Full release validation

Full Release Validation is the release umbrella. It is the single manual entrypoint for pre-release proof, but most work happens in child workflows so a failed box can be rerun without restarting the whole release.

Run it from a trusted workflow ref, normally main, and pass the release branch, tag, or full commit SHA as ref:

gh workflow run full-release-validation.yml \
  --ref main \
  -f ref=release/YYYY.M.D \
  -f provider=openai \
  -f mode=both \
  -f release_profile=stable

Child workflows use the trusted workflow ref for the harness and the input ref for the candidate under test. That keeps new validation logic available when validating an older release branch or tag.

Package Acceptance normally builds the candidate tarball from the resolved ref, including full-SHA runs dispatched with pnpm ci:full-release. After a beta publish, pass release_package_spec=remoteclaw@YYYY.M.D-beta.N to reuse the shipped npm package across release checks, Package Acceptance, cross-OS, release-path Docker, and package Telegram. Use package_acceptance_package_spec only when Package Acceptance should intentionally prove a different package. The Codex plugin live package lane follows the same state: published release_package_spec values derive codex_plugin_spec=npm:@remoteclaw/codex@<version>; SHA/artifact runs pack extensions/codex from the selected ref; and operators can set codex_plugin_spec directly for npm:, npm-pack:, or git: plugin sources. The lane grants the explicit Codex CLI install approval required by that plugin, then runs Codex CLI preflight and same-session OpenAI agent turns.

Top-level stages

Stage	Details
Target resolution	Job: `Resolve target ref` Child workflow: none Proves: resolves the release branch, tag, or full commit SHA and records selected inputs. Rerun: rerun the umbrella if this fails.
Vitest and normal CI	Job: `Run normal full CI` Child workflow: `CI` Proves: manual full CI graph against the target ref, including Linux Node lanes, bundled plugin shards, channel contracts, Node 22 compatibility, `check`, `check-additional`, build smoke, docs checks, Python skills, Windows, macOS, Control UI i18n, and Android via the umbrella. Rerun: `rerun_group=ci`.
Plugin prerelease	Job: `Run plugin prerelease validation` Child workflow: `Plugin Prerelease` Proves: release-only plugin static checks, agentic plugin coverage, full extension batch shards, and plugin prerelease Docker lanes. Rerun: `rerun_group=plugin-prerelease`.
Release checks	Job: `Run release/live/Docker/QA validation` Child workflow: `RemoteClaw Release Checks` Proves: install smoke, cross-OS package checks, live/E2E suites, Docker release-path chunks, Package Acceptance, QA Lab parity, live Matrix, and live Telegram. Rerun: `rerun_group=release-checks` or a narrower release-checks handle.
Package Telegram	Job: `Run package Telegram E2E` Child workflow: `NPM Telegram Beta E2E` Proves: artifact-backed Telegram package proof for `rerun_group=all` with `release_profile=full`, or published-package Telegram proof when `npm_telegram_package_spec` is set. Rerun: `rerun_group=npm-telegram` with `npm_telegram_package_spec`.
Umbrella verifier	Job: `Verify full validation` Child workflow: none Proves: re-checks recorded child run conclusions and appends slowest-job tables from child workflows. Rerun: rerun only this job after rerunning a failed child to green.

For ref=main and rerun_group=all, a newer umbrella supersedes an older one. When the parent is cancelled, its monitor cancels any child workflow it already dispatched. Release branch and tag validation runs do not cancel each other by default.

Release checks stages

RemoteClaw Release Checks is the largest child workflow. It resolves the target once and prepares a shared release-package-under-test artifact when package or Docker-facing stages need it.

Stage	Details
Release target	Job: `Resolve target ref` Backing workflow: none Tests: selected ref, optional expected SHA, profile, rerun group, and focused live suite filter. Rerun: `rerun_group=release-checks`.
Package artifact	Job: `Prepare release package artifact` Backing workflow: none Tests: packs or resolves one candidate tarball and uploads `release-package-under-test` for downstream package-facing checks. Rerun: the affected package, cross-OS, or live/E2E group.
Install smoke	Job: `Run install smoke` Backing workflow: `Install Smoke` Tests: full install path with root Dockerfile smoke image reuse, QR package install, root and gateway Docker smokes, installer Docker tests, Bun global install image-provider smoke, and fast bundled-plugin install/uninstall E2E. Rerun: `rerun_group=install-smoke`.
Cross-OS	Job: `cross_os_release_checks` Backing workflow: `RemoteClaw Cross-OS Release Checks (Reusable)` Tests: fresh and upgrade lanes on Linux, Windows, and macOS for the selected provider and mode, using the candidate tarball plus a baseline package. Rerun: `rerun_group=cross-os`.
Repo and live E2E	Job: `Run repo/live E2E validation` Backing workflow: `RemoteClaw Live And E2E Checks (Reusable)` Tests: repository E2E, live cache, OpenAI websocket streaming, native live provider and plugin shards, and Docker-backed live model/backend/gateway harnesses selected by `release_profile`. Rerun: `rerun_group=live-e2e`, optionally with `live_suite_filter`.
Docker release path	Job: `Run Docker release-path validation` Backing workflow: `RemoteClaw Live And E2E Checks (Reusable)` Tests: release-path Docker chunks against the shared package artifact. Rerun: `rerun_group=live-e2e`.
Package Acceptance	Job: `Run package acceptance` Backing workflow: `Package Acceptance` Tests: offline plugin package fixtures, plugin update, mock-OpenAI Telegram package acceptance, and published-upgrade survivor checks from every stable npm release at or after `2026.4.23` against the same tarball. Rerun: `rerun_group=package`.
QA parity	Job: `Run QA Lab parity lane` and `Run QA Lab parity report` Backing workflow: direct jobs Tests: candidate and baseline agentic parity packs, then the parity report. Rerun: `rerun_group=qa-parity` or `rerun_group=qa`.
QA live Matrix	Job: `Run QA Lab live Matrix lane` Backing workflow: direct job Tests: fast live Matrix QA profile in the `qa-live-shared` environment. Rerun: `rerun_group=qa-live` or `rerun_group=qa`.
QA live Telegram	Job: `Run QA Lab live Telegram lane` Backing workflow: direct job Tests: live Telegram QA with Convex CI credential leases. Rerun: `rerun_group=qa-live` or `rerun_group=qa`.
Release verifier	Job: `Verify release checks` Backing workflow: none Tests: required release-check jobs for the selected rerun group. Rerun: rerun after focused child jobs pass.

