fix(e2e): build changed sandbox images locally

.github/workflows/e2e-standard-profile.yaml

@@ -21,15 +21,15 @@ on:
       cli_artifact_provenance:
         required: true
         type: string
-      managed_image_catalog:
-        required: true
-        type: string
       managed_image_revision:
         required: true
         type: string
       managed_image_receipt:
         required: true
         type: string
+      workload_source:
+        required: true
+        type: string
       credential_boundary:
         required: true
         type: string
@@ -113,6 +113,7 @@ jobs:
     env:
       E2E_JOB: "1"
       E2E_MANAGED_IMAGE_REVISION: ${{ inputs.managed_image_revision }}
+      E2E_WORKLOAD_SOURCE: ${{ inputs.workload_source }}
       E2E_TARGET_ID: ${{ inputs.target_id }}
       NEMOCLAW_RUN_LIVE_E2E: "1"
       NEMOCLAW_E2E_EXPECTED_SHA: ${{ inputs.candidate_sha }}
@@ -400,45 +401,6 @@ jobs:
         with:
           provenance-json: ${{ inputs.cli_artifact_provenance }}
 
-      - name: Materialize temporary managed-image catalog
-        if: ${{ inputs.managed_image_catalog != '' }}
-        shell: /bin/bash --noprofile --norc -e -o pipefail {0}
-        env:
-          CANDIDATE_SHA: ${{ inputs.candidate_sha }}
-          MANAGED_IMAGE_CATALOG: ${{ inputs.managed_image_catalog }}
-          RESTORE_CLI: ${{ inputs.restore_cli && 'true' || 'false' }}
-        run: |
-          set -euo pipefail
-          catalog_path="${RUNNER_TEMP}/e2e-managed-image-catalog.json"
-          jq -e --arg revision "$CANDIDATE_SHA" '
-            type == "object" and length > 0 and
-            all(.[];
-              .source.revision == $revision and
-              (.source.release | type == "string" and length > 0) and
-              (.source.cohort | type == "string" and length > 0)
-            ) and
-            ([.[].source.release] | unique | length) == 1 and
-            ([.[].source.cohort] | unique | length) == 1
-          ' <<<"$MANAGED_IMAGE_CATALOG" >/dev/null || {
-            echo "::error::managed-image catalog source identity does not match the candidate" >&2
-            exit 1
-          }
-          if [[ "$RESTORE_CLI" == "true" ]]; then
-            candidate_release="v$(jq -r '.nemoclawVersion' dist/build-identity.json)"
-            jq -e --arg release "$candidate_release" '
-              all(.[]; .source.release == $release)
-            ' <<<"$MANAGED_IMAGE_CATALOG" >/dev/null || {
-              echo "::error::managed-image catalog release does not match the restored CLI" >&2
-              exit 1
-            }
-          fi
-          jq -c . <<<"$MANAGED_IMAGE_CATALOG" >"$catalog_path"
-          [[ -s "$catalog_path" && ! -L "$catalog_path" ]] || {
-            echo "::error::temporary managed-image catalog is invalid" >&2
-            exit 1
-          }
-          printf 'NEMOCLAW_E2E_MANAGED_IMAGE_CATALOG=%s\n' "$catalog_path" >>"$GITHUB_ENV"
-
       - name: Install reviewed cloudflared
         if: ${{ inputs.cloudflared }}
         shell: /bin/bash --noprofile --norc -e -o pipefail {0}

src/lib/onboard/managed-workload/onboard-orchestration.test.ts

@@ -184,23 +184,15 @@ describe("managed workload onboard orchestration", () => {
     ).toBe(false);
   });
 
-  it("keeps stock managed images required during providerless interceptor creation (#9833)", () => {
-    expect(
-      shouldActivateStockManagedRuntime({
-        portableLifecycle: false,
-        hermesPortableLifecycle: false,
-        agentName: "openclaw",
-      }),
-    ).toBe(true);
-  });
-
-  it("rejects an unavailable catalog for stock managed-image onboarding", async () => {
+  it("uses the Dockerfile when the stock managed-image catalog is unavailable", async () => {
     const { runtime } = createFreshOnboardingRuntime(
       {},
       { stockManagedRuntime: true, unavailableCatalog: true },
     );
 
-    await expect(runtime.ensurePreparedWorkload()).rejects.toThrow("registry offline");
+    await expect(runtime.ensurePreparedWorkload()).resolves.toMatchObject({
+      source: { kind: "legacy-dockerfile" },
+    });
   });
 
   it("rejects an unavailable catalog for explicit temporary managed-image onboarding", async () => {

test/e2e/fixtures/managed-image-receipt.ts

@@ -219,8 +219,11 @@ export function assertStockManagedImageReceipt(options: {
   readonly environment?: NodeJS.ProcessEnv;
   readonly expectedAgent?: string;
   readonly sandboxName: string;
-}): StockManagedImageReceiptEvidence {
+}): StockManagedImageReceiptEvidence | null {
   const environment = options.environment ?? process.env;
+  const workloadSource =
+    environment.E2E_WORKLOAD_SOURCE?.trim() ?? process.env.E2E_WORKLOAD_SOURCE?.trim();
+  if (workloadSource === "local-dockerfile") return null;
   const revision = selectedManagedImageRevision(environment);
   const home = environment.HOME?.trim() || os.homedir();
   const registryPath = path.join(

test/e2e/fixtures/phases/onboarding.ts

@@ -256,11 +256,16 @@ export class OnboardingPhaseFixture {
       );
     }
     const sandboxName = sandboxNameFromOptions(environment.onboarding, options);
-    const baseImageReference = requireDcodeBaseImageReference(
-      options.dcodeBaseImageReference === undefined
-        ? process.env
-        : { [DCODE_BASE_IMAGE_ENV]: options.dcodeBaseImageReference },
-    );
+    const localDockerfile =
+      options.dcodeBaseImageReference === undefined &&
+      process.env.E2E_WORKLOAD_SOURCE === "local-dockerfile";
+    const baseImageReference = localDockerfile
+      ? undefined
+      : requireDcodeBaseImageReference(
+          options.dcodeBaseImageReference === undefined
+            ? process.env
+            : { [DCODE_BASE_IMAGE_ENV]: options.dcodeBaseImageReference },
+        );
     const apiKey = this.secrets.required("NVIDIA_INFERENCE_API_KEY");
     this.registerSandboxCleanup(sandboxName);
     const result = await this.host.nemoclaw([...ONBOARD_ARGS, "--observability"], {
@@ -282,7 +287,7 @@ export class OnboardingPhaseFixture {
         NEMOCLAW_PREFERRED_API: process.env.NEMOCLAW_PREFERRED_API || "openai-completions",
         NVIDIA_INFERENCE_API_KEY: apiKey,
         [HOSTED_INFERENCE_CREDENTIAL_ENV]: apiKey,
-        [DCODE_BASE_IMAGE_ENV]: baseImageReference,
+        ...(baseImageReference ? { [DCODE_BASE_IMAGE_ENV]: baseImageReference } : {}),
       }),
       redactionValues: [apiKey],
       timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,

test/e2e/fixtures/shell-probe.ts

@@ -2,6 +2,12 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import type { ArtifactSink } from "./artifacts.ts";
+import { loadAgent } from "../../../src/lib/agent/defs.ts";
+import {
+  CANDIDATE_AGENT_FEATURE_ENV,
+  CANDIDATE_QUALIFICATION_RECEIPT_ENV,
+} from "../../../src/lib/agent/candidate.ts";
+import { CUA_FEATURE_ENV } from "../../../src/lib/cua/feature.ts";
 import { type ChildProcessProgress, spawnObservedChild } from "./observed-child-process.ts";
 import { superviseChild } from "./shell/supervisor.ts";
 import type { TrustedShellCommand } from "./shell/trusted-command.ts";
@@ -41,6 +47,26 @@ export interface ShellProbeOutputEvent {
 export type { TrustedShellCommand, TrustedShellCommandInput } from "./shell/trusted-command.ts";
 export { trustedShellCommand } from "./shell/trusted-command.ts";
 
