
-            self.transport = .relay
-            self.distribution = .official
-            self.relayBaseURL = URL(string: "https://\(Self.openClawHostedRelayHost)")!
-            self.apnsEnvironment = .production
-            self.relayProfile = .production
-            self.proofPolicy = .appleStrict
-        case .deviceSandbox:
-            self.transport = .relay
-            self.distribution = .official
-            self.relayBaseURL = relayBaseURLOverride
-                ?? URL(string: "https://\(Self.openClawSandboxRelayHost)")!
-            self.apnsEnvironment = .sandbox
-            self.relayProfile = .deviceSandbox
-            self.proofPolicy = .appleDevelopment
-        case .simulatorSandbox:
-            self.transport = .relay
-            self.distribution = .official
-            self.relayBaseURL = relayBaseURLOverride
-                ?? URL(string: "https://\(Self.openClawSandboxRelayHost)")!
-            self.apnsEnvironment = .sandbox
-            self.relayProfile = .simulatorSandbox
-            self.proofPolicy = .internalSimulator
-        }
-    }
-
-    private static func readURL(readValue: (String) -> Any?, key: String) -> URL? {
-        guard let raw = readValue(key) as? String else { return nil }
+    private static func readURL(bundle: Bundle, key: String) -> URL? {
+        guard let raw = bundle.object(forInfoDictionaryKey: key) as? String else { return nil }
         let trimmed = raw.trimmingCharacters(in: .whitespacesAndNewlines)
         guard !trimmed.isEmpty else { return nil }
         guard let components = URLComponents(string: trimmed),
@@ -138,12 +96,29 @@ struct PushBuildConfig {
     }
 
     private static func readEnum<T: RawRepresentable>(
-        readValue: (String) -> Any?,
+        bundle: Bundle,
         key: String,
         fallback: T)
     -> T where T.RawValue == String {
-        guard let raw = readValue(key) as? String else { return fallback }
+        guard let raw = bundle.object(forInfoDictionaryKey: key) as? String else { return fallback }
         let trimmed = raw.trimmingCharacters(in: .whitespacesAndNewlines)
         return T(rawValue: trimmed) ?? T(rawValue: trimmed.lowercased()) ?? fallback
     }
+
+    private static let defaultAPNsEnvironment: PushAPNsEnvironment = .sandbox
+
+    private static func defaultRelayProfile(apnsEnvironment: PushAPNsEnvironment) -> PushRelayProfile {
+        apnsEnvironment == .production ? .production : .deviceSandbox
+    }
+
+    private static func defaultProofPolicy(relayProfile: PushRelayProfile) -> PushProofPolicy {
+        switch relayProfile {
+        case .production:
+            .appleStrict
+        case .deviceSandbox:
+            .appleDevelopment
+        case .simulatorSandbox:
+            .internalSimulator
+        }
+    }
 }

apps/ios/Sources/Push/PushEnrollmentConsent.swift

@@ -1,19 +0,0 @@
-import Foundation
-
-enum PushEnrollmentConsent {
-    static let disclosureAcceptedKey = "push.enrollment.disclosureAccepted"
-
-    static var disclosureAccepted: Bool {
-        UserDefaults.standard.bool(forKey: disclosureAcceptedKey)
-    }
-
-    static func markDisclosureAccepted() {
-        UserDefaults.standard.set(true, forKey: self.disclosureAcceptedKey)
-    }
-
-    #if DEBUG
-    static func reset() {
-        UserDefaults.standard.removeObject(forKey: self.disclosureAcceptedKey)
-    }
-    #endif
-}

apps/ios/Sources/Push/PushRegistrationManager.swift

@@ -69,16 +69,12 @@ actor PushRegistrationManager {
     async throws -> String {
         guard self.buildConfig.distribution == .official else {
             throw PushRelayError.relayMisconfigured(
-                "Relay transport requires an official push build mode")
+                "Relay transport requires OpenClawPushDistribution=official")
         }
         try Self.validateRelayContract(
             relayProfile: self.buildConfig.relayProfile,
             apnsEnvironment: self.buildConfig.apnsEnvironment,
             proofPolicy: self.buildConfig.proofPolicy)
-        GatewayDiagnostics.pushRelay.stage(
-            "contract validated apns=\(self.buildConfig.apnsEnvironment.rawValue) "
-                + "profile=\(self.buildConfig.relayProfile.rawValue) "
-                + "proof=\(self.buildConfig.proofPolicy.rawValue)")
         guard let relayClient = self.relayClient else {
             throw PushRelayError.relayBaseURLMissing
         }
@@ -106,7 +102,6 @@ actor PushRegistrationManager {
            stored.lastAPNsTokenHashHex == tokenHashHex,
            !Self.isExpired(stored.relayHandleExpiresAtMs)
         {
-            GatewayDiagnostics.pushRelay.stage("using cached relay registration")
             return try Self.encodePayload(
                 RelayGatewayPushRegistrationPayload(
                     relayHandle: stored.relayHandle,
@@ -120,7 +115,6 @@ actor PushRegistrationManager {
                     tokenDebugSuffix: stored.tokenDebugSuffix))
         }
 
-        GatewayDiagnostics.pushRelay.stage("relay registration cache miss")
         let response = try await relayClient.register(PushRelayRegistrationInput(
             installationId: installationId,
             bundleId: bundleId,
@@ -145,7 +139,6 @@ actor PushRegistrationManager {
             relayProfile: self.buildConfig.relayProfile.rawValue,
             proofPolicy: self.buildConfig.proofPolicy.rawValue)
         _ = PushRelayRegistrationStore.saveRegistrationState(registrationState)
-        GatewayDiagnostics.pushRelay.stage("stored relay registration hasExpiry=\(response.expiresAtMs != nil)")
         return try Self.encodePayload(
             RelayGatewayPushRegistrationPayload(
                 relayHandle: response.relayHandle,

apps/ios/Sources/Push/PushRelayClient.swift

@@ -276,20 +276,7 @@ final class PushRelayClient: @unchecked Sendable {
     }
 
     func register(_ input: PushRelayRegistrationInput) async throws -> PushRelayRegisterResponse {
-        GatewayDiagnostics.pushRelay.stage(
-            "registration start origin=\(self.normalizedBaseURLString) "
-                + "apns=\(input.environment.rawValue) "
-                + "profile=\(input.relayProfile.rawValue) "
-                + "proof=\(input.proofPolicy.rawValue)")
-        let challenge: PushRelayChallengeResponse
-        do {
-            GatewayDiagnostics.pushRelay.stage("challenge request start")
-            challenge = try await self.fetchChallenge()
-            GatewayDiagnostics.pushRelay.stage("challenge received")
-        } catch {
-            GatewayDiagnostics.pushRelay.failed("challenge request", error: error)
-            throw error
-        }
+        let challenge = try await self.fetchChallenge()
         let signedPayload = PushRelayRegisterSignedPayload(
             challengeId: challenge.challengeId,
             installationId: input.installationId,
@@ -308,38 +295,15 @@ final class PushRelayClient: @unchecked Sendable {
             apnsEnvironment: input.environment.rawValue,
             relayProfile: input.relayProfile.rawValue,
             proofPolicy: input.proofPolicy.rawValue)
-        let appAttest: PushRelayAppAttestProof?
-        do {
-            GatewayDiagnostics.pushRelay.stage("app attest proof start")
-            appAttest = try await self.createAppAttestProofIfNeeded(
-                proofPolicy: input.proofPolicy,
-                challenge: challenge.challenge,
-                signedPayloadData: signedPayloadData,
-                scope: appAttestScope)
-            GatewayDiagnostics.pushRelay.stage("app attest proof complete included=\(appAttest != nil)")
-        } catch {
-            GatewayDiagnostics.pushRelay.failed("app attest proof", error: error)
-            throw error
-        }
-        let receipt: PushRelayReceiptPayload?
-        do {
-            GatewayDiagnostics.pushRelay.stage("receipt proof start")
-            receipt = try await self.createReceiptIfNeeded(proofPolicy: input.proofPolicy)
-            GatewayDiagnostics.pushRelay.stage("receipt proof complete included=\(receipt != nil)")
-        } catch {
-            GatewayDiagnostics.pushRelay.failed("receipt proof", error: error)
-            throw error
-        }
-        let simulatorProof: PushRelaySimulatorProofPayload?
-        do {
-            simulatorProof = try self.createSimulatorProofIfNeeded(
-                proofPolicy: input.proofPolicy,
-                signedPayloadData: signedPayloadData)
-            GatewayDiagnostics.pushRelay.stage("simulator proof complete included=\(simulatorProof != nil)")
-        } catch {
-            GatewayDiagnostics.pushRelay.failed("simulator proof", error: error)
-            throw error
-        }
+        let appAttest = try await self.createAppAttestProofIfNeeded(
+            proofPolicy: input.proofPolicy,
+            challenge: challenge.challenge,
+            signedPayloadData: signedPayloadData,
+            scope: appAttestScope)
+        let receipt = try await self.createReceiptIfNeeded(proofPolicy: input.proofPolicy)
+        let simulatorProof = try self.createSimulatorProofIfNeeded(
+            proofPolicy: input.proofPolicy,
+            signedPayloadData: signedPayloadData)
         let requestBody = PushRelayRegisterRequest(
             challengeId: signedPayload.challengeId,
             installationId: signedPayload.installationId,
@@ -370,17 +334,8 @@ final class PushRelayClient: @unchecked Sendable {
         request.setValue("application/json", forHTTPHeaderField: "Content-Type")
         request.httpBody = try self.jsonEncoder.encode(requestBody)
 
-        let data: Data
-        let response: URLResponse
-        do {
-            GatewayDiagnostics.pushRelay.stage("register request start")
-            (data, response) = try await self.session.data(for: request)
-        } catch {
-            GatewayDiagnostics.pushRelay.failed("register request", error: error)
-            throw error
-        }
+        let (data, response) = try await self.session.data(for: request)
         let status = Self.statusCode(from: response)
-        GatewayDiagnostics.pushRelay.stage("register response status=\(status)")
         guard (200..<300).contains(status) else {
             if status == 401 {
                 // If the relay rejects registration, drop local App Attest state so the next
@@ -388,20 +343,11 @@ final class PushRelayClient: @unchecked Sendable {
                 _ = PushRelayRegistrationStore.clearAppAttestKeyID(scope: appAttestScope)
                 _ = PushRelayRegistrationStore.clearAttestedKeyID(scope: appAttestScope)
             }
-            let relayError = PushRelayError.requestFailed(
+            throw PushRelayError.requestFailed(
                 status: status,
                 message: Self.decodeErrorMessage(data: data))
-            GatewayDiagnostics.pushRelay.stage("register response failed status=\(status)")
-            throw relayError
-        }
-        do {
-            let decoded = try self.decode(PushRelayRegisterResponse.self, from: data)
-            GatewayDiagnostics.pushRelay.stage("registration response decoded")
-            return decoded
-        } catch {
-            GatewayDiagnostics.pushRelay.failed("registration response decode", error: error)
-            throw error
         }
+        return try self.decode(PushRelayRegisterResponse.self, from: data)
     }
 
     private func createAppAttestProofIfNeeded(

apps/ios/Sources/RootTabs.swift

@@ -683,7 +683,6 @@ struct RootTabs: View {
                 self.updateIdleTimer()
                 self.updateHomeCanvasState()
                 guard newValue == .active else { return }
-                self.maybeRequestLocalNetworkAccess(reason: "scene_active")
                 Task {
                     await self.appModel.refreshGatewayOverviewIfConnected()
                     await MainActor.run {
@@ -730,10 +729,6 @@ struct RootTabs: View {
             .onChange(of: self.onboardingRequestID) { _, _ in
                 self.evaluateOnboardingPresentation(force: true)
             }
-            .onChange(of: self.showOnboarding) { _, newValue in
-                guard !newValue else { return }
-                self.maybeRequestLocalNetworkAccess(reason: "onboarding_dismissed")
-            }
             .onChange(of: self.appModel.openChatRequestID) { _, _ in
                 self.selectSidebarDestination(.chat)
             }
@@ -772,9 +767,6 @@ struct RootTabs: View {
             .fullScreenCover(isPresented: self.$showOnboarding) {
                 OnboardingWizardView(
                     allowSkip: self.onboardingAllowSkip,
-                    onRequestLocalNetworkAccess: { reason in
-                        self.requestLocalNetworkAccess(reason: reason)
-                    },
                     onClose: {
                         self.showOnboarding = false
                     })
@@ -1053,14 +1045,13 @@ extension RootTabs {
             shouldPresentOnLaunch: OnboardingStateStore.shouldPresentOnLaunch(appModel: self.appModel))
         switch route {
         case .none:
-            self.maybeRequestLocalNetworkAccess(reason: "root_appear")
+            break
         case .onboarding:
             self.onboardingAllowSkip = true
             self.showOnboarding = true
         case .settings:
             self.didAutoOpenSettings = true
             self.selectSidebarDestination(.gateway)
-            self.maybeRequestLocalNetworkAccess(reason: "root_appear")
         }
     }
 
@@ -1087,7 +1078,6 @@ extension RootTabs {
         guard route == .settings else { return }
         self.didAutoOpenSettings = true
         self.selectSidebarDestination(.gateway)
-        self.maybeRequestLocalNetworkAccess(reason: "auto_open_settings")
     }
 
     private func maybeOpenSettingsForGatewaySetup() {
@@ -1098,19 +1088,6 @@ extension RootTabs {
         self.presentedSheet = nil
         self.didAutoOpenSettings = true
         self.selectSidebarDestination(.gateway)
-        self.requestLocalNetworkAccess(reason: "gateway_setup_deeplink")
-    }
-
-    private func maybeRequestLocalNetworkAccess(reason: String) {
-        guard self.didEvaluateOnboarding else { return }
-        guard self.scenePhase == .active else { return }
-        guard !self.showOnboarding else { return }
-        self.requestLocalNetworkAccess(reason: reason)
-    }
-
-    private func requestLocalNetworkAccess(reason: String) {
-        guard !self.appModel.isAppleReviewDemoModeEnabled else { return }
-        self.gatewayController.requestLocalNetworkAccess(reason: reason)
     }
 
     private func applyInitialChatSessionIfNeeded() {

apps/ios/SwiftSources.input.xcfilelist

@@ -76,7 +76,6 @@ Sources/Permissions/PermissionRequestBridge.swift
 Sources/Push/ExecApprovalNotificationBridge.swift
 Sources/Push/BackgroundAliveBeacon.swift
 Sources/Push/PushBuildConfig.swift
-Sources/Push/PushEnrollmentConsent.swift
 Sources/Push/PushRegistrationManager.swift
 Sources/Push/PushRelayClient.swift
 Sources/Push/PushRelayKeychainStore.swift

apps/ios/Tests/NodeAppModelInvokeTests.swift

@@ -1377,24 +1377,6 @@ private final class MockBootstrapNotificationCenter: NotificationCentering, @unc
         #expect(center.addCalls == 1)
     }
 
