fix(e2e): reconcile credential generation window state

.github/workflows/base-image.yaml

@@ -25,6 +25,7 @@ on:
       - ".github/workflows/managed-images.yaml"
       - "test/e2e/live/managed-image-activation-e2e.test.ts"
       - "test/e2e/live/managed-image-activation-e2e-helpers.ts"
+      - "test/e2e/fixtures/workload-source-env.ts"
       - ".github/actions/ci-reviewed-npm-audit/**"
       - ".github/actions/build-base-image-platform/**"
       - ".github/actions/publish-base-image-manifest/**"
@@ -41,6 +42,8 @@ on:
       - "src/lib/actions/sandbox/openshell-child-visible-credentials.v*.json"
       - "src/lib/core/json-types.ts"
       - "src/lib/core/ports.ts"
+      - "src/lib/hermes-managed-route.ts"
+      - "src/lib/inference/managed-dcode/identity.ts"
       - "src/lib/messaging/**"
       - "src/lib/onboard/managed-bootstrap/envelope.ts"
       - "src/lib/onboard/managed-startup/**"

.github/workflows/e2e-standard-profile.yaml

@@ -21,7 +21,10 @@ on:
       cli_artifact_provenance:
         required: true
         type: string
-      managed_image_catalog:
+      managed_image_revision:
+        required: true
+        type: string
+      workload_source:
         required: true
         type: string
       credential_boundary:
@@ -106,7 +109,9 @@ jobs:
     timeout-minutes: ${{ inputs.timeout_minutes }}
     env:
       E2E_JOB: "1"
+      E2E_MANAGED_IMAGE_REVISION: ${{ inputs.managed_image_revision }}
       E2E_TARGET_ID: ${{ inputs.target_id }}
+      E2E_WORKLOAD_SOURCE: ${{ inputs.workload_source }}
       NEMOCLAW_RUN_LIVE_E2E: "1"
       NEMOCLAW_E2E_EXPECTED_SHA: ${{ inputs.candidate_sha }}
       NEMOCLAW_E2E_CORRELATION_ID: ${{ inputs.risk_signal_correlation_id }}
@@ -392,45 +397,6 @@ jobs:
         with:
           provenance-json: ${{ inputs.cli_artifact_provenance }}
 
-      - name: Materialize temporary managed-image catalog
-        if: ${{ inputs.managed_image_catalog != '' }}
-        shell: /bin/bash --noprofile --norc -e -o pipefail {0}
-        env:
-          CANDIDATE_SHA: ${{ inputs.candidate_sha }}
-          MANAGED_IMAGE_CATALOG: ${{ inputs.managed_image_catalog }}
-          RESTORE_CLI: ${{ inputs.restore_cli && 'true' || 'false' }}
-        run: |
-          set -euo pipefail
-          catalog_path="${RUNNER_TEMP}/e2e-managed-image-catalog.json"
-          jq -e --arg revision "$CANDIDATE_SHA" '
-            type == "object" and length > 0 and
-            all(.[];
-              .source.revision == $revision and
-              (.source.release | type == "string" and length > 0) and
-              (.source.cohort | type == "string" and length > 0)
-            ) and
-            ([.[].source.release] | unique | length) == 1 and
-            ([.[].source.cohort] | unique | length) == 1
-          ' <<<"$MANAGED_IMAGE_CATALOG" >/dev/null || {
-            echo "::error::managed-image catalog source identity does not match the candidate" >&2
-            exit 1
-          }
-          if [[ "$RESTORE_CLI" == "true" ]]; then
-            candidate_release="v$(jq -r '.nemoclawVersion' dist/build-identity.json)"
-            jq -e --arg release "$candidate_release" '
-              all(.[]; .source.release == $release)
-            ' <<<"$MANAGED_IMAGE_CATALOG" >/dev/null || {
-              echo "::error::managed-image catalog release does not match the restored CLI" >&2
-              exit 1
-            }
-          fi
-          jq -c . <<<"$MANAGED_IMAGE_CATALOG" >"$catalog_path"
-          [[ -s "$catalog_path" && ! -L "$catalog_path" ]] || {
-            echo "::error::temporary managed-image catalog is invalid" >&2
-            exit 1
-          }
-          printf 'NEMOCLAW_E2E_MANAGED_IMAGE_CATALOG=%s\n' "$catalog_path" >>"$GITHUB_ENV"
-
       - name: Install reviewed cloudflared
         if: ${{ inputs.cloudflared }}
         shell: /bin/bash --noprofile --norc -e -o pipefail {0}

.github/workflows/managed-images.yaml

@@ -1045,7 +1045,7 @@ jobs:
             find "$RUNNER_TEMP/managed-pr-contracts" -type f -name contract.json -print0
           )
           node --experimental-strip-types --no-warnings \
-            tools/e2e/pr-managed-image-publication.mts assemble \
+            tools/e2e/pr-managed-image-source.mts assemble \
             "$CANDIDATE_SHA" \
             "$NEMOCLAW_MANAGED_ACTIVATION_CATALOG" \
             "${contracts[@]}"
@@ -1147,7 +1147,7 @@ jobs:
             find "$RUNNER_TEMP/managed-pr-contracts" -type f -name contract.json -print0
           )
           node --experimental-strip-types --no-warnings \
-            tools/e2e/pr-managed-image-publication.mts assemble \
+            tools/e2e/pr-managed-image-source.mts assemble \
             "$CANDIDATE_SHA" \
             "$NEMOCLAW_E2E_MANAGED_IMAGE_CATALOG" \
             "${contracts[@]}"

scripts/checks/build-protected-managed-images.sh

@@ -88,9 +88,10 @@ esac
 target_arch="${platform#linux/}"
 npm_target_os="linux"
 npm_target_libc="glibc"
-[[ "$openclaw_base" =~ ^ghcr[.]io/nvidia/nemoclaw/sandbox-base@sha256:[a-f0-9]{64}$ ]] || usage
-[[ "$hermes_base" =~ ^ghcr[.]io/nvidia/nemoclaw/hermes-sandbox-base@sha256:[a-f0-9]{64}$ ]] || usage
-[[ "$dcode_base" =~ ^ghcr[.]io/nvidia/nemoclaw/langchain-deepagents-code-sandbox-base@sha256:[a-f0-9]{64}$ ]] || usage
+base_prefix='(ghcr[.]io/nvidia/nemoclaw|localhost:5000/nemoclaw-managed-protected-base)'
+[[ "$openclaw_base" =~ ^${base_prefix}/sandbox-base@sha256:[a-f0-9]{64}$ ]] || usage
+[[ "$hermes_base" =~ ^${base_prefix}/hermes-sandbox-base@sha256:[a-f0-9]{64}$ ]] || usage
+[[ "$dcode_base" =~ ^${base_prefix}/langchain-deepagents-code-sandbox-base@sha256:[a-f0-9]{64}$ ]] || usage
 [[ "$source_root" == /* && "$source_root" != *$'\n'* && -d "$source_root" && ! -L "$source_root" ]] || usage
 source_root="$(cd -- "$source_root" && pwd -P)"
 seed_helper="$source_root/scripts/checks/materialize-locked-npm-cache-seed.mts"

src/lib/onboard/managed-workload/onboard-orchestration.test.ts

@@ -173,13 +173,21 @@ describe("managed workload onboard orchestration", () => {
     ).toBe(false);
   });
 
-  it("rejects an unavailable catalog for stock managed-image onboarding", async () => {
+  it("uses the Dockerfile when the stock managed-image catalog is unavailable", async () => {
     const { runtime } = createFreshOnboardingRuntime(
       {},
       { stockManagedRuntime: true, unavailableCatalog: true },
     );
 
-    await expect(runtime.ensurePreparedWorkload()).rejects.toThrow("registry offline");
+    await expect(runtime.ensurePreparedWorkload()).resolves.toMatchObject({
+      source: {
+        kind: "legacy-dockerfile",
+        dockerfilePath: "agents/openclaw/Dockerfile",
+        reason: "contract-unavailable",
+      },
+      release: null,
+      fallbackDiagnostic: expect.stringContaining("registry offline"),
+    });
   });
 
   it("rejects an unavailable catalog for explicit temporary managed-image onboarding", async () => {

src/lib/onboard/managed-workload/onboard-orchestration.ts

@@ -223,14 +223,15 @@ export function createManagedWorkloadOnboardRuntime(
     input.computePlan,
   );
   const strictManagedRuntime = input.tempManagedRuntime || input.managedWorkloadRebuild !== null;
-  const runtimeCapabilities =
-    strictManagedRuntime || input.stockManagedRuntime
-      ? discoveredRuntimeCapabilities
-      : {
-          ...discoveredRuntimeCapabilities,
-          managedImageSelectionPolicy: "prefer-managed" as const,
-          managedImages: null,
-        };
+  const runtimeCapabilities = strictManagedRuntime
+    ? discoveredRuntimeCapabilities
+    : {
+        ...discoveredRuntimeCapabilities,
+        managedImageSelectionPolicy: "prefer-managed" as const,
+        managedImages: input.stockManagedRuntime
+          ? discoveredRuntimeCapabilities.managedImages
+          : null,
+      };
   const runtimeProvider = resolveRuntimeProviderBundle(
     input.computePlan.driverName,
     CURRENT_RUNTIME_PROVIDER_BUNDLES,

test/credentials/openshell-credential-generation-window.test.ts

@@ -1,7 +1,9 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+import { EventEmitter } from "node:events";
 import fs from "node:fs";
+import vm from "node:vm";
 
 import { describe, expect, it } from "vitest";
 
@@ -18,7 +20,8 @@ import {
   credentialWindowRequestId,
   credentialWindowSecrets,
   OPENSHELL_RETAINED_CREDENTIAL_GENERATIONS,
-} from "../e2e/live/openshell-credential-generation-window.ts";
+  parseCredentialWindowRequestObservation,
+} from "../e2e/live/mcp-bridge-credential-generation-window.ts";
 
 describe("OpenShell exact-main credential generation-window proof", () => {
   it("crosses the complete upstream retention window with unique scannable values", () => {
@@ -43,8 +46,6 @@ describe("OpenShell exact-main credential generation-window proof", () => {
     expect(script.indexOf(snapshot)).toBeLessThan(script.indexOf("while (Date.now() < deadline"));
     expect(script).toContain('"^openshell:resolve:env:(v[0-9]{1,20})_" + config.envName + "$"');
     expect(script).toContain('authorization: "Bearer " + credentialPlaceholder');
-    expect(script).toContain('response.statusCode === 200 ? "allowed" : "denied"');
-    expect(script).toContain('outbound.on("error", () => resolve("denied"))');
     expect(script).toContain("outbound.setTimeout(30_000");
     expect(script).toContain(JSON.stringify(CREDENTIAL_WINDOW_PATHS.acknowledgement));
     expect(script).toContain(JSON.stringify(CREDENTIAL_WINDOW_STEPS.allowedBeforeExpiry));
@@ -57,6 +58,164 @@ describe("OpenShell exact-main credential generation-window proof", () => {
     expect(script).not.toContain(MCP_BRIDGE_TEST_CREDENTIALS.generationWindow);
   });
 
