test(e2e): finish sandbox image suite migration

.github/workflows/e2e.yaml

@@ -4540,6 +4540,36 @@ jobs:
             "${NEMOCLAW_PROTECTED_MANAGED_IMAGE_EVIDENCE}.tmp" \
             "$NEMOCLAW_PROTECTED_MANAGED_IMAGE_EVIDENCE"
 
+      - name: Validate protected managed-image evidence
+        shell: bash
+        run: >-
+          npx tsx tools/e2e/live-vitest-invocation.mts run --test-path test/e2e/live/managed-image-multiarch-startup.test.ts
+
+      - name: Validate OpenClaw managed-image security boundary
+        shell: bash
+        run: >-
+          npx tsx tools/e2e/live-vitest-invocation.mts run --test-path test/e2e/live/managed-image-openclaw-security.test.ts
+
+      - name: Validate managed-image glibc probe lifecycle
+        shell: bash
+        run: |
+          set -euo pipefail
+          export NEMOCLAW_RUN_GLIBC_PROBE_DOCKER_E2E=1
+          NEMOCLAW_TEST_IMAGE="$(jq -er '.[] | select(.agent == "openclaw") | .reference' "$NEMOCLAW_PROTECTED_MANAGED_IMAGE_CONTRACT")"
+          export NEMOCLAW_TEST_IMAGE
+          npx vitest run --project integration test/e2e-runtime/image-compatibility-docker-lifecycle.test.ts --silent=false --reporter=default --reporter=test/e2e/risk-signal-reporter.ts
+
+      - name: Publish exact amd64 protected runtime build cache
+        if: ${{ matrix.platform == 'linux/amd64' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ env.NEMOCLAW_PROTECTED_MANAGED_IMAGE_BUILD_CACHE_ARTIFACT }}
+          path: ${{ env.NEMOCLAW_PROTECTED_MANAGED_IMAGE_BUILD_CACHE }}/
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0
+          overwrite: true
+
       - name: Remove isolated protected managed-image registry
         if: always()
         shell: bash
@@ -4566,22 +4596,6 @@ jobs:
             exit 1
           fi
 
-      - name: Validate protected managed-image evidence
-        shell: bash
-        run: >-
-          npx tsx tools/e2e/live-vitest-invocation.mts run --test-path test/e2e/live/managed-image-multiarch-startup.test.ts
-
-      - name: Publish exact amd64 protected runtime build cache
-        if: ${{ matrix.platform == 'linux/amd64' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: ${{ env.NEMOCLAW_PROTECTED_MANAGED_IMAGE_BUILD_CACHE_ARTIFACT }}
-          path: ${{ env.NEMOCLAW_PROTECTED_MANAGED_IMAGE_BUILD_CACHE }}/
-          if-no-files-found: error
-          retention-days: 1
-          compression-level: 0
-          overwrite: true
-
       - name: Upload protected managed-image evidence
         if: always()
         uses: NVIDIA/NemoClaw/.github/actions/upload-e2e-artifacts@7768e15eb90d3ee2d33432f481dfe8747e4f6d57

