managed-images.yaml

# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# Publish complete managed images from exact base-image contracts. Every
# agent/platform lane pushes and validates only an immutable digest. The
# aggregate publisher then proves that all three agents have both supported
# Linux architectures before it stages any cohort alias. Only after all staged
# aliases resolve to the exact validated manifests does the single OpenClaw
# cohort pointer move. Consumers use that pointer to discover the matching
# Hermes and Deep Agents Code cohort aliases, so a failed run cannot expose a
# mixed-agent or mixed-architecture cohort.

name: Images / Managed Images

on:
  workflow_call:
  pull_request:
    paths:
      - ".github/workflows/managed-images.yaml"
      - ".dockerignore"
      - "Dockerfile"
      - "agents/**"
      - "ci/npm-audit-exceptions.json"
      - "nemoclaw/**"
      - "nemoclaw-blueprint/**"
      - "scripts/**"
      - "src/lib/actions/sandbox/openshell-child-visible-credentials.v*.json"
      - "src/lib/core/json-types.ts"
      - "src/lib/core/ports.ts"
      - "src/lib/messaging/**"
      - "src/lib/onboard/**"
      - "src/lib/security/credential-hash.ts"
      - "src/lib/state/paths.ts"
      - "src/lib/state/state-root.ts"
      - "test/e2e/live/managed-image-activation-e2e*.ts"
      - "src/lib/tool-disclosure.ts"
      - "tools/mcp-tool-discovery-runtime/**"
      - "tsconfig.runtime-preloads.json"

permissions:
  contents: read
  packages: write

concurrency:
  group: managed-images-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  REGISTRY: ghcr.io

jobs:
  pr-staging-qa-deep-code:
    name: Staging QA base permission regression (Deep Agents Code)
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-22.04
    timeout-minutes: 90
    permissions:
      contents: read
    env:
      CANDIDATE_SHA: ${{ github.event.pull_request.head.sha }}
      # Retains the reviewed discovery-permission repair and the current
      # managed-image security inventory. The original staging source pinned
      # Expat 2.8.2, which cannot satisfy the candidate's 2.8.3 contract.
      STAGING_QA_SOURCE_SHA: 250d4abd2d602f864659c06d170699347b5d38bc
      STAGING_QA_BASE_IMAGE: nemoclaw-deepagents-code-base:staging-31396519688
      STAGING_QA_FINAL_IMAGE: nemoclaw-managed-pr/langchain-deepagents-code-staging-qa
    steps:
      - name: Checkout latest PR commit
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          path: candidate
          persist-credentials: false

      # Rebuild a security-compatible base from the exact source that retains
      # the reviewed discovery-permission repair.
      - name: Checkout exact staging QA base source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ env.STAGING_QA_SOURCE_SHA }}
          path: staging-qa-base-source
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22.19.0

      - name: Validate staging QA source
        shell: bash
        run: |
          set -euo pipefail
          source_root="$GITHUB_WORKSPACE/staging-qa-base-source"
          actual_source_sha="$(git -C "$source_root" rev-parse HEAD)"
          if [ "$actual_source_sha" != "$STAGING_QA_SOURCE_SHA" ]; then
            echo "ERROR: staging QA base source does not match the recorded NemoClaw commit." >&2
            exit 1
          fi
          printf '### Staging QA Deep Agents Code base\n\n'
          printf 'NemoClaw source commit: %s\n' "$STAGING_QA_SOURCE_SHA"
          {
            printf '### Staging QA Deep Agents Code base\n\n'
            printf 'NemoClaw source commit: %s\n' "$STAGING_QA_SOURCE_SHA"
          } >> "$GITHUB_STEP_SUMMARY"

      # NemoPatch exact Deep Agents candidate-base boundary.
      # Preserve the recorded staging tree and replace only the dependency inputs
      # that the candidate base image owns.
      - name: Overlay exact PR dependency inputs on staging QA base
        shell: bash
        run: |
          set -euo pipefail
          candidate_root="$GITHUB_WORKSPACE/candidate"
          staging_root="$GITHUB_WORKSPACE/staging-qa-base-source"
          for relative in \
            agents/langchain-deepagents-code/Dockerfile.base \
            agents/langchain-deepagents-code/requirements.lock
          do
            source_file="$candidate_root/$relative"
            destination_file="$staging_root/$relative"
            if [ ! -f "$source_file" ] || [ -L "$source_file" ] || [ ! -f "$destination_file" ] || [ -L "$destination_file" ]; then
              echo "ERROR: staging QA dependency input is missing, unsafe, or changed shape: $relative" >&2
              exit 1
            fi
            install -m 0644 "$source_file" "$destination_file"
          done
          printf '\nCandidate dependency inputs: %s\n' "$CANDIDATE_SHA" >> "$GITHUB_STEP_SUMMARY"

      - name: Reproduce staging discovery permission drift
        shell: bash
        working-directory: candidate
        run: |
          set -euo pipefail
          reviewed_root="tools/mcp-tool-discovery-runtime/reviewed-runtime-bundle/mcp-tool-discovery"
          for artifact in \
            BUNDLED_PACKAGES.json \
            THIRD_PARTY_LICENSES.txt \
            mcp-tool-discovery.bundle
          do
            artifact_path="${reviewed_root}/${artifact}"
            if [ ! -f "$artifact_path" ] || [ -L "$artifact_path" ]; then
              echo "ERROR: reviewed discovery permission fixture must be a regular non-symlink: ${artifact_path}" >&2
              exit 1
            fi
            chmod 0664 "$artifact_path"
          done

      - name: Rebuild staging QA Deep Agents Code base from exact source
        id: staging-base
        shell: bash
        env:
          DOCKER_BUILDKIT: "1"
        run: |
          set -euo pipefail
          source_root="$GITHUB_WORKSPACE/staging-qa-base-source"
          docker build --progress=plain \
            -f "$source_root/agents/langchain-deepagents-code/Dockerfile.base" \
            -t "$STAGING_QA_BASE_IMAGE" \
            "$source_root"
          base_id="$(docker image inspect --format "{{.Id}}" "$STAGING_QA_BASE_IMAGE")"
          if [[ ! "$base_id" =~ ^sha256:[0-9a-f]{64}$ ]]; then
            echo "ERROR: rebuilt staging QA base did not resolve to an immutable local image ID." >&2
            exit 1
          fi
          printf 'id=%s\n' "$base_id" >> "$GITHUB_OUTPUT"
          printf '\nRebuilt local image: %s\n' "$base_id" >> "$GITHUB_STEP_SUMMARY"

      - name: Build latest PR commit against reproduced staging QA base
        id: staging-final
        shell: bash
        working-directory: candidate
        env:
          DOCKER_BUILDKIT: "1"
        run: |
          set -euo pipefail
          final_reference="${STAGING_QA_FINAL_IMAGE}:${CANDIDATE_SHA}"
          docker build --progress=plain \
            -f agents/langchain-deepagents-code/Dockerfile \
            --build-arg BASE_IMAGE="$STAGING_QA_BASE_IMAGE" \
            --build-arg NEMOCLAW_MODEL=nvidia/nemotron-3-ultra-550b-a55b \
            --build-arg NEMOCLAW_INFERENCE_PROVIDER_ID=inference \
            --build-arg NEMOCLAW_UPSTREAM_PROVIDER=nvidia-nim \
            --build-arg NEMOCLAW_INFERENCE_BASE_URL=https://inference.local/v1 \
            --build-arg NEMOCLAW_INFERENCE_API=openai-completions \
            --build-arg NEMOCLAW_DCODE_AUTO_APPROVAL=thread-opt-in \
            --build-arg NEMOCLAW_BUILD_ID="$STAGING_QA_SOURCE_SHA" \
            --build-arg NEMOCLAW_DARWIN_VM_COMPAT=0 \
            -t "$final_reference" \
            .
          final_id="$(docker image inspect --format "{{.Id}}" "$final_reference")"
          if [[ ! "$final_id" =~ ^sha256:[0-9a-f]{64}$ ]]; then
            echo "ERROR: staging QA final image did not resolve to an immutable local image ID." >&2
            exit 1
          fi
          printf 'id=%s\n' "$final_id" >> "$GITHUB_OUTPUT"

      - name: Validate staging QA final image contract
        shell: bash
        env:
          BASE_ID: ${{ steps.staging-base.outputs.id }}
          FINAL_ID: ${{ steps.staging-final.outputs.id }}
        run: |
          set -euo pipefail
          base_layers="$(docker image inspect --format "{{json .RootFS.Layers}}" "$BASE_ID")"
          final_layers="$(docker image inspect --format "{{json .RootFS.Layers}}" "$FINAL_ID")"
          if ! jq -n -e \
            --argjson base "$base_layers" \
            --argjson final "$final_layers" '
              ($base | length) > 0 and
              ($final | length) >= ($base | length) and
              all(range(0; $base | length); $final[.] == $base[.])
            ' >/dev/null; then
            echo "ERROR: staging QA final image does not extend the rebuilt QA base." >&2
            exit 1
          fi
          if ! actual_discovery_contract="$(
            docker run --rm --platform linux/amd64 --entrypoint /bin/sh "$FINAL_ID" -c '
            set -eu
            discovery_runtime=/usr/local/lib/nemoclaw/mcp-tool-discovery-runtime
            if ! entry_owner_unsafe="$(find -P "$discovery_runtime" ! -user root -print -quit)"; then
              echo "ERROR: staging QA discovery entry ownership inspection failed." >&2
              exit 1
            fi
            if [ -n "$entry_owner_unsafe" ]; then
              echo "ERROR: staging QA discovery entry is not root-owned: $entry_owner_unsafe" >&2
              exit 1
            fi
            if ! owner_or_write_unsafe="$(
              find -L "$discovery_runtime" \
                \( ! -user root -o -perm /022 \) -print -quit
            )"; then
              echo "ERROR: staging QA discovery tree inspection failed." >&2
              exit 1
            fi
            if [ -n "$owner_or_write_unsafe" ]; then
              echo "ERROR: staging QA discovery tree is not root-owned and read-only: $owner_or_write_unsafe" >&2
              exit 1
            fi
            if ! mode_unsafe="$(
              find -P "$discovery_runtime" \
                \( \( -type d ! -perm 0555 \) -o \( -type f ! -perm 0444 \) \) \
                -print -quit
            )"; then
              echo "ERROR: staging QA discovery mode inspection failed." >&2
              exit 1
            fi
            if [ -n "$mode_unsafe" ]; then
              echo "ERROR: staging QA discovery path has an unexpected mode: $mode_unsafe" >&2
              exit 1
            fi
            if ! actual_discovery_contract="$(node "$discovery_runtime/mcp-tool-discovery.mjs")"; then
              echo "ERROR: staging QA discovery bundle execution failed." >&2
              exit 1
            fi
            printf "%s" "$actual_discovery_contract"
          '
          )"; then
            echo "ERROR: staging QA final image discovery contract probe failed." >&2
            exit 1
          fi
          if ! node -e '
            const expected = {
              protocol: 1,
              ok: false,
              detail: "tool discovery received invalid runtime arguments",
            };
            let result;
            try {
              result = JSON.parse(require("node:fs").readFileSync(0, "utf8"));
            } catch {
              process.exit(1);
            }
            const record =
              result !== null && typeof result === "object" && !Array.isArray(result)
                ? result
                : undefined;
            if (
              !record ||
              record.protocol !== expected.protocol ||
              record.ok !== expected.ok ||
              record.detail !== expected.detail
            ) {
              process.exit(1);
            }
          ' <<< "$actual_discovery_contract" >/dev/null; then
            echo "ERROR: staging QA discovery bundle contract mismatch." >&2
            exit 1
          fi

  pr-build-and-entrypoint:
    name: PR build and direct managed startup (${{ matrix.display_name }})
    # External contributor PRs retain the local build/direct-startup lane after
    # GitHub's maintainer workflow approval. Exact digest publication is limited
    # to branches in NVIDIA/NemoClaw; fork jobs never log in or push.
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
    timeout-minutes: 90
    permissions:
      contents: read
      packages: write
    env:
      CANDIDATE_SHA: ${{ github.event.pull_request.head.sha }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - agent: openclaw
            display_name: OpenClaw
            dockerfile: Dockerfile
            base_alias: ghcr.io/nvidia/nemoclaw/sandbox-base:latest
            base_repository: ghcr.io/nvidia/nemoclaw/sandbox-base
            image: nemoclaw-managed-pr/openclaw
            repository: ghcr.io/nvidia/nemoclaw/openclaw-sandbox
          - agent: hermes
            display_name: Hermes
            dockerfile: agents/hermes/Dockerfile
            base_alias: ghcr.io/nvidia/nemoclaw/hermes-sandbox-base:latest
            base_repository: ghcr.io/nvidia/nemoclaw/hermes-sandbox-base
            image: nemoclaw-managed-pr/hermes
            repository: ghcr.io/nvidia/nemoclaw/hermes-sandbox
          - agent: langchain-deepagents-code
            display_name: Deep Agents Code
            dockerfile: agents/langchain-deepagents-code/Dockerfile
            base_alias: ghcr.io/nvidia/nemoclaw/langchain-deepagents-code-sandbox-base:latest
            base_repository: ghcr.io/nvidia/nemoclaw/langchain-deepagents-code-sandbox-base
            image: nemoclaw-managed-pr/langchain-deepagents-code
            repository: ghcr.io/nvidia/nemoclaw/langchain-deepagents-code-sandbox
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - name: Reproduce reviewed discovery permission drift
        shell: bash
        run: |
          set -euo pipefail
          reviewed_root="tools/mcp-tool-discovery-runtime/reviewed-runtime-bundle/mcp-tool-discovery"
          for artifact in \
            BUNDLED_PACKAGES.json \
            THIRD_PARTY_LICENSES.txt \
            mcp-tool-discovery.bundle
          do
            artifact_path="${reviewed_root}/${artifact}"
            if [ ! -f "$artifact_path" ] || [ -L "$artifact_path" ]; then
              echo "ERROR: reviewed discovery permission fixture must be a regular non-symlink: ${artifact_path}" >&2
              exit 1
            fi
            chmod 0664 "$artifact_path"
          done

