fix(images): lock OpenClaw production graph

[HOYALIM]

Summary

• materialize the reviewed openclaw@2026.7.1 production closure as a NemoClaw-owned lock consumed by both image paths
• replace the affected nested brace-expansion@5.0.7 and fast-uri@3.1.2 resolutions with reviewed 5.0.8 and 3.1.4 resolutions before lock generation
• verify lock bytes, registry/SRI metadata, installed package identities, reviewed lifecycle completion, and base provenance before runtime exposure
• audit the same locked graph in required CI and rebuild the base image whenever its lock inputs or verifier change

Validation

• focused integration coverage for locked installation, graph verification, remediation, archive handling, audit wiring, and image layout
• npm run build:cli
• npm run typecheck
• Node 22.23.1: production install with lifecycle scripts disabled, installed identities verified, reviewed lifecycle completed, and OpenClaw 2026.7.1 confirmed
• reviewed npm audit: 0 high/critical findings across the production graph boundaries

Local Docker image build was not run because the Docker daemon is unavailable; the required image workflow provides that proof.

References #5896

Signed-off-by: Ho Lim subhoya@gmail.com

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: docs/security/openclaw-2026.7.1-dependency-review.md documents the authoritative OpenClaw lock, reviewed dependency remediations, registry/SRI and installed-graph verification, CI audit boundary, and both image paths. The documented lock digest matches the exact refreshed head.
• Agent: Codex Desktop

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The PR adds lockfile-based OpenClaw installation verification, schema 2 reviewed npm audit configuration, trusted PR audit execution, expanded base-image triggers, runtime graph staging, provenance schema 3, and regression tests for integrity, workflow, and symlink protections.

Changes

Reviewed npm graph verification

Layer / File(s)	Summary
Lockfile verification APIs and CLI scripts/lib/reviewed-npm-archive.mts	Adds lockfile parsing, SHA-256 validation, reviewed metadata checks, installed-tree validation, cache integration, and dedicated verification modes.
Targeted audit materialization scripts/audit-reviewed-npm-graph.mts, ci/reviewed-npm-audit.json	Adds schema 2 registry-origin and lock-digest fields, target-root path validation, and pre/post-install lock verification.

OpenClaw image and CI integration

Layer / File(s)	Summary
OpenClaw runtime image installation agents/openclaw/openclaw-runtime/package.json, Dockerfile*, agents/openclaw/dependency-review.md, docs/security/...	Adds the pinned runtime package, verified npm ci installation for OpenClaw 2026.6.10, and schema 3 provenance with lock SHA-256 data.
Trusted audit workflows .github/actions/..., .github/workflows/*	Adds explicit audit paths, pins npm, selects trusted PR-base action code with a pinned bootstrap fallback, and expands base-image triggers.
Regression and contract coverage test/*, ci/source-shape-test-budget.json	Tests lock tampering, identity drift, symlink rejection, failed installs, provenance, workflow trust, runtime staging, and audit invariants.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PRWorkflow
  participant TrustedAuditAction
  participant AuditScript
  participant NpmRegistry
  participant AuditArtifact
  PRWorkflow->>TrustedAuditAction: select trusted action from base SHA
  TrustedAuditAction->>AuditScript: pass target-root and report-dir
  AuditScript->>NpmRegistry: verify reviewed lock metadata
  AuditScript->>AuditScript: npm ci and verify installed lock
  AuditScript->>AuditArtifact: write JSON audit reports

Loading

Possibly related PRs

• NVIDIA/NemoClaw#6891: Both changes update base-image triggers for the reviewed npm archive helper and OpenClaw runtime package manifests.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: locking the OpenClaw production graph for image-related paths.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / medium confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, full-e2e, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[HOYALIM]

Addressed the exact-head guardrail and trusted-audit warning in bd2035e4a.

• Run the reviewed npm audit from the base-SHA action, with a narrow immutable bootstrap for this first integration and fail-closed rejection elsewhere.
• Add workflow-boundary tests for trusted checkout, exact bootstrap gating, explicit target inputs, and rejection of PR-worktree action execution.
• Remove four new conditional branches from the installed-lock fixture while preserving missing-package and symlink adversarial cases.
• Register only the concrete shipped lock, Docker, and CI security/compatibility contracts required by the source-shape gate.

