refactor(policy): make OpenShell the sole durable policy source

.github/workflows/managed-images.yaml

@@ -37,13 +37,15 @@ on:
       - "Dockerfile"
       - "agents/**"
       - "ci/npm-audit-exceptions.json"
+      - "ci/pi-agent-qualification-v1-*.json"
       - "ci/reviewed-npm-audit.json"
       - "nemoclaw/**"
       - "nemoclaw-blueprint/**"
       - "scripts/**"
       - "src/lib/actions/sandbox/openshell-child-visible-credentials.v*.json"
       - "src/lib/actions/sandbox/mcp-bridge-*.ts"
       - "src/lib/actions/sandbox/rebuild-post-restore-phase.ts"
+      - "src/lib/agent/candidate-authority.ts"
       - "src/lib/core/json-types.ts"
       - "src/lib/core/ports.ts"
       - "src/lib/messaging/**"
@@ -1212,11 +1214,12 @@ jobs:
 
   pi-candidate:
     name: Build and validate the Pi candidate managed image (${{ matrix.arch }})
-    if: github.repository == 'NVIDIA/NemoClaw' && github.event_name == 'pull_request'
+    if: github.repository == 'NVIDIA/NemoClaw' && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 120
     permissions:
       contents: read
+      packages: write
     strategy: &pi_candidate_strategy
       fail-fast: false
       matrix:
@@ -1231,14 +1234,17 @@ jobs:
       BASE_DOCKERFILE: agents/pi/Dockerfile.base
       CANDIDATE_IMAGE: nemoclaw-managed-candidate/pi
       DOCKERFILE: agents/pi/Dockerfile
-      LOCAL_BASE_REFERENCE: nemoclaw-managed-candidate/pi-base:${{ github.sha }}
+      LOCAL_BASE_REFERENCE: nemoclaw-managed-candidate/pi-base:${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       PLATFORM: ${{ matrix.platform }}
       PUBLICATION_COHORT: ghrun-${{ github.run_id }}-${{ github.run_attempt }}
       REPOSITORY: ghcr.io/nvidia/nemoclaw/pi-sandbox
+      # Qualification receipts compare image sources with the PR head, never GitHub's synthetic merge.
+      SOURCE_REVISION: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
     steps: &pi_candidate_steps
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
       - name: Set up Docker Buildx
         id: buildx
@@ -1300,10 +1306,10 @@ jobs:
           build-contexts: nemoclaw-pi-base=oci-layout://${{ steps.base.outputs.oci }}
           load: true
           push: false
-          tags: nemoclaw-managed-candidate/pi:${{ github.sha }}
+          tags: nemoclaw-managed-candidate/pi:${{ env.SOURCE_REVISION }}
           labels: |
             org.opencontainers.image.source=https://github.com/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.revision=${{ env.SOURCE_REVISION }}
             io.nvidia.nemoclaw.agent=pi
             io.nvidia.nemoclaw.managed-image.contract=1
             io.nvidia.nemoclaw.managed-image.platform=${{ matrix.platform }}
@@ -1319,7 +1325,7 @@ jobs:
       - name: Validate the Pi candidate runtime contract
         shell: bash
         env:
-          IMAGE_REFERENCE: nemoclaw-managed-candidate/pi:${{ github.sha }}
+          IMAGE_REFERENCE: nemoclaw-managed-candidate/pi:${{ env.SOURCE_REVISION }}
         run: |
           set -euo pipefail
           image_json="$(docker image inspect "$IMAGE_REFERENCE")"
@@ -1348,7 +1354,6 @@ jobs:
             test -x /usr/local/bin/nemoclaw-managed-bootstrap
           '
       - name: Log in to GHCR
-        if: github.event_name != 'pull_request'
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
@@ -1358,7 +1363,6 @@ jobs:
       # consumer alias, so a published candidate stays reachable by digest alone.
       - name: Publish the Pi candidate image by digest
         id: publish
-        if: github.event_name != 'pull_request'
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           builder: ${{ steps.buildx.outputs.name }}
@@ -1369,7 +1373,7 @@ jobs:
           outputs: type=image,name=ghcr.io/nvidia/nemoclaw/pi-sandbox,push-by-digest=true,name-canonical=true,push=true
           labels: |