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22.19.0

      - name: Validate exact Deep Agents PR base build args
        if: matrix.agent == 'langchain-deepagents-code'
        shell: bash
        run: scripts/check-production-build-args.sh -f agents/langchain-deepagents-code/Dockerfile.base

      - name: Log in to GHCR for exact same-repository PR digest
        if: github.event.pull_request.head.repo.full_name == github.repository
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish exact Deep Agents PR base by digest
        id: candidate-base-build
        if: matrix.agent == 'langchain-deepagents-code' && github.event.pull_request.head.repo.full_name == github.repository
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: agents/langchain-deepagents-code/Dockerfile.base
          platforms: linux/amd64
          outputs: type=image,name=${{ matrix.base_repository }},push-by-digest=true,name-canonical=true,push=true
          cache-from: type=registry,ref=${{ matrix.base_repository }}:buildcache-linux-amd64
          provenance: false
          sbom: false

      - name: Bind exact Deep Agents PR base
        id: candidate-base
        if: matrix.agent == 'langchain-deepagents-code' && github.event.pull_request.head.repo.full_name == github.repository
        shell: bash
        env:
          BASE_REPOSITORY: ${{ matrix.base_repository }}
          DIGEST: ${{ steps.candidate-base-build.outputs.digest }}
        run: |
          set -euo pipefail
          if [[ ! "$DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then
            echo "ERROR: exact Deep Agents PR base build returned an invalid digest." >&2
            exit 1
          fi
          reference="${BASE_REPOSITORY}@${DIGEST}"
          raw="$RUNNER_TEMP/deep-agents-pr-base.raw"
          docker buildx imagetools inspect "$reference" --raw > "$raw"
          actual="sha256:$(sha256sum "$raw" | awk '{print $1}')"
          if [ "$actual" != "$DIGEST" ]; then
            echo "ERROR: exact Deep Agents PR base bytes do not match the build digest." >&2
            exit 1
          fi
          printf 'ref=%s\n' "$reference" >> "$GITHUB_OUTPUT"
          printf '### Deep Agents exact PR base\n\n`%s`\n' "$reference" >> "$GITHUB_STEP_SUMMARY"

      - name: Build exact Deep Agents fork PR base locally
        id: candidate-base-local-build
        if: matrix.agent == 'langchain-deepagents-code' && github.event.pull_request.head.repo.full_name != github.repository
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: agents/langchain-deepagents-code/Dockerfile.base
          platforms: linux/amd64
          load: true
          push: false
          tags: nemoclaw-pr-base/${{ matrix.agent }}:${{ github.event.pull_request.head.sha }}
          cache-from: type=registry,ref=${{ matrix.base_repository }}:buildcache-linux-amd64
          provenance: false
          sbom: false

      - name: Bind exact Deep Agents fork PR base
        id: candidate-base-local
        if: matrix.agent == 'langchain-deepagents-code' && github.event.pull_request.head.repo.full_name != github.repository
        shell: bash
        env:
          REFERENCE: nemoclaw-pr-base/${{ matrix.agent }}:${{ github.event.pull_request.head.sha }}
        run: |
          set -euo pipefail
          image_id="$(docker image inspect --format '{{.Id}}' "$REFERENCE")"
          if [[ ! "$image_id" =~ ^sha256:[0-9a-f]{64}$ ]]; then
            echo "ERROR: exact Deep Agents fork PR base did not resolve to an immutable local image ID." >&2
            exit 1
          fi
          printf 'ref=%s\n' "$REFERENCE" >> "$GITHUB_OUTPUT"
          printf '### Deep Agents exact fork PR base\n\n`%s` (`%s`)\n' "$REFERENCE" "$image_id" >> "$GITHUB_STEP_SUMMARY"

      - name: Resolve exact linux/amd64 PR base
        if: matrix.agent != 'langchain-deepagents-code'
        id: base
        shell: bash
        env:
          BASE_ALIAS: ${{ matrix.base_alias }}
          BASE_REPOSITORY: ${{ matrix.base_repository }}
          DISPLAY_NAME: ${{ matrix.display_name }}
        run: |
          set -euo pipefail
          alias_raw="$RUNNER_TEMP/pr-base-alias.raw"
          exact_raw="$RUNNER_TEMP/pr-base-exact.raw"
          docker buildx imagetools inspect "$BASE_ALIAS" --raw > "$alias_raw"
          if ! digest="$(
            jq -er '
              if (
                .mediaType == "application/vnd.oci.image.index.v1+json" or
                .mediaType == "application/vnd.docker.distribution.manifest.list.v2+json"
              ) then
                [
                  .manifests[]
                  | select(
                      .platform.os == "linux" and
                      .platform.architecture == "amd64"
                    )
                ]
                | if length == 1 then .[0].digest else error("not one linux/amd64 image") end
              else
                error("base alias is not a platform index")
              end
            ' "$alias_raw"
          )"; then
            echo "ERROR: PR base alias does not contain exactly one linux/amd64 image." >&2
            exit 1
          fi
          if [[ ! "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]; then
            echo "ERROR: PR base alias returned an invalid linux/amd64 digest." >&2
            exit 1
          fi
          reference="${BASE_REPOSITORY}@${digest}"
          docker buildx imagetools inspect "$reference" --raw > "$exact_raw"
          actual="sha256:$(sha256sum "$exact_raw" | awk '{print $1}')"
          if [ "$actual" != "$digest" ]; then
            echo "ERROR: exact PR base bytes do not match the selected descriptor digest." >&2
            exit 1
          fi
          printf 'ref=%s\n' "$reference" >> "$GITHUB_OUTPUT"
          printf '### %s PR base\n\n`%s`\n' "$DISPLAY_NAME" "$reference" \
            >> "$GITHUB_STEP_SUMMARY"

      - name: Validate PR managed-image build args
        shell: bash
        env:
          BASE_REFERENCE: ${{ steps.candidate-base.outputs.ref || steps.candidate-base-local.outputs.ref || steps.base.outputs.ref }}
          DOCKERFILE: ${{ matrix.dockerfile }}
        run: |
          set -euo pipefail
          scripts/check-production-build-args.sh \
            -f "$DOCKERFILE" \
            --build-arg "BASE_IMAGE=${BASE_REFERENCE}" \
            --build-arg "NEMOCLAW_MANAGED_IMAGE_CAPABILITY_UNION=1" \
            --build-arg "NEMOCLAW_MANAGED_IMAGE_RUNTIME_USER=root"

      - name: Build PR managed image locally
        if: matrix.agent != 'langchain-deepagents-code' || github.event.pull_request.head.repo.full_name == github.repository
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          platforms: linux/amd64
          load: true
          push: false
          tags: ${{ matrix.image }}:${{ github.event.pull_request.head.sha }}
          labels: |
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.event.pull_request.head.sha }}
            io.nvidia.nemoclaw.agent=${{ matrix.agent }}
            io.nvidia.nemoclaw.managed-image.contract=1
            io.nvidia.nemoclaw.managed-image.platform=linux/amd64
            io.nvidia.nemoclaw.managed-image.startup-profile=1
            io.nvidia.nemoclaw.managed-image.capabilities=1
            io.nvidia.nemoclaw.managed-image.cohort=ghrun-${{ github.run_id }}-${{ github.run_attempt }}
          build-args: |
            BASE_IMAGE=${{ steps.candidate-base.outputs.ref || steps.candidate-base-local.outputs.ref || steps.base.outputs.ref }}
            NEMOCLAW_MANAGED_IMAGE_CAPABILITY_UNION=1
            NEMOCLAW_MANAGED_IMAGE_RUNTIME_USER=root
          cache-from: type=registry,ref=ghcr.io/nvidia/nemoclaw/${{ matrix.agent }}-sandbox:buildcache-linux-amd64
          provenance: false
          sbom: false

      - name: Build fork PR managed image locally from exact Deep Agents base
        if: matrix.agent == 'langchain-deepagents-code' && github.event.pull_request.head.repo.full_name != github.repository
        shell: bash
        env:
          AGENT: ${{ matrix.agent }}
          BASE_REFERENCE: ${{ steps.candidate-base-local.outputs.ref }}
          COHORT: ghrun-${{ github.run_id }}-${{ github.run_attempt }}
          DOCKERFILE: ${{ matrix.dockerfile }}
          IMAGE_REFERENCE: ${{ matrix.image }}:${{ github.event.pull_request.head.sha }}
          REVISION: ${{ github.event.pull_request.head.sha }}
        run: |
          set -euo pipefail
          docker buildx build --builder default --load \
            --platform linux/amd64 \
            --file "$DOCKERFILE" \
            --tag "$IMAGE_REFERENCE" \
            --label "org.opencontainers.image.source=https://github.com/${{ github.repository }}" \
            --label "org.opencontainers.image.revision=$REVISION" \
            --label "io.nvidia.nemoclaw.agent=$AGENT" \
            --label "io.nvidia.nemoclaw.managed-image.contract=1" \
            --label "io.nvidia.nemoclaw.managed-image.platform=linux/amd64" \
            --label "io.nvidia.nemoclaw.managed-image.startup-profile=1" \
            --label "io.nvidia.nemoclaw.managed-image.capabilities=1" \
            --label "io.nvidia.nemoclaw.managed-image.cohort=$COHORT" \
            --build-arg "BASE_IMAGE=$BASE_REFERENCE" \
            --build-arg "NEMOCLAW_MANAGED_IMAGE_CAPABILITY_UNION=1" \
            --build-arg "NEMOCLAW_MANAGED_IMAGE_RUNTIME_USER=root" \
            .

