Fix apply workflow sync before state hydration

[clawsweeper]

Makes #271 merge-ready for the ClawSweeper automerge loop.
The edit pass should inspect the live PR diff, review comments, and failing checks; rebase if needed; keep the contributor branch credited; and stop only when validation is green or an external blocker is proven.

ClawSweeper 🐠 replacement reef notes:

• Cluster: automerge-openclaw-clawsweeper-271
• Source PRs: Fix apply workflow sync before state hydration #271
• Credit: Source PR: Fix apply workflow sync before state hydration #271
• Validation: pnpm check:changed
• Replacement reason: ClawSweeper could not update the source PR branch directly, so it opened a writable replacement PR instead.
• Automerge requested by: @Takhoffman

• Repair fallback: GitHub rejected the repair branch push because it updates workflow files and the ClawSweeper app token does not have workflows permission

Inherited issue-closing references from the source PR:
Fixes #270

Co-author credit kept:

• @brokemac79: Co-authored-by: brokemac79 255583030+brokemac79@users.noreply.github.com

fish notes: reasoning high; reviewed against 7a6eca8.

[clawsweeper]

Codex review: passed. Reviewed June 13, 2026, 4:49 PM ET / 20:49 UTC.

Summary
This PR moves the apply-existing git pull --rebase before state hydration, removes the post-hydration pull, adds ordering coverage, and disables steerable Codex in one repair-worker test.

Reproducibility: yes. at source level: current main hydrates generated state into the checkout and then runs git pull --rebase before reconcile. I did not run a live scheduled apply job in this read-only review.

Review metrics: 2 noteworthy metrics.

• Automation surface: 1 workflow changed. The diff changes scheduled apply-existing ordering around checkout sync, state hydration, setup, and reconcile.
• Regression coverage: 1 test added, 1 test isolated. The new coverage pins the apply ordering, and the repair-worker test now ignores ambient steerable-Codex configuration.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Risk before merge

• [P1] This changes the scheduled close-apply GitHub Actions path; the source PR proof is positive, but a live scheduled/main runner remains the highest-fidelity environment for app-token and checkout timing behavior.

Maintainer options:

1. Merge after required checks (recommended)
   If pnpm check and CodeQL stay green, maintainers can accept the remaining live-runner uncertainty because the source PR proof exercised sync, hydration, and reconcile on a fresh setup.
2. Ask for live apply-lane proof
   If maintainers want higher fidelity, request a redacted Actions log or dry-run artifact showing the same apply-existing ordering on a runner before merge.

Next step before merge

• [P2] No repair lane work is needed; automerge/check gating and maintainer acceptance of the workflow-ordering risk are the remaining path.

Security
Cleared: No concrete security or supply-chain regression found; the workflow change reorders an existing pull and does not add permissions, actions, dependencies, or secret exposure.

Review details

Best possible solution:

Merge the replacement after required checks and mergeability pass, preserving the sync-before-hydration ordering and focused regression coverage.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level: current main hydrates generated state into the checkout and then runs git pull --rebase before reconcile. I did not run a live scheduled apply job in this read-only review.

Is this the best way to solve the issue?

Yes. Moving the existing pull before setup-state is the narrow maintainable fix for the dirty-worktree rebase failure, and the PR adds focused ordering coverage.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 0c3e8876ae04.

Label changes

Label changes:

• add P1: The PR targets a scheduled close-apply workflow failure that can block real apply runs before reconcile and apply work begin.
• add merge-risk: 🚨 automation: The diff changes GitHub Actions automation behavior in the close-apply lane rather than ordinary application logic.
• add proof: sufficient: Contributor real behavior proof is sufficient. The linked source PR includes redacted terminal proof from a fresh clone/state checkout showing sync before hydration, successful hydration, and completed reconcile for the same workflow fix.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• add status: 🚀 automerge armed: This PR is in ClawSweeper's automerge lane. Sufficient (terminal): The linked source PR includes redacted terminal proof from a fresh clone/state checkout showing sync before hydration, successful hydration, and completed reconcile for the same workflow fix.

Label justifications:

• P1: The PR targets a scheduled close-apply workflow failure that can block real apply runs before reconcile and apply work begin.
• merge-risk: 🚨 automation: The diff changes GitHub Actions automation behavior in the close-apply lane rather than ordinary application logic.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 🚀 automerge armed: This PR is in ClawSweeper's automerge lane. Sufficient (terminal): The linked source PR includes redacted terminal proof from a fresh clone/state checkout showing sync before hydration, successful hydration, and completed reconcile for the same workflow fix.
• proof: sufficient: Contributor real behavior proof is sufficient. The linked source PR includes redacted terminal proof from a fresh clone/state checkout showing sync before hydration, successful hydration, and completed reconcile for the same workflow fix.

Evidence reviewed

What I checked:

• Repository policy read: Read the full target AGENTS.md; its conservative apply-lane workflow guidance and read-only review rules shaped this review. (AGENTS.md:1, 0c3e8876ae04)
• Current main still has the reported ordering: Current main runs setup-state and setup-pnpm before Sync before applying decisions, leaving the pull after state hydration and before reconcile. (.github/workflows/sweep.yml:1980, 0c3e8876ae04)
• Hydration can mutate generated paths: The hydrator removes and copies generated paths such as records, assets, and apply reports into the worktree, matching the dirty-worktree failure mechanism. (scripts/hydrate-state.ts:35, 0c3e8876ae04)
• PR workflow order fixes the central issue: At the PR head, Sync source checkout before state hydration runs before token setup and setup-state, and no post-hydration pull remains before reconcile. (.github/workflows/sweep.yml:1960, 7a6eca87ead4)
• Regression coverage added: The PR adds a workflow-ordering test that asserts sync occurs before setup-state and that no git pull --rebase remains between setup-state and reconcile. (test/clawsweeper.test.ts:17544, 7a6eca87ead4)
• Repair-worker test isolation added: The replacement head also sets CLAWSWEEPER_STEERABLE_CODEX=0 in a repair-worker test so ambient steerable-Codex configuration does not change the fake Codex path. (test/repair/run-worker.test.ts:97, 7a6eca87ead4)

Likely related people:

• Peter Steinberger: Current blame and history show the apply-existing workflow, setup-state/hydrate-state files, and steerable-Codex environment behavior were introduced or recently maintained in this area by this author. (role: introduced behavior and recent area contributor; confidence: high; commits: 7ad3bd8f972e, ec54a3444717, 86d0ca37755b; files: .github/workflows/sweep.yml, .github/actions/setup-state/action.yml, scripts/hydrate-state.ts)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[clawsweeper]

🦞✅
ClawSweeper merged this PR after the passing review.

Source: clawsweeper[bot]
Feedback: structured ClawSweeper verdict: pass (sha=7a6eca87ead48eb162c408c201eff99cb8b6f5b2)
Merge status: merged by ClawSweeper automerge
Merged at: 2026-06-13T20:50:22Z
Merge commit: b20c00c7bffd

What merged:

• This PR moves the apply-existing git pull --rebase before state hydration, removes the post-hydration pull, adds ordering coverage, and disables steerable Codex in one repair-worker test.
• Reproducibility: yes. at source level: current main hydrates generated state into the checkout and then runs git pull --rebase before reconcile. I did not run a live scheduled apply job in this read-only review.

Automerge notes:

• PR branch already contained follow-up commit before automerge: Trigger CI for apply sync PR
• PR branch already contained follow-up commit before automerge: Fix apply workflow sync before state hydration

The automerge loop is complete.

Automerge progress:

• 2026-06-13 20:50:13 UTC review passed 7a6eca87ead4 (structured ClawSweeper verdict: pass (sha=7a6eca87ead48eb162c408c201eff99cb8b6f...)

• 2026-06-13 20:50:23 UTC merged 7a6eca87ead4 (merged by ClawSweeper automerge)