feat(onboard): support external images with Podman by rsliter · Pull Request #12538 · NVIDIA/NemoClaw

rsliter · 2026-09-30T17:40:28Z

Outcome

Rootless Podman can now onboard, resume, rebuild, and clean up exact-digest external OpenClaw and Hermes images through --from-image. Podman uses its ambient registry credentials, validates the immutable local image identity, and retains publisher-owned shared images; Docker behavior remains compatible.

Reason

External-image preparation previously encoded Docker-specific inspection, absence detection, pull, and image-ID behavior in the generic workflow. That prevented the qualified Podman provider from honestly advertising or executing the accepted external-image capability.

Related issues

Fixes #12241.

Changes

Add a provider-owned external-image preparation surface. The onboarding and rebuild consumers need engine-specific absence classification, pull syntax, and immutable-ID normalization; a direct generic command change cannot represent Docker and Podman semantics safely. Provider-contract, external-image, rebuild-preflight, and Podman-provider tests protect the capability and advertisement rules.
Add a guarded Podman external-image operation. Rootless Podman needs exact socket and executable authority, ambient REGISTRY_AUTH_FILE forwarding, fail-closed status handling, and a non-retrying digest pull. Podman adapter and provider tests protect credential boundaries, status 125 handling, bare-ID normalization, and cleanup retention.
Extend the existing managed-image activation E2E contract to cover external OpenClaw and Hermes images on the selected Docker or Podman runtime. Reusing the existing lane avoids a second behavior registry while proving onboarding, identity drift rejection, rebuild, and cleanup. E2E-support tests protect runtime selection, identity normalization, diagnostics, and phase metadata.
Document selected-runtime behavior and ambient Podman authentication for --from-image and rebuild.

Verification

npx vitest run --project cli src/lib/onboard/workload/external-image.test.ts src/lib/actions/sandbox/lifecycle/rebuild-external-image-preflight.test.ts src/lib/onboard/runtime-provider/runtime-provider-contract.test.ts src/lib/onboard/runtime-provider/activation.test.ts src/lib/onboard/runtime-provider/podman-runtime-surfaces.test.ts src/lib/onboard/runtime-provider/podman.test.ts src/lib/adapters/podman/index.test.ts - 229 tests passed.
Focused E2E-support validation - 26 tests passed.
node --max-old-space-size=8192 node_modules/typescript/bin/tsc -p tsconfig.cli.json - passed.
npm run checks:repository - 18 selected repository checks passed.
npm run test:e2e-phases:check - 101 tests across 78 files passed.
npm run docs - strict documentation build passed with no errors.
Normal pre-commit and pre-push hooks - formatting, linting, repository checks, secret scanning, phase plans, growth guardrails, publication validation, and CLI/plugin TypeScript checks passed.
npm run test:changed - non-success aggregate run: 10,131 tests passed and 58 failed. The failures were outside the modified paths and classified as /private/tmp trusted-ancestry rejection, missing host Python yaml, host Docker-context variance, or whole-suite resource timeouts. The affected-path tests above pass.
Diff inspection confirmed that no secrets, API keys, or credentials are present.

Review notes

Sensitive paths: src/lib/onboard/** under the canonical contributor policy. Pre-publication context is an implementation self-review of NVIDIA/NemoClaw commit 500932d1be7f323c69c85f3005ed70b2eae0c3da across all 24 changed paths, including exact-digest validation, ambient credential handling, ambiguous failure states, rebuild ordering, and cleanup retention. No unresolved candidate-owned finding was found. This is not independent approval; the sensitive paths await independent review.

Signed-off-by: Rebecca Sliter 571084+rsliter@users.noreply.github.com

Summary by CodeRabbit

New Features
- Rootless Podman now supports digest-pinned OpenClaw and Hermes images through --from-image, alongside Docker.
- Private-image access uses the selected runtime’s credentials, including Podman’s REGISTRY_AUTH_FILE. NemoClaw does not request or store registry tokens.
Bug Fixes
- Rebuilds validate image identity and runtime compatibility. If pulling or validation fails, the existing sandbox remains in place.
- Shared external images are retained during workload cleanup.
- Admin approval targets the exact pending request, avoiding approval of a stale request.
Documentation
- Updated image setup and rebuild guidance to cover Docker and rootless Podman.

