ci(e2e): select full E2E for root image changes

test/e2e/README.md

@@ -421,6 +421,9 @@ Shared sandbox-boundary changes have a floor of `full-e2e`, `hermes-e2e`, and
 family is a conservative path boundary that includes non-documentation files
 under `tools/e2e/` and `test/e2e/`, plus the E2E and PR-CI workflows, risk
 policy, dependency and test configuration, and preparation and upload actions.
+Repository-root `Dockerfile` changes additionally select `full-e2e` alongside
+the platform-install `cloud-onboard` floor so OpenClaw final-image changes run
+through cold onboarding and a real first turn.
 The Deep Agents Code headless-inference check additionally selects the exact
 `ubuntu-repo-cloud-langchain-deepagents-code` typed target. That target is
 hashed into the risk plan beside the control-plane floor jobs, so the

test/pr-risk-plan.test.ts

@@ -28,7 +28,7 @@ describe("deterministic PR risk plan", () => {
     const second = plan("src/lib/onboard.ts", "src/lib/state/registry.ts");
 
     expect(first).toEqual(second);
-    expect(first.version).toBe(4);
+    expect(first.version).toBe(5);
     expect(first.headSha).toBe(HEAD_SHA);
     expect(first.planHash).toMatch(/^[a-f0-9]{64}$/u);
     expect(first.changedFiles).toEqual(["src/lib/onboard.ts", "src/lib/state/registry.ts"]);
@@ -190,6 +190,19 @@ describe("deterministic PR risk plan", () => {
     expect(riskPlanRequiredJobIds(result)).toEqual(expect.arrayContaining(jobs));
   });
 
+  it("runs cold full E2E for repository-root OpenClaw image changes (#6660)", () => {
+    const rootImage = plan("Dockerfile");
+    const adjacentImage = plan("Dockerfile.base");
+
+    expect(rootImage.families.map((family) => family.id)).toEqual([
+      "platform-install",
+      "openclaw-image",
+    ]);
+    expect(riskPlanRequiredJobIds(rootImage)).toEqual(["cloud-onboard", "full-e2e"]);
+    expect(adjacentImage.families.map((family) => family.id)).toEqual(["platform-install"]);
+    expect(riskPlanRequiredJobIds(adjacentImage)).toEqual(["cloud-onboard"]);
+  });
+
   it.each([
     {
       file: "nemoclaw-blueprint/private-networks.yaml",

tools/advisors/risk-plan.mts

@@ -3,7 +3,7 @@
 
 import { createHash } from "node:crypto";
 
-export const RISK_PLAN_VERSION = 4 as const;
+export const RISK_PLAN_VERSION = 5 as const;
 
 export const PR_E2E_TYPED_TARGET_IDS = ["ubuntu-repo-cloud-langchain-deepagents-code"] as const;
 
@@ -19,6 +19,7 @@ export type RiskFamilyId =
   | "inference-policy"
   | "messaging-lifecycle"
   | "platform-install"
+  | "openclaw-image"
   | "credentials-security"
   | "e2e-control-plane"
   | "sandbox-boundary"
@@ -242,6 +243,17 @@ export const RISK_RULES: readonly RiskRule[] = [
       file === "ci/onboard-performance-budget.json" ||
       RISK_RELEVANT_TEST_FILES.has(file),
   },
+  {
+    id: "openclaw-image",
+    summary: "OpenClaw final-image changes must preserve cold onboarding and a usable first turn.",
+    tier: 3,
+    requiredJobs: ["full-e2e"],
+    invariants: [
+      "the repository-root image builds through the same cold path exercised by supported hosts",
+      "the resulting OpenClaw sandbox becomes ready and completes a real first turn",
+    ],
+    matches: (file) => file === "Dockerfile",
+  },
   {
     id: "credentials-security",
     summary: