feat(openshell): add external gateway status

.github/actions/ci-build-typecheck/action.yaml

@@ -32,6 +32,8 @@ runs:
 
     - name: Verify compiled package contracts
       shell: bash
+      env:
+        NPM_CONFIG_CACHE: ${{ runner.temp }}/npm
       run: npx vitest run --project package-contract
 
     - name: Typecheck CLI + tests

.github/workflows/e2e.yaml

@@ -770,11 +770,18 @@ jobs:
             { echo "::error::checked-out commit does not match the artifact candidate SHA"; exit 1; }
           [[ "$RUN_ATTEMPT" =~ ^[1-9][0-9]*$ && "$RUN_ID" =~ ^[1-9][0-9]*$ ]] ||
             { echo "::error::workflow run identity is invalid"; exit 1; }
-          for required_file in dist/nemoclaw.js dist/build-identity.json; do
+          for required_file in \
+            dist/nemoclaw.js \
+            dist/build-identity.json \
+            dist/lib/blueprint-runner.js \
+            dist/nemoclaw/package.json \
+            dist/nemoclaw/blueprint/runner.js; do
             [[ -f "$required_file" && ! -L "$required_file" && -s "$required_file" ]] ||
               { echo "::error::candidate CLI build output is missing or is not a nonempty regular file: $required_file"; exit 1; }
           done
           for boundary in \
+            openshell-gateway-health-sdk.js \
+            openshell-observation-boundary.cjs \
             openshell-policy-boundary.cjs \
             sandbox-name.cjs \
             snapshot-sanitizer-boundary.cjs; do
@@ -790,6 +797,12 @@ jobs:
             .sourceRevision == $candidateSha
           ' dist/build-identity.json >/dev/null ||
             { echo "::error::candidate CLI build identity does not match the candidate commit SHA"; exit 1; }
+          jq -e '
+            type == "object" and
+            (keys | sort) == ["type"] and
+            .type == "module"
+          ' dist/nemoclaw/package.json >/dev/null ||
+            { echo "::error::candidate Blueprint Runner module boundary is invalid"; exit 1; }
 
           # BEGIN exact managed-image catalog staging
           managed_catalog="${RUNNER_TEMP}/pr-managed-image-catalog.json"
@@ -3400,7 +3413,7 @@ jobs:
       E2E_DEFAULT_ENABLED: "0"
       E2E_TARGET_ID: "external-gateway-health"
       E2E_AGENT_RUNTIME: "none"
-      E2E_OBSERVABLE_OUTCOME: "The reviewed SDK observes exact public gateway health over explicit HTTPS and CA"
+      E2E_OBSERVABLE_OUTCOME: "The exact Blueprint Runner observes public gateway health over explicit HTTPS and CA"
       E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu host with OpenShell 0.0.106; no inference endpoint"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/external-gateway-health
       NEMOCLAW_RUN_LIVE_E2E: "1"

.gitignore

@@ -7,6 +7,7 @@
 __pycache__/
 coverage/
 dist/
+nemoclaw/runner-dist/
 artifacts/pr-review-advisor-local/
 docs/_build/
 node_modules/

ci/source-architecture-budget.json

@@ -25,7 +25,7 @@
       "src/lib/messaging/channels/index.ts": 25,
       "src/lib/onboard/gateway-binding.ts": 53,
       "src/lib/runner.ts": 85,
-      "src/lib/security/redact.ts": 54,
+      "src/lib/security/redact.ts": 55,
       "src/lib/state/onboard-session.ts": 36,
       "src/lib/state/mcp-lifecycle-lock.ts": 21,
       "src/lib/state/registry.ts": 100,

ci/source-shape-test-budget.json

@@ -191,6 +191,11 @@
       "test": "provides the package token only to trusted main dependency installation",
       "category": "security"
     },
+    {
+      "file": "test/automation/pull-requests/pr-workflow-contract.test.ts",
+      "test": "reuses the trusted dependency cache for offline package contracts",
+      "category": "security"
+    },
     {
       "file": "test/automation/pull-requests/pr-workflow-contract.test.ts",
       "test": "passes only the base-packaged SDK archive to pull request dependency jobs",

