[Linux][Sandbox] nemoclaw rebuild accepts corrupted backup manifest without validation and completes successfully

Description

`nemoclaw {sandbox} rebuild --yes` silently accepts a corrupted backup manifest (rebuild receipt) and completes the rebuild successfully with exit 0. No integrity validation of the backup manifest is performed before proceeding. A backup receipt that has been corrupted, truncated, or tampered with produces a successful rebuild indistinguishable from a valid one, undermining the integrity guarantees of `backup-all`.


Platform scope: Reproduced on Linux x86_64 (Ubuntu 24.04); other platforms not tested.

Regression: Unknown — not verified on earlier versions.

OpenShell issue: No

Environment

Device:        Ubuntu 24.04 x86_64 server

OS:            Ubuntu 24.04.4 LTS

Architecture:  x86_64

Node.js:       v22.23.1

npm:           10.9.2

Docker:        29.6.1

OpenShell CLI: 0.0.101

NemoClaw:      v0.0.111

OpenClaw:      2026.7.1

Steps to Reproduce

1. Onboard a sandbox and run backup-all:

   nemoclaw onboard --name backup-locked --yes

   nemoclaw backup-all

2. Locate the backup receipt:

   ls ~/.nemoclaw/rebuild-backups/backup-locked/

3. Corrupt the receipt by appending invalid content:

   echo "CORRUPTED_CONTENT_INVALID" >> ~/.nemoclaw/rebuild-backups/backup-locked/{receipt-file}

4. Run: nemoclaw backup-locked rebuild --yes; echo "EXIT:$?"

Expected Result

Rebuild exits non-zero with a clear error message indicating the backup manifest is invalid or corrupt.

No rebuild proceeds when the integrity of the backup receipt cannot be verified.

Actual Result

Rebuild completes successfully with exit 0.

The corrupted manifest content is silently ignored.

No warning or error about the invalid receipt content appears.

The sandbox rebuilds as if the receipt were valid.

EXIT:0

Logs

$ echo "CORRUPTED_CONTENT_INVALID" >> ~/.nemoclaw/rebuild-backups/backup-locked/rebuild-manifest.json

$ nemoclaw backup-locked rebuild --yes

[Rebuild output: completes normally with no error]

$ echo $?

0

The sandbox is rebuilt and reaches Ready state despite the corrupted manifest.