chore(openshell): upgrade supported version to 0.0.85

.github/workflows/e2e.yaml

@@ -567,7 +567,7 @@ jobs:
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/openshell-gateway-auth-contract
       NEMOCLAW_RUN_LIVE_E2E: "1"
       NEMOCLAW_NON_INTERACTIVE: "1"
-      NEMOCLAW_OPENSHELL_PIN_VERSION: "0.0.72"
+      NEMOCLAW_OPENSHELL_PIN_VERSION: "0.0.85"
       DOCKER_GRPC_PROBE_IMAGE: "node:22-trixie-slim@sha256:2d9f5c76c8f4dd36e8f253bee5d828a83a6c09f36188f0b0414325232e0b175d"
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -634,7 +634,9 @@ jobs:
       NEMOCLAW_E2E_SHARD: ${{ matrix.agent }}
       NEMOCLAW_MCP_BRIDGE_AGENT: ${{ matrix.agent }}
       NEMOCLAW_OPENSHELL_CHANNEL: stable
+      NEMOCLAW_OPENSHELL_EXACT_MAIN_PROOF: "1"
       NEMOCLAW_RUN_LIVE_E2E: "1"
+      OPENSHELL_DOCKER_SUPERVISOR_IMAGE: ghcr.io/nvidia/openshell/supervisor@sha256:f4226253a3525c3832adac5b38b419a0f27d1e915effe565b5885e20f93cd5e9
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
@@ -678,6 +680,20 @@ jobs:
         run: |
           set -euo pipefail
           bash scripts/install-openshell.sh
+          if [[ "$NEMOCLAW_MCP_BRIDGE_AGENT" == "deepagents" ]]; then
+            mkdir -p "$E2E_ARTIFACT_DIR/mcp-bridge-deepagents"
+            jq -n '{
+              schemaVersion: 1,
+              sourceRepository: "NVIDIA/OpenShell",
+              releaseTag: "v0.0.85",
+              sourceSha: "3dee5570a46076a57a3b056f35f35ebc0861ac85",
+              artifacts: {
+                cli: {binarySha256: "222d9d53a142691d7a7de2c692f38e52d24066f9f633d53746c5fef775861bc8"},
+                gateway: {binarySha256: "33bb479d936c3c1b17dd475df05747be9de74564fb67d69a4c33cdd01181d02f"},
+                standaloneSandbox: {binarySha256: "863ef21ab7ef623f5e7a8728c4e5532b46bfbae3ace3b800665a1c6353a1f7d2"}
+              }
+            }' > "$E2E_ARTIFACT_DIR/mcp-bridge-deepagents/openshell-exact-main-provenance.json"
+          fi
 
       - name: Run MCP OpenShell provider live test
         run: |
@@ -694,6 +710,13 @@ jobs:
           export OPENSHELL_BIN
           "$OPENSHELL_BIN" --version
           npx tsx tools/e2e/live-vitest-invocation.mts run --test-path test/e2e/live/mcp-bridge.test.ts
+          if [[ "$NEMOCLAW_MCP_BRIDGE_AGENT" == "deepagents" ]]; then
+            npx vitest run --project e2e-live \
+              test/e2e/live/openshell-credential-generation-window.test.ts \
+              -t '^openshell-credential-generation-window$' \
+              --no-file-parallelism \
+              --silent=false --reporter=default --reporter=test/e2e/risk-signal-reporter.ts
+          fi
 
       - id: mcp_artifact_secret_scan
         name: Scan MCP artifacts for fixture credentials
@@ -3575,6 +3598,15 @@ jobs:
             sandbox_base_image_ref: "ghcr.io/nvidia/nemoclaw/sandbox-base@sha256:10433a8cd2f2b809dd0fdf983514679e04c0f8aa1ff5bbff675029046033b108"
             openshell_version: 0.0.44
             openclaw_version: 2026.5.22
+          - id: v0.0.74-x86_64
+            runner: ubuntu-latest
+            shard: v0-0-74-x86-64
+            nemoclaw_ref: v0.0.74
+            nemoclaw_commit: "3a05b54e8ec3e1d5550ec5c728de54af872bffe3"
+            installer_sha256: "a0cd3feca488d247e53d59d7d8246d2b86e75e95acb5e7d78504b3c0c60fd7db"
+            sandbox_base_image_ref: "ghcr.io/nvidia/nemoclaw/sandbox-base@sha256:104151ffadc2ff0b6c815e3c95c2783ced61aee0d0f83fc327cc02be9b7e14e6"
+            openshell_version: 0.0.72
+            openclaw_version: 2026.5.27
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "openshell-gateway-upgrade"
@@ -3605,7 +3637,8 @@ jobs:
 
       - name: Run OpenShell gateway upgrade live Vitest test
         # Keep the original v0.0.36 fixture on x86_64 and validate the exact
-        # v0.0.55/OpenShell 0.0.44 regression shape on x86_64 and arm64.
+        # v0.0.55/OpenShell 0.0.44 regression shape on x86_64 and arm64, plus
+        # the immediate v0.0.74/OpenShell 0.0.72 predecessor to this bump.
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |

agents/hermes/Dockerfile

@@ -134,7 +134,7 @@ COPY agents/hermes/runtime-config-guard.py /usr/local/lib/nemoclaw/hermes-runtim
 COPY agents/hermes/finalize-tirith-marker.py /usr/local/lib/nemoclaw/finalize-tirith-marker.py
 COPY agents/hermes/build-mcp-digest.py /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py
 COPY agents/hermes/mcp-config-transaction.py /usr/local/lib/nemoclaw/hermes-mcp-config-transaction.py
-COPY src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.72.json /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.72.json
+COPY src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.85.json /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.85.json
 COPY scripts/state-dir-guard.py /usr/local/lib/nemoclaw/state-dir-guard.py
 COPY nemoclaw-blueprint/scripts/*.js /usr/local/lib/nemoclaw/preloads/
 # Dockerfile.base is the source of truth for rlimit hooks. This Hermes replay
@@ -143,11 +143,11 @@ COPY nemoclaw-blueprint/scripts/*.js /usr/local/lib/nemoclaw/preloads/
 # minimum supported Hermes sandbox base tag guarantees those artifacts and
 # test/sandbox-rlimit-hooks.test.ts covers that base.
 RUN chmod 755 /usr/local/bin/nemoclaw-start /usr/local/lib/nemoclaw/sandbox-init.sh /usr/local/lib/nemoclaw/validate-hermes-env-secret-boundary.py /usr/local/lib/nemoclaw/patch-hermes-session-list-preview.py /usr/local/lib/nemoclaw/seed-hermes-dashboard-config.py /usr/local/lib/nemoclaw/hermes-runtime-config-guard.py /usr/local/lib/nemoclaw/finalize-tirith-marker.py /usr/local/lib/nemoclaw/hermes-mcp-config-transaction.py \
-    && chown root:root /usr/local/bin/nemoclaw-gateway-control /usr/local/lib/nemoclaw/gateway-supervisor.sh /usr/local/lib/nemoclaw/state-dir-guard.py /usr/local/lib/nemoclaw/managed-gateway-control.py /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.72.json \
+    && chown root:root /usr/local/bin/nemoclaw-gateway-control /usr/local/lib/nemoclaw/gateway-supervisor.sh /usr/local/lib/nemoclaw/state-dir-guard.py /usr/local/lib/nemoclaw/managed-gateway-control.py /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.85.json \
     && chmod 700 /usr/local/bin/nemoclaw-gateway-control \
     && chmod 500 /usr/local/lib/nemoclaw/state-dir-guard.py /usr/local/lib/nemoclaw/managed-gateway-control.py \
     && chmod 444 /usr/local/lib/nemoclaw/gateway-supervisor.sh /usr/local/lib/nemoclaw/build-hermes-mcp-digest.py \
-    && chmod 444 /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.72.json \
+    && chmod 444 /usr/local/lib/nemoclaw/openshell-child-visible-credentials.v0.0.85.json \
     && if [ -d /usr/local/lib/nemoclaw/preloads ]; then \
         chown -R 0:0 /usr/local/lib/nemoclaw/preloads \
         && find /usr/local/lib/nemoclaw/preloads -type f -exec chmod 444 {} + \
@@ -207,7 +207,7 @@ PY
 # file has to also rewrite the Dockerfile-committed hash, which reviewers gate).
 # Regenerate with `sha256sum agents/hermes/{hermes-wrapper.py,validate-env-secret-boundary.py,finalize-tirith-marker.py}`.
 ARG NEMOCLAW_HERMES_WRAPPER_SHA256=ec8b0e4d6254175929d5a02240acd6af25e94774a30b36ba5c6f5a69c32fb9d7
-ARG NEMOCLAW_HERMES_VALIDATOR_SHA256=970d7ff03bc409ff1d5ca46bfdbd2a42ac28a32a810ccc147a508301bff38496
+ARG NEMOCLAW_HERMES_VALIDATOR_SHA256=d7371a84099b204346e0bfecfacb0086fdab690e5fadcf5e12417b6038927d19
 ARG NEMOCLAW_HERMES_TIRITH_FINALIZER_SHA256=a1e6b1c53ab297569abb87c29d15c294d729e46005bfd022136b4c447a791819
 # hadolint ignore=DL4006
 RUN printf '%s  %s\n' \