-    @Test @MainActor func apnsRegistrationRequiresDisclosureAndNotificationAuthorization() async {
-        let center = MockBootstrapNotificationCenter()
-        center.status = .authorized
-        let appModel = NodeAppModel(notificationCenter: center)
-        PushEnrollmentConsent.reset()
-        defer { PushEnrollmentConsent.reset() }
-
-        #expect(await appModel._test_canPublishAPNsRegistration() == false)
-        #expect(await appModel._test_canPublishAPNsRegistration(usesRelayTransport: false) == false)
-
-        PushEnrollmentConsent.markDisclosureAccepted()
-        center.status = .notDetermined
-        #expect(await appModel._test_canPublishAPNsRegistration() == false)
-
-        center.status = .authorized
-        #expect(await appModel._test_canPublishAPNsRegistration())
-    }
-
     @Test @MainActor func chatPushWithoutSpeechReturnsUnavailableWhenNotificationsOff() async throws {
         let center = MockBootstrapNotificationCenter()
         center.status = .notDetermined

apps/ios/Tests/PushBuildConfigTests.swift

@@ -1,50 +0,0 @@
-import Foundation
-import Testing
-@testable import OpenClaw
-
-struct PushBuildConfigTests {
-    @Test func `app store mode derives production relay contract`() {
-        let config = PushBuildConfig(infoDictionary: [
-            "OpenClawPushMode": "appStore",
-            "OpenClawPushRelayBaseURL": "https://wrong.example.com",
-        ])
-
-        #expect(config.mode == .appStore)
-        #expect(config.transport == .relay)
-        #expect(config.distribution == .official)
-        #expect(config.relayBaseURL?.absoluteString == "https://ios-push-relay.openclaw.ai")
-        #expect(config.apnsEnvironment == .production)
-        #expect(config.relayProfile == .production)
-        #expect(config.proofPolicy == .appleStrict)
-    }
-
-    @Test func `simulator sandbox mode derives internal proof contract`() {
-        let config = PushBuildConfig(infoDictionary: [
-            "OpenClawPushMode": "simulatorSandbox",
-            "OpenClawPushRelayBaseURL": "https://staging-relay.example.com",
-        ])
-
-        #expect(config.mode == .simulatorSandbox)
-        #expect(config.transport == .relay)
-        #expect(config.distribution == .official)
-        #expect(config.relayBaseURL?.absoluteString == "https://staging-relay.example.com")
-        #expect(config.apnsEnvironment == .sandbox)
-        #expect(config.relayProfile == .simulatorSandbox)
-        #expect(config.proofPolicy == .internalSimulator)
-    }
-
-    @Test func `local release mode remains direct production push`() {
-        let config = PushBuildConfig(infoDictionary: [
-            "OpenClawPushMode": "localProduction",
-            "OpenClawPushRelayBaseURL": "https://ios-push-relay.openclaw.ai",
-        ])
-
-        #expect(config.mode == .localProduction)
-        #expect(config.transport == .direct)
-        #expect(config.distribution == .local)
-        #expect(config.relayBaseURL == nil)
-        #expect(config.apnsEnvironment == .production)
-        #expect(config.relayProfile == .production)
-        #expect(config.proofPolicy == .appleStrict)
-    }
-}

apps/ios/Tests/RootTabsSourceGuardTests.swift

@@ -550,20 +550,6 @@ struct RootTabsSourceGuardTests {
         #expect(docsSource.contains(".accessibilityHint(\"Opens Settings / Gateway\")"))
     }
 
-    @Test func `push enrollment stays behind notification disclosure flow`() throws {
-        let appSource = try String(contentsOf: Self.openClawAppSourceURL(), encoding: .utf8)
-        let actionsSource = try String(contentsOf: Self.settingsProTabActionsSourceURL(), encoding: .utf8)
-        let modelSource = try String(contentsOf: Self.nodeAppModelSourceURL(), encoding: .utf8)
-
-        #expect(appSource.contains("PushEnrollmentConsent.disclosureAccepted"))
-        #expect(appSource.contains("await Self.isNotificationAuthorizationAllowed()"))
-        #expect(actionsSource.contains("PushEnrollmentConsent.markDisclosureAccepted()"))
-        #expect(actionsSource.contains("self.registerForRemoteNotificationsIfEnrollmentReady()"))
-        #expect(modelSource.contains("PushEnrollmentConsent.disclosureAccepted"))
-        #expect(modelSource.contains("notifications_not_authorized"))
-        #expect(modelSource.contains("enrollment_disclosure_not_accepted"))
-    }
-
     @Test func `gateway settings keeps pairing trust diagnostics and tailscale actions`() throws {
         let settingsSource = try String(contentsOf: Self.settingsProTabSourceURL(), encoding: .utf8)
         let sectionsSource = try String(contentsOf: Self.settingsProTabSectionsSourceURL(), encoding: .utf8)
@@ -594,7 +580,6 @@ struct RootTabsSourceGuardTests {
         #expect(actionsSource.contains("self.gatewayController.refreshActiveGatewayRegistrationFromSettings()"))
         #expect(actionsSource.contains("self.gatewayController.restartDiscovery()"))
         #expect(actionsSource.contains("await self.appModel.refreshGatewayOverviewIfConnected()"))
-        #expect(actionsSource.contains("self.gatewayController.requestLocalNetworkAccess(reason: \"settings_preflight\")"))
         #expect(actionsSource.contains("await TCPProbe.probe(host: trimmed, port: port"))
         #expect(actionsSource.contains("Check Tailscale or LAN."))
         #expect(actionsSource.contains("Tailscale is off on this device. Turn it on, then try again."))
@@ -611,32 +596,6 @@ struct RootTabsSourceGuardTests {
         #expect(controllerSource.contains("trustRotatedGatewayCertificate(from problem: GatewayConnectionProblem)"))
     }
 
-    @Test func `local network access is requested from visible gateway flows`() throws {
-        let appSource = try String(contentsOf: Self.openClawAppSourceURL(), encoding: .utf8)
-        let rootSource = try String(contentsOf: Self.rootTabsSourceURL(), encoding: .utf8)
-        let onboardingSource = try String(contentsOf: Self.onboardingWizardSourceURL(), encoding: .utf8)
-        let actionsSource = try String(contentsOf: Self.settingsProTabActionsSourceURL(), encoding: .utf8)
-        let controllerSource = try String(contentsOf: Self.gatewayConnectionControllerSourceURL(), encoding: .utf8)
-
-        #expect(appSource.contains("deferDiscoveryUntilLocalNetworkRequest: true"))
-        #expect(controllerSource.contains("func requestLocalNetworkAccess(reason: String)"))
-        #expect(controllerSource.contains("guard self.localNetworkAccessRequested else"))
-        #expect(controllerSource.contains("self.requestLocalNetworkAccess(reason: \"connect_manual\")"))
-        #expect(controllerSource.contains("self.requestLocalNetworkAccess(reason: \"connect_discovered_gateway\")"))
-        #expect(controllerSource.contains("self.requestLocalNetworkAccess(reason: \"connect_last_known\")"))
-
-        #expect(rootSource.contains("self.maybeRequestLocalNetworkAccess(reason: \"root_appear\")"))
-        #expect(rootSource.contains("self.maybeRequestLocalNetworkAccess(reason: \"scene_active\")"))
-        #expect(rootSource.contains("self.maybeRequestLocalNetworkAccess(reason: \"onboarding_dismissed\")"))
-        #expect(rootSource.contains("self.requestLocalNetworkAccess(reason: \"gateway_setup_deeplink\")"))
-        #expect(rootSource.contains("guard self.didEvaluateOnboarding else { return }"))
-        #expect(rootSource.contains("onRequestLocalNetworkAccess: { reason in"))
-
-        #expect(onboardingSource.contains("self.requestLocalNetworkAccess(reason: \"onboarding_continue\")"))
-        #expect(onboardingSource.contains("self.requestLocalNetworkAccessIfPastIntro(reason: \"onboarding_appear\")"))
-        #expect(actionsSource.contains("self.gatewayController.requestLocalNetworkAccess(reason: \"settings_preflight\")"))
-    }
-
     @Test func `gateway settings preview matrix covers primary states`() throws {
         let supportSource = try String(contentsOf: Self.settingsProTabSupportSourceURL(), encoding: .utf8)
 
@@ -827,20 +786,6 @@ struct RootTabsSourceGuardTests {
             .appendingPathComponent("Sources/Design/SettingsProTab.swift")
     }
 
-    private static func onboardingWizardSourceURL() -> URL {
-        URL(fileURLWithPath: #filePath)
-            .deletingLastPathComponent()
-            .deletingLastPathComponent()
-            .appendingPathComponent("Sources/Onboarding/OnboardingWizardView.swift")
-    }
-
-    private static func openClawAppSourceURL() -> URL {
-        URL(fileURLWithPath: #filePath)
-            .deletingLastPathComponent()
-            .deletingLastPathComponent()
-            .appendingPathComponent("Sources/OpenClawApp.swift")
-    }
-
     private static func notificationPermissionGuidanceDialogSourceURL() -> URL {
         URL(fileURLWithPath: #filePath)
             .deletingLastPathComponent()

apps/ios/UITests/SnapshotHelper.swift

@@ -15,12 +15,13 @@
 import Foundation
 import XCTest
 
-@MainActor
+var deviceLanguage = ""
+var locale = ""
+
 func setupSnapshot(_ app: XCUIApplication, waitForAnimations: Bool = true) {
     Snapshot.setupSnapshot(app, waitForAnimations: waitForAnimations)
 }
 
-@MainActor
 func snapshot(_ name: String, waitForLoadingIndicator: Bool) {
     if waitForLoadingIndicator {
         Snapshot.snapshot(name)
@@ -32,7 +33,6 @@ func snapshot(_ name: String, waitForLoadingIndicator: Bool) {
 /// - Parameters:
 ///   - name: The name of the snapshot
 ///   - timeout: Amount of seconds to wait until the network loading indicator disappears. Pass `0` if you don't want to wait.
-@MainActor
 func snapshot(_ name: String, timeWaitingForIdle timeout: TimeInterval = 20) {
     Snapshot.snapshot(name, timeWaitingForIdle: timeout)
 }
@@ -52,7 +52,6 @@ enum SnapshotError: Error, CustomDebugStringConvertible {
 }
 
 @objcMembers
-@MainActor
 open class Snapshot: NSObject {
     static var app: XCUIApplication?
     static var waitForAnimations = true
@@ -60,8 +59,6 @@ open class Snapshot: NSObject {
     static var screenshotsDirectory: URL? {
         return cacheDirectory?.appendingPathComponent("screenshots", isDirectory: true)
     }
-    static var deviceLanguage = ""
-    static var currentLocale = ""
 
     open class func setupSnapshot(_ app: XCUIApplication, waitForAnimations: Bool = true) {
 
@@ -106,17 +103,17 @@ open class Snapshot: NSObject {
 
         do {
             let trimCharacterSet = CharacterSet.whitespacesAndNewlines
-            currentLocale = try String(contentsOf: path, encoding: .utf8).trimmingCharacters(in: trimCharacterSet)
+            locale = try String(contentsOf: path, encoding: .utf8).trimmingCharacters(in: trimCharacterSet)
         } catch {
             NSLog("Couldn't detect/set locale...")
         }
 
-        if currentLocale.isEmpty && !deviceLanguage.isEmpty {
-            currentLocale = Locale(identifier: deviceLanguage).identifier
+        if locale.isEmpty && !deviceLanguage.isEmpty {
+            locale = Locale(identifier: deviceLanguage).identifier
         }
 
-        if !currentLocale.isEmpty {
-            app.launchArguments += ["-AppleLocale", "\"\(currentLocale)\""]
+        if !locale.isEmpty {
+            app.launchArguments += ["-AppleLocale", "\"\(locale)\""]
         }
     }
 
@@ -168,7 +165,7 @@ open class Snapshot: NSObject {
             }
 
             let screenshot = XCUIScreen.main.screenshot()
-            #if os(iOS) && !targetEnvironment(macCatalyst)
+            #if os(iOS)
             let image = XCUIDevice.shared.orientation.isLandscape ?  fixLandscapeOrientation(image: screenshot.image) : screenshot.image
             #else
             let image = screenshot.image
@@ -184,7 +181,7 @@ open class Snapshot: NSObject {
 
                 let path = screenshotsDir.appendingPathComponent("\(simulator)-\(name).png")
                 #if swift(<5.0)
-                    try UIImagePNGRepresentation(image)?.write(to: path, options: .atomic)
+                    UIImagePNGRepresentation(image)?.write(to: path, options: .atomic)
                 #else
                     try image.pngData()?.write(to: path, options: .atomic)
                 #endif
@@ -284,7 +281,6 @@ private extension XCUIElementQuery {
         return self.containing(isNetworkLoadingIndicator)
     }
 
-    @MainActor
     var deviceStatusBars: XCUIElementQuery {
         guard let app = Snapshot.app else {
             fatalError("XCUIApplication is not set. Please call setupSnapshot(app) before snapshot().")
@@ -310,4 +306,4 @@ private extension CGFloat {
 
 // Please don't remove the lines below
 // They are used to detect outdated configuration files
-// SnapshotHelperVersion [1.30]
+// SnapshotHelperVersion [1.27]

apps/ios/VERSIONING.md

@@ -96,7 +96,7 @@ Pinned iOS version `2026.4.10` maps to:
   - creates or verifies Developer Portal bundle IDs/services through Fastlane `produce`
   - syncs encrypted App Store signing assets with Fastlane `match`
   - increments App Store Connect build numbers for the pinned short version
-  - uploads screenshots, release notes, and the rendered App Review PDF attachment before archiving a release build
+  - uploads screenshots and release notes before archiving a release build
 
 ## Release-note resolution order
 
@@ -156,4 +156,4 @@ Fastlane and Xcode should consume only the pinned iOS version from `apps/ios/ver
 
 Changing `package.json.version` alone must not change the iOS app version until a maintainer explicitly runs the pin step.
 
-App Review submission must remain manual. Automation may create/update the editable App Store version, upload screenshots, upload release notes, upload the App Review PDF attachment, and upload builds, but it should not upload the App Store Connect `Notes` field or submit a build for review.
+App Review submission must remain manual. Automation may create/update the editable App Store version, upload screenshots, upload release notes, and upload builds, but it should not submit a build for review.

apps/ios/fastlane/Fastfile

@@ -5,30 +5,12 @@ require "fileutils"
 require "tmpdir"
 require "tempfile"
 require "cgi"
-require "digest/md5"
 
 default_platform(:ios)
 
 APP_STORE_APP_IDENTIFIER = "ai.openclawfoundation.app"
 DEFAULT_APP_STORE_CONNECT_KEYCHAIN_SERVICE = "openclaw-app-store-connect-key"
-DEFAULT_SNAPSHOT_DEVICE_FAMILIES = [
-  {
-    label: "iPhone",
-    patterns: [
-      /\AiPhone .* Pro Max\z/,
-      /\AiPhone .* Plus\z/,
-      /\AiPhone .*\z/
-    ]
-  },
-  {
-    label: "13-inch iPad",
-    patterns: [
-      /\AiPad Pro 13-inch/,
-      /\AiPad Air 13-inch/,
-      /\AiPad .*13-inch/
-    ]
-  }
-].freeze
+DEFAULT_SNAPSHOT_DEVICES = ["iPhone 16 Pro Max", "iPad Pro 13-inch (M4)"].freeze
 DEFAULT_WATCH_SNAPSHOT_DEVICE = "Apple Watch Ultra 3 (49mm)"
 WATCH_SCREENSHOT_MODE_DEFAULTS_KEY = "openclaw.watch.screenshotMode"
 WATCH_SNAPSHOT_STATUS_BAR_TIME = "09:41"
@@ -48,14 +30,6 @@ PUBLIC_METADATA_FILENAMES = [
   "subtitle.txt",
   "support_url.txt"
 ].freeze
-APP_REVIEW_NOTES_METADATA_FILENAMES = [
-  "notes.txt",
-  "review_notes.txt"
-].freeze
-APP_STORE_SCREENSHOT_LIMIT_PER_SET = 10
-APP_STORE_SCREENSHOT_SET_DELETE_TIMEOUT_SECONDS = 120
-APP_STORE_SCREENSHOT_PROCESSING_TIMEOUT_SECONDS = 3600
-APP_STORE_SCREENSHOT_PROCESSING_POLL_SECONDS = 5
 
 def load_env_file(path)
   return unless File.exist?(path)
@@ -88,6 +62,10 @@ def release_notes_upload_requested?
   ENV["DELIVER_RELEASE_NOTES"] == "1"
 end
 
+def screenshot_paths
+  Dir[File.join(__dir__, "screenshots", "**", "*.png")]
+end
+
 def validate_required_screenshots!(paths)
   missing_families = REQUIRED_SCREENSHOT_FAMILIES.filter_map do |name, pattern|
     name unless paths.any? { |path| File.basename(path).match?(pattern) }
@@ -99,23 +77,11 @@ end
 
 def snapshot_devices
   raw = ENV["OPENCLAW_SNAPSHOT_DEVICES"].to_s.strip
-  return default_snapshot_devices if raw.empty?
+  return DEFAULT_SNAPSHOT_DEVICES if raw.empty?
 
   raw.split(",").map(&:strip).reject(&:empty?)
 end
 
-def default_snapshot_devices
-  names = available_simulator_devices.map { |device| device["name"].to_s }.reject(&:empty?).uniq
-
-  DEFAULT_SNAPSHOT_DEVICE_FAMILIES.map do |family|
-    match = family.fetch(:patterns).filter_map do |pattern|
-      names.find { |name| name.match?(pattern) }
-    end.first
-    UI.user_error!("No available #{family.fetch(:label)} simulator found for App Store screenshots.") if match.nil?
-    match
-  end
-end
-
 def watch_snapshot_device
   raw = ENV["OPENCLAW_WATCH_SNAPSHOT_DEVICE"].to_s.strip
   raw.empty? ? DEFAULT_WATCH_SNAPSHOT_DEVICE : raw
@@ -147,51 +113,6 @@ def resolve_simulator_device(name)
   fallback
 end
 
-def install_ready_for_review_edit_state_lookup!
-  require "spaceship"
-
-  app_class = Spaceship::ConnectAPI::App
-  app_class.class_eval do
-    unless method_defined?(:openclaw_get_edit_app_store_version_without_ready_for_review)
-      alias_method :openclaw_get_edit_app_store_version_without_ready_for_review, :get_edit_app_store_version
-    end
-
-    unless method_defined?(:openclaw_fetch_edit_app_info_without_ready_for_review)
-      alias_method :openclaw_fetch_edit_app_info_without_ready_for_review, :fetch_edit_app_info
-    end
-
-    def get_edit_app_store_version(client: nil, platform: nil, includes: Spaceship::ConnectAPI::AppStoreVersion::ESSENTIAL_INCLUDES)
-      version = openclaw_get_edit_app_store_version_without_ready_for_review(client: client, platform: platform, includes: includes)
-      return version if version
-
-      # First public releases can leave the only version in READY_FOR_REVIEW.
-      # Fastlane 2.236.1 excludes that state and then tries to create an illegal
-      # second version; use the existing review-ready version as the edit target.
-      client ||= Spaceship::ConnectAPI
-      platform ||= Spaceship::ConnectAPI::Platform::IOS
-      filter = {
-        appVersionState: Spaceship::ConnectAPI::AppStoreVersion::AppVersionState::READY_FOR_REVIEW,
-        platform: platform
-      }
-
-      get_app_store_versions(client: client, filter: filter, includes: includes)
-        .sort_by { |candidate| Gem::Version.new(candidate.version_string) }
-        .last
-    end
-
-    def fetch_edit_app_info(client: nil, includes: Spaceship::ConnectAPI::AppInfo::ESSENTIAL_INCLUDES)
-      app_info = openclaw_fetch_edit_app_info_without_ready_for_review(client: client, includes: includes)
-      return app_info if app_info
-
-      client ||= Spaceship::ConnectAPI
-      client
-        .get_app_infos(app_id: id, includes: includes)
-        .to_models
-        .find { |candidate| candidate.state == Spaceship::ConnectAPI::AppInfo::State::READY_FOR_REVIEW }
-    end
-  end
-end
-
 def bundle_identifier_for_product(product_path)
   info_plist_path = File.join(product_path, "Info.plist")
   UI.user_error!("Expected Info.plist at #{info_plist_path}.") unless File.exist?(info_plist_path)
@@ -289,7 +210,6 @@ def normalize_watch_screenshot_status_bar(path)
   script = <<~SWIFT
     import AppKit
     import Foundation
-    import ImageIO
 
     let path = CommandLine.arguments[1]
     let timeText = CommandLine.arguments[2]
@@ -301,37 +221,36 @@ def normalize_watch_screenshot_status_bar(path)
       exit(2)
     }
 
-    let width = cgImage.width
-    let height = cgImage.height
-    let drawWidth = CGFloat(width)
-    let drawHeight = CGFloat(height)
-    let colorSpace = CGColorSpace(name: CGColorSpace.sRGB) ?? CGColorSpaceCreateDeviceRGB()
-    guard let bitmapContext = CGContext(
-      data: nil,
-      width: width,
-      height: height,
-      bitsPerComponent: 8,
-      bytesPerRow: width * 4,
-      space: colorSpace,
-      bitmapInfo: CGImageAlphaInfo.noneSkipLast.rawValue)
+    let width = CGFloat(cgImage.width)
+    let height = CGFloat(cgImage.height)
+    guard let bitmap = NSBitmapImageRep(
+      bitmapDataPlanes: nil,
+      pixelsWide: Int(width),
+      pixelsHigh: Int(height),
+      bitsPerSample: 8,
+      samplesPerPixel: 4,
+      hasAlpha: true,
+      isPlanar: false,
+      colorSpaceName: .deviceRGB,
+      bytesPerRow: 0,
+      bitsPerPixel: 0),
+      let graphicsContext = NSGraphicsContext(bitmapImageRep: bitmap)
     else {
       fputs("Failed to create normalized screenshot bitmap at \\(path)\\n", stderr)
       exit(3)
     }
 
-    let graphicsContext = NSGraphicsContext(cgContext: bitmapContext, flipped: false)
+    bitmap.size = NSSize(width: width, height: height)
     NSGraphicsContext.saveGraphicsState()
     NSGraphicsContext.current = graphicsContext
-    NSColor.black.setFill()
-    NSBezierPath(rect: NSRect(x: 0, y: 0, width: drawWidth, height: drawHeight)).fill()
     source.draw(
-      in: NSRect(x: 0, y: 0, width: drawWidth, height: drawHeight),
-      from: NSRect(x: 0, y: 0, width: drawWidth, height: drawHeight),
-      operation: .sourceOver,
+      in: NSRect(x: 0, y: 0, width: width, height: height),
+      from: NSRect(x: 0, y: 0, width: width, height: height),
+      operation: .copy,
       fraction: 1.0)
 
     NSColor.black.setFill()
-    NSBezierPath(rect: NSRect(x: drawWidth - 146, y: drawHeight - 92, width: 124, height: 70)).fill()
+    NSBezierPath(rect: NSRect(x: width - 146, y: height - 92, width: 124, height: 70)).fill()
 
     let paragraphStyle = NSMutableParagraphStyle()
     paragraphStyle.alignment = .right
@@ -341,26 +260,17 @@ def normalize_watch_screenshot_status_bar(path)
       .paragraphStyle: paragraphStyle,
     ]
     timeText.draw(
-      in: NSRect(x: drawWidth - 134, y: drawHeight - 82, width: 102, height: 44),
+      in: NSRect(x: width - 134, y: height - 82, width: 102, height: 44),
       withAttributes: attributes)
     NSGraphicsContext.restoreGraphicsState()
 
-    guard let output = bitmapContext.makeImage(),
-          let destination = CGImageDestinationCreateWithURL(
-            URL(fileURLWithPath: path) as CFURL,
-            "public.png" as CFString,
-            1,
-            nil)
+    guard let png = bitmap.representation(using: .png, properties: [:])
     else {
       fputs("Failed to encode normalized screenshot at \\(path)\\n", stderr)
       exit(4)
     }
 
-    CGImageDestinationAddImage(destination, output, nil)
-    guard CGImageDestinationFinalize(destination) else {
-      fputs("Failed to write normalized screenshot at \\(path)\\n", stderr)
-      exit(5)
-    }
+    try png.write(to: URL(fileURLWithPath: path))
   SWIFT
 
   Tempfile.create(["openclaw-watch-status-bar", ".swift"]) do |file|
@@ -737,37 +647,6 @@ def release_notes_metadata_path
   temp_root
 end
 
-def app_review_notes_markdown_path
-  File.join(ios_root, "APP-REVIEW-NOTES.md")
-end
-
-def app_review_notes_pdf_path
-  File.join(ios_root, "build", "app-review", "APP-REVIEW-NOTES.pdf")
-end
-
-def generate_app_review_notes_pdf!
-  source = app_review_notes_markdown_path
-  UI.user_error!("Missing App Review notes at #{source}.") unless File.exist?(source)
-
-  output = app_review_notes_pdf_path
-  FileUtils.mkdir_p(File.dirname(output))
-  sh(shell_join(["xcrun", "swift", File.join(repo_root, "scripts", "ios-app-review-notes-pdf.swift"), source, output]))
-  output
-end
-
-def assert_no_app_review_notes_field_metadata!(metadata_path)
-  notes_dir = File.join(metadata_path, "review_information")
-  APP_REVIEW_NOTES_METADATA_FILENAMES.each do |filename|
-    path = File.join(notes_dir, filename)
-    next unless File.exist?(path)
-
-    UI.user_error!(
-      "Refusing to upload App Review Notes metadata from #{path}. " \
-        "Maintain the App Store Connect Notes field manually so the live setup code is not stored in this repo."
-    )
-  end
-end
-
 def public_metadata_path
   source = File.join(__dir__, "metadata")
   temp_root = Dir.mktmpdir("openclaw-app-store-metadata")
@@ -781,259 +660,6 @@ def public_metadata_path
   temp_root
 end
 