Docker release-path chunks

The Docker release-path stage runs these chunks when live_suite_filter is empty:

Chunk	Coverage
`core`	Core Docker release-path smoke lanes.
`package-update-openai`	OpenAI package install/update behavior, Codex on-demand install, Codex plugin live turns, and Chat Completions tool calls.
`package-update-anthropic`	Anthropic package install and update behavior.
`package-update-core`	Provider-neutral package and update behavior.
`plugins-runtime-plugins`	Plugin runtime lanes that exercise plugin behavior.
`plugins-runtime-services`	Service-backed and live plugin runtime lanes; includes OpenWebUI when requested.
`plugins-runtime-install-a` through `plugins-runtime-install-h`	Plugin install/runtime batches split for parallel release validation.

Use targeted docker_lanes=<lane[,lane]> on the reusable live/E2E workflow when only one Docker lane failed. The release artifacts include per-lane rerun commands with package artifact and image reuse inputs when available.

Release profiles

release_profile mostly controls live/provider breadth inside release checks. It does not remove normal full CI, Plugin Prerelease, install smoke, package acceptance, QA Lab, or Docker release-path chunks. full also makes the umbrella run package Telegram E2E against the release package artifact when rerun_group=all, so a full pre-publish candidate does not silently skip that Telegram package lane.

Profile	Intended use	Included live/provider coverage
`minimum`	Fastest release-critical smoke.	OpenAI/core live path, Docker live models for OpenAI, native gateway core, native OpenAI gateway profile, native OpenAI plugin, and Docker live gateway OpenAI.
`stable`	Default release approval profile.	`minimum` plus Anthropic, Google, MiniMax, backend, native live test harness, Docker live CLI backend, Docker ACP bind, Docker Codex harness, and an OpenCode Go smoke shard.
`full`	Broad advisory sweep.	`stable` plus advisory providers, plugin live shards, and media live shards.

Full-only additions

These suites are skipped by stable and included by full:

Area	Full-only coverage
Docker live models	OpenCode Go, OpenRouter, xAI, Z.ai, and Fireworks.
Docker live gateway	Advisory shard for DeepSeek, Fireworks, OpenCode Go, OpenRouter, xAI, and Z.ai.
Native gateway provider profiles	Fireworks, DeepSeek, full OpenCode Go model shards, OpenRouter, xAI, and Z.ai.
Native plugin live shards	Plugins A-K, L-N, O-Z other, Moonshot, and xAI.
Native media live shards	Audio, Google music, MiniMax music, and video groups A-D.

stable includes native-live-src-gateway-profiles-opencode-go-smoke; full uses the broader OpenCode Go model shards instead.

Focused reruns

Use rerun_group to avoid repeating unrelated release boxes:

Handle	Scope
`all`	All Full Release Validation stages.
`ci`	Manual full CI child only.
`plugin-prerelease`	Plugin Prerelease child only.
`release-checks`	All RemoteClaw Release Checks stages.
`install-smoke`	Install Smoke through release checks.
`cross-os`	Cross-OS release checks.
`live-e2e`	Repo/live E2E and Docker release-path validation.
`package`	Package Acceptance.
`qa`	QA parity plus QA live lanes.
`qa-parity`	QA parity lanes and report only.
`qa-live`	QA live Matrix and Telegram only.
`npm-telegram`	Published-package Telegram E2E; requires `npm_telegram_package_spec`.

Use live_suite_filter with rerun_group=live-e2e when one live suite failed. Valid filter ids are defined in the reusable live/E2E workflow, including docker-live-models, live-gateway-docker, live-gateway-anthropic-docker, live-gateway-google-docker, live-gateway-minimax-docker, live-gateway-advisory-docker, live-cli-backend-docker, live-acp-bind-docker, and live-codex-harness-docker.

Evidence to keep

Keep the Full Release Validation summary as the release-level index. It links child run ids and includes slowest-job tables. For failures, inspect the child workflow first, then rerun the smallest matching handle above.

Useful artifacts:

release-package-under-test from RemoteClaw Release Checks
Docker release-path artifacts under .artifacts/docker-tests/
Package Acceptance package-under-test and Docker acceptance artifacts
Cross-OS release-check artifacts for each OS and suite
QA parity, Matrix, and Telegram artifacts

Workflow files

.github/workflows/full-release-validation.yml
.github/workflows/remoteclaw-release-checks.yml
.github/workflows/remoteclaw-live-and-e2e-checks-reusable.yml
.github/workflows/plugin-prerelease.yml
.github/workflows/install-smoke.yml
.github/workflows/remoteclaw-cross-os-release-checks-reusable.yml
.github/workflows/package-acceptance.yml