fix(messaging): keep build plan out of image env

[HOYALIM]

Summary

• keep NEMOCLAW_MESSAGING_PLAN_B64 available to Docker build steps without persisting it in final OpenClaw or Hermes image environments
• preserve the validated reduced runtime-plan artifact used by startup and rebuild flows
• add source-shape and runtime-plan regressions for both agents

Validation

• npx vitest run test/messaging-image-env-contract.test.ts test/messaging-build-applier.test.ts
• npm run build:cli
• npm run typecheck:cli
• npm run check:diff

Refs #5896

Signed-off-by: Ho Lim subhoya@gmail.com

Summary by CodeRabbit

• Security

  • Treated NEMOCLAW_MESSAGING_PLAN_B64 as build-time only, ensuring it is not exported into the final container runtime environment.

• Reliability / Tests

  • Expanded Dockerfile environment contract coverage to handle both modern and legacy ENV syntaxes, including multiline continuations.
  • Parameterized runtime plan/startup checks to cover both supported agent flavors and validate required startup phases and environment handling.

• CI / Automation

  • Added a new “messaging plan boundary” CI job and workflow validation to enforce image boundary rules for both agent types.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Dockerfiles no longer persist NEMOCLAW_MESSAGING_PLAN_B64 in final image environments. New utilities, workflow checks, and tests verify reduced messaging-plan artifacts and runtime isolation for OpenClaw and Hermes.

Changes

Messaging plan image boundary

Layer / File(s)	Summary
Remove messaging plan runtime exports Dockerfile, agents/hermes/Dockerfile, test/messaging-build-applier.test.ts, test/messaging-image-env-contract.test.ts, ci/source-shape-test-budget.json	The messaging plan remains build-time configuration, while Dockerfile contract tests cover both agent flavors and verify the variable is absent from runtime environments.
Generate and verify agent image boundaries scripts/check-messaging-plan-image-boundary.mts, test/messaging-plan-image-boundary.test.ts	Agent-specific plans, reduced artifacts, rendered configuration evidence, Docker environment checks, and leakage rejection are implemented and tested.
Build and validate boundary images in CI .github/workflows/sandbox-images-and-e2e.yaml, tools/e2e/sandbox-images-workflow-boundary.mts, test/e2e/support/sandbox-images-workflow-boundary.test.ts	CI builds and verifies OpenClaw and Hermes boundary images, while workflow validation enforces isolation, ordering, timeouts, and non-publication of probe artifacts.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CI
  participant DockerBuild
  participant BoundaryVerifier
  participant RuntimeImage
  CI->>DockerBuild: Generate plan and build OpenClaw or Hermes image
  BoundaryVerifier->>RuntimeImage: Inspect environment and reduced artifact
  BoundaryVerifier->>RuntimeImage: Read agent-specific rendered configuration
  BoundaryVerifier-->>CI: Report boundary validation result

Loading

Possibly related PRs

• NVIDIA/NemoClaw#1618: Both modify Hermes Dockerfile handling to keep the messaging plan build-time only.
• NVIDIA/NemoClaw#5866: Both reinforce Hermes runtime-plan boundary behavior.
• NVIDIA/NemoClaw#5777: Both adjust messaging-plan Dockerfile wiring and boundary behavior.

Suggested labels: area: ci

Suggested reviewers: cv, ericksoa, apurvvkumaria

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: keeping the build plan out of the final image environment.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/messaging-image-env-contract.test.ts`:
- Around line 12-24: Update dockerfileEnvNames to recognize legacy Docker ENV
key-value syntax in addition to NAME=value assignments, including continued
directives, so keys such as NEMOCLAW_MESSAGING_PLAN_B64 are recorded and
contract checks cannot be bypassed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 04b0c4db-8869-4182-954f-5555c0b4ebb1

📥 Commits

Reviewing files that changed from the base of the PR and between deed1aa and d85c69c.

📒 Files selected for processing (5)

• Dockerfile
• agents/hermes/Dockerfile
• ci/source-shape-test-budget.json
• test/messaging-build-applier.test.ts
• test/messaging-image-env-contract.test.ts

[github-actions]

E2E Advisor Recommendation

Required E2E: cloud-onboard, messaging-plan-image-boundary
Optional E2E: messaging-compatible-endpoint, hermes-sandbox-secret-boundary

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: target/main
Head: HEAD
Confidence: high

Required E2E

• cloud-onboard: Required validation floor: changed production Dockerfiles can affect clean-host installation and hosted onboarding image construction.
• messaging-plan-image-boundary: Run the new isolated real-image workflow job to prove both OpenClaw and Hermes retain build-time Teams rendering/package evidence while excluding the complete messaging plan from final image and process environments.

