fix(security): consume verified audits in offline image rebuilds

Dockerfile

@@ -546,6 +546,7 @@
 COPY scripts/lib/reviewed-npm-audit.mts /scripts/lib/reviewed-npm-audit.mts
 COPY scripts/lib/npm-audit-receipt.mts /scripts/lib/npm-audit-receipt.mts
 COPY scripts/lib/openclaw-npm-remediation.mts /scripts/lib/openclaw-npm-remediation.mts
+COPY scripts/lib/verify-mcporter-audit.sh /scripts/lib/verify-mcporter-audit.sh
 COPY scripts/patch-bundled-npm-brace-expansion.mts /scripts/patch-bundled-npm-brace-expansion.mts
 COPY scripts/lib/patch-bundled-npm-ip-address.mts /scripts/lib/patch-bundled-npm-ip-address.mts
 COPY scripts/patch-bundled-npm-tar.mts /scripts/patch-bundled-npm-tar.mts
@@ -599,6 +600,13 @@
 COPY nemoclaw-blueprint/openclaw-plugins/ /usr/local/share/nemoclaw/openclaw-plugins/
 COPY --from=mcp-tool-discovery-runtime /opt/mcp-tool-discovery-runtime/dist/ /usr/local/lib/nemoclaw/mcp-tool-discovery-runtime/
 
+# Keep optional audit evidence in an uncommitted mount source. The checked-in
+# seed has no reviewed-npm-audit directory, so ordinary builds still perform a
+# live audit. Protected builders import validated evidence into the seed before
+# invoking this Dockerfile with network access disabled.
+FROM scratch AS protected-mcporter-audit-cache
+COPY tools/mcp-tool-discovery-runtime/npm-cache-seed/ /seed/
+
 # Stage 3: Runtime image — pull cached base from GHCR
 # hadolint ignore=DL3006
 FROM ${BASE_IMAGE}
@@ -823,6 +831,7 @@
 RUN --network=default \
     --mount=type=secret,id=nemoclaw-mcporter-audit-receipt,required=false \
     --mount=type=secret,id=nemoclaw-mcporter-audit-raw-report,required=false \
+    --mount=type=bind,from=protected-mcporter-audit-cache,source=/seed,target=/run/nemoclaw-mcporter-audit-cache \
     set -eu; \
     if [ -f /usr/local/share/nemoclaw/corporate-ca.pem ]; then \
         export CURL_CA_BUNDLE=/usr/local/share/nemoclaw/corporate-ca.pem; \
@@ -986,24 +995,7 @@
         ln -s /usr/local/lib/nemoclaw/mcporter-runtime/node_modules/.bin/mcporter /usr/local/bin/mcporter; \
         test "$(mcporter --version)" = "$MCPORTER_VERSION"; \
     fi; \
-    MCPORTER_RECEIPT=/run/secrets/nemoclaw-mcporter-audit-receipt; \
-    MCPORTER_RAW_REPORT=/run/secrets/nemoclaw-mcporter-audit-raw-report; \
-    if [ -f "$MCPORTER_RECEIPT" ] || [ -f "$MCPORTER_RAW_REPORT" ] || [ -n "${NEMOCLAW_MCPORTER_AUDIT_RECEIPT_SHA256:-}" ]; then \
-        [ -f "$MCPORTER_RECEIPT" ] && [ -f "$MCPORTER_RAW_REPORT" ] && printf %s "$NEMOCLAW_MCPORTER_AUDIT_RECEIPT_SHA256" | grep -qxE '[0-9a-f]{64}' \
-            || { echo "ERROR: cached mcporter audit requires paired receipt, raw report, and receipt SHA-256" >&2; exit 1; }; \
-        printf '%s  %s\n' "$NEMOCLAW_MCPORTER_AUDIT_RECEIPT_SHA256" "$MCPORTER_RECEIPT" | sha256sum -c -; \
-node --experimental-strip-types /scripts/lib/npm-audit-receipt.mts \
---receipt "$MCPORTER_RECEIPT" \
---package-json /usr/local/lib/nemoclaw/mcporter-runtime/package.json \
---package-lock /usr/local/lib/nemoclaw/mcporter-runtime/package-lock.json \
---raw-report "$MCPORTER_RAW_REPORT" --exceptions /scripts/npm-audit-exceptions.json \
---graph mcporter-runtime --audit-config /scripts/reviewed-npm-audit.json \
---registry https://registry.yarnpkg.com --threshold high --legacy-npmjs true; \
-    else \
-        node --experimental-strip-types /scripts/lib/reviewed-npm-audit.mts \
-            --directory /usr/local/lib/nemoclaw/mcporter-runtime \
-            --exceptions /scripts/npm-audit-exceptions.json --graph mcporter-runtime --threshold high; \
-    fi
+    bash /scripts/lib/verify-mcporter-audit.sh
 