             org.opencontainers.image.source=https://github.com/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.revision=${{ env.SOURCE_REVISION }}
             io.nvidia.nemoclaw.agent=pi
             io.nvidia.nemoclaw.managed-image.contract=1
             io.nvidia.nemoclaw.managed-image.platform=${{ matrix.platform }}
@@ -1382,11 +1386,14 @@ jobs:
             NEMOCLAW_MANAGED_IMAGE_RUNTIME_USER=root
           provenance: false
           sbom: false
+      - name: Remove Pi publication credentials
+        if: always()
+        shell: bash
+        run: docker logout ghcr.io
       # The publication above rebuilds the image rather than reusing the
       # already-validated local one, so revalidate the exact published digest
       # before the contract records it as the qualified candidate.
       - name: Validate the published Pi candidate digest
-        if: github.event_name != 'pull_request'
         shell: bash
         env:
           DIGEST: ${{ steps.publish.outputs.digest }}
@@ -1433,28 +1440,22 @@ jobs:
           '
       # The checks above bypass /usr/local/bin/nemoclaw-start with a direct
       # --entrypoint override, so they never prove the entrypoint itself runs
-      # correctly. Start the local pull-request image or exact published digest
-      # through its declared entrypoint with no command, matching a real launch,
+      # correctly. Start the published digest through its declared entrypoint
+      # with no command, matching a real launch,
       # and prove PID 1 drops to the sandbox user, hardens its resource limits,
       # and persists the trusted proxy environment before it holds the sandbox
       # open.
       - name: Exercise the Pi candidate through its declared entrypoint
         shell: bash
         env:
           DIGEST: ${{ steps.publish.outputs.digest }}
-          EVENT_NAME: ${{ github.event_name }}
-          IMAGE_REFERENCE: nemoclaw-managed-candidate/pi:${{ github.sha }}
         run: |
           set -euo pipefail
-          if [ "$EVENT_NAME" = "pull_request" ]; then
-            reference="$IMAGE_REFERENCE"
-          else
-            if [[ ! "$DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then
-              echo "ERROR: the Pi candidate publication did not return an immutable digest." >&2
-              exit 1
-            fi
-            reference="${REPOSITORY}@${DIGEST}"
+          if [[ ! "$DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then
+            echo "ERROR: the Pi candidate publication did not return an immutable digest." >&2
+            exit 1
           fi
+          reference="${REPOSITORY}@${DIGEST}"
           corporate_ca_dir="$(mktemp -d "$RUNNER_TEMP/pi-candidate-ca.XXXXXX")"
           corporate_ca="$corporate_ca_dir/corporate-ca.pem"
           openssl req -x509 -newkey rsa:2048 -nodes -days 1 \
@@ -1571,7 +1572,6 @@ jobs:
             done
           '
       - name: Record the exact Pi candidate contract
-        if: github.event_name != 'pull_request'
         shell: bash
         env:
           DIGEST: ${{ steps.publish.outputs.digest }}
@@ -1590,7 +1590,7 @@ jobs:
             --arg image "$REPOSITORY" \
             --arg platform "$PLATFORM" \
             --arg release "$release" \
-            --arg revision "$GITHUB_SHA" \
+            --arg revision "$SOURCE_REVISION" \
             --arg reference "${REPOSITORY}@${DIGEST}" \
             '{
               contractVersion: 1,
@@ -1615,7 +1615,6 @@ jobs:
       # This candidate name is deliberately outside that pattern so a published
       # Pi digest cannot enter the atomic release cohort.
       - name: Upload the exact Pi candidate contract
-        if: github.event_name != 'pull_request'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: managed-candidate-contract-${{ github.run_id }}-${{ github.run_attempt }}-pi-${{ matrix.arch }}

