fix(e2e): retain immutable OpenShell dev artifacts

.github/workflows/e2e.yaml

@@ -1723,10 +1723,47 @@ jobs:
         shell: bash
         run: bash .github/scripts/docker-auth-cleanup.sh
 
-  mcp-bridge-dev:
+  openshell-dev-artifact:
     needs: generate-matrix
     if: ${{ contains(fromJSON(needs.generate-matrix.outputs.selected_jobs), 'mcp-bridge-dev') }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    timeout-minutes: 15
+    outputs:
+      artifact_name: ${{ steps.resolve_openshell_dev_artifact.outputs.artifact_name }}
+      source_commit: ${{ steps.resolve_openshell_dev_artifact.outputs.source_commit }}
+      manifest_sha256: ${{ steps.resolve_openshell_dev_artifact.outputs.manifest_sha256 }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: ${{ inputs.checkout_repository || github.repository }}
+          ref: ${{ inputs.checkout_sha || github.sha }}
+          persist-credentials: false
+
+      - name: Set up Node for OpenShell dev artifact resolution
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      - id: resolve_openshell_dev_artifact
+        name: Resolve immutable OpenShell dev artifact
+        run: >-
+          node --experimental-strip-types --no-warnings
+          tools/e2e/openshell-dev-artifact.mts resolve
+          "${{ runner.temp }}/openshell-dev-artifact"
+
+      - name: Upload OpenShell dev artifact resolution
+        if: ${{ always() }}
+        uses: NVIDIA/NemoClaw/.github/actions/upload-e2e-artifacts@7768e15eb90d3ee2d33432f481dfe8747e4f6d57
+        with:
+          name: ${{ steps.resolve_openshell_dev_artifact.outputs.artifact_name || format('openshell-dev-infrastructure-failure-{0}-{1}', github.run_id, github.run_attempt) }}
+          path: ${{ runner.temp }}/openshell-dev-artifact/
+
+  mcp-bridge-dev:
+    needs: [generate-matrix, openshell-dev-artifact]
+    if: ${{ contains(fromJSON(needs.generate-matrix.outputs.selected_jobs), 'mcp-bridge-dev') }}
+    runs-on: ubuntu-latest
     permissions:
       contents: read
     timeout-minutes: 90
@@ -1762,6 +1799,21 @@ jobs:
         with:
           provenance-json: ${{ needs.generate-matrix.outputs.cli_artifact_provenance }}
 
+      - name: Restore immutable OpenShell dev artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ needs.openshell-dev-artifact.outputs.artifact_name }}
+          path: ${{ runner.temp }}/openshell-dev-artifact
+          digest-mismatch: error
+
+      - name: Verify immutable OpenShell dev artifact
+        run: >-
+          node --experimental-strip-types --no-warnings
+          tools/e2e/openshell-dev-artifact.mts verify
+          "${{ runner.temp }}/openshell-dev-artifact"
+          "${{ needs.openshell-dev-artifact.outputs.source_commit }}"
+          "${{ needs.openshell-dev-artifact.outputs.manifest_sha256 }}"
+
       - name: Install and verify cloudflared prerequisite
         # Update posture: keep this dev compatibility lane on the same reviewed
         # version/SHA256 pair as the stable lane; workflow-contract tests fail
@@ -1787,13 +1839,13 @@ jobs:
       - name: Generate MCP test TLS
         run: bash test/e2e/setup-mcp-test-tls.sh
 
-      - name: Revoke Docker auth before unverified dev tooling
+      - name: Revoke Docker auth before OpenShell development tooling
         shell: bash
         run: bash .github/scripts/docker-auth-cleanup.sh
 
       - name: Install OpenShell CLI
         env:
-          NEMOCLAW_ACCEPT_DEV_UNVERIFIED_INSTALL: "1"
+          NEMOCLAW_E2E_OPENSHELL_RELEASE_ASSET_DIR: ${{ runner.temp }}/openshell-dev-artifact/assets
           NEMOCLAW_OPENSHELL_FORCE_INSTALL: "1"
         run: |
           set -euo pipefail
@@ -3496,6 +3548,7 @@ jobs:
         openshell-gateway-auth-contract,
         mcp-bridge,
         openshell-credential-generation-window,
+        openshell-dev-artifact,
         mcp-bridge-dev,
         managed-image-multiarch-startup,
         llama-cpp-dgx-spark-plan,