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

copy-pr-bot · 2026-09-30T17:40:32Z

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

coderabbitai · 2026-09-30T17:40:35Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: NVIDIA/NemoClaw/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 2291c163-2545-4918-b043-efd7292cd5f5

📥 Commits

Reviewing files that changed from the base of the PR and between 5d509b3 and f027143.

📒 Files selected for processing (1)

docs/reference/commands.mdx

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

📝 Walkthrough

Walkthrough

Rootless Podman now supports digest-pinned OpenClaw and Hermes images through provider-owned preparation. Onboarding, rebuild, and runtime checks use provider-specific image operations. The changes also update admin approval to select the exact captured request.

Changes

External-image onboarding across runtimes

Layer / File(s)	Summary
Provider-neutral preparation contract `src/lib/onboard/runtime-provider/contract.ts`, `src/lib/onboard/workload/source.ts`, `src/lib/onboard/workload/external-image.ts`, `src/lib/onboard/runtime-provider/docker.ts`, `src/lib/onboard/runtime-provider/registry.ts`, related tests	Workload preparation uses provider-supplied local inspection, pulling, post-pull inspection, and content-ID normalization. Docker registers these operations. Supported agent names come from a shared list, and registry validation checks the provider capability and operation identity.
Podman preparation authority and registration `src/lib/adapters/container-engine.ts`, `src/lib/adapters/podman/*`, `src/lib/onboard/runtime-provider/activation.ts`, `src/lib/onboard/runtime-provider/podman.ts`, `src/lib/onboard/runtime-provider/podman-runtime-surfaces.ts`, related tests	Podman adds an external-image-preparation engine operation and exposes image inspection, pulling, and content-ID normalization. The operation can use `REGISTRY_AUTH_FILE` when configured. Provider registration checks the preparation capability and matching operation identity.
Onboarding, rebuild, and image retention `src/lib/onboard/managed-workload/onboard-orchestration.ts`, `src/lib/actions/sandbox/lifecycle/rebuild-external-image-preflight*`, `src/lib/onboard/runtime-provider/podman-runtime-surfaces.ts`, `src/lib/onboard/runtime-provider/podman.test.ts`	Onboarding and rebuild pass the provider’s preparation capability to workload validation. Podman cleanup retains workloads marked shared. Tests cover preparation and rebuild preflight.
Selected-runtime end-to-end checks `test/e2e/fixtures/docker-build-guard.ts`, `test/e2e/live/managed-image-activation-e2e-*`, `test/e2e/support/docker-build-guard.test.ts`, `test/e2e/support/managed-image-activation-diagnostics.test.ts`, `test/inference/managed/managed-image-publication-workflow.test.ts`, `tools/e2e/base-image-publication.mts`, `.github/workflows/managed-images.yaml`, `.github/workflows/base-image.yaml`	Managed-image activation checks use the selected runtime for build guards, image and container inspection, diagnostics, and image identity. Tests cover runtime ID normalization and external-image adoption for both runtimes. Workflow filters and publication checks include the container-engine and Podman adapter paths.
Runtime support and rebuild documentation `ci/platform-matrix.json`, `docs/manage-sandboxes/recover-rebuild-sandboxes.mdx`, `docs/reference/architecture.mdx`, `docs/reference/commands.mdx`, `docs/reference/platform-support.mdx`, `docs/reference/troubleshooting.mdx`, `docs/changelog/2026-10-01.mdx`, `test/e2e/README.md`	Documentation and platform notes describe Podman support for digest-pinned external images, runtime-specific registry credentials, and rebuild behavior. End-to-end documentation covers Docker and rootless Podman.

Exact-request admin approval

Layer / File(s)	Summary
Select the captured pending request `test/e2e/live/openclaw-admin-scope.ts`, `test/e2e/support/managed-image-activation-diagnostics.test.ts`, `test/security/admin-approval-helper.test.ts`	The approval connect script filters pending OpenClaw requests to the expected request ID. Tests cover approval when a stale request appears first and rejection when duplicate canonical records exist.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Feature · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant Onboarding
  participant ExternalImagePreparation
  participant SelectedRuntime
  Onboarding->>ExternalImagePreparation: inspectLocal image
  ExternalImagePreparation->>SelectedRuntime: inspect local image
  SelectedRuntime-->>ExternalImagePreparation: inspection result
  opt Local image is absent
    Onboarding->>ExternalImagePreparation: pull image
    ExternalImagePreparation->>SelectedRuntime: pull with runtime credentials
    Onboarding->>ExternalImagePreparation: inspectPulled image
    ExternalImagePreparation->>SelectedRuntime: inspect pulled image
    SelectedRuntime-->>Onboarding: image metadata
  end

Suggested reviewers: ericksoa, cv

Merge Risk: ⚪ Minimal · up to f0271

The documentation accurately describes Podman’s credential behavior; no merge-blocking issue remains in this change.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The changes to `test/e2e/live/openclaw-admin-scope.ts` and `test/security/admin-approval-helper.test.ts` add exact-request admin approval behavior and stale-request tests. These changes do not impleme…	Remove the unrelated admin-approval behavior and tests from this pull request, or move them to a separate pull request.
Docstring Coverage	⚠️ Warning	Docstring coverage is 9.09% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 55 functions across 28 files. (1 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding Podman support for external images during onboarding.
Linked Issues check	✅ Passed	[`#12241`] requires digest-pinned OpenClaw and Hermes images through rootless Podman, with ambient credentials, immutable identity validation, rebuild support, explicit failure, and cleanup retention. T…

Full details: Out of Scope Changes check

Explanation

The changes to test/e2e/live/openclaw-admin-scope.ts and test/security/admin-approval-helper.test.ts add exact-request admin approval behavior and stale-request tests. These changes do not implement or validate the rootless Podman external-image requirements in [#12241].

Full details: Docstring Coverage

Explanation

Docstring coverage is 9.09% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 55 functions across 28 files. (1 skipped: 1 unsupported.)

Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-30T17:41:40Z

🌿 Preview your docs: https://nvidia-preview-pr-12538.docs.buildwithfern.com/nemoclaw

github-code-quality · 2026-09-30T17:42:05Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit f027143 in the codex/12241-podman-e... branch is 97%. The line coverage in commit 63002cd in the main branch is 96%.

Show a line coverage summary of the most impacted files.

File	`main` 63002cd	`codex/12241-podman-e...` f027143	+/-
`nemoclaw/src/onboard/config.ts`	98%	96%	-2%
`nemoclaw/src/index.ts`	94%	93%	-1%
`nemoclaw/src/bl...t-management.ts`	100%	100%	0%
`nemoclaw/src/co.../config-show.ts`	100%	100%	0%
`nemoclaw/src/commands/slash.ts`	100%	100%	0%
`nemoclaw/src/on...native-route.ts`	0%	100%	+100%

TypeScript / code-coverage/cli

The overall line coverage in commit f027143 in the codex/12241-podman-e... branch is 85%. The line coverage in commit 63002cd in the main branch is 84%.

Show a line coverage summary of the most impacted files.