      - name: Validate exact PR managed image contract
        id: contract
        shell: bash
        env:
          AGENT: ${{ matrix.agent }}
          IMAGE_REFERENCE: ${{ matrix.image }}:${{ github.event.pull_request.head.sha }}
          PLATFORM: linux/amd64
          PUBLICATION_COHORT: ghrun-${{ github.run_id }}-${{ github.run_attempt }}
        run: |
          set -euo pipefail
          image_json="$(docker image inspect "$IMAGE_REFERENCE")"
          image_id="$(
            jq -er '
              if length == 1 and (.[0].Id | type) == "string"
              then .[0].Id
              else error("expected one local image identity")
              end
            ' <<< "$image_json"
          )"
          if [[ ! "$image_id" =~ ^sha256:[0-9a-f]{64}$ ]]; then
            echo "ERROR: PR managed image did not resolve to an immutable local image ID: $image_id" >&2
            exit 1
          fi
          if [ "$(docker image inspect --format '{{.Id}}' "$image_id")" != "$image_id" ]; then
            echo "ERROR: PR managed image ID did not resolve to itself." >&2
            exit 1
          fi

          if [[ ! "$PUBLICATION_COHORT" =~ ^ghrun-[1-9][0-9]{0,19}-[1-9][0-9]{0,9}$ ]] ||
             ! jq -e \
               --arg agent "$AGENT" \
               --arg cohort "$PUBLICATION_COHORT" \
               --arg image_id "$image_id" \
               --arg platform "$PLATFORM" \
               --arg revision "$CANDIDATE_SHA" '
                 length == 1 and
                 .[0].Id == $image_id and
                 ((.[0].Config.User // "") as $user |
                   $user == "" or $user == "root" or $user == "0") and
                 .[0].Config.Labels["io.nvidia.nemoclaw.agent"] == $agent and
                 .[0].Config.Labels["io.nvidia.nemoclaw.managed-image.contract"] == "1" and
                 .[0].Config.Labels["io.nvidia.nemoclaw.managed-image.platform"] == $platform and
                 .[0].Config.Labels["io.nvidia.nemoclaw.managed-image.startup-profile"] == "1" and
                 .[0].Config.Labels["io.nvidia.nemoclaw.managed-image.capabilities"] == "1" and
                 .[0].Config.Labels["io.nvidia.nemoclaw.managed-image.cohort"] == $cohort and
                 .[0].Config.Labels["org.opencontainers.image.revision"] == $revision
               ' <<< "$image_json" >/dev/null; then
            echo "ERROR: PR managed image contract does not match the exact build identity." >&2
            exit 1
          fi

          discovery_runtime="/usr/local/lib/nemoclaw/mcp-tool-discovery-runtime"
          if ! actual_discovery_contract="$(
            docker run --rm --platform "$PLATFORM" --entrypoint /bin/sh "$image_id" -c '
              set -eu
              discovery_runtime="$1"
              if ! entry_owner_unsafe="$(
                find -P "$discovery_runtime" ! -user root -print -quit
              )"; then
                echo "ERROR: final PR managed image discovery entry ownership inspection failed." >&2
                exit 1
              fi
              if [ -n "$entry_owner_unsafe" ]; then
                echo "ERROR: final PR managed image discovery entry is not root-owned: $entry_owner_unsafe" >&2
                exit 1
              fi
              if ! owner_or_write_unsafe="$(
                find -L "$discovery_runtime" \
                  \( ! -user root -o -perm /022 \) -print -quit
              )"; then
                echo "ERROR: final PR managed image discovery tree inspection failed." >&2
                exit 1
              fi
              if [ -n "$owner_or_write_unsafe" ]; then
                echo "ERROR: final PR managed image discovery tree is not root-owned and read-only: $owner_or_write_unsafe" >&2
                exit 1
              fi
              if ! mode_unsafe="$(
                find -P "$discovery_runtime" \
                  \( \( -type d ! -perm 0555 \) -o \( -type f ! -perm 0444 \) \) \
                  -print -quit
              )"; then
                echo "ERROR: final PR managed image discovery mode inspection failed." >&2
                exit 1
              fi
              if [ -n "$mode_unsafe" ]; then
                echo "ERROR: final PR managed image discovery path has an unexpected mode: $mode_unsafe" >&2
                exit 1
              fi
              node "$discovery_runtime/mcp-tool-discovery.mjs"
            ' -- "$discovery_runtime"
          )"; then
            echo "ERROR: final PR managed image discovery contract probe failed." >&2
            exit 1
          fi
          if ! node -e '
            const expected = {
              protocol: 1,
              ok: false,
              detail: "tool discovery received invalid runtime arguments",
            };
            let result;
            try {
              result = JSON.parse(require("node:fs").readFileSync(0, "utf8"));
            } catch {
              process.exit(1);
            }
            const record =
              result !== null && typeof result === "object" && !Array.isArray(result)
                ? result
                : undefined;
            if (
              !record ||
              record.protocol !== expected.protocol ||
              record.ok !== expected.ok ||
              record.detail !== expected.detail
            ) {
              process.exit(1);
            }
          ' <<< "$actual_discovery_contract" >/dev/null; then
            echo "ERROR: final PR managed image discovery bundle contract mismatch." >&2
            exit 1
          fi

          printf 'reference=%s\n' "$image_id" >> "$GITHUB_OUTPUT"
          printf '### %s exact PR managed image\n\n`%s`\n' "$AGENT" "$image_id" \
            >> "$GITHUB_STEP_SUMMARY"

      - name: Install managed-image direct harness dependencies
        run: |
          npm ci --ignore-scripts
          npm run build:policy-boundary

      - name: Exercise managed startup root stdin and hold
        shell: bash
        env:
          AGENT: ${{ matrix.agent }}
          IMAGE_REFERENCE: ${{ steps.contract.outputs.reference }}
        run: |
          set -euo pipefail
          npx --no-install tsx \
            scripts/checks/run-managed-image-direct-e2e.ts \
            --agent "$AGENT" \
            --image "$IMAGE_REFERENCE" \
            --platform linux/amd64

      # Publish by digest only. No candidate tag, cohort tag, or release alias is
      # created, so this proof cannot expose an incomplete all-agent cohort.
      - name: Publish exact same-repository PR managed image by digest
        id: publish
        if: github.event.pull_request.head.repo.full_name == github.repository
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          platforms: linux/amd64
          outputs: type=image,name=${{ matrix.repository }},push-by-digest=true,name-canonical=true,push=true
          labels: |
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.event.pull_request.head.sha }}
            io.nvidia.nemoclaw.agent=${{ matrix.agent }}
            io.nvidia.nemoclaw.managed-image.contract=1
            io.nvidia.nemoclaw.managed-image.platform=linux/amd64
            io.nvidia.nemoclaw.managed-image.startup-profile=1
            io.nvidia.nemoclaw.managed-image.capabilities=1
            io.nvidia.nemoclaw.managed-image.cohort=ghrun-${{ github.run_id }}-${{ github.run_attempt }}
          build-args: |
            BASE_IMAGE=${{ steps.candidate-base.outputs.ref || steps.candidate-base-local.outputs.ref || steps.base.outputs.ref }}
            NEMOCLAW_MANAGED_IMAGE_CAPABILITY_UNION=1
            NEMOCLAW_MANAGED_IMAGE_RUNTIME_USER=root
          cache-from: type=registry,ref=ghcr.io/nvidia/nemoclaw/${{ matrix.agent }}-sandbox:buildcache-linux-amd64
          provenance: false
          sbom: false

      - name: Remove PR publication credentials
        if: always() && github.event.pull_request.head.repo.full_name == github.repository
        shell: bash
        run: docker logout ghcr.io

      - name: Export exact published PR managed-image contract
        if: github.event.pull_request.head.repo.full_name == github.repository
        shell: bash
        env:
          AGENT: ${{ matrix.agent }}
          COHORT: ghrun-${{ github.run_id }}-${{ github.run_attempt }}
          DIGEST: ${{ steps.publish.outputs.digest }}
          IMAGE: ${{ matrix.repository }}
        run: |
          set -euo pipefail
          [[ "$CANDIDATE_SHA" =~ ^[a-f0-9]{40}$ ]] || {
            echo "ERROR: exact PR head SHA is invalid" >&2
            exit 1
          }
          [[ "$DIGEST" =~ ^sha256:[a-f0-9]{64}$ ]] || {
            echo "ERROR: PR publication did not return an immutable digest" >&2
            exit 1
          }
          reference="${IMAGE}@${DIGEST}"
          raw="$RUNNER_TEMP/${AGENT}-published-manifest.raw"
          docker buildx imagetools inspect "$reference" --raw > "$raw"
          [[ "sha256:$(sha256sum "$raw" | awk '{print $1}')" == "$DIGEST" ]] || {
            echo "ERROR: published PR manifest bytes do not match the build digest" >&2
            exit 1
          }
          anonymous_config="$(mktemp -d "$RUNNER_TEMP/managed-pr-anonymous.XXXXXX")"
          trap 'rm -rf -- "$anonymous_config"' EXIT
          DOCKER_CONFIG="$anonymous_config" docker pull --platform linux/amd64 "$reference"
          release="v$(node -p 'require("./package.json").version')"
          contract_dir="$RUNNER_TEMP/managed-pr-contract"
          mkdir -p "$contract_dir"
          jq -n \
            --arg agent "$AGENT" \
            --arg cohort "$COHORT" \
            --arg digest "$DIGEST" \
            --arg image "$IMAGE" \
            --arg reference "$reference" \
            --arg release "$release" \
            --arg revision "$CANDIDATE_SHA" \
            '{
              contractVersion: 1,
              agent: $agent,
              platform: "linux/amd64",
              image: $image,
              digest: $digest,
              reference: $reference,
              source: {
                repository: "NVIDIA/NemoClaw",
                revision: $revision,
                release: $release,
                cohort: $cohort
              },
              startupProfileContractVersion: 1,
              capabilityContractVersion: 1
            }' > "$contract_dir/contract.json"

      - name: Upload exact published PR managed-image contract
        if: github.event.pull_request.head.repo.full_name == github.repository
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: managed-pr-contract-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.agent }}
          path: ${{ runner.temp }}/managed-pr-contract/contract.json
          if-no-files-found: error
          retention-days: 1

  pr-managed-activation:
    name: PR exact all-agent managed runtime activation
    needs: pr-build-and-entrypoint
    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-24.04
    timeout-minutes: 90
    permissions:
      contents: read
    env:
      CANDIDATE_SHA: ${{ github.event.pull_request.head.sha }}
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/managed-image-activation
      E2E_JOB: "1"
      E2E_TARGET_ID: managed-image-activation
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_MANAGED_ACTIVATION_CATALOG: ${{ github.workspace }}/managed-pr-catalog.json
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_RUN_LIVE_E2E: "1"
      OPENSHELL_GATEWAY: nemoclaw
    steps:
      - name: Checkout exact PR head
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22.19.0

      - name: Download exact published all-agent contracts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: managed-pr-contract-${{ github.run_id }}-${{ github.run_attempt }}-*
          path: ${{ runner.temp }}/managed-pr-contracts
          merge-multiple: false

      - name: Assemble exact all-agent activation catalog
        shell: bash
        run: |
          set -euo pipefail
          mapfile -d '' contracts < <(
            find "$RUNNER_TEMP/managed-pr-contracts" -type f -name contract.json -print0
          )
          [[ "${#contracts[@]}" -eq 3 ]] || {
            echo "ERROR: exact all-agent activation requires three contracts" >&2
            exit 1
          }
          jq -se \
            --arg revision "$CANDIDATE_SHA" '
              if (
                length == 3 and
                ([.[].agent] | sort) == ["hermes", "langchain-deepagents-code", "openclaw"] and
                ([.[].source.revision] | unique) == [$revision] and
                ([.[].source.cohort] | unique | length) == 1 and
                ([.[].platform] | unique) == ["linux/amd64"]
              )
              then map({key: .agent, value: .}) | from_entries
              else error("published PR contracts do not form one exact all-agent cohort")
              end
            ' "${contracts[@]}" > "$NEMOCLAW_MANAGED_ACTIVATION_CATALOG"

      - name: Build exact candidate CLI
        run: |
          npm ci --ignore-scripts
          npm run build:cli

      - name: Install OpenShell CLI
        shell: bash
        run: env -u GITHUB_TOKEN bash scripts/install-openshell.sh

      - name: Run real all-agent managed runtime activation
        shell: bash
        run: |
          set -euo pipefail
          [[ "$(git rev-parse --verify HEAD)" == "$CANDIDATE_SHA" ]] || {
            echo "ERROR: managed activation checkout does not match the exact PR head" >&2
            exit 1
          }
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          export OPENSHELL_BIN="$(command -v openshell)"
          "$OPENSHELL_BIN" --version
          npx tsx tools/e2e/live-vitest-invocation.mts run \
            --test-path test/e2e/live/managed-image-activation-e2e.test.ts