.github/workflows/main.yaml

@@ -348,7 +348,7 @@ jobs:
       - real-openclaw-dist-harness
       - cli-tests
       - plugin-tests
-      - sandbox-images-and-e2e
+      - sandbox-image-contracts
     if: always()
     permissions:
       actions: read
@@ -366,7 +366,7 @@ jobs:
           CLI_TESTS_RESULT: ${{ needs['cli-tests'].result }}
           GH_TOKEN: ${{ github.token }}
           PLUGIN_TESTS_RESULT: ${{ needs['plugin-tests'].result }}
-          SANDBOX_IMAGES_E2E_RESULT: ${{ needs['sandbox-images-and-e2e'].result }}
+          SANDBOX_IMAGE_CONTRACTS_RESULT: ${{ needs['sandbox-image-contracts'].result }}
           RUN_ATTEMPT: ${{ github.run_attempt }}
           RUN_ID: ${{ github.run_id }}
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
@@ -404,7 +404,7 @@ jobs:
             local job_id=""
             dependency_url="$RUN_URL"
             case "$name" in
-              static-checks|build-typecheck|installer-integration|wechat-runtime-audit|reviewed-npm-audit|real-openclaw-dist-harness|cli-tests|plugin-tests|sandbox-images-and-e2e) ;;
+              static-checks|build-typecheck|installer-integration|wechat-runtime-audit|reviewed-npm-audit|real-openclaw-dist-harness|cli-tests|plugin-tests|sandbox-image-contracts) ;;
               *) return ;;
             esac
             load_job_listing
@@ -447,13 +447,13 @@ jobs:
           require_success "real-openclaw-dist-harness" "$REAL_OPENCLAW_DIST_HARNESS_RESULT"
           require_success "cli-tests" "$CLI_TESTS_RESULT"
           require_success "plugin-tests" "$PLUGIN_TESTS_RESULT"
-          require_success "sandbox-images-and-e2e" "$SANDBOX_IMAGES_E2E_RESULT"
+          require_success "sandbox-image-contracts" "$SANDBOX_IMAGE_CONTRACTS_RESULT"
 
           [ "$failed" -eq 0 ]
 
-  sandbox-images-and-e2e:
+  sandbox-image-contracts:
     needs: [static-checks, build-typecheck]
-    uses: ./.github/workflows/sandbox-images-and-e2e.yaml
+    uses: ./.github/workflows/sandbox-images.yaml
     secrets:
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
       DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/pr-self-hosted.yaml

@@ -204,21 +204,8 @@ jobs:
           scripts/check-production-build-args.sh "${build_args[@]}"
           docker build "${build_args[@]}" -t nemoclaw-production .
 
-      - name: Build sandbox test image (fixtures layered on production)
-        run: docker build -f test/Dockerfile.sandbox --build-arg BASE_IMAGE=nemoclaw-production -t nemoclaw-sandbox-test .
-
-      - name: Save images to tarballs
-        run: |
-          docker save nemoclaw-sandbox-test | gzip > /tmp/sandbox-test-image.tar.gz
-          docker save nemoclaw-production | gzip > /tmp/isolation-image.tar.gz
-
-      - name: Upload sandbox test image
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: sandbox-test-image
-          path: /tmp/sandbox-test-image.tar.gz
-          retention-days: 1
-          if-no-files-found: error
+      - name: Save production image
+        run: docker save nemoclaw-production | gzip > /tmp/isolation-image.tar.gz
 
       - name: Upload isolation image
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -249,35 +236,16 @@ jobs:
           scripts/check-production-build-args.sh "${build_args[@]}"
           docker build "${build_args[@]}" -t nemoclaw-production-arm64 .
 
-      - name: Build sandbox test image on arm64
-        run: docker build -f test/Dockerfile.sandbox --build-arg BASE_IMAGE=nemoclaw-production-arm64 -t nemoclaw-sandbox-test-arm64 .
-
-  test-e2e-sandbox:
-    runs-on: linux-amd64-cpu4
-    timeout-minutes: 15
-    needs: build-sandbox-images
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Download image artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: sandbox-test-image
-          path: /tmp
-
-      - name: Load image
-        run: gunzip -c /tmp/sandbox-test-image.tar.gz | docker load
-
-      - name: Run sandbox E2E tests
-        run: docker run --rm -v "${{ github.workspace }}/test:/opt/test" nemoclaw-sandbox-test /opt/test/e2e-test.sh
 
-  test-e2e-gateway-isolation:
+  managed-image-openclaw-security:
     runs-on: linux-amd64-cpu4
-    timeout-minutes: 15
+    timeout-minutes: 10
     needs: build-sandbox-images
+    env:
+      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/managed-image-openclaw-security
+      E2E_TARGET_ID: managed-image-openclaw-security
+      NEMOCLAW_RUN_LIVE_E2E: "1"
+      NEMOCLAW_TEST_IMAGE: nemoclaw-production
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -291,7 +259,7 @@ jobs:
           cache: npm
 
       - name: Install root dependencies
-        run: npm ci --ignore-scripts
+        run: npm ci --ignore-scripts --no-audit --no-fund
 
       - name: Download image artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -300,20 +268,24 @@ jobs:
           path: /tmp
 
       - name: Load image
-        run: |
-          gunzip -c /tmp/isolation-image.tar.gz | docker load
-          docker image inspect nemoclaw-production >/dev/null
+        run: gunzip -c /tmp/isolation-image.tar.gz | docker load
+
+      - name: Validate OpenClaw managed-image security boundary
+        run: >-
+          npx tsx tools/e2e/live-vitest-invocation.mts run --test-path test/e2e/live/managed-image-openclaw-security.test.ts
 
-      - name: Run glibc probe lifecycle regression
+      - name: Validate glibc probe lifecycle
         env:
           NEMOCLAW_RUN_GLIBC_PROBE_DOCKER_E2E: "1"
-          NEMOCLAW_TEST_IMAGE: nemoclaw-production
-        run: npx vitest run --project integration test/e2e-runtime/image-compatibility-docker-lifecycle.test.ts --silent=false --reporter=default
+        run: >-
+          npx vitest run --project integration test/e2e-runtime/image-compatibility-docker-lifecycle.test.ts
+          --silent=false --reporter=default --reporter=test/e2e/risk-signal-reporter.ts
 
-      - name: Run gateway isolation E2E tests
-        run: NEMOCLAW_TEST_IMAGE=nemoclaw-production bash test/e2e-gateway-isolation.sh
+      - name: Upload OpenClaw managed-image security evidence
+        if: ${{ always() }}
+        uses: ./.github/actions/upload-e2e-artifacts
 
-  test-e2e-port-overrides:
+  port-override-image-contract:
     runs-on: linux-amd64-cpu4
     timeout-minutes: 10
     needs: build-sandbox-images

.github/workflows/sandbox-images-and-e2e.yaml → .github/workflows/sandbox-images.yaml

@@ -1,7 +1,7 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-name: Images / Build and Test Sandbox Images
+name: Images / Sandbox Image Contracts
 
 on:
   # Manual dispatch is the branch-validation path. Non-main refs set
@@ -96,27 +96,11 @@ jobs:
           scripts/check-production-build-args.sh "${build_args[@]}"
           docker build "${build_args[@]}" -t nemoclaw-production .
 
-      - name: Build sandbox test image (fixtures layered on production)
-        run: docker build -f test/Dockerfile.sandbox --build-arg BASE_IMAGE=nemoclaw-production -t nemoclaw-sandbox-test .
+      - name: Save production image
+        run: docker save nemoclaw-production | gzip > /tmp/isolation-image.tar.gz
 
-      - name: Save images to tarballs
-        run: |
-          set -euo pipefail
-          docker save nemoclaw-sandbox-test | gzip > /tmp/sandbox-test-image.tar.gz
-          docker save nemoclaw-production | gzip > /tmp/isolation-image.tar.gz
-
-      - name: Verify tarballs
-        run: |
-          gzip -t /tmp/sandbox-test-image.tar.gz
-          gzip -t /tmp/isolation-image.tar.gz
-
-      - name: Upload sandbox test image
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: sandbox-test-image
-          path: /tmp/sandbox-test-image.tar.gz
-          retention-days: 1
-          if-no-files-found: error
+      - name: Verify production image archive
+        run: gzip -t /tmp/isolation-image.tar.gz
 
       - name: Upload isolation image
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -438,37 +422,23 @@ jobs:
           scripts/check-production-build-args.sh "${build_args[@]}"
           docker build "${build_args[@]}" -t nemoclaw-production-arm64 .
 
-      - name: Build sandbox test image on arm64
-        run: docker build -f test/Dockerfile.sandbox --build-arg BASE_IMAGE=nemoclaw-production-arm64 -t nemoclaw-sandbox-test-arm64 .
 
