Merge branch 'main' into agent/fix-docker-authority-term-9584

Author: prekshivyas

.agents/skills/_shared/code-change-considerations.md

@@ -17,13 +17,22 @@ recording them here.
 
 - What accepted outcome and current consumer require the change?
 - What current code owns the behavior, and can that owner be extended directly?
+- What current code, branch, parameter, owner, fixture, or file becomes unnecessary and can be
+  deleted or merged in this change?
 - Would the change duplicate an existing structure or create another source of truth?
+- Can the completed source-and-test change be neutral or negative in total lines? If not, what
+  current correctness, security, or accepted-scope contract requires the growth?
+- If the change adds a helper, abstraction, configuration, registry, fallback, or compatibility
+  path, which current consumers adopt it now, what old structure does it remove, and is the whole
+  result smaller or simpler?
 - What state, success, failure, and partial-failure behavior must remain coherent?
 - What ordering or concurrency can change the result or bypass a guarantee?
 - How do absent values, defaults, retries, recovery, and cleanup behave?
 - Which alternate entry, error, cached, resumed, or compatibility paths can bypass the change?
 - Can code or configuration be removed, or can an existing or native mechanism replace new code?
 - What shortest stable test proves the changed behavior, including the relevant negative path?
+- Can that evidence extend or consolidate current fixtures, matrices, and assertions instead of
+  creating another test owner or a one-use test helper?
 - Does a real process, network, filesystem, container, hardware, or service boundary require deeper
   runtime or end-to-end evidence?
 - Which active issues, pull requests, or recent changes overlap, conflict, or affect delivery order?

.agents/skills/nemoclaw-contributor-implement-issue/SKILL.md

@@ -80,13 +80,25 @@ checked for that operation or failure class and the sensitive-workflow state out
 hold. Then make the direct change in the current behavior owner. Do not add speculative abstractions,
 configuration, compatibility, migration, or fallback behavior.
 
+Optimize the complete source-and-test change for deletion and consolidation. Compare a direct edit,
+reuse of an existing owner, and a refactor of current related code. Prefer a neutral or negative
+total line delta. Add a helper, abstraction, configuration surface, registry, fallback, or
+compatibility path only when current consumers adopt it in this change and the complete result
+removes more owners, concepts, branches, or lines than it adds. Possible future reuse is not enough.
+When a current correctness, security, or accepted-scope contract requires growth, keep the design
+direct and record why deletion or reuse cannot satisfy it.
+
 Add focused evidence as applicable:
 
 - positive behavior that must succeed;
 - negative or denied behavior that must fail;
 - error, interruption, recovery, or cleanup behavior;
 - boundary values, ambiguous state, and alternate entry paths.
 
+Preserve semantic regression coverage, not every existing fixture or assertion block. Extend or
+table-drive current coverage when that keeps one setup and one behavior owner. Do not create a
+one-use test helper, parallel matrix, or second test file merely to shorten an individual test.
+
 State why an evidence category does not apply when omission could hide risk. Use runtime or end-to-end
 evidence only when the real process, filesystem, network, container, hardware, workflow, or service
 boundary owns the behavior. Run focused tests after the final behavior-affecting edit and record the
@@ -103,6 +115,11 @@ Consideration and all nine Security Rubric categories to the completed behavior.
 security control and focused negative evidence that proves forbidden behavior remains denied. If no
 security control changed, state why and cite the reviewed trust boundaries.
 
+Record the reduction case for the completed design: the current code, owners, branches, parameters,
+fixtures, or files deleted or consolidated and the total source-and-test line direction. If the
+change grew, identify the current contract that requires that growth. Remove review-driven machinery
+when a direct solution is smaller; do not add another layer to compensate for an avoidable layer.
+
 Confirm that allowed, denied, error, and boundary behavior remains coherent across failure, retry,
 cleanup, cached, resumed, and compatibility paths that apply.
 Re-check the recorded operation and failure class, sibling paths, and sensitive-workflow state
@@ -121,6 +138,7 @@ Use this structure:
 - Accepted scope authority:
 - Delivered capability:
 - Changed behavior:
+- Simplification result: <deleted or consolidated structure, total line direction, and required-growth justification when applicable>
 - Deferred scope:
 