Validation: npx vitest run --project integration test/openclaw-locked-install.test.ts test/reviewed-npm-audit-workflow.test.ts test/openclaw-dependency-review.test.ts test/reviewed-npm-archive.test.ts test/sandbox-build-context.test.ts (47/47), npm run typecheck, npm run build:cli, and npm run check:diff all passed. Both commits are DCO signed and GitHub Verified.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Actionable comments posted: 3

🧹 Nitpick comments (2)

.github/workflows/pr.yaml (1)

311-326: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

One-time bootstrap hardcodes a specific PR number permanently into the shared workflow.

The bootstrap checkout/audit steps are gated on github.event.pull_request.number == 6830 and a specific fork name. Since PR numbers are never reused, this is safe from replay, but once PR #6830 merges these branches become permanent dead conditionals in pr.yaml that will never evaluate true again. Consider tracking removal in a follow-up issue/PR once the trusted base has the schema-2 audit, so this doesn't linger indefinitely.

Also applies to: 341-346

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr.yaml around lines 311 - 326, The one-time bootstrap
conditions in the workflow permanently retain dead PR-specific branches after PR
`#6830` merges. Track removal of the bootstrap checkout and corresponding audit
steps, identified by “Checkout pinned bootstrap reviewed npm audit” and the
related trusted-reviewed-npm-audit step, in a follow-up issue or PR once the
trusted base supports schema-2 audit.

test/openclaw-integrity-pin-suite.ts (1)

168-170: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Add a fail-closed test for the --verify-installed-lock checkpoint.

The node() mock at Line 288 always returns success for any call containing --verify-installed-lock, with no configurable failure path. The suite added failOpenClawNpmCi and failOpenClawPostinstall (Lines 168-170, 1420-1465) to prove the pipeline fails closed at those checkpoints, but the adjacent — and security-relevant — --verify-installed-lock step (documented in agents/openclaw/dependency-review.md as the check that "reject[s] symlinked package roots or manifests") has no analogous negative test. As written, nothing in this suite would catch a regression that made a real installed-lock-verification failure non-blocking.

♻️ Suggested addition mirroring the existing pattern

     tamperOpenClawLock?: boolean;
     failOpenClawNpmCi?: boolean;
     failOpenClawPostinstall?: boolean;
+    failOpenClawVerifyInstalledLock?: boolean;
   } = {},

     tamperOpenClawLock = false,
     failOpenClawNpmCi = false,
     failOpenClawPostinstall = false,
+    failOpenClawVerifyInstalledLock = false,
   } = options;

     `fail_openclaw_npm_ci=${failOpenClawNpmCi ? "1" : "0"}`,
     `fail_openclaw_postinstall=${failOpenClawPostinstall ? "1" : "0"}`,
+    `fail_openclaw_verify_installed_lock=${failOpenClawVerifyInstalledLock ? "1" : "0"}`,
     "node() {",
-    '  if printf "%s\\n" "$*" | grep -q -- "--verify-installed-lock"; then printf "node %s\\n" "$*" >> "$call_log"; return 0; fi',
+    '  if printf "%s\\n" "$*" | grep -q -- "--verify-installed-lock"; then printf "node %s\\n" "$*" >> "$call_log"; [ "$fail_openclaw_verify_installed_lock" = "0" ] || return 44; return 0; fi',

Then add a test paired with the existing "leaves no runtime exposure" cases, asserting postinstall-bundled-plugins.mjs and symlink/provenance creation never happen when this flag is set.

Also applies to: 192-194, 285-289, 1420-1465

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/openclaw-integrity-pin-suite.ts` around lines 168 - 170, Add a
configurable failure path for the --verify-installed-lock branch in the node()
mock, following the existing failOpenClawNpmCi and failOpenClawPostinstall
options. Add a fail-closed test alongside the existing “leaves no runtime
exposure” cases that enables this failure, asserts the pipeline rejects, and
verifies postinstall-bundled-plugins.mjs plus symlink/provenance creation are
never invoked.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/audit-reviewed-npm-graph.mts`:
- Around line 34-49: The path validation around resolveTargetPath and
CONFIG_PATH is only lexical and must reject symlink traversal. Canonicalize
REPO_ROOT and validate each relevant target’s existing path components before
accessing the reviewed-npm configuration, locked graph, or report-directory
cleanup, rejecting direct and ancestor symlinks that resolve outside the
checkout. Add regression coverage for both direct and ancestor symlink cases.

