chore(setup): bump gateway LKG to 2026.7.1

[github-actions]

Gateway LKG update

• Previous pinned LKG: 2026.6.11
• Candidate latest: 2026.7.1
• Updated file: src/OpenClaw.SetupEngine/GatewayLkgVersion.cs

This is the standing automation PR used to review and validate gateway LKG bumps before merge.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 14, 2026, 9:51 AM ET / 13:51 UTC.

Summary
Updates the setup engine’s default gateway LKG version from 2026.6.11 to 2026.7.1.

Reproducibility: not applicable. as a bug reproduction: this is a release-pin update, and the relevant verification is a real Windows easy-setup acceptance run against the proposed version.

Review metrics: 2 noteworthy metrics.

• Version selection: 1 constant changed. This single-line change selects the gateway release installed by new or repaired setup flows.
• Reported validation: 4 analysis/security checks passed. The supplied checks do not include the repository-required build, shared tests, tray tests, or real setup acceptance path.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🌊 off-meta tidepool
Patch quality: 🦐 gold shrimp
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Record a current-head Windows easy-setup install, startup, and health proof.
• [P2] Run ./build.ps1 plus the required shared and tray test projects before merge.

Risk before merge

• [P1] Changing the LKG without a current-head Windows easy-setup run could make new or repaired installations select a gateway that publishes successfully but fails installation, startup, or health checks on the supported path.
• [P1] The supplied check results do not demonstrate the full build, shared tests, tray tests, or setup proof required by repository policy.

Maintainer options:

1. Prove the real setup path (recommended)
   Capture a current-head Windows easy-setup run that installs v2026.7.1, starts the gateway, verifies healthy connectivity, and completes required build and tests.
2. Defer the LKG bump
   Keep v2026.6.11 as the setup default until the candidate has release-quality Windows acceptance evidence.

Next step before merge

• [P2] A release owner should confirm the Windows acceptance run and required validation, then merge or defer the draft; there is no concrete repository repair for an automated worker to make.

Maintainer decision needed

• Question: Has gateway v2026.7.1 passed the Windows Hub acceptance bar to become the new last-known-good setup version?
• Rationale: Exact publication is now sufficiently supported, but designating a gateway release as last-known-good requires real Windows setup evidence and release-owner acceptance that automated source review cannot supply.
• Likely owner: vincentkoc — The supplied routing signal and related release-validation history make him the strongest available owner for the release-acceptance choice.
• Options:
  • Accept after setup proof (recommended): Run the current-head Windows easy-setup path and merge if installation, startup, gateway health, and required repository validation succeed.
  • Keep the prior LKG: Leave 2026.6.11 pinned until v2026.7.1 completes the Windows acceptance run.

Security
Cleared: The diff changes only an existing pinned version and does not broaden dependency sources, permissions, secret access, or code-execution mechanisms.

Review details

Best possible solution:

Keep the centralized 2026.7.1 pin and merge it once a current-head Windows easy-setup run proves exact installation, gateway startup, and healthy connectivity, with the required repository build and tests also passing.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction: this is a release-pin update, and the relevant verification is a real Windows easy-setup acceptance run against the proposed version.

Is this the best way to solve the issue?

Yes, changing the single centralized LKG constant is the narrowest maintainable implementation; the unresolved matter is release acceptance and validation rather than code structure.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 77c42440376e.

Label changes

Label changes:

• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This standing bot-authored automation PR is exempt from the external-contributor proof gate, although maintainers should still require repository-policy Windows setup acceptance evidence.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🦐 gold shrimp, so this older rating label is no longer current.
• remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

• P2: This is a narrow routine release-maintenance update with meaningful but limited setup impact.
• merge-risk: 🚨 availability: An insufficiently accepted LKG could leave easy-setup users without an installed, running, or healthy gateway.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This standing bot-authored automation PR is exempt from the external-contributor proof gate, although maintainers should still require repository-policy Windows setup acceptance evidence.

Evidence reviewed

What I checked:

• Prior finding resolved: The standing automation reads npm’s openclaw/latest metadata and proposes the returned exact version, so selecting 2026.7.1 establishes stronger publication evidence than was available during the previous review. citeturn609909search0. (.github/workflows/gateway-lkg-update.yml:31, 4fb72d665928)
• Official release exists: Official OpenClaw release notes identify v2026.7.1 as released on July 13, 2026. citeturn609909search1.
• Installer-impacting change: The PR changes the centralized version returned by ResolveLkgVersion, which selects the gateway used by setup rather than changing incidental metadata. (src/OpenClaw.SetupEngine/GatewayLkgVersion.cs:6, 4fb72d665928)
• Validation evidence remains absent: The supplied PR body contains no Windows easy-setup installation, gateway startup, or health proof, and the reported checks cover analysis and CodeQL rather than the repository-required build and test closeout. (AGENTS.md:5, 77c42440376e)
• History inspection limitation: The local read-only shell could not execute because its sandbox failed while creating loopback networking, so owner routing relies on the supplied timeline and public repository evidence rather than a fresh local blame/log result.

Likely related people:

• shanselman: The prior ClawSweeper review explicitly routed this setup-area decision to him, and public repository material identifies him with the Windows Hub implementation. (role: Windows Hub feature owner; confidence: medium; files: src/OpenClaw.SetupEngine/GatewayLkgVersion.cs, .github/workflows/gateway-lkg-update.yml)
• vincentkoc: The prior review explicitly routed this PR to him, and the v2026.7.1 release notes credit related release-validation and setup-safety work. citeturn609909search1. (role: release-validation contributor; confidence: medium; files: src/OpenClaw.SetupEngine/GatewayLkgVersion.cs, .github/workflows/gateway-lkg-update.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (3 earlier review cycles)

• reviewed 2026-07-14T12:39:56.646Z sha 4fb72d6 :: needs maintainer review before merge. :: none
• reviewed 2026-07-14T13:02:37.381Z sha 4fb72d6 :: found issues before merge. :: [P1] Pin only an exact published gateway package
• reviewed 2026-07-14T13:28:35.352Z sha 4fb72d6 :: found issues before merge. :: [P1] Pin only an exact published gateway package

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(setup): bump gateway LKG to 2026.7.1 This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.