 ## Changed files

.agents/skills/nemoclaw-maintainer-fix-e2e-failures/SKILL.md

@@ -16,7 +16,6 @@ Continuously inspect automatic E2E results for `main`. Coordinate ownership and
 2. Keep release operations out of scope. Never change, retag, publish, or otherwise touch a release, tag, or release artifact during this workflow. Route release work to the existing release workflow.
 3. Confirm maintainer authorization. Merge only when the request grants it. Otherwise, leave the PR `approval-ready` and continue the loop.
 4. Check Git and GitHub access. Follow [Git and GitHub Access Hard Stop](../_shared/git-github-hard-stop.md) on access failure.
-5. Fetch trusted `origin/main`. Read its PR-limit policy with `git show origin/main:.github/workflows/pr-limit.yaml`. For a non-exempt author, do not create a claim that would exceed the 10-open-PR limit.
 
 Do not declare success or end the loop because the queue is empty or the newest run passes. Wait for the next automatic `main` result.
 

.github/actions/build-base-image-platform/action.yaml

@@ -4,6 +4,17 @@
 name: build-base-image-platform
 description: Build and publish one immutable base image digest for a platform.
 
+outputs:
+  digest:
+    description: Exact digest for the requested platform.
+    value: ${{ steps.build.outputs.digest }}
+  amd64-digest:
+    description: Exact amd64 digest when this action built the amd64 lane.
+    value: ${{ steps.job-output.outputs.amd64_digest }}
+  arm64-digest:
+    description: Exact arm64 digest when this action built the arm64 lane.
+    value: ${{ steps.job-output.outputs.arm64_digest }}
+
 inputs:
   agent:
     description: Agent identifier used for build arguments and artifact names.
@@ -129,6 +140,7 @@ runs:
           'test -x /usr/bin/dos2unix; test "$(command -v dos2unix)" = /usr/bin/dos2unix; dos2unix --version >/dev/null'
 
     - name: Export platform digest
+      id: job-output
       shell: bash
       env:
         ARCH: ${{ inputs.arch }}
@@ -145,6 +157,7 @@ runs:
         fi
         mkdir -p "$RUNNER_TEMP/digests"
         touch "$RUNNER_TEMP/digests/${ARCH}-${DIGEST#sha256:}"
+        printf '%s_digest=%s\n' "$ARCH" "$DIGEST" >> "$GITHUB_OUTPUT"
 
     - name: Upload platform digest
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/actions/publish-base-image-manifest/action.yaml

@@ -4,10 +4,21 @@
 name: publish-base-image-manifest
 description: Validate platform digests and publish one multi-platform base image manifest.
 