File	`main` 63002cd	`codex/12241-podman-e...` f027143	+/-
`src/lib/state/s...tory-restore.ts`	86%	0%	-86%
`src/lib/actions.../status-text.ts`	84%	46%	-38%
`src/lib/state/sandbox.ts`	92%	83%	-9%
`src/lib/onboard...al-inference.ts`	84%	90%	+6%
`src/lib/policy/index.ts`	71%	80%	+9%
`src/lib/state/p...l-retirement.ts`	79%	92%	+13%
`src/lib/onboard.../application.ts`	55%	72%	+17%
`src/lib/adapter...gnostics-cli.ts`	0%	87%	+87%
`src/lib/onboard...ternal-image.ts`	0%	91%	+91%
`src/lib/securit...ig-structure.ts`	0%	98%	+98%

_{Updated October 07, 2026 08:20 UTC}

rsliter · 2026-09-30T19:25:55Z

CI status at `500932d1be7f323c69c85f3005ed70b2eae0c3da`

All candidate-owned validation is green: the 12 CLI shards and aggregate CLI tests, static checks, build/typecheck, plugin tests, installer integration, docs, CodeQL, and the rootless Podman CPU lifecycle passed.

The remaining red checks are unrelated upstream failures on unchanged inputs:

rootless-linux, the Pi amd64/arm64 image builds, and the staging Deep Agents base build fail because Debian advanced libssl3t64 to 3.5.7-1~deb13u3 while the unchanged base Dockerfiles pin libssl-dev=3.5.7-1~deb13u2.
PR npm audit and reviewed npm audit fail on advisories in unchanged lockfiles.
The aggregate checks job fails downstream of reviewed npm audit.
Exact managed runtime activation, including rootless Podman, is skipped because its image-build prerequisite failed.

The upstream repair is #12507. Its current candidate passes both affected npm audits, with the affected image-build jobs now running, but it has not merged to main yet. This PR remains unchanged. Once #12507 lands, main can be integrated and the exact activation E2E rerun.

deepujain

Reviewed 500932d1. No new code defect found in the provider-owned image preparation, exact-digest receipt handling, rebuild preflight, or shared-image cleanup changes. Local focused validation passed: 255 tests across 8 files, after building the plugin and compiling the catalog.

I took the upstream failures into account: the image-build log shows the Debian libssl package mismatch, and this PR changes neither the image build definitions nor the audited dependency manifests/lockfiles. I am not requesting unrelated dependency or base-image fixes in this PR.

Approval is pending validation of the new path. Accepted issue #12241 explicitly requires rootless Podman E2E evidence for published OpenClaw and Hermes digests. The Podman activation job was skipped, so the passing CPU lifecycle check does not establish that evidence. Once the upstream prerequisite is available, please run the activation coverage on the resulting PR commit and link its result, including external-image onboarding/readiness, identity checks, rebuild without a build, and image retention during cleanup.

The Advisor run also skipped its specialists; I could not verify completed Advisor findings for this commit. Please obtain that review evidence as well, or have the accountable maintainer explicitly disposition its deferral. This is a validation request, not a request for another code change.

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

…12538-refresh

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

rsliter · 2026-10-06T13:05:24Z

Advisor product-scope classification for 1a0aa29: false positive.

Issue #12241 already records the required accepted product decision under ## Product Decision: Accept, with the reason, placement, accountable maintainer (@rsliter), and validation plan. GitHub also reports that rsliter, the issue author and accountable maintainer, has write permission on NVIDIA/NemoClaw. The accepted decision therefore predates this implementation and authorizes the rootless Podman external-image surface. No scope expansion or product decision is needed.

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

rsliter · 2026-10-06T22:35:00Z

@coderabbitai review

coderabbitai · 2026-10-06T22:35:08Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

rsliter · 2026-10-06T23:00:01Z

Advisor E2E recommendation disposition for exact head e1bb72d: covered by the existing exact managed-image activation, so a second selector is not warranted.

Exact-head evidence:

Rootless Podman activation passed: https://github.com/NVIDIA/NemoClaw/actions/runs/37539543943/job/112533062330
Docker activation passed: https://github.com/NVIDIA/NemoClaw/actions/runs/37539543943/job/112533062345
The rootless job sets NEMOCLAW_GATEWAY_RUNTIME=podman and executes test/e2e/live/managed-image-activation-e2e.test.ts through target managed-image-activation.
The target adopts the public immutable candidate digests for OpenClaw and Hermes through --from-image on the selected runtime, forbids a local image build, waits for readiness, exercises an agent turn, verifies the durable external-image receipt and runtime content ID, rejects image identity drift before replacement, rebuilds with the recorded digest and verifies another agent turn, destroys the sandbox, and proves the shared external image remains retained.

