fix(ci): cap ClawSweeper worker bursts

.github/workflows/sweep.yml

@@ -74,7 +74,7 @@ on:
       shard_count:
         description: "Parallel shards (capped by config/automation-limits.json)"
         required: false
-        default: "89"
+        default: "44"
       item_number:
         description: "Optional single issue/PR number to review"
         required: false

CHANGELOG.md

@@ -24,7 +24,7 @@ checkpoint, and status-only commits are intentionally omitted.
 - Removed unconditional ffmpeg provisioning from review startup so optional media proof cannot block exact-review leases; unavailable media tools remain per-item evidence failures.
 - Prevented contributor-branch repairs and changelog-free repair artifacts from adding release-owned changelog entries, keeping contributor credit and release-note context in PR bodies or commit history instead.
 - Added an explicit trusted ephemeral-runner fallback for repair planning when the host cannot start Codex's Linux read-only sandbox.
-- Replaced runner-side exact-review capacity waiting and self-retries with a durable 32-slot Worker queue that coalesces item deliveries, leases executors before checkout, and reclaims abandoned leases.
+- Replaced runner-side exact-review capacity waiting and self-retries with a durable 8-slot Worker queue that coalesces item deliveries, leases executors before checkout, and reclaims abandoned leases.
 - Stopped all issue and pull request label mutations, including human and third-party bot labels, from directly triggering exact reviews.
 
 ## 0.3.0 - 2026-06-15

README.md

@@ -546,7 +546,7 @@ source ~/.profile
 corepack enable
 pnpm install
 pnpm run build
-pnpm run plan -- --target-repo openclaw/openclaw --batch-size 5 --shard-count 89 --max-pages 250 --codex-model internal --codex-reasoning-effort high
+pnpm run plan -- --target-repo openclaw/openclaw --batch-size 5 --shard-count 44 --max-pages 250 --codex-model internal --codex-reasoning-effort high
 pnpm run review -- --target-repo openclaw/openclaw --target-dir ../openclaw --batch-size 5 --max-pages 250 --artifact-dir artifacts/reviews --codex-model internal --codex-reasoning-effort high --codex-timeout-ms 600000
 pnpm run apply-artifacts -- --target-repo openclaw/openclaw --artifact-dir artifacts/reviews --skip-dashboard
 pnpm run audit -- --target-repo openclaw/openclaw --max-pages 250 --sample-limit 25 --update-dashboard
@@ -603,31 +603,32 @@ default, subject to the selected repository profile; pass `target_repo`,
 `apply_kind=issue`, or `apply_kind=pull_request` to narrow a manual run.
 
 Scheduled runs cover the configured product profiles. `openclaw/openclaw` runs
-normal backfill every 5 minutes with up to 64 review shards when the system is
+normal backfill every 5 minutes with up to 24 review shards when the system is
 quiet; `openclaw/clawhub` runs on offset review/apply/audit crons so its reports
 live under `records/openclaw-clawhub/` without colliding with default repo
 records. `openclaw/clawsweeper` has a scheduled read-only audit row and is
 available for manual and event self-review smoke tests. Broad hot-intake sweeps
-cap scheduled fan-out at 44 one-item shards per run when quiet; exact event
-reviews still use one shard. Normal review, hot intake, and commit review are
+cap scheduled fan-out at 22 one-item shards per run when quiet; manual normal
+backfill can use up to 44 shards, while exact event reviews still use one shard.
+Normal review, hot intake, and commit review are
 background lanes, so they shrink automatically while repair or exact-item work
 is active. Throughput defaults live in
 [docs/limits.md](docs/limits.md) and `config/automation-limits.json`.
 
 ### Worker Budget
 
 ClawSweeper has one main capacity knob:
-`config/automation-limits.json` -> `workers.max`. The current value is `128`.
-Lane limits are derived from that number: normal review defaults to 89 shards
-for manual/backstop runs, scheduled normal review gets up to 64 after reserves,
-hot intake up to 44 shards, commit review 6 commits per page, and existing
-repair/issue implementation lanes use 40% of `workers.max`, currently 51 live
+`config/automation-limits.json` -> `workers.max`. The current value is `64`.
+Lane limits are derived from that number: normal review defaults to 44 shards
+for manual/backstop runs, scheduled normal review gets up to 24 after reserves,
+hot intake up to 22 shards, commit review 3 commits per page, and existing
+repair/issue implementation lanes use 40% of `workers.max`, currently 25 live
 workers. Imported gitcrawl cluster repair allows 2 live workers by default.
 Exact-item review, repair, and issue implementation are priority work; normal
 review, hot intake, and commit review are background work and automatically
 yield when priority work is active. Exact-item runs use a durable Worker queue
-that coalesces item deliveries and leases at most 32 concurrent reviews. Other
-lanes retain the existing global 128-worker scheduling model.
+that coalesces item deliveries and leases at most 8 concurrent reviews. Other
+lanes retain the existing global 64-worker scheduling model.
 Use `workers.max` first when turning total Codex usage up or down; use
 `lanes.repair.cluster_max_live_runs` to tune the imported legacy cluster-repair
 lane separately, and individual environment overrides only for temporary

config/automation-limits.json

@@ -1,13 +1,13 @@
 {
   "workers": {
-    "max": 128,
-    "reserve_for_interactive": 32,
-    "expansion_reserve": 32,
-    "minimum_background": 16
+    "max": 64,
+    "reserve_for_interactive": 16,
+    "expansion_reserve": 24,
+    "minimum_background": 8
   },
   "lanes": {
     "exact_review": {
-      "max_concurrent": 32
+      "max_concurrent": 8
     },
     "assist": {
       "max": 10

dashboard/worker.ts

@@ -71,7 +71,7 @@ const CLOSED_STATS_PAGE_LIMIT = 10;
 const DEFAULT_CLAWSWEEPER_BOT_LOGINS = ["clawsweeper[bot]", "openclaw-clawsweeper[bot]"];
 const GITHUB_TIMEOUT_MS = 4500;
 const DEFAULT_STALE_QUEUED_WORKFLOW_MS = 6 * 60 * 60 * 1000;
-const DEFAULT_EXACT_REVIEW_QUEUE_MAX_CONCURRENT = 40;
+const DEFAULT_EXACT_REVIEW_QUEUE_MAX_CONCURRENT = 8;
 const DEFAULT_EXACT_REVIEW_DISPATCH_LEASE_MS = 10 * 60 * 1000;
 const DEFAULT_EXACT_REVIEW_EXECUTION_LEASE_MS = 130 * 60 * 1000;
 const DEFAULT_EXACT_REVIEW_RETRY_MS = 30_000;
@@ -1585,7 +1585,7 @@ async function statusSnapshot(env) {
     .split(",")
     .map((value) => value.trim())
     .filter(Boolean);
-  const budget = numberFrom(env.WORKER_BUDGET, 128);
+  const budget = numberFrom(env.WORKER_BUDGET, 64);
   const [runs, completedRuns, filteredActiveRuns] = await Promise.all([
     githubJson(env, `/repos/${repo}/actions/runs?per_page=100`).catch((error) => {
       errors.push(`workflow runs: ${error.message}`);

