Managed OpenClaw registry entry omits the required agent identity

[ericksoa]

Investigation Summary

• Three managed OpenClaw rebuild and restore paths fail with the same durable-authority error.
• Stock managed onboarding creates a managed-image receipt but persists agent: null in the sandbox registry.
• Managed workload authority correctly requires an explicit agent that matches the receipt.
• Legacy and custom OpenClaw entries intentionally use agent: null; that compatibility contract is separate.
• No existing issue matches this failure signature.

Description

buildCreatedSandboxRegistryEntry() uses the legacy OpenClaw registry convention even when the workload kind is managed-image. The durable row therefore omits the agent identity required by readManagedWorkloadAuthority().

Expected behavior: a managed OpenClaw registry entry records agent: "openclaw" and agrees with its managed-image receipt.

Actual behavior: the entry records agent: null, so rebuild and restore reject the durable authority.

Reproduction Steps

1. Onboard stock OpenClaw through the managed-image path.
2. Start a rebuild, second onboarding, or snapshot restore that reads durable workload authority.
3. Observe: Invalid managed workload authority: the durable managed workload does not record an explicit agent.

Environment

• Workflow: unfiltered E2E run 32068537791
• Runner: GitHub-hosted Ubuntu
• Runtime: OpenShell Docker driver with managed OpenClaw
• Candidate commit: eb560abae63f89183406b3cc273ecb8bf12ccfd2

Failure Evidence

• Gateway reuse and sibling preservation
• Snapshot restore
• Credential generation-window rebuild

Acceptance Criteria

• New managed OpenClaw entries persist the explicit openclaw agent identity.
• The persisted identity must match the validated managed-image receipt.
• Legacy and explicit custom-image OpenClaw entries retain their current agent: null behavior.
• On an exact candidate containing the fix, the complete unfiltered E2E run passes each scenario that failed in run 32132319706:
  • OpenShell credential-generation window rebuild
  • Snapshot restore
  • Gateway reuse and double onboarding
  • Full OpenClaw E2E
• A mismatched or absent managed agent still fails closed before lifecycle mutation.

Relationship

Prerequisite for #9140. Related epic: #7744.

[ericksoa]

Reopening from the full unfiltered PR qualification run on the exact #9323 candidate head 3cf9a57df9fb73ff8c75d75e79864dd2f5ba453e, which includes the #9370 fix as f0326fc04d. Three independent live paths still reproduce the original terminal error exactly:

• Snapshot and restore: Invalid managed workload authority: the durable managed workload does not record an explicit agent
• Double onboarding: same error
• OpenShell credential-generation window: same error

This exact-head evidence shows that #9356 is not cleared for the #9140 cutover. The remaining registry creation or registration path must be isolated and covered before the full matrix can pass.

[ericksoa]

The complete unfiltered cutover run reproduces this issue four times on candidate 774e2363ecdfed90502ebbcffa03a4ecb46fc50e:

• Credential-generation window: https://github.com/NVIDIA/NemoClaw/actions/runs/32132319706/job/95696286857
• Snapshot restore: https://github.com/NVIDIA/NemoClaw/actions/runs/32132319706/job/95696288887
• Gateway reuse/double onboarding: https://github.com/NVIDIA/NemoClaw/actions/runs/32132319706/job/95696288893
• Full OpenClaw E2E: https://github.com/NVIDIA/NemoClaw/actions/runs/32132319706/job/95696290629

All four fail with durable managed workload does not record an explicit agent. Run: https://github.com/NVIDIA/NemoClaw/actions/runs/32132319706.