[steipete]

Move repo-local macOS release preflight from macos-14 to xcode-27. Preserve the macOS 13 minos gate, make the deployment target explicit for preflight and GoReleaser, and execute the amd64 helper under asserted/installed Rosetta. No Intel hardware is required.

The shared release-go-cli workflow remains on openclaw/release-workflows@v1 and is maintained centrally. Go 1.27.2 and the documented go 1.27.0 minimum are unchanged.

Validation: 41 release/workflow tests, actionlint and independent review through P3 passed. The full documented make check gate passed on an isolated Linux worker with Go 1.27.2, including module tidiness, vet, deadcode, govulncheck, unit tests, race tests and release contracts. Govulncheck found zero reachable or imported-package vulnerabilities; one module-only advisory is outside the used code. Exact-head and merged-main CI plus a merged-main release dry_run are required before closeout. No release, tag or product version bump is included.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T02:37:19.018104Z	d4076cd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR moves macOS release preflight to xcode-27, explicitly sets the macOS 13 deployment target, and checks execution of both architectures.

Example: A release preflight builds crawlctl for darwin/amd64 and darwin/arm64.

• Before: macos-14 checks both binaries’ macOS 13 minimum without executing them.
• After: xcode-27 checks the same minimum and runs both binaries’ --help, using Rosetta for amd64.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The focused patch has no identified defect, but confidence in the new runner path remains limited to source inspection and supporting checks.
Proof confidence	🌊 off-meta tidepool	Not applicable: The ordinary contributor proof gate exempts this maintainer-authored PR; reported Linux checks and historical release runs do not demonstrate the changed macOS path.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Release maintainers need the local macOS preflight to follow the centrally adopted runner while retaining compatibility checks.
Reason: The supplied maintainer-authored classification establishes direction, and the small diff preserves the documented release contract.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: the maintainer-directed release migration is absent from main, and the pinned diff introduces no actionable correctness or security defect.

Priority: P3
Reviewed head: d4076cd34f8a93fbc6cad4c782b12e089565a0b2

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: The supplied evidence does not exercise the changed preflight on xcode-27 with both binaries executing and reporting minos 13.0.

Agent review details

How this fits together

The repository’s release caller validates dispatch inputs and macOS binaries before handing tagging, signing, notarization, verification, and publication to the shared release workflow.

flowchart TD
  A[Release dispatch] --> B[Version validation]
  B --> C[Xcode 27 preflight]
  C --> D[Deployment and execution checks]
  D --> E[Notarization access check]
  E --> F[Shared release workflow]
  F --> G[Verified release artifacts]

Loading

Technical review

Best possible solution:

Retain this focused migration while preserving the existing deployment, credential, and shared publication boundaries.

Do we have a high-confidence way to reproduce the issue?

This PR changes release infrastructure rather than reporting a reproduced product defect.

Is this the best way to solve the issue?

The change uses the existing preflight owner and matches the shared workflow’s Xcode 27 and Rosetta approach without adding a competing release path.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 97b4d5b647e4.

Provenance checked

• macOS release preflight keeps the original intent (49c27f9: Check both binaries against the documented macOS 13 minimum and verify notarization access before tag creation.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Verified introduced change: The pinned diff changes the runner, adds Rosetta verification and architecture-specific execution, sets deployment-target environment values, and adds the changelog entry; main retains macos-14. (.github/workflows/release-unified.yml:24, d4076cd34f8a)
• Preserved release contract: The macOS 13 minimum and pre-tag notarization check were established in chore: prepare crawlkit 0.17.0 #160; shared release ownership and archive contracts were restored in ci: restore unified release workflow #79. (docs/publishing.md:36, 97b4d5b647e4)
• Current discussion and validation: The complete body and comments contain reported Linux validation and an existing automated review, but no run of the changed macOS preflight; exact-head checks have nine successes and one skip, and recorded release runs predate this PR. (d4076cd34f8a)
• Authoritative dependency and existing runner trust: The target executes release-go-cli.yml@v1, establishing this dependency’s relevance; its resolved workflow already signs and notarizes on xcode-27 and verifies Intel execution through Rosetta. The root AGENTS.md endpoint returned 404. (.github/workflows/release-go-cli.yml:1344, 55c651f600fa)
• Repository policy and history: The complete root AGENTS.md was applied; no nested policy, maintainer notes, or pr-simplify skill governs these paths. Feature history identifies repeated release work by Peter Steinberger; one older commit inspection encountered a missing promisor object, without affecting the verified diff or current contract. (AGENTS.md, 97b4d5b647e4)

Labels

Label changes:

• add P3: This is release infrastructure maintenance without evidence of an urgent user-facing failure.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: This is release infrastructure maintenance without evidence of an urgent user-facing failure.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Use the already planned merged-main release dry run to confirm both architecture executions and the macOS 13 checks.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 18, 2026, 10:54 PM ET / October 19, 2026, 02:54 UTC.