ci: retain matching Tab5 build symbols

[vincentkoc]

Problem

The normal Tab5 build produces an application ELF and linker map, but the firmware artifact does not retain them. Without the exact matching ELF, a captured crash cannot be reliably attributed using symbols from a later rebuild.

Stacked on #40. This adds diagnostic capability, not a crash fix.

Changes

• Retain the normal Tab5 application ELF and map in a separate artifact named with the example, target, compiled source SHA, run ID, and attempt.
• Require nonempty ELF, map, and firmware manifest before staging.
• Include SHA256 checksums and a byte-for-byte copy of the existing sanitized firmware manifest.
• Stage copies in runner-owned temporary storage without changing the container-owned build directory's permissions.
• Leave the SDK selector, application, panic configuration, build commands, permissions, and existing flash bundles unchanged.

Original Checks

• Eight local staging fixtures passed: complete inputs, missing/empty ELF, map, or manifest, and a read-only build directory. The fixtures execute the workflow shell and check output contents, checksums, and preservation of flash files.
• actionlint and git diff --check passed.
• The initial hosted run passed all five compilations but exposed a host/container directory-ownership error during symbol staging. The read-only-directory regression reproduced that failure and passes with staging moved to runner-owned storage.
• All five jobs passed in run 34188657538, attempt 1 at PR head 7655de8dcafeccf6fade022ac781c34dd81f904c, including Tab5 symbol staging and upload.
• Downloaded the Tab5 firmware and separate symbols once each. Both ZIP SHA256 values match GitHub's artifact digests; all 11 firmware and 3 symbol checksum entries passed. The four flash images retain offsets 0x2000, 0x8000, 0x10000, and 0x810000.
• The firmware/symbol manifests are byte-identical. Compiled test-merge source f9035f6d25235c6ea5c00919199e4fbda142c156 has the expected PR/base parents and the same tree as the PR head.
• The retained ELF's full SHA256 matches the application's embedded ELF SHA256: d1273c140762b51c4cba5cde1df7e927388402941d31bd9e510e9da76ba1cc2a.

Validation Limits

The manifest records SDK commit 362a1776ec212788fda95f75b733bfdde3a0c394, build revision v5.5.5-648-g362a1776ec2, and esptool 4.12.0. The SDK image remains a moving selector, not pristine ESP-IDF 5.5.5. These are symbols for this new build, not recovered symbols for an earlier image.

No firmware was flashed and no USB-JTAG capture was performed for this PR. This unpatched build is not the next hardware candidate; the separately scoped SPM compatibility change is tracked in #42.

Landing Preparation

Signed head 1d1c83af134b16824cbbeec940f834419c1e51ba retains the original
symbol commits and incorporates the reviewed predecessor
905aa25ebca4cbfeaf01541b2ef0452ac138205d. Its complete tree is exactly that
predecessor plus the original symbol-retention delta. No new build or
packaging behavior was introduced. All five builds passed in
exact-head CI run 34506028271;
the downloaded artifact evidence above identifies the earlier build, not
this prepared head.
Maintainer disposition on September 12, 2026: land this independently verified
symbol-retention change with a merge commit, retaining the original signed
objects. The existing artifact and exact-head CI evidence are accepted; this
does not qualify voice or add new hardware evidence.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 12, 2026, 1:12 AM ET / 05:12 UTC (Revision 7).

ClawSweeper review

What this changes

The CI workflow retains Tab5 debugging symbols and a linker map in a separate build-specific artifact with matching firmware metadata and checksums.

Merge readiness

✅ Ready for maintainer review

Ready for normal landing review: the change remains absent from main, the recorded artifact proof supports its purpose, and no actionable defect remains. The previous draft-state blocker is resolved.

Priority: P3
Reviewed head: 1d1c83af134b16824cbbeec940f834419c1e51ba

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, correct workflow addition with strong artifact-specific proof and no remaining actionable blocker.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (linked_artifact): The actual Tab5 CI staging/upload path succeeded, with recorded downloaded-artifact checks proving matching manifests, checksums, and embedded ELF identity. That evidence belongs to the earlier build; the unchanged workflow and successful current-head CI support the prepared head without implying hardware qualification.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): The actual Tab5 CI staging/upload path succeeded, with recorded downloaded-artifact checks proving matching manifests, checksums, and embedded ELF identity. That evidence belongs to the earlier build; the unchanged workflow and successful current-head CI support the prepared head without implying hardware qualification.
Evidence reviewed	8 items	Introduced workflow change: The pinned merge-base comparison contains only 32 added workflow lines. They validate three nonempty inputs, copy them into runner-owned temporary storage, generate checksums, and upload only for the Tab5 matrix entry. Still necessary on main: The current main workflow ends with the existing firmware upload and contains no symbol-retention steps. The package builder copies flash images and selected metadata, not ELF or linker-map files. The releases API returned no releases; no shipped implementation was established. Production packaging and security boundary: The existing packager rejects credential-bearing public firmware configuration and produces the manifest copied by this PR. The workflow retains contents:read permissions, uses its existing upload-artifact version, and introduces no download execution, credentials, or authorization changes.
Findings	None	None.
Security	None	None.

