chore(openshell): upgrade supported version to 0.0.71 - #5596
Merged
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAll hardcoded OpenShell version references are bumped from ChangesOpenShell Version Bump 0.0.44 → 0.0.67
Docker-driver Gateway JWT and TOML Configuration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
ericksoa
changed the title
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: Dispatch required Vitest E2E scenarios:
Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
Contributor
PR Review Advisor — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 1 item to resolve/justify, 0 in-scope improvements
|
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27972854267
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27974031163
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27974743925
|
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (2)
src/lib/onboard/docker-driver-gateway-env.test.ts (1)
62-93: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick winComplete the permission validation for all JWT bundle files.
The test defines
publicKeyPath(line 73) andkidPath(line 74) but only validates permissions forsigningKeyPath(line 89). According to the upstream contract indocker-driver-gateway-config.ts, all three files are written with mode 0o600. For complete test coverage of the security requirement, validate permissions for all JWT bundle files.🧪 Add permission checks for all JWT files
expect(fs.statSync(configPath).mode & 0o777).toBe(0o600); expect(fs.statSync(signingKeyPath).mode & 0o777).toBe(0o600); + expect(fs.statSync(publicKeyPath).mode & 0o777).toBe(0o600); + expect(fs.statSync(kidPath).mode & 0o777).toBe(0o600); } finally {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/docker-driver-gateway-env.test.ts` around lines 62 - 93, The test in the "writes OpenShell 0.0.67 gateway JWT config into the managed state dir" test case defines publicKeyPath and kidPath variables but only validates file permissions for signingKeyPath. Add two additional expect statements to validate that both publicKeyPath and kidPath have their file permissions set to 0o600 using fs.statSync().mode & 0o777, following the same pattern already established for the signingKeyPath permission validation.src/lib/onboard/docker-driver-gateway-config.ts (1)
30-69: 🧹 Nitpick | 🔵 Trivial | 💤 Low valueConsider removing redundant
chmodSynccalls after directory/file creation.
fs.mkdirSync(..., { mode })andfs.writeFileSync(..., { mode })already apply the specified mode. The subsequentchmodSynccalls on lines 40, 44-47, and 55 are redundant when the files are freshly created.However, the calls on lines 44-47 for the "all files exist" branch serve a useful purpose: they enforce correct permissions on pre-existing files that may have been tampered with or created with incorrect permissions. The pattern is acceptable for security-sensitive paths.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/docker-driver-gateway-config.ts` around lines 30 - 69, Remove redundant `chmodSync` calls in the ensureDockerDriverGatewayJwtBundle function. Remove the chmodSync(stateDir, 0o700) call that immediately follows fs.mkdirSync(stateDir, ...) since the mode is already specified in the mkdirSync options, and remove the chmodSync(jwtDir, 0o700) call after fs.mkdirSync(jwtDir, ...) for the same reason. Also remove the chmodSync calls (chmodSync(bundle.signingKeyPath), chmodSync(bundle.publicKeyPath), and chmodSync(bundle.kidPath)) that follow the writeRestrictedFile calls, since writeRestrictedFile likely already applies the correct file permissions. Keep the chmodSync calls in the "all files exist" branch (when present === files.length) as they enforce correct permissions on pre-existing files that may have been tampered with.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/lib/onboard/docker-driver-gateway-config.ts`:
- Around line 30-69: Remove redundant `chmodSync` calls in the
ensureDockerDriverGatewayJwtBundle function. Remove the chmodSync(stateDir,
0o700) call that immediately follows fs.mkdirSync(stateDir, ...) since the mode
is already specified in the mkdirSync options, and remove the chmodSync(jwtDir,
0o700) call after fs.mkdirSync(jwtDir, ...) for the same reason. Also remove the
chmodSync calls (chmodSync(bundle.signingKeyPath),
chmodSync(bundle.publicKeyPath), and chmodSync(bundle.kidPath)) that follow the
writeRestrictedFile calls, since writeRestrictedFile likely already applies the
correct file permissions. Keep the chmodSync calls in the "all files exist"
branch (when present === files.length) as they enforce correct permissions on
pre-existing files that may have been tampered with.
In `@src/lib/onboard/docker-driver-gateway-env.test.ts`:
- Around line 62-93: The test in the "writes OpenShell 0.0.67 gateway JWT config
into the managed state dir" test case defines publicKeyPath and kidPath
variables but only validates file permissions for signingKeyPath. Add two
additional expect statements to validate that both publicKeyPath and kidPath
have their file permissions set to 0o600 using fs.statSync().mode & 0o777,
following the same pattern already established for the signingKeyPath permission
validation.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 286e9009-1480-4bff-b3dc-1dd0e7012883
📒 Files selected for processing (7)
src/lib/onboard/docker-driver-gateway-config.tssrc/lib/onboard/docker-driver-gateway-env.test.tssrc/lib/onboard/docker-driver-gateway-env.tssrc/lib/onboard/docker-driver-gateway-launch.test.tssrc/lib/onboard/docker-driver-gateway-launch.tssrc/lib/onboard/docker-driver-gateway-runtime.test.tstest/brev-launchable-ci-cpu-checksum.test.ts
✅ Files skipped from review due to trivial changes (1)
- src/lib/onboard/docker-driver-gateway-runtime.test.ts
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27976422477
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27977024952
|
ericksoa
added
dependencies
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27977340548
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27978433303
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27978655990
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27978914573
|
prekshivyas
approved these changes
Jun 29, 2026
prekshivyas
left a comment
prekshivyas
left a comment
Collaborator
There was a problem hiding this comment.
CI green, E2E all-green, both advisors passed. LGTM.
