[SebTardif]

What changes

Keep comment commands dispatching when creation of the optional target acknowledgement token fails. The central dispatch credential is independent; reactions and queued acknowledgements already tolerate an empty target token. Make that token action best-effort so GitHub Actions reaches the existing fallback path.

Preserves the existing command set and credential scopes. Includes regression coverage, documentation, and an Unreleased entry thanking @SebTardif.

Validation

The regression fails on the previous main branch because the failed action prevents the dispatch step. With this change, all 32 tests and actionlint pass locally. Independent Codex review of the complete candidate found no actionable P0–P2 defects.

Hosted failure proof: https://github.com/openclaw/clawsweeper.bot/actions/runs/38954795195

The pinned create-github-app-token action runs on a GitHub-hosted runner with intentionally invalid, synthetic key material. It fails with Invalid keyData; the next step verifies outcome=failure, conclusion=success, and an empty target token, then executes the production comment-dispatch shell block. GitHub accepts the dispatch. The only routing changes in this temporary proof send a distinct inert event to this repository instead of sending a command to the central ClawSweeper service. No production credentials, comments, or deployments are involved. The temporary proof workflow is not part of the proposed final diff.

The unit regression models Actions scheduling and exercises the real dispatch shell with a stub endpoint; the linked hosted run separately demonstrates actual runner continuation and accepted API delivery. It does not claim an intentionally induced production app outage.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[vercel]

@SebTardif is attempting to deploy a commit to the OpenClaw Foundation Team on Vercel.

A member of the Team first needs to authorize it.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR makes acknowledgement-token creation best-effort so its failure does not prevent comment-command dispatch.

Example: A maintainer posts /review on openclaw/clawsweeper.bot, the central dispatch token succeeds, and the target acknowledgement token fails.

• Before: GitHub Actions skips the dispatch step and the command is lost.
• After: The workflow dispatches the command without posting an acknowledgement.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The focused patch appears correct and useful, but the required runtime proof is currently simulated.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: An explicit ClawSweeper command disappears when acknowledgement-token creation fails despite a usable dispatch token.
Reason: The change restores the documented separation between optional acknowledgements and command delivery without adding a setting or changing command semantics.

Merge readiness

⛔ Blocked before merge - 1 item remains

Keep this PR open: it fixes a concrete command-dispatch failure still present on main, with no actionable introduced defect found.

Priority: P2
Reviewed head: 59b73e9d23d2f0e2673319ebec0fd82c30f8c498

Before merge

• Add real behavior proof - The supplied terminal output executes the workflow shell block with a stub gh and a hand-modeled Actions skip rule, so it does not prove the changed continue-on-error behavior on a runner or a received dispatch. Add a linked hosted run or redacted runner logs showing target-token creation fail, the later step run, and dispatch acceptance; redact credentials, IPs, and non-public endpoints. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.

Findings

None.

Tests

• Missing end-to-end proof: Provide a hosted Actions run where target-token creation fails and the subsequent comment step dispatches successfully; the supplied before/after result models scheduling rather than exercising it.

Agent review details

How this fits together

The repository's GitHub Actions dispatcher receives item and comment events, obtains scoped GitHub App tokens, and forwards eligible events to the central ClawSweeper repository.

flowchart LR
  A[GitHub comment] --> B[Command prefilter]
  B --> C[Central dispatch token]
  C --> D[Best effort acknowledgement token]
  D --> E[Comment dispatch script]
  E --> F[Central ClawSweeper router]

Loading

Technical review

Best possible solution:

Keep the focused workflow fix so optional acknowledgement credentials cannot suppress independently authenticated command dispatch.

Do we have a high-confidence way to reproduce the issue?

Current-main source establishes the failure path: target-token creation can fail after dispatch-token creation, and the later dispatch step has the default success condition; no live failure was reproduced during this read-only review.

Is this the best way to solve the issue?

Adding continue-on-error at the optional token step repairs the workflow owner directly and matches both existing empty-token handling and the upstream dispatcher contract.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 13419ce4ddee.

Provenance checked

• Target comment-token failure handling changes intended behavior with a stated reason (adca467: The workflow addition forwards ClawSweeper commands and already makes acknowledgement writes conditional on a target token; its commit and commit-to-PR lookup provide no separate rationale for making token creation fatal.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Pinned change and current-main failure: The introduced production change adds only continue-on-error to the target comment-token step. Verified current main remains 13419ce, where this step lacks that setting and its failure skips the later comment-dispatch step. (.github/workflows/clawsweeper-dispatch.yml:63, 59b73e9d23d2)
• Existing missing-token handling: On main, TARGET_TOKEN controls only reactions and queued acknowledgements; the final repository dispatch uses the independently minted DISPATCH_TOKEN. The existing shell path already supports dispatch without an acknowledgement token. (.github/workflows/clawsweeper-dispatch.yml:161, 13419ce4ddee)
• Feature history and ownership: Scoped history and blame trace token creation and optional acknowledgement handling to steipete's workflow-addition commit. SebTardif subsequently contributed the merged concurrency repair in fix: keep comment commands out of the item concurrency group #2, which steipete reviewed and merged. A follow-history traversal encountered an unavailable historical blob; direct commit inspection, scoped history, and current-main blame supplied the relevant provenance. (.github/workflows/clawsweeper-dispatch.yml:55, 13419ce4ddee)
• Supplied proof and regression coverage: The full PR body explicitly describes simulated Actions step scheduling and a stub gh executable. The added test likewise models scheduling and executes the real shell block against a stub; neither exercises the changed setting in GitHub Actions. (tests/comment-token-failure.test.mjs:25, 59b73e9d23d2)
• Checks and deployment authorization: The reviewed head has successful test and dispatch checks. Vercel reports deployment authorization required, corroborated by its comment on this PR and the same gate on fix: keep comment commands out of the item concurrency group #2 (comment); this is an external deployment gate rather than a diff-caused failure. (59b73e9d23d2)
• Policy and related work: The target tree contains no AGENTS.md or maintainer-note directory. All-state searches found no replacement for this fix; fix: accept canonical ClawSweeper comment commands #4 changes command recognition, while the merged fix: keep comment commands out of the item concurrency group #2 changes concurrency. (13419ce4ddee)

Likely related people:

• Peter Steinberger: Raw commit adca467 adds .github/workflows/clawsweeper-dispatch.yml:55 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: adca46792e86; files: .github/workflows/clawsweeper-dispatch.yml)
• Sebastien Tardif: Raw commit 13419ce adds .github/workflows/clawsweeper-dispatch.yml:15 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 13419ce4ddee; files: .github/workflows/clawsweeper-dispatch.yml)

Labels

Label changes:

• add P2: An acknowledgement-token failure can drop an explicit command, but the affected path and repair are narrowly scoped.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P2: An acknowledgement-token failure can drop an explicit command, but the affected path and repair are narrowly scoped.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Show the token-failure path executing on GitHub Actions with successful subsequent dispatch.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 15, 2026, 9:05 PM ET / October 16, 2026, 01:05 UTC.

[steipete]

Verified at 4f2cb48: 32 tests pass locally and on Linux Crabbox, actionlint and independent review pass, and exact-head CI is green. Hosted run 38954795195 demonstrates actual token-action failure, continuation, and accepted inert dispatch; the live-proof hold is resolved.