[joshavant]

What Problem This Solves

CI can reuse an older cached patch when Node 22 or 24 is selected only by major version, leaving those checks outside the patched certificate-rejection runtime.

User Impact

CI now requests Node22.23.4 and24.22.1 on its existing Linux, macOS and Windows lanes. The Node25 compatibility lane and package runtime range remain unchanged. Node25 is a separate unresolved upstream hold; this change does not claim total CI-runtime remediation.

Why This Change Was Made

Pin the two supported patched release lines at the existing workflow acquisition owner. The release workflow already selects24.22.1.

Evidence

• Full pnpm run check on isolated Linux ARM64 with each exact Node version: format, build, typecheck, lint,58 router tests, tarball/import check pass on both.
• All workflows pass official actionlint1.7.12 with the repository runner configuration; git diff --check passes.
• Independent canonical P0–P2 autoreview: scoped-clean for the two-line change.
• Native macOS/Windows matrix results remain PR-CI evidence to collect; local Linux checks do not establish those platforms. No release or deployment was run.

Inspectable retained TLS evidence

The exact Linux ARM64 Node22.23.4 and24.22.1 executables each rejected all14 incident endpoints in built-in and explicit-old-CA modes (56 typed CERT_REVOKED results). Proper private-CA HTTPS succeeds; the fixture observed only its trusted request. Unknown issuer and wrong-hostname controls reject. Both versions accept a legitimate public HTTPS peer. The first Node22 harness returned a nonzero result because GitHub API returned HTTP403 after successful TLS instead of its expected HTTP200; the raw result is retained. A separately named public resource returns200 with the same exact Node22 ELF; incident probes were not repeated. Native macOS/Windows package CI now passes on this final head, but this Linux TLS proof does not establish their verifier modes. Node25 remains explicitly unresolved.

{
  "scope": "Actual exact official LinuxARM64 runtimes selected by source proof; native other-platform package CI is separate. No installed fleet claim.",
  "archiveSHA256": "b2e82ec0ce078c24307afeb45743da9c42e73d008def25e2349722d0c65e447f",
  "runtimes": [
    {
      "version": "v22.23.4",
      "platform": "linux",
      "arch": "arm64",
      "executableSHA256": "7e48183361053f039294fbbc3ba586722fe756bf296d6cb8195356d10819cd16",
      "incidentTypedCERT_REVOKED": 28,
      "modes": [
        "builtin",
        "explicit-old"
      ],
      "representative": [
        {
          "host": "dv-g3b-emudhra.we-have-a-problem.com",
          "mode": "builtin",
          "acceptedTLS": false,
          "errorCode": "CERT_REVOKED"
        },
        {
          "host": "dv-g3b-emudhra.we-have-a-problem.com",
          "mode": "explicit-old",
          "acceptedTLS": false,
          "errorCode": "CERT_REVOKED"
        }
      ],
      "controls": [
        {
          "label": "public",
          "explicitCA": false,
          "acceptedTLS": true,
          "status": 403
        },
        {
          "label": "private-trusted",
          "explicitCA": true,
          "acceptedTLS": true,
          "status": 200
        },
        {
          "label": "private-untrusted",
          "explicitCA": false,
          "acceptedTLS": false,
          "errorCode": "UNABLE_TO_VERIFY_LEAF_SIGNATURE"
        },
        {
          "label": "private-wrong-hostname",
          "explicitCA": true,
          "acceptedTLS": false,
          "errorCode": "ERR_TLS_CERT_ALTNAME_INVALID"
        }
      ],
      "ownedPrivateRequests": [
        "/trusted"
      ],
      "additionalPublicControl": {
        "url": "https://raw.githubusercontent.com/openclaw/ocm/v0.3.5/Cargo.toml",
        "acceptedTLS": true,
        "status": 200
      }
    },
    {
      "version": "v24.22.1",
      "platform": "linux",
      "arch": "arm64",
      "executableSHA256": "c8c5721679d8d1a09e9987e345d5f9a64899bb85f7a384783ba8a93e6e62348a",
      "incidentTypedCERT_REVOKED": 28,
      "modes": [
        "builtin",
        "explicit-old"
      ],
      "representative": [
        {
          "host": "dv-g3b-emudhra.we-have-a-problem.com",
          "mode": "builtin",
          "acceptedTLS": false,
          "errorCode": "CERT_REVOKED"
        },
        {
          "host": "dv-g3b-emudhra.we-have-a-problem.com",
          "mode": "explicit-old",
          "acceptedTLS": false,
          "errorCode": "CERT_REVOKED"
        }
      ],
      "controls": [
        {
          "label": "public",
          "explicitCA": false,
          "acceptedTLS": true,
          "status": 200
        },
        {
          "label": "private-trusted",
          "explicitCA": true,
          "acceptedTLS": true,
          "status": 200
        },
        {
          "label": "private-untrusted",
          "explicitCA": false,
          "acceptedTLS": false,
          "errorCode": "UNABLE_TO_VERIFY_LEAF_SIGNATURE"
        },
        {
          "label": "private-wrong-hostname",
          "explicitCA": true,
          "acceptedTLS": false,
          "errorCode": "ERR_TLS_CERT_ALTNAME_INVALID"
        }
      ],
      "ownedPrivateRequests": [
        "/trusted"
      ]
    }
  ]
}

