Merge branch 'main' into fix/portable-default-policy-finality-9206

Author: prekshivyas

.agents/skills/_shared/code-change-considerations.md

@@ -17,13 +17,22 @@ recording them here.
 
 - What accepted outcome and current consumer require the change?
 - What current code owns the behavior, and can that owner be extended directly?
+- What current code, branch, parameter, owner, fixture, or file becomes unnecessary and can be
+  deleted or merged in this change?
 - Would the change duplicate an existing structure or create another source of truth?
+- Can the completed source-and-test change be neutral or negative in total lines? If not, what
+  current correctness, security, or accepted-scope contract requires the growth?
+- If the change adds a helper, abstraction, configuration, registry, fallback, or compatibility
+  path, which current consumers adopt it now, what old structure does it remove, and is the whole
+  result smaller or simpler?
 - What state, success, failure, and partial-failure behavior must remain coherent?
 - What ordering or concurrency can change the result or bypass a guarantee?
 - How do absent values, defaults, retries, recovery, and cleanup behave?
 - Which alternate entry, error, cached, resumed, or compatibility paths can bypass the change?
 - Can code or configuration be removed, or can an existing or native mechanism replace new code?
 - What shortest stable test proves the changed behavior, including the relevant negative path?
+- Can that evidence extend or consolidate current fixtures, matrices, and assertions instead of
+  creating another test owner or a one-use test helper?
 - Does a real process, network, filesystem, container, hardware, or service boundary require deeper
   runtime or end-to-end evidence?
 - Which active issues, pull requests, or recent changes overlap, conflict, or affect delivery order?

.agents/skills/nemoclaw-contributor-implement-issue/SKILL.md

@@ -80,13 +80,25 @@ checked for that operation or failure class and the sensitive-workflow state out
 hold. Then make the direct change in the current behavior owner. Do not add speculative abstractions,
 configuration, compatibility, migration, or fallback behavior.
 
+Optimize the complete source-and-test change for deletion and consolidation. Compare a direct edit,
+reuse of an existing owner, and a refactor of current related code. Prefer a neutral or negative
+total line delta. Add a helper, abstraction, configuration surface, registry, fallback, or
+compatibility path only when current consumers adopt it in this change and the complete result
+removes more owners, concepts, branches, or lines than it adds. Possible future reuse is not enough.
+When a current correctness, security, or accepted-scope contract requires growth, keep the design
+direct and record why deletion or reuse cannot satisfy it.
+
 Add focused evidence as applicable:
 
 - positive behavior that must succeed;
 - negative or denied behavior that must fail;
 - error, interruption, recovery, or cleanup behavior;
 - boundary values, ambiguous state, and alternate entry paths.
 
+Preserve semantic regression coverage, not every existing fixture or assertion block. Extend or
+table-drive current coverage when that keeps one setup and one behavior owner. Do not create a
+one-use test helper, parallel matrix, or second test file merely to shorten an individual test.
+
 State why an evidence category does not apply when omission could hide risk. Use runtime or end-to-end
 evidence only when the real process, filesystem, network, container, hardware, workflow, or service
 boundary owns the behavior. Run focused tests after the final behavior-affecting edit and record the
@@ -103,6 +115,11 @@ Consideration and all nine Security Rubric categories to the completed behavior.
 security control and focused negative evidence that proves forbidden behavior remains denied. If no
 security control changed, state why and cite the reviewed trust boundaries.
 
+Record the reduction case for the completed design: the current code, owners, branches, parameters,
+fixtures, or files deleted or consolidated and the total source-and-test line direction. If the
+change grew, identify the current contract that requires that growth. Remove review-driven machinery
+when a direct solution is smaller; do not add another layer to compensate for an avoidable layer.
+
 Confirm that allowed, denied, error, and boundary behavior remains coherent across failure, retry,
 cleanup, cached, resumed, and compatibility paths that apply.
 Re-check the recorded operation and failure class, sibling paths, and sensitive-workflow state
@@ -121,6 +138,7 @@ Use this structure:
 - Accepted scope authority:
 - Delivered capability:
 - Changed behavior:
+- Simplification result: <deleted or consolidated structure, total line direction, and required-growth justification when applicable>
 - Deferred scope:
 
 ## Changed files

.github/workflows/managed-images.yaml

@@ -169,6 +169,46 @@ jobs:
             printf 'NemoClaw source commit: %s\n' "$STAGING_QA_SOURCE_SHA"
           } >> "$GITHUB_STEP_SUMMARY"
 
