nomarmy 0.1.0-alpha.2 → 0.1.0-alpha.21

package/docker/Dockerfile

@@ -1,9 +1,9 @@
-FROM node:24-bookworm-slim
+FROM node:26-bookworm-slim
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \
     bash ca-certificates curl git jq python3 python3-pip python3-venv ripgrep \
     && rm -rf /var/lib/apt/lists/*
-# node:24-bookworm-slim already ships a non-root "node" user at uid/gid 1000,
+# The node:*-bookworm-slim images ship a non-root "node" user at uid/gid 1000,
 # the same uid this Dockerfile used to try to create a "sandbox" user at.
 # useradd silently failed on every build (masked by `|| true`), so `USER
 # sandbox` below referred to a user that was never actually created --

package/docker/Dockerfile.go

@@ -1,4 +1,4 @@
-FROM node:24-bookworm-slim
+FROM node:26-bookworm-slim
 ENV DEBIAN_FRONTEND=noninteractive
 # Same base as docker/Dockerfile plus a Go toolchain -- the worker's own
 # tool-calling harness needs Node regardless of the target repo's language.
@@ -9,15 +9,17 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # (verified live: apt installed 1.19 here while go.dev's stable was 1.27) --
 # same reasoning as using rustup instead of apt for Rust in Dockerfile.rust.
 # Pinned, not "latest", for a reproducible build; bump GO_VERSION by hand
-# periodically against https://go.dev/dl/.
+# periodically against https://go.dev/dl/, with both SHA256 values from
+# https://go.dev/dl/?mode=json.
 ENV GO_VERSION=1.27.1
 RUN ARCH="$(dpkg --print-architecture)" \
     && case "$ARCH" in \
-         amd64) GOARCH=amd64 ;; \
-         arm64) GOARCH=arm64 ;; \
+         amd64) GOARCH=amd64; SHA256=63d339f0da5ab53635a56f2490a7984dfe12dfcff22ad749f63edaf590168445 ;; \
+         arm64) GOARCH=arm64; SHA256=3450b45a3f9ee8568792736a5c5e70a1f2e9b36c35a8f74958c03e51d7d92bec ;; \
          *) echo "unsupported architecture for Go install: $ARCH" >&2; exit 1 ;; \
        esac \
     && curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${GOARCH}.tar.gz" -o /tmp/go.tgz \
+    && echo "${SHA256}  /tmp/go.tgz" | sha256sum -c - \
     && tar -C /usr/local -xzf /tmp/go.tgz \
     && rm /tmp/go.tgz
 ENV PATH="/usr/local/go/bin:${PATH}"

package/docker/Dockerfile.rust

@@ -1,4 +1,4 @@
-FROM node:24-bookworm-slim
+FROM node:26-bookworm-slim
 ENV DEBIAN_FRONTEND=noninteractive
 # Same base as docker/Dockerfile plus a Rust toolchain -- the worker's own
 # tool-calling harness needs Node regardless of the target repo's language.
@@ -14,6 +14,21 @@ USER node
 ENV RUSTUP_HOME=/home/node/.rustup
 ENV CARGO_HOME=/home/node/.cargo
 ENV PATH="${CARGO_HOME}/bin:${PATH}"
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
+# rustup-init is pinned by version and checksum instead of piping
+# sh.rustup.rs into sh; rustup then verifies the toolchain it downloads.
+# Bump RUSTUP_VERSION and both hashes together, from
+# https://static.rust-lang.org/rustup/archive/<version>/<target>/rustup-init.sha256.
+ENV RUSTUP_VERSION=1.29.1
+RUN ARCH="$(dpkg --print-architecture)" \
+    && case "$ARCH" in \
+         amd64) TARGET=x86_64-unknown-linux-gnu; SHA256=dda7234360b7f578ca8b0ddcb80145646fa61a67c1720a5abc7051b35c9fcb71 ;; \
+         arm64) TARGET=aarch64-unknown-linux-gnu; SHA256=15f6e4ce9f583b929c996c91562bad6d4454f3281de858b02cdfdef615fac433 ;; \
+         *) echo "unsupported architecture for Rust install: $ARCH" >&2; exit 1 ;; \
+       esac \
+    && curl --proto '=https' --tlsv1.2 -fsSL "https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/${TARGET}/rustup-init" -o /tmp/rustup-init \
+    && echo "${SHA256}  /tmp/rustup-init" | sha256sum -c - \
+    && chmod +x /tmp/rustup-init \
+    && /tmp/rustup-init -y --no-modify-path --profile minimal --default-toolchain stable \
+    && rm /tmp/rustup-init
 WORKDIR /workspace
 CMD ["sleep", "infinity"]

