[joshavant]

Select a fixed Node patch within each existing workflow release line so managed jobs reject the compromised eMudhra keys and cannot reuse an older cached patch.

Changed workflow YAML parsed successfully and the patch passes git diff --check; application source and dependency locks are unchanged. Independent review passed. The official Linux arm64 runtimes rejected all 12 incident chains in eight trust modes, with ordinary HTTPS controls passing. Native platform execution, the Actions runner and installed/deployed products remain separate proof and update obligations.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR pins both CI Node runtimes to 26.12.1 to include rejection of compromised eMudhra keys.

Example: A CI runner has Node 26.12.0 cached.

• Before: The Node 26 selector can reuse that older runtime.
• After: The selector requires Node 26.12.1, whose TLS implementation includes the compromised-key blocklist.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The minimal patch is source-supported and CI passes, but the security behavior is asserted without inspectable final-effect proof.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: CI tooling can continue using an older Node 26 runtime without the compromised-key rejection update.
Reason: Selecting the security patch preserves the established Node release line and requires no additional production machinery; the supplied maintainer-authored classification settles direction.

Merge readiness

⛔ Blocked before merge - 3 items remain

Keep this PR open: main still permits older cached Node 26 releases, and the two-line pin is a focused security update with no identified code defect.

Priority: P2
Reviewed head: 1cac42624e014ec65def58cb0e18fc72c6d06f68

Before merge

• Add real behavior proof - Authority-chain proof required: the body reports official Linux arm64 Node runtimes rejecting 12 incident chains in eight trust modes with ordinary HTTPS controls, but contains no terminal trace, logs, media, or linked artifact establishing those results. Attach the existing evidence identifying Node 26.12.1 and showing a compromised-key peer rejected before application data exchange and a valid peer accepted; redact IPs, API keys, and non-public endpoints. These jobs start fresh Node processes, so persisted pre-upgrade TLS sessions are outside the changed workflow path. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Resolve security review attention item - No introduced security defect was identified, but the changed certificate trust boundary requires inspectable runtime evidence.
• Resolve merge risk - Before merge, substantiate the changed TLS trust boundary by attaching the reported runtime trace showing a compromised-key peer rejected before application data exchange and an ordinary HTTPS peer accepted.

Findings

None.

Tests

• Missing end-to-end proof: Attach the reported official-runtime TLS trace showing compromised-chain rejection before application data exchange and successful ordinary HTTPS traffic; existing CI exercises tooling compatibility rather than that security scenario.

Agent review details

How this fits together

GitHub Actions installs Node for Linux site tests and the Windows repair smoke script; the selected runtime executes repository tooling rather than becoming part of the distributed Go application.

flowchart TD
  A[Pull request or main push] --> B[CI workflow]
  B --> C[Setup Node 26.12.1]
  C --> D[Linux site tests]
  C --> E[Windows repair smoke]
  C --> F[Node TLS verification]

Loading

Technical review

Best possible solution:

Keep the two exact runtime pins and substantiate their security behavior without expanding this PR into runner or deployed-product upgrades.

Do we have a high-confidence way to reproduce the issue?

Source establishes that main's broad selector can accept an older cached Node 26 patch; no runtime attack reproduction was performed during this read-only review.

Is this the best way to solve the issue?

The existing setup-node owner already supports exact patch selection, making these two value changes the smallest complete fix for selecting the patched tooling runtime.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 2abfcd4bd66d.

Merge-risk options

Maintainer options:

1. Attach the reported TLS verification evidence (recommended)
   Provide redacted terminal output or a linked artifact identifying the official Node 26.12.1 binary and showing compromised-chain rejection before application data exchange alongside a successful ordinary HTTPS control.

Provenance checked

• Node runtime selection for site and Windows repair tooling changes intended behavior with a stated reason (2f12824: chore(deps): refresh Marked and Node CI runtime #37 moved both jobs to the then-current stable Node 26 runtime.)

Testing

Proof path: unit tests only.

Security

Needs attention: No introduced security defect was identified, but the changed certificate trust boundary requires inspectable runtime evidence.

Evidence

What I checked:

• Verified introduced change: The pinned base-to-head diff changes only the two node-version values from 26 to 26.12.1; main retains both broad selectors. (.github/workflows/ci.yml:67, 1cac42624e01)
• Existing runtime direction: chore(deps): refresh Marked and Node CI runtime #37 deliberately moved both tooling jobs to Node 26; this PR preserves that release line while selecting its security patch. (.github/workflows/ci.yml:143, 2f128247bc47)
• Executed dependency and selection contract: The workflow executes this pinned action. Its official-build implementation checks the hosted tool cache before downloading, using the supplied version specification; its base implementation evaluates versions with semver, so an exact patch excludes older cached patches. (src/distributions/official_builds/official_builds.ts, 820762786026)
• Selected runtime security behavior: The workflow installs this runtime, making its TLS contract relevant. The official 26.12.1 release includes blocked-public-key rejection; the corresponding source checks certificate-chain SPKI hashes and records CERT_REVOKED. tls: reject chains containing blocked public keys nodejs/node#66871 explains the compromised intermediates and notes that pre-upgrade resumed sessions are not reverified. (src/crypto/crypto_context.cc, a2caddd20e4e)
• Validation and supplied proof: The CI run at https://github.com/openclaw/clawdex/actions/runs/39680963587 succeeded for the reviewed head, including site and Windows repair jobs. The complete PR body reports Linux arm64 rejection results but supplies no trace or linked artifact; both discussion comments contain review-status text only. (1cac42624e01)
• Feature history and policy inspection: History identifies Peter Steinberger's runtime refreshes, Vincent Koc's site-job addition, and Sebastien Tardif's Windows repair work. No root or applicable nested AGENTS.md, maintainer notes, or pr-simplify skill exists in the inspected checkout. Some older history blobs are unavailable locally, but the relevant runtime changes and current-main blame were readable. (.github/workflows/ci.yml:64, 2abfcd4bd66d)

Likely related people:

• Vincent Koc: Raw commit d5fddd6 adds .github/workflows/ci.yml:81 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: d5fddd68d9e2; files: .github/workflows/ci.yml)
• Sebastien Tardif: Raw commit 6779177 adds .github/workflows/ci.yml:151 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 6779177301d1; files: .github/workflows/ci.yml)

Labels

Label changes:

• add P2: This is a focused CI runtime security update; the diff does not establish an urgent failure of the shipped application.
• add merge-risk: 🚨 security-boundary: The runtime update changes certificate-chain acceptance, while the reported allowed and forbidden peer results lack inspectable final-effect evidence.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P2: This is a focused CI runtime security update; the diff does not establish an urgent failure of the shipped application.
• merge-risk: 🚨 security-boundary: The runtime update changes certificate-chain acceptance, while the reported allowed and forbidden peer results lack inspectable final-effect evidence.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Attach the reported Node 26.12.1 trace proving compromised-key rejection before application data exchange and successful ordinary HTTPS traffic.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 21, 2026, 5:55 PM ET / 21:55 UTC.