From d9820e4098b8ea6f0a70b0d7adfa351bdf0e0420 Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Sat, 30 May 2026 10:28:32 +0200
Subject: [PATCH] fix(ci): disable crabbox on-demand fallback

---
 .crabbox.yaml                                 | 16 +++++---------
 CHANGELOG.md                                  |  1 +
 scripts/test-projects.test-support.mjs        |  1 +
 .../package-acceptance-workflow.test.ts       | 22 ++++++++++++++++++-
 test/scripts/test-projects.test.ts            |  7 ++++++
 5 files changed, 35 insertions(+), 12 deletions(-)

diff --git a/.crabbox.yaml b/.crabbox.yaml
index ef91d95832b..d7b7f216b89 100644
--- a/.crabbox.yaml
+++ b/.crabbox.yaml
@@ -6,18 +6,10 @@ class: standard
 capacity:
   market: spot
   strategy: most-available
-  fallback: on-demand-after-120s
+  # Fail closed instead of silently falling back to on-demand while the
+  # Azure-backed billing account is the default runner path.
+  fallback: spot-only
   hints: true
-  availabilityZones:
-    - eu-west-1a
-    - eu-west-1b
-    - eu-west-1c
-  regions:
-    - eu-west-1
-    - eu-west-2
-    - eu-central-1
-    - us-east-1
-    - us-west-2
 actions:
   workflow: .github/workflows/crabbox-hydrate.yml
   # Default AWS hydration uses local Actions replay. Use
@@ -37,6 +29,8 @@ blacksmith:
   job: check
   ref: main
 aws:
+  # AWS-specific overrides still pin direct `--provider aws` runs without
+  # leaking AWS region names into the Azure default capacity fallback list.
   region: eu-west-1
   rootGB: 400
 sync:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4d44c30f855..ae452882563 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -34,6 +34,7 @@ Docs: https://docs.openclaw.ai
 - Security/config parsing: reject unsafe OAuth/token lifetimes, retry-after delays, inbound timestamps, response body sizes, command timeout config, sandbox observer token TTLs, and gateway WebSocket calls after close.
 - Providers/media: cap local service, model, usage, queue, generated media, TTS, music, workflow polling, and provider OAuth request timers across hosted and local providers.
 - Release/CI/E2E: bound release candidate reads, beta smoke REST calls, changelog restore, kitchen-sink and bundled plugin readiness probes, secret-provider probes, Vitest routing, and mainline test flakes. (#88127, #88137, #88155, #88160)
+- CI/Crabbox: keep default runner capacity spot-only and provider-neutral so OpenClaw remote validation does not silently fall back to on-demand leases or stale AWS region hints.
 - Performance: reuse prepared provider handles, strict tool schemas, gateway runtime metadata, session maintenance config, plugin metadata, bundled skill allowlists, package-local plugin artifacts, and single-entry store writes.
 
 ## 2026.5.28
diff --git a/scripts/test-projects.test-support.mjs b/scripts/test-projects.test-support.mjs
index 96e3785a0eb..24006a4319f 100644
--- a/scripts/test-projects.test-support.mjs
+++ b/scripts/test-projects.test-support.mjs
@@ -365,6 +365,7 @@ const PRECISE_SOURCE_TEST_TARGETS = new Map([
 ]);
 const BROAD_ONLY_TEST_HELPERS = new Set(["test/helpers/poll.ts"]);
 const TOOLING_SOURCE_TEST_TARGETS = new Map([
+  [".crabbox.yaml", ["test/scripts/package-acceptance-workflow.test.ts"]],
   ["scripts/build-all.mjs", ["test/scripts/build-all.test.ts"]],
   ["scripts/github/barnacle-auto-response.mjs", ["test/scripts/barnacle-auto-response.test.ts"]],
   ["scripts/changed-lanes.mjs", ["test/scripts/changed-lanes.test.ts"]],
diff --git a/test/scripts/package-acceptance-workflow.test.ts b/test/scripts/package-acceptance-workflow.test.ts
index beee96df0bd..dacc41d5443 100644
--- a/test/scripts/package-acceptance-workflow.test.ts
+++ b/test/scripts/package-acceptance-workflow.test.ts
@@ -200,7 +200,7 @@ describe("package acceptance workflow", () => {
     expect(hydrateWindowsFetch.run).not.toContain("StandardError.ReadToEnd()");
     expect(hydrateWindowsFetch.run).toContain("git fetch failed with exit code $($fetch.ExitCode)");
     expect(hydrateWindowsFetch.run).toContain(
-      '--no-tags --no-progress --prune --no-recurse-submodules --depth=50',
+      "--no-tags --no-progress --prune --no-recurse-submodules --depth=50",
     );
     expect(hydrateWindowsFetch.run).toContain('"+refs/heads/main:refs/remotes/origin/main"');
     expect(workflowStep(hydrateWindowsDaemon, "Mark Crabbox ready").shell).toBe("powershell");
@@ -221,6 +221,26 @@ describe("package acceptance workflow", () => {
     );
   });
 
+  it("keeps default Crabbox capacity fail-closed and provider-neutral", () => {
+    const crabboxConfig = parse(readFileSync(CRABBOX_CONFIG, "utf8")) as {
+      aws?: { region?: string };
+      capacity?: {
+        availabilityZones?: string[];
+        fallback?: string;
+        market?: string;
+        regions?: string[];
+      };
+      provider?: string;
+    };
+
+    expect(crabboxConfig.provider).toBe("azure");
+    expect(crabboxConfig.capacity?.market).toBe("spot");
+    expect(crabboxConfig.capacity?.fallback).toBe("spot-only");
+    expect(crabboxConfig.capacity?.regions).toBeUndefined();
+    expect(crabboxConfig.capacity?.availabilityZones).toBeUndefined();
+    expect(crabboxConfig.aws?.region).toBe("eu-west-1");
+  });
+
   it("resolves candidate package sources before reusing Docker E2E lanes", () => {
     const workflow = readFileSync(PACKAGE_ACCEPTANCE_WORKFLOW, "utf8");
 
diff --git a/test/scripts/test-projects.test.ts b/test/scripts/test-projects.test.ts
index d295b457a89..2ff004885b4 100644
--- a/test/scripts/test-projects.test.ts
+++ b/test/scripts/test-projects.test.ts
@@ -356,6 +356,13 @@ describe("scripts/test-projects changed-target routing", () => {
     });
   });
 
+  it("keeps Crabbox config edits on package acceptance tests", () => {
+    expect(resolveChangedTestTargetPlan([".crabbox.yaml"])).toEqual({
+      mode: "targets",
+      targets: ["test/scripts/package-acceptance-workflow.test.ts"],
+    });
+  });
+
   it("routes explicit tooling implementation files to owner tests", () => {
     expect(
       findUnmatchedExplicitTestTargets([