Fix apply workflow sync before state hydration

[brokemac79]

Summary

• Move the apply-existing job's git pull --rebase before state hydration so the source checkout is still clean when it syncs.
• Remove the post-hydration pull that could fail after generated state copied tracked paths into the worktree.
• Add a regression assertion that the apply lane syncs before setup-state and does not rebase between hydration and reconcile.

Fixes #270.

Validation

• pnpm run build:all passed
• node --test --test-name-pattern "apply workflow" test/clawsweeper.test.ts passed
• pnpm run format:check passed
• pnpm run check reached build and lint successfully, then failed during test:unit on this Windows host in unrelated environment-sensitive tests: Codex proof spawn returns EPERM, one test expects /usr/bin/git, and a POSIX file-mode assertion sees Windows modes.

Runtime Proof

Generated from a fresh throwaway clone of this PR branch plus a fresh public state checkout. Paths are local temp paths and omitted here. No apply-decisions, close, or other mutation command was run.

HEAD=eebe840
STATUS_BEFORE_SYNC=
git pull --rebase
Already up to date.
STATUS_AFTER_SYNC=

HYDRATE_START
{"hydrated":["records","jobs","results","assets","apply-report.json","repair-apply-report.json"],"source":"<temp>/clawsweeper-state","target":"<temp>/clawsweeper"}
HYDRATE_EXIT=0
STATUS_AFTER_HYDRATE_COUNT=1

RECONCILE_FULL_START
pnpm run reconcile -- --target-repo openclaw/openclaw --skip-closed-at
{
  "openItemsSeen": 7949,
  "pagesScanned": 80,
  "movedToClosed": 1885,
  "movedToItems": 3,
  "removedStaleClosedCopies": 0,
  "fetchedClosedAt": 0
}
RECONCILE_FULL_EXIT=0

This demonstrates the reordered apply-existing path can sync the source checkout before hydration, hydrate state, and reach/complete reconcile without the dirty-worktree rebase failure.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 9, 2026, 6:26 AM ET / 10:26 UTC.

Summary
The PR moves the apply-existing job's git pull --rebase before state hydration, removes the post-hydration pull, and adds workflow ordering regression coverage.

Reproducibility: yes. at source level: current main hydrates generated state into the checkout and then runs git pull --rebase in apply-existing, matching the dirty-worktree failure reported in #270. I did not run a live scheduled apply job in this read-only review.

Review metrics: 2 noteworthy metrics.

• Automation surface: 1 workflow changed. The diff changes scheduled apply-existing ordering around checkout sync, state hydration, and reconcile.
• Regression coverage: 1 test added. The new test pins the intended sync-before-hydration ordering and absence of a post-hydration pull.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Risk before merge

• [P1] This changes the scheduled close-apply GitHub Actions path; the posted throwaway-clone proof and green checks are positive, but a live scheduled/main runner remains the highest-fidelity environment for app-token and checkout timing behavior.

Maintainer options:

1. Merge with current runtime proof (recommended)
   If required checks remain green, maintainers can accept the remaining live-runner uncertainty because the patch is small and the PR body proves sync, hydration, and reconcile on a fresh setup.
2. Ask for live workflow proof
   If maintainers want higher fidelity before merge, request a redacted Actions log or artifact showing the same apply-existing ordering on this branch or an equivalent main-run dry path.

Next step before merge

• [P2] No automated code repair is indicated; maintainers should review the automation-sensitive workflow reorder and decide whether the posted proof plus checks are enough to merge.

Security
Cleared: No concrete security or supply-chain regression found; the workflow change reorders an existing git pull --rebase and does not add permissions, actions, dependencies, or secret exposure.

Review details

Best possible solution:

Merge the narrow ordering fix after required checks and maintainer acceptance of the apply-lane automation risk, keeping apply-existing synced before hydration with no post-hydration rebase.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level: current main hydrates generated state into the checkout and then runs git pull --rebase in apply-existing, matching the dirty-worktree failure reported in #270. I did not run a live scheduled apply job in this read-only review.

Is this the best way to solve the issue?

Yes. Moving the existing pull before setup-state is the narrow maintainable fix for the dirty-worktree rebase failure, and the PR adds focused ordering coverage.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 205a27a9d70d.

Label changes

Label justifications:

• P1: The PR targets a scheduled close-apply workflow failure that can block real apply runs before reconcile and apply work begin.
• merge-risk: 🚨 automation: The diff changes GitHub Actions automation behavior in the close-apply lane rather than ordinary application logic.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes redacted terminal output from a fresh clone/state checkout showing sync before hydration, successful hydration, and completed reconcile; the latest trigger commit has the same tree as the proof commit.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes redacted terminal output from a fresh clone/state checkout showing sync before hydration, successful hydration, and completed reconcile; the latest trigger commit has the same tree as the proof commit.

Evidence reviewed

What I checked:

• Repository policy read: Read the full target AGENTS.md; its conservative guidance for apply-lane workflow changes and state hydration affected this review. (AGENTS.md:1, 205a27a9d70d)
• Current main failure ordering: Current main runs ./.github/actions/setup-state in apply-existing before the later Sync before applying decisions git pull --rebase step. (.github/workflows/sweep.yml:1889, 205a27a9d70d)
• Hydration copies generated paths: The state hydrator removes and copies generated paths such as records, jobs, results, assets, and apply reports into the source worktree, matching the dirty-worktree mechanism reported in Scheduled close-apply workflow fails after state hydration dirties worktree #270. (scripts/hydrate-state.ts:5, 205a27a9d70d)
• PR workflow diff: The PR adds Sync source checkout before state hydration before setup-state and removes the old Sync before applying decisions step after hydration/build. (.github/workflows/sweep.yml:1866, 15b3463300e8)
• PR regression coverage: The PR adds a test asserting sync occurs before setup-state and that no git pull --rebase remains between state hydration and reconcile. (test/clawsweeper.test.ts:16408, 15b3463300e8)
• Runtime proof and latest head: The PR body includes redacted terminal proof from a fresh clone/state checkout showing sync before hydration, HYDRATE_EXIT=0, and RECONCILE_FULL_EXIT=0; the latest trigger commit has the same tree as the proof commit. (15b3463300e8)

Likely related people:

• Dallin Romney: Blame shows the apply-existing job, setup-state action, hydrate-state script, and original post-hydration sync step came from the dashboard/state hydration merge, with later related workflow-infra commits in the same area. (role: introduced behavior and recent area contributor; confidence: high; commits: 1aff86c63e59, 40568e1fc23d, bf59027ad874; files: .github/workflows/sweep.yml, .github/actions/setup-state/action.yml, scripts/hydrate-state.ts)
• Jesse Merhi: The reconcile/preselect apply workflow block and nearby apply workflow regression test were added in the PR-close coverage gate work. (role: recent adjacent contributor; confidence: medium; commits: 2af278ebe246; files: .github/workflows/sweep.yml, test/clawsweeper.test.ts)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[brokemac79]

Added redacted runtime proof to the PR body showing the reordered apply-existing path syncs before hydration, hydrates state, and completes reconcile without running apply/close commands.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/27199097287
• Updated: 2026-06-09T10:15:36.565Z