+      # NemoPatch exact Deep Agents candidate-base boundary.
+      # Preserve the recorded staging tree and replace only the dependency inputs
+      # that the candidate base image owns.
+      - name: Overlay exact PR dependency inputs on staging QA base
+        shell: bash
+        run: |
+          set -euo pipefail
+          candidate_root="$GITHUB_WORKSPACE/candidate"
+          staging_root="$GITHUB_WORKSPACE/staging-qa-base-source"
+          for relative in \
+            agents/langchain-deepagents-code/Dockerfile.base \
+            agents/langchain-deepagents-code/requirements.lock
+          do
+            source_file="$candidate_root/$relative"
+            destination_file="$staging_root/$relative"
+            if [ ! -f "$source_file" ] || [ -L "$source_file" ] || [ ! -f "$destination_file" ] || [ -L "$destination_file" ]; then
+              echo "ERROR: staging QA dependency input is missing, unsafe, or changed shape: $relative" >&2
+              exit 1
+            fi
+            install -m 0644 "$source_file" "$destination_file"
+          done
+          for support_relative in \
+            scripts/lib/bundled-npm-package.mts \
+            scripts/security/patches/perl-5.44.0-net-ping-capability-tests.patch
+          do
+            support_source="$candidate_root/$support_relative"
+            support_parent="$staging_root/$(dirname "$support_relative")"
+            support_destination="$staging_root/$support_relative"
+            if [ ! -f "$support_source" ] || [ -L "$support_source" ] || [ ! -d "$support_parent" ] || [ -L "$support_parent" ] || [ -L "$support_destination" ]; then
+              echo "ERROR: staging QA Dockerfile support file is missing, unsafe, or changed shape: $support_relative" >&2
+              exit 1
+            fi
+            if [ -e "$support_destination" ] && [ ! -f "$support_destination" ]; then
+              echo "ERROR: staging QA Dockerfile support destination changed shape: $support_relative" >&2
+              exit 1
+            fi
+            install -m 0644 "$support_source" "$support_destination"
+          done
+          printf '\nCandidate dependency inputs: %s\n' "$CANDIDATE_SHA" >> "$GITHUB_STEP_SUMMARY"
+
       - name: Reproduce staging discovery permission drift
         shell: bash
         working-directory: candidate
@@ -406,6 +446,11 @@ jobs:
         with:
           node-version: 22.19.0
 
+      - name: Validate exact Deep Agents PR base build args
+        if: matrix.agent == 'langchain-deepagents-code'
+        shell: bash
+        run: scripts/check-production-build-args.sh -f agents/langchain-deepagents-code/Dockerfile.base
+
       - name: Resolve exact linux/amd64 PR base
         id: base
         shell: bash

.github/workflows/podman-cpu-proof.yaml

@@ -28,6 +28,7 @@ on:
       - "src/lib/onboard/runtime-provider/container-state-mutation.ts"
       - "src/lib/onboard/runtime-provider/docker-state-mutation.ts"
       - "src/lib/onboard/experimental/portable-host-preparation*.ts"
+      - "src/lib/onboard/experimental/portable-profile.ts"
       - "src/lib/onboard/runtime-provider/podman*.ts"
       - "scripts/install-openshell.sh"
       - "scripts/checks/run-portable-cpu-delegation-proof.mts"
@@ -334,6 +335,21 @@ jobs:
             printf 'XDG_RUNTIME_DIR=%s\n' "$runtime_dir"
           } >>"$GITHUB_ENV"
 
+      - name: Configure exact Portable host gateway alias
+        shell: bash
+        run: |
+          set -euo pipefail
+          portable_host_gateway_ip="$(
+            node --input-type=module --eval '
+              const { PORTABLE_HOST_GATEWAY_IP } =
+                await import("./dist/lib/onboard/docker-driver-platform.js");
+              process.stdout.write(PORTABLE_HOST_GATEWAY_IP);
+            '
+          )"
+          sudo ip address replace "$portable_host_gateway_ip/32" dev lo
+          ip -o -4 address show dev lo | awk '{print $4}' | grep -Fx "$portable_host_gateway_ip/32"
+          printf 'E2E_PORTABLE_HOST_GATEWAY_IP=%s\n' "$portable_host_gateway_ip" >>"$GITHUB_ENV"
+
       - name: Start the exact connected gateway required by portable retirement
         shell: bash
         run: |
@@ -458,6 +474,18 @@ jobs:
             esac
           done < <(podman --url "$endpoint" secret ls --format '{{.Name}}' 2>/dev/null || true)
           podman --url "$endpoint" network rm openshell-docker 2>/dev/null || true
+          # gateway-alias-cleanup
+          portable_host_gateway_ip=""
+          if portable_host_gateway_ip="$(
+            node --input-type=module --eval '
+              const { PORTABLE_HOST_GATEWAY_IP } =
+                await import("./dist/lib/onboard/docker-driver-platform.js");
+              process.stdout.write(PORTABLE_HOST_GATEWAY_IP);
+            '
+          )" && [ -n "$portable_host_gateway_ip" ] \
+            && [ "${E2E_PORTABLE_HOST_GATEWAY_IP:-}" = "$portable_host_gateway_ip" ]; then
+            sudo ip address delete "$portable_host_gateway_ip/32" dev lo 2>/dev/null || true
+          fi
           service_pid="${E2E_PODMAN_SERVICE_PID:-}"
           if [[ "$service_pid" =~ ^[1-9][0-9]*$ ]]; then
             kill "$service_pid" 2>/dev/null || true

agents/langchain-deepagents-code/Dockerfile

@@ -232,7 +232,7 @@ RUN test -f /usr/local/bin/nemoclaw-managed-bootstrap \
     && cmp -s /usr/local/lib/nemoclaw/dcode-launcher.sh /usr/local/lib/nemoclaw/dcode-managed-exec \
     && chmod -R a+rX /opt/nemoclaw-blueprint \
     && test "$(find /opt/nemoclaw-deepagents-profile-plugin -type f -print | LC_ALL=C sort)" = "$(printf '%s\n' '/opt/nemoclaw-deepagents-profile-plugin/pyproject.toml' '/opt/nemoclaw-deepagents-profile-plugin/src/nemoclaw_deepagents_profile/__init__.py')" \
-    && printf '%s  %s\n' '8fe85c62293c74147848732dc56c33e8ab60133fa41c071da4328ac60f2bf44f' '/opt/nemoclaw-deepagents-profile-plugin/src/nemoclaw_deepagents_profile/__init__.py' '7ba7b77bd6f889cc861eddbe3e38fc1f4433a85b7bc2a9b516e19a19a37a7686' '/opt/nemoclaw-deepagents-profile-plugin/pyproject.toml' | sha256sum -c - \
+    && printf '%s  %s\n' '6bb8dc8108c5dd7e7f71c39aacfb0da07d285b7a324eecd691177a9ca460cfc0' '/opt/nemoclaw-deepagents-profile-plugin/src/nemoclaw_deepagents_profile/__init__.py' '7be3f7972d7cd78d3ddaf66e2ff8b07a5e6af3611034b956cf0475ba78f5a576' '/opt/nemoclaw-deepagents-profile-plugin/pyproject.toml' | sha256sum -c - \
     && /opt/venv/bin/pip3 install --no-index --no-cache-dir --no-deps --no-build-isolation /opt/nemoclaw-deepagents-profile-plugin \
     && /opt/venv/bin/python3 -I -c 'import nemoclaw_deepagents_profile; print("NEMOCLAW_DCODE_PROFILE_" + "IMPORT_GATE", flush=True); import deepagents; import deepagents_code' \
     && /opt/venv/bin/pip3 check \

agents/langchain-deepagents-code/Dockerfile.base

@@ -339,7 +339,7 @@ RUN python3 -m venv --copies "$VIRTUAL_ENV" \
         -r /tmp/deepagents-code-requirements.lock \
     && "$VIRTUAL_ENV/bin/pip3" check \
     && "$VIRTUAL_ENV/bin/python3" -I -c \
-        "from importlib.metadata import version; expected = {'aiohttp': '3.14.3', 'cryptography': '50.0.0', 'deepagents-code': '0.1.34', 'langgraph-checkpoint-sqlite': '3.1.1', 'mcp': '1.28.1', 'pillow': '12.3.0', 'pyasn1': '0.6.4', 'uv': '0.11.33'}; actual = {name: version(name) for name in expected}; assert actual == expected, actual" \
+        "from importlib.metadata import version; expected = {'aiohttp': '3.14.3', 'cryptography': '50.0.0', 'deepagents-code': '0.1.55', 'langgraph-checkpoint-sqlite': '3.1.1', 'mcp': '1.28.1', 'pillow': '12.3.0', 'pyasn1': '0.6.4', 'uv': '0.11.33'}; actual = {name: version(name) for name in expected}; assert actual == expected, actual" \
     && ln -sf "$VIRTUAL_ENV/bin/dcode" /usr/local/bin/dcode \
     && ln -sf "$VIRTUAL_ENV/bin/deepagents-code" /usr/local/bin/deepagents-code \
     && rm -f /tmp/deepagents-code-requirements.lock \

agents/langchain-deepagents-code/dcode-wrapper.sh

@@ -11,7 +11,7 @@ if [ "${1:-}" = "--nemoclaw-mcp-capability" ] && [ "$#" -eq 1 ]; then
   exit 0
 fi
 
-unset BASH_ENV ENV OPENAI_PROXY
+unset BASH_ENV ENV OPENAI_PROXY DEEPAGENTS_CODE_APPROVAL_MODE DEEPAGENTS_CODE_STARTUP_MODE
 while IFS= read -r _nemoclaw_auto_approval_env; do
   unset "$_nemoclaw_auto_approval_env"
 done < <(compgen -A variable NEMOCLAW_DCODE_AUTO_APPROVAL || true)
@@ -637,7 +637,7 @@ try:
 except Exception:
     sys.exit(1)
 # Schema pin: detection assumes a truthy top-level "credentials" key,
-# matching the auth.json shape in deepagents-code==0.1.34. Nested or
+# matching the auth.json shape reviewed for deepagents-code==0.1.55. Nested or
 # renamed shapes ({"auth":{...}}, {"state":{"credentials":...}}, top-level
 # list) are not detected. When bumping the upstream pin, re-review this
 # assumption against the new auth.json schema.