21 tasks
22 tasks
Preserve the 0.0.71 auth and version contracts on the current Vitest-only E2E layout, add the issue #4760 denied-log regression, and harden the Brev launchable boundary. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Keep the OpenShell auth review references, explicit-only inventory, workflow size budget, and Brev Docker hardening proof consistent after the main merge. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+81
to
+86
| const result = spawnSync(command, args, { | ||
| encoding: "utf-8", | ||
| env, | ||
| stdio: ["ignore", "pipe", "pipe"], | ||
| timeout: 60_000, | ||
| }); |
Contributor
E2E Target RecommendationRequired E2E targets: Dispatch required E2E targets:
Full E2E target advisor summaryE2E Target AdvisorBase: Required E2E targets
Optional E2E targets
Relevant changed files
|
Move denied-log polling into a focused support module and preserve removed-channel tolerance without growing conditional branches in changed live tests. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Contributor
Vitest E2E Target Results — ❌ Some jobs failedRun: 28450977336
|
Contributor
Vitest E2E Target Results —
|
| Job | Result |
|---|---|
| network-policy | ✅ success |
| openshell-gateway-auth-contract | ✅ success |
| openshell-gateway-upgrade | |
| openshell-version-pin | ✅ success |
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Contributor
Vitest E2E Target Results —
|
| Job | Result |
|---|---|
| network-policy | |
| openshell-gateway-auth-contract | ✅ success |
| openshell-gateway-upgrade | |
| openshell-version-pin | ✅ success |
21 tasks
jyaunches
added a commit
that referenced
this pull request
Jun 30, 2026
<!-- markdownlint-disable MD041 --> ## Summary Refreshes the public documentation for NemoClaw v0.0.71 after scanning commits since v0.0.70. Adds release notes and fills the remaining doc gaps for Windows bootstrap diagnostics, OpenClaw agent auto-relock warnings, auto-pair cadence tuning, and plugin-install recovery hints. ## Changes - `docs/about/release-notes.mdx`: adds the v0.0.71 release-note section, grouped by gateway recovery, OpenShell auth, policy provenance, day-two maintenance, messaging/inference, and Windows setup. - `docs/get-started/windows-preparation.mdx`: documents sanitized WSL install output and reboot gating in the Windows bootstrap. - `docs/reference/commands.mdx`: documents the host `agent` wrapper's shields auto-relock warning and OpenClaw auto-pair watcher tuning variables. - `docs/reference/troubleshooting.mdx`: adds plugin-install network failure recovery guidance and updates Windows WSL troubleshooting for sanitized install logs and reboot-required handling. Source summary: - #6065 -> `docs/about/release-notes.mdx`: Notes explicit model override preservation and gateway-log guard-chain recovery diagnostics. - #5874 -> `docs/about/release-notes.mdx`: Summarizes host-mediated `recover` and `gateway restart`, linking to lifecycle, command, troubleshooting, and trusted-boundary docs already added by the source PR. - #5596 -> `docs/about/release-notes.mdx`: Summarizes OpenShell 0.0.71 gateway auth, loopback binding, and compatibility-container docs already added by the source PR. - #5797 and #5798 -> `docs/about/release-notes.mdx`: Summarizes `policy-list` provenance, Restricted tier suppression, and Balanced tier weather behavior already reflected in policy docs. - #5784 -> `docs/about/release-notes.mdx`: Summarizes `--destroy-user-data` and the safe `--yes` uninstall behavior already documented in lifecycle and command docs. - #6034 -> `docs/about/release-notes.mdx`: Summarizes custom Dockerfile warm-build cache behavior already documented in the command reference. - #5951 -> `docs/reference/commands.mdx`: Documents the stderr-only host `agent` wrapper warning after recent shields auto-relock. - #5387 -> `docs/reference/commands.mdx`: Documents OpenClaw auto-pair watcher cadence and fast-reentry tuning variables. - #5835 -> `docs/reference/troubleshooting.mdx`: Adds recovery guidance for OpenClaw plugin-install network failures. - #5995 and #5956 -> `docs/about/release-notes.mdx`: Summarizes Microsoft Teams final-message delivery and runtime mention hints already covered by messaging docs. - #5716 -> `docs/about/release-notes.mdx`: Summarizes non-interactive Ollama loopback safety already covered by local inference docs. - #5505, #5527, and #5528 -> `docs/about/release-notes.mdx`: Summarizes compatible local endpoint, model task-fit, and model capability audit docs. - #6009 -> `docs/get-started/windows-preparation.mdx`, `docs/reference/troubleshooting.mdx`: Documents sanitized Windows bootstrap WSL output and reboot-required gating. - #6055 -> no additional source doc page change needed beyond the already-merged quickstart update; release notes did not duplicate routine quickstart cleanup. No matching v0.0.71 GitHub announcement discussion was found in the latest 20 discussions, so this refresh is based on the commit scan and existing source PR docs. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: docs-only refresh with no runtime behavior changes. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — ran `npm run docs`; Fern reported 0 errors and 2 existing warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new release-notes entry covering gateway recovery, authentication, network policy/provenance output, uninstall safety, Windows bootstrap diagnostics, messaging defaults, and inference setup guidance. * Clarified Windows preparation steps around reboot behavior and redacting troubleshooting transcripts. * Expanded command reference details for OpenClaw wrapper behavior and new auto-pair tuning options. * Improved troubleshooting guidance for plugin installation issues, WSL repair/reboot cases, and install timing problems. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> Co-authored-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com>
cv
pushed a commit
that referenced
this pull request
Jul 3, 2026
<!-- markdownlint-disable MD041 --> ## Summary NemoClaw `v0.0.74` will ship stable OpenShell `v0.0.72`. This dependency layer advances the supported OpenShell contract from `0.0.71` to `0.0.72`, pins every consumed release artifact, preserves round-trippable policy state, and hardens installer verification so pull-request code cannot authorize its own pins. ## Related Issue Refs #5591. Follow-up to merged #5596. Dependency layer for #5876 and the accepted MCP design in #566. ## Changes - Pin stable OpenShell `0.0.72` across the supported version floor/ceiling, installer, Brev launchable, blueprint, supervisor image, workflow, and live-E2E contracts. OpenShell development builds remain compatibility evidence, not the shipping runtime. - Pin all consumed CLI, gateway, and sandbox archives plus both Brev CLI references to the official `v0.0.72` checksum manifests. - Read mutation input from `openshell policy get --base`, strip reserved `_provider_*` entries before `policy set`, retain `--full` only for read-only diagnostics, and preserve future mapping sections plus MCP/JSON-RPC fields during merges. - Route the CommonJS CLI and ESM plugin through one generated OpenShell policy boundary and exact-pin `yaml` `2.8.3` in both production package graphs. - Normalize that boundary for both compiled CommonJS and source-mode `tsx` loading. A subprocess package-contract test reproduces the live source-loader path that exposed the mismatch. - Run installer verification from base-trusted code. The introducing PR falls back only to immutable commit `cb5e9aefab2b16fedc0995149fc3520da0d5e0c7`, verified as tree `1fdf59efe40b78c407e222fd42043b23a61e199a`, with an enforced expiry at `2026-12-29T19:35:41Z`. - Treat PR-head installer files as data only. The trusted parser rejects symbolic links, a symbolic-link `scripts` parent, non-regular files, changed inode/device identity, and input over 1 MiB; it opens with `O_NOFOLLOW` and performs a bounded descriptor read. - Fail installer verification closed on missing, duplicate, mismatched, incomplete, or unreachable OpenShell/Brev pin data. - Publish the OpenShell `0.0.72` compatibility review and align version, policy, gateway-authentication, and troubleshooting documentation. ### Exact-head evidence - PR head: `2d06fa01b624b63813fe558ce36b29d47ad31e36`, based exactly on current `main` `dc96deb24d67eeeb2cb7b2bb42c7c53f000507f3`. The final signed merge incorporates the release-boundary revert that defers unrelated dcode-status work, so this dependency PR does not reintroduce #6202 outside its scope. - GitHub verifies the new merge commit signature, DCO is green, the prior maintainer approval remains recorded at [review 4611344448](#6020 (review)), and GitHub reports the PR graph as `MERGEABLE`. - Post-restack local validation passes `build:cli`, full and CLI typechecks, repository checks, generated agent-doc synchronization, affected Deep Agents image contracts, and `git diff --check`. - All exact-head ordinary PR checks are terminal green (33 successful, three skipped/neutral, zero failures), including macOS/WSL E2E, every CLI shard and aggregate, static/security scans, DCO, and both PR Review Advisor jobs. GitHub reports `APPROVED` and `MERGEABLE/CLEAN`. - Exact-head selected OpenShell [E2E run 28632123304](https://github.com/NVIDIA/NemoClaw/actions/runs/28632123304) is terminal green: version pin, gateway-auth contract, network policy, gateway upgrade/state restoration, scorecard, and the no-comment reporter all passed from a temporary no-PR ref at the identical commit. The temporary ref was deleted after completion. - Exact-head PR Review [run 28632002111](https://github.com/NVIDIA/NemoClaw/actions/runs/28632002111) and E2E Advisor [run 28632002140](https://github.com/NVIDIA/NemoClaw/actions/runs/28632002140) are green. GPT reports no actionable finding; Nemotron's check passed but both JSON synthesis attempts were unparseable, so that model's artifact is incomplete rather than clearance. E2E Advisor reports high confidence and selects the four live lanes linked above. ### Trust-boundary notes - The immutable bootstrap is intentionally used only while the PR base lacks the trusted action. Once that action exists on the base, executing the newer base-trusted verifier is the stronger boundary; the expiring bootstrap should then be removed rather than run redundantly. - No untrusted PR process executes alongside the parser. GitHub checks out inert PR data, then trusted code validates and reads the already-opened descriptor. The link/type/identity/bounds checks cover repository-controlled redirection and exhaustion inputs without claiming protection from a privileged concurrent host writer. - Stable OpenShell `0.0.72` accepts an unmarked policy root only when it contains `version` or `network_policies`; metadata-only and malformed documents fail closed. Versionless `network_policies` is retained for the supported compatibility contract. ### Advisor disposition - GPT reported no required findings and one warning about the mutable default `BASE_IMAGE` tag. That `ARG BASE_IMAGE=ghcr.io/nvidia/nemoclaw/sandbox-base:latest` line is unchanged from current `main`; this dependency PR neither introduces nor broadens that repository-wide build default. - Nemotron's bootstrap finding would weaken the intended trust transition: the immutable bootstrap exists only for the introducing PR. Once the action is present on the base, the newer base-trusted action must replace the older bootstrap; both paths are immutable for the current event and are contract-tested. - Nemotron's parser race assumes an untrusted concurrent filesystem writer. PR code is never executed in this job: GitHub checks out inert data, then trusted code rejects links/special files, checks the opened descriptor's device/inode, bounds the read, and closes it. A privileged host writer is outside this PR-input threat model. - Nemotron's checksum finding is not circular. The trusted checker pins the SHA-256 of each upstream checksum manifest, verifies that immutable manifest before reading it, and compares every embedded installer pin with exactly one manifest entry. At install time each named archive must exist and match its pinned digest, so a missing asset still fails closed without downloading all archives during every PR check. - The generated-boundary auditor executes in the Docker builder stage exercised by ordinary `build-sandbox-images` CI. The exact source-mode `.cts` versus generated `.cjs` mismatch found by live proof is now covered directly by the subprocess package-contract test and the compiled runner suites. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: policy mutation, package boundary, installer trust, workflow selection, and runtime upgrade/state-restoration have focused coverage; final selected E2E is linked above. - [ ] Tests not applicable — justification: not applicable; this changes security-sensitive installer, policy, and runtime compatibility behavior. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: not applicable; supported OpenShell versions and policy behavior are user-facing. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: the linked approval predates the current head; exact-head human review or an explicit carried-approval decision remains required, and no waiver is requested. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: no waiver is requested; exact-head ordinary CI is green, and the selected run's comment-only reporter caveat is documented above and is not a required PR check. ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [x] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> Signed-off-by: Preksha Vyas <prekshiv@nvidia.com> Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com>
ericksoa
added a commit
that referenced
this pull request
Jul 4, 2026
…5595) <!-- markdownlint-disable MD041 --> ## Summary Upgrade NemoClaw to `openclaw@2026.6.10` and adapt packaging, compiled-runtime compatibility patches, messaging plugins, rebuild recovery, and E2E coverage to the reviewed release. The change retains the existing fail-closed package, credential-recovery, state-restore, and runtime-proof boundaries while moving one stable patch release forward from 2026.6.9. ## Related Issue - Refs #5591. - #5596 (OpenShell 0.0.71) landed first, preserving the dependency landing order; this PR targets `v0.0.74`. - Post-tag installer consolidation and fixture retirement remain tracked in #5896 and are not blockers for the first tag containing this PR. ## Changes - Pin `openclaw@2026.6.10`, diagnostics, Brave, Discord, Slack, WhatsApp, and Microsoft Teams packages to their reviewed npm SRIs across images, manifests, package metadata, lifecycle policy, and version-aware tests. - Verify registry metadata and downloaded archives before install, suppress package-controlled lifecycle scripts, and retain the explicit reviewed OpenClaw postinstall boundary. - Re-audit the published 2026.6.10 tarball, shrinkwrap, npm graph, Teams package-load hashes, weather skill, and every compiled-dist patch selector. - Keep the fail-closed sandbox fetch/proxy, chat correlation, compact tool catalog, Teams message-hint, and #4434 unreachable-inference compatibility patches bound to the reviewed distribution. - Route repair-only device self-approval through OpenClaw CLI, authenticated gateway dispatch, and canonical locked-state authorization. Exact bounded repairs use the existing stored device credential and fail without falling back to shared/admin credentials or local approval; no Python process reads or writes device credentials or pairing state. - Preserve keyless rebuild recovery only for the exact registered provider, model, credential binding, endpoint identity, API, and persisted route, without reading, exporting, or replacing the credential. - Restore registry rows from an atomic removal receipt and reclaim a removed default only when no concurrent default transition superseded it. - Isolate `NEMOCLAW_PREFERRED_API` along with all other ambient inference selectors during rebuild resume, preserving the recorded sandbox route. - Reject multiline production build arguments and decimal-version inputs that could inject legacy fixture overrides through workflow dispatch. - Scan snapshot credential assignments through the shared credential-name classifier while continuing to permit only recognized `models.json` environment/secret references. - Classify #4434 diagnostics only from the final contiguous, bounded TUI `run error:` block so unrelated transcript text cannot satisfy the guard. - Split generated runtime-proof source into bounded OpenShell arguments, validate the proof port as decimal `1..65535`, and construct only the fixed loopback proof URL. - Run the real published-distribution SRI/patch/audit harness from trusted main CI while retaining explicit local opt-in proof. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: focused unit, integration, E2E-support, workflow-contract, package-contract, and real published-distribution suites exercise every changed boundary. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: final-head maintainer re-review pending. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: no waiver requested. ### Risk Boundaries - Keyless provider reuse never reads, exports, or replaces a credential. The shared pre-delete/runtime assessment requires the exact registered route and gateway binding; missing, oversized, ambiguous, spoofed, or incompatible metadata fails before deletion or triggers rollback. - OpenShell intentionally redacts provider values. Custom endpoint reuse therefore also requires authoritative registry route identity and no conflicting recorded endpoint; the recovery path never updates the provider. - Rebuild resume cannot borrow ambient agent, provider, model, endpoint, credential, preferred API, or reasoning values from another sandbox. - Registry rollback restores a removed default only when both the fallback pointer and persisted selection revision still match. A later explicit default choice is preserved even when it selects that same fallback value. - Production build guards reject CR/LF input, the legacy fixture flag, retained legacy versions, and fixture-only integrity/tarball overrides before every production image build. - Snapshot restore accepts only typed or recognized credential references in `models.json`; concrete keys, bearer tokens, assignments, and arbitrary credential values remain rejected. - Messaging-plugin registry provenance now requires the exact package spec, committed registry `dist.integrity`, committed registry `dist.tarball` URL, and packed-byte SRI before `npm pack` or plugin installation. Missing or mismatched metadata fails closed; #5896 remains only the shared-installer consolidation tracker. - The reviewed archive contract remains duplicated across isolated Docker and Node execution contexts so each transaction fails before install. Shared installer consolidation remains #5896 rather than widening this bump. - Compiled-dist patches are scoped to the SRI-verified 2026.6.10 shapes and fail closed on selector drift; they must be removed when upstream supplies equivalent behavior. - Same-device repair selects stored-device authentication only for the exact signed CLI/operator/pairing baseline. A failure rethrows before shared/admin or local-state fallback, and the handler plus locked writer revalidate the current pending identity and bounded scopes before token rotation. - The #4434 shim enriches only reviewed normalized failures inside OpenShell sandboxes. Its live guard requires the complete final error block and cannot borrow diagnostic keywords from earlier output. - No Teams tenant credentials, captured activities, or public-ingress scaffold are included; Teams evidence remains package/load-boundary evidence. ## Verification Exact head: `5911445d55dfd10b03233b4133195e6d8c8d0e60` Current `main`: `06b78aae3816ffe23eab64e9327ca99407a5a527` - [x] PR description includes the DCO sign-off declaration and the new commit includes `Signed-off-by` - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes — all commit/push hooks passed except the deliberately skipped unsharded `test-cli` coverage hook; exact-head hosted coverage shards are required below. - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) — the unsharded local coverage hook was attempted on the complete tree but exceeded many existing 5-second per-test limits under coverage on this Mac. Every changed boundary passes in isolated focused runs; authoritative hosted coverage shards are required below and no waiver is requested. - [ ] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Local exact-tree evidence: - `npm run build:cli`, `npm run typecheck:cli`, `npm run typecheck`, repository checks, Vitest project/import/title checks, and the 1,216-file test-size scan passed on the merged tree. - Final exact-head rebuild, registry, provider-recovery, base-image-handoff, destroy, DCode, and recovery suites: 167 CLI tests passed. - Final exact-head destroy, fetch-guard, stored-device-auth, workflow-contract, and scorecard suite: 83 integration tests passed. - Final exact-head #4462 fixture boundary and E2E workflow-contract suite: 22 E2E-support tests passed. - OpenClaw archive/build-argument/mcporter provenance suite: 37 passed; messaging build-applier provenance suite: 30 passed. - OpenClaw chat and device-scope compiled-runtime patch suites: 32 passed. - The real OpenClaw 2026.6.10 #4462 pairing-only repair and exact raw CLI identity proof passed through the extracted live heredoc path with no pending request left behind; the executable fixture contract observes `paired.json` → `device-auth.json` → `pending.json` publication. - Real `openclaw@2026.6.10` published-tarball SRI, patch application, and patch audit/config-token gateway harness: 3 passed in 117.43 seconds on Node 22.19 at the current exact head. - Changed files pass Biome formatting, lint, shellcheck, hadolint, YAML/JSON, Markdown, secret, schema, repository, source-shape, size, and diff checks. - The repository-wide format check still reports two pre-existing clean files outside this PR; neither is changed here and no waiver is applied to PR CI. Hosted exact-head requirements before merge: - [x] Ordinary PR matrix, including sharded CLI/plugin coverage, green. - [x] Fresh GPT and Nemotron advisor runs completed and dispositioned. - [x] Full exact-head E2E matrix green with only documented explicit-only skips. - [x] Branch zero commits behind current `main` after all proof completes. - [ ] One approving review and no unresolved blocking thread. Final exact-head hosted evidence: - [Ordinary PR matrix](https://github.com/NVIDIA/NemoClaw/actions/runs/28703740246) is green, including all five CLI shards, static checks, build/typecheck, installer integration, plugin tests, and the aggregate gate. - [Base images](https://github.com/NVIDIA/NemoClaw/actions/runs/28703746118) and [sandbox images plus E2E](https://github.com/NVIDIA/NemoClaw/actions/runs/28703773610) are green at the exact head and exercised the reviewed OpenClaw and locked mcporter provenance-reuse paths. - [Full E2E](https://github.com/NVIDIA/NemoClaw/actions/runs/28703774060) attempt 2 is green: every default-enabled job passed, five explicit-only jobs were intentionally skipped, and no failures remain. - [Targeted #4462 plus rebuild-openclaw](https://github.com/NVIDIA/NemoClaw/actions/runs/28703787702) and the [Hermes dashboard rerun](https://github.com/NVIDIA/NemoClaw/actions/runs/28704016943) are green at the exact head. - [Final advisor run](https://github.com/NVIDIA/NemoClaw/actions/runs/28703740209) completed successfully. GPT reports zero required and zero new findings. Its remaining floating-Docker-action warning concerns refs inherited unchanged from current `main`; repository-wide action pinning is accepted as separate hardening rather than scope for this dependency bump. The duplicate non-interactive-helper suggestion is likewise a non-blocking refactor. Nemotron's repeated source-of-truth and structural findings do not identify a new final-head defect; the applicable integrity, recovery, trusted-main, and decomposition boundaries are documented above and in #5896. CodeRabbit, CodeQL, and all required contexts are green; all review threads are resolved. The branch is zero commits behind `main`, carries label `v0.0.74`, and is mergeable. The only outstanding branch-protection gate is a final approving review; [re-review was requested from @apurvvkumaria](#5595 (comment)). ## Rollback Plan Revert this PR as a unit, restoring the prior OpenClaw pins, integrity values, plugin-install behavior, state-restore rules, and compatible patch set. Do not combine the older runtime pin with 2026.6.10 compiled-dist selectors. Rebuild base and sandbox images, then rerun the affected E2E lanes. --- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Upgraded bundled OpenClaw runtime to **2026.6.10** with fully version-pinned messaging plugins. * Enhanced sandbox rebuild with registry receipts/rollback and improved routing credential preflight. * Added an e2e **snapshot credential scanner** to detect credential leaks. * **Bug Fixes** * Improved **chat.send** compatibility (embedded retry persistence + preserved run/session wiring). * Strengthened unreachable-inference UI diagnostics and tightened approval/retry flows to prevent unintended state changes. * **Documentation** * Updated Telegram troubleshooting and messaging-channel docs; added the **OpenClaw 2026.6.10** dependency review. * **Chores / CI** * Hardened Docker build-arg validation and added a real OpenClaw dist harness; added messaging plugin provenance integrity checks. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> Signed-off-by: Andrew Erickson <aerickson@nvidia.com>
7 tasks
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Ports the focused E2E stabilizers from `dep/openshell-v0.0.67` / PR NVIDIA#5596 onto current `main` after PR NVIDIA#5760, without merging the full OpenShell 0.0.67 branch. This targets the full-main nightly failures from run 28172043426: - `kimi-inference-compat-e2e` — relax live Kimi trajectory shape expectations. - `common-egress-agent-e2e` — tolerate wrapped reply tokens like `REFER\nENCE_AGENT_OK`. - `sessions-agents-cli-e2e` — keep sessions admin RPCs local/SDK-backed and avoid multiline RPC args. Also includes the small channel/remove rebuild staging stabilizer carried by the shared matrix-stabilization commit. ## Validation - Local push hooks could not fully run because this worktree is missing local npm dependencies (`tsx`, `typescript`, Biome dependency `klaw`). - Shellcheck/gitleaks/basic pre-commit checks passed before the dependency-gated hooks failed. - Focused nightly E2E dispatch is being run separately on this branch. ## Notes - Does not port the full OpenShell 0.0.67 upgrade. - Does not claim to fix `diagnostics-e2e` HTTP 403; that failure looked infra/upstream/credential-like. Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved sandbox gateway RPC execution with pairing-aware retry, clear retry/no-retry gating, and stricter handling of unsupported admin methods. * Added safer parsing and richer failure diagnostics with token redaction in returned output and logged errors. * **New Features** * Enhanced gateway RPC results to include separate diagnostic output and tightened admin method support via allowlisting. * **Tests** * Expanded Vitest coverage for gateway orchestration/output handling and stream capture behavior. * Strengthened OpenClaw text assertions, updated e2e token/PONG checks, and relaxed Kimi validations for mock vs live. * Prevented Telegram env reuse after channel removal. * **Chores** * Added optional stdout/stderr stream capture controls for OpenShell helpers. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Aaron Erickson <aerickson@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary <!-- 1-3 sentences: what this PR does and why. --> This PR advances NemoClaw's stable OpenShell support from `0.0.44` on current `main` to `0.0.71`, including checksum-pinned installation, authenticated Docker-driver gateway startup, fail-closed recovery behavior, and unified E2E coverage. It preserves the existing CLI integration and adds the full `nemoclaw <sandbox> logs --tail 50` denied-egress regression required by NVIDIA#4760. ## Related Issue <!-- Fixes #NNN or Closes #NNN. Remove this section if none. --> Fixes NVIDIA#4760 Refs NVIDIA#5591 Refs NVIDIA#5513 ## Changes <!-- Bullet list of key changes. --> - Pin OpenShell `0.0.71` across the blueprint, installer, onboarding version checks, Brev launchable bootstrap, and unified E2E workflow, with published release SHA-256 digests for supported CLI and gateway assets. - Generate and validate NemoClaw-owned local TLS, mTLS user auth, and OpenShell sandbox JWT configuration for Docker-driver gateways; reject unauthenticated and wildcard-bind paths while preserving OpenShell-managed Docker bridge callbacks. - Keep the older-glibc gateway compatibility container behind explicit opt-in, loopback binding, dropped capabilities, `no-new-privileges`, and a validated Unix Docker socket. - Recover gateway JWT generation only when the recorded owner is provably gone, and keep malformed, live, replaced, or unprobeable lock states fail-closed. - Fail Hermes recovery closed when the sandbox lacks the secret-boundary validator, and accept markerless OpenShell relaunch output only after the gateway health probe succeeds. - Harden the Brev bootstrap by keeping `/var/run/docker.sock` restricted, using Docker-group execution for daemon commands, and removing mutable image pre-pulls and `latest` fallbacks. - Port OpenShell version, gateway-auth, upgrade, and network-policy coverage into `.github/workflows/e2e.yaml` and `test/e2e/**`, including the explicit live gateway-auth job and NVIDIA#4760's full denied-reason assertion from `logs --tail 50`. - Update command, troubleshooting, release-note, and security documentation for the supported version, gateway trust boundary, compatibility opt-in, and recovery behavior. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: Not applicable; this PR adds and updates focused unit, integration, workflow-contract, and live E2E coverage. - [ ] Tests not applicable — justification: Not applicable; runtime, installer, security, recovery, and workflow behavior changes. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: Not applicable; supported-version, gateway, compatibility, and recovery behavior is user-facing. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: [Maintainer approval on the prior exact head](NVIDIA#5596 (review)) is recorded; final-head advisors and human confirmation are pending. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: Not applicable; no final-head CI exception or maintainer waiver is requested. ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [x] New doc pages include SPDX header and frontmatter (new pages only) Current merge-candidate evidence: - Final pushed head: `be74fad8f0f09d4436d431c79d727d54d66a52b1`; every PR commit is GitHub `Verified`. - `npm run build:cli` and `npm run typecheck:cli` passed. - Focused gateway/Brev/workflow regression set: 23/23 passed. - OpenShell version-pin live-hermetic tests: 2/2 passed. - Gateway-auth helpers and workflow boundary: 21/21 passed. - Focused unified workflow selection: 2/2 passed; workflow inventory and Vitest project-overlap checks passed. - Isolated broad regression reruns passed: CLI list/share/live inference 11/11; Hermes behavior 10/10; source installer/version/preflight 134/134; OpenShell installer integration 19/19; Docker-bootstrap preflight 4/4. - `npm run test-size:check`, `npm run source-shape:check`, `npm run test-conditionals:scan`, `git diff --check`, Biome, shell syntax, and focused docs/link checks passed. - Changed-range `prek` passed formatting, lint, schema/config, repository, env-doc, shellcheck, hadolint, gitleaks, source-shape, test-size, and plugin gates. Its instrumented full CLI/integration hook remains locally red on unchanged current-`main` child-process/host-state cases under Node `22.16.0`; no waiver is requested, and final-head GitHub CI is authoritative. - Fern validation completed with no errors and two pre-existing environment/theme warnings (unauthenticated redirect check and theme contrast), so the warning-free docs checkbox remains unchecked. - Superseded baseline only: full-nightly run [28402458227](https://github.com/NVIDIA/NemoClaw/actions/runs/28402458227) completed successfully on old head `823e3ca5e52ff843f6b79c237d009eafb5bcf3c7` with 68 successful and 4 intentionally skipped jobs. It is not final evidence for this head. - Still pending on `be74fad8f`: required CI, both advisors, human final-head confirmation, targeted live gateway-auth/network-policy/version/upgrade proof, and exact-head full nightly. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Aaron Erickson <aerickson@nvidia.com> --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> Signed-off-by: Preksha Vyas <prekshiv@nvidia.com> Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Refreshes the public documentation for NemoClaw v0.0.71 after scanning commits since v0.0.70. Adds release notes and fills the remaining doc gaps for Windows bootstrap diagnostics, OpenClaw agent auto-relock warnings, auto-pair cadence tuning, and plugin-install recovery hints. ## Changes - `docs/about/release-notes.mdx`: adds the v0.0.71 release-note section, grouped by gateway recovery, OpenShell auth, policy provenance, day-two maintenance, messaging/inference, and Windows setup. - `docs/get-started/windows-preparation.mdx`: documents sanitized WSL install output and reboot gating in the Windows bootstrap. - `docs/reference/commands.mdx`: documents the host `agent` wrapper's shields auto-relock warning and OpenClaw auto-pair watcher tuning variables. - `docs/reference/troubleshooting.mdx`: adds plugin-install network failure recovery guidance and updates Windows WSL troubleshooting for sanitized install logs and reboot-required handling. Source summary: - NVIDIA#6065 -> `docs/about/release-notes.mdx`: Notes explicit model override preservation and gateway-log guard-chain recovery diagnostics. - NVIDIA#5874 -> `docs/about/release-notes.mdx`: Summarizes host-mediated `recover` and `gateway restart`, linking to lifecycle, command, troubleshooting, and trusted-boundary docs already added by the source PR. - NVIDIA#5596 -> `docs/about/release-notes.mdx`: Summarizes OpenShell 0.0.71 gateway auth, loopback binding, and compatibility-container docs already added by the source PR. - NVIDIA#5797 and NVIDIA#5798 -> `docs/about/release-notes.mdx`: Summarizes `policy-list` provenance, Restricted tier suppression, and Balanced tier weather behavior already reflected in policy docs. - NVIDIA#5784 -> `docs/about/release-notes.mdx`: Summarizes `--destroy-user-data` and the safe `--yes` uninstall behavior already documented in lifecycle and command docs. - NVIDIA#6034 -> `docs/about/release-notes.mdx`: Summarizes custom Dockerfile warm-build cache behavior already documented in the command reference. - NVIDIA#5951 -> `docs/reference/commands.mdx`: Documents the stderr-only host `agent` wrapper warning after recent shields auto-relock. - NVIDIA#5387 -> `docs/reference/commands.mdx`: Documents OpenClaw auto-pair watcher cadence and fast-reentry tuning variables. - NVIDIA#5835 -> `docs/reference/troubleshooting.mdx`: Adds recovery guidance for OpenClaw plugin-install network failures. - NVIDIA#5995 and NVIDIA#5956 -> `docs/about/release-notes.mdx`: Summarizes Microsoft Teams final-message delivery and runtime mention hints already covered by messaging docs. - NVIDIA#5716 -> `docs/about/release-notes.mdx`: Summarizes non-interactive Ollama loopback safety already covered by local inference docs. - NVIDIA#5505, NVIDIA#5527, and NVIDIA#5528 -> `docs/about/release-notes.mdx`: Summarizes compatible local endpoint, model task-fit, and model capability audit docs. - NVIDIA#6009 -> `docs/get-started/windows-preparation.mdx`, `docs/reference/troubleshooting.mdx`: Documents sanitized Windows bootstrap WSL output and reboot-required gating. - NVIDIA#6055 -> no additional source doc page change needed beyond the already-merged quickstart update; release notes did not duplicate routine quickstart cleanup. No matching v0.0.71 GitHub announcement discussion was found in the latest 20 discussions, so this refresh is based on the commit scan and existing source PR docs. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: docs-only refresh with no runtime behavior changes. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — ran `npm run docs`; Fern reported 0 errors and 2 existing warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new release-notes entry covering gateway recovery, authentication, network policy/provenance output, uninstall safety, Windows bootstrap diagnostics, messaging defaults, and inference setup guidance. * Clarified Windows preparation steps around reboot behavior and redacting troubleshooting transcripts. * Expanded command reference details for OpenClaw wrapper behavior and new auto-pair tuning options. * Improved troubleshooting guidance for plugin installation issues, WSL repair/reboot cases, and install timing problems. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> Co-authored-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary NemoClaw `v0.0.74` will ship stable OpenShell `v0.0.72`. This dependency layer advances the supported OpenShell contract from `0.0.71` to `0.0.72`, pins every consumed release artifact, preserves round-trippable policy state, and hardens installer verification so pull-request code cannot authorize its own pins. ## Related Issue Refs NVIDIA#5591. Follow-up to merged NVIDIA#5596. Dependency layer for NVIDIA#5876 and the accepted MCP design in NVIDIA#566. ## Changes - Pin stable OpenShell `0.0.72` across the supported version floor/ceiling, installer, Brev launchable, blueprint, supervisor image, workflow, and live-E2E contracts. OpenShell development builds remain compatibility evidence, not the shipping runtime. - Pin all consumed CLI, gateway, and sandbox archives plus both Brev CLI references to the official `v0.0.72` checksum manifests. - Read mutation input from `openshell policy get --base`, strip reserved `_provider_*` entries before `policy set`, retain `--full` only for read-only diagnostics, and preserve future mapping sections plus MCP/JSON-RPC fields during merges. - Route the CommonJS CLI and ESM plugin through one generated OpenShell policy boundary and exact-pin `yaml` `2.8.3` in both production package graphs. - Normalize that boundary for both compiled CommonJS and source-mode `tsx` loading. A subprocess package-contract test reproduces the live source-loader path that exposed the mismatch. - Run installer verification from base-trusted code. The introducing PR falls back only to immutable commit `cb5e9aefab2b16fedc0995149fc3520da0d5e0c7`, verified as tree `1fdf59efe40b78c407e222fd42043b23a61e199a`, with an enforced expiry at `2026-12-29T19:35:41Z`. - Treat PR-head installer files as data only. The trusted parser rejects symbolic links, a symbolic-link `scripts` parent, non-regular files, changed inode/device identity, and input over 1 MiB; it opens with `O_NOFOLLOW` and performs a bounded descriptor read. - Fail installer verification closed on missing, duplicate, mismatched, incomplete, or unreachable OpenShell/Brev pin data. - Publish the OpenShell `0.0.72` compatibility review and align version, policy, gateway-authentication, and troubleshooting documentation. ### Exact-head evidence - PR head: `2d06fa01b624b63813fe558ce36b29d47ad31e36`, based exactly on current `main` `dc96deb24d67eeeb2cb7b2bb42c7c53f000507f3`. The final signed merge incorporates the release-boundary revert that defers unrelated dcode-status work, so this dependency PR does not reintroduce NVIDIA#6202 outside its scope. - GitHub verifies the new merge commit signature, DCO is green, the prior maintainer approval remains recorded at [review 4611344448](NVIDIA#6020 (review)), and GitHub reports the PR graph as `MERGEABLE`. - Post-restack local validation passes `build:cli`, full and CLI typechecks, repository checks, generated agent-doc synchronization, affected Deep Agents image contracts, and `git diff --check`. - All exact-head ordinary PR checks are terminal green (33 successful, three skipped/neutral, zero failures), including macOS/WSL E2E, every CLI shard and aggregate, static/security scans, DCO, and both PR Review Advisor jobs. GitHub reports `APPROVED` and `MERGEABLE/CLEAN`. - Exact-head selected OpenShell [E2E run 28632123304](https://github.com/NVIDIA/NemoClaw/actions/runs/28632123304) is terminal green: version pin, gateway-auth contract, network policy, gateway upgrade/state restoration, scorecard, and the no-comment reporter all passed from a temporary no-PR ref at the identical commit. The temporary ref was deleted after completion. - Exact-head PR Review [run 28632002111](https://github.com/NVIDIA/NemoClaw/actions/runs/28632002111) and E2E Advisor [run 28632002140](https://github.com/NVIDIA/NemoClaw/actions/runs/28632002140) are green. GPT reports no actionable finding; Nemotron's check passed but both JSON synthesis attempts were unparseable, so that model's artifact is incomplete rather than clearance. E2E Advisor reports high confidence and selects the four live lanes linked above. ### Trust-boundary notes - The immutable bootstrap is intentionally used only while the PR base lacks the trusted action. Once that action exists on the base, executing the newer base-trusted verifier is the stronger boundary; the expiring bootstrap should then be removed rather than run redundantly. - No untrusted PR process executes alongside the parser. GitHub checks out inert PR data, then trusted code validates and reads the already-opened descriptor. The link/type/identity/bounds checks cover repository-controlled redirection and exhaustion inputs without claiming protection from a privileged concurrent host writer. - Stable OpenShell `0.0.72` accepts an unmarked policy root only when it contains `version` or `network_policies`; metadata-only and malformed documents fail closed. Versionless `network_policies` is retained for the supported compatibility contract. ### Advisor disposition - GPT reported no required findings and one warning about the mutable default `BASE_IMAGE` tag. That `ARG BASE_IMAGE=ghcr.io/nvidia/nemoclaw/sandbox-base:latest` line is unchanged from current `main`; this dependency PR neither introduces