Skip to content

feat(dcode): add bounded headless validation profiles #7822

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jyaunches wants to merge 32 commits into from
Closed

feat(dcode): add bounded headless validation profiles #7822

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
32 commits
Select commit Hold shift + click to select a range
b9be5ef
feat(dcode): add bounded headless validation profiles
jyaunches Jul 29, 2026
8e8c204
refactor(onboard): extract DCode profile preparation
jyaunches Jul 29, 2026
7616174
test(onboard): keep DCode fixtures linear
jyaunches Jul 29, 2026
e842a32
docs(cli): document DCode validation profile flag
jyaunches Jul 29, 2026
c75c211
fix(dcode): harden validation profile boundaries
jyaunches Jul 29, 2026
d788058
fix(dcode): make validation budgets write-once
jyaunches Jul 29, 2026
7657e9c
fix(dcode): narrow validation claim permissions
jyaunches Jul 29, 2026
cee81c2
fix(dcode): close validation receipt gaps
jyaunches Jul 29, 2026
ef8414f
test(dcode): model validation budget lifecycle
jyaunches Jul 29, 2026
f7df021
fix(dcode): import managed lifecycle helper
jyaunches Jul 29, 2026
9ba4dbc
merge: resolve conflicts with main
github-actions[bot] Jul 29, 2026
463cf1a
chore: refresh checks after main merge
jyaunches Jul 29, 2026
401add1
fix(dcode): reject validation process controls
jyaunches Jul 29, 2026
e88379e
docs(dcode): clarify validation environment checks
jyaunches Jul 29, 2026
00d7fef
fix(dcode): reject source mutation races
jyaunches Jul 29, 2026
604f85e
docs(dcode): qualify source mutation detection
jyaunches Jul 29, 2026
12f230f
chore(ci): lower stale shell quote fan-in budget
jyaunches Jul 29, 2026
4901d50
merge: update branch from main
jyaunches Jul 29, 2026
1a74489
docs(dcode): qualify mutation watcher contract
jyaunches Jul 29, 2026
8adae2b
fix(dcode): preserve source race classification
jyaunches Jul 29, 2026
85dbb8a
fix(dcode): close validation launch race
jyaunches Jul 29, 2026
7c6617f
test(dcode): restore source race executable owner
jyaunches Jul 29, 2026
bb20b67
test(dcode): scope validation owner fixtures
jyaunches Jul 29, 2026
913becb
merge: update branch from main
jyaunches Jul 29, 2026
9f48519
merge: resolve conflicts with main
github-actions[bot] Jul 30, 2026
ad67e7d
merge: resolve conflicts with main
github-actions[bot] Jul 30, 2026
94b0fb8
merge: resolve conflicts with main
github-actions[bot] Jul 31, 2026
1db88c6
merge: resolve conflicts with main
github-actions[bot] Aug 1, 2026
2d47cf5
merge: resolve conflicts with main
github-actions[bot] Aug 1, 2026
934d00a
merge: resolve conflicts with main
github-actions[bot] Aug 3, 2026
75b7bab
merge: resolve conflicts with main
github-actions[bot] Aug 4, 2026
59a4ede
merge: resolve conflicts with main
github-actions[bot] Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 38 additions & 2 deletions agents/langchain-deepagents-code/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,6 +241,7 @@ ARG NEMOCLAW_INFERENCE_API=openai-completions
ARG NEMOCLAW_REASONING_EFFORT=
ARG NEMOCLAW_TOOL_DISCLOSURE=progressive
ARG NEMOCLAW_DCODE_AUTO_APPROVAL=disabled
ARG NEMOCLAW_DCODE_VALIDATION_PROFILE_B64=disabled
# DCode has no extra optional packages today, but release images participate in
# the same managed-image capability contract as OpenClaw and Hermes.
ARG NEMOCLAW_MANAGED_IMAGE_CAPABILITY_UNION=0
Expand All @@ -257,6 +258,16 @@ RUN case "$NEMOCLAW_TOOL_DISCLOSURE" in \
disabled|thread-opt-in) ;; \
*) echo "ERROR: NEMOCLAW_DCODE_AUTO_APPROVAL must be disabled or thread-opt-in" >&2; exit 1 ;; \
esac \
&& case "$NEMOCLAW_DCODE_VALIDATION_PROFILE_B64" in \
disabled) ;; \
*[!A-Za-z0-9+/=]*|'') echo "ERROR: invalid DCode validation profile encoding" >&2; exit 1 ;; \
Comment thread
coderabbitai[bot] marked this conversation as resolved.
esac \
&& if [ "$NEMOCLAW_DCODE_VALIDATION_PROFILE_B64" != "disabled" ]; then \
test "${#NEMOCLAW_DCODE_VALIDATION_PROFILE_B64}" -le 90000 \
&& printf '%s' "$NEMOCLAW_DCODE_VALIDATION_PROFILE_B64" > /tmp/nemoclaw-dcode-validation-profile.encoding \
&& grep -Eq '^[A-Za-z0-9+/]+={0,2}$' /tmp/nemoclaw-dcode-validation-profile.encoding \
&& rm -f /tmp/nemoclaw-dcode-validation-profile.encoding; \
fi \
&& case "$NEMOCLAW_REASONING_EFFORT" in \
""|low|medium|high) ;; \
*) echo "ERROR: NEMOCLAW_REASONING_EFFORT must be empty, low, medium, or high" >&2; exit 1 ;; \
Expand All @@ -276,8 +287,31 @@ RUN install -d -m 0755 /usr/local/share/nemoclaw \
&& printf '%s\n' "$NEMOCLAW_INFERENCE_BASE_URL" > /usr/local/share/nemoclaw/dcode-inference-base-url \
&& printf '%s\n' "$NEMOCLAW_DCODE_AUTO_APPROVAL" > /usr/local/share/nemoclaw/dcode-auto-approval \
&& printf '%s\n' "$NEMOCLAW_REASONING_EFFORT" > /usr/local/share/nemoclaw/dcode-reasoning-effort \
&& if [ "$NEMOCLAW_DCODE_VALIDATION_PROFILE_B64" = "disabled" ]; then \
rm -f /usr/local/share/nemoclaw/dcode-validation-profile.json; \
else \
printf '%s' "$NEMOCLAW_DCODE_VALIDATION_PROFILE_B64" > /tmp/nemoclaw-dcode-validation-profile.b64; \
if ! base64 -d /tmp/nemoclaw-dcode-validation-profile.b64 > /usr/local/share/nemoclaw/dcode-validation-profile.json; then \
rm -f /tmp/nemoclaw-dcode-validation-profile.b64 /usr/local/share/nemoclaw/dcode-validation-profile.json; \
exit 1; \
fi; \
rm -f /tmp/nemoclaw-dcode-validation-profile.b64; \
if [ "$(wc -c < /usr/local/share/nemoclaw/dcode-validation-profile.json)" -gt 65536 ]; then \
rm -f /usr/local/share/nemoclaw/dcode-validation-profile.json; \
exit 1; \
fi; \
fi \
&& chown root:root /usr/local/share/nemoclaw/dcode-proxy-host /usr/local/share/nemoclaw/dcode-proxy-port /usr/local/share/nemoclaw/dcode-inference-base-url /usr/local/share/nemoclaw/dcode-auto-approval /usr/local/share/nemoclaw/dcode-reasoning-effort \
&& if [ -f /usr/local/share/nemoclaw/dcode-validation-profile.json ]; then \
chown root:root /usr/local/share/nemoclaw/dcode-validation-profile.json; \
fi \
&& chmod 0444 /usr/local/share/nemoclaw/dcode-proxy-host /usr/local/share/nemoclaw/dcode-proxy-port /usr/local/share/nemoclaw/dcode-inference-base-url /usr/local/share/nemoclaw/dcode-auto-approval /usr/local/share/nemoclaw/dcode-reasoning-effort \
&& if [ -f /usr/local/share/nemoclaw/dcode-validation-profile.json ]; then \
chown root:root /usr/local/share/nemoclaw/dcode-validation-profile.json; \
chmod 0444 /usr/local/share/nemoclaw/dcode-validation-profile.json; \
/opt/venv/bin/python3 -I -c 'from deepagents_code import _nemoclaw_managed as managed; managed.validate_managed_validation_profile_file()'; \
fi \
&& /opt/venv/bin/python3 -I -c 'from deepagents_code import _nemoclaw_managed as managed; managed.initialize_managed_validation_invocation_budget()' \
&& unset OTEL_EXPORTER_OTLP_TRACES_ENDPOINT \
&& empty_prompt_log="$(mktemp)" \
&& if timeout 10 env -i /usr/local/lib/nemoclaw/dcode-wrapper.sh -n "" >"$empty_prompt_log" 2>&1; then empty_prompt_status=0; else empty_prompt_status=$?; fi \
Expand Down Expand Up @@ -332,10 +366,12 @@ USER sandbox
RUN mkdir -p /sandbox/.nemoclaw/blueprints/0.1.0 \
&& cp -r /opt/nemoclaw-blueprint/* /sandbox/.nemoclaw/blueprints/0.1.0/ \
&& node --experimental-strip-types /opt/nemoclaw-deepagents-code/generate-config.ts \
&& chmod 660 /sandbox/.deepagents/config.toml
&& chmod 660 /sandbox/.deepagents/config.toml \
&& /opt/venv/bin/python3 -I -c 'from deepagents_code import _nemoclaw_managed as managed; managed.validate_managed_validation_invocation_budget_unprivileged()'

USER root
RUN chown root:root /sandbox/.nemoclaw \
RUN /opt/venv/bin/python3 -I -c 'from deepagents_code import _nemoclaw_managed as managed; managed.finalize_managed_validation_invocation_budget()' \
&& chown root:root /sandbox/.nemoclaw \
&& chmod 1755 /sandbox/.nemoclaw \
&& chown -R root:root /sandbox/.nemoclaw/blueprints \
&& chmod -R 755 /sandbox/.nemoclaw/blueprints \
Expand Down
Loading