dashboard/wrangler.toml

@@ -29,7 +29,7 @@ CLAWSWEEPER_REPO = "openclaw/clawsweeper"
 CLAWSWEEPER_APP_CLIENT_ID = "Iv23liOECG0slfuhz093"
 CLAWSWEEPER_CRABFLEET_URL = "https://crabfleet.openclaw.ai"
 TARGET_REPOS = "openclaw/openclaw,openclaw/clawhub,openclaw/clawsweeper,openclaw/fs-safe"
-WORKER_BUDGET = "128"
+WORKER_BUDGET = "64"
 WORKER_DETAIL_RUN_LIMIT = "128"
 WORKER_JOB_FETCH_CONCURRENCY = "12"
 WORKER_JOB_CACHE_TTL_SECONDS = "60"
@@ -39,6 +39,6 @@ AUTOMERGE_CACHE_TTL_SECONDS = "300"
 RECENT_CLOSED_CACHE_TTL_SECONDS = "300"
 CACHE_TTL_SECONDS = "20"
 INCLUDE_CI_STATUS = "1"
-EXACT_REVIEW_QUEUE_MAX_CONCURRENT = "40"
+EXACT_REVIEW_QUEUE_MAX_CONCURRENT = "8"
 EXACT_REVIEW_DISPATCH_LEASE_MS = "600000"
 EXACT_REVIEW_EXECUTION_LEASE_MS = "7800000"

docs/commit-dispatcher.md

@@ -107,7 +107,7 @@ CLAWSWEEPER_COMMIT_REVIEW_SETTLE_SECONDS=60
 Use `0` for settled manual backfills or a larger value during GitHub event
 lag incidents.
 
-Commit review is a background lane. It defaults to 6 commits per workflow page
+Commit review is a background lane. It defaults to 3 commits per workflow page
 when the system is quiet, but the receiver asks the central worker scheduler for
 capacity before each page. Active repair, exact-item review, and sweep work can
 lower the page size so commit review does not consume capacity needed by
@@ -116,10 +116,10 @@ maintainer-visible work. The checked-in default comes from
 `openclaw/clawsweeper` only when the org has enough rate-limit headroom:
 
 ```text
-CLAWSWEEPER_COMMIT_REVIEW_PAGE_SIZE=6
+CLAWSWEEPER_COMMIT_REVIEW_PAGE_SIZE=3
 ```
 
-The receiver clamps this between 1 and 128. Setting the variable bypasses the
+The receiver clamps this between 1 and 64. Setting the variable bypasses the
 dynamic default for that run; leave it unset when the central scheduler should
 decide. Large push ranges continue in later workflow pages.
 

docs/commit-sweeper.md

@@ -89,13 +89,13 @@ by SHA/range rather than detaching the whole target repository at the commit.
 
 ## Scaling
 
-Commit Sweeper is background work. It defaults to 6 commits per workflow page
+Commit Sweeper is background work. It defaults to 3 commits per workflow page
 when the system is quiet, but the receiver asks the central worker scheduler for
 the effective page size before dispatching the matrix. Active repair,
 exact-item review, and sweep work can lower commit review to keep capacity
 available for maintainer-visible work. The checked-in default lives in
 `config/automation-limits.json`. The receiver clamps
-`CLAWSWEEPER_COMMIT_REVIEW_PAGE_SIZE` between 1 and 128, then pages large ranges:
+`CLAWSWEEPER_COMMIT_REVIEW_PAGE_SIZE` between 1 and 64, then pages large ranges:
 
 - select up to the configured page size
 - classify them cheaply

docs/limits.md

@@ -33,40 +33,40 @@ The mental model:
 
 | Name | Current | Meaning |
 | --- | ---: | --- |
-| `workers.max` | 128 | Maximum global Codex worker budget used to derive lane limits. |
-| `workers.reserve_for_interactive` | 32 | Worker slots background lanes leave open for exact/manual/urgent work. |
-| `workers.expansion_reserve` | 32 | Extra slots background lanes leave open for independently planned matrix expansion. |
-| `workers.minimum_background` | 16 | Target floor for background progress when enough global capacity is available. |
-| `lanes.exact_review.max_concurrent` | 32 | Maximum concurrent exact-item review workflow runs admitted to Codex. |
+| `workers.max` | 64 | Maximum global Codex worker budget used to derive lane limits. |
+| `workers.reserve_for_interactive` | 16 | Worker slots background lanes leave open for exact/manual/urgent work. |
+| `workers.expansion_reserve` | 24 | Extra slots background lanes leave open for independently planned matrix expansion. |
+| `workers.minimum_background` | 8 | Target floor for background progress when enough global capacity is available. |
+| `lanes.exact_review.max_concurrent` | 8 | Maximum concurrent exact-item review workflow runs admitted to Codex. |
 | `lanes.assist.max` | 10 | Maximum concurrent lightweight assist jobs. |
 | `lanes.repair.cluster_max_live_runs` | 2 | Default live repair workflow cap for imported gitcrawl cluster dispatches. |
 
