Codex review: needs maintainer review before merge.

Latest ClawSweeper review: 2026-05-22 10:17 UTC / May 22, 2026, 6:17 AM ET.

Workflow note: Future ClawSweeper reviews update this same comment in place.

Summary
The branch stops mapping raw Codex app-server interrupted turns to OpenClaw aborted, adds focused projector/runner regressions, and adds a changelog entry.

Reproducibility: yes. Current main source maps raw app-server interrupted to aborted, and the embedded runner's no-visible-answer guard skips aborted attempts; the PR body also includes a focused failing assertion from main.

PR rating
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Summary: Strong focused proof, narrow implementation, and no blocking findings leave only maintainer acceptance of the interrupted-status contract.

Real behavior proof
Sufficient (live_output): The PR body and comments include redacted after-fix live output for focused local tests, Crabbox SSH runs, and a live Codex harness path exercising the changed behavior.

Risk before merge

• If a supported Codex app-server path emits raw interrupted for genuine out-of-band cancellation without OpenClaw abort-controller, timeout, or abort-marker evidence, users may now see no-visible-answer recovery instead of cancellation handling.

Maintainer options:

1. Merge With Explicit-Abort Contract (recommended)
   Merge if maintainers accept that only OpenClaw abort, timeout, abort-marker, or abort-controller evidence should suppress visible-answer recovery for Codex turns.
2. Require Interruption-Origin Signal
   Ask for an app-server interruption-origin signal first if raw interrupted must sometimes mean user cancellation in supported deployments without OpenClaw-side abort evidence.
3. Pause For Upstream Semantics
   Hold the PR if maintainers need upstream confirmation that raw interrupted is overloaded in a way this patch would mishandle.

Next step before merge
No automated repair remains; the next action is maintainer merge/check gating with the explicit-abort contract acknowledged.

Security
Cleared: The diff changes Codex app-server state projection, focused tests, and changelog text only; it adds no dependency, permission, secret, network, install, or code-execution surface.

ClawSweeper PR egg

✨ Hatched: 🥚 common Pearl Test Hopper

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

• Merged PRs are hatchable.
• Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
• Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

Rarity: 🥚 common.
Trait: sniffs out flaky tests.
Image traits: location CI tidepool; accessory lint brush; palette cobalt, lime, and pearl; mood calm; pose curling around a status light; shell matte ceramic shell; lighting cool dashboard glow; background soft code-shaped tiles.
Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Pearl Test Hopper in ClawSweeper.

Live behavior proof for PR #84494

Commit under test: 16981a7912a1b3a766810a7837f1d67aeb5a2b1e

What was run:

OPENCLAW_LIVE_TEST=1 \
OPENCLAW_LIVE_CODEX_HARNESS=1 \
OPENCLAW_LIVE_CODEX_HARNESS_AUTH=codex-auth \
OPENCLAW_LIVE_CODEX_HARNESS_CODE_MODE_ONLY=1 \
OPENCLAW_LIVE_CODEX_HARNESS_SUBAGENT_PROBE=0 \
OPENCLAW_LIVE_CODEX_HARNESS_IMAGE_PROBE=0 \
OPENCLAW_LIVE_CODEX_HARNESS_CHAT_IMAGE_PROBE=0 \
OPENCLAW_LIVE_CODEX_HARNESS_MCP_PROBE=0 \
OPENCLAW_LIVE_CODEX_HARNESS_GUARDIAN_PROBE=0 \
OPENCLAW_LIVE_CODEX_HARNESS_REQUEST_TIMEOUT_MS=600000 \
timeout 1200s node scripts/test-live.mjs --codex-harness -- \
  src/gateway/gateway-codex-harness.live.test.ts

Result:

[gateway-codex-live] client-connected
[gateway-codex-live] agent-event {"stream":"codex_app_server.lifecycle","data":{"phase":"thread_ready","threadId":"[redacted]"}}
[gateway-codex-live] agent-event {"stream":"codex_app_server.lifecycle","data":{"phase":"turn_starting","threadId":"[redacted]"}}
[gateway-codex-live] agent-event {"stream":"assistant","data":{"text":"CODEX-HARNESS-E97A46"}}
[gateway-codex-live] first-turn {"firstText":"CODEX-HARNESS-E97A46"}