 # Patch OpenClaw media fetch for proxy-only sandbox (NVIDIA/NemoClaw#1755).
 #
@@ -1575,10 +1567,10 @@
 # CHAT_UI_URL is a non-loopback address (Brev Launchable, remote deployments)
 # since terminal-based pairing is impossible in those contexts.
 # Default: "0" (device auth enabled for local deployments — secure by default).
 ARG NEMOCLAW_DISABLE_DEVICE_AUTH=0
 # Internal audit provenance for the opt-out above. Standard onboarding rewrites
 # this to managed-onboard; direct image builders retain operator provenance.
 ARG NEMOCLAW_DEVICE_AUTH_OPT_OUT_SOURCE=operator
 # Compatibility build arg for older custom Dockerfiles and rebuild tooling.
 # NemoClaw-managed images intentionally do not consume it; gateway auth tokens
 # are generated at container startup and are never baked into image layers.
@@ -1612,7 +1604,7 @@
 # NEMOCLAW_MESSAGING_PLAN_B64 intentionally remains ARG-only: Docker exposes it
 # to build RUN processes without retaining the full plan in the final image env.
 # Direct ARG interpolation into inline source is a code injection vector (C-2).
 ENV NEMOCLAW_MODEL=${NEMOCLAW_MODEL} \
     NEMOCLAW_INFERENCE_PROVIDER_ID=${NEMOCLAW_INFERENCE_PROVIDER_ID} \
     NEMOCLAW_UPSTREAM_PROVIDER=${NEMOCLAW_UPSTREAM_PROVIDER} \
     NEMOCLAW_PRIMARY_MODEL_REF=${NEMOCLAW_PRIMARY_MODEL_REF} \

Dockerfile.protected-npm-audit

@@ -0,0 +1,31 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# Produce reviewed mcporter audit evidence on the networked managed-image
+# builder so the protected rebuild can stay fully offline.
+FROM node:22-trixie-slim@sha256:db8a96a63e5264607ada2d206758876ebbed6a12be2ada7517793cbfb0c2a29c AS protected-mcporter-audit
+ENV RUNNER_TEMP=/tmp
+WORKDIR /opt/nemoclaw-audit
+COPY .github/actions/ci-reviewed-npm-audit/verify-and-install-npm.sh .github/actions/ci-reviewed-npm-audit/verify-and-install-npm.sh
+COPY ci/npm-audit-exceptions.json ci/reviewed-npm-audit.json ci/
+COPY scripts/audit-reviewed-npm-graph.mts scripts/audit-reviewed-npm-graph.mts
+COPY scripts/lib/npm-audit-receipt.mts scripts/lib/openclaw-npm-remediation.mts scripts/lib/repository-input-path.mts scripts/lib/reviewed-npm-archive.mts scripts/lib/reviewed-npm-audit.mts scripts/lib/
+COPY agents/openclaw/mcporter-runtime/package.json agents/openclaw/mcporter-runtime/package-lock.json agents/openclaw/mcporter-runtime/
+# hadolint ignore=DL3016,DL4006,SC2155
+RUN --network=default set -eu; \
+    export NEMOCLAW_REVIEWED_NPM_VERSION="$(node -p "require('./ci/reviewed-npm-audit.json').npmVersion")"; \
+    export NEMOCLAW_REVIEWED_NPM_INTEGRITY="$(node -p "require('./ci/reviewed-npm-audit.json').npmIntegrity")"; \
+    env -u NODE_AUTH_TOKEN -u NPM_TOKEN -u NPM_CONFIG__AUTH_TOKEN \
+        bash .github/actions/ci-reviewed-npm-audit/verify-and-install-npm.sh; \
+    test "$(npm --version)" = "$NEMOCLAW_REVIEWED_NPM_VERSION"
+RUN --network=default env \
+    -u NODE_AUTH_TOKEN -u NPM_TOKEN -u NPM_CONFIG__AUTH_TOKEN \
+    NEMOCLAW_REVIEWED_NPM_AUDIT_LOCKED_GRAPH=mcporter-runtime \
+    NEMOCLAW_REVIEWED_NPM_AUDIT_REPORT_DIR=artifacts/reviewed-npm-audit \
+    NPM_CONFIG_REGISTRY=https://registry.npmjs.org/ \
+    NPM_CONFIG_USERCONFIG=/dev/null \
+    node --experimental-strip-types scripts/audit-reviewed-npm-graph.mts
+
+FROM scratch AS protected-mcporter-audit-evidence
+COPY --from=protected-mcporter-audit --chmod=0400 /opt/nemoclaw-audit/artifacts/reviewed-npm-audit/mcporter-runtime.receipt.json /mcporter-runtime.receipt.json
+COPY --from=protected-mcporter-audit --chmod=0400 /opt/nemoclaw-audit/artifacts/reviewed-npm-audit/mcporter-runtime.raw.json /mcporter-runtime.raw.json