+export function resolveLiveE2eWorkloadSourceEnv(input: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+  const targetId = input.E2E_TARGET_ID ?? process.env.E2E_TARGET_ID;
+  const source = input.E2E_WORKLOAD_SOURCE ?? process.env.E2E_WORKLOAD_SOURCE;
+  if (!targetId || source !== "local-dockerfile" || input.NEMOCLAW_FROM_DOCKERFILE) return input;
+  const agentName = input.NEMOCLAW_AGENT ?? process.env.NEMOCLAW_AGENT ?? "openclaw";
+  const agent = loadAgent(agentName, {
+    [CANDIDATE_AGENT_FEATURE_ENV]:
+      input[CANDIDATE_AGENT_FEATURE_ENV] ?? process.env[CANDIDATE_AGENT_FEATURE_ENV],
+    [CANDIDATE_QUALIFICATION_RECEIPT_ENV]:
+      input[CANDIDATE_QUALIFICATION_RECEIPT_ENV] ??
+      process.env[CANDIDATE_QUALIFICATION_RECEIPT_ENV],
+    [CUA_FEATURE_ENV]: input[CUA_FEATURE_ENV] ?? process.env[CUA_FEATURE_ENV],
+  });
+  const dockerfilePath = agent.dockerfilePath ?? agent.legacyPaths?.dockerfile;
+  if (!dockerfilePath) {
+    throw new Error(`Agent '${agent.name}' has no Dockerfile for local E2E workload source.`);
+  }
+  return { ...input, NEMOCLAW_FROM_DOCKERFILE: dockerfilePath };
+}
+
 export interface ShellProbeResult {
   command: string[];
   /** Wall-clock command duration, persisted for CI bottleneck analysis. */
@@ -216,10 +242,10 @@ export class ShellProbe {
     const startedAtMs = Date.now();
     const commandOutputObserver =
       options.onOutput === this.progress.onOutput ? undefined : options.onOutput;
-    const commandEnv: NodeJS.ProcessEnv = {
+    const commandEnv = resolveLiveE2eWorkloadSourceEnv({
       ...(process.env.PATH === undefined ? {} : { PATH: process.env.PATH }),
       ...(options.env ?? {}),
-    };
+    });
     const child = spawnObservedChild(command, args, {
       activityLabel: `command: ${activityName}`,
       progress: this.progress,

test/e2e/live/bedrock-runtime-compatible-anthropic-raw-command.ts

@@ -6,6 +6,7 @@ import { spawnObservedChild } from "../fixtures/observed-child-process.ts";
 import { REPO_ROOT } from "../fixtures/paths.ts";
 import type { TestProgress, TestProgressCapability } from "../fixtures/progress.ts";
 import { redactString } from "../fixtures/redaction.ts";
+import { resolveLiveE2eWorkloadSourceEnv } from "../fixtures/shell-probe.ts";
 import {
   projectRawOutputForArtifact,
   type RawArtifactOutputMode,
@@ -95,7 +96,7 @@ export async function runRawCommand(
       spawn: {
         cwd: options.cwd ?? REPO_ROOT,
         detached: true,
-        env: { ...(options.env ?? {}) },
+        env: resolveLiveE2eWorkloadSourceEnv({ ...(options.env ?? {}) }),
         stdio: ["ignore", "pipe", "pipe"],
       },
     });

test/e2e/live/dashboard-connect-handoff.ts

@@ -9,6 +9,7 @@ import {
   spawnObservedChild,
 } from "../fixtures/observed-child-process.ts";
 import { REPO_ROOT } from "../fixtures/paths.ts";
+import { resolveLiveE2eWorkloadSourceEnv } from "../fixtures/shell-probe.ts";
 import { dashboardRemoteBindConnectStarted } from "./dashboard-remote-bind-env.ts";
 