+outputs:
+  contract-base64:
+    description: Exact validated base-image contract for dependent jobs.
+    value: ${{ steps.contract-output.outputs.contract_base64 }}
+
 inputs:
   agent:
     description: Agent identifier stored in the managed base image contract.
     required: true
+  amd64-digest:
+    description: Exact amd64 platform digest from the producer job.
+    required: true
+  arm64-digest:
+    description: Exact arm64 platform digest from the producer job.
+    required: true
   display-name:
     description: Agent name used in validation errors.
     required: true
@@ -27,12 +38,23 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Download platform digests
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        pattern: ${{ inputs.agent }}-base-digest-${{ github.run_id }}-${{ github.run_attempt }}-*
-        path: ${{ runner.temp }}/digests
-        merge-multiple: true
+    - name: Restore exact platform digests
+      shell: bash
+      env:
+        AMD64_DIGEST: ${{ inputs.amd64-digest }}
+        ARM64_DIGEST: ${{ inputs.arm64-digest }}
+      run: |
+        set -euo pipefail
+        for digest in "$AMD64_DIGEST" "$ARM64_DIGEST"; do
+          [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]] || {
+            echo "ERROR: base-image producer output has an invalid digest." >&2
+            exit 1
+          }
+        done
+        digest_root="$RUNNER_TEMP/digests"
+        install -d -m 0700 "$digest_root"
+        touch "$digest_root/amd64-${AMD64_DIGEST#sha256:}"
+        touch "$digest_root/arm64-${ARM64_DIGEST#sha256:}"
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
@@ -65,6 +87,22 @@ runs:
         IMAGE: ${{ inputs.registry }}/${{ inputs.image }}
         TAGS: ${{ steps.meta.outputs.tags }}
       run: bash "$GITHUB_ACTION_PATH/publish.sh"
+    - name: Export managed base image contract
+      id: contract-output
+      shell: bash
+      run: |
+        set -euo pipefail
+        contract="$RUNNER_TEMP/managed-base-contract/contract.json"
+        if [ ! -f "$contract" ] || [ -L "$contract" ]; then
+          echo "ERROR: managed base image contract is missing or is a symbolic link." >&2
+          exit 1
+        fi
+        contract_size="$(wc -c < "$contract" | tr -d '[:space:]')"
+        if [[ ! "$contract_size" =~ ^[1-9][0-9]{0,5}$ ]] || [ "$contract_size" -gt 65536 ]; then
+          echo "ERROR: managed base image contract is empty or oversized." >&2
+          exit 1
+        fi
+        printf 'contract_base64=%s\n' "$(base64 -w 0 "$contract")" >> "$GITHUB_OUTPUT"
     - name: Upload managed base image contract
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:

.github/pr-limits.json

@@ -0,0 +1,20 @@
+{
+  "apurvvkumaria": "10",
+  "chengjiew": "10",
+  "cjagwani": "10",
+  "cv": "10",
+  "dongni-yang": "10",
+  "ericksoa": "10",
+  "jyaunches": "10",
+  "laitingsheng": "10",
+  "prekshivyas": "10",
+  "rluo8": "10",
+  "rsliter": "10",
+  "sandl99": "10",
+  "senthilr-nv": "10",
+  "tedy-y": "10",
+  "tonyluo-nv": "10",
+  "wscurran": "10",
+  "yimoj": "10",
+  "*": "5"
+}

.github/workflows/base-image-platform.yaml

@@ -0,0 +1,83 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Build base image platform
+
+on:
+  workflow_call:
+    inputs:
+      agent:
+        description: Agent identifier for the base-image build.
+        required: true
+        type: string
+      arch:
+        description: Artifact architecture identifier.
+        required: true
+        type: string
+      platform:
+        description: Docker platform to build.
+        required: true
+        type: string
+      runner:
+        description: GitHub-hosted runner for the target architecture.
+        required: true
+        type: string
+      dockerfile:
+        description: Path to the base-image Dockerfile.
+        required: true
+        type: string
+      image:
+        description: Image repository relative to GHCR.
+        required: true
+        type: string
+      openclaw-version:
+        description: Optional OpenClaw version build argument.
+        required: false
+        type: string
+        default: ""
+    outputs:
+      digest:
+        description: Exact digest for the requested platform.
+        value: ${{ jobs.build.outputs.digest }}
+    secrets:
+      registry_password:
+        description: GHCR publication credential.
+        required: true
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    name: Build ${{ inputs.agent }} base image (${{ inputs.arch }})
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      digest: ${{ steps.platform.outputs.digest }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Build and publish platform digest
+        id: platform
+        uses: ./.github/actions/build-base-image-platform
+        with:
+          agent: ${{ inputs.agent }}
+          arch: ${{ inputs.arch }}
+          platform: ${{ inputs.platform }}
+          dockerfile: ${{ inputs.dockerfile }}
+          image: ${{ inputs.image }}
+          registry: ghcr.io
+          registry-username: ${{ github.actor }}
+          registry-password: ${{ secrets.registry_password }}
+          openclaw-version: ${{ inputs.openclaw-version }}
+          metadata-tags: |
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+            type=ref,event=tag
+            type=sha,prefix=,format=short