-def app_store_screenshot_root
-  File.join(__dir__, "screenshots")
-end
-
-def app_store_screenshot_manifest
-  require "deliver/loader"
-
-  Deliver::Loader.load_app_screenshots(app_store_screenshot_root, false)
-end
-
-def resolve_app_store_connect_app(app_identifier:, app_id:)
-  require "spaceship"
-
-  app = if env_present?(app_id) && !env_present?(app_identifier)
-          Spaceship::ConnectAPI::App.get(app_id: app_id)
-        else
-          Spaceship::ConnectAPI::App.find(app_identifier || APP_STORE_APP_IDENTIFIER)
-        end
-  UI.user_error!("Could not find App Store Connect app #{app_identifier || app_id || APP_STORE_APP_IDENTIFIER}.") unless app
-  app
-end
-
-def resolve_app_store_connect_version(app:, short_version:)
-  version = app.get_edit_app_store_version(platform: Spaceship::ConnectAPI::Platform::IOS)
-  UI.user_error!("Could not find an editable App Store Connect version for #{app.name}.") unless version
-  if version.version_string != short_version
-    UI.user_error!(
-      "Editable App Store Connect version mismatch for #{app.name}: expected #{short_version}, got #{version.version_string}."
-    )
-  end
-  version
-end
-
-def app_store_screenshot_sets_for_display_type(localization:, display_type:)
-  localization
-    .get_app_screenshot_sets(includes: "appScreenshots")
-    .select { |set| set.screenshot_display_type == display_type }
-end
-
-def clear_app_store_screenshot_sets!(localization:)
-  existing_sets = localization.get_app_screenshot_sets(includes: "appScreenshots")
-  return if existing_sets.empty?
-
-  existing_sets.each do |set|
-    UI.message("Deleting existing #{localization.locale} #{set.screenshot_display_type} screenshot set #{set.id}.")
-    set.delete!
-  end
-
-  deadline = Time.now + APP_STORE_SCREENSHOT_SET_DELETE_TIMEOUT_SECONDS
-  loop do
-    sets = localization.get_app_screenshot_sets(includes: "appScreenshots")
-    return if sets.empty?
-
-    if Time.now >= deadline
-      UI.user_error!(
-        "Timed out waiting for App Store Connect to delete #{localization.locale} screenshot sets: #{sets.map(&:id).join(', ')}."
-      )
-    end
-    sleep(3)
-  end
-end
-
-def app_store_screenshot_expected_rows(screenshots)
-  screenshots.map do |screenshot|
-    {
-      checksum: Digest::MD5.file(screenshot.path).hexdigest,
-      file_name: File.basename(screenshot.path)
-    }
-  end
-end
-
-def app_store_screenshot_actual_rows(app_screenshot_set)
-  (app_screenshot_set.app_screenshots || []).map do |screenshot|
-    {
-      checksum: screenshot.source_file_checksum,
-      file_name: screenshot.file_name,
-      state: (screenshot.asset_delivery_state || {})["state"]
-    }
-  end
-end
-
-def format_app_store_screenshot_rows(rows)
-  rows.map do |row|
-    [row[:file_name], row[:checksum], row[:state]].compact.join(" ")
-  end.join(", ")
-end
-
-def app_store_screenshot_processing_timeout_seconds
-  raw = ENV["DELIVER_SCREENSHOT_PROCESSING_TIMEOUT"].to_s.strip
-  return APP_STORE_SCREENSHOT_PROCESSING_TIMEOUT_SECONDS if raw.empty?
-
-  unless raw.match?(/\A\d+\z/) && raw.to_i.positive?
-    UI.user_error!("Invalid DELIVER_SCREENSHOT_PROCESSING_TIMEOUT '#{raw}'. Expected a positive number of seconds.")
-  end
-  raw.to_i
-end
-
-def app_store_screenshot_state_counts(screenshots)
-  screenshots.each_with_object({}) do |screenshot, counts|
-    state = (screenshot.asset_delivery_state || {})["state"] || "UNKNOWN"
-    counts[state] ||= 0
-    counts[state] += 1
-  end
-end
-
-def wait_for_app_store_screenshots_processing!(screenshot_ids:, locale:, display_type:)
-  timeout_seconds = app_store_screenshot_processing_timeout_seconds
-  deadline = Time.now + timeout_seconds
-  loop do
-    screenshots = screenshot_ids.map do |screenshot_id|
-      Spaceship::ConnectAPI.get_app_screenshot(app_screenshot_id: screenshot_id).first
-    end
-
-    failed = screenshots.select(&:error?)
-    unless failed.empty?
-      details = failed.map { |screenshot| "#{screenshot.file_name}: #{screenshot.error_messages.join(', ')}" }
-      UI.user_error!("App Store Connect failed processing #{locale} #{display_type} screenshots: #{details.join('; ')}.")
-    end
-    return screenshots if screenshots.all?(&:complete?)
-
-    if Time.now >= deadline
-      states = app_store_screenshot_state_counts(screenshots)
-      UI.user_error!(
-        "Timed out after #{timeout_seconds}s waiting for App Store Connect to process #{locale} #{display_type} screenshots: #{states}."
-      )
-    end
-
-    UI.verbose("Waiting for #{locale} #{display_type} screenshots to finish processing: #{app_store_screenshot_state_counts(screenshots)}.")
-    sleep(APP_STORE_SCREENSHOT_PROCESSING_POLL_SECONDS)
-  end
-end
-
-def validate_app_store_screenshot_target_counts!(screenshots_by_target)
-  screenshots_by_target.each do |(locale, display_type), screenshots|
-    next if screenshots.length <= APP_STORE_SCREENSHOT_LIMIT_PER_SET
-
-    UI.user_error!(
-      "Found #{screenshots.length} screenshots for #{locale} #{display_type}; App Store Connect allows #{APP_STORE_SCREENSHOT_LIMIT_PER_SET}."
-    )
-  end
-end
-
-def verify_app_store_screenshot_set!(app_screenshot_set:, screenshots:, locale:, display_type:)
-  expected = app_store_screenshot_expected_rows(screenshots)
-  timeout_seconds = app_store_screenshot_processing_timeout_seconds
-  deadline = Time.now + timeout_seconds
-  actual = []
-
-  loop do
-    app_screenshot_set = Spaceship::ConnectAPI::AppScreenshotSet.get(app_screenshot_set_id: app_screenshot_set.id)
-    actual = app_store_screenshot_actual_rows(app_screenshot_set)
-    actual_identity = actual.map { |row| { checksum: row[:checksum], file_name: row[:file_name] } }
-    incomplete = actual.reject { |row| row[:state] == "COMPLETE" }
-
-    return if actual_identity == expected && incomplete.empty?
-
-    if actual.length > expected.length
-      UI.user_error!(
-        "App Store Connect screenshot verification failed for #{locale} #{display_type}. " \
-          "Expected: #{format_app_store_screenshot_rows(expected)}. " \
-          "Actual: #{format_app_store_screenshot_rows(actual)}."
-      )
-    end
-
-    if Time.now >= deadline
-      UI.user_error!(
-        "Timed out after #{timeout_seconds}s waiting for App Store Connect screenshot verification for #{locale} #{display_type}. " \
-          "Expected: #{format_app_store_screenshot_rows(expected)}. " \
-          "Actual: #{format_app_store_screenshot_rows(actual)}."
-      )
-    end
-
-    UI.verbose(
-      "Waiting for App Store Connect screenshot verification for #{locale} #{display_type}: " \
-        "#{format_app_store_screenshot_rows(actual)}."
-    )
-    sleep(APP_STORE_SCREENSHOT_PROCESSING_POLL_SECONDS)
-  end
-end
-
-def replace_app_store_screenshot_set!(localization:, display_type:, screenshots:)
-  existing_sets = app_store_screenshot_sets_for_display_type(localization: localization, display_type: display_type)
-  unless existing_sets.empty?
-    UI.user_error!(
-      "App Store Connect still has #{localization.locale} #{display_type} screenshot sets after reset: #{existing_sets.map(&:id).join(', ')}."
-    )
-  end
-
-  UI.message("Creating #{localization.locale} #{display_type} screenshot set.")
-  app_screenshot_set = localization.create_app_screenshot_set(attributes: { screenshotDisplayType: display_type })
-  uploaded_ids = screenshots.map.with_index do |screenshot, index|
-    started_at = Time.now
-    uploaded = app_screenshot_set.upload_screenshot(path: screenshot.path, wait_for_processing: false)
-    UI.message(
-      "Uploaded #{localization.locale} #{display_type} screenshot #{index + 1}/#{screenshots.length}: " \
-        "#{File.basename(screenshot.path)} (#{(Time.now - started_at).round(1)}s)."
-    )
-    uploaded.id
-  end
-  wait_for_app_store_screenshots_processing!(
-    screenshot_ids: uploaded_ids,
-    locale: localization.locale,
-    display_type: display_type
-  )
-
-  app_screenshot_set = Spaceship::ConnectAPI::AppScreenshotSet.get(app_screenshot_set_id: app_screenshot_set.id)
-  app_screenshot_set = app_screenshot_set.reorder_screenshots(app_screenshot_ids: uploaded_ids)
-  verify_app_store_screenshot_set!(
-    app_screenshot_set: app_screenshot_set,
-    screenshots: screenshots,
-    locale: localization.locale,
-    display_type: display_type
-  )
-end
-
-# Fastlane deliver can duplicate complete screenshots when its verification retry
-# runs before App Store Connect consistently lists processed assets. Keep the
-# screenshot write path serial and assert the remote set equals the local files.
-def upload_app_store_screenshots_deterministically!(app_identifier:, app_id:, short_version:, screenshots:)
-  app = resolve_app_store_connect_app(app_identifier: app_identifier, app_id: app_id)
-  version = resolve_app_store_connect_version(app: app, short_version: short_version)
-  localizations_by_locale = version.get_app_store_version_localizations.each_with_object({}) do |localization, index|
-    index[localization.locale] = localization
-  end
-
-  screenshots_by_target = screenshots
-    .sort_by { |screenshot| [screenshot.language.to_s, screenshot.display_type.to_s, File.basename(screenshot.path)] }
-    .group_by { |screenshot| [screenshot.language, screenshot.display_type] }
-  validate_app_store_screenshot_target_counts!(screenshots_by_target)
-
-  missing_locales = screenshots_by_target.keys.map(&:first).uniq.reject { |locale| localizations_by_locale.key?(locale) }
-  unless missing_locales.empty?
-    UI.user_error!(
-      "App Store Connect localizations are missing for screenshot locales #{missing_locales.join(', ')}. " \
-        "Upload metadata for these locales before uploading screenshots."
-    )
-  end
-
-  screenshots_by_target.keys.map(&:first).uniq.each do |locale|
-    clear_app_store_screenshot_sets!(localization: localizations_by_locale.fetch(locale))
-  end
-
-  screenshots_by_target.each do |(locale, display_type), target_screenshots|
-    replace_app_store_screenshot_set!(
-      localization: localizations_by_locale.fetch(locale),
-      display_type: display_type,
-      screenshots: target_screenshots
-    )
-  end
-
-  UI.success("Uploaded and verified #{screenshots.length} App Store screenshots for #{short_version}.")
-end
-
 def read_ios_version_metadata
   script_path = File.join(repo_root, "scripts", "ios-version.ts")
   stdout, stderr, status = Open3.capture3(
@@ -1128,11 +754,6 @@ def prepare_app_store_release!(version:, build_number:)
   release_xcconfig
 end
 
-def validate_app_store_ipa!(ipa_path)
-  script_path = File.join(repo_root, "scripts", "ios-validate-app-store-ipa.sh")
-  sh(shell_join(["bash", script_path, "--ipa", ipa_path]))
-end
-
 def build_app_store_release(context)
   version = context[:version]
   project_path = File.join(ios_root, "OpenClaw.xcodeproj")
@@ -1183,7 +804,6 @@ def build_app_store_release(context)
   UI.user_error!("xcodebuild export produced multiple IPAs in #{output_directory}: #{exported_ipas.join(", ")}") if exported_ipas.length > 1
   exported_ipa = exported_ipas.first
   FileUtils.mv(exported_ipa, expected_ipa_path) unless exported_ipa == expected_ipa_path
-  validate_app_store_ipa!(expected_ipa_path)
 
   {
     archive_path: archive_path,
@@ -1303,12 +923,25 @@ platform :ios do
     ENV.delete("XCODE_XCCONFIG_FILE")
   end
 
-  desc "Generate screenshots, update App Store metadata and review attachment, then upload an App Store build"
-  lane :release_upload do
-    unless ENV["OPENCLAW_IOS_RELEASE_WRAPPER"] == "1"
-      UI.user_error!("Use `pnpm ios:release:upload`; direct Fastlane TestFlight upload is disabled.")
-    end
+  desc "Build + upload an App Store distribution build to App Store Connect"
+  lane :app_store do
+    context = prepare_app_store_context(require_api_key: true)
+    build = build_app_store_release(context)
 
+    upload_to_testflight(
+      api_key: context[:api_key],
+      ipa: build[:ipa_path],
+      skip_waiting_for_build_processing: true,
+      uses_non_exempt_encryption: false
+    )
+
+    UI.success("Uploaded iOS App Store build: version=#{build[:version]} short=#{build[:short_version]} build=#{build[:build_number]}")
+  ensure
+    ENV.delete("XCODE_XCCONFIG_FILE")
+  end
+
+  desc "Generate screenshots, update App Store version metadata, then upload an App Store build"
+  lane :release_upload do
     release_signing_check!
     preserve_local_signing do
       screenshots
@@ -1333,9 +966,8 @@ platform :ios do
     ENV.delete("XCODE_XCCONFIG_FILE")
   end
 
-  desc "Upload App Store metadata, App Review PDF attachment, and optionally screenshots"
+  desc "Upload App Store metadata (and optionally screenshots)"
   lane :metadata do
-    install_ready_for_review_edit_state_lookup!
     sync_ios_versioning!
     version_metadata = read_ios_version_metadata
     api_key = app_store_connect_api_key_config
@@ -1346,22 +978,19 @@ platform :ios do
     app_id = nil unless env_present?(app_id)
 
     if screenshot_upload_requested?
-      screenshots_to_upload = app_store_screenshot_manifest
-      if screenshots_to_upload.empty?
+      paths = screenshot_paths
+      if paths.empty?
         UI.user_error!("DELIVER_SCREENSHOTS=1 but no PNG screenshots were found under apps/ios/fastlane/screenshots.")
       end
-      validate_required_screenshots!(screenshots_to_upload.map(&:path))
+      validate_required_screenshots!(paths)
     end
 
-    assert_no_app_review_notes_field_metadata!(File.join(__dir__, "metadata"))
     metadata_path = public_metadata_path
     skip_metadata = ENV["DELIVER_METADATA"] != "1"
     if release_notes_upload_requested? && skip_metadata
       metadata_path = release_notes_metadata_path
       skip_metadata = false
     end
-    assert_no_app_review_notes_field_metadata!(metadata_path) unless skip_metadata
-    app_review_attachment_file = skip_metadata ? nil : generate_app_review_notes_pdf!
 
     deliver_options = {
       api_key: api_key,
@@ -1371,11 +1000,10 @@ platform :ios do
       primary_category: "PRODUCTIVITY",
       secondary_category: "UTILITIES",
       metadata_path: metadata_path,
-      skip_screenshots: true,
+      skip_screenshots: !screenshot_upload_requested?,
       skip_metadata: skip_metadata,
       skip_binary_upload: true,
-      overwrite_screenshots: false,
-      app_review_attachment_file: app_review_attachment_file,
+      overwrite_screenshots: screenshot_upload_requested?,
       skip_app_version_update: false,
       submit_for_review: false,
       run_precheck_before_submit: false
@@ -1388,14 +1016,6 @@ platform :ios do
     end
 
     deliver(**deliver_options)
-    if screenshot_upload_requested?
-      upload_app_store_screenshots_deterministically!(
-        app_identifier: app_identifier,
-        app_id: app_id,
-        short_version: version_metadata[:short_version],
-        screenshots: screenshots_to_upload
-      )
-    end
   end
 
   desc "Generate deterministic iOS screenshots for App Store metadata"

apps/ios/fastlane/SETUP.md

@@ -104,7 +104,7 @@ Generate deterministic App Store screenshots:
 pnpm ios:screenshots
 ```
 
-The screenshot lane runs the app with `--openclaw-screenshot-mode`, which enters the built-in connected screenshot fixture instead of pairing with a live gateway. By default it chooses one available large iPhone simulator and one available 13-inch iPad simulator from the installed Xcode runtime; override devices with a comma-separated `OPENCLAW_SNAPSHOT_DEVICES` value when the requested simulators exist locally.
+The screenshot lane runs the app with `--openclaw-screenshot-mode`, which enters the built-in connected screenshot fixture instead of pairing with a live gateway. By default it captures the tab set on `iPhone 16 Pro Max` and `iPad Pro 13-inch (M4)`; override devices with a comma-separated `OPENCLAW_SNAPSHOT_DEVICES` value when the requested simulators exist locally.
 
 Upload to App Store Connect:
 
@@ -112,9 +112,12 @@ Upload to App Store Connect:
 pnpm ios:release:upload
 ```
 
-Direct Fastlane TestFlight upload is disabled. Use the package script so the
-release wrapper, App Store push mode, and exported-IPA validation gate all run
-in the same path.
+Direct Fastlane entry point:
+
+```bash
+cd apps/ios
+fastlane ios release_upload
+```
 
 Maintainer recovery path for a fresh clone on the same Mac:
 
@@ -141,7 +144,13 @@ fastlane ios auth_check
 pnpm ios:version:pin -- --from-gateway
 ```
 
-5. Upload:
+5. Set the official relay URL before release:
+
+```bash
+export OPENCLAW_PUSH_RELAY_BASE_URL=https://relay.example.com
+```
+
+6. Upload:
 
 ```bash
 pnpm ios:release:upload
@@ -150,7 +159,6 @@ pnpm ios:release:upload
 Quick verification after upload:
 
 - confirm `apps/ios/build/app-store/OpenClaw-<version>.ipa` exists
-- confirm Fastlane validates the exported IPA before upload
 - confirm Fastlane prints `Uploaded iOS App Store build: version=<version> short=<short> build=<build>`
 - remember that App Store Connect/TestFlight processing can take a few minutes after the upload succeeds
 
@@ -167,7 +175,5 @@ Versioning rules:
 - `pnpm ios:version:check` validates that checked-in iOS version artifacts are in sync
 - The release flow regenerates `apps/ios/OpenClaw.xcodeproj` from `apps/ios/project.yml` before archiving
 - Local App Store signing uses a temporary generated xcconfig with profile names from `apps/ios/Config/AppStoreSigning.json` and leaves local development signing overrides untouched
-- App Store release uses `OpenClawPushMode=appStore`, which derives the canonical production hosted relay, production APNs, production relay profile, and `appleStrict` proof. The release lane rejects custom production relay URL overrides.
-- The exported IPA is validated before upload by inspecting its push mode, signed entitlements, and embedded App Store profile.
-- `pnpm ios:release:upload` generates and uploads screenshots, release notes, and the App Review PDF attachment before archiving, then uploads the IPA without submitting it for App Review or uploading the App Store Connect `Notes` field
+- `pnpm ios:release:upload` generates and uploads screenshots and release notes before archiving, then uploads the IPA without submitting it for App Review
 - See `apps/ios/VERSIONING.md` for the detailed workflow

apps/ios/fastlane/Snapfile

@@ -2,9 +2,10 @@ project("OpenClaw.xcodeproj")
 scheme("OpenClawUITests")
 configuration("Debug")
 
-# The Fastfile screenshot lane resolves concrete device names from the installed
-# Xcode simulators. Fastlane validates Snapfile devices before lane overrides, so
-# this file intentionally does not hardcode simulator model names.
+devices([
+  "iPhone 16 Pro Max",
+  "iPad Pro 13-inch (M4)",
+])
 
 languages([
   "en-US",

apps/ios/fastlane/metadata/README.md

@@ -2,7 +2,7 @@
 
 This directory is used by `fastlane deliver` for App Store Connect text metadata.
 
-## Upload public metadata and App Review attachment
+## Upload metadata only
 
 ```bash
 cd apps/ios
@@ -10,9 +10,9 @@ APP_STORE_CONNECT_APP_ID=YOUR_APP_STORE_CONNECT_APP_ID \
 DELIVER_METADATA=1 fastlane ios metadata
 ```
 
-## Release notes and App Review attachment
+## Release notes only
 
-`pnpm ios:release:upload` uses this mode before archiving so the editable App Store version has current release notes and the App Review PDF attachment without rewriting all metadata:
+`pnpm ios:release:upload` uses this mode before archiving so the editable App Store version has current release notes without rewriting all metadata:
 
 ```bash
 cd apps/ios
@@ -46,12 +46,11 @@ Or set `APP_STORE_CONNECT_API_KEY_PATH`.
 
 - Locale files live under `metadata/en-US/`.
 - `release_notes.txt` is generated from `apps/ios/CHANGELOG.md`; after changelog updates, run `pnpm ios:version:sync`.
-- `apps/ios/APP-REVIEW-NOTES.md` is rendered to `apps/ios/build/app-review/APP-REVIEW-NOTES.pdf` and uploaded as the App Review attachment when metadata is uploaded.
 - Release notes resolve from `## <pinned iOS version>` first, then fall back to `## Unreleased` while a TestFlight train is still in progress.
 - When starting a new production release train, pin the iOS version first with `pnpm ios:version:pin -- --from-gateway`.
-- The release upload flow uploads release notes, screenshots, and the App Review PDF attachment before the IPA, and never submits for App Review.
+- The release upload flow uploads release notes and screenshots before the IPA, and never submits for App Review.
 - `privacy_url.txt` is set to `https://openclaw.ai/privacy`.
 - If app lookup fails in `deliver`, set one of:
   - `APP_STORE_CONNECT_APP_IDENTIFIER` (bundle ID)
   - `APP_STORE_CONNECT_APP_ID` (numeric App Store Connect app ID, e.g. from `/apps/<id>/...` URL)
-- App Review submission is manual. Keep review contact, demo account, and the App Store Connect `Notes` field outside this repo and enter them directly in App Store Connect when submitting for review. Do not add `metadata/review_information/notes.txt`; the lane refuses to upload that field.
+- App Review submission is manual. Keep review contact, demo account, and reviewer notes outside this repo and enter them directly in App Store Connect when submitting for review.

apps/ios/fastlane/metadata/en-US/description.txt

@@ -5,7 +5,7 @@ Pair this iOS app with your OpenClaw Gateway to use your iPhone as a secure node
 What you can do:
 - Pair with your private OpenClaw Gateway by QR code or setup code
 - Chat with your assistant from iPhone
-- Use realtime Talk mode and background Talk
+- Use realtime Talk mode and push-to-talk
 - Review Gateway action approvals from your iPhone
 - Share text, links, and media directly from iOS into OpenClaw
 - Enable device capabilities such as camera, screen, location, photos, contacts, calendar, and reminders when you choose

apps/ios/fastlane/metadata/en-US/release_notes.txt

@@ -1,3 +1,5 @@
-Maintenance update for the current OpenClaw beta release.
+Maintenance update for the current OpenClaw release.
 
-- Improved notification cleanup, Watch app compatibility, and native file input handling.
+- Added Apple Watch controls for common agent actions.
+- Improved Gateway setup, notification settings, and share-extension identity handling.
+- Updated the Watch app integration for current Xcode compatibility.

apps/ios/project.yml

@@ -122,13 +122,21 @@ targets:
         Debug:
           OPENCLAW_CODE_SIGN_ENTITLEMENTS: Sources/OpenClaw.entitlements
           OPENCLAW_APNS_ENTITLEMENT_ENVIRONMENT: development
-          OPENCLAW_PUSH_MODE: localSandbox
+          OPENCLAW_PUSH_TRANSPORT: direct
+          OPENCLAW_PUSH_DISTRIBUTION: local
           OPENCLAW_PUSH_RELAY_BASE_URL: ""
+          OPENCLAW_PUSH_APNS_ENVIRONMENT: sandbox
+          OPENCLAW_PUSH_RELAY_PROFILE: deviceSandbox
+          OPENCLAW_PUSH_PROOF_POLICY: appleDevelopment
         Release:
           OPENCLAW_CODE_SIGN_ENTITLEMENTS: Sources/OpenClaw.entitlements
           OPENCLAW_APNS_ENTITLEMENT_ENVIRONMENT: production
-          OPENCLAW_PUSH_MODE: localProduction
+          OPENCLAW_PUSH_TRANSPORT: direct
+          OPENCLAW_PUSH_DISTRIBUTION: local
           OPENCLAW_PUSH_RELAY_BASE_URL: ""
+          OPENCLAW_PUSH_APNS_ENVIRONMENT: production
+          OPENCLAW_PUSH_RELAY_PROFILE: production
+          OPENCLAW_PUSH_PROOF_POLICY: appleStrict
     info:
       path: Sources/Info.plist
       properties:
@@ -170,8 +178,12 @@ targets:
         NSSpeechRecognitionUsageDescription: OpenClaw uses on-device speech recognition for talk mode and voice wake.
         NSSupportsLiveActivities: true
         ITSAppUsesNonExemptEncryption: false
-        OpenClawPushMode: "$(OPENCLAW_PUSH_MODE)"
+        OpenClawPushTransport: "$(OPENCLAW_PUSH_TRANSPORT)"
+        OpenClawPushDistribution: "$(OPENCLAW_PUSH_DISTRIBUTION)"
         OpenClawPushRelayBaseURL: "$(OPENCLAW_PUSH_RELAY_BASE_URL)"
+        OpenClawPushAPNsEnvironment: "$(OPENCLAW_PUSH_APNS_ENVIRONMENT)"
+        OpenClawPushRelayProfile: "$(OPENCLAW_PUSH_RELAY_PROFILE)"
+        OpenClawPushProofPolicy: "$(OPENCLAW_PUSH_PROOF_POLICY)"
         UISupportedInterfaceOrientations:
           - UIInterfaceOrientationPortrait
           - UIInterfaceOrientationPortraitUpsideDown

apps/ios/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "2026.6.10"
+  "version": "2026.6.9"
 }

apps/macos/Package.resolved

@@ -108,6 +108,24 @@
         "revision" : "7c6ad0fc39d0763e0b699210e4124afd5041c5df",
         "version" : "1.6.4"
       }
+    },
+    {
+      "identity" : "swiftui-math",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/gonzalezreal/swiftui-math",
+      "state" : {
+        "revision" : "0b5c2cfaaec8d6193db206f675048eeb5ce95f71",
+        "version" : "0.1.0"
+      }
+    },
+    {
+      "identity" : "textual",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/gonzalezreal/textual",
+      "state" : {
+        "revision" : "5b06b811c0f5313b6b84bbef98c635a630638c38",
+        "version" : "0.3.1"
+      }
     }
   ],
   "version" : 3

apps/macos/Package.swift

@@ -20,7 +20,6 @@ let package = Package(
         .package(url: "https://github.com/apple/swift-log.git", from: "1.10.1"),
         .package(url: "https://github.com/sparkle-project/Sparkle", from: "2.9.0"),
         .package(url: "https://github.com/steipete/Peekaboo.git", exact: "3.5.2"),
-        .package(url: "https://github.com/pointfreeco/swift-concurrency-extras", from: "1.3.1"),
         .package(path: "../shared/OpenClawKit"),
         .package(path: "../swabble"),
     ],
@@ -55,7 +54,6 @@ let package = Package(
                 .product(name: "Sparkle", package: "Sparkle"),
                 .product(name: "PeekabooBridge", package: "Peekaboo"),
                 .product(name: "PeekabooAutomationKit", package: "Peekaboo"),
-                .product(name: "ConcurrencyExtras", package: "swift-concurrency-extras"),
             ],
             exclude: [
                 "Resources/Info.plist",

apps/macos/Sources/OpenClaw/Resources/Info.plist

@@ -15,9 +15,9 @@
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>2026.6.10</string>
+    <string>2026.6.9</string>
     <key>CFBundleVersion</key>
-    <string>2026061000</string>
+    <string>2026060900</string>
     <key>CFBundleIconFile</key>
     <string>OpenClaw</string>
     <key>CFBundleURLTypes</key>

apps/shared/OpenClawKit/Package.swift

@@ -19,6 +19,7 @@ let package = Package(
     ],
     dependencies: [
         .package(url: "https://github.com/steipete/ElevenLabsKit", exact: "0.1.1"),
+        .package(url: "https://github.com/gonzalezreal/textual", exact: "0.3.1"),
     ],
     targets: [
         .target(
@@ -44,6 +45,10 @@ let package = Package(
             name: "OpenClawChatUI",
             dependencies: [
                 "OpenClawKit",
+                .product(
+                    name: "Textual",
+                    package: "textual",
+                    condition: .when(platforms: [.macOS, .iOS])),
             ],
             path: "Sources/OpenClawChatUI",
             swiftSettings: [

apps/shared/OpenClawKit/Sources/OpenClawChatUI/ChatMarkdownRenderer.swift

@@ -1,5 +1,5 @@
-import Foundation
 import SwiftUI
+import Textual
 
 public enum ChatMarkdownVariant: String, CaseIterable, Sendable {
     case standard
@@ -22,28 +22,46 @@ struct ChatMarkdownRenderer: View {
     var body: some View {
         let processed = ChatMarkdownPreprocessor.preprocess(markdown: self.text)
         VStack(alignment: .leading, spacing: 10) {
-            Text(self.markdownText(processed.cleaned))
-                .font(self.font)
-                .foregroundStyle(self.textColor)
-                .tint(self.linkColor)
-                .textSelection(.enabled)
-                .lineSpacing(self.variant == .compact ? 2 : 4)
+            StructuredText(markdown: processed.cleaned)
+                .modifier(ChatMarkdownStyle(
+                    variant: self.variant,
+                    context: self.context,
+                    font: self.font,
+                    textColor: self.textColor))
 
             if !processed.images.isEmpty {
                 InlineImageList(images: processed.images)
             }
         }
     }
+}
 
-    private var linkColor: Color {
-        self.context == .user ? self.textColor : OpenClawChatTheme.accent
+private struct ChatMarkdownStyle: ViewModifier {
+    let variant: ChatMarkdownVariant
+    let context: ChatMarkdownRenderer.Context
+    let font: Font
+    let textColor: Color
+
+    func body(content: Content) -> some View {
+        Group {
+            if self.variant == .compact {
+                content.textual.structuredTextStyle(.default)
+            } else {
+                content.textual.structuredTextStyle(.gitHub)
+            }
+        }
+        .font(self.font)
+        .foregroundStyle(self.textColor)
+        .textual.inlineStyle(self.inlineStyle)
+        .textual.textSelection(.enabled)
     }
 
-    private func markdownText(_ markdown: String) -> AttributedString {
-        let options = AttributedString.MarkdownParsingOptions(
-            interpretedSyntax: .full,
-            failurePolicy: .returnPartiallyParsedIfPossible)
-        return (try? AttributedString(markdown: markdown, options: options)) ?? AttributedString(markdown)
+    private var inlineStyle: InlineStyle {
+        let linkColor: Color = self.context == .user ? self.textColor : OpenClawChatTheme.accent
+        let codeScale: CGFloat = self.variant == .compact ? 0.85 : 0.9
+        return InlineStyle()
+            .code(.monospaced, .fontScale(codeScale))
+            .link(.foregroundColor(linkColor))
     }
 }
 

apps/shared/OpenClawKit/Sources/OpenClawKit/Resources/CanvasA2UI/a2ui.bundle.js

@@ -1,3 +1,4 @@
+// Bundled A2UI runtime resource embedded by OpenClawKit.
 var __defProp$1 = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
 	let target = {};
@@ -11935,10 +11936,6 @@ var __runInitializers = function(thisArg, initializers, value) {
 	};
 	return _classThis;
 })();
-/**
-* Canvas A2UI browser bootstrap that installs theme overrides and native bridge
-* helpers.
-*/
 const modalStyles = i$10`
   dialog {
     position: fixed;

docs/.generated/config-baseline.sha256

@@ -1,4 +1,4 @@
-86a0119a199543a450bc2489959d028ba2331e3fb86b8a6e601da5fc04e6e3da  config-baseline.json
-09591715d30d5d08cdd8c3cebe43f240920eb30e05e06d0f1f9ab7192ddae28f  config-baseline.core.json
-671979e86e4c4f59415d0a20879e838f9bbd883b3d29eeb02cb5131db8d187fe  config-baseline.channel.json
-94529978588d6e3776a86780b22cf9ff46a6f9957f2f178d3829403fad451ca7  config-baseline.plugin.json
+ee542300a1f9d5c23e772d47f2acfcc92ee0a4da210974306790bf2220b80277  config-baseline.json
+6349131baaa1828f2a071f42e4d7b17c8966c59b6588c8a4c1a32ea5ea4dcd5e  config-baseline.core.json
+de674ef01dad2828bb711a4648dc5a00f696f71c3c59004131d9475769bc1ff8  config-baseline.channel.json
+ce2a731077f0f0135b7eaf01b00a60abfa0d2776aba4be237491d492af0c8a02  config-baseline.plugin.json

docs/.generated/plugin-sdk-api-baseline.sha256

@@ -1,2 +1,2 @@
-95f2562304eebefd432c7694a90b860e4611f989e77bd3214b7c2cbeabba1882  plugin-sdk-api-baseline.json
-5d2c93807dae6e142616d82b0718964326ce46389bf81288972bbf664af64ae7  plugin-sdk-api-baseline.jsonl
+8d38dc64627e6bfcebc25215d499a30841953799133dea16ffce902cf301273f  plugin-sdk-api-baseline.json
+d7927d51588fd006d743fc56cc22d779141b487f82655d88054d2be12f3093ff  plugin-sdk-api-baseline.jsonl

docs/.i18n/glossary.zh-CN.json

@@ -943,14 +943,6 @@
     "source": "Matrix QA",
     "target": "Matrix QA"
   },
-  {
-    "source": "Maturity scorecard",
-    "target": "成熟度评分卡"
-  },
-  {
-    "source": "Maturity taxonomy",
-    "target": "成熟度分类法"
-  },
   {
     "source": "Matrix presentation metadata",
     "target": "Matrix 呈现元数据"

docs/AGENTS.md

@@ -24,14 +24,6 @@ This directory owns docs authoring, Mintlify link rules, and docs i18n policy.
 - `scripts/docs-sync-publish.mjs` excludes and prunes `docs/internal/**` from the public `openclaw/docs` publish repo if a page is force-added later.
 - Internal docs may mention repo paths, private app names, 1Password item names, and runbooks, but never include secret values.
 
-## Maturity Scorecard Editing
-
-`taxonomy.yaml` and `qa/maturity-scores.yaml` are the source inputs; generated maturity docs under `docs/maturity/` are projections and should not be hand-edited for score, LTS, taxonomy, QA profile, or evidence tables.
-`scripts/qa/render-maturity-docs.ts` owns generation; use `pnpm maturity:render` to refresh committed docs and `pnpm maturity:check` to verify them.
-`.github/workflows/maturity-scorecard.yml` renders artifact previews and can open generated-doc PRs; `.github/workflows/openclaw-release-checks.yml` dispatches it for release QA.
-Keep deterministic `qa-evidence.json.scorecard` data in GitHub Actions artifacts unless a maintainer explicitly asks for a sanitized committed projection.
-Human overrides must change source state in a PR and explain the reason plus public or redacted evidence.
-
 ## Docs i18n
 
 - Foreign-language docs are not maintained in this repo. The generated publish output lives in the separate `openclaw/docs` repo (often cloned locally as `../openclaw-docs`).

docs/channels/mattermost.md

@@ -155,7 +155,6 @@ Notes:
 
 - `onchar` still responds to explicit @mentions.
 - `channels.mattermost.requireMention` is honored for legacy configs but `chatmode` is preferred.
-- After the bot sends a visible reply in a channel thread, later messages in that same thread are answered without a new @mention or `onchar` prefix, so multi-turn thread conversations keep flowing. Participation is remembered for 7 days of thread inactivity (refreshed on each reply) and persists across gateway restarts. Threads the bot has only observed are unaffected; start a new top-level message to require an explicit mention again.
 
 ## Threading and sessions
 

docs/channels/qqbot.md

@@ -151,7 +151,6 @@ to a group, then mention it or configure the group to run without a mention.
       groups: {
         "*": {
           requireMention: true,
-          commandLevel: "all",
           historyLimit: 50,
           tools: { deny: ["exec", "read", "write"] },
         },
@@ -159,7 +158,6 @@ to a group, then mention it or configure the group to run without a mention.
           name: "Release room",
           requireMention: false,
           ignoreOtherMentions: true,
-          commandLevel: "safety",
           historyLimit: 20,
           prompt: "Keep replies short and operational.",
         },
@@ -174,9 +172,6 @@ to a group, then mention it or configure the group to run without a mention.
 settings include:
 
 - `requireMention`: require an @mention before the bot replies. Default: `true`.
-- `commandLevel`: control which built-in slash commands can run in groups.
-  Default: `all`, which preserves the pre-existing QQBot group behavior when the
-  setting is omitted.
 - `ignoreOtherMentions`: drop messages that mention someone else but not the bot.
 - `historyLimit`: keep recent non-mention group messages as context for the next mentioned turn. Set `0` to disable.
 - `tools`: allow/deny tools for the whole group.
@@ -184,17 +179,6 @@ settings include:
 - `name`: friendly label used in logs and group context.
 - `prompt`: per-group behavior prompt appended to the agent context.
 
-`commandLevel` accepts:
-
-- `all`: keep recognized built-in commands available as before. Some commands may
-  stay hidden from menus, but authorized users can still run them in the group.
-- `safety`: allow common collaboration commands such as `/help`, `/btw`, and
-  `/stop`; ask users to run sensitive commands such as `/config`, `/tools`, and
-  `/bash` in private chat.
-- `strict`: only allow the group-session controls needed for strict group
-  operation. `/stop` still stays urgent so an authorized sender can interrupt an
-  active run.
-
 Old QQBot `toolPolicy` entries are retired. Run `openclaw doctor --fix` to migrate them to `tools`.
 
 Activation modes are `mention` and `always`. `requireMention: true` maps to

docs/ci.md

@@ -42,7 +42,6 @@ or an explicit manual dispatch.
 | `checks-windows`                   | Windows-specific process/path tests plus shared runtime import specifier regressions                      | Windows-relevant changes                            |
 | `macos-node`                       | macOS TypeScript test lane using the shared built artifacts                                               | macOS-relevant changes                              |
 | `macos-swift`                      | Swift lint, build, and tests for the macOS app                                                            | macOS-relevant changes                              |
-| `ios-build`                        | Xcode project generation plus the iOS app simulator build                                                 | iOS app, shared app kit, or Swabble changes         |
 | `android`                          | Android unit tests for both flavors plus one debug APK build                                              | Android-relevant changes                            |
 | `test-performance-agent`           | Daily Codex slow-test optimization after trusted activity                                                 | Main CI success or manual dispatch                  |
 | `openclaw-performance`             | Daily/on-demand Kova runtime performance reports with mock-provider, deep-profile, and GPT 5.5 live lanes | Scheduled and manual dispatch                       |
@@ -53,7 +52,7 @@ or an explicit manual dispatch.
 2. `preflight` decides which lanes exist at all. The `docs-scope` and `changed-scope` logic are steps inside this job, not standalone jobs.
 3. `security-fast`, `check-*`, `check-additional-*`, `check-docs`, and `skills-python` fail quickly without waiting on the heavier artifact and platform matrix jobs.
 4. `build-artifacts` overlaps with the fast Linux lanes so downstream consumers can start as soon as the shared build is ready.
-5. Heavier platform and runtime lanes fan out after that: `checks-fast-core`, `checks-fast-contracts-plugins-*`, `checks-fast-contracts-channels-*`, `checks-node-core-*`, `checks-windows`, `macos-node`, `macos-swift`, `ios-build`, and `android`.
+5. Heavier platform and runtime lanes fan out after that: `checks-fast-core`, `checks-fast-contracts-plugins-*`, `checks-fast-contracts-channels-*`, `checks-node-core-*`, `checks-windows`, `macos-node`, `macos-swift`, and `android`.
 
 GitHub may mark superseded jobs as `cancelled` when a newer push lands on the same PR or `main` ref. Treat that as CI noise unless the newest run for the same ref is also failing. Matrix jobs use `fail-fast: false`, and `build-artifacts` reports embedded channel, core-support-boundary, and gateway-watch failures directly instead of queuing tiny verifier jobs. The automatic CI concurrency key is versioned (`CI-v7-*`) so a GitHub-side zombie in an old queue group cannot indefinitely block newer main runs. Manual full-suite runs use `CI-manual-v1-*` and do not cancel in-progress runs.
 
@@ -81,7 +80,7 @@ When the check fails, update the PR body instead of pushing another code commit.
 
 Scope logic lives in `scripts/ci-changed-scope.mjs` and is covered by unit tests in `src/scripts/ci-changed-scope.test.ts`. Manual dispatch skips changed-scope detection and makes the preflight manifest act as if every scoped area changed.
 
-- **CI workflow edits** validate the Node CI graph plus workflow linting, but do not force Windows, iOS, Android, or macOS native builds by themselves; those platform lanes stay scoped to platform source changes.
+- **CI workflow edits** validate the Node CI graph plus workflow linting, but do not force Windows, Android, or macOS native builds by themselves; those platform lanes stay scoped to platform source changes.
 - **Workflow Sanity** runs `actionlint`, `zizmor` over all workflow YAML files, the composite-action interpolation guard, and the conflict-marker guard. The PR-scoped `security-fast` job also runs `zizmor` over changed workflow files so workflow security findings fail early in the main CI graph.
 - **Docs on `main` pushes** are checked by the standalone `Docs` workflow with the same ClawHub docs mirror used by CI, so mixed code+docs pushes do not also queue the CI `check-docs` shard. Pull requests and manual CI still run `check-docs` from CI when docs changed.
 - **TUI PTY** runs in the `checks-node-core-runtime-tui-pty` Linux Node shard for TUI changes. The shard runs `test/vitest/vitest.tui-pty.config.ts` with `OPENCLAW_TUI_PTY_INCLUDE_LOCAL=1`, so it covers both the deterministic `TuiBackend` fixture lane and the slower `tui --local` smoke that mocks only the external model endpoint.
@@ -121,7 +120,7 @@ Treat GitHub titles, comments, bodies, review text, branch names, and commit mes
 
 ## Manual dispatches
 
-Manual CI dispatches run the same job graph as normal CI but force every non-Android scoped lane on: Linux Node shards, bundled-plugin shards, plugin and channel contract shards, Node 22 compatibility, `check-*`, `check-additional-*`, built-artifact smoke checks, docs checks, Python skills, Windows, macOS, iOS build, and Control UI i18n. Standalone manual CI dispatches run Android only with `include_android=true`; the full release umbrella enables Android by passing `include_android=true`. Plugin prerelease static checks, the release-only `agentic-plugins` shard, the full extension batch sweep, and plugin prerelease Docker lanes are excluded from CI. The Docker prerelease suite runs only when `Full Release Validation` dispatches the separate `Plugin Prerelease` workflow with the release-validation gate enabled.
+Manual CI dispatches run the same job graph as normal CI but force every non-Android scoped lane on: Linux Node shards, bundled-plugin shards, plugin and channel contract shards, Node 22 compatibility, `check-*`, `check-additional-*`, built-artifact smoke checks, docs checks, Python skills, Windows, macOS, and Control UI i18n. Standalone manual CI dispatches run Android only with `include_android=true`; the full release umbrella enables Android by passing `include_android=true`. Plugin prerelease static checks, the release-only `agentic-plugins` shard, the full extension batch sweep, and plugin prerelease Docker lanes are excluded from CI. The Docker prerelease suite runs only when `Full Release Validation` dispatches the separate `Plugin Prerelease` workflow with the release-validation gate enabled.
 
 Manual runs use a unique concurrency group so a release-candidate full suite is not cancelled by another push or PR run on the same ref. The optional `target_ref` input lets a trusted caller run that graph against a branch, tag, or full commit SHA while using the workflow file from the selected dispatch ref.
 
@@ -133,30 +132,15 @@ gh workflow run full-release-validation.yml --ref main -f ref=<branch-or-sha>
 
 ## Runners
 
-| Runner                          | Jobs                                                                                                                                                                                                                                                                                 |
-| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `ubuntu-24.04`                  | Manual CI dispatch and non-canonical repository fallbacks, CodeQL JavaScript/actions quality scans, workflow-sanity, labeler, auto-response, docs workflows outside CI, and install-smoke preflight so the Blacksmith matrix can queue earlier                                       |
-| `blacksmith-4vcpu-ubuntu-2404`  | `preflight`, `security-fast`, lower-weight extension shards, `checks-fast-core`, plugin/channel contract shards, most bundled/lower-weight Linux Node shards, `check-guards`, `check-prod-types`, `check-test-types`, selected `check-additional-*` shards, and `check-dependencies` |
-| `blacksmith-8vcpu-ubuntu-2404`  | Retained heavy Linux Node suites, boundary/extension-heavy `check-additional-*` shards, and `android`                                                                                                                                                                                |
-| `blacksmith-16vcpu-ubuntu-2404` | `build-artifacts`, `check-lint` (CPU-sensitive enough that 8 vCPU cost more than they saved); install-smoke Docker builds (32-vCPU queue time cost more than it saved)                                                                                                               |
-| `blacksmith-8vcpu-windows-2025` | `checks-windows`                                                                                                                                                                                                                                                                     |
-| `blacksmith-6vcpu-macos-15`     | `macos-node` on `openclaw/openclaw`; forks fall back to `macos-15`                                                                                                                                                                                                                   |
-| `blacksmith-12vcpu-macos-26`    | `macos-swift` and `ios-build` on `openclaw/openclaw`; forks fall back to `macos-26`                                                                                                                                                                                                  |
-
-## Runner registration budget
-
-GitHub caps self-hosted runner registrations at 1,500 runners per 5 minutes per
-repository, organization, or enterprise. The limit is shared by all Blacksmith
-runner registrations in the `openclaw` organization, so adding another
-Blacksmith installation does not add a new bucket.
-
-Treat Blacksmith labels as the scarce resource for burst control. Jobs that
-only route, notify, summarize, select shards, or run short CodeQL scans should
-stay on GitHub-hosted runners unless they have measured Blacksmith-specific
-needs. Any new Blacksmith matrix, larger `max-parallel`, or high-frequency
-workflow must show its worst-case registration count and keep the org-level
-target below 1,000 registrations per 5 minutes, leaving headroom for concurrent
-repositories and retried jobs.
+| Runner                          | Jobs                                                                                                                                                                                                                                                                                                            |
+| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `ubuntu-24.04`                  | Manual CI dispatch and non-canonical repository fallbacks, workflow-sanity, labeler, auto-response, docs workflows outside CI, and install-smoke preflight so the Blacksmith matrix can queue earlier                                                                                                           |
+| `blacksmith-4vcpu-ubuntu-2404`  | `CodeQL Critical Quality`, `preflight`, `security-fast`, lower-weight extension shards, `checks-fast-core`, plugin/channel contract shards, most bundled/lower-weight Linux Node shards, `check-guards`, `check-prod-types`, `check-test-types`, selected `check-additional-*` shards, and `check-dependencies` |
+| `blacksmith-8vcpu-ubuntu-2404`  | Retained heavy Linux Node suites, boundary/extension-heavy `check-additional-*` shards, and `android`                                                                                                                                                                                                           |
+| `blacksmith-16vcpu-ubuntu-2404` | `build-artifacts`, `check-lint` (CPU-sensitive enough that 8 vCPU cost more than they saved); install-smoke Docker builds (32-vCPU queue time cost more than it saved)                                                                                                                                          |
+| `blacksmith-8vcpu-windows-2025` | `checks-windows`                                                                                                                                                                                                                                                                                                |
+| `blacksmith-6vcpu-macos-15`     | `macos-node` on `openclaw/openclaw`; forks fall back to `macos-15`                                                                                                                                                                                                                                              |
+| `blacksmith-12vcpu-macos-26`    | `macos-swift` on `openclaw/openclaw`; forks fall back to `macos-26`                                                                                                                                                                                                                                             |
 
 Canonical-repo CI keeps Blacksmith as the default runner path for normal push and pull-request runs. `workflow_dispatch` and non-canonical repository runs use GitHub-hosted runners, but normal canonical runs do not currently probe Blacksmith queue health or automatically fall back to GitHub-hosted labels when Blacksmith is unavailable.
 
@@ -178,7 +162,6 @@ pnpm test:channels
 pnpm test:contracts:channels
 pnpm check:docs                               # docs format + lint + broken links
 pnpm build                                    # build dist when CI artifact/smoke checks matter
-pnpm ios:build                                # generate and build the iOS app project
 pnpm ci:timings                               # summarize the latest origin/main push CI run
 pnpm ci:timings:recent                        # compare recent successful main CI runs
 node scripts/ci-run-timings.mjs <run-id>      # summarize wall time, queue time, and slowest jobs
@@ -215,7 +198,7 @@ Every lane uploads GitHub artifacts. When `CLAWGRIT_REPORTS_TOKEN` is configured
 
 ## Full Release Validation
 
-`Full Release Validation` is the manual umbrella workflow for "run everything before release." It accepts a branch, tag, or full commit SHA, dispatches the manual `CI` workflow with that target, dispatches `Plugin Prerelease` for release-only plugin/package/static/Docker proof, and dispatches `OpenClaw Release Checks` for install smoke, package acceptance, cross-OS package checks, maturity scorecard rendering from QA profile evidence, QA Lab parity, Matrix, and Telegram lanes. Stable and full profiles always include exhaustive live/E2E and Docker release-path soak coverage; the beta profile can opt in with `run_release_soak=true`. The canonical package Telegram E2E runs inside Package Acceptance, so a full candidate does not start a duplicate live poller. After publishing, pass `release_package_spec` to reuse the shipped npm package across release checks, Package Acceptance, Docker, cross-OS, and Telegram without rebuilding. Use `npm_telegram_package_spec` only for a focused published-package Telegram rerun. The Codex plugin live package lane uses the same selected state by default: published `release_package_spec=openclaw@<tag>` derives `codex_plugin_spec=npm:@openclaw/codex@<tag>`, while SHA/artifact runs pack `extensions/codex` from the selected ref. Set `codex_plugin_spec` explicitly for custom plugin sources such as `npm:`, `npm-pack:`, or `git:` specs.
+`Full Release Validation` is the manual umbrella workflow for "run everything before release." It accepts a branch, tag, or full commit SHA, dispatches the manual `CI` workflow with that target, dispatches `Plugin Prerelease` for release-only plugin/package/static/Docker proof, and dispatches `OpenClaw Release Checks` for install smoke, package acceptance, cross-OS package checks, QA Lab parity, Matrix, and Telegram lanes. Stable and full profiles always include exhaustive live/E2E and Docker release-path soak coverage; the beta profile can opt in with `run_release_soak=true`. The canonical package Telegram E2E runs inside Package Acceptance, so a full candidate does not start a duplicate live poller. After publishing, pass `release_package_spec` to reuse the shipped npm package across release checks, Package Acceptance, Docker, cross-OS, and Telegram without rebuilding. Use `npm_telegram_package_spec` only for a focused published-package Telegram rerun. The Codex plugin live package lane uses the same selected state by default: published `release_package_spec=openclaw@<tag>` derives `codex_plugin_spec=npm:@openclaw/codex@<tag>`, while SHA/artifact runs pack `extensions/codex` from the selected ref. Set `codex_plugin_spec` explicitly for custom plugin sources such as `npm:`, `npm-pack:`, or `git:` specs.
 
 See [Full release validation](/reference/full-release-validation) for the
 stage matrix, exact workflow job names, profile differences, artifacts, and
@@ -503,7 +486,7 @@ The pull request guard stays light: it only starts for changes under `.github/ac
 
 ### Critical Quality categories
 
-`CodeQL Critical Quality` is the matching non-security shard. It runs only error-severity, non-security JavaScript/TypeScript quality queries over narrow high-value surfaces on GitHub-hosted Linux runners so quality scans do not spend Blacksmith runner-registration budget. Its pull request guard is intentionally smaller than the scheduled profile: non-draft PRs only run the matching `agent-runtime-boundary`, `config-boundary`, `core-auth-secrets`, `channel-runtime-boundary`, `gateway-runtime-boundary`, `memory-runtime-boundary`, `mcp-process-runtime-boundary`, `provider-runtime-boundary`, `session-diagnostics-boundary`, `plugin-boundary`, `plugin-sdk-package-contract`, and `plugin-sdk-reply-runtime` shards for agent command/model/tool execution and reply dispatch code, config schema/migration/IO code, auth/secrets/sandbox/security code, core channel and bundled channel plugin runtime, gateway protocol/server-method, memory runtime/SDK glue, MCP/process/outbound delivery, provider runtime/model catalog, session diagnostics/delivery queues, plugin loader, Plugin SDK/package-contract, or Plugin SDK reply runtime changes. CodeQL config and quality workflow changes run all twelve PR quality shards.
+`CodeQL Critical Quality` is the matching non-security shard. It runs only error-severity, non-security JavaScript/TypeScript quality queries over narrow high-value surfaces on the smaller Blacksmith Linux runner. Its pull request guard is intentionally smaller than the scheduled profile: non-draft PRs only run the matching `agent-runtime-boundary`, `config-boundary`, `core-auth-secrets`, `channel-runtime-boundary`, `gateway-runtime-boundary`, `memory-runtime-boundary`, `mcp-process-runtime-boundary`, `provider-runtime-boundary`, `session-diagnostics-boundary`, `plugin-boundary`, `plugin-sdk-package-contract`, and `plugin-sdk-reply-runtime` shards for agent command/model/tool execution and reply dispatch code, config schema/migration/IO code, auth/secrets/sandbox/security code, core channel and bundled channel plugin runtime, gateway protocol/server-method, memory runtime/SDK glue, MCP/process/outbound delivery, provider runtime/model catalog, session diagnostics/delivery queues, plugin loader, Plugin SDK/package-contract, or Plugin SDK reply runtime changes. CodeQL config and quality workflow changes run all twelve PR quality shards.
 
 Manual dispatch accepts:
 

docs/clawhub/cli.md

@@ -23,9 +23,9 @@ OpenClaw agent or Gateway.
 