 const CONNECT_CAPTURE_LIMIT_BYTES = 1024 * 1024;
@@ -87,7 +88,7 @@ export async function runDashboardConnectUntilForwardHandoff(
     spawn: {
       cwd: REPO_ROOT,
       detached: true,
-      env: { ...options.env },
+      env: resolveLiveE2eWorkloadSourceEnv({ ...options.env }),
       stdio: ["ignore", "pipe", "pipe"],
     },
   });

test/e2e/live/full-e2e-workload-evidence.ts

@@ -8,6 +8,9 @@ export function readFullE2eColdWorkloadEvidence(
   usedBuildKitPrebuild: boolean,
   environment: NodeJS.ProcessEnv = process.env,
 ) {
+  if (environment.E2E_WORKLOAD_SOURCE === "local-dockerfile") {
+    return { kind: "legacy-dockerfile" } as const;
+  }
   if (usedBuildKitPrebuild) {
     throw new Error("managed-image cold onboarding must not use a local BuildKit prebuild");
   }
@@ -16,6 +19,7 @@ export function readFullE2eColdWorkloadEvidence(
     expectedAgent: "openclaw",
     sandboxName,
   });
+  if (!receipt) throw new Error("managed-image cold onboarding receipt is missing");
   return {
     kind: "managed-image",
     reference: receipt.reference,

test/e2e/mock-parity.json

@@ -141,6 +141,7 @@
     {
       "live": "test/e2e/live/full-e2e.test.ts",
       "liveSources": [
+        "test/e2e/live/full-e2e-workload-evidence.ts",
         "test/e2e/live/agent-turn-latency-helpers.ts",
         "test/e2e/live/full-e2e-inference-probe.ts"
       ],
@@ -151,6 +152,7 @@
         "test/e2e/support/openclaw-agent-output.test.ts",
         "test/e2e/support/e2e-cleanup-resources.test.ts",
         "test/e2e/support/e2e-clients.test.ts",
+        "test/e2e/support/managed-image-receipt.test.ts",
         "test/helpers/e2e-answer-assertions.test.ts"
       ]
     },
@@ -255,7 +257,8 @@
     },
     {
       "live": "test/e2e/live/dashboard-remote-bind.test.ts",
-      "liveOnlyReason": "Requires a real OpenShell dashboard forward on a remote Brev host to prove all-interface bind behavior after background connect."
+      "liveSources": ["test/e2e/live/dashboard-connect-handoff.ts"],
+      "fast": ["test/e2e/support/dashboard-connect-handoff.test.ts"]
     },
     {
       "live": "test/e2e/live/sandbox-rlimits-connect.test.ts",
@@ -328,6 +331,7 @@
     },
     {
       "live": "test/e2e/live/bedrock-runtime-compatible-anthropic.test.ts",
+      "liveSources": ["test/e2e/live/bedrock-runtime-compatible-anthropic-raw-command.ts"],
       "fast": [
         "test/e2e/support/bedrock-runtime-compatible-anthropic-progress.test.ts",
         "test/e2e/support/e2e-cleanup-resources.test.ts",

test/e2e/support/bedrock-runtime-compatible-anthropic-progress.test.ts

@@ -54,8 +54,10 @@ afterEach(async () => {
 });
 
