chore(openshell): upgrade supported version to 0.0.72

.github/actions/ci-installer-hash-check/action.yaml

@@ -0,0 +1,19 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Trusted installer hash check
+description: Run the trusted installer hash verifier against an explicit repository tree.
+
+inputs:
+  repo-root:
+    description: Absolute path to the repository tree whose installer pins are being verified.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Verify installer hashes are current
+      shell: bash
+      env:
+        NEMOCLAW_INSTALLER_HASH_REPO_ROOT: ${{ inputs.repo-root }}
+      run: bash "${{ github.action_path }}/../../../scripts/check-installer-hash.sh"

.github/actions/ci-plugin-coverage/action.yaml

@@ -29,6 +29,7 @@ runs:
           --coverage.reporter=cobertura \
           --coverage.reportsDirectory=coverage/plugin \
           --coverage.include="nemoclaw/src/**/*.ts" \
+          --coverage.include="nemoclaw/src/**/*.cts" \
           --coverage.exclude="**/*.test.ts"
         npx tsx scripts/check-coverage-ratchet.ts coverage/plugin/coverage-summary.json ci/coverage-threshold-plugin.json "Plugin coverage"
 

.github/workflows/e2e.yaml

@@ -432,7 +432,7 @@ jobs:
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/openshell-gateway-auth-contract
       NEMOCLAW_RUN_LIVE_E2E: "1"
       NEMOCLAW_NON_INTERACTIVE: "1"
-      NEMOCLAW_OPENSHELL_PIN_VERSION: "0.0.71"
+      NEMOCLAW_OPENSHELL_PIN_VERSION: "0.0.72"
       DOCKER_GRPC_PROBE_IMAGE: "node:22-trixie-slim@sha256:2d9f5c76c8f4dd36e8f253bee5d828a83a6c09f36188f0b0414325232e0b175d"
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

.github/workflows/installer-hash-check.yaml

@@ -2,8 +2,10 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 # Verifies pinned installer SHA-256 hashes still match upstream scripts.
-# Checked: Ollama installer.
-# Runs on every PR and push to main, plus a weekly scheduled check.
+# Checked: OpenShell v0.0.72 installer and Brev release assets.
+# Reports the required network-backed drift check on every PR, every push to
+# main, and weekly. Pull requests execute checker code from their base commit;
+# the immutable bootstrap is used only for the PR that first adds that action.
 
