test(images): add security revision container verifier

[apurvvkumaria]

Summary

Add a standalone container verifier for the current OpenClaw security remediation produced by #7286. The verifier inspects the installed OpenClaw package graph in an offline, read-only, unprivileged container and rejects vulnerable, stale, or internally inconsistent dependency state.

Related Issue

Related to #7272. The real-container lane validates the final image produced after #7286 lands; this PR remains independently based on main and has no dependency on #7276.

Changes

• Keep always-running contract coverage for explicit opt-in, evidence rejection, and the least-privilege Docker boundary.
• Replace the historical runtime plugin-install matrix with one current-image probe of the globally installed openclaw@2026.6.10 graph.
• Require exact installed and shrinkwrap evidence for tar@7.5.19, brace-expansion@5.0.7, @openclaw/fs-safe@0.3.0, and jszip@3.10.1.
• Require the @openclaw/fs-safe optional dependencies to be absent, reject nested vulnerable copies, validate npm ls, and verify the OpenClaw executable resolves to the reviewed installation.
• Run the image probe with no network, a read-only root filesystem, the sandbox identity, no capabilities, no privilege escalation, bounded resources, and no host mounts.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: this changes only an internal, explicitly opt-in image verifier and introduces no user-facing behavior, configuration, API, or documentation route.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable
• Result: Not applicable
• Supporting evidence: Not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — current exact-head contract run: 3 passed with the real-container lane intentionally skipped; current exact-head real-container lane: 4 passed against the exact merged-fix(security): remediate OpenClaw 2026.6.10 transitive dependencies #7286 CI image; an older pre-final image was correctly rejected for its stale wrapper, fs-safe, and lock metadata.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

Additional checks passed: CLI typecheck, exact Vitest project membership, test-title style, source-shape budget, test-file-size budget, Biome, repository checks, and secret scanning.

Merge Dependencies

This is a downstream verifier and does not block #7286 from merging. Human review can proceed now, but this PR must not merge until all items below are complete:

• fix(security): remediate OpenClaw 2026.6.10 transitive dependencies #7286 is merged into main.
• Update this PR on the resulting main and run the opt-in real-container lane against the exact final built image.
• Record the merged fix(security): remediate OpenClaw 2026.6.10 transitive dependencies #7286 SHA, immutable image digest, and passing test evidence before merging this PR.

Final image evidence:

• Merged fix(security): remediate OpenClaw 2026.6.10 transitive dependencies #7286 revision: 2ad613d6e9abc26859b59e5a876ddd0ee40c7ca1
• Exact test(images): add security revision container verifier #7289 head: 48459d489c929076b47b41550b035cc90093bee1
• CI-built image: nemoclaw-production@sha256:a075375409e3c81d248beafe2b627c6bd2ee5ea95f8f36a7b1c0fdb02850bc4c
• OCI revision label: acfa2613c7a645ae1bff21914f25d824e5fbcf62
• Hardened real-container verifier: 4/4 passed (offline, read-only root filesystem, unprivileged sandbox user, no capabilities, no privilege escalation, bounded resources, and no host mounts).

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

• Tests
  • Added a new end-to-end security validation for an OpenClaw container image, selected via target ID and/or explicit opt-in.
  • Enforces that the image is referenced by an immutable digest (rejects non-digest/invalid image values).
  • When enabled, executes verification in a hardened container boundary (offline, read-only, least-privilege, constrained resources) and confirms expected dependency/lockfile integrity, including absence of optional and nested dependencies.
  • Emits and strictly validates structured JSON security evidence, including negative contract checks for tampered results.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds an opt-in Vitest Docker E2E suite that probes an installed OpenClaw image, enforces a hardened container boundary, validates an exact dependency remediation graph, and records structured evidence.