scripts/checks/vitest-project-overlap.mts

@@ -46,6 +46,7 @@ const INSTALLER_INTEGRATION_TESTS = new Set([
   "test/install-forward-restore-diagnostics.test.ts",
   "test/install-hermes-forward-restore.test.ts",
   "test/install-managed-cli-reuse.test.ts",
+  "test/install-openshell-e2e-artifact.test.ts",
   "test/install-openshell-version-pin.test.ts",
   "test/install-openshell-version-check.test.ts",
   "test/install-preflight-docker-bootstrap.test.ts",

scripts/install-openshell.sh

@@ -150,6 +150,20 @@
   RESOLVED_CHANNEL="$CHANNEL"
 fi
 
+E2E_RELEASE_ASSET_DIR="${NEMOCLAW_E2E_OPENSHELL_RELEASE_ASSET_DIR:-}"
+if [ -n "$E2E_RELEASE_ASSET_DIR" ]; then
+  [ "${E2E_JOB:-}" = "1" ] \
+    || fail "NEMOCLAW_E2E_OPENSHELL_RELEASE_ASSET_DIR is restricted to E2E jobs."
+  [ "$RESOLVED_CHANNEL" = "dev" ] \
+    || fail "NEMOCLAW_E2E_OPENSHELL_RELEASE_ASSET_DIR requires the dev channel."
+  [ "$OS" = "Linux" ] && [ "$ARCH_LABEL" = "x86_64" ] \
+    || fail "NEMOCLAW_E2E_OPENSHELL_RELEASE_ASSET_DIR supports Linux x86_64 only."
+  [[ "$E2E_RELEASE_ASSET_DIR" = /* ]] \
+    || fail "NEMOCLAW_E2E_OPENSHELL_RELEASE_ASSET_DIR must be an absolute path."
+  [ -d "$E2E_RELEASE_ASSET_DIR" ] && [ ! -L "$E2E_RELEASE_ASSET_DIR" ] \
+    || fail "NEMOCLAW_E2E_OPENSHELL_RELEASE_ASSET_DIR must name a regular directory."
+fi
+
 if [ "$RESOLVED_CHANNEL" = "dev" ]; then
   # invalidState: a mutable dev artifact is consumed as if it were a verified
   # stable release. sourceBoundary: OpenShell owns the moving dev tag; NemoClaw
@@ -160,10 +174,13 @@
   # compatibility testing ends or OpenShell publishes an independently
   # verifiable immutable development channel. See the v0.0.72 compatibility
   # review's "Dev Channel Opt-In" section.
-  if [ "${NEMOCLAW_ACCEPT_DEV_UNVERIFIED_INSTALL:-}" != "1" ]; then
+  if [ -n "$E2E_RELEASE_ASSET_DIR" ]; then
+    info "Using the same-run verified OpenShell dev artifact."
+  elif [ "${NEMOCLAW_ACCEPT_DEV_UNVERIFIED_INSTALL:-}" != "1" ]; then
     fail "Dev channel install skips SHA-256 verification. Set NEMOCLAW_ACCEPT_DEV_UNVERIFIED_INSTALL=1 to explicitly accept an unverified OpenShell dev-channel install."
+  else
+    warn "Dev channel install skips SHA-256 verification. Use only in trusted environments."
   fi
-  warn "Dev channel install skips SHA-256 verification. Use only in trusted environments."
 fi
 
 HOMEBREW_TAP="nvidia/openshell"
@@ -969,8 +986,16 @@
   done
 }
 
-info "Downloading OpenShell release assets (this may take a minute)..."
-if command -v gh >/dev/null 2>&1; then
+if [ -n "$E2E_RELEASE_ASSET_DIR" ]; then
+  info "Loading same-run verified OpenShell release assets..."
+  for name in "${ASSETS[@]}" "${CHECKSUM_FILES[@]}"; do
+    source_asset="$E2E_RELEASE_ASSET_DIR/$name"
+    [ -f "$source_asset" ] && [ ! -L "$source_asset" ] \
+      || fail "Verified E2E OpenShell artifact is missing regular file $name"
+    cp -- "$source_asset" "$tmpdir/$name"
+  done
+elif command -v gh >/dev/null 2>&1; then
+  info "Downloading OpenShell release assets (this may take a minute)..."
   gh_ok=1
   for name in "${ASSETS[@]}" "${CHECKSUM_FILES[@]}"; do
     if ! GH_PROMPT_DISABLED=1 GH_TOKEN="${GH_TOKEN:-${GITHUB_TOKEN:-}}" gh release download "$RELEASE_TAG" --repo NVIDIA/OpenShell \
@@ -987,6 +1012,7 @@
     download_with_curl
   fi
 else
+  info "Downloading OpenShell release assets (this may take a minute)..."
   download_with_curl
 fi
 

test/e2e/README.md

@@ -459,6 +459,22 @@ trust boundary and are never host-prebuilt by this fixture.
 The runtime target for `openclaw-plugin-runtime-exdev` is 16–17 minutes.
 Push-run timing for the reduced lifecycle has not yet been measured.
 
