Skip to content

fix(openclaw): fail fast on a host/image oc version skew - #40

Merged
isadominguez314 merged 2 commits into
pradeepvrd:integrationfrom
isadominguez314:fix/openclaw-version-skew
Sep 15, 2026
Merged

isadominguez314 merged 2 commits into
pradeepvrd:integrationfrom
isadominguez314:fix/openclaw-version-skew

Conversation

@isadominguez314

Copy link
Copy Markdown
Collaborator

Guards against the failure mode from the first #32 validation run: host oc 2026.8.2 could not read the session store the image's oc 2026.9.1-beta.1 had written (…written by version 2026.9.1-beta.1, but this command is running 2026.8.2), so the post-run trajectory export failed and the run published trajectory: [], errors: 1, status: "success" — a full cluster spin-up spent producing nothing gradable, discovered only at scoring time.

What changed

Two cached version probes (mirroring claude_code/agent.py's _claude_version pattern and philosophy) plus a guard at the top of _execute:

  • _host_oc_version(oc_bin) — parses oc --version from the host binary.
  • _image_oc_version(image) — parses it from the sandbox image via a short-lived docker run --rm --entrypoint oc <image> --version (generous timeout for a cold pull; cached per image, so once per matrix run).
  • On a sandboxed run, a mismatch returns AgentResult.errored(...) naming both versions and the fix, before the agent turn launches — failing in seconds instead of after the run.

Deliberate choices:

  • Equality, not an ordering. Prerelease suffixes (-beta.1) make "host is newer, probably fine" a guess, and the two binaries are meant to be pinned together anyway (the pin-unification follow-up tracks collapsing the bastion's three version pins into one).
  • An inconclusive probe never blocks. config.target may be a wrapper without a --version surface, docker may be unavailable to the probing process — refusing to run on a probe that merely failed would be worse than the risk it guards. Same rule the claude_code probe follows.
  • Unsandboxed runs skip the probe entirely — there's no second binary to compare against.

Validation

uv run pytest tests/unit → 1858 passed (6 new: prerelease parsing, inconclusive-probe behavior, skew message content, match/inconclusive silence, the fail-fast path asserting the agent turn never launches, and the unsandboxed skip); ruff check + format clean.

🤖 Generated with Claude Code

On a sandboxed run the container's oc writes the session store and the
host's oc reads it back post-run. oc refuses a store written by a
different version ('written by version 2026.9.1-beta.1, but this
command is running 2026.8.2'), which surfaced live as an empty
trajectory on a record stamped status success -- a full cluster
spin-up spent producing nothing gradable, discovered only at scoring.

Probe both versions at the top of _execute (cached, mirroring the
claude_code version probe) and error out before the agent turn when
they differ. Equality rather than an ordering: prerelease suffixes
make 'newer' a guess, and the two binaries are meant to be pinned
together anyway. An inconclusive probe (wrapper script, docker
unavailable) never blocks the run; unsandboxed runs skip the probe
entirely -- there is no second binary to compare against.
…version-skew

# Conflicts:
#	devops_bench/agents/cli/openclaw/agent.py
#	tests/unit/agents/test_agents_cli_openclaw.py
@isadominguez314
isadominguez314 merged commit 6bb7c66 into pradeepvrd:integration Sep 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant