fix(e2e): build changed sandbox images locally

.github/workflows/base-image.yaml

@@ -25,6 +25,7 @@ on:
       - ".github/workflows/managed-images.yaml"
       - "test/e2e/live/managed-image-activation-e2e.test.ts"
       - "test/e2e/live/managed-image-activation-e2e-helpers.ts"
+      - "test/e2e/fixtures/workload-source-env.ts"
       - ".github/actions/ci-reviewed-npm-audit/**"
       - ".github/actions/build-base-image-platform/**"
       - ".github/actions/publish-base-image-manifest/**"
@@ -41,6 +42,8 @@ on:
       - "src/lib/actions/sandbox/openshell-child-visible-credentials.v*.json"
       - "src/lib/core/json-types.ts"
       - "src/lib/core/ports.ts"
+      - "src/lib/hermes-managed-route.ts"
+      - "src/lib/inference/managed-dcode/identity.ts"
       - "src/lib/messaging/**"
       - "src/lib/onboard/managed-bootstrap/envelope.ts"
       - "src/lib/onboard/managed-startup/**"

.github/workflows/e2e-standard-profile.yaml

@@ -21,7 +21,10 @@ on:
       cli_artifact_provenance:
         required: true
         type: string
-      managed_image_catalog:
+      managed_image_revision:
+        required: true
+        type: string
+      workload_source:
         required: true
         type: string
       credential_boundary:
@@ -106,7 +109,9 @@ jobs:
     timeout-minutes: ${{ inputs.timeout_minutes }}
     env:
       E2E_JOB: "1"
+      E2E_MANAGED_IMAGE_REVISION: ${{ inputs.managed_image_revision }}
       E2E_TARGET_ID: ${{ inputs.target_id }}
+      E2E_WORKLOAD_SOURCE: ${{ inputs.workload_source }}
       NEMOCLAW_RUN_LIVE_E2E: "1"
       NEMOCLAW_E2E_EXPECTED_SHA: ${{ inputs.candidate_sha }}
       NEMOCLAW_E2E_CORRELATION_ID: ${{ inputs.risk_signal_correlation_id }}
@@ -392,45 +397,6 @@ jobs:
         with:
           provenance-json: ${{ inputs.cli_artifact_provenance }}
 
-      - name: Materialize temporary managed-image catalog
-        if: ${{ inputs.managed_image_catalog != '' }}
-        shell: /bin/bash --noprofile --norc -e -o pipefail {0}
-        env:
-          CANDIDATE_SHA: ${{ inputs.candidate_sha }}
-          MANAGED_IMAGE_CATALOG: ${{ inputs.managed_image_catalog }}
-          RESTORE_CLI: ${{ inputs.restore_cli && 'true' || 'false' }}
-        run: |
-          set -euo pipefail
-          catalog_path="${RUNNER_TEMP}/e2e-managed-image-catalog.json"
-          jq -e --arg revision "$CANDIDATE_SHA" '
-            type == "object" and length > 0 and
-            all(.[];
-              .source.revision == $revision and
-              (.source.release | type == "string" and length > 0) and
-              (.source.cohort | type == "string" and length > 0)
-            ) and
-            ([.[].source.release] | unique | length) == 1 and
-            ([.[].source.cohort] | unique | length) == 1
-          ' <<<"$MANAGED_IMAGE_CATALOG" >/dev/null || {
-            echo "::error::managed-image catalog source identity does not match the candidate" >&2
-            exit 1
-          }
-          if [[ "$RESTORE_CLI" == "true" ]]; then
-            candidate_release="v$(jq -r '.nemoclawVersion' dist/build-identity.json)"
-            jq -e --arg release "$candidate_release" '
-              all(.[]; .source.release == $release)
-            ' <<<"$MANAGED_IMAGE_CATALOG" >/dev/null || {
-              echo "::error::managed-image catalog release does not match the restored CLI" >&2
-              exit 1
-            }
-          fi
-          jq -c . <<<"$MANAGED_IMAGE_CATALOG" >"$catalog_path"
-          [[ -s "$catalog_path" && ! -L "$catalog_path" ]] || {
-            echo "::error::temporary managed-image catalog is invalid" >&2
-            exit 1
-          }
-          printf 'NEMOCLAW_E2E_MANAGED_IMAGE_CATALOG=%s\n' "$catalog_path" >>"$GITHUB_ENV"
-
       - name: Install reviewed cloudflared
         if: ${{ inputs.cloudflared }}
         shell: /bin/bash --noprofile --norc -e -o pipefail {0}

.github/workflows/managed-images.yaml

@@ -1045,7 +1045,7 @@ jobs:
             find "$RUNNER_TEMP/managed-pr-contracts" -type f -name contract.json -print0
           )
           node --experimental-strip-types --no-warnings \
-            tools/e2e/pr-managed-image-publication.mts assemble \
+            tools/e2e/pr-managed-image-source.mts assemble \
             "$CANDIDATE_SHA" \
             "$NEMOCLAW_MANAGED_ACTIVATION_CATALOG" \
             "${contracts[@]}"
@@ -1147,7 +1147,7 @@ jobs:
             find "$RUNNER_TEMP/managed-pr-contracts" -type f -name contract.json -print0
           )
           node --experimental-strip-types --no-warnings \
-            tools/e2e/pr-managed-image-publication.mts assemble \
+            tools/e2e/pr-managed-image-source.mts assemble \
             "$CANDIDATE_SHA" \
             "$NEMOCLAW_E2E_MANAGED_IMAGE_CATALOG" \
             "${contracts[@]}"

scripts/checks/build-protected-managed-images.sh

@@ -88,9 +88,10 @@ esac
 target_arch="${platform#linux/}"
 npm_target_os="linux"
 npm_target_libc="glibc"
-[[ "$openclaw_base" =~ ^ghcr[.]io/nvidia/nemoclaw/sandbox-base@sha256:[a-f0-9]{64}$ ]] || usage
-[[ "$hermes_base" =~ ^ghcr[.]io/nvidia/nemoclaw/hermes-sandbox-base@sha256:[a-f0-9]{64}$ ]] || usage
-[[ "$dcode_base" =~ ^ghcr[.]io/nvidia/nemoclaw/langchain-deepagents-code-sandbox-base@sha256:[a-f0-9]{64}$ ]] || usage
+base_prefix='(ghcr[.]io/nvidia/nemoclaw|localhost:5000/nemoclaw-managed-protected-base)'
+[[ "$openclaw_base" =~ ^${base_prefix}/sandbox-base@sha256:[a-f0-9]{64}$ ]] || usage
+[[ "$hermes_base" =~ ^${base_prefix}/hermes-sandbox-base@sha256:[a-f0-9]{64}$ ]] || usage
+[[ "$dcode_base" =~ ^${base_prefix}/langchain-deepagents-code-sandbox-base@sha256:[a-f0-9]{64}$ ]] || usage
 [[ "$source_root" == /* && "$source_root" != *$'\n'* && -d "$source_root" && ! -L "$source_root" ]] || usage
 source_root="$(cd -- "$source_root" && pwd -P)"
 seed_helper="$source_root/scripts/checks/materialize-locked-npm-cache-seed.mts"

src/lib/onboard/managed-workload/onboard-orchestration.test.ts

@@ -173,13 +173,21 @@ describe("managed workload onboard orchestration", () => {
     ).toBe(false);
   });
 
-  it("rejects an unavailable catalog for stock managed-image onboarding", async () => {
+  it("uses the Dockerfile when the stock managed-image catalog is unavailable", async () => {
     const { runtime } = createFreshOnboardingRuntime(
       {},
       { stockManagedRuntime: true, unavailableCatalog: true },
     );
 
-    await expect(runtime.ensurePreparedWorkload()).rejects.toThrow("registry offline");
+    await expect(runtime.ensurePreparedWorkload()).resolves.toMatchObject({
+      source: {
+        kind: "legacy-dockerfile",
+        dockerfilePath: "agents/openclaw/Dockerfile",
+        reason: "contract-unavailable",
+      },
+      release: null,
+      fallbackDiagnostic: expect.stringContaining("registry offline"),
+    });
   });
 
   it("rejects an unavailable catalog for explicit temporary managed-image onboarding", async () => {

src/lib/onboard/managed-workload/onboard-orchestration.ts

@@ -223,14 +223,15 @@ export function createManagedWorkloadOnboardRuntime(
     input.computePlan,
   );
   const strictManagedRuntime = input.tempManagedRuntime || input.managedWorkloadRebuild !== null;
-  const runtimeCapabilities =
-    strictManagedRuntime || input.stockManagedRuntime
-      ? discoveredRuntimeCapabilities
-      : {
-          ...discoveredRuntimeCapabilities,
-          managedImageSelectionPolicy: "prefer-managed" as const,
-          managedImages: null,
-        };
+  const runtimeCapabilities = strictManagedRuntime
+    ? discoveredRuntimeCapabilities
+    : {
+        ...discoveredRuntimeCapabilities,
+        managedImageSelectionPolicy: "prefer-managed" as const,
+        managedImages: input.stockManagedRuntime
+          ? discoveredRuntimeCapabilities.managedImages
+          : null,
+      };
   const runtimeProvider = resolveRuntimeProviderBundle(
     input.computePlan.driverName,
     CURRENT_RUNTIME_PROVIDER_BUNDLES,

test/e2e/README.md

@@ -90,16 +90,17 @@ After the checks pass, the action restores root `dist/` and `nemoclaw/dist/share
 If the version command fails, the action stops before the live test runs.
 This boundary keeps candidate source separate from the trusted workflow implementation.
 
-For a same-repository PR that changes a managed-image workflow path, the trusted planner also
-requires one successful `Images / Managed Images` run for the candidate commit. Before candidate
-checkout, the planner downloads the three nonexpired contract artifacts by immutable artifact ID.
-It verifies each artifact digest, producer run, attempt, and candidate commit. The planner rejects a
-missing, incomplete, or mixed all-agent publication before E2E jobs start.
-
-The planner adds the exact all-agent catalog to `dist/` after the candidate CLI build completes.
-Each live E2E consumer verifies that the catalog source revision matches `checkout_sha`. A PR that
-does not change a managed-image workflow path keeps the released catalog behavior. The GitHub token
-is available only to the trusted planner job and is not included in the candidate CLI artifact.
+For a manual PR run, the trusted planner compares the immutable base and
+candidate commit trees with the base-image and managed-image input paths. When
+those inputs are unchanged, the run uses the applicable trusted managed-image
+publication from `main`. When any input changed, the run builds the candidate
+Dockerfiles locally instead of waiting for a candidate publication.
+
+The native startup jobs build the local candidate bases for each platform. The
+AMD64 producer passes their exact digests and build caches to the protected GPU
+job. That job rebuilds with networking disabled and rejects any digest mismatch
+before it runs Ollama, NIM, or vLLM qualification. The GitHub token is available
+only to the trusted planner and is not included in the candidate CLI artifact.
 
 The same-repository `Images / Managed Images` PR workflow also runs the OpenClaw managed-image MCP
 discovery and lifecycle scope in two independent matrix jobs. Each job assembles one exact candidate

test/e2e/fixtures/phases/onboarding.ts

@@ -256,11 +256,16 @@ export class OnboardingPhaseFixture {
       );
     }
     const sandboxName = sandboxNameFromOptions(environment.onboarding, options);
-    const baseImageReference = requireDcodeBaseImageReference(
-      options.dcodeBaseImageReference === undefined
-        ? process.env
-        : { [DCODE_BASE_IMAGE_ENV]: options.dcodeBaseImageReference },
-    );
+    const useCandidateBase =
+      options.dcodeBaseImageReference === undefined &&
+      process.env.E2E_WORKLOAD_SOURCE === "local-dockerfile";
+    const baseImageReference = useCandidateBase
+      ? undefined
+      : requireDcodeBaseImageReference(
+          options.dcodeBaseImageReference === undefined
+            ? process.env
+            : { [DCODE_BASE_IMAGE_ENV]: options.dcodeBaseImageReference },
+        );
     const apiKey = this.secrets.required("NVIDIA_INFERENCE_API_KEY");
     this.registerSandboxCleanup(sandboxName);
     const result = await this.host.nemoclaw([...ONBOARD_ARGS, "--observability"], {
@@ -282,7 +287,7 @@ export class OnboardingPhaseFixture {
         NEMOCLAW_PREFERRED_API: process.env.NEMOCLAW_PREFERRED_API || "openai-completions",
         NVIDIA_INFERENCE_API_KEY: apiKey,
         [HOSTED_INFERENCE_CREDENTIAL_ENV]: apiKey,
-        [DCODE_BASE_IMAGE_ENV]: baseImageReference,
+        ...(baseImageReference ? { [DCODE_BASE_IMAGE_ENV]: baseImageReference } : {}),
       }),
       redactionValues: [apiKey],
       timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,

