fix(ci): complete main-only lifecycle evidence

.github/workflows/base-image.yaml

@@ -23,7 +23,8 @@ on:
       - ".github/workflows/base-image.yaml"
       - ".github/workflows/managed-images.yaml"
 
-      - "test/e2e/live/managed-image-activation-e2e*.ts"
+      - "test/e2e/live/managed-image-activation-e2e.test.ts"
+      - "test/e2e/live/managed-image-activation-e2e-helpers.ts"
       - ".github/actions/ci-reviewed-npm-audit/**"
       - ".github/actions/build-base-image-platform/**"
       - ".github/actions/publish-base-image-manifest/**"

AGENTS.md

@@ -114,8 +114,8 @@ When writing tests:
   - Newly added JavaScript files.
   - Growth in `src/lib/onboard.ts`.
   - Current test-file line-budget violations.
-  - Added `if` statements in changed test files.
-  The trusted PR check also rejects test-file budget limits that increase from the base commit.
+  - An increased `if`-statement count in a changed test file.
+  The trusted PR check also rejects test-file budget limits that increase from the PR base commit.
 - Use `npm run test:watch` for focused source-test feedback.
 - Add only concrete opaque-input mappings to `test/helpers/vitest-watch-triggers.ts`.
 - Use `npm run test:shuffle -- --sequence.seed=<seed>` to replay a printed test-order seed. Use `npm run test:diagnose:leaks` for async-resource or shutdown-hang diagnostics; both commands keep coverage disabled, and leak diagnostics can accompany exit code 0 when assertions pass.

CONTRIBUTING.md

@@ -294,10 +294,10 @@ After those tests pass, it checks the current checkout for:
 - Newly added JavaScript files.
 - Growth in `src/lib/onboard.ts`.
 - Test-file line-budget violations.
-- Added `if` statements in changed test files.
+- An increased `if`-statement count in a changed test file.
 
-The pull request check separately compares `ci/test-file-size-budget.json` with the base commit.
-The local check validates the current budget file but does not compare its limits with the base commit.
+The pull request check compares `ci/test-file-size-budget.json` with the PR base commit.
+The local check validates the current budget file but does not compare its limits with the PR base commit.
 Keep `npm run test:watch` running for source-test feedback while editing.
 Watch mode also maps the repository's current opaque YAML, Python, shell, generated, and workflow inputs to concrete contract tests outside Vitest's import graph.
 Add a narrow mapping in `test/helpers/vitest-watch-triggers.ts` when a new opaque input needs the same treatment.
@@ -414,9 +414,13 @@ The repository is organized as follows.
 
 ## Language Policy
 
-All new source files must be TypeScript. Do not add new `.js` files to the project. When modifying an existing JavaScript file, prefer migrating it to TypeScript in the same PR.
+Use TypeScript instead of JavaScript for new source, test, and script files.
+Do not add `.js`, `.cjs`, `.mjs`, or `.jsx` files.
+Existing JavaScript files may be modified or deleted.
 
-Only a small CommonJS launcher/compatibility layer remains in `bin/`, while the main CLI implementation now lives in `src/lib/` and compiles to `dist/`. Tests in `test/` may remain ESM JavaScript for now but new test files should use TypeScript where practical.
+`bin/` retains a small CommonJS launcher and compatibility layer.
+The main CLI implementation lives in `src/lib/` and compiles to `dist/`.
+Existing ESM JavaScript tests under `test/` may remain, but new tests must use TypeScript.
 
 Shell scripts (`scripts/*.sh`) must pass ShellCheck and use `shfmt` formatting.
 

docs/security/openclaw-2026.6.10-dependency-review.md

@@ -394,7 +394,8 @@ No real Microsoft Teams tenant proof is included in this PR. The work remains tr
   The exact source shapes, replacement SRIs, tarball URLs, patched metadata, and provenance recipe fail closed on drift.
   The low `body-parser` and moderate Hono and `protobufjs` findings remain documented at the configured `high` threshold.
   Current NemoClaw closes the WeChat residual with `agents/openclaw/wechat-runtime/package-lock.json` and post-install graph verification.
-- `src/lib/messaging/channels/manifests.test.ts` remains within the repository test-file line budget, so this OpenClaw dependency upgrade does not split the file.
+- `src/lib/messaging/channels/manifests.test.ts` remains within the repository test-file line budget.
+  This OpenClaw dependency upgrade does not require a split to satisfy that budget.
 - The npm audit result in this note remains a point-in-time snapshot.
   Default PR and main CI rematerialize the production-compatible graph from the reviewed local archives, audit it and the committed mcporter lock with `npm audit --omit=dev --json` through the reviewed evaluator, upload the raw reports and normalized policy results, and fail on unaccepted findings at the configured `high` threshold.
   The separate `wechat-runtime-audit` gate uses Node `22.19.0` and npm `10.9.4`, installs the committed WeChat production lock with scripts disabled, fails on any low-or-higher production advisory, verifies registry signatures, exercises the reviewed archive through a copied writable cache, and uploads its evidence.

docs/security/openshell-0.0.99-migration-review.md

@@ -184,8 +184,11 @@ projects. Reviewed condition-only jobs may be skipped when the empty-selector di
 select them, including Launchable, Jetson, DGX Spark, retired-selector compatibility, reporting,
 and scorecard jobs.
 
-The managed image lifecycle check for all shipped agents is not a required PR check.
-After promotion on `main`, the managed image workflow verifies the published `linux/amd64` image cohort for OpenClaw, Hermes, and LangChain Deep Agents Code.
+The managed image lifecycle job is not a required PR check and does not gate or roll back promotion.
+When the base-image workflow publishes managed images from `main`, this job runs after `promote` moves the OpenClaw cohort pointer.
+It exercises each published `linux/amd64` digest reference through onboarding, agent turns, gateway restart recovery, and destroy.
+The references cover OpenClaw, Hermes, and LangChain Deep Agents Code.
+If verification fails, the workflow does not roll back the promoted cohort pointer.
 Changes that can affect rootless Podman still require the latest PR commit's rootless Podman CPU lifecycle check with Docker disabled.
 
 The gate fails closed for missing, expired, duplicate, or malformed evidence. It also rejects a

test/codebase-growth-contract.test.ts

@@ -26,6 +26,6 @@ it("keeps test files within their line budgets", () => {
   expectNoViolations(evaluateCurrentTestFileSizeBudget());
 });
 
-it("does not add if statements to changed test files", () => {
+it("does not increase if-statement counts in changed test files", () => {
   expectNoViolations(evaluateCurrentTestConditionalContract());
 });

test/growth-guardrails-entrypoints.test.ts

@@ -105,7 +105,7 @@ describe("codebase growth trusted assertion", () => {
     "cjs",
     "mjs",
     "jsx",
-  ])("prints a new .%s JavaScript file in the consolidated failure", (extension) => {
+  ])("reports a newly added .%s JavaScript path in the consolidated failure", (extension) => {
     const filename = `scripts/new.${extension}`;
     const result = runEntrypoint([
       [{ filename, status: "added", additions: 1, deletions: 0 }],

test/openshell-e2e-qualification.test.ts

@@ -268,7 +268,7 @@ describe("OpenShell qualification-sensitive path detection", () => {
     expect(isOpenShellQualificationSensitivePath("docs/index.mdx")).toBe(false);
   });
 
-  it("removes managed-image activation from required pre-merge checks and retains the rootless lifecycle check", () => {
+  it("does not require managed-image activation before merge and retains the rootless lifecycle check", () => {
     const renamed = validatePullRequestFile({
       filename: "docs/retired.mdx",
       previous_filename: "scripts/install-openshell.sh",