In `@scripts/lib/reviewed-npm-archive.mts`:
- Around line 344-353: Update the root dependency validation around
rootDependencies to also inspect root.optionalDependencies and reject any root
optional dependency entries, ensuring the reviewed lock contains only the
requested package closure under npm ci --omit=dev. Preserve the existing
requirement that root.dependencies contains exactly the requested package and
version.

In `@test/reviewed-npm-audit-workflow.test.ts`:
- Around line 29-31: Add an explicit cleanup follow-up note near BOOTSTRAP_IF
documenting that the PR-6830 fork-specific bootstrap condition must be removed
after the PR merges. Preserve the existing bootstrap condition and BOOTSTRAP_SHA
values.

---

Nitpick comments:
In @.github/workflows/pr.yaml:
- Around line 311-326: The one-time bootstrap conditions in the workflow
permanently retain dead PR-specific branches after PR `#6830` merges. Track
removal of the bootstrap checkout and corresponding audit steps, identified by
“Checkout pinned bootstrap reviewed npm audit” and the related
trusted-reviewed-npm-audit step, in a follow-up issue or PR once the trusted
base supports schema-2 audit.

In `@test/openclaw-integrity-pin-suite.ts`:
- Around line 168-170: Add a configurable failure path for the
--verify-installed-lock branch in the node() mock, following the existing
failOpenClawNpmCi and failOpenClawPostinstall options. Add a fail-closed test
alongside the existing “leaves no runtime exposure” cases that enables this
failure, asserts the pipeline rejects, and verifies
postinstall-bundled-plugins.mjs plus symlink/provenance creation are never
invoked.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: cc1f2202-ce38-48bd-aee7-a6111d9b63c0

📥 Commits

Reviewing files that changed from the base of the PR and between 33d55b0 and bd2035e.

⛔ Files ignored due to path filters (1)

• agents/openclaw/openclaw-runtime/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (21)

• .github/actions/ci-reviewed-npm-audit/action.yaml
• .github/actions/resolve-sandbox-base-image/action.yaml
• .github/workflows/base-image.yaml
• .github/workflows/main.yaml
• .github/workflows/pr.yaml
• Dockerfile
• Dockerfile.base
• agents/openclaw/dependency-review.md
• agents/openclaw/openclaw-runtime/package.json
• ci/reviewed-npm-audit.json
• ci/source-shape-test-budget.json
• docs/security/openclaw-2026.6.10-dependency-review.md
• scripts/audit-reviewed-npm-graph.mts
• scripts/lib/reviewed-npm-archive.mts
• src/lib/sandbox/build-context.ts
• test/openclaw-dependency-review.test.ts
• test/openclaw-integrity-pin-suite.ts
• test/openclaw-locked-install.test.ts
• test/reviewed-npm-archive.test.ts
• test/reviewed-npm-audit-workflow.test.ts
• test/sandbox-build-context.test.ts

[wscurran]

✨ Thanks for the fix, @HOYALIM. Locking the OpenClaw production graph improves supply-chain integrity for both image paths. Ready for maintainer review.

---

Related open issues:

• #5896 Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps

---

Related open issues:

• #5896 Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps

[Copilot]

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[apurvvkumaria]

Upstream publication status (2026-07-25): openclaw/openclaw#113584 tracks the same two published-graph findings covered here. OpenClaw main now resolves brace-expansion@5.0.8 and fast-uri@3.1.4 (including openclaw/openclaw@78d8c1f and openclaw/openclaw@2396bd1), but the npm latest tag remains 2026.7.1-2 and extended-stable remains 2026.6.33; their published shrinkwraps still contain the affected resolutions. Therefore this PR remains the tactical NemoClaw remediation: retain the SRI-pinned, fail-closed replacements and exact locked-graph audit until a supported OpenClaw stable artifact publishes both corrected nodes. At that point, remove the two replacements and regenerate/verify the lock rather than carrying them forward.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

[apurvvkumaria]

Approved at exact head cf8c889. The OpenClaw remediation and provenance boundary are unchanged from the reviewed implementation; this head adds only verified current-main merge commits, including the shared schema registration fix. No unresolved review threads remain, and the exact-head documentation receipt is current. Required CI, reviewed npm audit, image, and E2E gates must still pass before merge.