 ## Derived Limits
 
 Review, commit, and existing repair limits are intentionally percentages of
 `workers.max`; imported cluster repair has its own lane knob. With
-`workers.max = 128`, normal review can use 89 workers, hot intake can use 44,
-commit review can use 6 commits per page, existing repair lanes dispatch 51
+`workers.max = 64`, normal review can use 44 workers, hot intake can use 22,
+commit review can use 3 commits per page, existing repair lanes dispatch 25
 live workers by default, and imported cluster repair dispatches two live workers
 by default.
 
 | Name | Current | Meaning |
 | --- | ---: | --- |
-| `exact_review.concurrent_max` | 32 | Exact-item review admission cap, clamped to `workers.max`. |
+| `exact_review.concurrent_max` | 8 | Exact-item review admission cap, clamped to `workers.max`. |
 | `assist.default` | 10 | Maintainer assist job cap. |
-| `review_shards.normal_default` | 89 | Quiet-system normal review shard ceiling. |
-| `review_shards.normal_active_floor` | 38 | Minimum active normal review shards to keep queued for `openclaw/openclaw`. |
-| `review_shards.hot_intake_default` | 44 | Quiet-system broad hot-intake review shard ceiling. |
+| `review_shards.normal_default` | 44 | Quiet-system normal review shard ceiling. |
+| `review_shards.normal_active_floor` | 19 | Minimum active normal review shards to keep queued for `openclaw/openclaw`. |
+| `review_shards.hot_intake_default` | 22 | Quiet-system broad hot-intake review shard ceiling. |
 | `review_shards.exact_item_default` | 1 | Exact-item hot-intake shard count. |
-| `review_shards.hard_cap` | 128 | Maximum accepted review shard count. |
-| `commit_review.page_size_default` | 6 | Commits selected per commit-review page. |
-| `commit_review.page_size_hard_cap` | 128 | Maximum commit-review page size. |
-| `repair_live_runs.default` | 51 | Default live repair workflow run cap for manual dispatch/requeue/self-heal. |
-| `repair_live_runs.hard_cap` | 128 | Absolute live repair run cap accepted by explicit CLI/env overrides with this config. |
-| `repair_live_runs.automerge_default` | 51 | Live repair run cap for automerge comment-router dispatches. |
-| `repair_live_runs.issue_implementation_default` | 51 | Live repair run cap for issue-to-PR implementation intake. |
+| `review_shards.hard_cap` | 64 | Maximum accepted review shard count. |
+| `commit_review.page_size_default` | 3 | Commits selected per commit-review page. |
+| `commit_review.page_size_hard_cap` | 64 | Maximum commit-review page size. |
+| `repair_live_runs.default` | 25 | Default live repair workflow run cap for manual dispatch/requeue/self-heal. |
+| `repair_live_runs.hard_cap` | 64 | Absolute live repair run cap accepted by explicit CLI/env overrides with this config. |
+| `repair_live_runs.automerge_default` | 25 | Live repair run cap for automerge comment-router dispatches. |
+| `repair_live_runs.issue_implementation_default` | 25 | Live repair run cap for issue-to-PR implementation intake. |
 | `repair_live_runs.cluster_default` | 2 | Live repair run cap for imported gitcrawl cluster dispatches. |
-| `issue_implementation.dispatches_per_sweep_default` | 5 | Maximum implementation intake jobs queued from one review publish run. |
+| `issue_implementation.dispatches_per_sweep_default` | 2 | Maximum implementation intake jobs queued from one review publish run. |
 
 Formula summary:
 
@@ -114,7 +114,7 @@ Exact-item webhooks are admitted by the dashboard Worker's durable
 deliveries by repository and item number, so a new webhook updates the latest
 desired review rather than consuming another runner. Only
 `EXACT_REVIEW_QUEUE_MAX_CONCURRENT` leased items may dispatch an exact-review
-workflow at once; the default is 32.
+workflow at once; the default is 8.
 