ci/cli-test-timing-hints.json

@@ -158,8 +158,6 @@
     "test/mcp/mcp-add-crash-consistency.test.ts": 43147,
     "test/mcp/mcp-bridge-destroy-marker-recovery.test.ts": 14345,
     "test/mcp/mcp-bridge-servers.test.ts": 15199,
-    "test/mcp/mcp-policy-key-ownership.test.ts": 9878,
-    "test/mcp/mcp-policy-transition.test.ts": 5011,
     "test/mcp/mcp-provider-ownership.test.ts": 9896,
     "test/mcp/mcp-tool-discovery-image-contract.test.ts": 8489,
     "test/networking/dns-proxy.test.ts": 5827,
@@ -200,12 +198,10 @@
     "test/runtime/gateway/recover-port-forward.test.ts": 12821,
     "test/runtime/messaging/telegram-diagnostics.test.ts": 5127,
     "test/runtime/policy/policies.test.ts": 5377,
-    "test/runtime/policy/policy-add-remove-session-sync.test.ts": 10393,
     "test/runtime/policy/policy-channel-agent-resolution.test.ts": 8083,
     "test/runtime/policy/policy-explain-cli.test.ts": 5249,
     "test/runtime/policy/policy-openclaw-npm-compatibility.test.ts": 14295,
     "test/runtime/policy/policy-preset-noop-disclosure.test.ts": 9796,
-    "test/runtime/policy/policy-tiers-onboard-restricted-stale-otel.test.ts": 5808,
     "test/runtime/policy/policy-tiers-onboard.test.ts": 8804,
     "test/runtime/policy/portable-policy-failure-finality.test.ts": 8392,
     "test/runtime/sandbox/reboot-identity-drift.test.ts": 13632,

ci/onboard-entry-composition-budget.json

@@ -11,9 +11,8 @@
     "runOnboard.finalizationDeps.verifyDeployment.getMessagingChannels": 1
   },
   "policy": {
-    "createOnboardPolicyApplication.getRecordedPolicyTier": 1,
     "preflightAuthoritativeRebuildTarget": 1,
-    "runOnboard": 5,
+    "runOnboard": 4,
     "sandboxCreateIntentResolver.getAgentPolicyPath": 1
   },
   "provider": {

ci/pi-agent-qualification-v1-linux-amd64.json

@@ -3,13 +3,13 @@
   "agent": "pi",
   "platform": "linux/amd64",
   "image": "ghcr.io/nvidia/nemoclaw/pi-sandbox",
-  "digest": "sha256:4a50a8ce74d76a6002a1cd0fe65b329528e0e3713c221535b3cfd56237a4fdf0",
-  "reference": "ghcr.io/nvidia/nemoclaw/pi-sandbox@sha256:4a50a8ce74d76a6002a1cd0fe65b329528e0e3713c221535b3cfd56237a4fdf0",
+  "digest": "sha256:492f2161f206644dd82c7206675e0b78f47da4f6c9a4fce23f38a4e2ef4e9b0f",
+  "reference": "ghcr.io/nvidia/nemoclaw/pi-sandbox@sha256:492f2161f206644dd82c7206675e0b78f47da4f6c9a4fce23f38a4e2ef4e9b0f",
   "source": {
     "repository": "NVIDIA/NemoClaw",
-    "revision": "d92acac1c40364702eaae92a169a2b06d1bfda4b",
+    "revision": "f53e91c199a36b1d19cca29ff0c950d9807ebbe1",
     "release": "v0.1.0",
-    "cohort": "ghrun-32678646532-1"
+    "cohort": "ghrun-33220887790-1"
   },
   "startupProfileContractVersion": 1,
   "capabilityContractVersion": 1

ci/pi-agent-qualification-v1-linux-arm64.json

@@ -3,13 +3,13 @@
   "agent": "pi",
   "platform": "linux/arm64",
   "image": "ghcr.io/nvidia/nemoclaw/pi-sandbox",
-  "digest": "sha256:2f859158f229776f6b5ff441cf4a59432cfb2c37096e4ec879fdcb88ac3e57c3",
-  "reference": "ghcr.io/nvidia/nemoclaw/pi-sandbox@sha256:2f859158f229776f6b5ff441cf4a59432cfb2c37096e4ec879fdcb88ac3e57c3",
+  "digest": "sha256:40de3fc971d91b174ba2bc2193c45b6e3c536f3cb28746b0af97a57e0a1ec543",
+  "reference": "ghcr.io/nvidia/nemoclaw/pi-sandbox@sha256:40de3fc971d91b174ba2bc2193c45b6e3c536f3cb28746b0af97a57e0a1ec543",
   "source": {
     "repository": "NVIDIA/NemoClaw",
-    "revision": "d92acac1c40364702eaae92a169a2b06d1bfda4b",
+    "revision": "f53e91c199a36b1d19cca29ff0c950d9807ebbe1",
     "release": "v0.1.0",
-    "cohort": "ghrun-32678646532-1"
+    "cohort": "ghrun-33220887790-1"
   },
   "startupProfileContractVersion": 1,
   "capabilityContractVersion": 1