      - name: Upload managed runtime activation evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: managed-image-activation-${{ github.run_id }}-${{ github.run_attempt }}
          path: e2e-artifacts/live/managed-image-activation/
          if-no-files-found: error
          retention-days: 1

  build-and-validate:
    name: Build and validate ${{ matrix.display_name }} managed image (${{ matrix.arch }})
    if: github.event_name != 'pull_request'
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 120
    strategy:
      fail-fast: false
      matrix:
        include:
          - agent: openclaw
            arch: amd64
            display_name: OpenClaw
            dockerfile: Dockerfile
            base_image: nvidia/nemoclaw/sandbox-base
            image: nvidia/nemoclaw/openclaw-sandbox
            platform: linux/amd64
            artifact_platform: linux-amd64
            required_binary: /usr/local/bin/openclaw
            runner: ubuntu-24.04
          - agent: openclaw
            arch: arm64
            display_name: OpenClaw
            dockerfile: Dockerfile
            base_image: nvidia/nemoclaw/sandbox-base
            image: nvidia/nemoclaw/openclaw-sandbox
            platform: linux/arm64
            artifact_platform: linux-arm64
            required_binary: /usr/local/bin/openclaw
            runner: ubuntu-24.04-arm
          - agent: hermes
            arch: amd64
            display_name: Hermes
            dockerfile: agents/hermes/Dockerfile
            base_image: nvidia/nemoclaw/hermes-sandbox-base
            image: nvidia/nemoclaw/hermes-sandbox
            platform: linux/amd64
            artifact_platform: linux-amd64
            required_binary: /usr/local/bin/hermes
            runner: ubuntu-24.04
          - agent: hermes
            arch: arm64
            display_name: Hermes
            dockerfile: agents/hermes/Dockerfile
            base_image: nvidia/nemoclaw/hermes-sandbox-base
            image: nvidia/nemoclaw/hermes-sandbox
            platform: linux/arm64
            artifact_platform: linux-arm64
            required_binary: /usr/local/bin/hermes
            runner: ubuntu-24.04-arm
          - agent: langchain-deepagents-code
            arch: amd64
            display_name: Deep Agents Code
            dockerfile: agents/langchain-deepagents-code/Dockerfile
            base_image: nvidia/nemoclaw/langchain-deepagents-code-sandbox-base
            image: nvidia/nemoclaw/langchain-deepagents-code-sandbox
            platform: linux/amd64
            artifact_platform: linux-amd64
            required_binary: /usr/local/bin/dcode
            runner: ubuntu-24.04
          - agent: langchain-deepagents-code
            arch: arm64
            display_name: Deep Agents Code
            dockerfile: agents/langchain-deepagents-code/Dockerfile
            base_image: nvidia/nemoclaw/langchain-deepagents-code-sandbox-base
            image: nvidia/nemoclaw/langchain-deepagents-code-sandbox
            platform: linux/arm64
            artifact_platform: linux-arm64
            required_binary: /usr/local/bin/dcode
            runner: ubuntu-24.04-arm
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Download exact base image contract
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: managed-base-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.agent }}
          path: ${{ runner.temp }}/managed-base-contract

      - name: Validate exact base image contract
        id: base
        shell: bash
        env:
          AGENT: ${{ matrix.agent }}
          BASE_IMAGE: ${{ env.REGISTRY }}/${{ matrix.base_image }}
          CONTRACT: ${{ runner.temp }}/managed-base-contract/contract.json
          PLATFORM: ${{ matrix.platform }}
        run: |
          set -euo pipefail
          if [ ! -f "$CONTRACT" ] || [ -L "$CONTRACT" ]; then
            echo "ERROR: exact base image contract is missing or is a symlink." >&2
            exit 1
          fi
          if ! jq -e \
            --arg agent "$AGENT" \
            --arg image "$BASE_IMAGE" \
            --arg platform "$PLATFORM" \
            --arg revision "$GITHUB_SHA" \
            --argjson runAttempt "$GITHUB_RUN_ATTEMPT" \
            --argjson runId "$GITHUB_RUN_ID" \
            '
              (keys | sort) == [
                "agent",
                "contractVersion",
                "digest",
                "image",
                "platformDigests",
                "platformReferences",
                "platforms",
                "reference",
                "run",
                "sourceRevision"
              ]
              and .contractVersion == 1
              and .agent == $agent
              and .image == $image
              and (.digest | test("^sha256:[0-9a-f]{64}$"))
              and .reference == (.image + "@" + .digest)
              and .platforms == ["linux/amd64", "linux/arm64"]
              and (.platformDigests | keys | sort) == .platforms
              and (.platformReferences | keys | sort) == .platforms
              and (.platformDigests[$platform] | test("^sha256:[0-9a-f]{64}$"))
              and .platformReferences[$platform] ==
                (.image + "@" + .platformDigests[$platform])
              and .sourceRevision == $revision
              and .run == {id: $runId, attempt: $runAttempt}
            ' "$CONTRACT" >/dev/null
          then
            echo "ERROR: exact base image contract failed closed validation." >&2
            exit 1
          fi
          platform_reference="$(
            jq -er --arg platform "$PLATFORM" '.platformReferences[$platform]' "$CONTRACT"
          )"
          docker buildx imagetools inspect "$platform_reference" >/dev/null
          printf 'ref=%s\n' "$platform_reference" >> "$GITHUB_OUTPUT"

      - name: Log in to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Validate production build args
        env:
          BASE_IMAGE: ${{ steps.base.outputs.ref }}
          DOCKERFILE: ${{ matrix.dockerfile }}
        run: |
          set -euo pipefail
          build_args=(
            -f "$DOCKERFILE"
            --build-arg "BASE_IMAGE=${BASE_IMAGE}"
            --build-arg "NEMOCLAW_MANAGED_IMAGE_CAPABILITY_UNION=1"
            --build-arg "NEMOCLAW_MANAGED_IMAGE_RUNTIME_USER=root"
          )
          scripts/check-production-build-args.sh "${build_args[@]}"

      # Push only the canonical digest. Consumer aliases do not exist until the
      # exact image has passed anonymous-pull and runtime-contract validation.
      - name: Build and push managed image by digest
        id: build
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          platforms: ${{ matrix.platform }}
          outputs: type=image,name=${{ env.REGISTRY }}/${{ matrix.image }},push-by-digest=true,name-canonical=true,push=true
          labels: |
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            io.nvidia.nemoclaw.agent=${{ matrix.agent }}
            io.nvidia.nemoclaw.managed-image.contract=1
            io.nvidia.nemoclaw.managed-image.platform=${{ matrix.platform }}
            io.nvidia.nemoclaw.managed-image.startup-profile=1
            io.nvidia.nemoclaw.managed-image.capabilities=1
            io.nvidia.nemoclaw.managed-image.cohort=ghrun-${{ github.run_id }}-${{ github.run_attempt }}
          build-args: |
            BASE_IMAGE=${{ steps.base.outputs.ref }}
            NEMOCLAW_MANAGED_IMAGE_CAPABILITY_UNION=1
            NEMOCLAW_MANAGED_IMAGE_RUNTIME_USER=root
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ matrix.image }}:buildcache-${{ matrix.artifact_platform }}
          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ matrix.image }}:buildcache-${{ matrix.artifact_platform }},mode=max
          provenance: mode=max
          sbom: true

      - name: Install managed-image publication harness dependencies
        run: |
          npm ci --ignore-scripts
          npm run build:policy-boundary

      - name: Validate exact managed image before promotion
        id: validate
        shell: bash
        env:
          AGENT: ${{ matrix.agent }}
          DIGEST: ${{ steps.build.outputs.digest }}
          IMAGE: ${{ env.REGISTRY }}/${{ matrix.image }}
          PLATFORM: ${{ matrix.platform }}
          PUBLICATION_COHORT: ghrun-${{ github.run_id }}-${{ github.run_attempt }}
          REQUIRED_BINARY: ${{ matrix.required_binary }}
        run: |
          set -euo pipefail
          if [[ ! "$DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then
            echo "ERROR: managed image build did not return a valid digest: $DIGEST" >&2
            exit 1
          fi
          reference="${IMAGE}@${DIGEST}"
          docker buildx imagetools inspect "$reference" >/dev/null

          anonymous_config="$(mktemp -d "$RUNNER_TEMP/anonymous-docker-XXXXXX")"
          chmod 0700 "$anonymous_config"
          if ! DOCKER_CONFIG="$anonymous_config" docker pull --platform "$PLATFORM" "$reference"; then
            echo "::error::Anonymous exact-digest pull failed for ${reference}. Before aliases can be promoted, bootstrap the GHCR package ${IMAGE} with public visibility, then rerun this workflow."
            exit 1
          fi

          image_id="$(docker image inspect --format '{{.Id}}' "$reference")"
          if [[ ! "$image_id" =~ ^sha256:[0-9a-f]{64}$ ]] ||
             [ "$(docker image inspect --format '{{.Id}}' "$image_id")" != "$image_id" ]; then
            echo "ERROR: exact managed image did not resolve to one immutable local image ID." >&2
            exit 1
          fi
          image_user="$(docker image inspect --format '{{.Config.User}}' "$reference")"
          if [ -n "$image_user" ] && [ "$image_user" != "root" ] && [ "$image_user" != "0" ]; then
            echo "ERROR: managed image OCI user must be uid 0 for OpenShell supervisor initialization: $image_user" >&2
            exit 1
          fi

          agent_label="$(
            docker image inspect \
              --format '{{index .Config.Labels "io.nvidia.nemoclaw.agent"}}' \
              "$reference"
          )"
          contract_label="$(
            docker image inspect \
              --format '{{index .Config.Labels "io.nvidia.nemoclaw.managed-image.contract"}}' \
              "$reference"
          )"
          startup_profile_label="$(
            docker image inspect \
              --format '{{index .Config.Labels "io.nvidia.nemoclaw.managed-image.startup-profile"}}' \
              "$reference"
          )"
          capabilities_label="$(
            docker image inspect \
              --format '{{index .Config.Labels "io.nvidia.nemoclaw.managed-image.capabilities"}}' \
              "$reference"
          )"
          platform_label="$(
            docker image inspect \
              --format '{{index .Config.Labels "io.nvidia.nemoclaw.managed-image.platform"}}' \
              "$reference"
          )"
          cohort_label="$(
            docker image inspect \
              --format '{{index .Config.Labels "io.nvidia.nemoclaw.managed-image.cohort"}}' \
              "$reference"
          )"
          revision_label="$(
            docker image inspect \
              --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' \
              "$reference"
          )"
          if [[ ! "$PUBLICATION_COHORT" =~ ^ghrun-[1-9][0-9]{0,19}-[1-9][0-9]{0,9}$ ]] ||
             [ "$agent_label" != "$AGENT" ] ||
             [ "$contract_label" != "1" ] ||
             [ "$startup_profile_label" != "1" ] ||
             [ "$capabilities_label" != "1" ] ||
             [ "$platform_label" != "$PLATFORM" ] ||
             [ "$cohort_label" != "$PUBLICATION_COHORT" ] ||
             [ "$revision_label" != "$GITHUB_SHA" ]; then
            echo "ERROR: managed image contract labels do not match the build identity." >&2
            exit 1
          fi

