Add OpenClaw to the fast ring, following the npm registry

[spencerbull]

Adds openclaw (the OpenClaw agent platform: CLI, gateway service, and Control UI) as a local package on the fast ring, tracking npm's latest dist-tag through the declarative npm provider with the usual 24h quarantine.

Why local rather than AUR

OpenClaw ships date-based releases every few days and the AUR package trails them by a week or more, so the PKGBUILD lives here (based on the AUR one) and the tarball comes straight from the npm registry with a pinned checksum. The pin is 2026.9.1, taken inside the quarantine window on purpose via BYPASS_MIN_RELEASE_AGE; unattended syncs still honour the 24h floor.

Things worth knowing

• npm 12 lifecycle scripts. The builder's npm blocks install-time scripts unless the package is allow-listed, and for a local tarball the key that matches is the tarball's own file: spec, not the package name. Without it OpenClaw's postinstall never runs, its .openclaw-lifecycle-pending marker ships, and every openclaw invocation fails with EACCES inside /usr/lib/node_modules. package() passes --allow-scripts and fails the build if the marker survives.
• No systemctl in .install. The gateway is a systemd user unit, which a root pacman hook cannot reach, so post_upgrade prints the restart/doctor guidance instead of attempting it (same shape as voxtype-bin).
• Not vendored: npm install at package time pulls ~330 transitive deps, as the AUR package does.

Verified

Built with bin/build --package openclaw, installed on an Omarchy machine, then exercised openclaw gateway install/start/uninstall, openclaw dashboard --json, the Control UI, and the TUI. bin/sync-upstream self-test passes.

Companion: the Omarchy-side Install > AI / default-agent wiring is omacom/omarchy#10246.

[spencerbull]

Reviewed at 14eaa08 by Fable 5.1, with an independent second opinion from Codex at xhigh reasoning. Verdict: ready to merge, with one low-severity hardening worth a line first. Nothing found that would reach a user.

Checked

• The pinned sha256 matches the registry tarball, and 2026.9.1 is the current latest dist-tag. It has cleared the 24h window since the pin was taken.
• The npm 12 claim in the PKGBUILD holds: arborist matches a file: policy key against the node's resolved spec, so the tarball path is the only key that can match, and it enables preinstall and postinstall together.
• Built with makepkg on a disposable Omarchy worker, not on the reviewing machine. The build succeeded, the .openclaw-lifecycle-pending marker was absent from the package, and no $srcdir or $pkgdir path leaked into it. npm writes no hidden lockfile for a global install.
• Installed the package on that worker: openclaw --version runs cleanly, and every command the install script prints exists in this release. The gateway unit is a user unit named openclaw-gateway.service, so dropping the AUR's root-side restart is correct.
• The docs symlinks, license, README and CHANGELOG land where intended, the wrapper replaces npm's bin symlink, and namcap reports only prebuilt-binary warnings. bin/list-packages shows the package as local and fast, bin/sync-upstream openclaw reports no update, and the self-test passes on the branch.
• Not exercised: bin/build and aarch64. The makepkg run used the same npm 12.0.2 the builder ships, but the docker path and the arm64 dependency graph were not run here.

Finding

• Low, pkgbuilds/openclaw/PKGBUILD line 46. Allowing OpenClaw's postinstall also runs its upstream migration, which recursively deletes plugin-runtime-deps under the builder's ~/.openclaw, ~/.clawdbot, and any OPENCLAW_STATE_DIR. The official builder has a fresh home and is unaffected. A maintainer running makepkg on a machine with an older OpenClaw would lose that legacy cache. Setting HOME to a scratch directory under $srcdir for the npm call closes it and makes the build hermetic. Codex found this.

For the maintainer

This is the first package pairing the npm provider with min_release_age. The npm provider reads only the dist-tag version, so a release inside the window is skipped rather than replaced by the previous eligible one, unlike the GitHub provider. That is base-branch behaviour and not a defect in this change, but the README's promise that a fast cadence cannot starve updates does not yet hold for npm sources. Codex raised it, and it checks out against helpers/upstream-github.sh.

Codex agreed with the rest of the review. Its independence is not guaranteed, since it can read the reviewing session's transcript. Waiting on the maintainer.

🤖 Generated by Fable 5.1 in Claude Code, posting on behalf of @spencerbull. Reviewed by Codex XHigh.

[spencerbull]

Taken in fe409ba: the npm call now runs with HOME pointed at a scratch directory under $srcdir and OPENCLAW_HOME, OPENCLAW_STATE_DIR, and OPENCLAW_CONFIG_PATH unset, which are the four keys the lifecycle scripts read. Rebuilt through bin/build twice on the way there; the final package carries no lifecycle marker and no build paths, and the self-tests are green on the new head.

On the npm provider and min_release_age: agreed that it skips rather than falls back, and that it is base-branch behaviour rather than this change. Worth its own issue against the provider so the README's promise holds for npm sources too.