package/harnesses/_template/README.md

@@ -0,0 +1,27 @@
+# Harness name
+
+Write a short summary of what this harness provides.
+
+## Detection
+
+List the markers and packages that match. Explain any `after` layers.
+
+## Installed today
+
+List tools and dependencies, versions, build commands, and known gaps.
+
+## Verification and network
+
+Document each proposed profile. Declare the lowest network level needed.
+For allowlist verification, document operator opt-in and dedicated test tenants
+with throwaway credentials, never production. Workers always remain offline.
+This registry does not enable services or allowlist networking yet.
+
+## Requirements and artifacts
+
+Explain memory, shared memory, KVM, and artifact globs, if any.
+
+## Fixture
+
+Add a tiny repository under `fixture/`. Describe how to verify it and its
+expected results. Keep credentials and host-specific paths out of fixtures.

package/harnesses/_template/harness.yml

@@ -0,0 +1,26 @@
+# Copy this folder to harnesses/<name>. Underscore folders are ignored.
+# name: example-harness # Required kebab-case name, equal to the folder name.
+# summary: Short description of what this installs.
+# detect: # Any matching rule applies. Paths are relative to the repo.
+#   - file: example.config.json
+#   - package: example-package # A Node dependency in a discovered package.json.
+#   - lockfile: example.lock
+# after: [node] # Existing harnesses that must precede this one.
+# image: # Choose declarative apt/run OR builtin, never both.
+#   apt: [example-package] # OS packages installed at image build time.
+#   run: ["example-install --frozen"] # Build commands, not worker commands.
+#   # builtin: node # Install logic implemented in lib/.
+# verification: # Proposed profiles mapped to commands or command lists.
+#   quick: example-test
+#   full: [example-lint, example-test]
+# artifacts: [test-results/**] # Repository-relative artifact globs.
+# requires: # Optional resource requirements.
+#   memoryMb: 1024
+#   shmMb: 512
+#   kvm: false
+# network: none # Default; services and allowlist are future verification levels.
+# services: [] # Service names; omit entirely for network none, even if empty.
+# suggestedRole: # Optional role suggestion.
+#   name: example-qa
+#   description: Runs the example suite.
+# docs: README.md # Default; path relative to this harness folder.

package/harnesses/browser-playwright/README.md

@@ -0,0 +1,35 @@
+# Playwright browser harness
+
+Installs Chromium and its OS dependencies using the repository's installed
+@playwright/test version, after the Node dependency layer. Commit a supported
+Node lockfile. Root and discovered nested packages are supported; browsers live
+in /ms-playwright and are readable by the node user. Installation failure leaves
+a .nomarmy-playwright-install-failed marker in /ms-playwright.
+
+Select the browser verification profile (npx playwright test) in .nomarmy.yml:
+
+```yaml
+verification:
+  browser:
+    commands: [npx playwright test]
+    environment: none
+```
+
+Allow at least 1024 MB memory. nomArmy's verification container allocates 512 MB
+/dev/shm (or the largest shared-memory requirement of the matched harnesses).
+For OpenClaw-managed worker sandboxes, unless OpenClaw exposes a shm setting,
+launch Chromium with --disable-dev-shm-usage via Playwright launchOptions, as
+the fixture does.
+
+The fixture opens its own static HTML with file://: the test needs no network.
+Install its npm dependencies and Chromium before running offline.
+
+Screenshots, traces and reports under test-results/** and playwright-report/**
+become job evidence under artifacts/, listed in verification.artifacts.
+Collection is limited to 200 files and 50 MB; a cap is reported in verification.
+Most of the time the General checks the UI itself after merging. This harness
+is for repositories with a real end-to-end suite as their gate.
+
+## Running the fixture
+
+`fixture/` has no lockfile on purpose: with one, nomArmy's own repository would match this harness and every nomArmy job would build Chromium into its image. To try it, copy the folder somewhere, run `npm install --package-lock-only` there (with network), commit, and verify it with the `browser` profile. Checked this way: headless Chromium passes offline, and the screenshot and trace land in the job's `artifacts/`.