       - name: Clean up Docker auth
         if: always()
         shell: bash
         run: bash .github/scripts/docker-auth-cleanup.sh
 
-  test-e2e-sandbox:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    needs: build-sandbox-images
-    steps:
-      - *checkout
-
-      - name: Download image artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: sandbox-test-image
-          path: /tmp
-
-      - name: Load image
-        run: gunzip -c /tmp/sandbox-test-image.tar.gz | docker load
-
-      - name: Run sandbox E2E tests
-        run: docker run --rm -v "${{ github.workspace }}/test:/opt/test" nemoclaw-sandbox-test /opt/test/e2e-test.sh
-
-  test-e2e-gateway-isolation:
+  runtime-overrides:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    # The live target owns 45 minutes; retain 15 minutes for setup, image
+    # transfer, and the always-running artifact upload.
+    timeout-minutes: 60
     needs: build-sandbox-images
+    env:
+      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/runtime-overrides
+      E2E_TARGET_ID: runtime-overrides
+      NEMOCLAW_RUN_LIVE_E2E: "1"
+      NEMOCLAW_TEST_IMAGE: nemoclaw-production
     steps:
       - *checkout
 
@@ -490,49 +460,46 @@ jobs:
           gunzip -c /tmp/isolation-image.tar.gz | docker load
           docker image inspect nemoclaw-production >/dev/null
 
-      - name: Run glibc probe lifecycle regression
-        env:
-          NEMOCLAW_RUN_GLIBC_PROBE_DOCKER_E2E: "1"
-          NEMOCLAW_TEST_IMAGE: nemoclaw-production
-        run: npx vitest run --project integration test/e2e-runtime/image-compatibility-docker-lifecycle.test.ts --silent=false --reporter=default
+      - name: Run runtime overrides test against production image
+        timeout-minutes: 45
+        run: |
+          npx vitest run --project e2e-live \
+            test/e2e/live/runtime-overrides.test.ts \
+            --silent=false --reporter=default
 
-      - name: Run gateway isolation E2E tests
-        run: NEMOCLAW_TEST_IMAGE=nemoclaw-production bash test/e2e-gateway-isolation.sh
+      - name: Upload runtime overrides artifacts
+        if: always()
+        uses: ./.github/actions/upload-e2e-artifacts
 
-  runtime-overrides:
+  glibc-probe-image-contract:
     runs-on: ubuntu-latest
-    # The live target owns 45 minutes; retain 15 minutes for setup, image
-    # transfer, and the always-running artifact upload.
-    timeout-minutes: 60
+    timeout-minutes: 10
     needs: build-sandbox-images
-    env:
-      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/runtime-overrides
-      E2E_TARGET_ID: runtime-overrides
-      NEMOCLAW_RUN_LIVE_E2E: "1"
-      NEMOCLAW_TEST_IMAGE: nemoclaw-production
     steps:
       - *checkout
 
-      - *setup-node
+      - name: Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22.19.0
+          cache: npm
 
-      - *install-root-dependencies
+      - name: Install root dependencies
+        run: npm ci --ignore-scripts --no-audit --no-fund
 
       - *download-isolation-image
 
       - *load-isolation-image
 
-      - name: Run runtime overrides test against production image
-        timeout-minutes: 45
-        run: |
-          npx vitest run --project e2e-live \
-            test/e2e/live/runtime-overrides.test.ts \
-            --silent=false --reporter=default
-
-      - name: Upload runtime overrides artifacts
-        if: always()
-        uses: ./.github/actions/upload-e2e-artifacts
+      - name: Validate glibc probe lifecycle
+        env:
+          NEMOCLAW_RUN_GLIBC_PROBE_DOCKER_E2E: "1"
+          NEMOCLAW_TEST_IMAGE: nemoclaw-production
+        run: >-
+          npx vitest run --project integration test/e2e-runtime/image-compatibility-docker-lifecycle.test.ts
+          --silent=false --reporter=default --reporter=test/e2e/risk-signal-reporter.ts
 
-  test-e2e-port-overrides:
+  port-override-image-contract:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     needs: build-sandbox-images
@@ -543,5 +510,5 @@ jobs:
 
       - *load-isolation-image
 
-      - name: Run port override E2E tests
+      - name: Validate port override image contract
         run: NEMOCLAW_TEST_IMAGE=nemoclaw-production bash test/e2e-port-overrides.sh