<!-- markdownlint-disable MD041 -->
## Summary
Publishes the LangChain Deep Agents Code sandbox base image from the
same main/tag workflow used by the other supported agents, closing the
release-pipeline gap that left v0.0.76 resolving an obsolete
`deepagents-code` 0.1.12 base. Base resolution now verifies the
installed DCode distribution against the active manifest and
fingerprints both the manifest and dependency lock so version or
transitive dependency drift fails closed before final-image
construction.

## Related Issue
Refs #6456. Keep the issue open until the exact-main image run succeeds,
the new GHCR package is public, and a clean ARM64 v0.0.76 install is
revalidated.

## Changes
- Add a guarded, multi-architecture GHCR publisher for
`langchain-deepagents-code-sandbox-base` with `latest`, release-tag, and
short-SHA metadata.
- Trigger base-image publication when the workflow, DCode base
Dockerfile, manifest, or dependency lock changes, so merging this fix
immediately publishes `latest`.
- Reject published, cached, or overridden DCode bases unless `/opt/venv`
contains the manifest-required `deepagents-code` version; the
metadata-only probe is networkless, capability-dropped,
no-new-privileges, and read-only.
- Include the DCode manifest and dependency lock in base-resolution
identity plus dirty/main-divergence checks, preventing version and
transitive lock changes from reusing stale images.
- Pin every Docker action in the package-writing workflow to an
immutable commit.
- Add focused resolver, workflow, source-invariant, and build-guard
regression coverage for #6456.

## Design Notes
- The invalid state is a published or cached DCode image whose installed
`deepagents-code` version differs from `manifest.yaml`
`expected_version`. The manifest is the runtime acceptance contract and
`requirements.lock` is the immutable image-build input; they serve
different consumers and cannot safely be collapsed in this release fix.
Their named invariant test runs in every PR's integration CI, so drift
is merge-blocking. Remove the duplicated-field guard only when build
tooling generates both consumers from one authoritative source.
- Global `Dockerfile.base` and blueprint inputs intentionally remain in
every agent resolution key under the resolver's pre-existing
conservative policy. #6456 adds the DCode manifest/lock inputs without
redefining cross-agent invalidation; removal requires a dedicated
per-agent cache-policy design with migration and regression coverage.
- DCode validation and DCode-specific resolution options are isolated in
`deep-agents-code-base-image.ts`; the shared base-image module only
selects those options. Hermes remains separate because it validates a
different capability contract.
- On exact head `29c17cd5`, `base-image.ts` is 378 lines versus 373 on
`main`, and the generic resolver test is 452 lines versus 452 on `main`;
the prior monolith findings are resolved by the focused DCode module and
agent-resolution test file.
- `dockerCapture` exposes stdout, not an exit-status result. Empty
output therefore means the container or metadata probe may have failed
and is rejected with a warning; a non-empty wrong version follows the
distinct stale-version path. Expanding the Docker adapter result type is
outside this publication fix.
- `/opt/venv/bin/python3` is the DCode base Dockerfile's declared
virtual-environment interpreter. Using the absolute path avoids `PATH`
ambiguity; a future layout change intentionally fails closed, and the
exact-head DCode onboarding E2E exercises the real image contract.
- The `deepagents-code` distribution identifier comes from the top-level
hash-locked requirement and is checked against the manifest version by
required integration CI; any future package rename fails closed.
- Coverage deliberately splits the two public contracts: focused DCode
tests exercise manifest-to-validator binding, while the agent-resolution
suite proves a pulled image is rejected when its supplied validator
fails. Exact-head DCode onboarding and sandbox-rebuild E2E supply the
composed runtime check.
- The composed override/cache contract is covered at stable public
seams: the DCode helper test binds the manifest version to the
locked-down probe, the agent provisioning test passes that validator to
resolution, the resolver test rejects an overridden candidate when
validation fails, and the resolution-metadata test revalidates a cached
hint before reuse. Exact-head DCode onboarding E2E validates the
assembled runtime path; duplicating those private seams in one synthetic
test would add coupling without a new behavior assertion.
- Manifest/lock synchronization is CI-enforced:
`test/dcode-base-image-workflow.test.ts` is in the integration project,
`.github/actions/ci-cli-coverage-shard/action.yaml` runs both `--project
cli` and `--project integration` for code PRs, and the required
aggregate `cli-tests` check passed on this exact head.
- Missing in-repo agent inputs are retained by normalization and hashed
as `<missing>` by the resolution key. Only empty, repository-root, or
out-of-repository paths are rejected, which is the intentional
path-traversal boundary rather than silent missing-file handling.
- The metadata probe has no network, capabilities, privilege escalation,
writable root filesystem, or host mounts. Keeping the image's default
user avoids requiring arbitrary override images to define a `sandbox`
account; the command is read-only and fail-closed.
- Image references are non-secret resolver inputs and are intentionally
included in validation diagnostics so operators can identify a bad
explicit override or cached tag; secret-bearing process output still
passes through the existing runner redaction boundary.
- Separate publisher jobs intentionally preserve package-specific
failures, reruns, and tag observability. Converting all existing
publishers to a matrix changes the release contract across three
packages and is a separate workflow refactor, not prerequisite work for
#6456.
- `packages: write` is the minimum permission needed to publish the
requested GHCR image and is pre-existing for this dedicated workflow;
the only other workflow permission is `contents: read`, publisher jobs
are repository-guarded, and all Docker actions are immutable-pinned.
- PR #5755 is already conflicting with current `main`; its checkout
dependency bump must rebase independently. PR #6469 remains mergeable
and does not need to absorb that unrelated dependency update.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates
<!-- Check exactly one tests line and one docs line. Check other lines
when applicable. Add every requested justification or approval
reference. -->
- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: restores the documented
hash-locked DCode runtime and stale-base fallback contracts without
changing commands, flags, configuration, defaults, or policy.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: pending human review of
base-image selection and release publication on this exact head.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification
<!-- Check each applicable item only when supported by the requested
evidence. Run targeted tests once per relevant change set and rerun
after later edits or hook autofixes that can affect the tested behavior.
Do not rerun hook-covered checks. -->
- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — exact head `29c17cd5`: changed
resolver/base-image/workflow suites passed 56/56; the parent DCode image
contract suites passed 83/83; JS-config and CLI typechecks, `npm run
checks`, YAML/Biome validation, normal hooks, secret scan, import/shape
checks, and test-size budgets passed. Exact-head [E2E run
28948929160](https://github.com/NVIDIA/NemoClaw/actions/runs/28948929160)
passed DCode cloud onboarding and sandbox rebuild.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [ ] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
<!-- DCO sign-off is required in this PR description, and every commit
must appear as Verified in GitHub. Run: git config user.name && git
config user.email -->
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Expanded automated image publishing to cover an additional agent base
image and related dependency updates.
* Base image rebuilds now respond to more relevant file changes, helping
keep published images current.

* **Bug Fixes**
* Improved base image validation so outdated images are rejected more
reliably.
* Resolution logic now tracks dependency lockfile changes, reducing
stale image reuse.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

<!-- markdownlint-disable MD041 -->
## Summary
Publishes the LangChain Deep Agents Code sandbox base image from the
same main/tag workflow used by the other supported agents, closing the
release-pipeline gap that left v0.0.76 resolving an obsolete
`deepagents-code` 0.1.12 base. Base resolution now verifies the
installed DCode distribution against the active manifest and
fingerprints both the manifest and dependency lock so version or
transitive dependency drift fails closed before final-image
construction.

## Related Issue
Refs NVIDIA#6456. Keep the issue open until the exact-main image run succeeds,
the new GHCR package is public, and a clean ARM64 v0.0.76 install is
revalidated.

## Changes
- Add a guarded, multi-architecture GHCR publisher for
`langchain-deepagents-code-sandbox-base` with `latest`, release-tag, and
short-SHA metadata.
- Trigger base-image publication when the workflow, DCode base
Dockerfile, manifest, or dependency lock changes, so merging this fix
immediately publishes `latest`.
- Reject published, cached, or overridden DCode bases unless `/opt/venv`
contains the manifest-required `deepagents-code` version; the
metadata-only probe is networkless, capability-dropped,
no-new-privileges, and read-only.
- Include the DCode manifest and dependency lock in base-resolution
identity plus dirty/main-divergence checks, preventing version and
transitive lock changes from reusing stale images.
- Pin every Docker action in the package-writing workflow to an
immutable commit.
- Add focused resolver, workflow, source-invariant, and build-guard
regression coverage for NVIDIA#6456.

## Design Notes
- The invalid state is a published or cached DCode image whose installed
`deepagents-code` version differs from `manifest.yaml`
`expected_version`. The manifest is the runtime acceptance contract and
`requirements.lock` is the immutable image-build input; they serve
different consumers and cannot safely be collapsed in this release fix.
Their named invariant test runs in every PR's integration CI, so drift
is merge-blocking. Remove the duplicated-field guard only when build
tooling generates both consumers from one authoritative source.
- Global `Dockerfile.base` and blueprint inputs intentionally remain in
every agent resolution key under the resolver's pre-existing
conservative policy. NVIDIA#6456 adds the DCode manifest/lock inputs without
redefining cross-agent invalidation; removal requires a dedicated
per-agent cache-policy design with migration and regression coverage.
- DCode validation and DCode-specific resolution options are isolated in
`deep-agents-code-base-image.ts`; the shared base-image module only
selects those options. Hermes remains separate because it validates a
different capability contract.
- On exact head `29c17cd5`, `base-image.ts` is 378 lines versus 373 on
`main`, and the generic resolver test is 452 lines versus 452 on `main`;
the prior monolith findings are resolved by the focused DCode module and
agent-resolution test file.
- `dockerCapture` exposes stdout, not an exit-status result. Empty
output therefore means the container or metadata probe may have failed
and is rejected with a warning; a non-empty wrong version follows the
distinct stale-version path. Expanding the Docker adapter result type is
outside this publication fix.
- `/opt/venv/bin/python3` is the DCode base Dockerfile's declared
virtual-environment interpreter. Using the absolute path avoids `PATH`
ambiguity; a future layout change intentionally fails closed, and the
exact-head DCode onboarding E2E exercises the real image contract.
- The `deepagents-code` distribution identifier comes from the top-level
hash-locked requirement and is checked against the manifest version by
required integration CI; any future package rename fails closed.
- Coverage deliberately splits the two public contracts: focused DCode
tests exercise manifest-to-validator binding, while the agent-resolution
suite proves a pulled image is rejected when its supplied validator
fails. Exact-head DCode onboarding and sandbox-rebuild E2E supply the
composed runtime check.
- The composed override/cache contract is covered at stable public
seams: the DCode helper test binds the manifest version to the
locked-down probe, the agent provisioning test passes that validator to
resolution, the resolver test rejects an overridden candidate when
validation fails, and the resolution-metadata test revalidates a cached
hint before reuse. Exact-head DCode onboarding E2E validates the
assembled runtime path; duplicating those private seams in one synthetic
test would add coupling without a new behavior assertion.
- Manifest/lock synchronization is CI-enforced:
`test/dcode-base-image-workflow.test.ts` is in the integration project,
`.github/actions/ci-cli-coverage-shard/action.yaml` runs both `--project
cli` and `--project integration` for code PRs, and the required
aggregate `cli-tests` check passed on this exact head.
- Missing in-repo agent inputs are retained by normalization and hashed
as `<missing>` by the resolution key. Only empty, repository-root, or
out-of-repository paths are rejected, which is the intentional
path-traversal boundary rather than silent missing-file handling.
- The metadata probe has no network, capabilities, privilege escalation,
writable root filesystem, or host mounts. Keeping the image's default
user avoids requiring arbitrary override images to define a `sandbox`
account; the command is read-only and fail-closed.
- Image references are non-secret resolver inputs and are intentionally
included in validation diagnostics so operators can identify a bad
explicit override or cached tag; secret-bearing process output still
passes through the existing runner redaction boundary.
- Separate publisher jobs intentionally preserve package-specific
failures, reruns, and tag observability. Converting all existing
publishers to a matrix changes the release contract across three
packages and is a separate workflow refactor, not prerequisite work for
NVIDIA#6456.
- `packages: write` is the minimum permission needed to publish the
requested GHCR image and is pre-existing for this dedicated workflow;
the only other workflow permission is `contents: read`, publisher jobs
are repository-guarded, and all Docker actions are immutable-pinned.
- PR NVIDIA#5755 is already conflicting with current `main`; its checkout
dependency bump must rebase independently. PR NVIDIA#6469 remains mergeable
and does not need to absorb that unrelated dependency update.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates
<!-- Check exactly one tests line and one docs line. Check other lines
when applicable. Add every requested justification or approval
reference. -->
- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: restores the documented
hash-locked DCode runtime and stale-base fallback contracts without
changing commands, flags, configuration, defaults, or policy.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: pending human review of
base-image selection and release publication on this exact head.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification
<!-- Check each applicable item only when supported by the requested
evidence. Run targeted tests once per relevant change set and rerun
after later edits or hook autofixes that can affect the tested behavior.
Do not rerun hook-covered checks. -->
- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — exact head `29c17cd5`: changed
resolver/base-image/workflow suites passed 56/56; the parent DCode image
contract suites passed 83/83; JS-config and CLI typechecks, `npm run
checks`, YAML/Biome validation, normal hooks, secret scan, import/shape
checks, and test-size budgets passed. Exact-head [E2E run
28948929160](https://github.com/NVIDIA/NemoClaw/actions/runs/28948929160)
passed DCode cloud onboarding and sandbox rebuild.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [ ] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
<!-- DCO sign-off is required in this PR description, and every commit
must appear as Verified in GitHub. Run: git config user.name && git
config user.email -->
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Expanded automated image publishing to cover an additional agent base
image and related dependency updates.
* Base image rebuilds now respond to more relevant file changes, helping
keep published images current.

* **Bug Fixes**
* Improved base image validation so outdated images are rejected more
reliably.
* Resolution logic now tracks dependency lockfile changes, reducing
stale image reuse.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>