chore: remove obsolete OCM-98 reproduction tools

[shakkernerd]

What Problem This Solves

The standalone OCM-98 reproduction workflow was removed in #235, but its incident-specific shell script and SQLite metadata helper remained in the repository.
The reproducer requires a legacy OCM v0.2.32 binary and fixed OpenClaw beta fixtures, and neither tool is used by the current runtime, CI, release, packaging, or documented development workflow.
Keeping these obsolete entry points alongside maintained tooling leaves an unnecessary historical workflow in the source tree.

User Impact

This removes scripts/reproduce-ocm-98.sh and scripts/ocm-98-db-meta.mjs together.
The historical investigation remains available in Git history.
OCM's runtime-install behavior, caller-state isolation, npm configuration handling, and normal test workflow remain unchanged.

The runtime-isolation fix from #131 stays in src/store/runtimes.rs, together with the active regression tests and their support probes.
README and CONTRIBUTING guidance, normal CI, and all release, signing, installer, and npm tooling are preserved.

Why This Change Was Made

The database helper is used only by the obsolete reproducer, so deleting the pair removes the complete unused tooling without leaving another orphaned helper.
Current source and discovery paths have no other caller for either file.
The actual protection against the original regression belongs to the runtime implementation and its ordinary tests, which do not depend on these historical tools.

Evidence

The static preflight verified an exact two-file deletion: every remaining tracked object and mode matches the current base, and no retained source reference points to either removed file.
Independent review also checked indirect discovery, explicit release fixture lists, and native/npm package contents and found no dependency on the pair.

The preserved official_runtime_install_isolates_npm_lifecycle_from_caller_openclaw_state test covers caller state and service-path isolation through host and managed npm paths.
The preserved official_runtime_install_preserves_real_npm_configuration test covers script policy and normal or explicit npm configuration.
Both remain in the existing Linux/macOS cargo test --locked CI path.
The obsolete reproducer and legacy binaries were not executed, and no local Rust build or dependency installation was needed for this deletion-only check.
CI run 35086808704 passed all nine jobs for commit 4a4a508, including both complete test suites and cargo install smoke checks.
All four CodeQL analysis jobs passed.
The completed automated review records Platinum (4/6) with no findings for the same commit.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 16, 2026, 6:49 AM ET / 10:49 UTC.

ClawSweeper review

What this changes

Removes the historical runtime-install reproduction script and its SQLite metadata helper while preserving runtime behavior and regression tests.

Merge readiness

✅ Ready for maintainer review

This is a focused, useful cleanup with no actionable defects found. The tools remain on main and in the latest release, so the removal is still necessary; the earlier workflow deletion did not complete this work.

Priority: P3
Reviewed head: 4a4a5082888944025762476fa1e04e040f19fc38

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused cleanup supported by consistent static evidence, with no concrete correctness or security findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: This member-authored cleanup has no runtime behavior change; static inspection confirms the historical tools are removed without altering installation code or its maintained tests.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This member-authored cleanup has no runtime behavior change; static inspection confirms the historical tools are removed without altering installation code or its maintained tests.
Evidence reviewed	8 items	Exact introduced scope: The pinned base-to-head comparison contains only two deletions totaling 344 lines; retained implementation, tests, workflows, dependencies, and packaging files are unchanged. No retained callers: The complete tracked-tree search returned no remaining references to the incident identifier, reproducer name, or metadata-helper name. No nested AGENTS.md or maintainer-note files were found. Runtime isolation remains intact: The retained helper redirects OpenClaw lifecycle paths into disposable state and removes inherited service and active-environment selectors. Both package and companion installation still invoke it and clean up afterward.
Findings	None	None.
Security	None	None.

How this fits together

OCM installs OpenClaw runtimes while isolating package installation scripts from the caller’s state. These historical tools compared legacy and fixed installers; ordinary runtime tests now maintain the regression coverage.

flowchart LR
  A[Legacy and current installers] --> B[Historical reproduction tools removed]
  B --> C[Historical comparison reports]
  D[Runtime installation code] --> E[Retained isolation regression tests]
  E --> F[Normal Linux and macOS CI]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Cleanup scope	2 tools removed; 344 lines deleted; 0 retained files changed	The complete removal leaves production behavior and maintained regression coverage unchanged.

Technical review

Best possible solution:

Keep runtime-isolation protection in the maintained implementation and ordinary tests, with historical reproduction tooling recoverable from Git history.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is deletion-only maintenance, and static inspection establishes the unused-tool boundary without rerunning the historical incident.

Is this the best way to solve the issue?

Yes. Removing the reproducer and its sole helper together is a narrow cleanup that preserves the actual repair and independent regression coverage.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against a898020dccc9.

Labels

Label changes:

• add P3: This removes unused historical tooling without changing supported runtime or installation behavior.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This member-authored cleanup has no runtime behavior change; static inspection confirms the historical tools are removed without altering installation code or its maintained tests.

Label justifications:

• P3: This removes unused historical tooling without changing supported runtime or installation behavior.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This member-authored cleanup has no runtime behavior change; static inspection confirms the historical tools are removed without altering installation code or its maintained tests.

Evidence

What I checked:

• Exact introduced scope: The pinned base-to-head comparison contains only two deletions totaling 344 lines; retained implementation, tests, workflows, dependencies, and packaging files are unchanged. (4a4a50828889)
• No retained callers: The complete tracked-tree search returned no remaining references to the incident identifier, reproducer name, or metadata-helper name. No nested AGENTS.md or maintainer-note files were found. (4a4a50828889)
• Runtime isolation remains intact: The retained helper redirects OpenClaw lifecycle paths into disposable state and removes inherited service and active-environment selectors. Both package and companion installation still invoke it and clean up afterward. (src/store/runtimes.rs:922, 4a4a50828889)
• Independent regression coverage: Retained tests check caller database, configuration, and service-state preservation through host and managed npm paths, plus real npm script-policy and configuration handling. Normal Linux/macOS CI runs cargo test --locked. These tests were inspected, not executed during this read-only review. (tests/runtime_command_tests.rs:2149, 4a4a50828889)
• Packaging and discovery boundaries: Native archives explicitly contain only the binary, LICENSE, and README. npm packages use explicit file maps, release fixtures copy named scripts, and CI discovers Python tests only under scripts/tests; none depends on the removed pair. (scripts/package-release.sh:100, 4a4a50828889)
• Main and release still contain the tools: Both scripts have identical blob identities on pinned main and the supplied latest-release commit for v0.2.47. The proposed removal is not already implemented there. (a898020dccc9)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)
• shakkernerd: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore: remove obsolete OCM-98 reproduction tools This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

[shakkernerd]

Simplified: OCM's source tree no longer includes the obsolete OCM-98 reproduction tools.