internal/security-reviews/openshell-typescript-sdk-0.0.106-dependency-review.md

@@ -0,0 +1,154 @@
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+# OpenShell TypeScript SDK 0.0.106 dependency review
+
+> Internal engineering evidence. This file is not part of the public documentation set.
+
+## Status and scope
+
+Issue #9872 permits `@nvidia/openshell-sdk@0.0.106` for one bounded public gateway-health call.
+The slice reads no machine credential and makes no authenticated or mutating call.
+
+This review applies only to the exact source, package, and runtime graph below.
+It does not qualify a Runner image or approve machine authentication.
+
+## Source and package identity
+
+| Evidence | Reviewed value |
+| --- | --- |
+| OpenShell tag | `v0.0.106` |
+| Source commit | `c4b500a7de64d0b66e3ee8098f58d14299092162` |
+| Package | `@nvidia/openshell-sdk@0.0.106` |
+| Registry | GitHub Packages |
+| Package version ID | `1134230109` |
+| Package SHA-512 integrity | `sha512-dB4mLex23Pnw61caGMR2CMHQihy9bj7IK2elJJd718k3yevm+fOt/vG6dJg8/5us4la2BwcOdRwLvOia3tdwFw==` |
+| Observed package SHA-256 | `30ae4c4749a610cc6e9b22067ece61f6137ba858acf5102c23cb81c37c4cc3fb` |
+| Producer run | `31809093046`, attempt 2, job `94864069197` |
+
+The registry metadata and the OpenShell tag identify the same source commit.
+The package has no registry signature or provenance attestation.
+The root package lock binds the exact registry URL and SHA-512 integrity.
+A later SDK version requires a new dependency review.
+
+## Selected runtime graph
+
+| Package | Version | Declared license |
+| --- | --- | --- |
+| `@nvidia/openshell-sdk` | `0.0.106` | Apache-2.0 |
+| `@bufbuild/protobuf` | `2.12.1` | Apache-2.0 AND BSD-3-Clause |
+| `@connectrpc/connect` | `2.1.2` | Apache-2.0 |
+| `@connectrpc/connect-node` | `2.1.2` | Apache-2.0 |
+
+The root manifest records all four packages as exact optional dependencies.
+The package lock pins each version and package integrity for source installs.
+None of these packages defines an install lifecycle script.
+
+## API and security contract
+
+NemoClaw uses `OpenShellClient.connect({ gateway, caCert })` from the official SDK. It calls the
+SDK-documented `client.raw.health()` operation over the shared transport created and owned by that
+client. NemoClaw does not import ConnectRPC, create a generated client, or create an HTTP/2 session.
+
+The health adapter:
+
+- Accepts only the validated HTTPS endpoint and CA.
+- Gives the endpoint and a copy of the CA bytes to the official SDK without an authentication token,
+  client certificate, client key, or insecure TLS option.
+- Retains the SDK's normal TLS certificate and hostname verification.
+- Starts one five-second deadline before local SDK loading and bounds adapter return through SDK
+  client creation and public health.
+- Passes that same deadline signal to the SDK health operation.
+- Passes no token, client certificate, client key, CLI state, or insecure TLS option.
+- Replaces SDK import and transport details with fixed messages.
+- Uses no direct transport or fallback.
+
+The SDK does not expose a DNS lookup hook or transport close handle. It uses the platform resolver
+when the explicit endpoint contains a hostname. The configured CA and TLS hostname check still
+authenticate the remote endpoint, but NemoClaw cannot pin one DNS answer set through this SDK API.
+Under the accepted initial contract, cluster and storage administrators are trusted infrastructure
+actors, and this operation sends only unauthenticated public health. A later change that sends a
+credential or accepts a broader trust model must revisit DNS rebinding and transport ownership.
+
+The SDK client is lazy.
+Public health is the first network request.
+Identity, workspace inventory, provider inventory, authentication, and mutation remain outside this slice.
+
+## Installation and redistribution
+
+The root NemoClaw package records the SDK and its three runtime dependencies as exact optional dependencies.
+Installations that do not use external gateway status can omit private-registry access.
+The root package exposes the Blueprint Runner executable.
+The OpenClaw plugin package and lock do not contain the SDK.
+The reviewed package workflow from PR #10368 supplies exact SDK bytes to untrusted CI without package credentials.