          DOCKER_CONFIG="$anonymous_config" docker run --rm -i \
            --platform "$PLATFORM" \
            --network none \
            --env "AGENT=$AGENT" \
            --env "REQUIRED_BINARY=$REQUIRED_BINARY" \
            --entrypoint /bin/sh \
            "$reference" -eu -s <<'VALIDATE_FILESYSTEM'
          test -x /usr/local/bin/nemoclaw-start
          test -f /usr/local/lib/nemoclaw/managed-startup-image-runtime.cjs
          test ! -L /usr/local/lib/nemoclaw/managed-startup-image-runtime.cjs
          test "$(stat -c '%u:%g:%a' /usr/local/lib/nemoclaw/managed-startup-image-runtime.cjs)" = "0:0:444"
          test -x "$REQUIRED_BINARY"
          test -r /opt/nemoclaw-blueprint/blueprint.yaml
          test ! -e /usr/local/share/nemoclaw/corporate-ca.pem
          test ! -L /usr/local/share/nemoclaw/corporate-ca.pem
          test "$NEMOCLAW_MANAGED_IMAGE_CAPABILITY_UNION" = "1"
          case "$AGENT" in
            openclaw)
              node <<'VALIDATE_OPENCLAW_UNION'
          const fs = require("node:fs");
          const path = require("node:path");
          const config = JSON.parse(
            fs.readFileSync("/sandbox/.openclaw/openclaw.json", "utf8"),
          );
          const packages = {
            "diagnostics-otel": ["@openclaw/diagnostics-otel", "2026.7.1"],
            brave: ["@openclaw/brave-plugin", "2026.7.1"],
            discord: ["@openclaw/discord", "2026.7.1"],
            "openclaw-weixin": ["@tencent-weixin/openclaw-weixin", "2.4.3"],
            slack: ["@openclaw/slack", "2026.7.1"],
            whatsapp: ["@openclaw/whatsapp", "2026.7.1"],
            msteams: ["@openclaw/msteams", "2026.7.1"],
            googlechat: ["@openclaw/googlechat", "2026.7.1"],
          };
          const projectsRoot = "/sandbox/.openclaw/npm/projects";
          const projectRoots = fs
            .readdirSync(projectsRoot, { withFileTypes: true })
            .filter((entry) => entry.isDirectory())
            .map((entry) => path.join(projectsRoot, entry.name));
          for (const [id, [name, version]] of Object.entries(packages)) {
            const matches = projectRoots.flatMap((projectRoot) => {
              const nodeModulesRoot = path.join(projectRoot, "node_modules");
              const packageRoot = path.join(nodeModulesRoot, ...name.split("/"));
              const manifestPath = path.join(packageRoot, "package.json");
              if (
                !fs.existsSync(nodeModulesRoot) ||
                !fs.existsSync(packageRoot) ||
                !fs.lstatSync(packageRoot).isDirectory() ||
                !fs.existsSync(manifestPath) ||
                !fs.lstatSync(manifestPath).isFile()
              ) return [];
              const packageRelative = path.relative(
                fs.realpathSync(nodeModulesRoot),
                fs.realpathSync(packageRoot),
              );
              if (
                packageRelative === "" ||
                packageRelative === ".." ||
                packageRelative.startsWith(`..${path.sep}`) ||
                path.isAbsolute(packageRelative)
              ) return [];
              const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
              return manifest.name === name && manifest.version === version ? [manifestPath] : [];
            });
            if (matches.length !== 1 || config.plugins?.entries?.[id]?.enabled !== false) {
              throw new Error(`managed OpenClaw plugin ${id} is missing, duplicated, or active`);
            }
          }
          for (const id of ["telegram", "tavily"]) {
            if (config.plugins?.entries?.[id]?.enabled !== false) {
              throw new Error(`bundled OpenClaw plugin ${id} is not explicitly disabled`);
            }
          }
          for (const id of [
            "telegram",
            "discord",
            "openclaw-weixin",
            "slack",
            "whatsapp",
            "msteams",
            "googlechat",
          ]) {
            if (config.channels?.[id]?.enabled !== false) {
              throw new Error(`managed OpenClaw channel ${id} is not explicitly disabled`);
            }
          }
          if (config.tools?.web?.search?.enabled !== false) {
            throw new Error("managed OpenClaw web search is not explicitly disabled");
          }
          VALIDATE_OPENCLAW_UNION
              ;;
            hermes)
              /opt/hermes/.venv/bin/python -I <<'VALIDATE_HERMES_UNION'
          import importlib.metadata as metadata
          from pathlib import Path
          import yaml

          config = yaml.safe_load(Path("/sandbox/.hermes/config.yaml").read_text())
          optional = ("telegram", "discord", "weixin", "slack", "whatsapp", "teams")
          if any(config["platforms"].get(name) != {"enabled": False} for name in optional):
              raise SystemExit("managed Hermes optional platform is not explicitly disabled")
          if metadata.version("microsoft-teams-apps") != "2.0.13.4":
              raise SystemExit("managed Hermes microsoft-teams-apps version is wrong")
          if metadata.version("aiohttp") != "3.14.3":
              raise SystemExit("managed Hermes aiohttp version is wrong")
          VALIDATE_HERMES_UNION
              ;;
            langchain-deepagents-code) ;;
            *) echo "ERROR: unsupported managed agent $AGENT" >&2; exit 1 ;;
          esac
          VALIDATE_FILESYSTEM

          version_output="$(
            DOCKER_CONFIG="$anonymous_config" docker run --rm \
              --platform "$PLATFORM" \
              --network none \
              --entrypoint "$REQUIRED_BINARY" \
              "$reference" --version 2>&1
          )"
          if [ -z "$version_output" ]; then
            echo "ERROR: required agent binary returned an empty version." >&2
            exit 1
          fi

          DOCKER_CONFIG="$anonymous_config" \
            npx --no-install tsx \
              scripts/checks/run-managed-image-direct-e2e.ts \
              --agent "$AGENT" \
              --image "$reference" \
              --platform "$PLATFORM"
          printf 'local_id=%s\n' "$image_id" >> "$GITHUB_OUTPUT"
          printf 'reference=%s\n' "$reference" >> "$GITHUB_OUTPUT"

      - name: Capture exact managed image publication evidence
        id: evidence
        shell: bash
        env:
          AGENT: ${{ matrix.agent }}
          BASE_REFERENCE: ${{ steps.base.outputs.ref }}
          COHORT: ghrun-${{ github.run_id }}-${{ github.run_attempt }}
          DIGEST: ${{ steps.build.outputs.digest }}
          PLATFORM: ${{ matrix.platform }}
          REFERENCE: ${{ steps.validate.outputs.reference }}
        run: |
          set -euo pipefail
          evidence_dir="$RUNNER_TEMP/managed-image-publication-evidence"
          evidence="$evidence_dir/evidence.json"
          scripts/checks/verify-managed-image-publication-evidence.sh \
            --reference "$REFERENCE" \
            --digest "$DIGEST" \
            --platform "$PLATFORM" \
            --agent "$AGENT" \
            --base-reference "$BASE_REFERENCE" \
            --repository "$GITHUB_REPOSITORY" \
            --revision "$GITHUB_SHA" \
            --cohort "$COHORT" \
            --run-id "$GITHUB_RUN_ID" \
            --run-attempt "$GITHUB_RUN_ATTEMPT" \
            --output "$evidence"
          printf 'path=%s\n' "$evidence" >> "$GITHUB_OUTPUT"

      - name: Export validated managed image candidate
        env:
          AGENT: ${{ matrix.agent }}
          BASE_REFERENCE: ${{ steps.base.outputs.ref }}
          DIGEST: ${{ steps.build.outputs.digest }}
          EVIDENCE: ${{ steps.evidence.outputs.path }}
          IMAGE: ${{ env.REGISTRY }}/${{ matrix.image }}
          PLATFORM: ${{ matrix.platform }}
          PUBLICATION_COHORT: ghrun-${{ github.run_id }}-${{ github.run_attempt }}
          REFERENCE: ${{ steps.validate.outputs.reference }}
        run: |
          set -euo pipefail
          if [[ ! "$GITHUB_SHA" =~ ^[0-9a-f]{40}$ ]] ||
             [[ ! "$PUBLICATION_COHORT" =~ ^ghrun-[1-9][0-9]{0,19}-[1-9][0-9]{0,9}$ ]]; then
            echo "ERROR: managed image publication identity is invalid." >&2
            exit 1
          fi
          release_tag=""
          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
            release_tag="${GITHUB_REF#refs/tags/}"
            if [[ ! "$release_tag" =~ ^v[0-9]+([.][0-9]+){1,3}([-.][0-9A-Za-z][0-9A-Za-z.-]*)?$ ]]; then
              echo "ERROR: release tag is not a supported version identity: $release_tag" >&2
              exit 1
            fi
          elif [ "$GITHUB_REF" != "refs/heads/main" ]; then
            echo "ERROR: managed images may only be published from main or a v* release tag." >&2
            exit 1
          fi

          contract_dir="$RUNNER_TEMP/managed-image-candidate"
          mkdir -p "$contract_dir"
          if [ ! -f "$EVIDENCE" ] || [ -L "$EVIDENCE" ]; then
            echo "ERROR: exact registry publication evidence is missing or unsafe." >&2
            exit 1
          fi
          jq -n \
            --arg agent "$AGENT" \
            --arg baseReference "$BASE_REFERENCE" \
            --arg digest "$DIGEST" \
            --arg image "$IMAGE" \
            --arg platform "$PLATFORM" \
            --arg cohort "$PUBLICATION_COHORT" \
            --arg reference "$REFERENCE" \
            --arg ref "$GITHUB_REF" \
            --arg release "$release_tag" \
            --arg repository "$GITHUB_REPOSITORY" \
            --arg revision "$GITHUB_SHA" \
            --argjson runAttempt "$GITHUB_RUN_ATTEMPT" \
            --argjson runId "$GITHUB_RUN_ID" \
            --slurpfile publicationEvidence "$EVIDENCE" \
            '{
              contractVersion: 2,
              phase: "candidate",
              agent: $agent,
              image: $image,
              digest: $digest,
              reference: $reference,
              baseReference: $baseReference,
              platform: $platform,
              publicationEvidence: $publicationEvidence[0],
              source: {
                repository: $repository,
                revision: $revision,
                ref: $ref,
                cohort: $cohort
              },
              run: {
                id: $runId,
                attempt: $runAttempt
              },
              release: (if $release == "" then null else $release end)
            }' > "$contract_dir/contract.json"
          jq -e \
            --arg agent "$AGENT" \
            --arg image "$IMAGE" \
            --arg platform "$PLATFORM" \
            --arg cohort "$PUBLICATION_COHORT" \
            --arg ref "$GITHUB_REF" \
            --arg release "$release_tag" \
            --arg repository "$GITHUB_REPOSITORY" \
            --arg revision "$GITHUB_SHA" \
            --argjson runAttempt "$GITHUB_RUN_ATTEMPT" \
            --argjson runId "$GITHUB_RUN_ID" \
             '(keys | sort) == [
               "agent",
               "baseReference",
               "contractVersion",
               "digest",
               "image",
               "phase",
               "platform",
               "publicationEvidence",
               "reference",
               "release",
               "run",
               "source"
             ]
             and .contractVersion == 2
             and .phase == "candidate"
             and .agent == $agent
             and .image == $image
             and .platform == $platform
             and (.digest | test("^sha256:[0-9a-f]{64}$"))
             and .reference == (.image + "@" + .digest)
             and (.baseReference | test("@sha256:[0-9a-f]{64}$"))
             and .publicationEvidence.candidateDescriptor.digest == .digest
             and .publicationEvidence.workloadDescriptor.platform == (
               $platform
               | split("/")
               | {os: .[0], architecture: .[1]}
             )
             and .publicationEvidence.attestations.manifestDescriptor.annotations[
               "vnd.docker.reference.digest"
             ] == .publicationEvidence.workloadDescriptor.digest
             and .publicationEvidence.attestations.slsa.descriptor.annotations[
               "in-toto.io/predicate-type"
             ] == "https://slsa.dev/provenance/v1"
             and .publicationEvidence.attestations.slsa.statement.subject.digest ==
               .publicationEvidence.workloadDescriptor.digest
             and .publicationEvidence.attestations.slsa.statement.bindings == {
               agent: $agent,
               baseReference: .baseReference,
               cohort: $cohort,
               platform: $platform,
               revision: $revision,
               source: ("https://github.com/" + $repository)
             }
             and .publicationEvidence.attestations.slsa.statement.builderId ==
               ("https://github.com/" + $repository + "/actions/runs/" +
                ($runId | tostring) + "/attempts/" + ($runAttempt | tostring))
             and .publicationEvidence.attestations.spdx.descriptor.annotations[
               "in-toto.io/predicate-type"
             ] == "https://spdx.dev/Document"
             and .publicationEvidence.attestations.spdx.statement.subject.digest ==
               .publicationEvidence.workloadDescriptor.digest
             and .source == {
               repository: $repository,
               revision: $revision,
               ref: $ref,
               cohort: $cohort
             }
             and .run == {id: $runId, attempt: $runAttempt}
             and .release == (if $release == "" then null else $release end)
             and (has("aliases") | not)' \
            "$contract_dir/contract.json" >/dev/null

      - name: Upload validated managed image candidate
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: managed-image-candidate-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.agent }}-${{ matrix.artifact_platform }}
          path: ${{ runner.temp }}/managed-image-candidate/contract.json
          if-no-files-found: error
          retention-days: 1

  promote:
    name: Promote complete multi-platform managed image cohort
    needs: build-and-validate
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
      packages: write
    steps:
      - name: Download all validated managed image candidates
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: managed-image-candidate-${{ github.run_id }}-${{ github.run_attempt }}-*
          path: ${{ runner.temp }}/managed-image-candidates
          merge-multiple: false

      # This is the all-agent/all-architecture publication barrier. It fails
      # closed before registry authentication or any alias operation.
      - name: Validate complete managed image candidate set
        id: candidates
        shell: bash
        env:
          CANDIDATE_ROOT: ${{ runner.temp }}/managed-image-candidates
        run: |
          set -euo pipefail
          if [[ ! "$GITHUB_SHA" =~ ^[0-9a-f]{40}$ ]]; then
            echo "ERROR: source revision must be a full 40-character SHA." >&2
            exit 1
          fi
          expected_cohort="ghrun-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
          if [[ ! "$expected_cohort" =~ ^ghrun-[1-9][0-9]{0,19}-[1-9][0-9]{0,9}$ ]]; then
            echo "ERROR: publication cohort is invalid: $expected_cohort" >&2
            exit 1
          fi
          expected_release=""
          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
            expected_release="${GITHUB_REF#refs/tags/}"
            if [[ ! "$expected_release" =~ ^v[0-9]+([.][0-9]+){1,3}([-.][0-9A-Za-z][0-9A-Za-z.-]*)?$ ]]; then
              echo "ERROR: release tag is not a supported version identity: $expected_release" >&2
              exit 1
            fi
          elif [ "$GITHUB_REF" != "refs/heads/main" ]; then
            echo "ERROR: managed images may only be promoted from main or a v* release tag." >&2
            exit 1
          fi

          artifact_prefix="managed-image-candidate-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
          expected_artifacts=(
            "${artifact_prefix}-openclaw-linux-amd64"
            "${artifact_prefix}-openclaw-linux-arm64"
            "${artifact_prefix}-hermes-linux-amd64"
            "${artifact_prefix}-hermes-linux-arm64"
            "${artifact_prefix}-langchain-deepagents-code-linux-amd64"
            "${artifact_prefix}-langchain-deepagents-code-linux-arm64"
          )
          expected_agents=(
            openclaw
            openclaw
            hermes
            hermes
            langchain-deepagents-code
            langchain-deepagents-code
          )
          expected_platforms=(
            linux/amd64
            linux/arm64
            linux/amd64
            linux/arm64
            linux/amd64
            linux/arm64
          )
          if [ ! -d "$CANDIDATE_ROOT" ] || [ -L "$CANDIDATE_ROOT" ]; then
            echo "ERROR: managed image candidate root is missing or unsafe." >&2
            exit 1
          fi
          actual_entry_count="$(
            find "$CANDIDATE_ROOT" ! -path "$CANDIDATE_ROOT" -prune -print |
              wc -l | tr -d '[:space:]'
          )"
          if [ "$actual_entry_count" != "${#expected_artifacts[@]}" ]; then
            echo "ERROR: expected exactly six managed image candidate artifacts." >&2
            exit 1
          fi

          candidate_files=()
          for index in "${!expected_artifacts[@]}"; do
            artifact="${expected_artifacts[$index]}"
            expected_agent="${expected_agents[$index]}"
            expected_platform="${expected_platforms[$index]}"
            artifact_dir="$CANDIDATE_ROOT/$artifact"
            contract="$artifact_dir/contract.json"
            if [ ! -d "$artifact_dir" ] || [ -L "$artifact_dir" ] ||
               [ ! -f "$contract" ] || [ -L "$contract" ]; then
              echo "ERROR: required managed image candidate is missing or unsafe: $artifact" >&2
              exit 1
            fi
            artifact_entry_count="$(
              find "$artifact_dir" ! -path "$artifact_dir" -prune -print |
                wc -l | tr -d '[:space:]'
            )"
            if [ "$artifact_entry_count" != "1" ] ||
               ! jq -e \
                 --arg agent "$expected_agent" \
                 --arg platform "$expected_platform" \
                 '.agent == $agent and .platform == $platform' \
                 "$contract" >/dev/null; then
              echo "ERROR: managed image candidate artifact identity is invalid: $artifact" >&2
              exit 1
            fi
            candidate_files+=("$contract")
          done

          candidate_set="$RUNNER_TEMP/managed-image-candidate-set.json"
          jq -s 'sort_by(.agent, .platform)' "${candidate_files[@]}" > "$candidate_set"
          if ! jq -e \
            --arg ref "$GITHUB_REF" \
            --arg release "$expected_release" \
            --arg repository "$GITHUB_REPOSITORY" \
            --arg revision "$GITHUB_SHA" \
            --arg cohort "$expected_cohort" \
            --argjson runAttempt "$GITHUB_RUN_ATTEMPT" \
            --argjson runId "$GITHUB_RUN_ID" \
            '
              def sha256: type == "string" and test("^sha256:[0-9a-f]{64}$");
              def positive_size:
                type == "number" and . > 0 and floor == .;
              def workload_descriptor($platform):
                (keys | sort) == ["digest", "mediaType", "platform", "size"]
                and .mediaType == "application/vnd.oci.image.manifest.v1+json"
                and (.digest | sha256)
                and (.size | positive_size)
                and .platform == (
                  $platform | split("/") | {os: .[0], architecture: .[1]}
                );
              def attestation_manifest_descriptor($workloadDigest):
                (keys | sort) == ["annotations", "digest", "mediaType", "platform", "size"]
                and .mediaType == "application/vnd.oci.image.manifest.v1+json"
                and (.digest | sha256)
                and (.size | positive_size)
                and .platform == {os: "unknown", architecture: "unknown"}
                and (.annotations | keys | sort) == [
                  "vnd.docker.reference.digest",
                  "vnd.docker.reference.type"
                ]
                and .annotations["vnd.docker.reference.digest"] == $workloadDigest
                and .annotations["vnd.docker.reference.type"] == "attestation-manifest";
              def statement_descriptor($predicateType):
                (keys | sort) == ["annotations", "digest", "mediaType", "size"]
                and .mediaType == "application/vnd.in-toto+json"
                and (.digest | sha256)
                and (.size | positive_size)
                and .annotations == {"in-toto.io/predicate-type": $predicateType};
              length == 6
              and ([.[].agent] | group_by(.) | map({key: .[0], value: length}) | from_entries) == {
                "hermes": 2,
                "langchain-deepagents-code": 2,
                "openclaw": 2
              }
              and (group_by(.agent) | all(.[];
                ([.[].platform] | sort) == ["linux/amd64", "linux/arm64"]
              ))
              and all(.[];
                (keys | sort) == [
                  "agent",
                  "baseReference",
                  "contractVersion",
                  "digest",
                  "image",
                  "phase",
                  "platform",
                  "publicationEvidence",
                  "reference",
                  "release",
                  "run",
                  "source"
                ]
                and .contractVersion == 2
                and .phase == "candidate"
                and (.digest | test("^sha256:[0-9a-f]{64}$"))
                and .reference == (.image + "@" + .digest)
                and (.baseReference | test("@sha256:[0-9a-f]{64}$"))
                and (.publicationEvidence | keys | sort) == [
                  "attestations",
                  "candidateDescriptor",
                  "workloadDescriptor"
                ]
                and (.publicationEvidence.candidateDescriptor | keys | sort) == [
                  "digest",
                  "mediaType",
                  "size"
                ]
                and .publicationEvidence.candidateDescriptor.mediaType ==
                  "application/vnd.oci.image.index.v1+json"
                and .publicationEvidence.candidateDescriptor.digest == .digest
                and (.publicationEvidence.candidateDescriptor.size | positive_size)
                and (
                  .platform as $candidatePlatform
                  | .publicationEvidence.workloadDescriptor
                  | workload_descriptor($candidatePlatform)
                )
                and (.publicationEvidence.attestations | keys | sort) == [
                  "manifestDescriptor",
                  "slsa",
                  "spdx"
                ]
                and (
                  .publicationEvidence.workloadDescriptor.digest as $workloadDigest
                  |
                  .publicationEvidence.attestations.manifestDescriptor
                  | attestation_manifest_descriptor($workloadDigest)
                )
                and (.publicationEvidence.attestations.slsa | keys | sort) == [
                  "descriptor",
                  "statement"
                ]
                and (
                  .publicationEvidence.attestations.slsa.descriptor
                  | statement_descriptor("https://slsa.dev/provenance/v1")
                )
                and (
                  .agent as $candidateAgent
                  | .baseReference as $candidateBaseReference
                  | .platform as $candidatePlatform
                  |
                  .publicationEvidence.workloadDescriptor.digest as $workloadDigest
                  | .publicationEvidence.attestations.slsa.statement
                  | (keys | sort) == [
                      "bindings",
                      "buildType",
                      "builderId",
                      "predicateType",
                      "subject",
                      "type"
                    ]
                  and .type == "https://in-toto.io/Statement/v1"
                  and .predicateType == "https://slsa.dev/provenance/v1"
                  and .buildType ==
                    "https://github.com/moby/buildkit/blob/master/docs/attestations/slsa-definitions.md"
                  and (.subject | keys | sort) == ["digest", "name"]
                  and (.subject.name | type) == "string"
                  and (.subject.name | length) > 0
                  and .subject.digest == $workloadDigest
                  and (.bindings | keys | sort) == [
                    "agent",
                    "baseReference",
                    "cohort",
                    "platform",
                    "revision",
                    "source"
                  ]
                  and .bindings.agent == $candidateAgent
                  and .bindings.baseReference == $candidateBaseReference
                  and .bindings.cohort == $cohort
                  and .bindings.platform == $candidatePlatform
                  and .bindings.revision == $revision
                  and .bindings.source == ("https://github.com/" + $repository)
                  and .builderId ==
                    ("https://github.com/" + $repository + "/actions/runs/" +
                     ($runId | tostring) + "/attempts/" + ($runAttempt | tostring))
                )
                and (.publicationEvidence.attestations.spdx | keys | sort) == [
                  "descriptor",
                  "statement"
                ]
                and (
                  .publicationEvidence.attestations.spdx.descriptor
                  | statement_descriptor("https://spdx.dev/Document")
                )
                and (
                  .publicationEvidence.workloadDescriptor.digest as $workloadDigest
                  | .publicationEvidence.attestations.spdx.statement
                  | (keys | sort) == ["predicateType", "subject", "type"]
                  and .type == "https://in-toto.io/Statement/v1"
                  and .predicateType == "https://spdx.dev/Document"
                  and (.subject | keys | sort) == ["digest", "name"]
                  and (.subject.name | type) == "string"
                  and (.subject.name | length) > 0
                  and .subject.digest == $workloadDigest
                )
                and .publicationEvidence.attestations.slsa.descriptor.digest !=
                  .publicationEvidence.attestations.spdx.descriptor.digest
                and .source == {
                  repository: $repository,
                  revision: $revision,
                  ref: $ref,
                  cohort: $cohort
                }
                and .run == {id: $runId, attempt: $runAttempt}
                and .release == (if $release == "" then null else $release end)
                and (has("aliases") | not)
              )
              and ([.[].reference] | unique | length) == 6
              and ([.[].baseReference] | unique | length) == 6
              and ([.[].publicationEvidence.workloadDescriptor.digest] | unique | length) == 6
              and ([.[].publicationEvidence.attestations.manifestDescriptor.digest]
                | unique | length) == 6
              and ([.[].publicationEvidence.attestations.slsa.descriptor.digest]
                | unique | length) == 6
              and ([.[].publicationEvidence.attestations.spdx.descriptor.digest]
                | unique | length) == 6
              and (
                map({key: (.agent + "|" + .platform), value: .image}) | from_entries
              ) == {
                "openclaw|linux/amd64": "ghcr.io/nvidia/nemoclaw/openclaw-sandbox",
                "openclaw|linux/arm64": "ghcr.io/nvidia/nemoclaw/openclaw-sandbox",
                "hermes|linux/amd64": "ghcr.io/nvidia/nemoclaw/hermes-sandbox",
                "hermes|linux/arm64": "ghcr.io/nvidia/nemoclaw/hermes-sandbox",
                "langchain-deepagents-code|linux/amd64":
                  "ghcr.io/nvidia/nemoclaw/langchain-deepagents-code-sandbox",
                "langchain-deepagents-code|linux/arm64":
                  "ghcr.io/nvidia/nemoclaw/langchain-deepagents-code-sandbox"
              }
            ' "$candidate_set" >/dev/null
          then
            echo "ERROR: complete managed image candidate set failed closed validation." >&2
            exit 1
          fi
          printf 'candidate_set=%s\n' "$candidate_set" >> "$GITHUB_OUTPUT"