This directly exercises the external-image boundary identified by the customer-value and operability specialists. Adding another selector would duplicate the same behavior logic and conflict with the repository guidance to keep behavior in the typed target and shared workflow planner. The Advisor recommendations should be resolved against the successful exact-head jobs above.

rsliter · 2026-10-06T23:21:31Z

@coderabbitai review

coderabbitai · 2026-10-06T23:21:40Z

⚠️ Action not completed

No files to review.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

rsliter · 2026-10-06T23:46:31Z

Advisor product-scope disposition for exact head 4d103098831b2ae239416a67e5a2f8667fd647cb: false positive.

Accepted issue #12241 records Accept plus the required reason, placement, accountable maintainer (@rsliter), and validation plan. GitHub reports the issue author rsliter with author_association: MEMBER, so this is a maintainer-accepted product decision. The merge-only refresh to 4d103098 adds no new product surface beyond the already reviewed candidate.

No source removal is warranted. Re-evaluate the product-scope finding against the accepted issue record and exact-head evidence.

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

rsliter · 2026-10-07T00:06:54Z

@coderabbitai review

coderabbitai · 2026-10-07T00:07:02Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

rsliter · 2026-10-07T02:16:32Z

Advisor E2E disposition for exact head f893745: false positive. The supported selector is the exact managed-image activation lane in .github/workflows/managed-images.yaml, which sets NEMOCLAW_GATEWAY_RUNTIME=podman and executes test/e2e/live/managed-image-activation-e2e.test.ts with public immutable OpenClaw and Hermes digests. The exact-head rootless Podman job passed: https://github.com/NVIDIA/NemoClaw/actions/runs/37556050403/job/112586113058. This live lane covers onboarding, readiness, agent turns, identity-drift rejection, rebuild/recreate behavior, destroy and cleanup, and external-image retention. No duplicate general E2E selector is warranted.

rsliter · 2026-10-07T06:05:24Z

Advisor exact-head disposition for b8b6fea9479801653b643d2ce4bb5d5ebcc1888f:

The customer-value product-scope P1 is a false positive. Accepted issue onboard: support downstream prebuilt sandbox images with rootless Podman #12241 records Accept, the reason, placement, accountable maintainer (@rsliter), and validation plan. GitHub reports rsliter as a repository MEMBER; the current implementation adds no surface beyond that accepted decision.
The migration-completion and verification-mistake-proofing selector recommendations are satisfied by the existing exact managed-image activation lane rather than a duplicate general E2E selector. The exact-head rootless Podman activation passed: https://github.com/NVIDIA/NemoClaw/actions/runs/37575738931/job/112648601955. It exercises public immutable OpenClaw and Hermes images through real Podman, including onboarding, readiness, agent turns, image identity and drift rejection, rebuild, destroy/cleanup, and external-image retention.

No source removal or additional selector is warranted. Please re-evaluate the Advisor gate against this accepted product decision and terminal exact-head activation evidence.

rsliter · 2026-10-07T08:08:17Z

@coderabbitai resume

coderabbitai · 2026-10-07T08:08:27Z

✅ Action performed

Reviews resumed and review finished.

github-actions · 2026-10-07T08:29:13Z

PR Review Advisor finished for commit f027143. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

Request review only when Require no Advisor blockers is green.

All previous runs

rsliter · 2026-10-07T12:48:06Z

Advisor disposition for latest PR commit f027143b97ea7ad005cabbf079e8b34586e4425d.

Product-scope finding

Advisor finding F-customer-value-behavior-5680f0812774ba442722 says rootless Podman external-image support lacks maintainer acceptance. This is a false positive.