+  it("settles a request when the response closes before ending (#10155)", async () => {
+    const writes = new Map<string, string>();
+    let control: string = CREDENTIAL_WINDOW_STEPS.deniedAfterDetach;
+    let stdout = "";
+    let stderr = "";
+    const script = buildCredentialWindowChildScript({
+      mcpUrl: "https://credential-window.example.test/mcp",
+      maxRuntimeMs: 10_000,
+    });
+    const response = Object.assign(new EventEmitter(), {
+      readableEnded: false,
+      resume: () => response,
+      statusCode: 200,
+    });
+    const https = {
+      request: (_options: unknown, onResponse: (value: typeof response) => void) => {
+        const outbound = Object.assign(new EventEmitter(), {
+          destroy: () => outbound,
+          end: () => {
+            onResponse(response);
+            queueMicrotask(() => response.emit("close"));
+            return outbound;
+          },
+          setTimeout: () => outbound,
+        });
+        return outbound;
+      },
+    };
+    const fileSystem = {
+      existsSync: () => true,
+      readFileSync: () => control,
+      writeFileSync: (file: string, value: string) => {
+        writes.set(file, value);
+        control =
+          file === CREDENTIAL_WINDOW_PATHS.acknowledgement ? CREDENTIAL_WINDOW_STEPS.stop : control;
+      },
+    };
+    const builtins = new Map<string, unknown>([
+      ["node:fs", fileSystem],
+      ["node:https", https],
+    ]);
+    const childProcess = {
+      env: {
+        [CREDENTIAL_WINDOW_ENV_NAME]: `openshell:resolve:env:v7_${CREDENTIAL_WINDOW_ENV_NAME}`,
+      },
+      exitCode: undefined as number | undefined,
+      stderr: {
+        write: (value: string) => {
+          stderr += value;
+          return true;
+        },
+      },
+      stdout: {
+        write: (value: string) => {
+          stdout += value;
+          return true;
+        },
+      },
+    };
+
+    await (vm.runInNewContext(script, {
+      Buffer,
+      URL,
+      process: childProcess,
+      queueMicrotask,
+      require: (id: string) =>
+        builtins.get(id) ??
+        (() => {
+          throw new Error(`unexpected child require: ${id}`);
+        })(),
+      setTimeout: (callback: () => void) => {
+        queueMicrotask(callback);
+        return 1;
+      },
+    }) as Promise<void>);
+
+    const observation = {
+      step: CREDENTIAL_WINDOW_STEPS.deniedAfterDetach,
+      outcome: "denied",
+      statusCode: null,
+      errorCode: "PREMATURE_CLOSE",
+    };
+    expect(stderr).toBe("");
+    expect(childProcess.exitCode).toBeUndefined();
+    expect(JSON.parse(writes.get(CREDENTIAL_WINDOW_PATHS.acknowledgement) ?? "")).toEqual(
+      observation,
+    );
+    expect(JSON.parse(stdout)).toEqual({ revision: "v7", outcomes: [observation] });
+  });
+
+  it("accepts bounded request diagnostics and rejects raw error text (#10155)", () => {
+    expect(
+      parseCredentialWindowRequestObservation(
+        JSON.stringify({
+          step: CREDENTIAL_WINDOW_STEPS.allowedBeforeExpiry,
+          outcome: "allowed",
+          statusCode: 200,
+          errorCode: null,
+        }),
+      ),
+    ).toEqual({
+      step: CREDENTIAL_WINDOW_STEPS.allowedBeforeExpiry,
+      outcome: "allowed",
+      statusCode: 200,
+      errorCode: null,
+    });
+    expect(
+      parseCredentialWindowRequestObservation(
+        JSON.stringify({
+          step: CREDENTIAL_WINDOW_STEPS.deniedAfterExpiry,
+          outcome: "denied",
+          statusCode: 503,
+          errorCode: null,
+        }),
+      ),
+    ).toEqual({
+      step: CREDENTIAL_WINDOW_STEPS.deniedAfterExpiry,
+      outcome: "denied",
+      statusCode: 503,
+      errorCode: null,
+    });
+    expect(
+      parseCredentialWindowRequestObservation(
+        JSON.stringify({
+          step: CREDENTIAL_WINDOW_STEPS.deniedAfterDetach,
+          outcome: "denied",
+          statusCode: null,
+          errorCode: "ECONNRESET",
+        }),
+      ),
+    ).toEqual({
+      step: CREDENTIAL_WINDOW_STEPS.deniedAfterDetach,
+      outcome: "denied",
+      statusCode: null,
+      errorCode: "ECONNRESET",
+    });
+    expect(
+      parseCredentialWindowRequestObservation(
+        JSON.stringify({
+          step: CREDENTIAL_WINDOW_STEPS.deniedAfterDetach,
+          outcome: "denied",
+          statusCode: null,
+          errorCode: "Error: fixture credential leaked",
+        }),
+      ),
+    ).toBeNull();
+    expect(
+      parseCredentialWindowRequestObservation(
+        JSON.stringify({
+          step: CREDENTIAL_WINDOW_STEPS.allowedBeforeExpiry,
+          outcome: "allowed",
+          statusCode: 401,
+          errorCode: null,
+        }),
+      ),
+    ).toBeNull();
+  });
+
   it("builds explicit bounded expiry and attached-key-removal updates", () => {
     expect(CREDENTIAL_WINDOW_EXPIRY_DELAY_MS).toBe(3 * 60_000);
     expect(buildCredentialWindowProviderUpdateArgs("owned-provider", 123_456)).toEqual([

test/e2e/README.md

@@ -90,16 +90,17 @@ After the checks pass, the action restores root `dist/` and `nemoclaw/dist/share
 If the version command fails, the action stops before the live test runs.
 This boundary keeps candidate source separate from the trusted workflow implementation.
 
-For a same-repository PR that changes a managed-image workflow path, the trusted planner also
-requires one successful `Images / Managed Images` run for the candidate commit. Before candidate
-checkout, the planner downloads the three nonexpired contract artifacts by immutable artifact ID.
-It verifies each artifact digest, producer run, attempt, and candidate commit. The planner rejects a
-missing, incomplete, or mixed all-agent publication before E2E jobs start.
-
-The planner adds the exact all-agent catalog to `dist/` after the candidate CLI build completes.
-Each live E2E consumer verifies that the catalog source revision matches `checkout_sha`. A PR that
-does not change a managed-image workflow path keeps the released catalog behavior. The GitHub token
-is available only to the trusted planner job and is not included in the candidate CLI artifact.
+For a manual PR run, the trusted planner compares the immutable base and
+candidate commit trees with the base-image and managed-image input paths. When
+those inputs are unchanged, the run uses the applicable trusted managed-image
+publication from `main`. When any input changed, the run builds the candidate
+Dockerfiles locally instead of waiting for a candidate publication.
+
+The native startup jobs build the local candidate bases for each platform. The
+AMD64 producer passes their exact digests and build caches to the protected GPU
+job. That job rebuilds with networking disabled and rejects any digest mismatch
+before it runs Ollama, NIM, or vLLM qualification. The GitHub token is available
+only to the trusted planner and is not included in the candidate CLI artifact.
 
 The same-repository `Images / Managed Images` PR workflow also runs the OpenClaw managed-image MCP
 discovery and lifecycle scope in two independent matrix jobs. Each job assembles one exact candidate