refactor(mcp): make lifecycle source-backed

.github/workflows/base-image.yaml

@@ -44,6 +44,7 @@ on:
       - "test/e2e/live/managed-image-activation-e2e*.ts"
       - "test/e2e/live/mcp-bridge*.ts"
       - "src/lib/actions/sandbox/mcp-bridge-*.ts"
+      - "src/lib/actions/sandbox/mcp-bridge/**"
       - "src/lib/actions/sandbox/openshell-child-visible-credentials.v*.json"
       - "src/lib/actions/sandbox/rebuild-post-restore-phase.ts"
       - "src/lib/agent/candidate-authority.ts"

.github/workflows/e2e-standard-profile.yaml

@@ -30,6 +30,10 @@ on:
       cli_artifact_provenance:
         required: true
         type: string
+      openshell_sdk_artifact_name:
+        required: false
+        type: string
+        default: ""
       managed_image_catalog:
         required: true
         type: string
@@ -418,6 +422,61 @@ jobs:
         with:
           build-cli: "false"
 
+      - name: Validate reviewed OpenShell SDK artifact identity
+        if: ${{ inputs.target_id == 'network-policy' }}
+        shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+        env:
+          SDK_ARTIFACT_NAME: ${{ inputs.openshell_sdk_artifact_name }}
+          RUN_ID: ${{ github.run_id }}
+          RUN_ATTEMPT: ${{ github.run_attempt }}
+        run: |
+          set -euo pipefail
+          [[ "$SDK_ARTIFACT_NAME" =~ ^openshell-sdk-e2e-([1-9][0-9]*)-([1-9][0-9]{0,8})$ ]] || exit 1
+          [[ "${BASH_REMATCH[1]}" == "$RUN_ID" ]] || exit 1
+          producer_attempt="${BASH_REMATCH[2]}"
+          [[ "$RUN_ATTEMPT" =~ ^[1-9][0-9]{0,8}$ ]] || exit 1
+          (( producer_attempt <= RUN_ATTEMPT )) || exit 1
+
+      - name: Check out trusted network-policy SDK verifier
+        if: ${{ inputs.target_id == 'network-policy' }}
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.workflow_sha }}
+          path: .e2e-sdk-verifier
+          persist-credentials: false
+          sparse-checkout: |
+            ci/reviewed-npm-audit.json
+            scripts/audit-reviewed-npm-graph.mts
+            scripts/checks/prepare-ci-npm-install.mts
+            scripts/lib/openclaw-npm-remediation.mts
+            scripts/lib/reviewed-npm-archive.mts
+            scripts/lib/reviewed-npm-audit.mts
+            scripts/lib/npm-audit-receipt.mts
+            scripts/lib/repository-input-path.mts
+          sparse-checkout-cone-mode: false
+
+      - name: Download reviewed network-policy SDK archive
+        if: ${{ inputs.target_id == 'network-policy' }}
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ inputs.openshell_sdk_artifact_name }}
+          path: ${{ runner.temp }}/network-policy-sdk
+
+      - name: Install verified network-policy SDK without package credentials
+        if: ${{ inputs.target_id == 'network-policy' }}
+        shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+        env:
+          NEMOCLAW_CI_NPM_PACKAGE_MODE: artifact
+          NEMOCLAW_CI_TARGET_ROOT: ${{ github.workspace }}
+          NEMOCLAW_CI_NPM_CACHE: ${{ runner.temp }}/network-policy-sdk-cache
+          NEMOCLAW_OPEN_SHELL_SDK_ARTIFACT_DIRECTORY: ${{ runner.temp }}/network-policy-sdk
+        run: |
+          set -euo pipefail
+          mkdir -p "$NEMOCLAW_CI_NPM_CACHE"
+          env -u NODE_AUTH_TOKEN -u GITHUB_TOKEN node .e2e-sdk-verifier/scripts/checks/prepare-ci-npm-install.mts
+          env -u NODE_AUTH_TOKEN -u GITHUB_TOKEN npm ci --ignore-scripts --prefer-offline --no-audit --no-fund --cache "$NEMOCLAW_CI_NPM_CACHE"
+          env -u NODE_AUTH_TOKEN -u GITHUB_TOKEN node --input-type=module -e 'await import("@nvidia/openshell-sdk")'
+
       - name: Restore exact-commit CLI artifact
         if: ${{ inputs.restore_cli }}
         uses: NVIDIA/NemoClaw/.github/actions/restore-e2e-cli-artifact@17759906bd7f80319c58af759dd60cfb893109bf

.github/workflows/e2e.yaml

@@ -92,6 +92,11 @@ on:
         required: false
         default: ""
         type: string
+      base_image_publication_run_id:
+        description: Optional successful base-image dispatch run from this NVIDIA/NemoClaw PR branch.
+        required: false
+        default: ""
+        type: string
       correlation_id:
         description: Run correlation ID (UUIDv4).
         required: false
@@ -115,7 +120,8 @@ env:
 
 jobs:
   package-openshell-sdk:
-    if: ${{ github.event_name == 'workflow_dispatch' && contains(format(',{0},', inputs.jobs), ',external-gateway-health,') }}
+    needs: [generate-matrix]
+    if: ${{ needs.generate-matrix.result == 'success' && (contains(fromJSON(needs.generate-matrix.outputs.catalogue_nvidia_inference_matrix || '[]').*.id, 'network-policy') || contains(fromJSON(needs.generate-matrix.outputs.selected_jobs || '[]'), 'external-gateway-health')) }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
@@ -293,14 +299,29 @@ jobs:
         name: Select base and optional managed-image publication
         if: ${{ inputs.pr_number == '' || steps.select_pr_source.outputs.selection == 'base-cohort' || inputs.jobs != '' || inputs.targets == '' || contains(inputs.targets, 'managed-image-') }}
         env:
+          BASE_IMAGE_PUBLICATION_RUN_ID: ${{ inputs.base_image_publication_run_id }}
+          BASE_SHA: ${{ inputs.base_sha }}
+          CANDIDATE_REPOSITORY: ${{ inputs.checkout_repository }}
+          CANDIDATE_SHA: ${{ inputs.checkout_sha }}
           EXPECTED_SHA: ${{ steps.publication_mode.outputs.expected_sha }}
           GITHUB_TOKEN: ${{ github.token }}
+          MANAGED_IMAGE_SHA: ${{ inputs.managed_image_revision }}
+          PR_NUMBER: ${{ inputs.pr_number }}
           PUBLICATION_HISTORY_ALLOW_NON_HEAD: ${{ steps.publication_mode.outputs.allow_non_head }}
           REQUIRE_MANAGED_IMAGE_PUBLICATION: ${{ steps.select_pr_source.outputs.selection == 'candidate-catalog' && '0' || '1' }}
           SELECT_NEAREST_SUCCESSFUL_PUBLICATION: ${{ steps.publication_mode.outputs.select_nearest_successful }}
+          WORKFLOW_SHA: ${{ github.workflow_sha }}
         shell: bash
         run: |
           set -euo pipefail
+          if [[ -n "$BASE_IMAGE_PUBLICATION_RUN_ID" ]]; then
+            [[ "$REQUIRE_MANAGED_IMAGE_PUBLICATION" == "0" ]] || {
+              echo "::error::PR base publication requires the authenticated candidate managed-image catalog" >&2
+              exit 1
+            }
+            node --experimental-strip-types --no-warnings tools/e2e/pr-base-image-publication.mts
+            exit 0
+          fi
           export GITHUB_REF=refs/heads/main
           export GITHUB_SHA="$EXPECTED_SHA"
           wait_seconds=3000
@@ -3148,8 +3169,8 @@ jobs:
 
   catalogue-nvidia-inference:
     name: ${{ matrix.display_name }} (${{ matrix.runtime_provider }})
-    needs: [base-image-publication, generate-matrix]
-    if: ${{ needs.generate-matrix.outputs.catalogue_nvidia_inference_matrix != '[]' }}
+    needs: [base-image-publication, generate-matrix, package-openshell-sdk]
+    if: ${{ always() && needs.base-image-publication.result == 'success' && needs.generate-matrix.result == 'success' && needs.generate-matrix.outputs.catalogue_nvidia_inference_matrix != '[]' && (needs.package-openshell-sdk.result == 'success' || !contains(fromJSON(needs.generate-matrix.outputs.catalogue_nvidia_inference_matrix || '[]').*.id, 'network-policy')) }}
     strategy:
       fail-fast: false
       matrix:
@@ -3168,6 +3189,7 @@ jobs:
       managed_image_receipt: ${{ needs.base-image-publication.outputs.managed_image_receipt }}
       managed_image_catalog: ${{ needs.base-image-publication.outputs.managed_image_catalog }}
       workload_source: ${{ needs.generate-matrix.outputs.workload_source }}
+      openshell_sdk_artifact_name: ${{ needs.package-openshell-sdk.outputs.artifact_name }}
       credential_boundary: NVIDIA inference API key
       target_id: ${{ matrix.target_id }}
       catalogue_id: ${{ matrix.id }}

.github/workflows/managed-images.yaml

@@ -46,6 +46,7 @@ on:
       - "scripts/**"
       - "src/lib/actions/sandbox/openshell-child-visible-credentials.v*.json"
       - "src/lib/actions/sandbox/mcp-bridge-*.ts"
+      - "src/lib/actions/sandbox/mcp-bridge/**"
       - "src/lib/actions/sandbox/rebuild-post-restore-phase.ts"
       - "src/lib/agent/candidate-authority.ts"
       - "src/lib/extra-agents-validation.ts"

.github/workflows/pr.yaml

@@ -490,6 +490,8 @@ jobs:
 