Changes

OpenClaw security revision validation

Layer / File(s)	Summary
Probe contracts and container configuration test/openclaw-security-revision-container-e2e.test.ts	Defines evidence types, validates immutable image configuration, and embeds a verifier for OpenClaw, npm, package, and lockfile inspection.
Hardened execution and evidence assertions test/openclaw-security-revision-container-e2e.test.ts	Builds restricted Docker arguments, parses emitted evidence, and strictly checks expected remediation versions, metadata, and dependency absence.
Opt-in E2E execution and artifact completion test/openclaw-security-revision-container-e2e.test.ts	Tests enablement and boundary contracts, rejects compromised evidence variants, runs the container when enabled, writes evidence, and completes the artifact target.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Vitest
  participant Docker
  participant Verifier
  participant OpenClaw
  participant npm
  participant EvidenceArtifact
  Vitest->>Docker: Run opted-in hardened container
  Docker->>Verifier: Execute embedded probe
  Verifier->>OpenClaw: Run openclaw --version
  Verifier->>npm: Run npm ls
  Verifier-->>Vitest: Return structured evidence
  Vitest->>Vitest: Assert exact remediation graph
  Vitest->>EvidenceArtifact: Write evidence JSON

Loading

Possibly related PRs

• NVIDIA/NemoClaw#7286: Adds the remediation logic and dependency graph validated by this E2E test.
• NVIDIA/NemoClaw#7294: Adds a related opt-in hardened OpenClaw security-revision container E2E test.

Suggested reviewers: ericksoa, jyaunches, cjagwani

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding a security revision container verifier test for images.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/openclaw-security-revision-e2e

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 48459d4 in the codex/openclaw-secur... branch remains at 96%, unchanged from commit d3d5171 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 48459d4 in the codex/openclaw-secur... branch remains at 80%, unchanged from commit d3d5171 in the main branch.

Show a code coverage summary of the most impacted files.

File	main d3d5171	codex/openclaw-secur... 48459d4	+/-
src/lib/state/g...way-registry.ts	95%	94%	-1%
src/lib/sandbox...rce-identity.ts	91%	91%	0%
src/lib/state/m...ock-identity.ts	95%	95%	0%
src/lib/tunnel/services.ts	73%	73%	0%
src/lib/state/m...-acquisition.ts	84%	89%	+5%

---

_{Updated July 21, 2026 19:01 UTC}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/openclaw-security-revision-container-e2e.test.ts`:
- Around line 73-81: Extend ProbeEvidence.shrinkwrap with a jszip: LockedPackage
entry, then update the shrinkwrap probe assertions to validate jszip’s version,
resolved URL, and integrity using the same checks as braceExpansion, fsSafe, and
tar. Preserve the existing root-dependency and other package assertions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 8497cec1-82f0-4e3d-a17f-b2e8633a8ba9

📥 Commits

Reviewing files that changed from the base of the PR and between d5fa194 and cf98ed3.

📒 Files selected for processing (1)

• test/openclaw-security-revision-container-e2e.test.ts

[apurvvkumaria]

Post-#7286 refresh is complete on exact head 7f01b5f6f326fc23dd0fb5281f6585dc4ddcc60e.

• Merged current main append-only with no conflicts.
• Addressed PRA-1 by rejecting optional-dependency metadata on the locked tar, brace-expansion, and jszip entries, with table-driven negative coverage.
• Focused contract run: 3 passed, 1 intentionally skipped.
• Hardened real-container run against nemoclaw-production@sha256:c94bd25b9dbe75b7194f6cd9561af913f5c64ae886612a9cdfb73d3ec8b1218e: 4/4 passed.
• Both new commits are GitHub Verified and DCO is green.

Current-head CI and human review remain in progress; there are no unresolved review threads.

[apurvvkumaria]

Latest-head validation complete for 48459d489c929076b47b41550b035cc90093bee1 after the immutable-image-reference hardening.

• GitHub CI: 37 passed, 17 skipped, 0 failed.
• No unresolved review threads.
• Hardened exact-image verifier against the merged fix(security): remediate OpenClaw 2026.6.10 transitive dependencies #7286 digest: 4/4 passed.
• The verifier also failed closed during one transient local npm ls child-process spawn failure; one controlled rerun passed, confirming no dependency-graph regression.

This head is conflict-free and mergeable; human approval is the remaining gate.

[cjagwani]

Security review complete. Exact head 48459d4 requires an immutable named @sha256 image reference, runs offline/read-only as the sandbox user with all capabilities dropped, no privilege escalation, bounded CPU/memory/PIDs/files, and no host mounts or Docker socket. The exact self-hosted CI image nemoclaw-production@sha256:a075375409e3c81d248beafe2b627c6bd2ee5ea95f8f36a7b1c0fdb02850bc4c (OCI revision acfa261) passed 4/4 live verifier cases. All 53 current checks are green; DCO and all commits are verified.

[senthilr-nv]

Reviewed the exact current head and base. Product scope, security, CI, contributor, and test gates pass.