test(openclaw): remove dependency review prose contracts

[jyaunches]

Outcome

Removes dependency-review prose assertions from the OpenClaw integration suite. Security and compatibility behavior remains covered through the archive, build-argument, remediation, lock, and image boundaries that own it.

Reason

PR #10892's test-design review identified assertions that treated explanatory Markdown as an executable contract. Those checks could fail after an accurate rewrite without detecting a product regression.

Related issues

Relates to #10892.

Changes

• Remove five tests that search dependency-review notes and troubleshooting prose for literal phrases.
• Remove the unused review-note paths.
• Keep the existing behavior checks for reviewed archive invariants, build-argument rejection, and rebuild-resume compatibility.

Verification

• npx vitest run --project integration test/agents/openclaw/openclaw-dependency-review.test.ts — 10 tests passed.
• npm run source-shape:check — passed with zero detected source-shape cases.
• npm run checks:repository — passed.
• Commit and push hooks — passed, including formatting, lint, repository checks, growth guardrails, secret scanning, commitlint, and CLI TypeScript checks.
• git diff --check — passed.
• GitHub commit verification — commit 87baa1c7a8c28f992849173281bc980a6acb63d6 is Verified.
• Diff review — no secrets, API keys, or credentials added.

Review notes

This is a test-only reduction. It changes no production code or security control. The behavior-focused security tests named above remain in place.

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

• Tests
  • Removed obsolete automated checks for retired dependency-review scenarios, the OpenClaw contract suite, and messaging plugin provenance.
  • Retained coverage for shared archive integrity and rebuild-resume compatibility.
  • No changes were made to exported or public functionality.
  • No user-facing functionality or behavior changes are included in this update.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 66d22584-2e94-4f3c-b79e-573218d6b9ad

📥 Commits

Reviewing files that changed from the base of the PR and between b08eaa0 and e6f84ee.

📒 Files selected for processing (1)

• test/agents/openclaw/openclaw-dependency-review.test.ts

💤 Files with no reviewable changes (1)

• test/agents/openclaw/openclaw-dependency-review.test.ts

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

Removed obsolete OpenClaw dependency-review path constants, contract tests, and messaging plugin provenance assertions. Shared archive invariants and rebuild-resume compatibility tests remain.

Changes

OpenClaw test cleanup

Layer / File(s)	Summary
Remove obsolete dependency-review coverage test/agents/openclaw/openclaw-dependency-review.test.ts	Removed obsolete path constants, OpenClaw 2026.6.10 dependency-review contract tests, and messaging plugin provenance assertions. Retained shared archive invariant and rebuild-resume compatibility tests.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 82d19

This change removes obsolete OpenClaw dependency-review test coverage while retaining the stated archive, build, remediation, lock, and image-boundary checks. No current merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: removing dependency-review prose contracts from the OpenClaw tests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test/remove-review-prose-contracts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit 82d1981 in the test/remove-review-p... branch remains at 96%, unchanged from commit ee8b43f in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit 82d1981 in the test/remove-review-p... branch remains at 83%, unchanged from commit ee8b43f in the main branch.

Show a line coverage summary of the most impacted files.

File	main ee8b43f	test/remove-review-p... 82d1981	+/-
src/lib/onboard...able-receipt.ts	82%	70%	-12%
src/lib/inferen...ocal-runtime.ts	97%	87%	-10%
src/lib/onboard...ble-contract.ts	91%	83%	-8%
src/lib/agent/s...store-reader.ts	90%	83%	-7%
src/lib/state/o...box-recovery.ts	95%	88%	-7%
src/lib/onboard...le-container.ts	89%	83%	-6%
src/lib/onboard...-transaction.ts	69%	70%	+1%
src/lib/onboard...ed-lifecycle.ts	75%	77%	+2%
src/lib/onboard...on-authority.ts	81%	88%	+7%
src/lib/onboard...w-auto-apply.ts	73%	86%	+13%

---

_{Updated September 03, 2026 18:28 UTC}

[github-actions]

PR Review Advisor finished for commit ce8ee88. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

All previous runs

[cjagwani]

review of ce8ee88d50cd845a73a319e1e8c50bcec4f6b722.

P0

• None.

P1

• None.

The deleted assertions are prose/source-shape contracts; executable owners remain for npm provenance and remediation, Jaeger, MCP retry/diagnostics/timeout, device authorization/state, messaging provenance, workflow guards, and build-argument validation. Focused validation passed 10/10 tests, and the sibling behavior suites passed 122 tests with one expected skip. Both commits are verified.

I am not approving this SHA: required test-e2e-sandbox is failing, the branch is behind current main (b08eaa0844dc2e972fbfa2806590668802d449b4), and there is no CodeRabbit review object. I will re-review after the branch and gates refresh.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.