agents/hermes/mcp-config-transaction.py

@@ -58,7 +58,8 @@
 ENV_PLACEHOLDER_RE = re.compile(
     r"^Bearer openshell:resolve:env:([A-Za-z_][A-Za-z0-9_]{0,127})$"
 )
-BOUNDARY_MANIFEST_NAME = "openshell-child-visible-credentials.v0.0.72.json"
+OPENSHELL_REVISIONED_CREDENTIAL_NAME_RE = re.compile(r"^v[0-9]+_[A-Za-z0-9_]+$")
+BOUNDARY_MANIFEST_NAME = "openshell-child-visible-credentials.v0.0.85.json"
 ANSI_ESCAPE_RE = re.compile(
     r"\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07]*(?:\x07|\x1b\\)|[@-_])"
 )
@@ -116,7 +117,7 @@ def _load_credential_boundary_manifest() -> dict[str, object]:
     # corrupt, or wrong-version OpenShell boundary manifest.
     # sourceBoundary: NemoClaw owns one reviewed manifest installed beside this
     # helper in images; the second path is the deterministic source-checkout layout.
-    # whyNotSourceFix: OpenShell v0.0.72 has no machine-readable child-env contract.
+    # whyNotSourceFix: OpenShell v0.0.85 has no machine-readable child-env contract.
     # It also deliberately hides the supervisor identity mount from workload
     # children and the Hermes image contains no OpenShell CLI. Executing
     # ``openshell --version`` here would therefore either fail every real
@@ -142,7 +143,10 @@ def _load_credential_boundary_manifest() -> dict[str, object]:
     if manifest_path is None:
         raise RuntimeError("Hermes MCP credential boundary manifest is missing")
     manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
-    if not isinstance(manifest, dict) or manifest.get("openshellVersion") != "0.0.72":
+    if (
+        not isinstance(manifest, dict)
+        or manifest.get("openshellVersion") != "0.0.85"
+    ):
         raise RuntimeError("Hermes MCP credential boundary manifest is invalid")
     return manifest
 
@@ -175,7 +179,8 @@ def _manifest_strings(manifest: dict[str, object], key: str) -> frozenset[str]:
 
 def _credential_name_is_reserved(name: str) -> bool:
     return (
-        name in _RAW_CHILD_VALUE_KEYS
+        OPENSHELL_REVISIONED_CREDENTIAL_NAME_RE.fullmatch(name) is not None
+        or name in _RAW_CHILD_VALUE_KEYS
         or name in _REWRITTEN_CHILD_VALUE_KEYS
         or name in _RUNTIME_CONTROL_KEYS
         or any(name.startswith(prefix) for prefix in _RUNTIME_CONTROL_PREFIXES)
@@ -324,7 +329,7 @@ def _validate_payload(action: str, payload: dict[str, object]) -> None:
     }
     if action == "add" and hostname in host_aliases:
         raise ValueError(
-            "Authenticated MCP OpenShell host aliases are unavailable with OpenShell v0.0.72"
+            "Authenticated MCP OpenShell host aliases are unavailable with OpenShell v0.0.85"
         )
     if not (action == "remove" and hostname in host_aliases) and (
         hostname in {"localhost", "local", "internal", "metadata"}
@@ -1068,7 +1073,7 @@ def _assert_non_root_lifecycle_identity() -> None:
     # topology.
     # sourceBoundary: OpenShell owns workload topology; NemoClaw owns the
     # immutable root-lifecycle marker and validates it before mutation.
-    # whyNotSourceFix: OpenShell 0.0.72 supports both topologies but exposes no
+    # whyNotSourceFix: OpenShell 0.0.85 supports both topologies but exposes no
     # attested same-UID capability that this packaged helper can query.
     # regressionTest: hermes-mcp-config-transaction.test.ts rejects both probe
     # and add when the root-lifecycle marker identifies the legacy topology.