 describe("Bedrock raw-command progress", () => {
-  it("reports timestamp-only output activity without forwarding child payloads", async () => {
+  it("applies the local Dockerfile and reports timestamp-only output activity", async () => {
     const secret = "opaque-bedrock-progress-secret";
+    const expectedDockerfile = path.resolve("Dockerfile");
+    const expectedOutput = `${secret}:${expectedDockerfile}`;
     const artifacts = await artifactSink("bedrock-progress-output");
     const observation = progressProbe();
     const { progress } = observation;
@@ -64,19 +66,25 @@ describe("Bedrock raw-command progress", () => {
       process.execPath,
       [
         "-e",
-        "process.stdout.write(process.env.BEDROCK_TEST_SECRET); process.stderr.write('stderr-ready')",
+        "process.stdout.write(`${process.env.BEDROCK_TEST_SECRET}:${process.env.NEMOCLAW_FROM_DOCKERFILE}`); process.stderr.write('stderr-ready')",
       ],
       {
         artifactName: "bedrock-progress-output",
         artifacts,
-        env: { ...process.env, BEDROCK_TEST_SECRET: secret },
+        env: {
+          ...process.env,
+          BEDROCK_TEST_SECRET: secret,
+          E2E_TARGET_ID: "bedrock-runtime-compatible-anthropic",
+          E2E_WORKLOAD_SOURCE: "local-dockerfile",
+          NEMOCLAW_AGENT: "openclaw",
+        },
         progress,
         redactionValues: [secret],
       },
     );
 
     expect(result.exitCode).toBe(0);
-    expect(result.stdout).toBe(secret);
+    expect(result.stdout).toBe(expectedOutput);
     observation.timers[0]?.();
     expect(observation.lines.at(-1)).toContain("no active command");
     expect(observation.lines).toEqual(
@@ -95,7 +103,7 @@ describe("Bedrock raw-command progress", () => {
         path.join(artifacts.rootDir, "raw-shell/bedrock-progress-output.stdout.txt"),
         "utf8",
       ),
-    ).resolves.toBe("[REDACTED]");
+    ).resolves.toBe(`[REDACTED]:${expectedDockerfile}`);
   });
 
   it("emits an immediate content-free timeout event and closes command activity", async () => {

test/e2e/support/dashboard-connect-handoff.test.ts

@@ -37,15 +37,25 @@ async function stopFixtureProcess(pid: number): Promise<void> {
   expect(processExists(pid)).toBe(false);
 }
 
-test("accepts a normally completed connect when the forward is already healthy", async ({
+test("accepts a normally completed connect with the local Dockerfile workload", async ({
   artifacts,
   progress,
 }) => {
   const result = await runDashboardConnectUntilForwardHandoff({
     artifacts,
-    command: [process.execPath, "-e", "process.exit(0)"],
+    command: [
+      process.execPath,
+      "-e",
+      "process.exit(process.env.NEMOCLAW_FROM_DOCKERFILE === process.argv[1] ? 0 : 1)",
+      path.resolve("Dockerfile"),
+    ],
     dashboardPort: DASHBOARD_PORT,
-    env: process.env,
+    env: {
+      ...process.env,
+      E2E_TARGET_ID: "dashboard-remote-bind",
+      E2E_WORKLOAD_SOURCE: "local-dockerfile",
+      NEMOCLAW_AGENT: "openclaw",
+    },
     progress,
     sandboxName: SANDBOX_NAME,
     timeoutMs: 2_000,

test/e2e/support/managed-image-receipt.test.ts

@@ -173,12 +173,15 @@ describe("stock E2E managed-image receipt assertion", () => {
     ).toMatchObject({ agent: "openclaw", sourceRevision: REVISION });
   });
 
-  it("uses the trusted candidate catalog for full E2E workload evidence", () => {
+  it("records local Dockerfile evidence without a managed-image receipt", () => {
     const home = writeRegistry(managedReceipt());
 
     expect(
-      readFullE2eColdWorkloadEvidence(SANDBOX_NAME, false, candidateCatalogEnvironment(home)),
-    ).toMatchObject({ kind: "managed-image", sourceRevision: REVISION });
+      readFullE2eColdWorkloadEvidence(SANDBOX_NAME, false, {
+        ...candidateCatalogEnvironment(home),
+        E2E_WORKLOAD_SOURCE: "local-dockerfile",
+      }),
+    ).toMatchObject({ kind: "legacy-dockerfile" });
   });
 
   it("rejects a candidate catalog whose source revision differs from the exact candidate revision", () => {