Issue #12241 contains an explicit Accept decision. It records the reason, placement, accountable maintainer (@rsliter), and validation plan. GitHub reports that rsliter has the repository maintain role. This PR adds no product surface beyond that accepted decision.

E2E recommendation

The same specialist says no supplied selector covers public digest onboarding with rootless Podman. Advisor's trusted selector inventory contains only selectors from .github/workflows/e2e.yaml. It cannot name the specialized managed-image-activation selector in .github/workflows/managed-images.yaml.

That specialized test ran on this commit and passed:

Rootless Podman: https://github.com/NVIDIA/NemoClaw/actions/runs/37591568340/job/112700308222
Docker: https://github.com/NVIDIA/NemoClaw/actions/runs/37591568340/job/112700308402

The rootless Podman artifact verifies public digest-pinned OpenClaw and Hermes onboarding, readiness, runtime identity, identity-drift rejection, buildless rebuild with zero build commands, image retention, and cleanup.

Disposition

The Advisor finding and E2E recommendation are non-actionable review input. The PR already contains and ran the owning specialized E2E coverage. Do not add a duplicate general E2E selector or rerun unchanged jobs. The other eight Advisor specialists reported no findings.

kaofelix

The validation gap from the earlier review is now closed for f027143. I verified both activation artifacts: OpenClaw and Hermes onboard, rebuild, and retain their external images without local builds.

The Advisor scope finding requires no source change. Its gate remains red and needs resolution before merge.

Independent review found no new actionable defects. All 230 focused CLI tests passed.

## Outcome Managed-image admin approval now reaches its prepared shell when portable OpenClaw has the expected pending scope upgrade. The fixture uses the trusted OpenShell shell transport directly, so NemoClaw readiness cannot reject the intentionally unsettled request before approval. ## Reason PR #12538 added exact-request filtering but still opened the approval shell through `nemoclaw connect`. Portable readiness correctly rejects an unsettled admin request, so the rootless main workflow failed before the prepared approval ran. ### Related issues Refs #12538. ## Changes - Let the shared approval-script builder accept a shell-quoted connect command and a prepared-shell prelude. The managed-image fixture needs both to approve the pending request before product readiness. The default `nemoclaw connect` path remains unchanged for other consumers. - Run exact-request approval through OpenShell's interactive sandbox shell. This is the existing credential-prepared boundary, while `nemoclaw connect` cannot be its entry point during an intentionally pending approval. - Keep the exact-request filter inside the one-line prepared payload. Integration and E2E-support tests protect exact selection, stale-request exclusion, cleanup, redaction, and the single-line terminal boundary. The live contract remains in `test/e2e/live/managed-image-activation-e2e.test.ts`. Its real boundary is the OpenShell interactive shell with portable pairing pending. It proves that the captured admin request is approved and the downstream OpenClaw operation succeeds. Deterministic payload and selector behavior stays in `test/security/admin-approval-helper.test.ts` and `test/e2e/support/managed-image-activation-diagnostics.test.ts`. ## Verification - `npx vitest run --project integration test/security/admin-approval-helper.test.ts` — 31 tests passed. - `npx vitest run --project e2e-support test/e2e/support/managed-image-activation-diagnostics.test.ts` — 28 tests passed. - `npm run typecheck:cli` — passed. - `npm run validate:pr` — passed. - Normal commit and pre-push hooks — passed, including publication validation and CLI TypeScript checks. - Diff inspection confirmed that no secrets, API keys, or credentials are present. --- Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com> --------- Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com> Co-authored-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