+
+If the runtime omits the SDK or exposes an incompatible client, external gateway status returns a fixed package-unavailable error before a network request.
+The result exposes no import detail and starts no fallback.
+
+The SDK and its three runtime dependency archives omit license and notice files.
+Before a Runner image distributes this graph, the image release must include the applicable Apache-2.0 and BSD-3-Clause license texts.
+The image software bill of materials and third-party notice must bind to the installed graph.
+
+## Concern records
+
+### DEP-1: Package substitution
+
+- Severity and confidence: high, high confidence.
+- Failure mode: another package or transitive version executes in the Runner.
+- Control: pin the SDK and each runtime dependency exactly in the published root manifest, and pin each package URL and integrity in the source lock.
+- Verification: compiled package installation and Runner package-contract tests.
+
+### DEP-2: Package credential exposure
+
+- Severity and confidence: high, high confidence.
+- Failure mode: candidate code or an unreviewed dependency receives the package credential.
+- Control: use the reviewed base-controlled package workflow from PR #10368.
+- Verification: workflow and integration tests owned by that merged change.
+
+### DEP-3: Optional dependency absence or initialization failure
+
+- Severity and confidence: medium, high confidence.
+- Failure mode: package failure looks like a gateway outage, or import detail reaches output.
+- Control: validate the official SDK client export and generated service-status enum before network
+  access, then return a fixed package-unavailable error.
+- Verification: focused adapter tests and the compiled package contract.
+
+### DEP-4: DNS rebinding or local-target substitution
+
+- Severity and confidence: high, high confidence.
+- Failure mode: a validated hostname resolves or rebinds to a local service when the request starts.
+- Control: the official SDK retains TLS certificate and hostname verification against the explicit
+  CA, and the slice sends only unauthenticated public health. The accepted initial contract treats
+  platform infrastructure administrators as trusted.
+- Residual: SDK 0.0.106 does not expose a pinned lookup. A hostname can resolve differently between
+  validation and connection, including to a local address. TLS identity verification prevents an
+  unrelated local service from impersonating the configured gateway, but it does not prevent the
+  connection attempt.
+- Verification: wrong-CA and wrong-hostname package tests; independent security review must keep
+  this residual visible.
+
+### DEP-5: Transport outlives the bounded observation
+
+- Severity and confidence: high, high confidence.
+- Failure mode: request cancellation returns, but the HTTP/2 session keeps the Runner process alive.
+- Control: pass the one total deadline signal to the official SDK health operation and retain the
+  bounded Kubernetes Job deadline as the outer control. A late local SDK import cannot start a
+  network request because health begins only after the bounded load returns.
+- Residual: SDK 0.0.106 exposes no transport close handle.
+- Verification: adapter deadline tests and a packaged Runner test against a stalled TLS peer prove
+  that the Runner returns and the process exits within the package boundary.
+
+### DEP-6: Redistribution evidence
+
+- Severity and confidence: medium, high confidence.
+- Failure mode: a Runner image omits license evidence or claims unavailable provenance.
+- Control: bind the image software bill of materials and license inventory to the installed graph.
+- Verification: future Runner image release evidence.
+
+## Remaining gates
+
+- The feature must pass focused, package, type, build, and repository checks on its final commit.
+- The final security review must explicitly assess the SDK's standard DNS resolution and lack of a
+  transport close handle; this review does not claim address pinning or session ownership.
+- The future Runner image must prove the exact SDK runtime identity, software bill of materials, and license inventory.
+- A separate accepted decision must define machine authentication before credential reads or authenticated calls start.