scripts/audit-reviewed-npm-graph.mts

@@ -72,6 +72,16 @@ type ReviewedAuditReport = Readonly<{
   threshold?: Severity;
 }>;
 
+export function selectLockedGraph(
+  config: Readonly<{ lockedGraphs: readonly LockedGraph[] }>,
+  graphId: string | undefined,
+): Readonly<{ graph: LockedGraph; index: number }> | undefined {
+  if (!graphId) return undefined;
+  const index = config.lockedGraphs.findIndex((graph) => graph.id === graphId);
+  if (index < 0) throw new Error("reviewed npm audit locked graph is not configured");
+  return { graph: config.lockedGraphs[index]!, index };
+}
+
 const TRUSTED_REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const TARGET_REPO_ROOT = fs.realpathSync(
   path.resolve(process.env.NEMOCLAW_REVIEWED_NPM_AUDIT_TARGET_ROOT ?? TRUSTED_REPO_ROOT),
@@ -873,6 +883,10 @@ export function assertReviewedAuditReportsPass(
 
 function main(): void {
   const config = readConfig();
+  const selectedLockedGraph = selectLockedGraph(
+    config,
+    process.env.NEMOCLAW_REVIEWED_NPM_AUDIT_LOCKED_GRAPH,
+  );
   const expectedNode = `v${config.nodeVersion}`;
   if (process.version !== expectedNode) {
     throw new Error(`reviewed npm audit requires Node ${expectedNode}; running ${process.version}`);
@@ -901,6 +915,43 @@ function main(): void {
   }
   const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-reviewed-npm-audit-"));
   try {
+    if (selectedLockedGraph) {
+      const { graph, index } = selectedLockedGraph;
+      const result = auditLockedGraph(
+        graph,
+        index,
+        config,
+        tempRoot,
+        exceptionFile,
+        artifactDirectory,
+        npmVersion,
+      );
+      assertReviewedAuditReportsPass(
+        [{ label: graph.label, threshold: graph.severityThreshold, result }],
+        config.severityThreshold,
+      );
+      emitAuditReceipt({
+        artifactDirectory,
+        graphId: graph.id,
+        npmVersion,
+        packageJsonFile: targetRepositoryPath(
+          path.join(graph.directory, "package.json"),
+          `${graph.label} package manifest`,
+        ),
+        packageLockFile: targetRepositoryPath(
+          path.join(graph.directory, "package-lock.json"),
+          `${graph.label} lockfile`,
+        ),
+        rawReportFile: path.join(
+          artifactDirectory,
+          `locked-graph-${index + 1}.json`,
+        ),
+        registryOrigin: NPM_AUDIT_REGISTRY,
+        result,
+        threshold: graph.severityThreshold ?? config.severityThreshold,
+      });
+      return;
+    }
     const sourceResult = auditSourceGraph(
       config,
       tempRoot,