package/harnesses/browser-playwright/fixture/package.json

@@ -0,0 +1 @@
+{"private":true,"type":"module","scripts":{"test":"playwright test"},"devDependencies":{"@playwright/test":"1.55.1"}}

package/harnesses/browser-playwright/fixture/page.html

@@ -0,0 +1 @@
+<!doctype html><title>Offline fixture</title><h1>Browser ready</h1>

package/harnesses/browser-playwright/fixture/page.spec.js

@@ -0,0 +1,5 @@
+import { test, expect } from '@playwright/test';
+test('opens local fixture', async ({ page }) => {
+  await page.goto(new URL('./page.html', import.meta.url).href);
+  await expect(page.getByRole('heading')).toHaveText('Browser ready');
+});

package/harnesses/browser-playwright/fixture/playwright.config.js

@@ -0,0 +1,8 @@
+import { defineConfig } from '@playwright/test';
+export default defineConfig({
+  testDir: '.',
+  testMatch: 'page.spec.js',
+  reporter: [['html', { open: 'never' }]],
+  use: { browserName: 'chromium', screenshot: 'on', trace: 'on',
+    launchOptions: { args: ['--disable-dev-shm-usage'] } },
+});

package/harnesses/browser-playwright/harness.yml

@@ -0,0 +1,18 @@
+name: browser-playwright
+summary: Offline Chromium end-to-end tests with the repository's Playwright version
+detect:
+  - package: '@playwright/test'
+  - file: playwright.config.ts
+  - file: playwright.config.js
+  - file: playwright.config.mjs
+after: [node]
+image:
+  builtin: playwright
+verification:
+  browser: npx playwright test
+artifacts: [test-results/**, playwright-report/**]
+requires:
+  memoryMb: 1024
+  shmMb: 512
+network: none
+docs: README.md

package/harnesses/go/README.md

@@ -0,0 +1,45 @@
+# Go harness
+
+Go toolchain with prefetched modules for offline verification.
+
+## Detection
+
+Matches `go.mod` or `go.work` at the repository root.
+
+## Installed today
+
+Installs Go 1.27.1 from the upstream tarball for amd64 or arm64, on the Node 24 Debian bookworm base with Python 3 and pip. Sets GOPATH for the node user.
+
+At image build, copies root `go.mod` and `go.sum` (when present), plus `go.work`, `go.work.sum` and each repository-contained workspace module’s manifests. Runs `go mod download` as node into the default module cache, `/home/node/go/pkg/mod`. Repositories with `vendor/` skip this download. A failed download leaves `/deps/go/.nomarmy-go-mod-download-failed` without failing the image build. Runtime sets `GOPROXY=off` and `GOSUMDB=off`; no `GOFLAGS` override is set, preserving Go’s default module behavior. Copied metadata is hashed into the image tag, so dependency changes rebuild the cache. The layer composes with Node dependencies in mixed repositories.
+
+## Verification and network
+
+Proposes `go test ./...` as the `quick` profile. Network level: `none`. Matched harnesses compose the sandbox image used by workers and verification. The verification profile is a proposal; the registry does not change job profiles or network access.
+
+## Remaining limitations
+
+Private modules and registries use the build-only credentials described below; no credentials are copied into the image. A failure marker means the cache may be incomplete and offline verification can still fail. Workspace modules and local replacements outside the repository are not copied.
+
+## Requirements and artifacts
+
+No additional resource requirements or artifact globs are declared.
+
+
+## Private registries
+
+Use `registries:` in the gitignored `.nomarmy.local.yml` only; the committed
+config rejects it. Values are host credential **file paths**, never tokens.
+Use `go: { netrc: ~/.netrc, private: "github.com/acme/*" }`. Only `go mod download` receives the node-owned netrc plus RUN-local GOPRIVATE and GONOSUMDB; vendored builds need no download mount.
+
+Credentials stay on the host and enter Podman only as build-secret mounts;
+no credential files are copied into the context or passed to sandbox jobs.
+Use a **read-only, least-privilege token** and reviewed dependencies. Secrets
+are accessible to install code during that RUN, so malicious packages are not
+made safe by a mount. Credential rotation invalidates both tag and install
+cache. Credentialed install output/build-error details are withheld.
+
+See [Private registries](../../docs/your-repo.md#private-registries) for the
+configuration and required manual canary check: inspect `podman history
+--no-trunc`, image configuration, the exported filesystem **and every saved
+image layer**, plus failure logs/job records, for absent secret bytes. Unit
+tests stub Podman; live isolation needs independent security review.