nor broadens that repository-wide build default. - Nemotron's bootstrap finding would weaken the intended trust transition: the immutable bootstrap exists only for the introducing PR. Once the action is present on the base, the newer base-trusted action must replace the older bootstrap; both paths are immutable for the current event and are contract-tested. - Nemotron's parser race assumes an untrusted concurrent filesystem writer. PR code is never executed in this job: GitHub checks out inert data, then trusted code rejects links/special files, checks the opened descriptor's device/inode, bounds the read, and closes it. A privileged host writer is outside this PR-input threat model. - Nemotron's checksum finding is not circular. The trusted checker pins the SHA-256 of each upstream checksum manifest, verifies that immutable manifest before reading it, and compares every embedded installer pin with exactly one manifest entry. At install time each named archive must exist and match its pinned digest, so a missing asset still fails closed without downloading all archives during every PR check. - The generated-boundary auditor executes in the Docker builder stage exercised by ordinary `build-sandbox-images` CI. The exact source-mode `.cts` versus generated `.cjs` mismatch found by live proof is now covered directly by the subprocess package-contract test and the compiled runner suites. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: policy mutation, package boundary, installer trust, workflow selection, and runtime upgrade/state-restoration have focused coverage; final selected E2E is linked above. - [ ] Tests not applicable — justification: not applicable; this changes security-sensitive installer, policy, and runtime compatibility behavior. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: not applicable; supported OpenShell versions and policy behavior are user-facing. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: the linked approval predates the current head; exact-head human review or an explicit carried-approval decision remains required, and no waiver is requested. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: no waiver is requested; exact-head ordinary CI is green, and the selected run's comment-only reporter caveat is documented above and is not a required PR check. ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [x] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> Signed-off-by: Preksha Vyas <prekshiv@nvidia.com> Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
…VIDIA#5595) <!-- markdownlint-disable MD041 --> ## Summary Upgrade NemoClaw to `openclaw@2026.6.10` and adapt packaging, compiled-runtime compatibility patches, messaging plugins, rebuild recovery, and E2E coverage to the reviewed release. The change retains the existing fail-closed package, credential-recovery, state-restore, and runtime-proof boundaries while moving one stable patch release forward from 2026.6.9. ## Related Issue - Refs NVIDIA#5591. - NVIDIA#5596 (OpenShell 0.0.71) landed first, preserving the dependency landing order; this PR targets `v0.0.74`. - Post-tag installer consolidation and fixture retirement remain tracked in NVIDIA#5896 and are not blockers for the first tag containing this PR. ## Changes - Pin `openclaw@2026.6.10`, diagnostics, Brave, Discord, Slack, WhatsApp, and Microsoft Teams packages to their reviewed npm SRIs across images, manifests, package metadata, lifecycle policy, and version-aware tests. - Verify registry metadata and downloaded archives before install, suppress package-controlled lifecycle scripts, and retain the explicit reviewed OpenClaw postinstall boundary. - Re-audit the published 2026.6.10 tarball, shrinkwrap, npm graph, Teams package-load hashes, weather skill, and every compiled-dist patch selector. - Keep the fail-closed sandbox fetch/proxy, chat correlation, compact tool catalog, Teams message-hint, and NVIDIA#4434 unreachable-inference compatibility patches bound to the reviewed distribution. - Route repair-only device self-approval through OpenClaw CLI, authenticated gateway dispatch, and canonical locked-state authorization. Exact bounded repairs use the existing stored device credential and fail without falling back to shared/admin credentials or local approval; no Python process reads or writes device credentials or pairing state. - Preserve keyless rebuild recovery only for the exact registered provider, model, credential binding, endpoint identity, API, and persisted route, without reading, exporting, or replacing the credential. - Restore registry rows from an atomic removal receipt and reclaim a removed default only when no concurrent default transition superseded it. - Isolate `NEMOCLAW_PREFERRED_API` along with all other ambient inference selectors during rebuild resume, preserving the recorded sandbox route. - Reject multiline production build arguments and decimal-version inputs that could inject legacy fixture overrides through workflow dispatch. - Scan snapshot credential assignments through the shared credential-name classifier while continuing to permit only recognized `models.json` environment/secret references. - Classify NVIDIA#4434 diagnostics only from the final contiguous, bounded TUI `run error:` block so unrelated transcript text cannot satisfy the guard. - Split generated runtime-proof source into bounded OpenShell arguments, validate the proof port as decimal `1..65535`, and construct only the fixed loopback proof URL. - Run the real published-distribution SRI/patch/audit harness from trusted main CI while retaining explicit local opt-in proof. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: focused unit, integration, E2E-support, workflow-contract, package-contract, and real published-distribution suites exercise every changed boundary. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: final-head maintainer re-review pending. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: no waiver requested. ### Risk Boundaries - Keyless provider reuse never reads, exports, or replaces a credential. The shared pre-delete/runtime assessment requires the exact registered route and gateway binding; missing, oversized, ambiguous, spoofed, or incompatible metadata fails before deletion or triggers rollback. - OpenShell intentionally redacts provider values. Custom endpoint reuse therefore also requires authoritative registry route identity and no conflicting recorded endpoint; the recovery path never updates the provider. - Rebuild resume cannot borrow ambient agent, provider, model, endpoint, credential, preferred API, or reasoning values from another sandbox. - Registry rollback restores a removed default only when both the fallback pointer and persisted selection revision still match. A later explicit default choice is preserved even when it selects that same fallback value. - Production build guards reject CR/LF input, the legacy fixture flag, retained legacy versions, and fixture-only integrity/tarball overrides before every production image build. - Snapshot restore accepts only typed or recognized credential references in `models.json`; concrete keys, bearer tokens, assignments, and arbitrary credential values remain rejected. - Messaging-plugin registry provenance now requires the exact package spec, committed registry `dist.integrity`, committed registry `dist.tarball` URL, and packed-byte SRI before `npm pack` or plugin installation. Missing or mismatched metadata fails closed; NVIDIA#5896 remains only the shared-installer consolidation tracker. - The reviewed archive contract remains duplicated across isolated Docker and Node execution contexts so each transaction fails before install. Shared installer consolidation remains NVIDIA#5896 rather than widening this bump. - Compiled-dist patches are scoped to the SRI-verified 2026.6.10 shapes and fail closed on selector drift; they must be removed when upstream supplies equivalent behavior. - Same-device repair selects stored-device authentication only for the exact signed CLI/operator/pairing baseline. A failure rethrows before shared/admin or local-state fallback, and the handler plus locked writer revalidate the current pending identity and bounded scopes before token rotation. - The NVIDIA#4434 shim enriches only reviewed normalized failures inside OpenShell sandboxes. Its live guard requires the complete final error block and cannot borrow diagnostic keywords from earlier output. - No Teams tenant credentials, captured activities, or public-ingress scaffold are included; Teams evidence remains package/load-boundary evidence. ## Verification Exact head: `5911445d55dfd10b03233b4133195e6d8c8d0e60` Current `main`: `06b78aae3816ffe23eab64e9327ca99407a5a527` - [x] PR description includes the DCO sign-off declaration and the new commit includes `Signed-off-by` - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes — all commit/push hooks passed except the deliberately skipped unsharded `test-cli` coverage hook; exact-head hosted coverage shards are required below. - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) — the unsharded local coverage hook was attempted on the complete tree but exceeded many existing 5-second per-test limits under coverage on this Mac. Every changed boundary passes in isolated focused runs; authoritative hosted coverage shards are required below and no waiver is requested. - [ ] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Local exact-tree evidence: - `npm run build:cli`, `npm run typecheck:cli`, `npm run typecheck`, repository checks, Vitest project/import/title checks, and the 1,216-file test-size scan passed on the merged tree. - Final exact-head rebuild, registry, provider-recovery, base-image-handoff, destroy, DCode, and recovery suites: 167 CLI tests passed. - Final exact-head destroy, fetch-guard, stored-device-auth, workflow-contract, and scorecard suite: 83 integration tests passed. - Final exact-head NVIDIA#4462 fixture boundary and E2E workflow-contract suite: 22 E2E-support tests passed. - OpenClaw archive/build-argument/mcporter provenance suite: 37 passed; messaging build-applier provenance suite: 30 passed. - OpenClaw chat and device-scope compiled-runtime patch suites: 32 passed. - The real OpenClaw 2026.6.10 NVIDIA#4462 pairing-only repair and exact raw CLI identity proof passed through the extracted live heredoc path with no pending request left behind; the executable fixture contract observes `paired.json` → `device-auth.json` → `pending.json` publication. - Real `openclaw@2026.6.10` published-tarball SRI, patch application, and patch audit/config-token gateway harness: 3 passed in 117.43 seconds on Node 22.19 at the current exact head. - Changed files pass Biome formatting, lint, shellcheck, hadolint, YAML/JSON, Markdown, secret, schema, repository, source-shape, size, and diff checks. - The repository-wide format check still reports two pre-existing clean files outside this PR; neither is changed here and no waiver is applied to PR CI. Hosted exact-head requirements before merge: - [x] Ordinary PR matrix, including sharded CLI/plugin coverage, green. - [x] Fresh GPT and Nemotron advisor runs completed and dispositioned. - [x] Full exact-head E2E matrix green with only documented explicit-only skips. - [x] Branch zero commits behind current `main` after all proof completes. - [ ] One approving review and no unresolved blocking thread. Final exact-head hosted evidence: - [Ordinary PR matrix](https://github.com/NVIDIA/NemoClaw/actions/runs/28703740246) is green, including all five CLI shards, static checks, build/typecheck, installer integration, plugin tests, and the aggregate gate. - [Base images](https://github.com/NVIDIA/NemoClaw/actions/runs/28703746118) and [sandbox images plus E2E](https://github.com/NVIDIA/NemoClaw/actions/runs/28703773610) are green at the exact head and exercised the reviewed OpenClaw and locked mcporter provenance-reuse paths. - [Full E2E](https://github.com/NVIDIA/NemoClaw/actions/runs/28703774060) attempt 2 is green: every default-enabled job passed, five explicit-only jobs were intentionally skipped, and no failures remain. - [Targeted NVIDIA#4462 plus rebuild-openclaw](https://github.com/NVIDIA/NemoClaw/actions/runs/28703787702) and the [Hermes dashboard rerun](https://github.com/NVIDIA/NemoClaw/actions/runs/28704016943) are green at the exact head. - [Final advisor run](https://github.com/NVIDIA/NemoClaw/actions/runs/28703740209) completed successfully. GPT reports zero required and zero new findings. Its remaining floating-Docker-action warning concerns refs inherited unchanged from current `main`; repository-wide action pinning is accepted as separate hardening rather than scope for this dependency bump. The duplicate non-interactive-helper suggestion is likewise a non-blocking refactor. Nemotron's repeated source-of-truth and structural findings do not identify a new final-head defect; the applicable integrity, recovery, trusted-main, and decomposition boundaries are documented above and in NVIDIA#5896. CodeRabbit, CodeQL, and all required contexts are green; all review threads are resolved. The branch is zero commits behind `main`, carries label `v0.0.74`, and is mergeable. The only outstanding branch-protection gate is a final approving review; [re-review was requested from @apurvvkumaria](NVIDIA#5595 (comment)). ## Rollback Plan Revert this PR as a unit, restoring the prior OpenClaw pins, integrity values, plugin-install behavior, state-restore rules, and compatible patch set. Do not combine the older runtime pin with 2026.6.10 compiled-dist selectors. Rebuild base and sandbox images, then rerun the affected E2E lanes. --- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Upgraded bundled OpenClaw runtime to **2026.6.10** with fully version-pinned messaging plugins. * Enhanced sandbox rebuild with registry receipts/rollback and improved routing credential preflight. * Added an e2e **snapshot credential scanner** to detect credential leaks. * **Bug Fixes** * Improved **chat.send** compatibility (embedded retry persistence + preserved run/session wiring). * Strengthened unreachable-inference UI diagnostics and tightened approval/retry flows to prevent unintended state changes. * **Documentation** * Updated Telegram troubleshooting and messaging-channel docs; added the **OpenClaw 2026.6.10** dependency review. * **Chores / CI** * Hardened Docker build-arg validation and added a real OpenClaw dist harness; added messaging plugin provenance integrity checks. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> Signed-off-by: Andrew Erickson <aerickson@nvidia.com>
2 tasks
21 tasks
23 tasks
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR advances NemoClaw's stable OpenShell support from
0.0.44on currentmainto0.0.71, including checksum-pinned installation, authenticated Docker-driver gateway startup, fail-closed recovery behavior, and unified E2E coverage. It preserves the existing CLI integration and adds the fullnemoclaw <sandbox> logs --tail 50denied-egress regression required by #4760.Related Issue
Fixes #4760
Refs #5591
Refs #5513
Changes
0.0.71across the blueprint, installer, onboarding version checks, Brev launchable bootstrap, and unified E2E workflow, with published release SHA-256 digests for supported CLI and gateway assets.no-new-privileges, and a validated Unix Docker socket./var/run/docker.sockrestricted, using Docker-group execution for daemon commands, and removing mutable image pre-pulls andlatestfallbacks..github/workflows/e2e.yamlandtest/e2e/**, including the explicit live gateway-auth job and [All Platforms][Policy&Network] Policy DENIED log truncates [reason:...] field with literal '...' — full endpoint and policy name unreadable in 'nemoclaw <sb> logs --tail' #4760's full denied-reason assertion fromlogs --tail 50.Type of Change
Quality Gates
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Current exact-head merge evidence:
1c9f7ef97380c11ce44c8c49de53e25ff1ec752d; every PR commit is GitHubVerified. Maintainer merge commit:d091ff0d78461dc7e6d94ae42f00e7f6842491a3.report-to-prrejecting a comment after chore(openshell): upgrade supported version to 0.0.71 #5596 had already merged.full-e2eandopenclaw-tui-chat-correlation, with four expected skips and zero E2E/code failures. Its workflow-level failure is likewise only the post-mergereport-to-prclosed-PR guard.npm run build:cli,npm run typecheck:cli, focused gateway/Brev/workflow regressions, version-pin, gateway-auth, unified-workflow selection, installer integration, test-size, source-shape, conditional, formatting, shell, and docs/link checks.no-new-privileges, port-unpublished, and Unix-socket constrained; recovery no longer suggests the nonexistentpolicy-addcommand; source-boundary/removal markers and the chore(openshell): upgrade supported version to 0.0.72 #6020 landing order are documented.npm testand warning-free-docs boxes remain honest local-proof boundaries; the exact-head GitHub matrices above are the merge evidence.Signed-off-by: Aaron Erickson aerickson@nvidia.com