fix(onboard): require managed images for stock agents

.github/workflows/e2e-standard-profile.yaml

@@ -27,6 +27,9 @@ on:
       managed_image_revision:
         required: true
         type: string
+      managed_image_receipt:
+        required: true
+        type: string
       credential_boundary:
         required: true
         type: string
@@ -113,6 +116,7 @@ jobs:
       E2E_TARGET_ID: ${{ inputs.target_id }}
       NEMOCLAW_RUN_LIVE_E2E: "1"
       NEMOCLAW_E2E_EXPECTED_SHA: ${{ inputs.candidate_sha }}
+      E2E_MANAGED_IMAGE_COHORT_RECEIPT: ${{ inputs.managed_image_receipt }}
       NEMOCLAW_E2E_CORRELATION_ID: ${{ inputs.risk_signal_correlation_id }}
       NEMOCLAW_E2E_RISK_SIGNAL_EXPECTED_SHA: ${{ inputs.risk_signal_expected_sha }}
       NEMOCLAW_LLAMA_CPP_QUALIFICATION_HEAD_SHA: ${{ inputs.candidate_sha }}

.github/workflows/pr-self-hosted.yaml

@@ -90,7 +90,7 @@ jobs:
             printf 'selected=%s\n' "$selected"
           } >>"$GITHUB_OUTPUT"
 
-      - name: Check out trusted publication gate
+      - name: Check out PR base SHA for publication verification
         if: ${{ steps.changed.outputs.selected == 'true' }}
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -104,12 +104,12 @@ jobs:
         with:
           node-version: 22
 
-      - name: Install trusted publication gate dependencies
+      - name: Install publication verifier dependencies
         if: ${{ steps.changed.outputs.selected == 'true' }}
         run: npm ci --ignore-scripts --no-audit --no-fund
 
       - id: publication
-        name: Verify applicable base-image publication
+        name: Verify complete base and managed-image publication
         if: ${{ steps.changed.outputs.selected == 'true' }}
         env:
           EXPECTED_SHA: ${{ steps.changed.outputs.base_sha }}

ci/source-shape-test-budget.json

@@ -81,6 +81,11 @@
       "test": "selects exact-commit rootless evidence for Portable recovery changes (#9707)",
       "category": "security"
     },
+    {
+      "file": "test/e2e/support/pr-self-hosted-llama-selector.test.ts",
+      "test": "binds trusted base publication to the generic NVIDIA GPU job",
+      "category": "security"
+    },
     {
       "file": "test/agents/hermes/hermes-final-image-layout.test.ts",
       "test": "pins $source to its current bytes at $target",

docs/deployment/sandbox-hardening.mdx

@@ -15,7 +15,7 @@ The NemoClaw sandbox image applies several security measures to reduce the attac
 ## Immutable Managed Image Selection
 
 Stock onboarding through the OpenShell Docker driver selects an exact managed-image digest and validates the complete OpenClaw, Hermes, and LangChain Deep Agents Code publication cohort before sandbox creation.
-If registry or catalog availability prevents resolution, the ordinary `prefer-managed` path builds the shipped, reviewed repository Dockerfile instead; it never selects an unpinned `:latest` image.
+If registry or catalog availability prevents resolution, stock onboarding stops before sandbox creation and does not build a shipped Dockerfile.
 An available but incomplete, mixed, mutable, wrong-platform, or identity-inconsistent cohort fails closed before sandbox creation.
 Passing `--from <Dockerfile>` remains a separate explicit opt-in whose complete custom image must be reviewed independently.
 

docs/get-started/quickstart-hermes.mdx

@@ -62,8 +62,9 @@ Review the [Prerequisites](prerequisites) before you begin.
     If the installer does not offer Express setup, or if you enter `n` at the Express prompt on a supported non-N1x host, choose an inference provider and model, then provide its credential when prompted.
     For that interactive path, skip optional web search and messaging setup on a first run, then accept the suggested network policy tier.
     With the OpenShell Docker driver, stock Hermes onboarding normally uses the release's exact managed-image digest.
-    If registry or catalog availability prevents resolution, it builds the shipped repository Dockerfile instead; it never selects an unpinned `:latest` image.
+    If registry or catalog availability prevents resolution, stock onboarding stops before sandbox creation and does not build a shipped Dockerfile.
     Invalid or inconsistent catalog evidence fails closed before sandbox creation.
+    An explicit `nemohermes onboard --from <Dockerfile>` remains a separate custom-image path.
   </Step>
 
