Remote PR gates

Use PR CI for broad proof and focused local checks for trusted work. Use a box only for what CI and the local machine cannot cover (another OS or device, live providers/channels, long E2E, or heavy benchmarks), and only when granted immediately. If it queues, run locally instead; never wait on a box queue or chain Testbox → AWS → Hetzner fallbacks. Keep untrusted code in secretless isolation, live credentials scoped, and Gateway/state isolated. Do not rerun or re-push just for green; read CI failure classification before attributing a red.

Testbox command checkout

• .github/actions/prepare-testbox-shell owns the Testbox shell/working-directory contract. Noninteractive login shells preserve the caller-selected directory; hydration adapts only the known Blacksmith interactive-SSH auto-cd and probes exact physical cwd before ready registration. Do not force nested shells into GITHUB_WORKSPACE or the transport checkout.
• Raw Crabbox payloads start in the synchronized transport checkout. crabbox-wrapper.mjs instead verifies/applies its source capsule and reconciles dependencies in the prepared execution workspace before running the payload. Preserve that intentional receiver handoff; its pathname alone does not identify stale source. Verify selected source bytes/patch as well as directory, and stop/re-warm leases when preparation changes.

Optional remote gate modes

• OPENCLAW_PR_GATES_REMOTE=testbox runs ordered pnpm build, pnpm check --base <captured-fork-base>, and full-suite pnpm test gates in one isolated Blacksmith Testbox source capsule through scripts/crabbox-wrapper.mjs (same delegation as check:changed). The capsule owns dependency installation; no package gate runs in the local prep checkout. Docs-only changes still skip pnpm test. The tbx_ lease id and Actions run URL land in .local/gates.env (REMOTE_GATES_*) and .local/prep.md. Use it only for proof that CI and the local machine cannot cover, with a box granted immediately; if it queues, run locally instead. Never chain Testbox, AWS, and Hetzner fallbacks; contributor/fork code stays on secretless CI or sanitized AWS unless a maintainer explicitly approves credentialed execution. Explicit OPENCLAW_TEST_PROJECTS_PARALLEL and OPENCLAW_VITEST_MAX_WORKERS values are validated as positive integers and forwarded to the remote test command. Empty values preserve the remote scheduler defaults; other caller environment variables are not forwarded by this adapter.
• OPENCLAW_PR_GATES_REMOTE=crabbox-aws is an explicit active-org-admin mode, never a queue fallback or the default. prepare-gates records a pending handle; after prepare-push proves the exact remote head, scripts/pr-lib/ci-dispatch.mjs --backend crabbox synchronously dispatches the protected-main publisher and waits for its exact-head check. That trusted workflow checksum-installs released Crabbox v0.46, resolves its /v1/whoami service principal, and creates sanitized direct AWS proof under the same token with umask 022, trusted scripts/crabbox-untrusted-bootstrap.sh, pnpm build, pnpm check, and the fail-closed PR-derived test plan from the repository's changed-test owner. Every executable changed path must independently resolve to concrete matched test files; broad fallback, partial plans, deleted executable paths, and unmatched/config targets are refused. Only explicit docs and AGENTS.md/CLAUDE.md instruction surfaces may produce zero tests. The canonical broker command binds the exact PR base, head, bootstrap hash, and plan digest. The publisher requires the PR base to be the merge base of its immutable workflow SHA and proves that each protected-main snapshot is identical to or descended from that workflow SHA, with an unchanged reread around each comparison. Main may advance during the long remote run, but not inside either publisher validation window. It validates its newly created immutable broker run, ordered complete events, exact broker-resolved owner/org correlation between /v1/whoami and the run, canonical bootstrap hash, exact command/base/head/plan, active admin actor, and open same-repository PR target before GitHub Actions adds the workflow SHA to the strict summary and publishes the distinct openclaw/crabbox-gate; draft rejection remains a merge-time rule. Only after that success does .local/gates.env record provider/run/lease/URL recovery metadata from the trusted check. Retained logs are checked when present but are optional because released v0.46 can retain zero log bytes for a successful run. Normal openclaw/ci-gate semantics stay unchanged. Native merge may add --admin only when the exact Crabbox check is successful from GitHub Actions, its immutable workflow SHA is an ancestor of the final protected-main snapshot, which must also descend from the first merge-validation main read, the actor is still an active organization admin, and the sole unsatisfied required check is a normal CI gate with GitHub-owned workflow startup_failure or a recognized hosted, unacquired, zero-step failure/timed_out job; cancellation, action-required, stale, an assigned runner, job log text, and any failed or executed workflow step never authorize bypass. The proof base stays bound to REMOTE_GATES_BASE_SHA; the live PR base may advance only with forward ancestry to the first main read. The flow repeats this verification immediately before the pinned-head merge request. Any newer main returned by that check discards its authority decision, verifies the candidate tree and settles projections, then repeats full authority verification within the shared three-round admin limit. Active organization membership is the final live authority read, with no fetch or settlement afterward; GitHub has no expected-base-OID merge precondition, so the Crabbox path compares the landed squash parent with the original admission main snapshot in .local/merge-crabbox-parent-audit.json and reports a match or intervening main movement after the completed merge. Normal merge paths do not perform this audit.

An interrupted protected Crabbox preparation resumes with scripts/pr prepare-push <PR> --resume-crabbox-run <Actions run ID> after the existing exact-token lock recovery, when required. This observes one pinned publisher attempt; it never refreshes, pushes, or dispatches another proof. Pending dispatch intent and selected run/controller/attempt stay in gates.env until the trusted exact-head check succeeds. An accepted dispatch without a recorded run requires explicit run selection; ordinary prepare-push refuses to redispatch. Legacy pending preparations use the retained review base and fail if the publisher proof does not match; current main is never substituted. Pre-change completed stamps additionally require their retained broker run and lease to match the trusted check. Their missing controller/attempt is pinned from the selected Actions run, not treated as historical receipt evidence. A retained base mismatch requires investigation of the original dispatch; resume refuses without changing the receipt or substituting today's main or the check's base.