 name: Security / Installer Hash Check
 
@@ -26,8 +28,164 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - name: Checkout
+      - name: Set up trusted installer hash parser runtime
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
+        with:
+          node-version: 22.16.0
+
+      # The full PR-head checkout below supplies data only. Its checker and pin
+      # parser are never executed: later steps run exclusively from either
+      # .trusted-installer-hash or .bootstrap-installer-hash.
+      - name: Checkout pull request head
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+
+      - name: Checkout trusted event
+        if: github.event_name != 'pull_request'
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Checkout base-trusted installer hash action
+        if: github.event_name == 'pull_request'
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          path: .trusted-installer-hash
+          persist-credentials: false
+          sparse-checkout: |
+            .github/actions/ci-installer-hash-check
+            scripts/check-installer-hash.sh
+            scripts/checks/extract-installer-pins.mts
+          sparse-checkout-cone-mode: false
+
+      - name: Detect base-trusted installer hash action
+        id: trusted-installer-hash
+        if: github.event_name == 'pull_request'
+        shell: bash
+        run: |
+          if [[ -f .trusted-installer-hash/.github/actions/ci-installer-hash-check/action.yaml ]]; then
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "available=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      # invalidState: the first PR that introduces this action has no copy in
+      # its base commit. Running the mutable PR-side checker would let that PR
+      # authorize its own installer pins.
+      # sourceBoundary: this exact commit and reviewed Git tree contain the
+      # trusted action and checker; the PR head supplies only inspected files.
+      # whyNotSourceFix: a base commit cannot contain a new action before the
+      # introducing PR merges, so the bootstrap must name immutable code once.
+      # regressionTest: test/pr-workflow-contract.test.ts rejects mutable
+      # checker execution, non-immutable refs, and a mismatched reviewed tree.
+      # manualReviewEvidence: on 2026-07-02, independent Git object inspection
+      # confirmed commit cb5e9aefab2b16fedc0995149fc3520da0d5e0c7 has
+      # tree 1fdf59efe40b78c407e222fd42043b23a61e199a. The reviewed bootstrap
+      # script SHA-256 is 179e1572932eedc1a8ed974d534e9f2a5c34db7ebe971000dc20b77ed9d9feb3;
+      # its parser SHA-256 is
+      # e1d6b63a7b0378a3d28ee71d347ade2da75b3fcf2ff55aa55a9b54d2bc2fc13a;
+      # and its composite-action SHA-256 is
+      # 9c48c64cc934032c99a0aa9aa08b1164757988dc2842e1df88d1b7252ce1183f.
+      # removalCondition: remove the bootstrap checkout after this workflow has
+      # landed on every supported PR base. The fallback is refused after the
+      # explicit 180-day review window ending 2026-12-29T19:35:41Z.
+      - name: Enforce immutable installer hash bootstrap expiry
+        if: >-
+          github.event_name == 'pull_request' &&
+          steps.trusted-installer-hash.outputs.available != 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          node <<'NODE'
+          const commit = "cb5e9aefab2b16fedc0995149fc3520da0d5e0c7";
+          const expiresAt = "2026-12-29T19:35:41Z";
+          const expiresAtMs = Date.parse(expiresAt);
+          const canonicalExpiresAt =
+            Number.isFinite(expiresAtMs) && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/u.test(expiresAt)
+              ? new Date(expiresAtMs).toISOString().replace(".000Z", "Z")
+              : "";
+
+          if (!/^[a-f0-9]{40}$/u.test(commit) || canonicalExpiresAt !== expiresAt) {
+            console.error(
+              "::error::Immutable installer hash bootstrap expiry configuration is invalid; " +
+                "refusing the fallback. Expected a 40-character commit SHA and canonical UTC expiry.",
+            );
+            process.exit(1);
+          }
+
+          if (Date.now() >= expiresAtMs) {
+            console.error(
+              `::error::Immutable installer hash bootstrap ${commit} expired at ${expiresAt}. ` +
+                "Remove the bootstrap fallback or replace it with newly reviewed immutable checker code.",
+            );
+            process.exit(1);
+          }
+
+          const daysRemaining = Math.ceil((expiresAtMs - Date.now()) / 86_400_000);
+          console.log(
+            `Immutable installer hash bootstrap ${commit} remains valid for ${daysRemaining} day(s), ` +
+              `until ${expiresAt}.`,
+          );
+          NODE
+
+      - name: Checkout immutable installer hash bootstrap
+        if: >-
+          github.event_name == 'pull_request' &&
+          steps.trusted-installer-hash.outputs.available != 'true'
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: cb5e9aefab2b16fedc0995149fc3520da0d5e0c7
+          path: .bootstrap-installer-hash
+          persist-credentials: false
+          sparse-checkout: |
+            .github/actions/ci-installer-hash-check
+            scripts/check-installer-hash.sh
+            scripts/checks/extract-installer-pins.mts
+          sparse-checkout-cone-mode: false
+
+      - name: Verify immutable installer hash bootstrap tree
+        if: >-
+          github.event_name == 'pull_request' &&
+          steps.trusted-installer-hash.outputs.available != 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          readonly expected_commit="cb5e9aefab2b16fedc0995149fc3520da0d5e0c7"
+          readonly expected_tree="1fdf59efe40b78c407e222fd42043b23a61e199a"
+          actual_commit="$(git -C .bootstrap-installer-hash rev-parse HEAD)"
+          actual_tree="$(git -C .bootstrap-installer-hash rev-parse 'HEAD^{tree}')"
+          if [[ "${actual_commit}" != "${expected_commit}" ]]; then
+            echo "::error::Immutable installer hash bootstrap checkout does not match the reviewed commit." >&2
+            exit 1
+          fi
+          if [[ "${actual_tree}" != "${expected_tree}" ]]; then
+            echo "::error::Immutable installer hash bootstrap checkout does not match the reviewed tree." >&2
+            exit 1
+          fi
+
+      - name: Verify pull request installer hashes from base-trusted code
+        if: >-
+          github.event_name == 'pull_request' &&
+          steps.trusted-installer-hash.outputs.available == 'true'
+        uses: ./.trusted-installer-hash/.github/actions/ci-installer-hash-check
+        with:
+          repo-root: ${{ github.workspace }}
+
+      - name: Verify pull request installer hashes from immutable bootstrap
+        if: >-
+          github.event_name == 'pull_request' &&
+          steps.trusted-installer-hash.outputs.available != 'true'
+        uses: ./.bootstrap-installer-hash/.github/actions/ci-installer-hash-check
+        with:
+          repo-root: ${{ github.workspace }}
 