[gateway-codex-live] agent-event {"stream":"assistant","data":{"text":"CODEX-HARNESS-RESUME-78E5BE"}}
[gateway-codex-live] second-turn {"secondText":"CODEX-HARNESS-RESUME-78E5BE"}

[gateway-codex-live] code-mode-only-tool-probe:start {"sessionKey":"agent:dev:live-codex-harness"}
[gateway-codex-live] agent-event {"stream":"tool","data":{"phase":"start","name":"sessions_list","toolCallId":"[redacted]","meta":"1","args":{"limit":1,"includeLastMessage":false}}}
[gateway-codex-live] agent-event {"stream":"tool","data":{"phase":"result","name":"sessions_list","toolCallId":"[redacted]","meta":"1","isError":false,"result":{"success":true}}}
[gateway-codex-live] agent-event {"stream":"codex_app_server.item","data":{"phase":"completed","itemId":"[redacted]","type":"dynamicToolCall"}}
[gateway-codex-live] agent-event {"stream":"codex_app_server.item","data":{"phase":"started","itemId":"[redacted]","type":"agentMessage"}}
[gateway-codex-live] agent-event {"stream":"codex_app_server.item","data":{"phase":"completed","itemId":"[redacted]","type":"agentMessage"}}
[gateway-codex-live] agent-event {"stream":"assistant","data":{"text":"CODEX-CODEMODE-TOOL-2A2648"}}
[gateway-codex-live] agent-event {"stream":"lifecycle","data":{"phase":"end"}}
[gateway-codex-live] code-mode-only-tool-probe:done

Test Files  1 passed (1)
Tests  1 passed | 1 skipped (2)

This is the real OpenClaw gateway -> plugin-owned Codex app-server path. It shows:

• a normal Codex turn produced a visible assistant response,
• a resumed turn produced a new visible assistant response without restarting the session,
• a tool-only phase (sessions_list, isError=false) was followed by a final assistant message,
• the run reached lifecycle end and Vitest passed.

Additional raw Codex app-server proof:

PROOF_MODE=tool timeout 300s node /tmp/openclaw-upstream-drafts/codex-appserver-live-proof.mjs

notification {"method":"item/started","type":"commandExecution"}
notification {"method":"item/completed","type":"commandExecution"}
notification {"method":"rawResponseItem/completed","type":"function_call_output"}
notification {"method":"item/started","type":"agentMessage"}
notification {"method":"item/completed","type":"agentMessage"}
notification {"method":"turn/completed","status":"completed"}
summary {"mode":"tool","completedStatus":"completed","sawTurnCompleted":true,"sawAgentMessage":true,"assistantContainsToken":true}

This raw app-server proof exercised a no-output shell command (/bin/bash -lc true) followed by a final assistant message.

Cancellation/interrupt proof:

PROOF_MODE=interrupt timeout 180s node /tmp/openclaw-upstream-drafts/codex-appserver-live-proof.mjs

interrupting turn {"threadId":"[redacted]","turnId":"[redacted]"}
notification {"method":"turn/completed","status":"interrupted"}
summary {"mode":"interrupt","completedStatus":"interrupted","sawTurnCompleted":true,"sawAgentMessage":false,"assistantContainsToken":false}

This confirms explicit interruption still remains distinguishable and does not synthesize a fake final answer.

Crabbox status:

Crabbox SSH target check:
REMOTE_CODEX_AUTH_MISSING
node v24.15.0
pnpm 11.1.0
lease cleanup stopped=true

I did not copy local Codex auth secrets to the lab VM. The prior focused regression test did pass through Crabbox on the SSH target:

CI=1 node scripts/run-vitest.mjs run --config test/vitest/vitest.extensions.config.ts \
  extensions/codex/src/app-server/run-attempt.test.ts \
  -t "keeps upstream cancellation aborted"

1 passed | 185 skipped
lease cleanup stopped=true

Security note: local paths, thread IDs, tool call IDs, account identity, and private lab host details were redacted from this public proof.

@clawsweeper re-review

Live behavior proof has been supplied in #84494 (comment). The Real behavior proof check is passing, and the proof includes gateway Codex app-server tool-followed-by-final-output plus explicit turn/interrupt behavior.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/26152961927
• Updated: 2026-05-20T09:18:33.838Z

@clawsweeper re-review

I added the exact diagnostic proof requested and pushed commit 551ffd124a.