package/harnesses/go/harness.yml

@@ -0,0 +1,14 @@
+name: go
+summary: Go toolchain with prefetched modules for offline verification
+detect:
+  - file: go.mod
+  - file: go.work
+after: []
+image:
+  builtin: go
+verification:
+  quick: go test ./...
+artifacts: []
+requires: {}
+network: none
+docs: README.md

package/harnesses/mock-oidc/README.md

@@ -0,0 +1,31 @@
+# Mock OIDC
+
+Enable explicitly in your repository's `.nomarmy.yml` (there are no detection rules):
+
+```yaml
+harnesses: [mock-oidc]
+verification:
+  auth:
+    commands: [npm test]
+```
+
+Point your application's issuer/discovery configuration at `OIDC_ISSUER` or
+`OAUTH2_ISSUER`, both exported as `http://mock-oidc:8080/default` during nomArmy
+verification. Configure your test client ID, redirect URI and audience to match
+what your application expects; allow HTTP only in this test configuration.
+
+The pinned NAV mock OAuth2 server supplies discovery, signing keys, token and
+mock authorization flows. It is not an Okta/Auth0 tenant: it does not prove real
+identity, MFA, tenant policies, upstream federation or production compatibility.
+Never use real credentials with this fake.
+
+nomArmy pulls the pinned image on the host if missing, then starts it without
+published ports on a per-run `--internal` Podman network. Discovery must return
+2xx within 30 seconds before commands run. Containers and the network are
+removed even if verification fails. Workers remain `--network none`; only
+nomArmy's own verification can reach the fake. Env maps in harness manifests
+are non-secret literals, not secret references or host-environment imports.
+
+`fixture/` is a tiny Node-built-ins-only repository. Run its `quick` profile
+through nomArmy verification. It fetches discovery over the private network;
+it requires no internet or npm packages. It is not a host-side unit test.

package/harnesses/mock-oidc/fixture/.nomarmy.yml

@@ -0,0 +1,4 @@
+harnesses: [mock-oidc]
+verification:
+  quick:
+    commands: [node --test discovery.test.mjs]

package/harnesses/mock-oidc/fixture/discovery.test.mjs

@@ -0,0 +1,16 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+
+test('private mock issuer discovery', async () => {
+  const issuer = process.env.OIDC_ISSUER;
+  assert.equal(issuer, 'http://mock-oidc:8080/default');
+  const response = await fetch(`${issuer}/.well-known/openid-configuration`, {
+    redirect: 'error', signal: AbortSignal.timeout(5000),
+  });
+  assert.equal(response.status, 200);
+  const document = await response.json();
+  assert.equal(document.issuer, issuer);
+  assert.equal(new URL(document.jwks_uri).origin, new URL(issuer).origin);
+  assert.equal(new URL(document.authorization_endpoint).origin, new URL(issuer).origin);
+  assert.equal(new URL(document.token_endpoint).origin, new URL(issuer).origin);
+});

package/harnesses/mock-oidc/harness.yml

@@ -0,0 +1,19 @@
+name: mock-oidc
+summary: Mock OAuth2 and OIDC discovery and login on an isolated verification network
+detect: []
+image:
+  apt: []
+  run: []
+network: services
+services:
+  - name: mock-oidc
+    image: ghcr.io/navikt/mock-oauth2-server:2.1.10
+    port: 8080
+    env:
+      SERVER_PORT: '8080'
+    health: /default/.well-known/openid-configuration
+env:
+  OIDC_ISSUER: http://mock-oidc:8080/default
+  OAUTH2_ISSUER: http://mock-oidc:8080/default
+verification:
+  oidc: node discovery.test.mjs