   <Step title="Confirm the Sandbox Is Ready">

docs/get-started/quickstart-langchain-deepagents-code.mdx

@@ -65,8 +65,9 @@ Review the [Prerequisites](prerequisites) before you begin.
     If the installer does not offer Express setup, or if you enter `n` at the Express prompt on a supported non-N1x host, choose an inference provider and model, then provide its credential when prompted.
     For that interactive path, accept the suggested network policy tier on a first run.
     With the OpenShell Docker driver, stock Deep Agents Code onboarding normally uses the release's exact managed-image digest.
-    If registry or catalog availability prevents resolution, it builds the shipped repository Dockerfile instead; it never selects an unpinned `:latest` image.
+    If registry or catalog availability prevents resolution, stock onboarding stops before sandbox creation and does not build a shipped Dockerfile.
     Invalid or inconsistent catalog evidence fails closed before sandbox creation.
+    An explicit `nemo-deepagents onboard --from <Dockerfile>` remains a separate custom-image path.
   </Step>
 
   <Step title="Confirm the Sandbox Is Ready">

docs/get-started/quickstart.mdx

@@ -51,8 +51,9 @@ Review the [Prerequisites](prerequisites) before you begin.
     Press Enter to accept the suggested `my-assistant` sandbox name.
     For a first run, skip optional web search and messaging setup, then accept the suggested network policy tier.
     With the OpenShell Docker driver, stock OpenClaw onboarding normally uses the release's exact managed-image digest.
-    If registry or catalog availability prevents resolution, it builds the shipped repository Dockerfile instead; it never selects an unpinned `:latest` image.
+    If registry or catalog availability prevents resolution, stock onboarding stops before sandbox creation and does not build a shipped Dockerfile.
     Invalid or inconsistent catalog evidence fails closed before sandbox creation.
+    An explicit `nemoclaw onboard --from <Dockerfile>` remains a separate custom-image path.
 
     <Note>
       The installer can display `Run express install with these settings? [Y/n]:` before the agent-selection prompt on DGX Spark, qualifying DGX Station, or Windows Subsystem for Linux (WSL) hosts.

docs/reference/architecture.mdx

@@ -312,7 +312,7 @@ The maintained onboarding path for this agent does not consume the component.
 
 Stock onboarding through the OpenShell Docker driver for OpenClaw, Hermes, and LangChain Deep Agents Code selects an immutable managed image for the installed release and host architecture.
 Before selecting one agent image, NemoClaw validates a complete three-agent cohort with one release, source revision, publication cohort, and compatible startup and capability contracts.
-If registry or catalog availability prevents resolution, the ordinary `prefer-managed` path builds the shipped, reviewed repository Dockerfile instead and never selects an unpinned tag.
+If registry or catalog availability prevents resolution, stock onboarding stops before sandbox creation and does not build a shipped Dockerfile.
 Available catalog evidence that is incomplete, mixed, mutable, wrong-platform, or identity-inconsistent fails closed before sandbox creation.
 An explicit `--from <Dockerfile>` remains a separate complete custom-image path.
 The portable experimental profile retains its existing workload path, and native Podman remains disabled.

docs/reference/commands.mdx

@@ -977,8 +977,8 @@ Docker and Podman gateways cannot reuse one state directory. For NemoClaw-manage
 
 Without `--from`, onboarding through the OpenShell Docker driver for OpenClaw, Hermes, and LangChain Deep Agents Code selects an immutable managed image for the installed release and host architecture.
 NemoClaw validates the complete three-agent publication cohort before selecting any member.
-If registry or catalog availability prevents resolution, the ordinary `prefer-managed` path builds the shipped, reviewed repository Dockerfile instead; it never selects an unpinned `:latest` image.
-Available catalog evidence that is incomplete, mixed, mutable, wrong-platform, or identity-inconsistent fails closed before sandbox creation.
+If registry or catalog availability prevents resolution, stock onboarding stops before sandbox creation and does not build a shipped Dockerfile.
+Catalog evidence that is incomplete, mixed, mutable, wrong-platform, or identity-inconsistent also fails closed before sandbox creation.
 The portable experimental profile and native Podman are not part of this activation.
 
