[freeqaz]

Problem

Finding 1856 asked for a test that Compute refuses an executionCluster.harnessRouting.hostname that parses as another address (127.1, 0x7f.1). The only existing test, "execution chart refuses a harness hostname Compute refuses", checks the Helm side.

Writing that test showed that the Compute call it should protect (validateDnsHostname(required(execution.harnessRouting?.hostname, "Harness routing hostname"), ...) in KubernetesComputeDriver.validateConfiguration) could not be reached for any nonempty value. Just before it, the execution plane's own check reuses harnessRouting as its gatewayRouting and already refuses these hostnames, so:

• the refusal named a setting the operator did not write: Gateway routing hostname must be a DNS hostname without a port or path. A numeric or 0x last label parses as IPv4; ... for a harness hostname;
• a test that only expects a refusal would still pass if the harness check were removed.

Change

• Check the harness hostname before the execution plane's check, so the refusal names Harness routing hostname. The same hostnames are refused and accepted. A configuration that is also broken elsewhere in the execution plane now reports the hostname first, and a missing harnessRouting (schema bypassed) now reports the missing harness hostname instead of a Gateway routing or gateway client error.
• New Compute conformance test two-cluster Compute refuses a harness routing hostname that parses as another address:
  • 127.1, 0x7f.1, api.123, harness.0x10 are refused with the IPv4 hint;
  • Harness.example.test, harness.example.test:443, harness_1.test and a non-string value are refused without the hint;
  • an empty or missing value must be explicitly configured;
  • harness.example.test, 1password.example.test, 0x.example.test are accepted.

Verification

• New test fails on main (actual: Gateway routing hostname must be ...).
• Mutant, harness check removed: the test fails with the same Gateway message.
• node --test tests/conformance/kubernetes-compute.test.mjs tests/conformance/kubernetes-preflight.test.mjs tests/conformance/kubernetes-runtime-credentials.test.mjs: 416/416 pass.
• tests/conformance/kubernetes-compute.test.mjs 20/20 at 2 CPUs (CPUs 6-7) on the final head cc135a272.
• Open PRs touching the same files (fix(compute): carry identifier-shaped OpenAI 401 codes in the native upfront probe #2767, Allow custom OpenAI-compatible endpoints for native OpenClaw #2755, Show which provider readiness check a deployment is waiting on #2695, fix(openshell): fail Pod-label refusals permanently and check the allowlist #2643, feat(runtime): apply Gateway tool policy to dedicated OCE deployments #2633, feat(console): show the authorized native Gateway people roster #2596, Add an opt-in Strands history policy backend for Credential Proxy #2543, RFC and implementation: managed outbound HTTPS for dedicated Gateways #2518, Credential Proxy Implementation #2487, fix: preserve native plugin permissions across Harness selection #2409, fix: prepare native admin access on the first Agent deployment #2259, fix: preserve native plugin permissions across Harness selection and admission #2258, feat: assign configured OpenClaw roles to Agent users #906, docs(specs): propose rfc-0019 for crash-looping runtimes in the deployment record #883, feat: add Agent workload tags #115): git merge-tree against each adds no conflicted file and no conflict hunk beyond what main already causes. The new test sits before the sandbox routing test, away from feat(console): show the authorized native Gateway people roster #2596's insertion point.
• tsc --build tsconfig.json, eslint and prettier on the touched files: clean.

Risks

Low. The change only reorders one check within Compute configuration validation. The execution Helm chart's refusal is unchanged. The other harness routing fields (gatewayName, gatewayNamespace, envoyNamespace, envoyHttpsTargetPort) are still refused as "Gateway routing ..." through the shared check; that is board finding 1858.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.