-      - name: Verify installer hashes are current
-        run: bash scripts/check-installer-hash.sh
+      - name: Verify trusted event installer hashes
+        if: github.event_name != 'pull_request'
+        uses: ./.github/actions/ci-installer-hash-check
+        with:
+          repo-root: ${{ github.workspace }}

Dockerfile

@@ -22,8 +22,13 @@ ENV NPM_CONFIG_AUDIT=false \
     NPM_CONFIG_FETCH_TIMEOUT=300000
 COPY nemoclaw/package.json nemoclaw/package-lock.json nemoclaw/tsconfig.json /opt/nemoclaw/
 COPY nemoclaw/src/ /opt/nemoclaw/src/
+COPY scripts/checks/verify-openshell-policy-boundary-dependencies.mts /opt/nemoclaw-build-checks/
 WORKDIR /opt/nemoclaw
-RUN npm ci && npm run build
+RUN npm ci \
+    && npm run build \
+    && node --experimental-strip-types \
+        /opt/nemoclaw-build-checks/verify-openshell-policy-boundary-dependencies.mts \
+        /opt/nemoclaw/dist/shared/openshell-policy-boundary.cjs
 
 # Stage 2: Build TypeScript messaging runtime preloads.
 FROM builder AS runtime-preload-builder
@@ -101,9 +106,15 @@ ENV NPM_CONFIG_AUDIT=false \
     NPM_CONFIG_FETCH_RETRY_MINTIMEOUT=20000 \
     NPM_CONFIG_FETCH_RETRY_MAXTIMEOUT=120000 \
     NPM_CONFIG_FETCH_TIMEOUT=300000
+# The builder-stage verify-openshell-policy-boundary-dependencies.mts check is
+# the primary security gate: it enforces the generated boundary's strict module
+# dependency allowlist before this stage copies it. The node check below is
+# defense in depth only and proves the copied runtime still exports the complete
+# audited interface; function availability does not replace dependency lockdown.
 RUN npm ci --omit=dev \
     && test -f /usr/local/bin/node \
     && test -d /opt/nemoclaw/node_modules/json5 \
+    && node -e 'const boundary = require("/opt/nemoclaw/dist/shared/openshell-policy-boundary.cjs"); for (const name of ["parseOpenShellPolicy", "stripProviderComposedPolicies", "withoutProviderComposedPolicies"]) { if (typeof boundary[name] !== "function") throw new Error("OpenShell policy boundary export is unavailable: " + name); }' \
     && node_unsafe="$(find -L /usr/local/bin/node -maxdepth 0 \( ! -user root -o -perm /022 \) -print -quit)" \
     && test -z "$node_unsafe" \
     && json5_unsafe="$(find -L /opt/nemoclaw/node_modules/json5 \( ! -user root -o -perm /022 \) -print -quit)" \

ci/test-file-size-budget.json

@@ -12,6 +12,6 @@
     "test/onboard-messaging.test.ts": 2062,
     "test/onboard-selection.test.ts": 6867,
     "test/onboard.test.ts": 4774,
-    "test/policies.test.ts": 2489
+    "test/policies.test.ts": 2475
   }
 }

docs/about/release-notes.mdx

@@ -16,6 +16,14 @@ NVIDIA NemoClaw is available in early preview starting March 16, 2026.
 Use this page to track the highlights of the latest release.
 For more detailed release notes, refer to the [NemoClaw GitHub announcements](https://github.com/NVIDIA/NemoClaw/discussions/categories/announcements?discussions_q=is%3Aopen+category%3AAnnouncements).
 