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR pins the existing Node 22 and 24 CI lanes to 22.23.4 and 24.22.1 and records the change in the changelog.

Example: A CI runner has Node 22.18.0 cached when setting up the Node 22 lane.

• Before: The major-version selector can reuse that older cached runtime.
• After: The selector requires Node 22.23.4 before dependency installation and package checks.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A minimal, useful patch with scoped real-network TLS evidence, passing platform checks, and no actionable findings.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The supplied output connects exact official Node 22.23.4 and 24.22.1 Linux ARM64 executables to real HTTPS requests: compromised chains reject with CERT_REVOKED, valid public/private peers succeed, and unauthorized private controls produce no fixture request. Exact-head native CI independently confirms runtime acquisition and package compatibility across the existing platform matrix. This establishes the scoped runtime-pin change without claiming Node 25 remediation or native macOS/Windows TLS-mode qualification.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: CI can install dependencies and validate the package using an older cached Node patch that lacks compromised-certificate-key rejection.
Reason: The supplied maintainer context establishes direction, and the narrow change addresses the CI selection problem without changing consumer runtime requirements.

Merge readiness

✅ Ready for maintainer review

Keep this PR open for landing: the focused CI runtime fix is absent from main, supplied TLS evidence supports its stated scope, and review found no introduced defect.

Priority: P2
Reviewed head: a45ae4b1867c64c2890a982d34825f9552730cc9

Before merge

None.

Findings

None.

Agent review details

How this fits together

GitHub Actions selects Node through setup-node, then installs dependencies and runs package validation; this change controls that tooling runtime.

flowchart TD
  A[Pull request or main push] --> B[Node and operating system matrix]
  B --> C[Setup exact Node runtime]
  C --> D[Install frozen dependencies]
  D --> E[Run package checks]
  E --> F[Report CI results]

Loading

Technical review

Best possible solution:

Land the exact CI runtime pins through the existing setup-node owner while preserving Node 25 compatibility coverage.

Do we have a high-confidence way to reproduce the issue?

Main's major-only selectors reach setup-node's cache lookup with check-latest disabled, establishing how an older cached patch can be reused; this review did not execute a before-fix runtime.

Is this the best way to solve the issue?

Exact patch selection is the smallest complete fix at the existing acquisition owner and preserves package engines, platform coverage, action permissions, and the documented Node 25 contract.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against c21eaefa0ecd.

