[freeqaz-openai]

The peer suite ran the test that bounds stream renewal during a policy outage, but CI’s expected-test list omitted it. CI now checks that the named case runs and passes. The PostgreSQL cases share their receipt assertions; the peer and PostgreSQL tests also share a small deferred-promise helper. The original awaits and case-specific expected errors remain at the call sites.

All 154 peer cases and 35 PostgreSQL cases passed without skips. The CI runner’s targeted test also verified that it rejects a missing or skipped expected case.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR requires the existing stream-outage regression in CI and shares equivalent deferred-promise and refused-receipt test helpers.

Example: The case “exchange bounds unavailable stream policy checks without extending authorization” disappears from the peer suite.

• Before: The CI manifest has no named expectation requiring that case.
• After: The CI runner reports a missing expected test and fails the lane.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused maintenance patch with equivalent assertions, preserved scheduling, existing runner coverage, and successful exact-head CI.
Proof confidence	🐚 platinum hermit (4/6)	This collaborator-authored PR changes test infrastructure only; source equivalence and successful exact-head CI support its scope without requiring a new product-runtime demonstration.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: A future removal of the stream-outage regression could escape CI’s named-case enforcement.
Reason: The maintainer-authored change strengthens existing coverage with minimal maintenance cost and preserves the tested product contract.

Merge readiness

✅ Ready for maintainer review

Keep open: this maintainer-authored PR closes a concrete CI coverage gap and preserves existing test assertions and scheduling; no actionable defect was found.

Priority: P3
Reviewed head: 5a71f19af215254a4eea2ecd3b4c5f0ada085599

Before merge

None.

Findings

None.

Agent review details

How this fits together

The CI manifest selects credential-proxy integration tests, and the runner compares their reported outcomes with required case names; shared helpers coordinate tests and check refused receipts.

flowchart TB
  Manifest[CI expected cases] --> Runner[CI test runner]
  Runner --> Tests[Credential integration tests]
  Helpers[Shared test helpers] --> Tests
  Tests --> Results[Test outcomes]
  Results --> Gate[Required case validation]

Loading

Technical review

Best possible solution:

Land the focused CI expectation and behavior-preserving helper extraction through the normal review process.

Do we have a high-confidence way to reproduce the issue?

Source inspection confirms that current main omits the existing outage case from expectedTests and that the runner enforces named expectations; no target code was executed.

Is this the best way to solve the issue?

The existing CI manifest is the correct owner for required-case enforcement, and the extracted helpers preserve assertion strength and asynchronous scheduling.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against dde0d51badfa.

Provenance checked

• Deferred-promise coordination keeps the original intent (3115679: The peer tests use explicit promise gates to hold concurrent operations at meaningful boundaries; the PostgreSQL suite adopted the same helper in c98be20.)
• Refused-receipt assertions keeps the original intent (c98be20: The assertions protect settled refusals without authorization, including withdrawal, unavailable authority, and stale placement; extraction retains all three assertions and case-specific errors.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Verified introduced scope: The pinned introduction changes only the CI expectation and test helpers; receipt reads, await points, expected errors, and provider-request assertions remain at their original call sites. (tests/integration/postgres-egress-policy-transaction.test.ts:115, 5a71f19af215)
• Concrete CI enforcement: The added expectation exactly matches the existing outage regression; the runner rejects both absent expectations and expected cases whose status is not passed. (scripts/ci/run-tests.mjs:1308, 5a71f19af215)
• Current main still lacks the expectation: Fetched main contains the outage regression but omits its name from the peer suite’s expectedTests list. (scripts/ci/test-suites/checks-baseline-1.json:492, dde0d51badfa)
• Existing runner regression coverage: An existing integration scenario invokes the real runner and checks its rejection of missing and skipped expected cases; this PR adds no redundant test group. (tests/integration/ci-runner.test.mjs:470, 5a71f19af215)
• Feature intent and ownership: Bound stream authorization retries during authority outages #3844 introduced bounded outage retries and the existing regression; Order native credential send authorization with grant withdrawal #3871 introduced the PostgreSQL assertions being consolidated, preserving withdrawal ordering and refusal semantics. (tests/integration/postgres-egress-policy-transaction.test.ts:552, dde0d51badfa)
• Exact-head CI: GitHub reports successful CI Required, Checks and Conformance 1, and PostgreSQL Platform checks for the reviewed head in https://github.com/openclaw/openclaw-enterprise/actions/runs/40545535134; detailed job logs were inaccessible because their redirected Azure host is blocked, so the body’s exact test counts were not independently confirmed. (5a71f19af215)

Likely related people:

• Free Wortley: Raw commit c98be20 adds tests/integration/postgres-egress-policy-transaction.test.ts:547 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: c98be2044ce4; files: tests/integration/postgres-egress-policy-transaction.test.ts)

Review metrics

Metric	Value	Why it matters
Change footprint	Production +0/-0; tests and helpers +33/-50; CI manifest +1/-0	The helper extraction reduces duplication without adding production machinery.

Labels

Label changes:

• add P3: This is low-risk test maintenance and CI coverage enforcement with no production behavior change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: This is low-risk test maintenance and CI coverage enforcement with no production behavior change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 27, 2026, 1:12 PM ET / 17:12 UTC.

[freeqaz]

Free's clanker here (an AI agent working on Free's behalf). Comment-only review of 5a71f19af2.

Summary: test-only, and coverage is not weaker. Nothing blocks landing.

• Expected tests: exchange bounds unavailable stream policy checks without extending authorization exists at credential-proxy-peer-pin.test.ts:274. It is now in checks-baseline-1's expectedTests, so the suite fails if that test is skipped or missing. This adds coverage.
• assertRefusedReceipt: all four replaced blocks assert the same three things as before: authorization === null, settled === true, and a deep-equal refused/dispatched: false outcome. Each call site still passes its own error.
• tests/helpers/deferred.ts: the code is identical to the two local copies it replaces. It is a helper, not a test file, so it needs no suite mapping.
• Verification: credential-proxy-peer-pin.test.ts passed 154/154 with 0 skipped on a remote test VM. CI Required is green on this head (the PostgreSQL file runs there). The PR merges cleanly with main and with #3879, which also edits checks-baseline-1.json.