package/harnesses/node/README.md

@@ -0,0 +1,53 @@
+# Node harness
+
+Node dependencies and workspaces installed with npm, pnpm, yarn or bun.
+
+## Detection
+
+Matches `package-lock.json`, `npm-shrinkwrap.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lock` or `bun.lockb` at the root or in discovered package directories.
+
+## Installed today
+
+Installs dependencies as the `node` user under `/deps` at image build time, on Node 24 / Debian bookworm:
+
+- npm: `npm ci --no-audit --no-fund` (unchanged).
+- pnpm: Corepack and `pnpm install --frozen-lockfile`.
+- Yarn classic: Corepack and `yarn install --frozen-lockfile`.
+- Yarn Berry: detected by `.yarnrc.yml` or lockfile `__metadata`; `YARN_NODE_LINKER=node-modules yarn install --immutable`.
+- Bun: installed globally at build time, then `bun install --frozen-lockfile`.
+
+Corepack respects `packageManager` in the manifest. Without a pin, Yarn defaults to classic or current stable Berry according to detection. Failed installs leave `.nomarmy-npm-ci-failed` for npm or `.nomarmy-<manager>-install-failed` for other managers (`yarn-berry` for Berry).
+
+A manifest's `workspaces` array (or `workspaces.packages`) or `pnpm-workspace.yaml` causes one install at that workspace root. Member manifests are copied at their relative paths, including members without their own lockfile; workspace members are not installed twice. Workspace globs support `*`, `**`, `?`, brace alternatives and exclusions. Non-workspace packages retain separate installs.
+
+Root dependencies resolve through `/node_modules`; workspace roots and members also receive worktree links into `/deps`, preserving pnpm's relative store links. The root binary PATH remains `/deps/node_modules/.bin`. Copied manifests, lockfiles and workspace/config files participate in the image tag.
+
+Private registries use operator-local build secrets; see the configuration and Yarn Berry limitation below.
+
+## Verification and network
+
+Proposes `npm test` as the `quick` profile. Network level: `none`. Matched harnesses compose the sandbox image used by workers and verification. The verification profile is a proposal; the registry does not change job profiles or network access.
+
+## Requirements and artifacts
+
+No additional resource requirements or artifact globs are declared.
+
+
+## Private registries
+
+Use `registries:` in the gitignored `.nomarmy.local.yml` only; the committed
+config rejects it. Values are host credential **file paths**, never tokens.
+npm, pnpm, Yarn Classic and bun read the mounted `.npmrc` as node (uid 1000). Credentialed Yarn Berry builds are currently rejected because Berry does not read `.npmrc`.
+
+Credentials stay on the host and enter Podman only as build-secret mounts;
+no credential files are copied into the context or passed to sandbox jobs.
+Use a **read-only, least-privilege token** and reviewed dependencies. Secrets
+are accessible to install code during that RUN, so malicious packages are not
+made safe by a mount. Credential rotation invalidates both tag and install
+cache. Credentialed install output/build-error details are withheld.
+
+See [Private registries](../../docs/your-repo.md#private-registries) for the
+configuration and required manual canary check: inspect `podman history
+--no-trunc`, image configuration, the exported filesystem **and every saved
+image layer**, plus failure logs/job records, for absent secret bytes. Unit
+tests stub Podman; live isolation needs independent security review.

package/harnesses/node/harness.yml

@@ -0,0 +1,18 @@
+name: node
+summary: Node dependencies and workspaces installed with npm, pnpm, yarn or bun
+detect:
+  - lockfile: package-lock.json
+  - lockfile: npm-shrinkwrap.json
+  - lockfile: pnpm-lock.yaml
+  - lockfile: yarn.lock
+  - lockfile: bun.lock
+  - lockfile: bun.lockb
+after: []
+image:
+  builtin: node
+verification:
+  quick: npm test
+artifacts: []
+requires: {}
+network: none
+docs: README.md