Provenance checked

• Node 22/24 CI version selection changes intended behavior with a stated reason (311db25: The package-check workflow introduced cross-platform Node 22/24 coverage using major selectors; the PR explains why exact security-patch selection is now needed.)
• Node 25 compatibility coverage keeps the original intent (01c7a1b: The additional lane detects development-tool engine incompatibilities within the declared Node range.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Verified introduced change: The pinned introduction diff changes only the two Node selectors and adds a changelog entry; fetched main still selects majors 22 and 24. (.github/workflows/ci.yml:39, a45ae4b1867c)
• Scoped live TLS evidence: The full PR body supplies exact Linux ARM64 executable hashes, 56 reported CERT_REVOKED results across built-in and explicit-old-CA modes, successful public/private controls, issuer and hostname rejection, and a private fixture receiving only /trusted. The initial Node 22 HTTP 403 followed successful TLS; a separate public control returned 200. The contributor's discussion explicitly limits this evidence to Linux ARM64: fix(ci): pin patched Node 22 and 24 checks #71 (comment). (a45ae4b1867c)
• Exact-head platform validation: All seven Node/platform package jobs and workflow lint passed on the reviewed head, including both exact versions on Linux, macOS, and Windows: https://github.com/openclaw/uirouter/actions/runs/40021455376. These checks establish package compatibility, separately from the TLS diagnostics. (.github/workflows/ci.yml:31, a45ae4b1867c)
• Authoritative version-selection contract: The target workflow executes this pinned action. Its check-latest input defaults to false, and its distribution implementation searches the hosted tool cache with the requested version specification before downloading; exact pins therefore exclude older cached patches. (src/distributions/base-distribution.ts, 949feb2413d6)
• Authoritative TLS runtime contract: The workflow installs and executes Node, making its TLS implementation directly relevant. The Node 22.23.4 release notes and Node 24.22.1 release notes include compromised-public-key rejection. Reviewed upstream source reports blocked chains through CERT_REVOKED in certificate verification. (src/crypto/crypto_context.cc, 01acf0ee7493)
• Existing scope and related work: Merged fix(release): use Node patch that rejects compromised CA keys #69 pins release tooling only; it does not implement these CI selectors. The Node 25 compatibility contract established by build(deps): refresh Node types and cover Node 25 installs #52 and preserved by fix(deps): preserve Node 25 toolchain compatibility #68 remains intact. (.github/workflows/ci.yml:45, c21eaefa0ecd)

Likely related people:

• Peter Steinberger: Raw commit 01c7a1b adds .github/workflows/ci.yml:46 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 01c7a1b96886; files: .github/workflows/ci.yml)
• Shakker: Raw commit 311db25 adds .github/workflows/ci.yml:35 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 311db251bf4d; files: .github/workflows/ci.yml)
• Josh Avant: Raw commit 33ea5f3 adds CHANGELOG.md:7 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 33ea5f3e1c21; files: CHANGELOG.md)

Labels

Label changes:

No label changes.

Label justifications:

• P2: This is a focused CI runtime-security improvement without demonstrated active exploitation or a broken consumer workflow.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• proof: sufficient: Contributor real behavior proof is sufficient.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (2 earlier review cycles)

• reviewed 2026-10-23T20:56:44.405Z sha a45ae4b :: needs real behavior proof before merge. :: none
• reviewed 2026-10-23T21:47:26.987Z sha a45ae4b :: needs maintainer review before merge. :: none

Reviewed October 23, 2026, 5:51 PM ET / 21:51 UTC (Revision 3).

[joshavant]

@clawsweeper re-review

The body now includes exact-artifact native Node22/24 TLS diagnostics: 56 typed incident-chain rejections, trusted public/private controls, issuer/hostname negatives, and the retained initial public-HTTP403 harness result. Native-platform package CI passed; Node25 and other-platform TLS modes remain explicit gaps.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The item is closed; no stale verdict was published.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/40452163435
• Updated: 2026-10-27T04:53:11.897Z