feat(onboard): support external images with Podman

500932d

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

rsliter self-assigned this Sep 30, 2026

rsliter marked this pull request as ready for review September 30, 2026 19:25

deepujain reviewed Sep 30, 2026

View reviewed changes

rsliter and others added 5 commits October 1, 2026 06:02

merge: refresh main into Podman external-image support

30d378f

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

fix(onboard): complete Podman external image qualification

686e03a

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

Merge branch 'main' of https://github.com/NVIDIA/NemoClaw into codex/…

6198c82

…12538-refresh

Merge branch 'main' into codex/12241-podman-external-images

7601801

fix(ci): qualify Podman build guard changes

1a0aa29

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

rsliter added 6 commits October 6, 2026 06:16

fix(onboard): inspect absent Podman images directly

6d1c790

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

fix(onboard): detect remote Podman image absence

c785a45

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

fix(onboard): bound local Podman image inspection

02e7db4

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

Merge remote-tracking branch 'origin/main' into codex/12538-refresh

f5d0662

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

fix(onboard): use Podman image ID template field

bf16dbd

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

Merge remote-tracking branch 'origin/main' into codex/12538-refresh

9b1d286

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

rsliter closed this Oct 6, 2026

Merge remote-tracking branch 'origin/main' into codex/12538-refresh

3ec6128

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

rsliter added 2 commits October 6, 2026 14:26

Merge remote-tracking branch 'origin/main' into codex/12538-refresh

853a0a8

fix(ci): publish Podman input changes

e1bb72d

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

Merge branch 'main' into codex/12241-podman-external-images

4d10309

docs(changelog): include Podman image onboarding

5d509b3

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

Merge branch 'main' into codex/12241-podman-external-images

f893745

rsliter added 3 commits October 6, 2026 21:59

Merge branch 'main' into codex/12241-podman-external-images

b05b122

Merge branch 'main' into codex/12241-podman-external-images

0e80602

Merge branch 'main' into codex/12241-podman-external-images

b8b6fea

Merge branch 'main' into codex/12241-podman-external-images

f027143

kaofelix self-requested a review October 7, 2026 12:59

kaofelix approved these changes Oct 7, 2026

View reviewed changes

rsliter merged commit a358cec into main Oct 7, 2026
97 checks passed

rsliter deleted the codex/12241-podman-external-images branch October 7, 2026 14:26

github-actions Bot added the v0.0.132 label Oct 7, 2026

rsliter mentioned this pull request Oct 7, 2026

fix(e2e): approve admin scope before portable readiness #12760

Merged

Conversation

rsliter commented Sep 30, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Outcome

Reason

Related issues

Changes

Verification

Review notes

Summary by CodeRabbit

Uh oh!

copy-pr-bot Bot commented Sep 30, 2026

Uh oh!

coderabbitai Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (2 warnings)

Uh oh!

github-actions Bot commented Sep 30, 2026

Uh oh!

github-code-quality Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

rsliter commented Sep 30, 2026

CI status at 500932d1be7f323c69c85f3005ed70b2eae0c3da

Uh oh!

deepujain left a comment

Choose a reason for hiding this comment

Uh oh!

rsliter commented Oct 6, 2026

Uh oh!

rsliter commented Oct 6, 2026

Uh oh!

coderabbitai Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rsliter commented Oct 6, 2026

Uh oh!

rsliter commented Oct 6, 2026

Uh oh!

coderabbitai Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rsliter commented Oct 6, 2026

Uh oh!

rsliter commented Oct 7, 2026

Uh oh!

coderabbitai Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rsliter commented Oct 7, 2026

Uh oh!

rsliter commented Oct 7, 2026

Uh oh!

rsliter commented Oct 7, 2026

Uh oh!

coderabbitai Bot commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 7, 2026

Uh oh!

rsliter commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Product-scope finding

E2E recommendation

Disposition

Uh oh!

kaofelix left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

rsliter commented Sep 30, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Sep 30, 2026 •

edited

Loading

github-code-quality Bot commented Sep 30, 2026 •

edited

Loading

CI status at `500932d1be7f323c69c85f3005ed70b2eae0c3da`

coderabbitai Bot commented Oct 6, 2026 •

edited

Loading

coderabbitai Bot commented Oct 6, 2026 •

edited

Loading

coderabbitai Bot commented Oct 7, 2026 •

edited

Loading

coderabbitai Bot commented Oct 7, 2026 •

edited

Loading

rsliter commented Oct 7, 2026 •

edited

Loading