docs: tighten landable bug sweep gates

steipete · steipete · commit 8f8638393ef4 · 2026-05-22T23:21:35.000+01:00
diff --git a/.agents/skills/openclaw-landable-bug-sweep/SKILL.md b/.agents/skills/openclaw-landable-bug-sweep/SKILL.md
@@ -15,10 +15,12 @@ Return exactly five PR URLs, each with:
 
 - bug summary
 - why the fix is low-risk
-- proof: local/CI/Testbox/live commands or run IDs
+- proof: rebased-head local/Testbox/live commands or run IDs
+- CI green on the exact pushed PR head
 - issue/duplicate cleanup done or still pending
 
 The five URLs may be existing PRs that were reviewed/fixed, or new PRs created from issues/clusters.
+Do not present a PR as one of the five until it has been refreshed on current `main`, left-tested, pushed, and verified green in live GitHub CI.
 
 ## Companion Skills
 
@@ -40,6 +42,7 @@ Accept only when all are true:
 - no plugin SDK, public plugin API, or `src/plugin-sdk/**` boundary change
 - no broad refactor smell
 - focused proof is feasible
+- branch can be rebased/refreshed and pushed, or a replacement PR can be created
 
 Good examples:
 
@@ -54,6 +57,8 @@ Reject:
 - plugin SDK/API boundary changes, including compatibility shims, new SDK methods, SDK exports, or plugin-facing channel/provider seams
 - auth/security boundary changes unless explicitly assigned
 - bugs needing live credentials that are unavailable
+- PRs with red CI unless you fix, rebase, push, and recheck them green
+- PRs you only reviewed locally but did not refresh/push/check live
 - fixes whose clean shape is a larger architecture move
 - speculative reports without reproducible/provable cause
 - UI/UX changes requiring product judgment
@@ -82,14 +87,16 @@ Reject:
    - if no PR exists, create one
    - add regression test when it fits
    - changelog for user-facing fixes; thank credited human reporter/contributor
-6. Review and publish:
-   - run focused proof
+6. Review, refresh, and publish:
+   - rebase or otherwise refresh the PR branch on current `origin/main`
+   - resolve drift, including newly exposed CI failures, rather than counting the PR as ready
+   - left-test the rebased head with the smallest meaningful local/Testbox/live command that proves the bug
    - run `$autoreview` until no accepted/actionable findings remain
    - create/update PR with real body and proof fields
-   - push branch
-   - get CI green or document exact external blocker; do not count blocked PRs in the five
+   - push the exact reviewed head
+   - verify live GitHub CI is green for that pushed head; do not count pending, red, dirty, conflicting, or externally blocked PRs in the five
 7. Hygiene:
-   - close duplicates and fixed-on-main issues with proof
+   - close duplicates and fixed-on-main issues/PRs with proof as soon as you notice them during the sweep
    - never mutate more than five associated items in one cluster without explicit confirmation
    - comments must be kind, concrete, and include proof/PR/commit links
 8. Repeat until five landable PR URLs are ready.
@@ -110,10 +117,11 @@ What was not tested:
 ## Existing PR Rules
 
 - Review code path beyond the diff before trusting it.
-- If PR is good: fix small issues, run proof, push if writable, get CI green.
+- If PR is good: rebase/refresh on current `main`, fix small issues, left-test, autoreview, push, and get CI green before counting it.
 - If PR is not good but has a useful idea: recreate locally, co-author when warranted, close original with thanks and explanation.
 - If PR is duplicate or fixed on `main`: comment proof, close.
 - If maintainer cannot push to contributor branch: create own branch/PR, preserve useful commits or credit.
+- If CI turns red after local proof, treat that as normal work: inspect the failing job, fix or reject, rerun, and only count the PR once green.
 
 ## Output Ledger
 
@@ -127,7 +135,9 @@ accepted:
   root cause:
   fix:
   risk:
-  proof:
+  rebase/head:
+  left-test:
+  autoreview:
   CI:
   credit/thanks:
   cleanup:
