test(images): add protected multiarch build contract

[ericksoa]

Summary

• add a protected build harness that produces an exact immutable managed image contract for every shipped agent
• require independent amd64 and arm64 qualification inputs with digest-pinned per-agent base images
• validate agent, platform, base-image, output-digest, and local-content identity without publishing mutable aliases

Stack

PR3.14B1 in #7744. Stacked on #8065. This slice is test and qualification substrate only: it does not activate or advertise buildless support.

Validation

• focused contract tests: 5/5
• shellcheck and shfmt
• Biome format and lint
• CLI typecheck
• repository architecture checks
• commit and pre-push hooks

Closes no issue; contributes to #7744.

Signed-off-by: Aaron Erickson aerickson@nvidia.com

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a4bfa4f0-02e4-4d31-bc55-73c5b556e8f5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 5976d9d in the feat/buildless-prote... branch remains at 96%, unchanged from commit d5b64a7 in the feat/managed-image-p... branch.

Show a code coverage summary of the most impacted files.

File	feat/managed-image-p... d5b64a7	feat/buildless-prote... 5976d9d	+/-
nemoclaw/src/se...ntial-filter.ts	100%	0%	-100%
nemoclaw/src/sh...er-boundary.cts	95%	0%	-95%
nemoclaw/src/se...ot-sanitizer.ts	95%	0%	-95%
nemoclaw/src/co...test-fixture.ts	81%	0%	-81%
nemoclaw/src/co...ration-state.ts	93%	94%	+1%

TypeScript / code-coverage/cli

The overall coverage in commit 5976d9d in the feat/buildless-prote... branch is 80%. The coverage in commit d5b64a7 in the feat/managed-image-p... branch is 81%.

Show a code coverage summary of the most impacted files.

File	feat/managed-image-p... d5b64a7	feat/buildless-prote... 5976d9d	+/-
src/lib/onboard...trap/adapter.ts	0%	63%	+63%
src/lib/onboard...strap/docker.ts	0%	64%	+64%
src/lib/onboard...shared-state.ts	0%	68%	+68%
src/lib/onboard.../docker-spec.ts	0%	81%	+81%
src/lib/onboard...cker-journal.ts	0%	83%	+83%
src/lib/onboard...der/snapshot.ts	0%	83%	+83%
src/lib/onboard...one-rebinder.ts	0%	83%	+83%
src/lib/actions...ne-providers.ts	0%	86%	+86%
src/lib/onboard...rkload/clone.ts	0%	86%	+86%
src/lib/onboard...test-fixture.ts	0%	96%	+96%

---

_{Updated August 02, 2026 13:40 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: Review the warnings below.
Findings: 0 blockers · 1 warning · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 1 warning · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 3 warnings · 0 suggestions
• Model comparison: normalized findings differ; normalized terminology decisions differ; normalized E2E selections match; Nemotron reported the same number of blockers, 2 more warnings, the same number of suggestions.

3 terminology differences from the second opinion

Advisory only. These are normalized differences from the primary terminology receipt.

• capabilities at scripts/checks/build-protected-managed-images.sh:120: selected only by the second-opinion lane as established.
• startup-profile at scripts/checks/build-protected-managed-images.sh:119: selected only by the second-opinion lane as established.
• cohort at scripts/checks/build-protected-managed-images.sh:64: selected only by the second-opinion lane as justified.

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

3 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• define — protected managed-image at scripts/checks/protected-managed-image-contract.ts:34: Define protected managed-image where explanatory text first presents this build contract.
• established — immutable image at scripts/checks/protected-managed-image-contract.ts:116: Keep the established term for digest-identified images.
• established — content identity at scripts/checks/protected-managed-image-contract.ts:75: Keep the established term for the local image-ID evidence.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

1 warning · 0 suggestions

Warnings

Warnings do not block.

PRA-1 Warning — Add shell-level coverage for digest mismatch rejection

• Location: scripts/checks/build-protected-managed-images.sh:91
• Category: tests
• Problem: The new build harness has no direct test that exercises its raw-manifest digest checks or verifies that a failed check preserves the existing output receipt.
• Impact: A future change can bypass a base or output image byte-identity check, or replace a prior receipt after a failed build, without a focused regression test detecting it.
• Recommendation: Add a shell-level test with mocked docker, jq, and sha256sum commands. Cover a successful three-agent receipt and base/output raw-byte digest mismatches that exit without replacing the output file.
• Verification: Read the new shell test and confirm it invokes build-protected-managed-images.sh with mocked Docker metadata and inspect output for both mismatch paths.
• Test coverage: A shell-boundary test must mock a successful three-agent build, then make the inspected base bytes and output bytes differ from their stated digests and assert nonzero exit and preservation of a pre-existing output receipt.
• Evidence: scripts/checks/build-protected-managed-images.sh:91-101 compares the base manifest raw-byte SHA-256 with the supplied base digest. scripts/checks/build-protected-managed-images.sh:142-151 compares the output manifest raw-byte SHA-256 with the build digest. test/protected-managed-image-contract.test.ts:35-84 covers parser input validation but does not invoke the shell harness.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[apurvvkumaria]

Security and compliance review: technically approved; standalone merge deferred by #7744 sequencing.

Reviewed the current branch revision across the repository's nine security categories:

• Trust and authorization: inputs are limited to the three shipped agents, two supported platforms, bounded cohort/revision formats, and the approved NVIDIA image repositories.
• Input validation: base and output image identities must use immutable digest syntax, receipts require a strict field set, and duplicate or incomplete agent sets fail closed.
• Injection and command execution: arguments remain quoted, no dynamic evaluation is used, and command dependencies are checked before mutation.
• Secrets and sensitive output: no credential input, secret material, or sensitive logging is introduced.
• Filesystem safety: work occurs in a bounded temporary directory; cleanup is trapped; the requested receipt is replaced only after all three agent records validate.
• Concurrency and lifecycle safety: architecture-specific receipts are independent, and downstream evidence uses immutable image references rather than mutable tags.
• Error handling: shell strict mode and explicit identity checks stop on malformed metadata or byte-identity drift before publishing a receipt.
• Dependency and supply chain: no dependency changes; base and produced manifest bytes are checked against their declared digests, and the commit is verified in GitHub.
• Regression and documentation: all repository gates passed, including both architectures, managed startup for all three agents, CodeQL, advisors, all CLI shards, and protected E2E. The independent documentation writer returned no-docs-needed because this remains internal qualification substrate and does not activate or advertise support.

The advisor's shell-mock coverage note is non-blocking. The control flow preserves an existing receipt on every early failure, and the real architecture jobs exercise the successful production harness.

Merge sequencing remains intentionally blocked: #7744 requires this slice to remain a source record for a consolidated batch until incorporation evidence links the replacement. Do not merge or close this PR standalone.