ci/source-architecture-budget.json

@@ -3,32 +3,31 @@
   "fanIn": {
     "defaultMax": 20,
     "maxByFile": {
-      "src/lib/actions/sandbox/mcp-bridge-contracts.ts": 26,
+      "src/lib/actions/sandbox/mcp-bridge-contracts.ts": 25,
       "src/lib/actions/sandbox/process-recovery.ts": 27,
       "src/lib/adapters/docker/index.ts": 43,
       "src/lib/adapters/openshell/client.ts": 20,
       "src/lib/adapters/openshell/resolve.ts": 27,
       "src/lib/adapters/openshell/runtime.ts": 55,
       "src/lib/adapters/openshell/timeouts.ts": 38,
       "src/lib/agent/defs.ts": 33,
-      "src/lib/cli/branding.ts": 86,
+      "src/lib/cli/branding.ts": 85,
       "src/lib/cli/nemoclaw-oclif-command.ts": 107,
       "src/lib/cli/terminal-style.ts": 43,
       "src/lib/core/json-types.ts": 37,
       "src/lib/core/ports.ts": 89,
       "src/lib/core/shell-quote.ts": 28,
       "src/lib/core/url-utils.ts": 30,
-      "src/lib/core/wait.ts": 38,
+      "src/lib/core/wait.ts": 37,
       "src/lib/credentials/store.ts": 46,
       "src/lib/inference/config.ts": 30,
-      "src/lib/inference/web-search.ts": 21,
       "src/lib/messaging/channels/index.ts": 25,
       "src/lib/onboard/gateway-binding.ts": 53,
       "src/lib/runner.ts": 86,
       "src/lib/security/redact.ts": 54,
-      "src/lib/state/onboard-session.ts": 36,
       "src/lib/state/mcp-lifecycle-lock.ts": 21,
-      "src/lib/state/registry.ts": 100,
+      "src/lib/state/onboard-session.ts": 35,
+      "src/lib/state/registry.ts": 97,
       "src/lib/state/state-root.ts": 21,
       "src/lib/subprocess-env.ts": 24,
       "src/lib/validation.ts": 24
@@ -40,7 +39,7 @@
       "src/lib/actions/inference-set.ts": 32,
       "src/lib/actions/sandbox/connect.ts": 43,
       "src/lib/actions/sandbox/destroy.ts": 29,
-      "src/lib/actions/sandbox/doctor.ts": 29,
+      "src/lib/actions/sandbox/doctor.ts": 27,
       "src/lib/actions/sandbox/gateway-state.ts": 21,
       "src/lib/actions/sandbox/status-snapshot.ts": 19,
       "src/lib/actions/sandbox/policy-channel.ts": 30,
@@ -51,7 +50,7 @@
       "src/lib/inference/local.ts": 22,
       "src/lib/inference/onboard-probes.ts": 21,
       "src/lib/inference/vllm.ts": 21,
-      "src/lib/onboard.ts": 201,
+      "src/lib/onboard.ts": 193,
       "src/lib/onboard/machine/handlers/sandbox.ts": 21,
       "src/lib/policy/index.ts": 23,
       "src/lib/sandbox/config.ts": 22,
@@ -60,9 +59,9 @@
   },
   "allowedCycles": [],
   "maxRootFiles": {
-    "src/lib/onboard": 308,
+    "src/lib/onboard": 306,
     "src/lib/actions": 19,
-    "src/lib/actions/sandbox": 183,
+    "src/lib/actions/sandbox": 182,
     "src/lib/state": 39,
     "src/lib/inference": 63,
     "scripts": 42

ci/test-file-size-budget.json

@@ -8,7 +8,7 @@
     "test/generation/generate-openclaw-config.test.ts": 1898,
     "test/installer-integration/install-preflight.test.ts": 3025,
     "test/agents/openclaw/runtime/nemoclaw-start.test.ts": 4626,
-    "test/onboarding/onboard-messaging.test.ts": 1976,
+    "test/onboarding/onboard-messaging.test.ts": 1971,
     "test/onboarding/onboard-selection.test.ts": 4176
   }
 }