      - name: Verify release tag before managed image promotion
        if: startsWith(github.ref, 'refs/tags/v')
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          RELEASE_TAG: ${{ github.ref_name }}
          RELEASE_REVISION: ${{ github.sha }}
        with:
          script: |
            const releaseTag = process.env.RELEASE_TAG ?? '';
            const releaseRevision = process.env.RELEASE_REVISION ?? '';
            if (!/^v\d+\.\d+\.\d+$/.test(releaseTag)) {
              throw new Error(`Refusing to verify non-semver tag: ${releaseTag}`);
            }
            if (!/^[0-9a-f]{40}$/.test(releaseRevision)) {
              throw new Error(`Refusing release promotion with invalid revision: ${releaseRevision}`);
            }
            const { owner, repo } = context.repo;
            const ref = await github.rest.git.getRef({ owner, repo, ref: `tags/${releaseTag}` });
            if (ref.data.object.type !== 'tag') {
              throw new Error(`Release tag ${releaseTag} must be annotated`);
            }
            const tagObjectSha = ref.data.object.sha;
            let tagObject;
            for (let attempt = 1; attempt <= 10; attempt += 1) {
              ({ data: tagObject } = await github.rest.git.getTag({
                owner,
                repo,
                tag_sha: tagObjectSha,
              }));
              if (tagObject.verification?.verified === true) break;
              if (attempt < 10) {
                core.info(`Waiting for GitHub tag verification (${attempt}/10)`);
                await new Promise((resolve) => setTimeout(resolve, 3000));
              }
            }
            if (
              tagObject.tag !== releaseTag ||
              tagObject.object.type !== 'commit' ||
              tagObject.object.sha !== releaseRevision ||
              tagObject.verification?.verified !== true
            ) {
              throw new Error(`Release tag ${releaseTag} is not a verified direct commit tag`);
            }

      - name: Checkout publication verifier
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Docker Buildx for promotion
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Log in to GHCR for promotion
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Revalidate exact managed image publication evidence
        shell: bash
        env:
          CANDIDATE_SET: ${{ steps.candidates.outputs.candidate_set }}
        run: |
          set -euo pipefail
          revalidated_root="$RUNNER_TEMP/revalidated-managed-image-evidence"
          install -d -m 0700 "$revalidated_root"
          index=0
          while IFS= read -r candidate; do
            index=$((index + 1))
            reference="$(jq -er '.reference' <<<"$candidate")"
            digest="$(jq -er '.digest' <<<"$candidate")"
            platform="$(jq -er '.platform' <<<"$candidate")"
            agent="$(jq -er '.agent' <<<"$candidate")"
            base_reference="$(jq -er '.baseReference' <<<"$candidate")"
            repository="$(jq -er '.source.repository' <<<"$candidate")"
            revision="$(jq -er '.source.revision' <<<"$candidate")"
            cohort="$(jq -er '.source.cohort' <<<"$candidate")"
            run_id="$(jq -er '.run.id | tostring' <<<"$candidate")"
            run_attempt="$(jq -er '.run.attempt | tostring' <<<"$candidate")"
            actual="$revalidated_root/$index.json"
            expected="$revalidated_root/$index.expected.json"
            scripts/checks/verify-managed-image-publication-evidence.sh \
              --reference "$reference" \
              --digest "$digest" \
              --platform "$platform" \
              --agent "$agent" \
              --base-reference "$base_reference" \
              --repository "$repository" \
              --revision "$revision" \
              --cohort "$cohort" \
              --run-id "$run_id" \
              --run-attempt "$run_attempt" \
              --output "$actual"
            jq -S '.publicationEvidence' <<<"$candidate" > "$expected"
            if ! cmp -s "$expected" <(jq -S . "$actual"); then
              echo "ERROR: registry publication evidence changed after candidate validation: $reference" >&2
              exit 1
            fi
          done < <(jq -c '.[]' "$CANDIDATE_SET")
          if [ "$index" -ne 6 ]; then
            echo "ERROR: registry evidence revalidation did not cover all six candidates." >&2
            exit 1
          fi

      - name: Stage validated multi-platform managed image cohort and contracts
        shell: bash
        env:
          CANDIDATE_SET: ${{ steps.candidates.outputs.candidate_set }}
        run: |
          set -euo pipefail
          contract_root="$RUNNER_TEMP/managed-image-contracts"
          mkdir -p "$contract_root"
          cohort="ghrun-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
          if [[ ! "$cohort" =~ ^ghrun-[1-9][0-9]{0,19}-[1-9][0-9]{0,9}$ ]]; then
            echo "ERROR: publication cohort is invalid: $cohort" >&2
            exit 1
          fi

          manifests="$RUNNER_TEMP/managed-image-cohort-manifests.jsonl"
          : > "$manifests"
          for agent in openclaw hermes langchain-deepagents-code; do
            agent_candidates="$RUNNER_TEMP/managed-image-${agent}-candidates.json"
            jq -ce --arg agent "$agent" \
              '[.[] | select(.agent == $agent)] | sort_by(.platform)' \
              "$CANDIDATE_SET" > "$agent_candidates"
            image="$(jq -er '.[0].image' "$agent_candidates")"
            descriptor_root="$RUNNER_TEMP/managed-image-${agent}-descriptors"
            install -d -m 0700 "$descriptor_root"
            descriptor_args=()
            candidate_index=0
            while IFS= read -r candidate; do
              candidate_index=$((candidate_index + 1))
              workload_descriptor="$descriptor_root/$candidate_index-workload.json"
              attestation_descriptor="$descriptor_root/$candidate_index-attestation.json"
              jq -S '.publicationEvidence.workloadDescriptor' \
                <<<"$candidate" > "$workload_descriptor"
              jq -S '.publicationEvidence.attestations.manifestDescriptor' \
                <<<"$candidate" > "$attestation_descriptor"
              descriptor_args+=(
                --file "$workload_descriptor"
                --file "$attestation_descriptor"
              )
            done < <(jq -c '.[]' "$agent_candidates")
            if [ "$candidate_index" -ne 2 ] || [ "${#descriptor_args[@]}" -ne 8 ]; then
              echo "ERROR: expected exactly two platform candidates for $agent." >&2
              exit 1
            fi
            cohort_alias="${image}:cohort-${cohort}"
            cohort_metadata="$RUNNER_TEMP/managed-image-${agent}-cohort-metadata.json"
            docker buildx imagetools create \
              --tag "$cohort_alias" \
              --metadata-file "$cohort_metadata" \
              "${descriptor_args[@]}"

            cohort_raw="$RUNNER_TEMP/managed-image-${agent}-cohort.raw"
            docker buildx imagetools inspect "$cohort_alias" --raw > "$cohort_raw"
            expected_descriptors="$descriptor_root/expected.json"
            actual_descriptors="$descriptor_root/actual.json"
            jq -S '[
              .[]
              | (
                  .publicationEvidence.workloadDescriptor,
                  .publicationEvidence.attestations.manifestDescriptor
                )
            ] | sort_by(.digest)' "$agent_candidates" > "$expected_descriptors"
            jq -S '.manifests | sort_by(.digest)' "$cohort_raw" > "$actual_descriptors"
            if ! jq -e '
                (keys | sort) == ["manifests", "mediaType", "schemaVersion"]
                and .schemaVersion == 2
                and .mediaType == "application/vnd.oci.image.index.v1+json"
                and (.manifests | length) == 4
                and ([
                  .manifests[]
                  | select(.platform.os == "linux")
                  | "linux/" + .platform.architecture
                ] | sort) == ["linux/amd64", "linux/arm64"]
                and ([
                  .manifests[]
                  | select(
                      .platform == {os: "unknown", architecture: "unknown"}
                      and .annotations["vnd.docker.reference.type"] ==
                        "attestation-manifest"
                    )
                ] | length) == 2
              ' "$cohort_raw" >/dev/null ||
               ! cmp -s "$expected_descriptors" "$actual_descriptors"; then
              echo "ERROR: staged cohort descriptors differ from validated candidates: $cohort_alias" >&2
              exit 1
            fi

            cohort_descriptor="$RUNNER_TEMP/managed-image-${agent}-cohort-descriptor.json"
            jq -ce '.["containerimage.descriptor"]' \
              "$cohort_metadata" > "$cohort_descriptor"
            cohort_digest="$(jq -er '.digest' "$cohort_descriptor")"
            cohort_size="$(wc -c < "$cohort_raw" | tr -d '[:space:]')"
            actual_cohort_digest="sha256:$(sha256sum "$cohort_raw" | awk '{print $1}')"
            if ! jq -e \
              --arg digest "$actual_cohort_digest" \
              --argjson size "$cohort_size" \
              '
                (keys | sort) == ["digest", "mediaType", "size"]
                and .mediaType == "application/vnd.oci.image.index.v1+json"
                and .digest == $digest
                and .size == $size
              ' "$cohort_descriptor" >/dev/null; then
              echo "ERROR: staged cohort descriptor does not match its registry bytes: $cohort_alias" >&2
              exit 1
            fi
            cohort_reference="${image}@${cohort_digest}"
            exact_raw="$RUNNER_TEMP/managed-image-${agent}-cohort-exact.raw"
            docker buildx imagetools inspect "$cohort_reference" --raw > "$exact_raw"
            if ! cmp -s "$cohort_raw" "$exact_raw"; then
              echo "ERROR: staged cohort alias bytes do not match their exact digest: $cohort_alias" >&2
              exit 1
            fi
            jq -cn \
              --arg agent "$agent" \
              --arg alias "$cohort_alias" \
              --arg digest "$cohort_digest" \
              --arg image "$image" \
              --arg reference "$cohort_reference" \
              --slurpfile descriptor "$cohort_descriptor" \
              --slurpfile platforms "$agent_candidates" \
              '{
                agent: $agent,
                image: $image,
                digest: $digest,
                reference: $reference,
                descriptor: $descriptor[0],
                alias: $alias,
                platforms: ($platforms[0] | map({
                  key: .platform,
                  value: {
                    digest,
                    reference,
                    baseReference,
                    publicationEvidence
                  }
                }) | from_entries)
              }' >> "$manifests"
          done

          cohort_manifests="$RUNNER_TEMP/managed-image-cohort-manifests.json"
          jq -s 'sort_by(.agent)' "$manifests" > "$cohort_manifests"
          if ! jq -e '
            length == 3
            and ([.[].agent] | sort) == [
              "hermes",
              "langchain-deepagents-code",
              "openclaw"
            ]
            and all(.[];
              (.digest | test("^sha256:[0-9a-f]{64}$"))
              and .reference == (.image + "@" + .digest)
              and .descriptor == {
                mediaType: "application/vnd.oci.image.index.v1+json",
                digest: .digest,
                size: .descriptor.size
              }
              and (.descriptor.size | type) == "number"
              and .descriptor.size > 0
              and (.platforms | keys | sort) == ["linux/amd64", "linux/arm64"]
              and all(.platforms[];
                (.digest | test("^sha256:[0-9a-f]{64}$"))
                and (.baseReference | test("@sha256:[0-9a-f]{64}$"))
                and .publicationEvidence.candidateDescriptor.digest == .digest
                and .publicationEvidence.attestations.manifestDescriptor.annotations[
                  "vnd.docker.reference.digest"
                ] == .publicationEvidence.workloadDescriptor.digest
                and .publicationEvidence.attestations.slsa.statement.subject.digest ==
                  .publicationEvidence.workloadDescriptor.digest
                and .publicationEvidence.attestations.spdx.statement.subject.digest ==
                  .publicationEvidence.workloadDescriptor.digest
              )
            )
          ' "$cohort_manifests" >/dev/null; then
            echo "ERROR: staged multi-platform cohort failed exact validation." >&2
            exit 1
          fi

          # Prove that every staged agent alias is anonymously pullable on both
          # supported architectures before the single consumer pointer moves.
          anonymous_config="$(mktemp -d "$RUNNER_TEMP/anonymous-cohort-docker-XXXXXX")"
          chmod 0700 "$anonymous_config"
          while IFS= read -r manifest; do
            cohort_reference="$(jq -r '.reference' <<<"$manifest")"
            for platform in linux/amd64 linux/arm64; do
              DOCKER_CONFIG="$anonymous_config" docker pull \
                --platform "$platform" \
                "$cohort_reference"
              docker image rm "$cohort_reference" >/dev/null
            done
          done < <(jq -c '.[]' "$cohort_manifests")