+## v0.0.74
+
+NemoClaw v0.0.74 advances to OpenShell `0.0.72` and adopts its safe policy round-trip boundary:
+
+- Stable installs pin OpenShell `0.0.72` release artifacts and supervisor image, adding MCP Streamable HTTP and JSON-RPC request-policy enforcement.
+- Policy mutations now read the round-trippable base policy instead of the effective policy, preventing provider-composed `_provider_*` entries from being sent back through `policy set` while preserving existing MCP rules.
+  For more information, refer to [OpenShell 0.0.72 Compatibility Review](../security/openshell-0.0.72-compatibility-review) and [Customize the Network Policy](../network-policy/customize-network-policy).
+
 ## v0.0.73
 
 NemoClaw v0.0.73 improves custom endpoint safety, Linux GPU onboarding, agent-aware policy validation, upgrade recovery, LangChain Deep Agents Code inference, and operator documentation.

docs/index.yml

@@ -140,6 +140,9 @@ navigation:
               - page: "Credential Storage"
                 path: _build/agent-variants/security/credential-storage.openclaw.generated.mdx
                 slug: credential-storage
+              - page: "OpenShell 0.0.72 Compatibility Review"
+                path: _build/agent-variants/security/openshell-0.0.72-compatibility-review.openclaw.generated.mdx
+                slug: openshell-0.0.72-compatibility-review
               - page: "Trusted Computing Base"
                 path: _build/agent-variants/security/tcb-boundary.openclaw.generated.mdx
                 slug: trusted-computing-base
@@ -298,6 +301,9 @@ navigation:
               - page: "Credential Storage"
                 path: _build/agent-variants/security/credential-storage.hermes.generated.mdx
                 slug: credential-storage
+              - page: "OpenShell 0.0.72 Compatibility Review"
+                path: _build/agent-variants/security/openshell-0.0.72-compatibility-review.hermes.generated.mdx
+                slug: openshell-0.0.72-compatibility-review
               - page: "Trusted Computing Base"
                 path: _build/agent-variants/security/tcb-boundary.hermes.generated.mdx
                 slug: trusted-computing-base

docs/network-policy/customize-network-policy.mdx

@@ -142,28 +142,29 @@ This path preserves existing policy entries and is the only NemoClaw-supported f
 $$nemoclaw my-assistant policy-add
 ```
 
-NemoClaw reads the live policy with `openshell policy get --full`, structurally merges your preset's `network_policies` into it, and writes the merged result back.
+NemoClaw reads the round-trippable base policy with `openshell policy get --base`, structurally merges your preset's `network_policies` into it, and writes the merged result back.
+Provider-composed `_provider_*` entries are excluded because OpenShell reserves that namespace and rejects it in `policy set`.
 Existing presets and the baseline remain in place.
 The preset file under `presets/` also persists across sandbox recreations.
 
 ### Option 2: Snapshot, Edit, and Set with OpenShell
 
 Use this path only when you cannot add a file under the NemoClaw source tree.
 Start from the current live policy so the presets layered on at onboarding stay in the file you apply.
-Requires OpenShell 0.0.44+ for `policy get --full` and `policy set --wait` syntax.
+Requires OpenShell 0.0.72+ for the round-trippable `policy get --base` and `policy set --wait` syntax.
 Strip the OpenShell metadata header before editing the file, then validate the raw policy shape before replacing your editable copy.
 The command order below matches the commands NemoClaw emits internally.
 
