refactor(mcp): make lifecycle source-backed

.github/workflows/e2e.yaml

@@ -4471,6 +4471,7 @@ jobs:
             --revision "$CHECKOUT_SHA" \
             --cohort "$NEMOCLAW_PROTECTED_MANAGED_IMAGE_COHORT" \
             --platform "$NEMOCLAW_PROTECTED_MANAGED_IMAGE_PLATFORM" \
+            --runtime-user sandbox \
             --openclaw-base "$BASE_OPENCLAW" \
             --hermes-base "$BASE_HERMES" \
             --dcode-base "$BASE_DCODE" \

agents/hermes/Dockerfile

@@ -6,7 +6,7 @@
 # Layers PR-specific code (plugin, config, startup script) on top of the
 # pre-built Hermes base image. Mirrors the OpenClaw Dockerfile structure.
 
-ARG BASE_IMAGE=ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@sha256:c588bf76ba1c280f8a366bdfd672193e852de4f509a280662c7070a9b6e2fa48
+ARG BASE_IMAGE=ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@sha256:0faf0abc8c62a284ba7dfecfc9afcd52524c0f5710ea9b2523be7c47b2a76582
 ARG NEMOCLAW_CORPORATE_CA_B64=
 ARG NEMOCLAW_MANAGED_IMAGE_CAPABILITY_UNION=0
 # BuildKit supplies this automatic platform argument. The Portable staged
@@ -131,7 +131,6 @@
 COPY agents/hermes/seed-dashboard-config.py /usr/local/lib/nemoclaw/seed-hermes-dashboard-config.py
 COPY agents/hermes/runtime-config-guard.py /usr/local/lib/nemoclaw/hermes-runtime-config-guard.py
 COPY agents/hermes/finalize-tirith-marker.py /usr/local/lib/nemoclaw/finalize-tirith-marker.py
-COPY agents/hermes/build-mcp-digest.py /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py
 COPY agents/hermes/mcp-config-transaction.py /usr/local/lib/nemoclaw/hermes-mcp-config-transaction.py
 COPY agents/hermes/cron-restore-control.py /usr/local/lib/nemoclaw/hermes-cron-restore-control.py
 COPY src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.116.json /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.116.json
@@ -569,10 +568,10 @@
 # minimum supported Hermes sandbox base tag guarantees those artifacts and
 # test/runtime/sandbox/sandbox-rlimit-hooks.test.ts covers that base.
 RUN chmod 755 /usr/local/bin/nemoclaw-start /usr/local/bin/nemoclaw-managed-startup-hold /usr/local/bin/nemoclaw-managed-bootstrap /usr/local/lib/nemoclaw/sandbox-init.sh /usr/local/lib/nemoclaw/validate-hermes-env-secret-boundary.py /usr/local/lib/nemoclaw/patch-hermes-sqlite-temp-store.py /usr/local/lib/nemoclaw/patch-hermes-discord-recovery-permissions.py /usr/local/lib/nemoclaw/seed-hermes-dashboard-config.py /usr/local/lib/nemoclaw/hermes-runtime-config-guard.py /usr/local/lib/nemoclaw/finalize-tirith-marker.py /usr/local/lib/nemoclaw/hermes-mcp-config-transaction.py \
-    && chown root:root /usr/local/bin/nemoclaw-gateway-control /usr/local/lib/nemoclaw/gateway-supervisor.sh /usr/local/lib/nemoclaw/managed-gateway-control.py /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py /usr/local/lib/nemoclaw/hermes-cron-restore-control.py /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.116.json \
+    && chown root:root /usr/local/bin/nemoclaw-gateway-control /usr/local/lib/nemoclaw/gateway-supervisor.sh /usr/local/lib/nemoclaw/managed-gateway-control.py /usr/local/lib/nemoclaw/hermes-cron-restore-control.py /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.116.json \
     && chmod 700 /usr/local/bin/nemoclaw-gateway-control /usr/local/lib/nemoclaw/hermes-cron-restore-control.py \
     && chmod 500 /usr/local/lib/nemoclaw/managed-gateway-control.py \
-    && chmod 444 /usr/local/lib/nemoclaw/corporate-ca-runtime.sh /usr/local/lib/nemoclaw/entrypoint-env-wrapper.sh /usr/local/lib/nemoclaw/gateway-supervisor.sh /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py /usr/local/lib/nemoclaw/managed_policy.py \
+    && chmod 444 /usr/local/lib/nemoclaw/corporate-ca-runtime.sh /usr/local/lib/nemoclaw/entrypoint-env-wrapper.sh /usr/local/lib/nemoclaw/gateway-supervisor.sh /usr/local/lib/nemoclaw/managed_policy.py \
     && chmod 444 /usr/local/lib/nemoclaw/patch-hermes-langfuse-credentials.mts \
     && chmod 444 /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.116.json \
     && /opt/hermes/.venv/bin/python3 -I -c 'import runpy, yaml; assert yaml.safe_load("ready: true")["ready"] is True; runpy.run_path("/usr/local/lib/nemoclaw/hermes-runtime-config-guard.py", run_name="nemoclaw_runtime_config_guard_probe")' \
@@ -686,7 +685,7 @@
 # Hermes v0.20.6 drops explicit auxiliary output limits on custom endpoints.
 # Preserve those limits on NemoClaw's managed inference route so session-title
 # generation cannot occupy Ollama's only inference slot until the context fills.
 ARG NEMOCLAW_HERMES_AUXILIARY_TOKEN_LIMIT_PATCHER_SHA256=d04ffc133e115caddd6a1243979e317a512a4ffd8b259ec2b053a5057c26ba93
 # hadolint ignore=DL4006
 RUN printf '%s  %s\n' \
         "$NEMOCLAW_HERMES_CRON_RUNTIME_PATCHER_SHA256" /opt/nemoclaw-hermes-config/patch-cron-execution-runtime.py \
@@ -1571,16 +1570,10 @@
         /sandbox/.hermes/audio_cache \
         /sandbox/.hermes/skills
 