 Build the sandbox image from a custom Dockerfile instead of the stock NemoClaw image.

src/lib/onboard/machine/handlers/provider-inference-host-local-startup.test.ts

@@ -26,7 +26,6 @@ import {
 } from "./provider-inference.test-support";
 
 type TestProviderInferenceOptions = ProviderInferenceStateOptions<Gpu, Agent, Host>;
-
 const PROBE_IMAGE = `quay.io/curl/curl@sha256:${"b".repeat(64)}`;
 const NIM_IMAGE = `nvcr.io/nim/meta/llama@sha256:${"d".repeat(64)}`;
 const MANAGED_IMAGE = `nvcr.io/nvidia/vllm@sha256:${"c".repeat(64)}`;
@@ -39,7 +38,6 @@ const receiptWriter = {
   targetSha256: "1".repeat(64),
   writeExact: (value: string) => value,
 };
-
 function publishedManagedReceipt(
   service: "nim" | "vllm",
   model: string,
@@ -245,6 +243,25 @@ function llamaCppLifecycleSelection(
 }
 
 describe("provider inference host-local startup selection", () => {
+  it("does not require host-local application support for a hosted candidate provider", () => {
+    const resolver = vi.fn();
+    const resolve = createCachedHostLocalInferenceSetupResolver({
+      resolver,
+      application: "pi",
+      provider: "nvidia-prod",
+      model: "nvidia/nemotron-3-super-120b-a12b",
+      acceleration: "cpu",
+      requireToolCalling: null,
+      freshRequireToolCalling: true,
+      allowPublishedResume: false,
+      recover: false,
+      recordToolCallingRequirement: vi.fn(),
+    });
+
+    expect(resolve("pi-sandbox")).toEqual({});
+    expect(resolver).not.toHaveBeenCalled();
+  });
+
   it.each(["openclaw", "hermes", "langchain-deepagents-code"] as const)(
     "dispatches a published %s llama.cpp route through the common lifecycle exactly once",
     async (application) => {

src/lib/onboard/machine/handlers/provider-inference.ts

@@ -546,6 +546,7 @@ function hostLocalInferenceSetupOptions(
     (candidate): candidate is HostLocalInferenceApplication => candidate === input.application,
   );
   if (!application) {
+    if (!isHostLocalInferenceProvider(input.provider)) return {};
     throw new Error(`Unsupported host-local inference application '${input.application}'.`);
   }
   const selected = resolver({

src/lib/onboard/managed-workload/onboard-orchestration.test.ts

@@ -5,7 +5,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
-import { describe, expect, it, vi } from "vitest";
+import { afterAll, describe, expect, it, vi } from "vitest";
 
 import { createHermesStateVolumeDockerHarness } from "../__test-helpers__/hermes-state-volume";
 
@@ -14,6 +14,9 @@ const preparationState = vi.hoisted(() => ({
   useUnavailableCatalog: false,
 }));
 const prepareSandboxWorkloadSource = vi.hoisted(() => vi.fn());
+const INSTALLED_REVISION = vi.hoisted(() => "d".repeat(40));
+const releaseRoot = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-release-root-"));
+fs.writeFileSync(path.join(releaseRoot, ".version"), "0.0.0\n");
 
 vi.mock("../workload/preparation", async (importOriginal) => {
   const original = await importOriginal<typeof import("../workload/preparation")>();
@@ -30,7 +33,10 @@ vi.mock("../workload/preparation", async (importOriginal) => {
   return { ...original, prepareSandboxWorkloadSource };
 });
 
-vi.mock("../../core/version", () => ({ getVersion: () => "v0.0.0" }));
+vi.mock("../../core/version", () => ({
+  getBuildIdentity: () => ({ nemoclawVersion: "0.0.0", sourceRevision: INSTALLED_REVISION }),
+  getVersion: () => "v0.0.0",
+}));
 
 import {
   createManagedHermesStateVolumeOnboardLifecycle,
@@ -71,7 +77,7 @@ function createFreshOnboardingRuntime(
       agentName: "openclaw",
       legacyDockerfilePath: "agents/openclaw/Dockerfile",
       customDockerfilePath: null,
-      rootDir: "/tmp/nemoclaw",
+      rootDir: releaseRoot,
       model: "model",
       provider: "provider",
       preferredInferenceApi: null,
@@ -118,6 +124,10 @@ async function expectUnsupportedHermesPortableSources(
 }
 
 describe("managed workload onboard orchestration", () => {
+  afterAll(() => {
+    fs.rmSync(releaseRoot, { force: true, recursive: true });
+  });
+
   it("activates stock managed images only for shipped agents outside Portable", () => {
     expect(
       shouldActivateStockManagedRuntime({
@@ -237,7 +247,7 @@ describe("managed workload onboard orchestration", () => {
       },
     );
 