agents/hermes/runtime-config-guard.py

@@ -587,7 +587,7 @@ def _pinned_process_matches_supervised_nonroot_start(
     supervisor_identity: tuple[str, int | None],
     expected_effective_uid: int,
 ) -> bool:
-    # OpenShell 0.0.72 keeps its supervisor at PID 1 and launches the non-root
+    # OpenShell 0.0.85 keeps its supervisor at PID 1 and launches the non-root
     # NemoClaw entrypoint as a child, so startup authority must be proved from
     # pinned procfs identity rather than a PID-1 equality check. Remove this
     # compatibility proof when #6256 provides authenticated supervisor/runtime

agents/hermes/start.sh

@@ -3062,7 +3062,7 @@ fi
 # while Hermes actually runs in the legacy root-separated topology.
 # sourceBoundary: OpenShell owns workload topology; NemoClaw owns the immutable
 # root-lifecycle marker and stamps it before starting the root-separated gateway.
-# whyNotSourceFix: OpenShell 0.0.72 supports both topologies but exposes no
+# whyNotSourceFix: OpenShell 0.0.85 supports both topologies but exposes no
 # attested same-UID capability that this packaged entrypoint can query.
 # regressionTest: hermes-mcp-config-transaction.test.ts rejects both probe and
 # add when the root-lifecycle marker identifies the legacy topology.

agents/hermes/validate-env-secret-boundary.py

@@ -52,12 +52,12 @@
     }
 )
 RUNTIME_ALLOWED_RAW_SECRET_KEYS = frozenset({"OPENCLAW_GATEWAY_TOKEN"})
-# OpenShell's Docker/Podman supervisor owns this variable and injects a mounted
-# file path, not private-key material. Keep the allowance exact and runtime-only
-# so a caller cannot use the secret-shaped name to smuggle an arbitrary value or
-# persist it in Hermes' mutable .env file.
-RUNTIME_ALLOWED_PLATFORM_PATH_VALUES = frozenset(
-    {("OPENSHELL_TLS_KEY", "/etc/openshell/tls/client/tls.key")}
+# OpenShell 8eacb477 (candidate 0.0.85) makes these supervisor-only identity
+# variables and removes them from entrypoint, exec, and connect children. Their
+# presence in Hermes is therefore contract drift even when the value is only a
+# mounted path.
+OPENSHELL_SUPERVISOR_ONLY_ENV_KEYS = frozenset(
+    {"OPENSHELL_TLS_CA", "OPENSHELL_TLS_CERT", "OPENSHELL_TLS_KEY"}
 )
 ALLOWED_LITERALS = frozenset({"", "[STRIPPED_BY_MIGRATION]"})
 MAX_ENV_BYTES = 4 * 1024 * 1024
@@ -451,6 +451,11 @@ def validate_env_file(path: str) -> int:
         key = key.strip()
         if not KEY_NAME_RE.fullmatch(key):
             continue
+        if key in OPENSHELL_SUPERVISOR_ONLY_ENV_KEYS:
+            violation_count += 1
+            if len(violations) < MAX_VIOLATIONS:
+                violations.append(f"{key} (line {lineno})")
+            continue
         if key in ENV_FILE_ALLOWED_NONSECRET_KEYS:
             continue
         if key in ENV_FILE_ALLOWED_RAW_SECRET_KEYS and is_allowed_raw_secret_value(
@@ -468,8 +473,9 @@ def validate_env_file(path: str) -> int:
         return 0
     _emit_violations(
         "[SECURITY] Refusing Hermes startup because /sandbox/.hermes/.env "
-        "contains raw secret-shaped values. Store credentials in OpenShell "
-        "providers and keep only openshell resolver placeholders in the sandbox.",
+        "contains raw secret-shaped values or OpenShell supervisor-only identity "
+        "variables. Store credentials in OpenShell providers and keep only "
+        "openshell resolver placeholders in the sandbox.",
         violations,
         violation_count - len(violations),
     )
@@ -481,14 +487,17 @@ def validate_runtime_env(env: dict[str, str] | None = None) -> int:
     violations: list[str] = []
     violation_count = 0
     for key, value in sorted(source.items()):
+        if key in OPENSHELL_SUPERVISOR_ONLY_ENV_KEYS:
+            violation_count += 1
+            if len(violations) < MAX_VIOLATIONS:
+                violations.append(key)
+            continue
         if key in RUNTIME_ALLOWED_NONSECRET_KEYS:
             continue
         if key in RUNTIME_ALLOWED_RAW_SECRET_KEYS and is_allowed_raw_secret_value(
             key, value
         ):
             continue
-        if (key, value) in RUNTIME_ALLOWED_PLATFORM_PATH_VALUES:
-            continue
         if not KEY_NAME_RE.fullmatch(key):
             continue
         if not SECRET_KEY_RE.search(key):
@@ -502,8 +511,9 @@ def validate_runtime_env(env: dict[str, str] | None = None) -> int:
         return 0
     _emit_violations(
         "[SECURITY] Refusing Hermes startup because the process environment "
-        "contains raw secret-shaped values. Store credentials in OpenShell "
-        "providers and keep only openshell resolver placeholders in the sandbox.",
+        "contains raw secret-shaped values or OpenShell supervisor-only identity "
+        "variables. Store credentials in OpenShell providers and keep only "
+        "openshell resolver placeholders in the sandbox.",
         violations,
         violation_count - len(violations),
     )

