fix(images): preserve managed runtime bundle permissions

[apurvvkumaria]

Summary

Restore the required root-owned, immutable 0444 mode for the reviewed managed-startup runtime bundle in every managed agent image. The repair uses each final image's existing permission replay so legacy builders remain supported and promotion continues to fail closed.

This repair blocks clean trusted main and therefore blocks publication of the draft-only trust-root bootstrap. It does not directly qualify #8616 or #8617.

Changes

• Require the managed-startup runtime bundle to be a regular, non-link file in the OpenClaw, Hermes, and Deep Agents Code final images.
• Replay root:root ownership and mode 0444, then require the final numeric stat to be 0:0:444.
• Preserve the reviewed bundle bytes, original builder-stage copy provenance, legacy-builder compatibility, six-variant validation, and aggregate promotion barrier.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification: The supported managed-image workflow validator checks regular-file, non-link, and 0:0:444 invariants for all six agent/architecture candidates before aggregate promotion. Focused image-layout and workflow contracts passed for this commit.
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This restores an existing internal image artifact invariant and changes no command, configuration, default, documented workflow, or supported surface.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Fresh independent correctness/security review of commit 591550ad54cc43b7b18982712b16d40902f41a29 passed all nine security categories with no findings.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Commit 591550a restores the existing root-owned, read-only managed-image runtime artifact contract in three Dockerfiles. It changes no command, configuration, default, documented workflow, or supported surface.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 47 focused image/layout/workflow tests passed; the targeted Deep Agents Code compatibility contract passed.
• Applicable broad gate passed — Not applicable to this three-Dockerfile permission repair; npm run checks:repository, Dockerfile lint, reviewed-bundle verification, and the source-shape audit passed.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

Final resolution still requires the first automatic exact-main managed-image run after external merge to pass all six validation jobs and artifact receipts. No manual E2E run was dispatched.

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Strengthened container image validation to ensure the managed startup runtime is present as a regular, non-symlink file.
  • Confirmed the runtime file is root-owned and has read-only permissions before startup checks complete.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5a4e05e6-49b4-4b3a-8bd6-775cafdc02df

📥 Commits

Reviewing files that changed from the base of the PR and between 6514e72 and 591550a.

📒 Files selected for processing (3)

• Dockerfile
• agents/hermes/Dockerfile
• agents/langchain-deepagents-code/Dockerfile

---

📝 Walkthrough

Walkthrough

The Dockerfiles now validate that managed-startup-image-runtime.cjs is a regular, non-symlink file owned by root with read-only 0444 permissions.

Changes

Startup artifact integrity

Layer / File(s)	Summary
Runtime image artifact validation Dockerfile, agents/hermes/Dockerfile, agents/langchain-deepagents-code/Dockerfile	Final-image checks validate the managed startup runtime bundle’s presence, regular-file status, root ownership, and exact 0444 permissions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: area: security

Suggested reviewers: ericksoa, cv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: preserving the managed runtime bundle permissions in container images.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-managed-image-bundle-permissions

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 591550a in the codex/fix-managed-im... branch remains at 96%, unchanged from commit 6514e72 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 591550a in the codex/fix-managed-im... branch remains at 81%, unchanged from commit 6514e72 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 6514e72	codex/fix-managed-im... 591550a	+/-
src/lib/policy/...scope-render.ts	97%	94%	-3%
src/lib/policy/index.ts	63%	62%	-1%
src/lib/actions...idge-destroy.ts	83%	83%	0%
src/lib/sandbox...rce-identity.ts	84%	84%	0%
src/lib/onboard...carryforward.ts	88%	96%	+8%
src/lib/policy/...ateway-state.ts	56%	73%	+17%

---

_{Updated August 09, 2026 05:03 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite against this exact revision.

Recommended E2E: cloud-onboard, full-e2e, hermes-e2e, hermes-inference-switch, managed-image-multiarch-startup, security-posture, ubuntu-repo-cloud-langchain-deepagents-code

1 optional E2E recommendation

• managed-image-protected-runtime

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.