-    lifecycle.materializeSandboxCreatePlan({} as never, (input) => {
+    lifecycle!.materializeSandboxCreatePlan({} as never, (input) => {
       expect(input.managedStateMount).toMatchObject({ target: "/sandbox/.hermes" });
       return {} as never;
     });
@@ -249,17 +259,31 @@ describe("managed workload onboard orchestration", () => {
 
   it("retains the live qualification catalog revision during fresh onboarding (#9385)", async () => {
     const catalogRevision = "a".repeat(40);
-    const { prepared, runtime } = createFreshOnboardingRuntime({
-      GITHUB_ACTIONS: "true",
-      E2E_MANAGED_IMAGE_REVISION: catalogRevision,
-    });
+    const { prepared, runtime } = createFreshOnboardingRuntime(
+      {
+        GITHUB_ACTIONS: "true",
+        E2E_MANAGED_IMAGE_REVISION: catalogRevision,
+      },
+      { stockManagedRuntime: true },
+    );
 
     await expect(runtime.ensurePreparedWorkload()).resolves.toBe(prepared);
     expect(prepareSandboxWorkloadSource).toHaveBeenCalledExactlyOnceWith(
       expect.objectContaining({ catalogRevision }),
     );
   });
 
+  it("does not apply the stock cohort revision outside stock onboarding", async () => {
+    const { prepared, runtime } = createFreshOnboardingRuntime({
+      GITHUB_ACTIONS: "true",
+      E2E_MANAGED_IMAGE_REVISION: "a".repeat(40),
+    });
+
+    await expect(runtime.ensurePreparedWorkload()).resolves.toBe(prepared);
+    expect(prepareSandboxWorkloadSource).toHaveBeenCalledOnce();
+    expect(prepareSandboxWorkloadSource.mock.calls[0]?.[0]).not.toHaveProperty("catalogRevision");
+  });
+
   it("binds fresh onboarding to the exact PR catalog (#9464)", async () => {
     const catalogRevision = "b".repeat(40);
     const fixtureRoot = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-live-e2e-catalog-"));
@@ -295,14 +319,35 @@ describe("managed workload onboard orchestration", () => {
     expect(prepareSandboxWorkloadSource.mock.calls[0]?.[0]).not.toHaveProperty("catalogRevision");
   });
 
+  it("retains an exact installed revision outside GitHub Actions", async () => {
+    const { prepared, runtime } = createFreshOnboardingRuntime({
+      NEMOCLAW_INSTALL_REF: INSTALLED_REVISION,
+    });
+
+    await expect(runtime.ensurePreparedWorkload()).resolves.toBe(prepared);
+    expect(prepareSandboxWorkloadSource).toHaveBeenCalledExactlyOnceWith(
+      expect.objectContaining({ catalogRevision: INSTALLED_REVISION }),
+    );
+  });
+
   it("resolves final-image patch metadata after managed build-context staging", async () => {
     const resolutionMetadata = { key: "published-dcode-base" };
+    const trustedDockerfile = path.join(
+      process.cwd(),
+      "agents",
+      "langchain-deepagents-code",
+      "Dockerfile",
+    );
     let staged = false;
     const resolvePatchInput = vi.fn(() => {
       expect(staged).toBe(true);
-      return { preResolvedBaseImageMetadata: resolutionMetadata } as never;
+      return {
+        fromDockerfile: trustedDockerfile,
+        preResolvedBaseImageMetadata: resolutionMetadata,
+      } as never;
     });
     const resolveSandboxBuildPatch = vi.fn(async (input: Record<string, unknown>) => {
+      expect(input.fromDockerfile).toBeNull();
       expect(input.preResolvedBaseImageMetadata).toBe(resolutionMetadata);
       expect(input.stagedDockerfile).toBe("/tmp/nemoclaw-staged-context/Dockerfile");
       return { buildId: "dcode-build", dashboardRemoteBindPrepared: false };
@@ -348,8 +393,9 @@ describe("managed workload onboard orchestration", () => {
         agent: {
           name: "langchain-deepagents-code",
           displayName: "LangChain Deep Agents Code",
+          dockerfilePath: trustedDockerfile,
         },
-        fromDockerfile: null,
+        fromDockerfile: trustedDockerfile,
         createAgentSandbox: () => {
           staged = true;
           return {