agents/langchain-deepagents-code/dcode-wrapper.sh

@@ -41,7 +41,6 @@ unset PYTHONHOME PYTHONPATH
 readonly DEEPAGENTS_ENV_FILE="/sandbox/.deepagents/.env"
 readonly OPENSHELL_ENV_PLACEHOLDER_PREFIX="openshell:resolve:env:"
 readonly DEEPAGENTS_CONFIG_FILE="/sandbox/.deepagents/config.toml"
-readonly OPENSHELL_TLS_KEY_PATH="/etc/openshell/tls/client/tls.key"
 readonly DEEPAGENTS_AUTH_FILE="/sandbox/.deepagents/.state/auth.json"
 readonly DEEPAGENTS_CODEX_AUTH_FILE="/sandbox/.deepagents/.state/chatgpt-auth.json"
 readonly MANAGED_DCODE_AUTO_APPROVAL_FILE="/usr/local/share/nemoclaw/dcode-auto-approval"
@@ -351,14 +350,15 @@ has_credential_name_context() {
   return 1
 }
 
-# SECURITY: OpenShell's supervisor injects this mounted TLS key path into the
-# runtime environment. Allow only the exact name/value pair after the generic
-# value scan. Never allow the name alone, and never apply this exception to the
-# mutable Deep Agents Code .env file.
-is_allowed_openshell_runtime_value() {
-  local name="$1"
-  local value="$2"
-  [ "$name" = "OPENSHELL_TLS_KEY" ] && [ "$value" = "$OPENSHELL_TLS_KEY_PATH" ]
+# OpenShell 8eacb477 (candidate 0.0.85) strips these supervisor identity
+# variables from entrypoint, exec, and connect children. Reject their presence
+# regardless of value so a runtime regression cannot silently expose mounted
+# mTLS identity to dcode.
+is_openshell_supervisor_only_env_name() {
+  case "$1" in
+    OPENSHELL_TLS_CA | OPENSHELL_TLS_CERT | OPENSHELL_TLS_KEY) return 0 ;;
+  esac
+  return 1
 }
 
 # OTLP endpoint variables carry the collector URL, not a credential. The
@@ -440,8 +440,7 @@ is_openshell_env_placeholder_for_name() {
   local canonical revision_prefix revision_suffix versioned revision
 
   # OPENSHELL_TLS_KEY is supervisor infrastructure, not a provider credential.
-  # Only its exact mounted path is accepted from the runtime environment below;
-  # never let a provider placeholder bypass that name/value allowlist.
+  # Never let a provider placeholder bypass that supervisor-only boundary.
   [ "$name" != "OPENSHELL_TLS_KEY" ] || return 1
 
   # Keep this identifier contract aligned with OpenShell provider env keys.
@@ -506,6 +505,9 @@ assert_no_secret_runtime_env() {
     name="${pair%%=*}"
     [ "$name" != "$pair" ] || continue
     value="${pair#*=}"
+    if is_openshell_supervisor_only_env_name "$name"; then
+      refuse_secret_env "runtime environment variable" "$name"
+    fi
     if [[ "$value" == *"$OPENSHELL_ENV_PLACEHOLDER_PREFIX"* ]]; then
       if is_openshell_env_placeholder_for_name "$name" "$value"; then
         continue
@@ -526,7 +528,7 @@ assert_no_secret_runtime_env() {
       fi
       continue
     fi
-    if has_credential_name_context "$name" && [ ${#value} -ge 10 ] && ! is_allowed_openshell_runtime_value "$name" "$value"; then
+    if has_credential_name_context "$name" && [ ${#value} -ge 10 ]; then
       refuse_secret_env "runtime environment variable" "$name"
     fi
   done < <(env -0)
@@ -578,6 +580,9 @@ assert_no_secret_env_file() {
         ;;
     esac
     value="$(trim_whitespace "$value")"
+    if is_openshell_supervisor_only_env_name "$key"; then
+      refuse_secret_env "$env_file" "$key"
+    fi
     if is_dynamic_dotenv_value "$value"; then
       refuse_dynamic_env "$env_file" "$key"
     fi