Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps

## Summary

After the first NemoClaw release tag containing #5595 is published, close the accepted residual trust, runtime-proof, and compatibility-debt gaps from the OpenClaw 2026.6.9 integration.

This is a post-tag tracking issue, not a blocker for the initial tag. Work may land through focused PRs, but must remain limited to the boundaries below.

## Existing trackers and non-duplication boundaries

- #5853 owns Microsoft Teams group-chat allowlist documentation/onboarding. This issue must not redesign or duplicate `groupAllowFrom` / `groupPolicy`.
- #5847 owns removal of the Teams policy preset when the channel is stopped.
- #5367 and #3948 own the existing Brave build/runtime defects.
- #4052 owns release-pinned base-image refs; #4271 owns the legacy blueprint image contract; #4680 owns base-image resolution caching.
- #5242 owns centralized dependency pins and canary workflow design.
- #2213, #3006, and #5492 own WeChat and broader messaging capability.
- #4533 is the historical onboard FSM/resume compatibility boundary for the rebuild shim.
- #5735 and merged PRs #5879 and #5897 are the immediate history for fail-closed stale rebuild endpoint handling and the current typed double-onboard assertion boundary.
- Closed issues #1252, #4434, #4687, #5122, #4730, #4821, and #5414 provide behavior and patch-removal history.

## Scope

### 1. Real Microsoft Teams tenant round trip

- [ ] Add a tenant-owned secret lane and runbook using real Bot Framework app credentials and public HTTPS ingress to the sandbox `/api/messages`.
- [ ] Originate a live DM from an allowlisted Entra user, observe the sandbox agent reply in the same Teams conversation, and retain sanitized evidence.
- [ ] Do not count manifest rendering, package integrity, local forwarding, or replay of captured activity JSON as a tenant round trip.
- [ ] Keep group-chat allowlist behavior entirely in #5853.

### 2. Reviewed npm archive installer and audit gate

- [ ] Replace duplicated archive-install logic with one reviewed implementation or shared library plus thin Docker/TypeScript wrappers.
- [ ] Preserve exact package spec, reviewed tarball URL, SRI verification, `npm pack --json` filename containment, and install-from-local-archive behavior for OpenClaw, Codex ACP, optional plugins, and messaging plugins.
- [ ] Keep malicious filename, integrity drift, and registry drift regression tests at every caller boundary.
- [ ] Add a default CI gate that materializes the exact reviewed dependency graph under a production-compatible Node version, runs `npm audit --omit=dev --json`, uploads the report, and fails at the agreed severity threshold. Coordinate pin ownership with #5242.

### 3. Default CI proof for optional OTEL and Brave paths

- [ ] Add non-skipped CI image variants with `NEMOCLAW_OPENCLAW_OTEL=1` and `NEMOCLAW_WEB_SEARCH_ENABLED=1`.
- [ ] Prove the pinned plugins install from verified local archives, register, and leave the gateway healthy.
- [ ] Send an OTEL span to a hermetic collector through the narrowly scoped host-gateway policy.
- [ ] Exercise Brave tool invocation and credential rewrite against a hermetic or controlled endpoint.
- [ ] Keep both product features opt-in. Root-cause fixes remain in #5367 and #3948; this issue owns making the resulting proof routine.

### 4. Clear the full messaging plan from final image/runtime ENV

- [ ] Treat `NEMOCLAW_MESSAGING_PLAN_B64` as an ephemeral build input only.
- [ ] Ensure OpenClaw and Hermes final image `Config.Env` and running process environments do not contain the full serialized plan.
- [ ] Retain only the validated reduced runtime-plan artifact and explicitly allowlisted runtime fields.
- [ ] Add `docker inspect` and container-runtime regressions proving the full payload is absent without breaking onboard, rebuild, or resume behavior.
- [ ] Preserve the secret-handling posture established by #1741.

### 5. Enforce base-image provenance trust

- [ ] Define the production/release trust policy for remote sandbox base images: expected NVIDIA GHCR repository, immutable resolved digest, and recorded publisher/workflow provenance where supported.
- [ ] Fail closed when a production build receives an unexpected repository, an unresolved floating ref, or provenance that does not satisfy policy.
- [ ] Permit a local base only when it is built from the current checkout and record that source distinctly.
- [ ] Emit the selected ref, platform digest, source, and verification result as CI evidence.
- [ ] Do not duplicate release-tag publication in #4052, blueprint cleanup in #4271, or cache policy in #4680.

### 6. Lock and audit the WeChat dependency graph

- [ ] Make the actual `@tencent-weixin/openclaw-weixin` installation consume a NemoClaw-owned locked and integrity-reviewed transitive graph, unless the upstream artifact begins shipping an acceptable internal shrinkwrap.
- [ ] Audit the same graph that is installed; an advisory lockfile unused by the installer is insufficient.
- [ ] Require deliberate lock refresh, review evidence, and CI audit on package bumps.
- [ ] Keep WeChat feature expansion outside this issue.

### 7. Upstream and retire compiled-dist patches

- [ ] Inventory every OpenClaw compiled-dist mutation still capable of writing, including fetch/proxy patches, plugin-install symlink handling, handshake timeout, chat correlation, and #4434 diagnostics.
- [ ] Give each patch an upstream issue/PR or document why a generic upstream policy hook is required instead of a NemoClaw-specific behavior.
- [ ] Run an unpatched upstream canary on relevant OpenClaw bumps using the same hermetic and live assertions.
- [ ] Remove each patch, recognizer, and obsolete fixture in the same change once unpatched upstream behavior passes. Do not weaken assertions merely to retire a patch.
- [ ] Keep the real-dist harness as a default gate while any compiled-dist mutation remains.

### 8. Remove the rebuild-resume compatibility shim

- [ ] Add a session-version migration or producer-level invariant proving recreate sessions are persisted at a resumable pre-sandbox boundary.
- [ ] Cover fresh, legacy, failed, and reopened-complete rebuild/resume sessions.
- [ ] Delete `rewindSessionForRebuildResume` and its compatibility-only branches once those producer/migration tests pass.
- [ ] Preserve registry-derived provider, endpoint, agent, and messaging state.
- [ ] Link closure evidence back to #4533.

### 9. Close remaining review polish from #5595

- [ ] Make the missing-`OPENCLAW_VERSION` package-install error name the required build argument or environment input, with a focused regression.
- [ ] Replace the positional `openclaw --version | awk '{print $2}'` parser with validated semantic-version extraction and cover harmless output decoration plus malformed output.
- [ ] Preserve the existing newer-than-reviewed fail-closed test while changing version parsing.
- [ ] Remove or wire the test-only `parseRestoreArgs` snapshot restore parser after confirming intended CLI ownership; delete its orphan tests if the parser is dead.
- [ ] Retire the legacy OpenClaw 2026.3.11 and 2026.4.24 E2E fixture pins, opt-in build arg, and production guard once stale-upgrade/rebuild lanes no longer require locally built old bases; keep the fail-closed guard until those tests use a replacement fixture strategy.

- [ ] Document the `NEMOCLAW_TOOL_CATALOG=0` emergency rollback switch in the dependency review, including scope and removal criteria.

### 10. Make stale custom-endpoint rebuild recovery internally consistent

- [ ] Persist the canonical custom endpoint URL, credential env name, preferred inference API, and compatible-endpoint reasoning mode in each sandbox registry entry; reject userinfo and strip query/fragment material before persistence.
- [ ] Thread the already-resolved provider-flow selection into the atomic `registerCreatedSandbox` payload. Do not drop the sandbox-name guard on session-derived selection or write `session.sandboxName` before creation, because either would weaken sibling-sandbox and interrupted-onboard isolation.
- [ ] Keep `prepareRebuildResumeConfig` fail-closed when the target sandbox has neither durable endpoint metadata nor its own matching onboard session. Never borrow an endpoint from another sandbox's session or ambient env.
- [ ] Make the printed recovery command actionable when the only loaded onboard session belongs to a sibling sandbox; rebuilding the target directly must load target-owned durable state or explain the exact missing metadata.
- [ ] Tighten `assertRegistryInferenceMetadata` in `double-onboard.test.ts`: do not substitute the expected value when `endpointUrl`, `credentialEnv`, or `preferredInferenceApi` is absent.
- [ ] Rerun `double-onboard-vitest` and require the stale direct-OpenShell-delete recovery phase to pass, in addition to the shell lane's 52/52 gateway/re-onboard assertions.
- [ ] Preserve the current no-data-loss boundary: failed preflight must occur before backup/delete/recreate mutation.

## Acceptance criteria

- [ ] The initial release tag containing #5595 exists before implementation is treated as required release work.
- [ ] Every scope section above has a merged PR or explicit linked disposition.
- [ ] Default CI covers archive/audit, optional-plugin, full-plan absence, and base-provenance contracts.
- [ ] Tenant-owned Teams evidence proves a real message and reply without exposing credentials or activity payloads.
- [ ] The WeChat graph installed in production is the graph reviewed by CI.
- [ ] Remaining compiled-dist patches and compatibility shims have explicit, testable removal triggers.
- [ ] A stale custom-endpoint sandbox can be rebuilt while a sibling sandbox owns the current onboard session, with strict registry assertions and no ambient/session endpoint borrowing.
- [ ] The OpenClaw 2026.6.9 dependency review is updated as each accepted residual risk is closed.

## Non-goals

- Blocking or widening the initial #5595 release.
- Teams group allowlist work from #5853.
- Teams stop/policy cleanup from #5847.
- Reimplementing Brave defect fixes tracked by #5367 or #3948.
- General dependency-manifest redesign from #5242.
- Base-image tag publication, caching redesign, or blueprint migration.
- New messaging channels or WeChat product features.