src/lib/onboard/managed-workload/onboard-orchestration.ts

@@ -32,6 +32,7 @@ import type { MessagingTokenDef } from "../messaging-prep";
 import { resolveSandboxBuildContext, resolveSandboxBuildPatch } from "../prepared-dcode-rebuild";
 import {
   CURRENT_RUNTIME_PROVIDER_BUNDLES,
+  normalizeRuntimeProviderIdentity,
   type RuntimeProviderBundle,
   resolveRuntimeProviderBundle,
 } from "../runtime-provider/access";
@@ -54,6 +55,7 @@ import {
 import { getSandboxReadyTimeoutSecs } from "../sandbox-gpu-create";
 import type { SandboxGpuConfig } from "../sandbox-gpu-mode";
 import {
+  installedManagedImageCatalogRevision,
   liveE2eManagedImageCatalog,
   liveE2eManagedImageRevision,
   type PreparedSandboxWorkloadSource,
@@ -66,6 +68,7 @@ import {
 import { resolveSandboxWorkloadRuntimeCapabilities } from "../workload/runtime";
 import {
   prepareManagedHermesStateVolume,
+  removeManagedHermesStateVolume,
   type ManagedHermesStateVolumeContext,
   type ManagedHermesStateVolumeDeps,
 } from "./hermes-state-volume";
@@ -80,6 +83,8 @@ type BootstrapProvider = RuntimeProviderBundle & {
   readonly bootstrap: RuntimeProviderManagedImageBootstrapSurface;
 };
 
+export { normalizeRuntimeProviderIdentity, removeManagedHermesStateVolume };
+
 export type ManagedHermesStateVolumeOnboardLifecycle = {
   materializeSandboxCreatePlan(
     input: MaterializeSandboxCreatePlanInput,
@@ -240,11 +245,18 @@ export function createManagedWorkloadOnboardRuntime(
   let preparedProfile: BuiltManagedStartupOnboardProfile | null = null;
 
   const ensurePreparedWorkload = async (): Promise<PreparedSandboxWorkloadSource> => {
-    const catalogRevision = liveE2eManagedImageRevision(input.startupProfile.environment);
+    const liveCatalogRevision = input.stockManagedRuntime
+      ? liveE2eManagedImageRevision(input.startupProfile.environment)
+      : null;
     const liveCatalog = liveE2eManagedImageCatalog(input.startupProfile.environment);
-    if (catalogRevision && liveCatalog) {
+    if (liveCatalogRevision && liveCatalog) {
       throw new Error("live E2E managed-image revision and catalog authority conflict");
     }
+    const catalogRevision =
+      liveCatalogRevision ??
+      (liveCatalog || input.tempManagedRuntimeCatalog || input.managedWorkloadRebuild
+        ? null
+        : installedManagedImageCatalogRevision(input.startupProfile.environment, input.rootDir));
     preparedWorkloadPromise ??= input.managedWorkloadRebuild
       ? Promise.resolve(
           prepareSandboxWorkloadSourceFromRebuildHandoff(
@@ -480,11 +492,15 @@ export async function prepareOnboardSandboxWorkloadLaunch(
   } else {
     const buildContext = requireLegacyBuildContext(legacyBuildContext);
     input.dependencies.prepareSandboxBuildPatchConfig({ configuredMessagingChannels });
+    const patchInput = input.legacy.resolvePatchInput();
     const patch = await (input.dependencies.resolveSandboxBuildPatch ?? resolveSandboxBuildPatch)({
       // Build-context staging resolves managed-agent base-image provenance.
       // Read the patch input only after that boundary so the final image gets
       // the exact metadata produced by the same staging operation.
-      ...input.legacy.resolvePatchInput(),
+      ...patchInput,
+      // An explicit path to the checked-in agent Dockerfile is staged through
+      // the trusted agent builder. Preserve that classification at patch time.
+      fromDockerfile: buildContext.origin === "generated" ? null : patchInput.fromDockerfile,
       selectedGpuRoute: initialGpuRoute,
       stagedDockerfile: buildContext.stagedDockerfile,
     });