New proof in PR body covers:

• app-server turn/completed status=interrupted
• successful tool-only bash commandExecution with empty output and exitCode=0
• no assistant text projected
• aborted=false, timedOut=false
• resolveIncompleteTurnPayloadText(...) reaches the no-visible-answer recovery text
• explicit cancellation counter-proof remains aborted=true and does not synthesize a final answer

Focused local proof passed: event-projector.test.ts 61 passed; cancellation regression 1 passed / 185 skipped.
Crabbox SSH proof passed for the exact diagnostic pair: 2 passed / 59 skipped, lease cleanup stopped=true.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Superseded
• Detail: A newer re-review for this item started before this run finished, so GitHub cancelled this older run. Check the latest ClawSweeper run for the current result.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/26160145698
• Updated: 2026-05-20T11:43:52.611Z

@clawsweeper re-review

I replaced the temporary cross-boundary diagnostic with the final proof layout and pushed commit 2010177bc7.

Exact proof now covers:

• projector test: app-server interrupted + successful empty bash output projects aborted=false, no assistant text, bash tool metadata preserved;
• projector counter-test: explicit abort remains aborted=true for the same interrupted/tool-only shape;
• core incomplete-turn test: a projector-compatible interrupted tool-only/no-assistant attempt reaches resolveIncompleteTurnPayloadText(...) and produces the no-visible-answer recovery text;
• core counter-check: explicit cancellation returns null, so it does not synthesize a final answer.

Focused local proof passed and Crabbox SSH proof passed with the corrected configs; PR body has the exact commands and redacted output.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/26188934738
• Updated: 2026-05-20T20:51:52.891Z

@clawsweeper re-review

I added exact runtime proof to the PR body under exact-runtime-interrupted-tool-only-proof-2026-05-20. The proof runs the real OpenClaw projector and incomplete-turn recovery modules locally and through Crabbox SSH, showing turn/completed status=interrupted + successful empty bash commandExecution + no assistant text reaches no-visible-answer recovery, while explicit cancellation remains aborted=true and returns recovery=null.

CI status update after exact runtime proof:

• Real behavior proof is passing after the new runtime proof section was added.
• I attempted gh run rerun 26160301231 --failed, but GitHub rejected it with Must have admin rights to Repository, so I cannot rerun failed jobs from this account.
• Sampled failed job logs point outside this PR diff:
  • checks-node-core-fast: src/security/windows-acl.test.ts failed on localized SYSTEM account classification.
  • checks-node-agentic-plugin-sdk: src/plugin-sdk/fs-safe-compat.test.ts failed with FsSafeError: Python helper is required for pinned writes on this platform.
  • checks-node-agentic-gateway-core: src/gateway/managed-image-attachments.test.ts failed while preparing image attachments.
• The PR diff only touches Codex app-server projection and focused lifecycle tests, and the focused local + Crabbox runtime proof for that path passed.

A maintainer rerun of the failed jobs is needed, or a maintainer can classify these CI failures as unrelated to this PR.

maintainer follow-up after reviewing this with the wider Codex app-server stack: #83200/#83222, #83476, #84135/#84974, #84137, #84492, and #84516.

I rebased this PR onto current main and pushed the contributor branch to 2bff2ae444aae5ba8d13911309f64cf92af52f4c. Merge state is clean. The review thread about treating interrupted terminal turns as aborted is resolved after rechecking the cancellation split: explicit cancellation still stays aborted, while app-server interrupted/tool-only terminal turns remain visible-answer eligible.

proof:

• focused Vitest interruption cases passed locally for event-projector, run-attempt, and pi-embedded-runner coverage.
• Crabbox fresh PR focused run passed: run_ecb2930d5da9 / cbx_fd2b493bde91.
• Blacksmith Testbox changed gate passed: tbx_01ks5f47e1wjjf8x4tv8tck15x, exit 0.

scope boundary: this is the #84492 interrupted/tool-only visibility fix. It should not be treated as closing #84516's long-reply/truncated-final-payload behavior or the #84137 post-tool raw assistant semantic decision.