+## OpenShell development artifact retention
+
+The `openshell-dev-artifact` job resolves the public OpenShell `dev` release
+once for each selected `mcp-bridge-dev` run. It records the source commit and
+the GitHub asset ID, source URL, size, and SHA-256 digest for every required
+Linux x64 archive and checksum file. It rejects release drift during download,
+then uploads the verified bytes under a content-addressed name with the shared
+14-day E2E retention policy.
+
+The OpenClaw, Hermes, and Deep Agents Code shards restore and verify that same
+artifact before installation. A missing, replaced, or corrupt upstream asset
+fails the resolver as an infrastructure failure and preserves
+`resolution.json` with the failed identifier and source URL. The three product
+shards do not start in that case, so the run cannot report a product failure
+before reaching product assertions.
+
 ## Larger-runner routing
 
 The larger-runner experiment is inactive while the configuration variable

test/e2e/support/mcp-workflow-boundary.test.ts

@@ -264,20 +264,66 @@ describe("MCP workflow artifact boundary", () => {
     }
   });
 
-  it("revokes Docker credentials before executing unverified dev artifacts", () => {
+  it("revokes Docker credentials before executing OpenShell development tooling (#9051)", () => {
     const directory = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-mcp-workflow-"));
     const workflowPath = path.join(directory, "e2e.yaml");
     try {
       const workflow = YAML.parse(fs.readFileSync(".github/workflows/e2e.yaml", "utf8")) as {
         jobs: Record<string, { steps: Array<Record<string, unknown>> }>;
       };
       workflow.jobs["mcp-bridge-dev"].steps = workflow.jobs["mcp-bridge-dev"].steps.filter(
-        (step) => step.name !== "Revoke Docker auth before unverified dev tooling",
+        (step) => step.name !== "Revoke Docker auth before OpenShell development tooling",
       );
       fs.writeFileSync(workflowPath, YAML.stringify(workflow));
 
       expect(validateMcpOpenShellWorkflowBoundary(workflowPath)).toContain(
-        "mcp-bridge-dev must revoke Docker auth before unverified dev tooling",
+        "mcp-bridge-dev must revoke Docker auth before OpenShell development tooling",
+      );
+    } finally {
+      fs.rmSync(directory, { force: true, recursive: true });
+    }
+  });
+
+  it("rejects moving or unverified inputs for the OpenShell dev shards (#9051)", () => {
+    const directory = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-mcp-workflow-"));
+    const workflowPath = path.join(directory, "e2e.yaml");
+    try {
+      const workflow = YAML.parse(fs.readFileSync(".github/workflows/e2e.yaml", "utf8")) as {
+        jobs: Record<
+          string,
+          {
+            needs?: string | string[];
+            steps: Array<{
+              name?: string;
+              uses?: string;
+              env?: Record<string, unknown>;
+              with?: Record<string, unknown>;
+            }>;
+          }
+        >;
+      };
+      const dev = workflow.jobs["mcp-bridge-dev"];
+      dev.needs = "generate-matrix";
+      const restore = dev.steps.find(
+        (step) => step.name === "Restore immutable OpenShell dev artifact",
+      );
+      const install = dev.steps.find((step) => step.name === "Install OpenShell CLI");
+      requireFixture(restore?.with, "OpenShell dev artifact restore fixture is missing");
+      requireFixture(install?.env, "OpenShell dev installer fixture is missing");
+      restore.uses = "actions/download-artifact@main";
+      restore.with.name = "openshell-dev-latest";
+      install.env.NEMOCLAW_ACCEPT_DEV_UNVERIFIED_INSTALL = "1";
+      delete install.env.NEMOCLAW_E2E_OPENSHELL_RELEASE_ASSET_DIR;
+      fs.writeFileSync(workflowPath, YAML.stringify(workflow));
+
+      expect(validateMcpOpenShellWorkflowBoundary(workflowPath)).toEqual(
+        expect.arrayContaining([
+          "mcp-bridge-dev must depend on its reviewed artifact producers",
+          "mcp-bridge-dev must use the reviewed immutable artifact downloader",
+          "mcp-bridge-dev must restore exactly the resolver's content-addressed artifact",
+          "mcp-bridge-dev installer must consume the same-run verified asset directory",
+          "mcp-bridge-dev installer must not authorize moving unverified dev artifacts",
+        ]),
       );
     } finally {
       fs.rmSync(directory, { force: true, recursive: true });