 ```bash
 openclaw skills search "calendar"
-openclaw skills install @owner/<slug>
-openclaw skills update @owner/<slug>
-openclaw skills verify @owner/<slug>
+openclaw skills install <slug>
+openclaw skills update <slug>
+openclaw skills verify <slug>
 
 openclaw plugins search "calendar"
 openclaw plugins install clawhub:<package>

docs/clawhub/publishing.md

@@ -24,13 +24,13 @@ where you have publisher access.
 Skills are published from a skill folder. The public page is:
 
 ```text
-https://clawhub.ai/<owner>/skills/<slug>
+https://clawhub.ai/<owner>/<slug>
 ```
 
 Example:
 
 ```text
-https://clawhub.ai/alice/skills/review-helper
+https://clawhub.ai/alice/review-helper
 ```
 
 The publish request includes the selected owner, slug, version, changelog, and

docs/cli/agents.md

@@ -212,7 +212,6 @@ Notes:
 
 - `--agent` or `--workspace` can be used to select the target agent.
 - If you rely on `--workspace` and multiple agents share that workspace, the command fails and asks you to pass `--agent`.
-- Local workspace-relative avatar image files are limited to 2 MB. HTTP(S) URLs and `data:` URIs are not checked with the local file-size limit.
 - When no explicit identity fields are provided, the command reads identity data from `IDENTITY.md`.
 
 Load from `IDENTITY.md`:

docs/cli/plugins.md

@@ -305,16 +305,6 @@ does not import plugin runtime code, run a package manager, or repair missing
 dependencies.
 </Note>
 
-If startup logs `plugins.allow is empty; discovered non-bundled plugins may auto-load: ...`,
-run `openclaw plugins list --enabled --verbose` or
-`openclaw plugins inspect <id>` with a listed plugin id to confirm the plugin
-ids and copy trusted ids into `plugins.allow` in `openclaw.json`. When the
-warning can list every discovered plugin, it prints a ready-to-paste
-`plugins.allow` snippet that already includes those ids. If a plugin loads
-without install/load-path provenance, inspect that plugin id, then either pin
-the trusted id in `plugins.allow` or reinstall the plugin from a trusted source
-so OpenClaw records install provenance.
-
 `plugins search` is a remote ClawHub catalog lookup. It does not inspect local
 state, mutate config, install packages, or load plugin runtime code. Search
 results include the ClawHub package name, family, channel, version, summary, and

docs/cli/skills.md

@@ -25,24 +25,24 @@ Related:
 ```bash
 openclaw skills search "calendar"
 openclaw skills search --limit 20 --json
-openclaw skills install @owner/<slug>
-openclaw skills install @owner/<slug> --version <version>
+openclaw skills install <slug>
+openclaw skills install <slug> --version <version>
 openclaw skills install git:owner/repo
 openclaw skills install git:owner/repo@main
 openclaw skills install ./path/to/skill --as custom-name
-openclaw skills install @owner/<slug> --force
-openclaw skills install @owner/<slug> --agent <id>
-openclaw skills install @owner/<slug> --global
-openclaw skills update @owner/<slug>
-openclaw skills update @owner/<slug> --global
+openclaw skills install <slug> --force
+openclaw skills install <slug> --agent <id>
+openclaw skills install <slug> --global
+openclaw skills update <slug>
+openclaw skills update <slug> --global
 openclaw skills update --all
 openclaw skills update --all --agent <id>
 openclaw skills update --all --global
-openclaw skills verify @owner/<slug>
-openclaw skills verify @owner/<slug> --version <version>
-openclaw skills verify @owner/<slug> --tag <tag>
-openclaw skills verify @owner/<slug> --card
-openclaw skills verify @owner/<slug> --global
+openclaw skills verify <slug>
+openclaw skills verify <slug> --version <version>
+openclaw skills verify <slug> --tag <tag>
+openclaw skills verify <slug> --card
+openclaw skills verify <slug> --global
 openclaw skills list
 openclaw skills list --eligible
 openclaw skills list --json
@@ -64,8 +64,8 @@ openclaw skills workshop reject <proposal-id> --reason "Not reusable"
 openclaw skills workshop quarantine <proposal-id> --reason "Needs security review"
 ```
 
-`search`, `update`, and `verify` use ClawHub directly. `install @owner/<slug>`
-installs a ClawHub skill, `install git:owner/repo[@ref]` clones a Git skill, and
+`search`, `update`, and `verify` use ClawHub directly. `install <slug>` installs
+a ClawHub skill, `install git:owner/repo[@ref]` clones a Git skill, and
 `install ./path` copies a local skill directory. By default, `install`, `update`,
 and `verify` target the active workspace `skills/` directory; with `--global`,
 they target the shared managed skills directory. `list`/`info`/`check` still
@@ -94,22 +94,19 @@ Notes:
   `SKILL.md`.
 - `install --as <slug>` overrides the inferred slug for Git and local directory
   installs.
-- `install --version <version>` applies only to ClawHub skill refs.
+- `install --version <version>` applies only to ClawHub skill slugs.
 - `install --force` overwrites an existing workspace skill folder for the same
   slug.
 - `--global` targets the shared managed skills directory and cannot be combined
   with `--agent <id>`.
 - `--agent <id>` targets one configured agent workspace and overrides current
   working directory inference.
-- `update @owner/<slug>` updates a single tracked skill. Add `--global` to
-  target the shared managed skills directory instead of the workspace.
+- `update <slug>` updates a single tracked skill. Add `--global` to target the
+  shared managed skills directory instead of the workspace.
 - `update --all` updates tracked ClawHub installs in the selected workspace, or
   in the shared managed skills directory when combined with `--global`.
-- `verify @owner/<slug>` prints ClawHub's `clawhub.skill.verify.v1` JSON
-  envelope by default. There is no `--json` flag because JSON is already the
-  default. Bare slugs remain accepted for compatibility when the skill is
-  already installed or unambiguous, but owner-qualified refs avoid publisher
-  ambiguity.
+- `verify <slug>` prints ClawHub's `clawhub.skill.verify.v1` JSON envelope by
+  default. There is no `--json` flag because JSON is already the default.
 - When ClawHub returns server-resolved source provenance, verify JSON also
   includes a commit-pinned `openclaw.verifiedSourceUrl`. Unavailable or
   self-declared source URLs stay only in the raw provenance envelope and are not

docs/cli/workboard.md

@@ -22,7 +22,7 @@ openclaw gateway restart
 ## Usage
 
 ```bash
-openclaw workboard list [--board <id>] [--status <status>] [--include-archived] [--json]
+openclaw workboard list [--board <id>] [--status <status>] [--json]
 openclaw workboard create <title...> [--notes <text>] [--status <status>] [--priority <priority>] [--agent <id>] [--board <id>] [--labels <items>] [--json]
 openclaw workboard show <id> [--json]
 openclaw workboard dispatch [--url <url>] [--token <token>] [--timeout <ms>] [--json]
@@ -50,16 +50,11 @@ Columns are id prefix, status, priority, board id, optional agent id, and title.
 
 Flags:
 
-| Flag                 | Purpose                                       |
-| -------------------- | --------------------------------------------- |
-| `--board <id>`       | Limit results to one board namespace          |
-| `--status <status>`  | Limit results to one Workboard status         |
-| `--include-archived` | Include archived cards in compact text output |
-| `--json`             | Print the full card list as machine JSON      |
-
-Compact text output hides archived cards by default so the CLI matches the
-`/workboard list` command. Pass `--include-archived` to show them. JSON output
-keeps the full card list, including archived cards, for existing automation.
+| Flag                | Purpose                                  |
+| ------------------- | ---------------------------------------- |
+| `--board <id>`      | Limit results to one board namespace     |
+| `--status <status>` | Limit results to one Workboard status    |
+| `--json`            | Print the full card list as machine JSON |
 
 ## `create`
 

docs/concepts/qa-e2e-automation.md

@@ -31,7 +31,7 @@ script aliases; both forms are supported.
 
 | Command                                             | Purpose                                                                                                                                                                                                                                                                 |
 | --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `qa run`                                            | Bundled QA self-check without `--qa-profile`; taxonomy-backed maturity profile runner with `--qa-profile smoke-ci`, `--qa-profile release`, or `--qa-profile all`.                                                                                                      |
+| `qa run`                                            | Bundled QA self-check without `--qa-profile`; taxonomy-backed maturity profile runner with `--qa-profile smoke-ci` or `--qa-profile release`.                                                                                                                           |
 | `qa suite`                                          | Run repo-backed scenarios against the QA gateway lane. Aliases: `pnpm openclaw qa suite --runner multipass` for a disposable Linux VM.                                                                                                                                  |
 | `qa coverage`                                       | Print the YAML scenario-coverage inventory (`--json` for machine output).                                                                                                                                                                                               |
 | `qa parity-report`                                  | Compare two `qa-suite-summary.json` files and write the agentic parity report, or use `--runtime-axis --token-efficiency` to write Codex-vs-OpenClaw runtime parity and token-efficiency reports from one runtime-pair summary.                                         |
@@ -68,17 +68,15 @@ Slim evidence omits per-entry `execution` and sets `evidenceMode: "slim"`;
 ```bash
 pnpm openclaw qa run \
   --qa-profile smoke-ci \
-  --category channel-framework.conversation-routing-and-delivery \
+  --category agent-runtime-and-provider-execution.agent-turn-execution \
   --provider-mode mock-openai \
   --output-dir .artifacts/qa-e2e/smoke-ci-profile-dispatch
 ```
 
 Use `smoke-ci` for deterministic profile proof with mock model providers and
 Crabline fake provider servers. Use `release` for Stable/LTS proof against live
-channels. Use `all` only for explicit full-taxonomy evidence runs; it selects
-every active maturity category and can be dispatched through the `QA Profile
-Evidence` workflow with `qa_profile=all`. When a command also needs an OpenClaw
-root profile, put the root profile before the QA command:
+channels. When a command also needs an OpenClaw root profile, put the root
+profile before the QA command:
 
 ```bash
 pnpm openclaw --profile work qa run --qa-profile smoke-ci
@@ -966,7 +964,6 @@ output and whose artifact paths are resolved relative to that producer
 `qa run --qa-profile`, the same `qa-evidence.json` also includes the profile
 scorecard summary for the selected taxonomy categories.
 Treat it as a discovery aid, not a gate replacement; the selected scenario still needs the right provider mode, live transport, Multipass, Testbox, or release lane for the behavior under test.
-For scorecard context, see [Maturity scorecard](/maturity/scorecard).
 