 Each dispatched workflow claims its opaque lease before checkout. Duplicate
 dispatches and stale workflows cannot claim the same lease, and a completion
@@ -124,13 +124,13 @@ keeps capacity waiting and retry state out of GitHub Actions runners.
 
 Examples with the current config:
 
-- Quiet system: manual normal review can request 89 shards; scheduled normal
-  review gets 64 after reserving 32 slots for exact/manual/urgent work and 32
+- Quiet system: manual normal review can request 44 shards; scheduled normal
+  review gets 24 after reserving 16 slots for exact/manual/urgent work and 24
   slots for in-flight matrix expansion.
-- 4 active repair workers and 68 active background workers: normal review gets
-  1 because `128 - 32 interactive reserve - 32 expansion reserve - 4 priority
-  - 68 background = -8`, and enabled background lanes keep one slow-progress worker.
-- 88 active priority workers: commit review gets 1, so commit review yields but
+- 4 active repair workers and 20 active background workers: normal review gets
+  1 because `64 - 16 interactive reserve - 24 expansion reserve - 4 priority
+  - 20 background = 0`, and enabled background lanes keep one slow-progress worker.
+- 48 active priority workers: commit review gets 1, so commit review yields but
   does not fully stall.
 
 Use these commands to inspect the effective values from a checkout:

docs/live-dashboard.md

@@ -130,8 +130,8 @@ The Worker fetches job details only for the bounded active-run set, limits that
 GitHub fanout to 12 concurrent requests, and caches each run's jobs for 60
 seconds. It separately samples 20 recent completed worker runs with ten-way
 fanout and caches error/recovery telemetry for 120 seconds. This bounds
-telemetry pressure without reducing the 128-worker fleet budget. Worker details
-paginate up to 300 jobs per workflow run so 128-shard runs remain fully visible,
+telemetry pressure without reducing the 64-worker fleet budget. Worker details
+paginate up to 300 jobs per workflow run so 44-shard runs remain fully visible,
 then finish before optional pipeline CI and historical
 enrichment begin, so those secondary lookups do not compete with active worker
 telemetry. If GitHub job telemetry is unavailable, the API and UI retain the

docs/repair/README.md

@@ -274,12 +274,12 @@ pnpm run repair:import-gitcrawl -- --from-gitcrawl --limit 40 --mode autonomous
 
 # Dispatch reviewed jobs. Dispatch derives its default live-worker cap from the
 # job's job_intent and config/automation-limits.json. Existing repair lanes
-# keep the normal 40%-of-workers.max cap, currently 51; imported gitcrawl
+# keep the normal 40%-of-workers.max cap, currently 25; imported gitcrawl
 # cluster jobs default to lanes.repair.cluster_max_live_runs, currently 2.
 # Use CLAWSWEEPER_MAX_LIVE_WORKERS/--max-live-workers for a one-lane override.
 # With --wait-for-capacity, dispatch can drain a larger file
 # list in capacity-sized waves instead of refusing the whole batch.
-CLAWSWEEPER_MAX_LIVE_WORKERS=51 pnpm run repair:dispatch -- jobs/openclaw/inbox/ordinary-example.md \
+CLAWSWEEPER_MAX_LIVE_WORKERS=25 pnpm run repair:dispatch -- jobs/openclaw/inbox/ordinary-example.md \
   --mode autonomous \
   --runner blacksmith-4vcpu-ubuntu-2404 \
   --execution-runner blacksmith-16vcpu-ubuntu-2404