package/harnesses/python/README.md

@@ -0,0 +1,46 @@
+# Python harness
+
+Python dependencies from uv, Poetry, pyproject, or requirements files.
+
+## Detection
+
+Matches `uv.lock`, `poetry.lock`, `pyproject.toml`, or `requirements.txt` at the repository root. Explicit `environment.python.requirements` in `.nomarmy.yml` wins; otherwise the install precedence is uv.lock, poetry.lock (or `[tool.poetry]`), `[project]` in pyproject.toml, then requirements.txt.
+
+## Installed dependencies
+
+Installs Python 3, pip, venv, and build-essential alongside the Node 24 base. Dependency downloads happen at image build time, not in the offline sandbox.
+
+- **uv:** installs uv and runs `uv sync --frozen --no-install-project --all-groups`, including dev groups, from the copied pyproject.toml and uv.lock.
+- **Poetry:** installs Poetry and runs `poetry install --no-root --no-interaction` from pyproject.toml and poetry.lock when present. Adds `--with dev` only when a Poetry dev group exists. Legacy dev dependencies follow Poetry's default behavior.
+- **Plain pyproject:** uses Python's TOML parser to install `[project].dependencies` and optional `test`, `tests`, and `dev` dependencies with pip, without installing the project itself. A lockfile makes dependency resolution reproducible; unlocked pyproject dependencies may resolve differently on rebuild.
+- **Requirements:** retains the existing system `pip3 install --no-cache-dir --break-system-packages` path. Uses requirements.txt by default; set `environment.python.requirements` to select other or multiple files. Explicit requirements also activate composition without a registry detect match.
+
+The project-manager paths share `/deps/python/.venv`. `VIRTUAL_ENV` is set, and its bin directory comes first in both the image PATH and worker exec PATH. Install failures leave `/deps/python/.nomarmy-<manager>-install-failed` (uv, poetry, or pyproject) instead of failing the image build. Copied manifests and lockfiles are hashed into the image tag. Local/path dependencies and workspace members not included in the root metadata context may require an explicit requirements configuration.
+
+## Verification and network
+
+The registry proposes `python3 -m unittest discover` as the `quick` profile. Config proposals use test commands found in evidence, or suggest `pytest` for project manifests; review that pytest is declared and appropriate. Network level: `none`. Matched harnesses compose the sandbox image used by workers and verification. Verification profiles are proposals; the registry does not change job profiles or network access.
+
+## Requirements and artifacts
+
+No additional resource requirements or artifact globs are declared.
+
+
+## Private registries
+
+Use `registries:` in the gitignored `.nomarmy.local.yml` only; the committed
+config rejects it. Values are host credential **file paths**, never tokens.
+pip uses `/etc/pip.conf`; for uv or Poetry use `pip: { netrc: ~/.netrc }` and credential-free index/source URLs in project metadata. The secret is mounted only for the root-owned install RUN, including venv installs.
+
+Credentials stay on the host and enter Podman only as build-secret mounts;
+no credential files are copied into the context or passed to sandbox jobs.
+Use a **read-only, least-privilege token** and reviewed dependencies. Secrets
+are accessible to install code during that RUN, so malicious packages are not
+made safe by a mount. Credential rotation invalidates both tag and install
+cache. Credentialed install output/build-error details are withheld.
+
+See [Private registries](../../docs/your-repo.md#private-registries) for the
+configuration and required manual canary check: inspect `podman history
+--no-trunc`, image configuration, the exported filesystem **and every saved
+image layer**, plus failure logs/job records, for absent secret bytes. Unit
+tests stub Podman; live isolation needs independent security review.

package/harnesses/python/harness.yml

@@ -0,0 +1,16 @@
+name: python
+summary: Python dependencies from uv, Poetry, pyproject, or requirements files
+detect:
+  - file: uv.lock
+  - file: poetry.lock
+  - file: pyproject.toml
+  - file: requirements.txt
+after: []
+image:
+  builtin: python
+verification:
+  quick: python3 -m unittest discover
+artifacts: []
+requires: {}
+network: none
+docs: README.md

package/harnesses/rust/README.md

@@ -0,0 +1,45 @@
+# Rust harness
+
+Rust toolchain with prefetched crates for offline verification.
+
+## Detection
+
+Matches `Cargo.toml` at the repository root.
+
+## Installed today
+
+Installs stable Rust through rustup with its minimal profile, plus build-essential, on the Node 24 Debian bookworm base with Python 3 and pip. Cargo and rustup live under the node user.
+
+At image build, copies root and nested `Cargo.toml` files through four directory levels, excluding `target/` and dot folders, plus root `Cargo.lock` when present. The isolated build context includes placeholder library and binary sources and explicit target paths so Cargo can parse packages without copying application code. Runs `cargo fetch` as node (`--locked` when the lockfile exists), caching crates under `/home/node/.cargo`. A failed fetch leaves `/deps/rust/.nomarmy-cargo-fetch-failed` without failing the image build. Runtime sets `CARGO_NET_OFFLINE=true`. All copied manifests, the lockfile and generated targets contribute to the image tag. The layer composes with other matched harnesses.
+
+## Verification and network
+
+Proposes `cargo test` as the `quick` profile. Network level: `none`. Matched harnesses compose the sandbox image used by workers and verification. The verification profile is a proposal; the registry does not change job profiles or network access.
+
+## Remaining limitations
+
+Private modules and registries use the build-only credentials described below; no credentials are copied into the image. A failure marker means the cache may be incomplete and offline verification can still fail. Workspace members and path dependencies outside the repository or deeper than four directories are not copied. Root `.cargo/config` and `.cargo/config.toml` are copied as credential-free registry metadata; unusual manifests may require additional target handling.
+
+## Requirements and artifacts
+
+No additional resource requirements or artifact globs are declared.
+
+
+## Private registries
+
+Use `registries:` in the gitignored `.nomarmy.local.yml` only; the committed
+config rejects it. Values are host credential **file paths**, never tokens.
+Use `cargo: ~/.cargo/credentials.toml`. Only `cargo fetch` receives the node-owned secret mount. Configure registry names/index URLs without tokens in project metadata.
+
+Credentials stay on the host and enter Podman only as build-secret mounts;
+no credential files are copied into the context or passed to sandbox jobs.
+Use a **read-only, least-privilege token** and reviewed dependencies. Secrets
+are accessible to install code during that RUN, so malicious packages are not
+made safe by a mount. Credential rotation invalidates both tag and install
+cache. Credentialed install output/build-error details are withheld.
+
+See [Private registries](../../docs/your-repo.md#private-registries) for the
+configuration and required manual canary check: inspect `podman history
+--no-trunc`, image configuration, the exported filesystem **and every saved
+image layer**, plus failure logs/job records, for absent secret bytes. Unit
+tests stub Podman; live isolation needs independent security review.