How this fits together

This repository builds firmware for ESP32 devices that connect to OpenClaw. Its CI packaging pipeline turns compiled Tab5 outputs into downloadable firmware and matching diagnostic artifacts for investigating crashes.

flowchart LR
  A[Tab5 source] --> B[ESP-IDF build]
  B --> C[Firmware bundle]
  B --> D[ELF and linker map]
  C --> E[Validate and copy matching metadata]
  D --> E
  E --> F[Checksummed symbols artifact]
  F --> G[Crash investigation]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Workflow scope	1 workflow, 32 added lines, 1 of 5 build jobs affected	The additional artifact handling is restricted to Tab5 and leaves application code and firmware packaging unchanged.

Technical review

Best possible solution:

Retain matching symbols alongside each Tab5 CI firmware build, preserving the existing flash bundle and the accepted merge-commit landing strategy.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a runtime bug reproduction: current main visibly omits symbol artifacts, and the hosted run demonstrates the requested retention behavior.

Is this the best way to solve the issue?

Yes. Copying the exact build outputs into a separate checksummed artifact is a narrow solution that avoids rebuilding symbols or altering flash bundles.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against ab90dc52cff4.

Labels

Label justifications:

• P3: This is a bounded diagnostic-artifact improvement without a runtime behavior change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The actual Tab5 CI staging/upload path succeeded, with recorded downloaded-artifact checks proving matching manifests, checksums, and embedded ELF identity. That evidence belongs to the earlier build; the unchanged workflow and successful current-head CI support the prepared head without implying hardware qualification.
• proof: sufficient: Contributor real behavior proof is sufficient. The actual Tab5 CI staging/upload path succeeded, with recorded downloaded-artifact checks proving matching manifests, checksums, and embedded ELF identity. That evidence belongs to the earlier build; the unchanged workflow and successful current-head CI support the prepared head without implying hardware qualification.

Evidence

What I checked:

• Introduced workflow change: The pinned merge-base comparison contains only 32 added workflow lines. They validate three nonempty inputs, copy them into runner-owned temporary storage, generate checksums, and upload only for the Tab5 matrix entry. (.github/workflows/ci.yml:110, 1d1c83af134b)
• Still necessary on main: The current main workflow ends with the existing firmware upload and contains no symbol-retention steps. The package builder copies flash images and selected metadata, not ELF or linker-map files. The releases API returned no releases; no shipped implementation was established. (.github/workflows/ci.yml:102, ab90dc52cff4)
• Production packaging and security boundary: The existing packager rejects credential-bearing public firmware configuration and produces the manifest copied by this PR. The workflow retains contents:read permissions, uses its existing upload-artifact version, and introduces no download execution, credentials, or authorization changes. (scripts/package_firmware.py:85, 1d1c83af134b)
• Real artifact-retention execution: GitHub confirms successful firmware upload, symbol staging, and symbol upload in the Tab5 job of https://github.com/openclaw/esp-openclaw-node/actions/runs/34188657538. The other four jobs correctly skipped symbol handling. (.github/workflows/ci.yml:110, 7655de8dcafe)
• Matching artifact proof: The captured PR body reports downloaded firmware and symbols with matching GitHub ZIP digests, 11 firmware and 3 symbol checksum entries passing, byte-identical manifests, and an ELF SHA256 matching the application's embedded ELF hash. The API independently confirms distinct firmware artifact 10041562380 and symbols artifact 10041563345 for compiled source f9035f6. This review inspected the recorded verification and API metadata, not the ZIP contents independently. (7655de8dcafe)
• Prepared head and review continuity: The workflow is unchanged from the previously demonstrated head. GitHub confirms successful CI run 34506028271 for the current head. The supplied timeline records ready_for_review after the prior review, and the captured MEMBER-authored body accepts the existing evidence and specifies landing with a merge commit preserving signed objects. (.github/workflows/ci.yml:110, 1d1c83af134b)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)
• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (6 earlier review cycles)

• reviewed 2026-09-08T04:39:33.593Z sha a56ffda :: needs maintainer review before merge. :: none
• reviewed 2026-09-08T04:59:04.913Z sha 7655de8 :: needs changes before merge. :: none
• reviewed 2026-09-08T05:28:49.252Z sha 7655de8 :: needs changes before merge. :: none
• reviewed 2026-09-10T17:08:50.233Z sha 1d1c83a :: needs changes before merge. :: none
• reviewed 2026-09-10T17:20:18.061Z sha 1d1c83a :: needs changes before merge. :: none
• reviewed 2026-09-12T04:56:50.159Z sha 1d1c83a :: needs changes before merge. :: none