chore(openshell): trust v0.0.99 release manifests

[apurvvkumaria]

Summary

Extend the base-owned OpenShell release-manifest trust allowlist to v0.0.99. This prerequisite lets a later selector PR verify the published CLI, gateway, and sandbox checksum manifests without letting proposed branch code authorize its own release identities.

Related Issue

Part of #8497

Changes

• Add the independently verified SHA-256 identity for the v0.0.99 CLI checksum manifest.
• Add the independently verified SHA-256 identity for the v0.0.99 gateway checksum manifest.
• Add the independently verified SHA-256 identity for the v0.0.99 sandbox checksum manifest.
• Add focused behavioral coverage using the published v0.0.99 manifests and asset digests.
• Keep all OpenShell version selectors and consumed artifact pins at v0.0.85 for the separate qualification and selector workstream.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior — test/installer-hash-check.test.ts selects v0.0.99, validates the three reviewed manifest identities, and checks the consumed assets against the published contents.
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: this prerequisite does not change the v0.0.85 selectors, commands, configuration, defaults, or supported runtime behavior. Documenting v0.0.99 now would imply support before qualification completes.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: chore(openshell): trust v0.0.99 release manifests #8499 (comment) — security review passed; the three published manifest digests matched and the focused suite passed.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Commit 345ff9056 is refreshed onto current main; the PR-relative diff adds the three trust identities and published-manifest coverage. Runtime selectors remain v0.0.85, so the change has no user-facing behavior to document.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project integration test/installer-hash-check.test.ts passed 77 tests; source-shape and test-title gates passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

• New Features
  • Added support for verifying OpenShell release 0.0.99 installer downloads against trusted SHA-256 checksums.

[coderabbitai]

📝 Walkthrough

Walkthrough

The installer hash allowlist and verification fixtures now support OpenShell release 0.0.99. Tests validate the standard, gateway, and sandbox manifest digests and version-specific asset verification.

Changes

OpenShell release trust

Layer / File(s)	Summary
Add release manifest digests scripts/check-installer-hash.sh	The allowlist includes three SHA-256 manifest digests for OpenShell 0.0.99.
Add version-specific verification fixtures test/installer-hash-check.test.ts	Fixtures select version-specific manifests, asset digests, and Homebrew formula digests. Tests verify trusted OpenShell 0.0.99 installation data.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• NVIDIA/NemoClaw issue 8497 — Covers OpenShell 0.0.99 checksum allowlist entries and verification fixtures.

Suggested reviewers: cv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding trusted OpenShell v0.0.99 release manifest digests.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/8497-trust-openshell-v099

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions differ; normalized E2E selections differ; severity counts match.

1 additional E2E selection from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

• bootstrap-install-smoke: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

1 semantic terminology decision

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• replace — release manifest at test/installer-hash-check.test.ts:999: Change the test title to `accepts trusted OpenShell 0.0.99 release manifests (chore(openshell): trust v0.0.99 release manifests #8499)`.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite against this exact revision.

Recommended E2E: managed-image-multiarch-startup

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[apurvvkumaria]

Security review completed for the current branch revision.

• Scope: the three new base-owned OpenShell v0.0.99 release-manifest trust identities in scripts/check-installer-hash.sh.
• Provenance: each added SHA-256 value matches GitHub’s published digest for the corresponding v0.0.99 CLI, gateway, and sandbox checksum-manifest asset. The release tag resolves to a GitHub-verified upstream commit.
• Boundary behavior: selectors remain on v0.0.85; this prerequisite does not let proposed branch code authorize the later selector change. The trusted checker still requires exactly one identity for each of the three manifest classes and fails closed for an untrusted release.
• Validation: npx vitest run --project integration test/installer-hash-check.test.ts — 76/76 passed.
• Findings: none. No secrets, credential handling, egress policy, privilege boundary, or runtime behavior changed.

Security review result: pass.

[apurvvkumaria]

CI follow-up for PR exact all-agent managed runtime activation:

• Attempt 1 and a complete attempt 3 both reproduced the same OpenShell 0.0.85 OpenClaw bootstrap failure: the existing managed sandbox replacement reported undeclared Docker inspect deltas at Config.AttachStderr, Config.AttachStdout, and HostConfig.PortBindings.
• Attempt 3 rebuilt and published all three exact managed-image contracts. OpenClaw, Hermes, and Deep Agents Code direct startup jobs all passed before the activation consumer reproduced the failure.
• PR chore(openshell): trust v0.0.99 release manifests #8499 changes only three dormant v0.0.99 checksum-manifest allowlist entries. It does not change runtime code, images, selectors, Docker normalization, onboarding, or the v0.0.85 execution path.
• The failed job completed its registered-resource cleanup.

No branch change is justified for this failure. Maintainer disposition is needed for this unrelated non-success check.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit f0c0ad4 in the codex/8497-trust-ope... branch remains at 96%, unchanged from commit eabbc15 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit f0c0ad4 in the codex/8497-trust-ope... branch remains at 81%, unchanged from commit eabbc15 in the main branch.

Show a code coverage summary of the most impacted files.

File	main eabbc15	codex/8497-trust-ope... f0c0ad4	+/-
src/lib/platform.ts	89%	84%	-5%
src/lib/shields...nsition-lock.ts	84%	83%	-1%
src/lib/state/m...-acquisition.ts	86%	85%	-1%
src/lib/inferen...ompatibility.ts	94%	94%	0%
src/lib/messagi...nnels/policy.ts	100%	100%	0%
src/lib/messagi...an-authority.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	87%	87%	0%
src/lib/shields...imer-control.ts	93%	93%	0%
src/lib/state/m...ock-identity.ts	94%	94%	0%
src/lib/policy/...ne-exclusion.ts	92%	96%	+4%

---

_{Updated August 07, 2026 03:29 UTC}

[senthilr-nv]

Conditional approval of 01036dda4: the published v0.0.99 manifest hashes and product scope are verified. Before merge, add exact regression coverage for the new trust anchors, refresh onto current main, and require the current-head/base merge gate to pass. Peer maintainer to verify these conditions.

[coderabbitai]

🧹 Nitpick comments (1)

test/installer-hash-check.test.ts (1)

999-999: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Remove the PR number from the test title.

#8499 is identified as a pull request, not a local issue. Remove the suffix unless a local issue #8499 exists.

Proposed change

-  it("accepts the reviewed OpenShell 0.0.99 release manifests (`#8499`)", () => {
+  it("accepts trusted OpenShell 0.0.99 release manifests", () => {

Based on learnings: only append a (#1234) suffix when it references a real local issue, not a pull request.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/installer-hash-check.test.ts` at line 999, Update the test title in the
`it` block for the reviewed OpenShell 0.0.99 release manifests to remove the
`(`#8499`)` suffix, leaving the release description unchanged.

Sources: Coding guidelines, Learnings

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/installer-hash-check.test.ts`:
- Line 999: Update the test title in the `it` block for the reviewed OpenShell
0.0.99 release manifests to remove the `(`#8499`)` suffix, leaving the release
description unchanged.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2da02eb0-90c6-4a7a-80c4-1e1aabf0a4b9

📥 Commits

Reviewing files that changed from the base of the PR and between 01036dd and 8bdc45e.

📒 Files selected for processing (1)

• test/installer-hash-check.test.ts

[apurvvkumaria]

Security review refresh: PASS for the current branch revision 8bdc45e.

Scope reviewed: the new test fixture carries the published OpenShell 0.0.99 CLI, gateway, and sandbox checksum-manifest contents and exercises them through the base-owned installer-hash checker. The test confirms that the fixture contents resolve to the three reviewed release-asset identities already added by this PR. Runtime selectors and consumed production pins remain on 0.0.85, and the follow-up adds no credential, network-policy, command-execution, or privilege boundary.

Validation: 77 installer-hash tests passed, including the 0.0.99 selection and all three manifest checks; Biome, test-title, and diff checks passed. The follow-up commit is signed off and GitHub Verified.

[senthilr-nv]

Approved at 345ff9056. The addressed regression test selects the published OpenShell v0.0.99 manifests and verifies all three trust identities; independent hashes match and the focused suite passes 77/77. Refresh onto current main and require the current-head/base merge gate before merge.

[apurvvkumaria]

Follow-up #8524 addresses the remaining terminology feedback by describing the OpenShell 0.0.99 release manifests as allowlisted. The existing local reference remains in the final suffix position accepted by the repository title-style gate; the focused installer-hash suite passes all 77 cases.