 For character and style checks, run the same scenario across multiple live model
 refs and write a judged Markdown report:
@@ -1024,7 +1021,6 @@ When no `--judge-model` is passed, the judges default to
 ## Related docs
 
 - [Matrix QA](/concepts/qa-matrix)
-- [Maturity scorecard](/maturity/scorecard)
 - [Personal agent benchmark pack](/concepts/personal-agent-benchmark-pack)
 - [QA Channel](/channels/qa-channel)
 - [Testing](/help/testing)

docs/docs.json

@@ -68,14 +68,6 @@
       "source": "/reference/openclaw-sdk-api-design",
       "destination": "/gateway/external-apps"
     },
-    {
-      "source": "/reference/maturity-scorecard",
-      "destination": "/maturity/scorecard"
-    },
-    {
-      "source": "/reference/maturity-taxonomy",
-      "destination": "/maturity/taxonomy"
-    },
     {
       "source": "/mcp",
       "destination": "/cli/mcp"
@@ -1860,8 +1852,6 @@
               {
                 "group": "Release and CI",
                 "pages": [
-                  "maturity/scorecard",
-                  "maturity/taxonomy",
                   "reference/RELEASING",
                   "reference/full-release-validation",
                   "reference/release-performance-sweep",

docs/gateway/config-agents.md

@@ -1103,7 +1103,6 @@ for provider examples and precedence.
 - `models`: optional per-agent model catalog/runtime overrides keyed by full `provider/model` ids. Use `models["provider/model"].agentRuntime` for per-agent runtime exceptions.
 - `runtime`: optional per-agent runtime descriptor. Use `type: "acp"` with `runtime.acp` defaults (`agent`, `backend`, `mode`, `cwd`) when the agent should default to ACP harness sessions.
 - `identity.avatar`: workspace-relative path, `http(s)` URL, or `data:` URI.
-- Local workspace-relative `identity.avatar` image files are limited to 2 MB. `http(s)` URLs and `data:` URIs are not checked with the local file-size limit.
 - `identity` derives defaults: `ackReaction` from `emoji`, `mentionPatterns` from `name`/`emoji`.
 - `subagents.allowAgents`: allowlist of configured agent ids for explicit `sessions_spawn.agentId` targets (`["*"]` = any configured target; default: same agent only). Include the requester id when self-targeted `agentId` calls should be allowed. Stale entries whose agent config was deleted are rejected by `sessions_spawn` and omitted from `agents_list`; run `openclaw doctor --fix` to clean them up, or add a minimal `agents.list[]` entry if that target should remain spawnable while inheriting defaults.
 - Sandbox inheritance guard: if the requester session is sandboxed, `sessions_spawn` rejects targets that would run unsandboxed.

docs/gateway/configuration-reference.md

@@ -602,7 +602,7 @@ See [Inferred commitments](/concepts/commitments).
 - `remote.transport`: `ssh` (default) or `direct` (ws/wss). For `direct`, `remote.url` must be `wss://` for public hosts; plaintext `ws://` is accepted only for loopback, LAN, link-local, `.local`, `.ts.net`, and Tailscale CGNAT hosts.
 - `remote.remotePort`: gateway port on the remote SSH host. Defaults to `18789`; use this when the local tunnel port differs from the remote gateway port.
 - `gateway.remote.token` / `.password` are remote-client credential fields. They do not configure gateway auth by themselves.
-- `gateway.push.apns.relay.baseUrl`: base HTTPS URL for the external APNs relay used after relay-backed iOS builds publish registrations to the gateway. Public App Store/TestFlight builds use the hosted OpenClaw relay. Custom relay URLs must match a deliberately separate iOS build/deployment path whose relay URL points at that relay.
+- `gateway.push.apns.relay.baseUrl`: base HTTPS URL for the external APNs relay used by official/TestFlight iOS builds after they publish relay-backed registrations to the gateway. This URL must match the relay URL compiled into the iOS build.
 - `gateway.push.apns.relay.timeoutMs`: gateway-to-relay send timeout in milliseconds. Defaults to `10000`.
 - Relay-backed registrations are delegated to a specific gateway identity. The paired iOS app fetches `gateway.identity.get`, includes that identity in the relay registration, and forwards a registration-scoped send grant to the gateway. Another gateway cannot reuse that stored registration.
 - `OPENCLAW_APNS_RELAY_BASE_URL` / `OPENCLAW_APNS_RELAY_TIMEOUT_MS`: temporary env overrides for the relay config above.

docs/gateway/configuration.md

@@ -337,9 +337,9 @@ candidate contains redacted secret placeholders such as `***`.
   </Accordion>
 
   <Accordion title="Enable relay-backed push for official iOS builds">
-    Relay-backed push for public App Store/TestFlight builds uses the hosted OpenClaw relay: `https://ios-push-relay.openclaw.ai`.
+    Relay-backed push uses the hosted OpenClaw relay by default: `https://ios-push-relay.openclaw.ai`.
 
-    Custom relay deployments require a deliberately separate iOS build/deployment path whose relay URL matches the gateway relay URL. If you are using a custom relay build, set this in gateway config:
+    To use a custom relay, set this in gateway config:
 
     ```json5
     {
@@ -369,12 +369,12 @@ candidate contains redacted secret placeholders such as `***`.
     - Uses a registration-scoped send grant forwarded by the paired iOS app. The gateway does not need a deployment-wide relay token.
     - Binds each relay-backed registration to the gateway identity that the iOS app paired with, so another gateway cannot reuse the stored registration.
     - Keeps local/manual iOS builds on direct APNs. Relay-backed sends apply only to official distributed builds that registered through the relay.
-    - Must match the relay base URL baked into the iOS build, so registration and send traffic reach the same relay deployment.
+    - Must match the relay base URL baked into the official/TestFlight iOS build, so registration and send traffic reach the same relay deployment.
 
     End-to-end flow:
 
     1. Install an official/TestFlight iOS build.
-    2. Optional: configure `gateway.push.apns.relay.baseUrl` on the gateway only when using a deliberately separate custom relay build.
+    2. Optional: configure `gateway.push.apns.relay.baseUrl` on the gateway only when using a custom relay deployment.
     3. Pair the iOS app to the gateway and let both node and operator sessions connect.
     4. The iOS app fetches the gateway identity, registers with the relay using App Attest plus the app receipt, and then publishes the relay-backed `push.apns.register` payload to the paired gateway.
     5. The gateway stores the relay handle and send grant, then uses them for `push.test`, wake nudges, and reconnect wakes.
@@ -387,7 +387,7 @@ candidate contains redacted secret placeholders such as `***`.
     Compatibility note:
 
     - `OPENCLAW_APNS_RELAY_BASE_URL` and `OPENCLAW_APNS_RELAY_TIMEOUT_MS` still work as temporary env overrides.
-    - Custom gateway relay URLs must match the relay base URL baked into the iOS build. The public App Store release lane rejects custom iOS relay URL overrides.
+    - Custom gateway relay URLs must match the relay base URL baked into the official/TestFlight iOS build.
     - `OPENCLAW_APNS_RELAY_ALLOW_HTTP=true` remains a loopback-only development escape hatch; do not persist HTTP relay URLs in config.
 
     See [iOS App](/platforms/ios#relay-backed-push-for-official-builds) for the end-to-end flow and [Authentication and trust flow](/platforms/ios#authentication-and-trust-flow) for the relay security model.

docs/help/faq.md

@@ -346,10 +346,10 @@ lives on the [First-run FAQ](/help/faq-first-run).
     ```bash
     openclaw skills search "calendar"
     openclaw skills search --limit 20
-    openclaw skills install @owner/<skill-slug>
-    openclaw skills install @owner/<skill-slug> --version <version>
-    openclaw skills install @owner/<skill-slug> --force
-    openclaw skills install @owner/<skill-slug> --global
+    openclaw skills install <skill-slug>
+    openclaw skills install <skill-slug> --version <version>
+    openclaw skills install <skill-slug> --force
+    openclaw skills install <skill-slug> --global
     openclaw skills update --all
     openclaw skills update --all --global
     openclaw skills list --eligible
@@ -433,11 +433,11 @@ lives on the [First-run FAQ](/help/faq-first-run).
     Install skills:
 
     ```bash
-    openclaw skills install @owner/<skill-slug>
+    openclaw skills install <skill-slug>
     openclaw skills update --all
     ```
 
-    Native installs land in the active workspace `skills/` directory. For shared skills across all local agents, use `openclaw skills install @owner/<skill-slug> --global` (or place them manually in `~/.openclaw/skills/<name>/SKILL.md`). If only some agents should see a shared install, configure `agents.defaults.skills` or `agents.list[].skills`. Some skills expect binaries installed via Homebrew; on Linux that means Linuxbrew (see the Homebrew Linux FAQ entry above). See [Skills](/tools/skills), [Skills config](/tools/skills-config), and [ClawHub](/tools/clawhub).
+    Native installs land in the active workspace `skills/` directory. For shared skills across all local agents, use `openclaw skills install <slug> --global` (or place them manually in `~/.openclaw/skills/<name>/SKILL.md`). If only some agents should see a shared install, configure `agents.defaults.skills` or `agents.list[].skills`. Some skills expect binaries installed via Homebrew; on Linux that means Linuxbrew (see the Homebrew Linux FAQ entry above). See [Skills](/tools/skills), [Skills config](/tools/skills-config), and [ClawHub](/tools/clawhub).
 
   </Accordion>
 

docs/help/testing.md

@@ -20,7 +20,6 @@ of Docker runners. This doc is a "how we test" guide:
 
 - [QA overview](/concepts/qa-e2e-automation) - architecture, command surface, scenario authoring.
 - [Matrix QA](/concepts/qa-matrix) - reference for `pnpm openclaw qa matrix`.
-- [Maturity scorecard](/maturity/scorecard) - how release QA evidence supports stability and LTS decisions.
 - [QA channel](/channels/qa-channel) - the synthetic transport plugin used by repo-backed scenarios.
 
 This page covers running the regular test suites and Docker/Parallels runners. The QA-specific runners section below ([QA-specific runners](#qa-specific-runners)) lists the concrete `qa` invocations and points back at the references above.
@@ -191,10 +190,7 @@ inside every shard.
   - When dispatched by `pnpm openclaw qa run --qa-profile <profile>`, embeds the
     selected taxonomy profile scorecard in the same `qa-evidence.json`.
     `smoke-ci` writes slim evidence, which sets `evidenceMode: "slim"` and omits
-    per-entry `execution`. `release` covers the curated release-readiness slice;
-    `all` selects every active maturity category and is intended for explicit QA
-    Profile Evidence workflow dispatches when a full scorecard artifact is
-    needed.
+    per-entry `execution`.
   - Runs multiple selected scenarios in parallel by default with isolated
     gateway workers. `qa-channel` defaults to concurrency 4 (bounded by the
     selected scenario count). Use `--concurrency <count>` to tune the worker
@@ -741,20 +737,17 @@ Native dependency policy:
 - Command: `pnpm test:e2e:openshell`
 - File: `extensions/openshell/src/backend.e2e.test.ts`
 - Scope:
-  - Reuses an active local OpenShell gateway
+  - Starts an isolated OpenShell gateway on the host via Docker
   - Creates a sandbox from a temporary local Dockerfile
   - Exercises OpenClaw's OpenShell backend over real `sandbox ssh-config` + SSH exec
   - Verifies remote-canonical filesystem behavior through the sandbox fs bridge
 - Expectations:
   - Opt-in only; not part of the default `pnpm test:e2e` run
   - Requires a local `openshell` CLI plus a working Docker daemon
-  - Requires an active local OpenShell gateway and its config source
-  - Uses isolated `HOME` / `XDG_CONFIG_HOME`, then destroys the test sandbox
+  - Uses isolated `HOME` / `XDG_CONFIG_HOME`, then destroys the test gateway and sandbox
 - Useful overrides:
   - `OPENCLAW_E2E_OPENSHELL=1` to enable the test when running the broader e2e suite manually
   - `OPENCLAW_E2E_OPENSHELL_COMMAND=/path/to/openshell` to point at a non-default CLI binary or wrapper script
-  - `OPENCLAW_E2E_OPENSHELL_CONFIG_HOME=/path/to/config` to expose the registered gateway config to the isolated test
-  - `OPENCLAW_E2E_OPENSHELL_HOST_IP=172.18.0.1` to override the Docker gateway IP used by the host policy fixture
 
 ### Live (real providers + real models)
 

docs/install/uninstall.md

@@ -110,18 +110,14 @@ systemctl --user daemon-reload
 ### Windows (Scheduled Task)
 
 Default task name is `OpenClaw Gateway` (or `OpenClaw Gateway (<profile>)`).
-The task script lives under your state dir as `gateway.cmd`; current installs may
-also create a windowless `gateway.vbs` launcher that Task Scheduler runs instead
-of opening `gateway.cmd` directly.
+The task script lives under your state dir.
 
 ```powershell
 schtasks /Delete /F /TN "OpenClaw Gateway"
-Remove-Item -Force "$env:USERPROFILE\.openclaw\gateway.cmd" -ErrorAction SilentlyContinue
-Remove-Item -Force "$env:USERPROFILE\.openclaw\gateway.vbs" -ErrorAction SilentlyContinue
+Remove-Item -Force "$env:USERPROFILE\.openclaw\gateway.cmd"
 ```
 
-If you used a profile, delete the matching task name and the `gateway.cmd` /
-`gateway.vbs` files under `~\.openclaw-<profile>`.
+If you used a profile, delete the matching task name and `~\.openclaw-<profile>\gateway.cmd`.
 
 ## Normal install vs source checkout