-# Pin config hash at build time for integrity verification at startup. Invoke
-# the installed runtime guard's `_canonical_mcp_servers_digest` directly so
-# image sealing and runtime verification cannot drift onto different JSON
-# canonicalization contracts.
+# Pin config hash at build time for config and environment integrity verification at startup.
 RUN mkdir -p /etc/nemoclaw \
     && sha256sum /sandbox/.hermes/config.yaml /sandbox/.hermes/.env \
     > /etc/nemoclaw/hermes.config-hash \
-    && mcp_digest="$(/opt/hermes/.venv/bin/python -I /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py --guard /usr/local/lib/nemoclaw/hermes-runtime-config-guard.py --config /sandbox/.hermes/config.yaml)" \
-    && printf '# nemoclaw-hermes-mcp-state-v1 intended=%s applied=%s\n' "$mcp_digest" "$mcp_digest" \
-    >> /etc/nemoclaw/hermes.config-hash \
     && chown root:root /etc/nemoclaw/hermes.config-hash \
     && chmod 444 /etc/nemoclaw/hermes.config-hash
 

agents/hermes/mcp-config-transaction.py

@@ -625,7 +625,7 @@ def inspect_managed_config(payload: dict[str, object]) -> dict[str, object]:
     )
     # TOCTOU contract: this call reads config, env, and every hash anchor into
     # one authenticated snapshot. After comparing the returned config bytes to
-    # host intent, `assert_mcp_integrity_snapshot_current` reopens every path and
+    # the command's requested entry, `assert_mcp_integrity_snapshot_current` reopens every path and
     # requires the same inode/content metadata before any match is reported.
     integrity = guard.inspect_mcp_integrity_snapshot(
         HERMES_DIR, hash_path, compatibility_hash_path
@@ -636,23 +636,23 @@ def inspect_managed_config(payload: dict[str, object]) -> dict[str, object]:
     if parsed is None:
         parsed = {}
     if not isinstance(parsed, dict):
-        raise RuntimeError("Hermes MCP config does not match persisted managed intent")
+        raise RuntimeError("Hermes MCP config does not match the requested native entry")
     servers = parsed.get("mcp_servers", {})
     if servers is None:
         servers = {}
     if not isinstance(servers, dict):
-        raise RuntimeError("Hermes MCP config does not match persisted managed intent")
+        raise RuntimeError("Hermes MCP config does not match the requested native entry")
     present = payload["present"]
     absent = payload["absent"]
     if not isinstance(present, dict) or not isinstance(absent, list):
-        raise RuntimeError("Hermes MCP config does not match persisted managed intent")
+        raise RuntimeError("Hermes MCP config does not match the requested native entry")
     matches = all(
         _managed_candidate_matches(servers.get(name), expected, True)
         for name, expected in present.items()
     )
     matches = matches and all(name not in servers for name in absent)
     if not matches:
-        raise RuntimeError("Hermes MCP config does not match persisted managed intent")
+        raise RuntimeError("Hermes MCP config does not match the requested native entry")
     guard.assert_mcp_integrity_snapshot_current(integrity)
     return {"ok": True, "state": "matched"}
 
@@ -747,12 +747,8 @@ def _refresh_and_verify_hashes(
         HERMES_DIR,
         STRICT_HASH_PATH if privileged else os.path.join(HERMES_DIR, ".config-hash"),
     )
-    expected_state = {
-        "apply": "current",
-        "rollback": "pending",
-    }.get(mcp_transition)
-    if expected_state is not None and state != expected_state:
-        raise RuntimeError("Hermes MCP applied hash state is stale")
+    if state != "current":
+        raise RuntimeError("Hermes config hash is stale")
 
 
 def _restore_hash_snapshots(
@@ -809,12 +805,15 @@ def apply_transaction(action: str, payload: dict[str, object]) -> bool:
     guard = _load_guard()
     original_text, original_snapshot = guard._read_text(CONFIG_PATH)
     _assert_mutable_snapshot(original_snapshot)
-    hash_originals = {
-        path: guard._read_text(path) for path in _managed_hash_paths(privileged)
-    }
     integrity_path = (
         STRICT_HASH_PATH if privileged else os.path.join(HERMES_DIR, ".config-hash")
     )
+    # Direct Hermes configuration changes are authoritative. Adopt the current
+    # source bytes into the file-integrity seal before this scoped mutation.
+    _refresh_and_verify_hashes(guard, privileged, "adopt")
+    hash_originals = {
+        path: guard._read_text(path) for path in _managed_hash_paths(privileged)
+    }
     guard.inspect_mcp_integrity(HERMES_DIR, integrity_path)
     parsed = yaml.safe_load(original_text)
     if parsed is None:

agents/hermes/policy-additions.yaml

@@ -23,6 +23,7 @@ filesystem_policy:
     - /app
     - /run/nemoclaw/managed-startup-ca-bundle.pem
     - /run/nemoclaw/managed-startup-runtime.env
+    - /run/nemoclaw/managed-gateway-expected-exit
     - /etc
     - /var/log
     - /var/lib/dpkg                  # Allow package-version inspection without package mutation.