scripts/checks/build-protected-managed-images.sh

@@ -167,6 +167,65 @@ for command in curl docker jq node sha256sum; do
   }
 done
 
+audit_evidence_dir=""
+audit_receipt=""
+audit_raw_report=""
+audit_receipt_sha256=""
+if [[ -n "$cache_to" ]]; then
+  audit_evidence_dir="$cache_to/reviewed-npm-audit"
+  docker buildx build \
+    --file "$source_root/Dockerfile.protected-npm-audit" \
+    --platform "$platform" \
+    --target protected-mcporter-audit-evidence \
+    --output "type=local,dest=${audit_evidence_dir}" \
+    --provenance=false \
+    --sbom=false \
+    "$source_root"
+elif [[ -n "$cache_from" ]]; then
+  audit_evidence_dir="$cache_from/reviewed-npm-audit"
+fi
+
+if [[ -n "$audit_evidence_dir" ]]; then
+  [[ -d "$audit_evidence_dir" && ! -L "$audit_evidence_dir" ]] || {
+    echo "ERROR: protected managed-image cache has no reviewed mcporter audit evidence" >&2
+    exit 1
+  }
+  [[ -z "$(find "$audit_evidence_dir" -type l -print -quit)" ]] || {
+    echo "ERROR: protected managed-image reviewed audit evidence contains a symlink" >&2
+    exit 1
+  }
+  audit_receipt="$audit_evidence_dir/mcporter-runtime.receipt.json"
+  audit_raw_report="$audit_evidence_dir/mcporter-runtime.raw.json"
+  audit_receipt_sha_file="$audit_evidence_dir/mcporter-runtime.receipt.sha256"
+  [[ -f "$audit_receipt" && ! -L "$audit_receipt" && -s "$audit_receipt" ]] || {
+    echo "ERROR: protected managed-image reviewed audit receipt is missing or unsafe" >&2
+    exit 1
+  }
+  [[ -f "$audit_raw_report" && ! -L "$audit_raw_report" && -s "$audit_raw_report" ]] || {
+    echo "ERROR: protected managed-image reviewed audit raw report is missing or unsafe" >&2
+    exit 1
+  }
+  audit_receipt_sha256="$(sha256sum "$audit_receipt" | awk '{print $1}')"
+  [[ "$audit_receipt_sha256" =~ ^[a-f0-9]{64}$ ]] || {
+    echo "ERROR: protected managed-image reviewed audit receipt hash is invalid" >&2
+    exit 1
+  }
+  if [[ -n "$cache_to" ]]; then
+    printf '%s\n' "$audit_receipt_sha256" >"$audit_receipt_sha_file"
+    chmod 0400 "$audit_receipt_sha_file"
+  else
+    [[ -f "$audit_receipt_sha_file" && ! -L "$audit_receipt_sha_file" ]] || {
+      echo "ERROR: protected managed-image reviewed audit receipt hash is missing or unsafe" >&2
+      exit 1
+    }
+    read -r recorded_audit_receipt_sha256 <"$audit_receipt_sha_file"
+    [[ "$recorded_audit_receipt_sha256" =~ ^[a-f0-9]{64}$ && "$recorded_audit_receipt_sha256" == "$audit_receipt_sha256" ]] || {
+      echo "ERROR: protected managed-image reviewed audit receipt hash does not match" >&2
+      exit 1
+    }
+  fi
+fi
+
 work_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/nemoclaw-protected-images.XXXXXX")"
 seed_overlay_active=0
 seed_backup="$work_dir/npm-cache-seed-original"
@@ -193,6 +252,17 @@ trap restore_worktree EXIT
 trap 'exit 130' INT
 trap 'exit 143' TERM
 
+if [[ -n "$cache_to" ]]; then
+  cp -pR -- "$source_seed_dir" "$seed_backup"
+  seed_overlay_active=1
+  install -d -m 0700 "$source_seed_dir/reviewed-npm-audit"
+  install -m 0400 \
+    "$audit_receipt" \
+    "$audit_raw_report" \
+    "$audit_receipt_sha_file" \
+    "$source_seed_dir/reviewed-npm-audit/"
+fi
+
 if [[ -n "$cache_from" ]]; then
   imported_seed="$work_dir/npm-cache-seed-import"
   node --experimental-strip-types --no-warnings "$seed_helper" copy \
@@ -363,6 +433,13 @@ build_agent() {
       cache_args+=(--cache-from "type=local,src=${cache_source}")
     fi
   fi
+  if [[ "$agent" == "openclaw" && -n "$audit_receipt" ]]; then
+    cache_args+=(
+      --secret "id=nemoclaw-mcporter-audit-receipt,src=${audit_receipt}"
+      --secret "id=nemoclaw-mcporter-audit-raw-report,src=${audit_raw_report}"
+      --build-arg "NEMOCLAW_MCPORTER_AUDIT_RECEIPT_SHA256=${audit_receipt_sha256}"
+    )
+  fi
 
   local base_digest="${base_reference##*@}"
   docker buildx imagetools inspect "$base_reference" --raw >"$exact_base_raw"
@@ -489,6 +566,9 @@ if [[ -n "$cache_to" ]]; then
     --os "$npm_target_os" \
     --cpu "$npm_target_cpu" \
     --libc "$npm_target_libc"
+  cp -pR -- \
+    "$source_seed_dir/reviewed-npm-audit" \
+    "$cache_to/npm-cache-seed/reviewed-npm-audit"
   node --experimental-strip-types --no-warnings "$seed_helper" export \
     --lockfile "$source_mcp_lockfile" \
     --output "$cache_to/mcp-runtime-npm-cache-seed" \