Optional E2E

• messaging-compatible-endpoint: Provides an adjacent end-to-end OpenClaw onboarding, messaging configuration, inference, and assistant-turn check after changing messaging-plan image handling.
• hermes-sandbox-secret-boundary: Useful regression coverage for the Hermes production image's runtime secret boundary after changing its build-time messaging-plan handling.

New E2E recommendations

• messaging (medium): Current real-image coverage validates synthetic Teams render and package evidence, but does not exercise a complete Teams-configured assistant lifecycle after onboarding for both supported agents.
  • Suggested test: Add a live, secretless Teams-compatible messaging lifecycle E2E that onboards OpenClaw and Hermes with a controlled Teams plan, starts each agent, and verifies the rendered channel is accepted without exposing the serialized plan.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/messaging-image-env-contract.test.ts`:
- Around line 12-30: Update dockerfileEnvNames to distinguish Dockerfile ENV
syntax using only the first token: treat it as modern assignment form when that
token contains “=”, otherwise parse the first token as the legacy variable name
and ignore “=” characters in its value. Extend the existing “recognizes modern
and legacy Dockerfile ENV forms” test with a legacy value ending in base64
padding, such as “eyJhIjoxfQ=”, and expect only the declared variable name.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 23c98928-2192-4a9b-93ea-2f35cfa520bd

📥 Commits

Reviewing files that changed from the base of the PR and between d85c69c and 450f6af.

📒 Files selected for processing (5)

• Dockerfile
• agents/hermes/Dockerfile
• ci/source-shape-test-budget.json
• test/messaging-build-applier.test.ts
• test/messaging-image-env-contract.test.ts

🚧 Files skipped from review as they are similar to previous changes (4)

• ci/source-shape-test-budget.json
• test/messaging-build-applier.test.ts
• agents/hermes/Dockerfile
• Dockerfile

[wscurran]

✨ Thanks for the security hardening work, @HOYALIM. Moving the messaging build plan to build-time only (ARG) and keeping it out of final OpenClaw and Hermes image environments is a solid improvement. Ready for maintainer review.

---

Related open issues:

• #5896 Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps

---

Related open issues:

• #5896 Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/sandbox-images-and-e2e.yaml:
- Around line 242-273: Update the workflow job containing the OpenClaw and
Hermes boundary steps to ensure Node is pinned to version 22.6 or newer, or
enable check-latest for the Node 22 setup. Keep the existing .mts commands
unchanged and apply the runtime constraint to both build-and-verify steps.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 98d962c8-159d-426c-89ea-1957f097a428

📥 Commits

Reviewing files that changed from the base of the PR and between ff16f56 and ef02fce.

📒 Files selected for processing (5)

• .github/workflows/sandbox-images-and-e2e.yaml
• scripts/check-messaging-plan-image-boundary.mts
• test/e2e/support/sandbox-images-workflow-boundary.test.ts
• test/messaging-plan-image-boundary.test.ts
• tools/e2e/sandbox-images-workflow-boundary.mts

[github-actions]

E2E Target Results — ✅ All requested tests passed

Run: 29277614078
Workflow ref: codex/pr-6737-image-boundary-f87b0a6d
Requested targets: (default — all supported)
Requested test IDs: cloud-onboard,rebuild-openclaw,rebuild-hermes,messaging-providers,hermes-e2e,messaging-compatible-endpoint
Summary: 6 passed, 0 failed, 0 cancelled, 0 skipped, 0 unknown

Test	Result
cloud-onboard	✅ success
hermes-e2e	✅ success
messaging-compatible-endpoint	✅ success
messaging-providers	✅ success
rebuild-hermes	✅ success
rebuild-openclaw	✅ success

[cjagwani]

Approved at exact head f87b0a6 after terminal standard CI/security/DCO, the exact-head disposable OpenClaw and Hermes image-boundary run (29276795188), the six-job live E2E run (29277614078), and the final trusted two-model Advisor run (29278916628). Terra and Nemotron both recommend merge_as_is with high confidence and no findings, warnings, or suggestions. All review threads are resolved. This approval does not merge the PR.