chore(openshell): upgrade supported version to 0.0.72

[ericksoa]

Summary

NemoClaw v0.0.74 will ship stable OpenShell v0.0.72. This dependency layer advances the supported OpenShell contract from 0.0.71 to 0.0.72, pins every consumed release artifact, preserves round-trippable policy state, and hardens installer verification so pull-request code cannot authorize its own pins.

Related Issue

Refs #5591.
Follow-up to merged #5596.
Dependency layer for #5876 and the accepted MCP design in #566.

Changes

• Pin stable OpenShell 0.0.72 across the supported version floor/ceiling, installer, Brev launchable, blueprint, supervisor image, workflow, and live-E2E contracts. OpenShell development builds remain compatibility evidence, not the shipping runtime.
• Pin all consumed CLI, gateway, and sandbox archives plus both Brev CLI references to the official v0.0.72 checksum manifests.
• Read mutation input from openshell policy get --base, strip reserved _provider_* entries before policy set, retain --full only for read-only diagnostics, and preserve future mapping sections plus MCP/JSON-RPC fields during merges.
• Route the CommonJS CLI and ESM plugin through one generated OpenShell policy boundary and exact-pin yaml 2.8.3 in both production package graphs.
• Normalize that boundary for both compiled CommonJS and source-mode tsx loading. A subprocess package-contract test reproduces the live source-loader path that exposed the mismatch.
• Run installer verification from base-trusted code. The introducing PR falls back only to immutable commit cb5e9aefab2b16fedc0995149fc3520da0d5e0c7, verified as tree 1fdf59efe40b78c407e222fd42043b23a61e199a, with an enforced expiry at 2026-12-29T19:35:41Z.
• Treat PR-head installer files as data only. The trusted parser rejects symbolic links, a symbolic-link scripts parent, non-regular files, changed inode/device identity, and input over 1 MiB; it opens with O_NOFOLLOW and performs a bounded descriptor read.
• Fail installer verification closed on missing, duplicate, mismatched, incomplete, or unreachable OpenShell/Brev pin data.
• Publish the OpenShell 0.0.72 compatibility review and align version, policy, gateway-authentication, and troubleshooting documentation.

Exact-head evidence

• Source head 9ab85e7d5f8ac0bbd065e5d5c2547e6cf6bd97b4 included main through 1787a6bc3245dcb6ecda8c57ed15934c46f822b5 and was squash-merged as c7f91885cc849a4594a7e0664c030986cbcfaddb for v0.0.74. The source-head and squash-merge trees are identical. The signed stack merges incorporated feat(deepagents-code): restore dcode status after v0.0.73 #6232's official post-v0.0.73 dcode-status restoration, fix(dcode): stop persisting LangSmith variables #6219's LangSmith-persistence hardening, and fix(cli): validate Git signing format in developer doctor #6168's developer-doctor update without changing the dependency-specific diff.
• GitHub verifies the source-head signature, DCO is green, the maintainer approval remains recorded at review 4611344448, and GitHub reports the PR merged at 2026-07-03T03:57:18Z.
• Post-restack local validation passes build:cli, full and CLI typechecks, repository checks, 54/54 affected Deep Agents image contracts, 8/8 onboarding launch tests, and git diff --check.
• All exact-head ordinary PR checks are terminal green (33 successful, three skipped/neutral rollup entries, zero failures), including macOS/WSL E2E, every CLI shard and aggregate, static/security scans, DCO, and both PR Review Advisor jobs. GitHub reports APPROVED and MERGEABLE/CLEAN.
• Exact-head selected OpenShell E2E run 28636628230 is terminal green for version-pin, gateway-auth contract, network-policy, gateway-upgrade/state-restoration, OpenClaw rebuild, scorecard, and reporter. All jobs ran from a temporary no-PR ref at the identical commit.
• Exact-head PR Review run 28636591175 and E2E Advisor run 28636591177 are green. GPT and Nemotron both report merge_as_is with high confidence; E2E Advisor reports high confidence and selects the four OpenShell contract lanes linked above. The additional OpenClaw rebuild lane carries forward the immediately preceding exact-head recommendation.

Trust-boundary notes

• The immutable bootstrap is intentionally used only while the PR base lacks the trusted action. Once that action exists on the base, executing the newer base-trusted verifier is the stronger boundary; the expiring bootstrap should then be removed rather than run redundantly.
• No untrusted PR process executes alongside the parser. GitHub checks out inert PR data, then trusted code validates and reads the already-opened descriptor. The link/type/identity/bounds checks cover repository-controlled redirection and exhaustion inputs without claiming protection from a privileged concurrent host writer.
• Stable OpenShell 0.0.72 accepts an unmarked policy root only when it contains version or network_policies; metadata-only and malformed documents fail closed. Versionless network_policies is retained for the supported compatibility contract.

Advisor disposition

• GPT reported no required findings and one warning about the mutable default BASE_IMAGE tag. That ARG BASE_IMAGE=ghcr.io/nvidia/nemoclaw/sandbox-base:latest line is unchanged from current main; this dependency PR neither introduces nor broadens that repository-wide build default.
• Nemotron's bootstrap finding would weaken the intended trust transition: the immutable bootstrap exists only for the introducing PR. Once the action is present on the base, the newer base-trusted action must replace the older bootstrap; both paths are immutable for the current event and are contract-tested.
• Nemotron's parser race assumes an untrusted concurrent filesystem writer. PR code is never executed in this job: GitHub checks out inert data, then trusted code rejects links/special files, checks the opened descriptor's device/inode, bounds the read, and closes it. A privileged host writer is outside this PR-input threat model.
• Nemotron's checksum finding is not circular. The trusted checker pins the SHA-256 of each upstream checksum manifest, verifies that immutable manifest before reading it, and compares every embedded installer pin with exactly one manifest entry. At install time each named archive must exist and match its pinned digest, so a missing asset still fails closed without downloading all archives during every PR check.
• The generated-boundary auditor executes in the Docker builder stage exercised by ordinary build-sandbox-images CI. The exact source-mode .cts versus generated .cjs mismatch found by live proof is now covered directly by the subprocess package-contract test and the compiled runner suites.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification: policy mutation, package boundary, installer trust, workflow selection, and runtime upgrade/state-restoration have focused coverage; final selected E2E is linked above.
• Tests not applicable — justification: not applicable; this changes security-sensitive installer, policy, and runtime compatibility behavior.
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: not applicable; supported OpenShell versions and policy behavior are user-facing.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: the linked approval predates the current head; exact-head human review or an explicit carried-approval decision remains required, and no waiver is requested.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: no waiver is requested; exact-head ordinary CI and every selected live E2E lane, scorecard, and reporter are green.

Verification

• PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
• Git hooks passed during commit and push, or npx prek run --from-ref main --to-ref HEAD passes
• Targeted tests pass for changed behavior
• Full npm test passes (broad runtime changes only)
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Aaron Erickson aerickson@nvidia.com

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Vitest E2E Target Results — ⚠️ Some jobs cancelled — partial pass

Run: 28636404533
Workflow ref: dep/openshell-v0.0.72
Requested targets: (default — all supported)
Requested jobs: openshell-version-pin,openshell-gateway-auth-contract,openshell-gateway-upgrade,cloud-onboard,network-policy,inference-routing,rebuild-openclaw,onboard-repair,gateway-guard-recovery,shields-config,security-posture
Summary: 9 passed, 0 failed, 2 cancelled, 0 skipped

Job	Result
cloud-onboard	✅ success
gateway-guard-recovery	✅ success
inference-routing	✅ success
network-policy	⚠️ cancelled
onboard-repair	✅ success
openshell-gateway-auth-contract	✅ success
openshell-gateway-upgrade	⚠️ cancelled
openshell-version-pin	✅ success
rebuild-openclaw	✅ success
security-posture	✅ success
shields-config	✅ success

[github-actions]

Vitest E2E Target Results — ✅ All requested jobs passed

Run: 28636791698
Workflow ref: dep/openshell-v0.0.72
Requested targets: (default — all supported)
Requested jobs: openshell-version-pin,openshell-gateway-auth-contract,openshell-gateway-upgrade,cloud-onboard,network-policy,inference-routing,rebuild-openclaw,onboard-repair,gateway-guard-recovery,shields-config,security-posture
Summary: 11 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
cloud-onboard	✅ success
gateway-guard-recovery	✅ success
inference-routing	✅ success
network-policy	✅ success
onboard-repair	✅ success
openshell-gateway-auth-contract	✅ success
openshell-gateway-upgrade	✅ success
openshell-version-pin	✅ success
rebuild-openclaw	✅ success
security-posture	✅ success
shields-config	✅ success