          # Record the intended OpenClaw root pointers in every exact contract.
          # They are not moved until all v2 evidence artifacts are durable.
          openclaw_manifest="$(jq -ce '.[] | select(.agent == "openclaw")' "$cohort_manifests")"
          consumer_aliases=("$(jq -r '.image' <<<"$openclaw_manifest"):${GITHUB_SHA}")
          release_tag="$(jq -r '.[0].release // empty' "$CANDIDATE_SET")"
          if [ -n "$release_tag" ]; then
            consumer_aliases+=("$(jq -r '.image' <<<"$openclaw_manifest"):${release_tag}")
          fi

          while IFS= read -r candidate; do
            agent="$(jq -r '.agent' <<<"$candidate")"
            platform="$(jq -r '.platform' <<<"$candidate")"
            artifact_platform="${platform//\//-}"
            cohort_manifest="$(jq -ce --arg agent "$agent" '.[] | select(.agent == $agent)' "$cohort_manifests")"
            cohort_alias="$(jq -r '.alias' <<<"$cohort_manifest")"
            staged_cohort="$(
              jq -c '{alias, descriptor, reference}' <<<"$cohort_manifest"
            )"
            aliases=("$cohort_alias")
            if [ "$agent" = "openclaw" ]; then
              aliases+=("${consumer_aliases[@]}")
            fi
            aliases_json="$(printf '%s\n' "${aliases[@]}" | jq -R . | jq -s .)"
            contract_dir="$contract_root/$agent/$artifact_platform"
            mkdir -p "$contract_dir"
            jq \
              --argjson aliases "$aliases_json" \
              --argjson stagedCohort "$staged_cohort" \
              '{
                contractVersion,
                agent,
                image,
                digest,
                reference,
                baseReference,
                platform,
                publicationEvidence,
                stagedCohort: $stagedCohort,
                source: {
                  repository: .source.repository,
                  revision: .source.revision,
                  release,
                  cohort: .source.cohort
                },
                run,
                aliases: $aliases
              }' <<<"$candidate" > "$contract_dir/contract.json"
            if ! jq -e \
              --arg agent "$agent" \
              --arg platform "$platform" \
              --arg cohort "$cohort" \
              --argjson aliases "$aliases_json" \
              '(keys | sort) == [
                 "agent",
                 "aliases",
                 "baseReference",
                 "contractVersion",
                 "digest",
                 "image",
                 "platform",
                 "publicationEvidence",
                 "reference",
                 "run",
                 "source",
                 "stagedCohort"
               ]
               and .contractVersion == 2
               and .agent == $agent
               and .platform == $platform
               and (.digest | test("^sha256:[0-9a-f]{64}$"))
               and .reference == (.image + "@" + .digest)
               and (.baseReference | test("@sha256:[0-9a-f]{64}$"))
               and .publicationEvidence.candidateDescriptor.digest == .digest
               and .publicationEvidence.workloadDescriptor.platform == (
                 $platform | split("/") | {os: .[0], architecture: .[1]}
               )
               and .publicationEvidence.attestations.manifestDescriptor.annotations[
                 "vnd.docker.reference.digest"
               ] == .publicationEvidence.workloadDescriptor.digest
               and .stagedCohort.alias == (.image + ":cohort-" + $cohort)
               and .stagedCohort.reference == (.image + "@" + .stagedCohort.descriptor.digest)
               and .stagedCohort.descriptor.mediaType ==
                 "application/vnd.oci.image.index.v1+json"
               and (.stagedCohort.descriptor.digest | test("^sha256:[0-9a-f]{64}$"))
               and (.stagedCohort.descriptor.size | type) == "number"
               and .stagedCohort.descriptor.size > 0
               and .source.revision == $ENV.GITHUB_SHA
               and .source.cohort == $cohort
               and .run == {
                 id: ($ENV.GITHUB_RUN_ID | tonumber),
                 attempt: ($ENV.GITHUB_RUN_ATTEMPT | tonumber)
               }
               and .aliases == $aliases
               and (
                 (.image + ":cohort-" + $cohort) as $cohortAlias
                 | (.aliases | index($cohortAlias)) != null
               )' "$contract_dir/contract.json" >/dev/null; then
              echo "ERROR: final exact platform contract failed validation: $agent/$platform" >&2
              exit 1
            fi
          done < <(jq -c '.[]' "$CANDIDATE_SET")

          cohort_contract="$contract_root/cohort.json"
          jq -n \
            --arg repository "$GITHUB_REPOSITORY" \
            --arg revision "$GITHUB_SHA" \
            --arg release "$release_tag" \
            --arg cohort "$cohort" \
            --argjson runAttempt "$GITHUB_RUN_ATTEMPT" \
            --argjson runId "$GITHUB_RUN_ID" \
            --slurpfile agents "$cohort_manifests" \
            '{
              contractVersion: 2,
              cohort: $cohort,
              source: {
                repository: $repository,
                revision: $revision,
                release: (if $release == "" then null else $release end)
              },
              run: {id: $runId, attempt: $runAttempt},
              platforms: ["linux/amd64", "linux/arm64"],
              agents: ($agents[0] | map({key: .agent, value: del(.agent)}) | from_entries)
            }' > "$cohort_contract"
          jq -e \
            --arg cohort "$cohort" \
            --arg revision "$GITHUB_SHA" \
            --argjson runAttempt "$GITHUB_RUN_ATTEMPT" \
            --argjson runId "$GITHUB_RUN_ID" \
            '(keys | sort) == [
               "agents",
               "cohort",
               "contractVersion",
               "platforms",
               "run",
               "source"
             ]
             and .contractVersion == 2
             and .cohort == $cohort
             and .source.revision == $revision
             and .run == {id: $runId, attempt: $runAttempt}
             and .platforms == ["linux/amd64", "linux/arm64"]
             and (.agents | keys | sort) == [
               "hermes",
               "langchain-deepagents-code",
               "openclaw"
             ]
             and all(.agents[];
               (.digest | test("^sha256:[0-9a-f]{64}$"))
               and .reference == (.image + "@" + .digest)
               and .descriptor == {
                 mediaType: "application/vnd.oci.image.index.v1+json",
                 digest: .digest,
                 size: .descriptor.size
               }
               and (.descriptor.size | type) == "number"
               and .descriptor.size > 0
               and .alias == (.image + ":cohort-" + $cohort)
               and (.platforms | keys | sort) == ["linux/amd64", "linux/arm64"]
               and all(.platforms[];
                 .publicationEvidence.candidateDescriptor.digest == .digest
                 and .publicationEvidence.attestations.manifestDescriptor.annotations[
                   "vnd.docker.reference.digest"
                 ] == .publicationEvidence.workloadDescriptor.digest
               )
             )' "$cohort_contract" >/dev/null

      - name: Upload complete managed image cohort contract
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: managed-image-cohort-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/managed-image-contracts/cohort.json
          if-no-files-found: error
          retention-days: 90

      - name: Upload OpenClaw amd64 managed image contract
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: managed-image-${{ github.run_id }}-${{ github.run_attempt }}-openclaw-linux-amd64
          path: ${{ runner.temp }}/managed-image-contracts/openclaw/linux-amd64/contract.json
          if-no-files-found: error
          retention-days: 90

      - name: Upload OpenClaw arm64 managed image contract
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: managed-image-${{ github.run_id }}-${{ github.run_attempt }}-openclaw-linux-arm64
          path: ${{ runner.temp }}/managed-image-contracts/openclaw/linux-arm64/contract.json
          if-no-files-found: error
          retention-days: 90

      - name: Upload Hermes amd64 managed image contract
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: managed-image-${{ github.run_id }}-${{ github.run_attempt }}-hermes-linux-amd64
          path: ${{ runner.temp }}/managed-image-contracts/hermes/linux-amd64/contract.json
          if-no-files-found: error
          retention-days: 90

      - name: Upload Hermes arm64 managed image contract
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: managed-image-${{ github.run_id }}-${{ github.run_attempt }}-hermes-linux-arm64
          path: ${{ runner.temp }}/managed-image-contracts/hermes/linux-arm64/contract.json
          if-no-files-found: error
          retention-days: 90

      - name: Upload Deep Agents Code amd64 managed image contract
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: managed-image-${{ github.run_id }}-${{ github.run_attempt }}-langchain-deepagents-code-linux-amd64
          path: ${{ runner.temp }}/managed-image-contracts/langchain-deepagents-code/linux-amd64/contract.json
          if-no-files-found: error
          retention-days: 90

      - name: Upload Deep Agents Code arm64 managed image contract
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: managed-image-${{ github.run_id }}-${{ github.run_attempt }}-langchain-deepagents-code-linux-arm64
          path: ${{ runner.temp }}/managed-image-contracts/langchain-deepagents-code/linux-arm64/contract.json
          if-no-files-found: error
          retention-days: 90

      # Keep this final: an evidence-artifact upload failure must never leave a
      # consumer root pointing at a cohort without its durable v2 contracts.
      - name: Promote durable managed image cohort pointers
        shell: bash
        run: |
          set -euo pipefail
          cohort_contract="$RUNNER_TEMP/managed-image-contracts/cohort.json"
          if [ ! -f "$cohort_contract" ] || [ -L "$cohort_contract" ]; then
            echo "ERROR: durable managed image cohort contract is missing or unsafe." >&2
            exit 1
          fi
          cohort="ghrun-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
          if ! jq -e \
            --arg cohort "$cohort" \
            --arg repository "$GITHUB_REPOSITORY" \
            --arg revision "$GITHUB_SHA" \
            --argjson runAttempt "$GITHUB_RUN_ATTEMPT" \
            --argjson runId "$GITHUB_RUN_ID" \
            '
              .contractVersion == 2
              and .cohort == $cohort
              and .source.repository == $repository
              and .source.revision == $revision
              and .run == {id: $runId, attempt: $runAttempt}
              and .agents.openclaw.reference ==
                (.agents.openclaw.image + "@" + .agents.openclaw.digest)
              and .agents.openclaw.descriptor == {
                mediaType: "application/vnd.oci.image.index.v1+json",
                digest: .agents.openclaw.digest,
                size: .agents.openclaw.descriptor.size
              }
              and (.agents.openclaw.descriptor.size | type) == "number"
              and .agents.openclaw.descriptor.size > 0
            ' "$cohort_contract" >/dev/null; then
            echo "ERROR: durable managed image cohort contract cannot authorize promotion." >&2
            exit 1
          fi

          image="$(jq -er '.agents.openclaw.image' "$cohort_contract")"
          exact_reference="$(jq -er '.agents.openclaw.reference' "$cohort_contract")"
          expected_digest="$(jq -er '.agents.openclaw.digest' "$cohort_contract")"
          expected_size="$(jq -er '.agents.openclaw.descriptor.size | tostring' "$cohort_contract")"
          release_tag="$(jq -r '.source.release // empty' "$cohort_contract")"
          if [[ ! "$image" =~ ^ghcr\.io/nvidia/nemoclaw/openclaw-sandbox$ ]] ||
             [[ ! "$exact_reference" =~ ^ghcr\.io/nvidia/nemoclaw/openclaw-sandbox@sha256:[0-9a-f]{64}$ ]] ||
             [[ ! "$GITHUB_SHA" =~ ^[0-9a-f]{40}$ ]]; then
            echo "ERROR: durable managed image pointer identity is invalid." >&2
            exit 1
          fi

          consumer_aliases=("${image}:${GITHUB_SHA}")
          if [ -n "$release_tag" ]; then
            if [[ ! "$release_tag" =~ ^v[0-9]+([.][0-9]+){1,3}([-.][0-9A-Za-z][0-9A-Za-z.-]*)?$ ]]; then
              echo "ERROR: durable managed image release identity is invalid." >&2
              exit 1
            fi
            consumer_aliases+=("${image}:${release_tag}")
          fi

          exact_raw="$RUNNER_TEMP/managed-image-openclaw-cohort-exact.raw"
          docker buildx imagetools inspect "$exact_reference" --raw > "$exact_raw"
          actual_digest="sha256:$(sha256sum "$exact_raw" | awk '{print $1}')"
          actual_size="$(wc -c < "$exact_raw" | tr -d '[:space:]')"
          if [ "$actual_digest" != "$expected_digest" ] ||
             [ "$actual_size" != "$expected_size" ]; then
            echo "ERROR: exact OpenClaw cohort bytes differ from the durable contract." >&2
            exit 1
          fi

          consumer_tag_args=()
          for alias in "${consumer_aliases[@]}"; do
            consumer_tag_args+=(--tag "$alias")
          done
          docker buildx imagetools create "${consumer_tag_args[@]}" "$exact_reference"

          for alias in "${consumer_aliases[@]}"; do
            alias_raw="$RUNNER_TEMP/managed-image-openclaw-pointer-${alias##*:}.raw"
            docker buildx imagetools inspect "$alias" --raw > "$alias_raw"
            if ! cmp -s "$exact_raw" "$alias_raw"; then
              echo "ERROR: OpenClaw cohort pointer is not exact: $alias" >&2
              exit 1
            fi
          done