test/e2e/fixtures/workload-source-env.ts

@@ -1,40 +1,49 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import path from "node:path";
+import { loadAgent } from "../../../src/lib/agent/defs.ts";
+import {
+  CANDIDATE_AGENT_FEATURE_ENV,
+  CANDIDATE_QUALIFICATION_RECEIPT_ENV,
+} from "../../../src/lib/agent/candidate.ts";
+import { CUA_FEATURE_ENV } from "../../../src/lib/cua/feature.ts";
 
-import { REPO_ROOT } from "./paths.ts";
-
-const LEGACY_DOCKERFILE_BY_AGENT = {
-  openclaw: "Dockerfile",
-  hermes: "agents/hermes/Dockerfile",
-  "langchain-deepagents-code": "agents/langchain-deepagents-code/Dockerfile",
-} as const;
-
-type LegacyDockerfileAgent = keyof typeof LEGACY_DOCKERFILE_BY_AGENT;
+function agentSelectionEnv(input: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+  return {
+    [CANDIDATE_AGENT_FEATURE_ENV]:
+      input[CANDIDATE_AGENT_FEATURE_ENV] ?? process.env[CANDIDATE_AGENT_FEATURE_ENV],
+    [CANDIDATE_QUALIFICATION_RECEIPT_ENV]:
+      input[CANDIDATE_QUALIFICATION_RECEIPT_ENV] ??
+      process.env[CANDIDATE_QUALIFICATION_RECEIPT_ENV],
+    [CUA_FEATURE_ENV]: input[CUA_FEATURE_ENV] ?? process.env[CUA_FEATURE_ENV],
+  };
+}
 
-function legacyDockerfileAgent(env: NodeJS.ProcessEnv): LegacyDockerfileAgent {
-  const agent = env.NEMOCLAW_AGENT ?? "openclaw";
-  if (agent in LEGACY_DOCKERFILE_BY_AGENT) return agent as LegacyDockerfileAgent;
-  return "openclaw";
+function localDockerfilePath(input: NodeJS.ProcessEnv): string {
+  const agentName = input.NEMOCLAW_AGENT ?? process.env.NEMOCLAW_AGENT ?? "openclaw";
+  const agent = loadAgent(agentName, agentSelectionEnv(input));
+  const dockerfilePath = agent.dockerfilePath ?? agent.legacyPaths?.dockerfile;
+  if (!dockerfilePath) {
+    throw new Error(`Agent '${agent.name}' has no Dockerfile for local E2E workload source.`);
+  }
+  return dockerfilePath;
 }
 
 /**
- * Existing live E2E targets retain the product's default legacy-Dockerfile
- * path. Targets that must select a source explicitly do so through the
- * provider-neutral E2E_WORKLOAD_SOURCE contract.
+ * Live E2E targets select the trusted managed image or a Dockerfile from the
+ * candidate checkout through the E2E_WORKLOAD_SOURCE contract.
  *
  * This is applied at the final fixture spawn boundary so an agent selected by
  * a test command receives its own Dockerfile rather than an OpenClaw default.
  */
 export function resolveLiveE2eWorkloadSourceEnv(input: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
-  const targetId = input.E2E_TARGET_ID;
-  const source = input.E2E_WORKLOAD_SOURCE;
-  if (!targetId || source !== "legacy-dockerfile") return input;
+  const targetId = input.E2E_TARGET_ID ?? process.env.E2E_TARGET_ID;
+  const source = input.E2E_WORKLOAD_SOURCE ?? process.env.E2E_WORKLOAD_SOURCE;
+  if (!targetId || source !== "local-dockerfile") return input;
   if (input.NEMOCLAW_FROM_DOCKERFILE) return input;
-  const agent = legacyDockerfileAgent(input);
+  const dockerfilePath = localDockerfilePath(input);
   return {
     ...input,
-    NEMOCLAW_FROM_DOCKERFILE: path.join(REPO_ROOT, LEGACY_DOCKERFILE_BY_AGENT[agent]),
+    NEMOCLAW_FROM_DOCKERFILE: dockerfilePath,
   };
 }