 ```bash
 # shellcheck shell=bash
 # Source-of-truth review:
-# invalidState: OpenShell 0.0.44 policy get --full emits metadata before the --- YAML header.
+# invalidState: OpenShell 0.0.72 policy get --base emits metadata before the --- YAML header.
 # sourceBoundary: OpenShell CLI output is owned by the separate OpenShell project.
 # whyNotSourceFix: NemoClaw pins OpenShell but cannot change that upstream formatter here.
 # regressionTest: test/policy-roundtrip-docs.test.ts validates this shared docs pattern.
 # removalCondition: remove this pipeline after pinned OpenShell emits clean raw YAML.
 tmp_policy=$(mktemp)
-openshell policy get --full my-assistant \
+openshell policy get --base my-assistant \
   | awk 'found { print } /^---$/ { found = 1 } END { if (!found) exit 1 }' \
   > "$tmp_policy" \
   && grep -q '^version:' "$tmp_policy" \

docs/network-policy/integration-policy-examples.mdx

@@ -368,18 +368,18 @@ $$nemoclaw my-assistant policy-list
 ```
 
 Use OpenShell when you need an editable copy of the live policy.
-Requires OpenShell 0.0.44+ for `policy get --full` and `policy set --wait` syntax.
+Requires OpenShell 0.0.72+ for the round-trippable `policy get --base` and `policy set --wait` syntax.
 
 ```bash
 # shellcheck shell=bash
 # Source-of-truth review:
-# invalidState: OpenShell 0.0.44 policy get --full emits metadata before the --- YAML header.
+# invalidState: OpenShell 0.0.72 policy get --base emits metadata before the --- YAML header.
 # sourceBoundary: OpenShell CLI output is owned by the separate OpenShell project.
 # whyNotSourceFix: NemoClaw pins OpenShell but cannot change that upstream formatter here.
 # regressionTest: test/policy-roundtrip-docs.test.ts validates this shared docs pattern.
 # removalCondition: remove this pipeline after pinned OpenShell emits clean raw YAML.
 tmp_policy=$(mktemp)
-openshell policy get --full my-assistant \
+openshell policy get --base my-assistant \
   | awk 'found { print } /^---$/ { found = 1 } END { if (!found) exit 1 }' \
   > "$tmp_policy" \
   && grep -q '^version:' "$tmp_policy" \

docs/reference/cli-selection-guide.mdx

@@ -118,18 +118,18 @@ Use `openshell` when the docs explicitly call for a live OpenShell gateway opera
 
 - Inspect or replace raw OpenShell policy:
 
-  Requires OpenShell 0.0.44+ for `policy get --full` and `policy set --wait` syntax.
+  Requires OpenShell 0.0.72+ for the round-trippable `policy get --base` and `policy set --wait` syntax.
 
   ```bash
   # shellcheck shell=bash
   # Source-of-truth review:
-  # invalidState: OpenShell 0.0.44 policy get --full emits metadata before the --- YAML header.
+  # invalidState: OpenShell 0.0.72 policy get --base emits metadata before the --- YAML header.
   # sourceBoundary: OpenShell CLI output is owned by the separate OpenShell project.
   # whyNotSourceFix: NemoClaw pins OpenShell but cannot change that upstream formatter here.
   # regressionTest: test/policy-roundtrip-docs.test.ts validates this shared docs pattern.
   # removalCondition: remove this pipeline after pinned OpenShell emits clean raw YAML.
   tmp_policy=$(mktemp)
-  openshell policy get --full <sandbox-name> \
+  openshell policy get --base <sandbox-name> \
     | awk 'found { print } /^---$/ { found = 1 } END { if (!found) exit 1 }' \
     > "$tmp_policy" \
     && grep -q '^version:' "$tmp_policy" \
@@ -229,7 +229,8 @@ Use `$$nemoclaw <name> policy-add` or `policy-remove` for NemoClaw presets and c
 NemoClaw merges the new policy with the live policy and reapplies presets during rebuilds.
 
 Use `openshell policy update` for precise live endpoint or REST rule changes.
-Use `openshell policy get --full <name>` and `openshell policy set --policy <file> --wait <name>` only when you need to edit and replace the raw policy file.
+Use `openshell policy get --base <name>` and `openshell policy set --policy <file> --wait <name>` only when you need to edit and replace the round-trippable base policy.
+Use `--full` only to inspect the effective policy, including provider-composed rules.
 
 ### Move Workspace Files