       - name: Run package-contract and type checks
         uses: ./.trusted-ci-actions/.github/actions/ci-build-typecheck
+        env:
+          NODE_OPTIONS: --max-old-space-size=8192
 
   installer-integration:
     needs: [changes, openshell-sdk-package]

agents/hermes/Dockerfile

@@ -130,7 +130,6 @@ COPY agents/hermes/patch-langfuse-credentials.mts /usr/local/lib/nemoclaw/patch-
 COPY agents/hermes/seed-dashboard-config.py /usr/local/lib/nemoclaw/seed-hermes-dashboard-config.py
 COPY agents/hermes/runtime-config-guard.py /usr/local/lib/nemoclaw/hermes-runtime-config-guard.py
 COPY agents/hermes/finalize-tirith-marker.py /usr/local/lib/nemoclaw/finalize-tirith-marker.py
-COPY agents/hermes/build-mcp-digest.py /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py
 COPY agents/hermes/mcp-config-transaction.py /usr/local/lib/nemoclaw/hermes-mcp-config-transaction.py
 COPY agents/hermes/cron-restore-control.py /usr/local/lib/nemoclaw/hermes-cron-restore-control.py
 COPY src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.106.json /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.106.json
@@ -568,10 +567,10 @@ RUN chmod -R a+rX /opt/nemoclaw-blueprint/
 # minimum supported Hermes sandbox base tag guarantees those artifacts and
 # test/runtime/sandbox/sandbox-rlimit-hooks.test.ts covers that base.
 RUN chmod 755 /usr/local/bin/nemoclaw-start /usr/local/bin/nemoclaw-managed-startup-hold /usr/local/bin/nemoclaw-managed-bootstrap /usr/local/lib/nemoclaw/sandbox-init.sh /usr/local/lib/nemoclaw/validate-hermes-env-secret-boundary.py /usr/local/lib/nemoclaw/patch-hermes-sqlite-temp-store.py /usr/local/lib/nemoclaw/patch-hermes-discord-recovery-permissions.py /usr/local/lib/nemoclaw/seed-hermes-dashboard-config.py /usr/local/lib/nemoclaw/hermes-runtime-config-guard.py /usr/local/lib/nemoclaw/finalize-tirith-marker.py /usr/local/lib/nemoclaw/hermes-mcp-config-transaction.py \
-    && chown root:root /usr/local/bin/nemoclaw-gateway-control /usr/local/lib/nemoclaw/gateway-supervisor.sh /usr/local/lib/nemoclaw/managed-gateway-control.py /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py /usr/local/lib/nemoclaw/hermes-cron-restore-control.py /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.106.json \
+    && chown root:root /usr/local/bin/nemoclaw-gateway-control /usr/local/lib/nemoclaw/gateway-supervisor.sh /usr/local/lib/nemoclaw/managed-gateway-control.py /usr/local/lib/nemoclaw/hermes-cron-restore-control.py /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.106.json \
     && chmod 700 /usr/local/bin/nemoclaw-gateway-control /usr/local/lib/nemoclaw/hermes-cron-restore-control.py \
     && chmod 500 /usr/local/lib/nemoclaw/managed-gateway-control.py \
-    && chmod 444 /usr/local/lib/nemoclaw/corporate-ca-runtime.sh /usr/local/lib/nemoclaw/entrypoint-env-wrapper.sh /usr/local/lib/nemoclaw/gateway-supervisor.sh /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py /usr/local/lib/nemoclaw/managed_policy.py \
+    && chmod 444 /usr/local/lib/nemoclaw/corporate-ca-runtime.sh /usr/local/lib/nemoclaw/entrypoint-env-wrapper.sh /usr/local/lib/nemoclaw/gateway-supervisor.sh /usr/local/lib/nemoclaw/managed_policy.py \
     && chmod 444 /usr/local/lib/nemoclaw/patch-hermes-langfuse-credentials.mts \
     && chmod 444 /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.106.json \
     && /opt/hermes/.venv/bin/python3 -I -c 'import runpy, yaml; assert yaml.safe_load("ready: true")["ready"] is True; runpy.run_path("/usr/local/lib/nemoclaw/hermes-runtime-config-guard.py", run_name="nemoclaw_runtime_config_guard_probe")' \
@@ -1560,16 +1559,10 @@ RUN test "$(stat -c '%U:%G %a' /sandbox/.hermes/runtime)" = "gateway:sandbox 277
         /sandbox/.hermes/audio_cache \
         /sandbox/.hermes/skills
 
-# Pin config hash at build time for integrity verification at startup. Invoke
-# the installed runtime guard's `_canonical_mcp_servers_digest` directly so
-# image sealing and runtime verification cannot drift onto different JSON
-# canonicalization contracts.
+# Pin config hash at build time for config and environment integrity verification at startup.
 RUN mkdir -p /etc/nemoclaw \
     && sha256sum /sandbox/.hermes/config.yaml /sandbox/.hermes/.env \
     > /etc/nemoclaw/hermes.config-hash \
-    && mcp_digest="$(/opt/hermes/.venv/bin/python -I /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py --guard /usr/local/lib/nemoclaw/hermes-runtime-config-guard.py --config /sandbox/.hermes/config.yaml)" \
-    && printf '# nemoclaw-hermes-mcp-state-v1 intended=%s applied=%s\n' "$mcp_digest" "$mcp_digest" \
-    >> /etc/nemoclaw/hermes.config-hash \
     && chown root:root /etc/nemoclaw/hermes.config-hash \
     && chmod 444 /etc/nemoclaw/hermes.config-hash