package/harnesses/rust/harness.yml

@@ -0,0 +1,13 @@
+name: rust
+summary: Rust toolchain with prefetched crates for offline verification
+detect:
+  - file: Cargo.toml
+after: []
+image:
+  builtin: rust
+verification:
+  quick: cargo test
+artifacts: []
+requires: {}
+network: none
+docs: README.md

package/install.sh

@@ -72,7 +72,7 @@ MSG
     exit 1
     ;;
   *)
-    echo "ERROR: $OS_NAME is not a supported host. See the README for supported platforms." >&2
+    echo "ERROR: $OS_NAME is not a supported host. See docs/install.md for supported platforms." >&2
     exit 1
     ;;
 esac
@@ -87,7 +87,9 @@ echo '==> Installing nomArmy dependencies'
 
 # Put `nomarmy` on PATH. Non-fatal by design: linking needs a writable npm
 # global prefix, and the CLI is equally usable as `node bin/nomarmy.mjs`.
-if (cd "$ROOT" && npm link >/dev/null 2>&1); then
+if [[ "$ROOT" == */node_modules/* ]]; then
+  : # Installed from npm: `nomarmy` is already on PATH.
+elif (cd "$ROOT" && npm link >/dev/null 2>&1); then
   echo '==> Linked the nomarmy CLI onto PATH'
 else
   echo 'NOTE: could not link the nomarmy CLI (npm global prefix not writable).'
@@ -99,10 +101,13 @@ fi
 # on a fresh macOS install nothing has initialized that VM yet at this point.
 if nomarmy_is_cloud; then need aws || { echo 'ERROR: the AWS CLI is required for cloud profiles.'; exit 1; }; fi
 "$ROOT/scripts/install-llama-cpp.sh" "$NOMARMY_PROFILE"
-if ! command -v openclaw >/dev/null 2>&1; then
-  echo '==> Installing OpenClaw (non-interactive)'
-  curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard
-  export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
+# One shared installation policy; no dist-tag or environment override.
+# Only this process's PATH is changed, never a shell rc file.
+export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
+if [[ -w "$(npm prefix -g)" ]]; then
+  node "$ROOT/scripts/install-openclaw.mjs"
+else
+  node "$ROOT/scripts/install-openclaw.mjs" --prefix "$HOME/.npm-global"
 fi
 need openclaw
 if nomarmy_has_local_model; then openclaw plugins install @openclaw/llama-cpp-provider || true; fi
@@ -111,10 +116,16 @@ if nomarmy_has_local_model; then openclaw plugins install @openclaw/llama-cpp-pr
 # Bedrock credential unless the coder sandbox is already network-isolated.
 "$ROOT/scripts/setup-sandbox.sh"
 "$ROOT/scripts/configure-openclaw.sh" "$NOMARMY_PROFILE"
-if [[ "$WITH_CLAUDE" == 1 ]]; then
-  if command -v claude >/dev/null 2>&1; then node "$ROOT/bin/nomarmy.mjs" connect claude; else echo 'NOTE: Claude Code not found; worker stack installed. Install Claude Code then run: nomarmy connect claude'; fi
+if [[ "${NOMARMY_COORDINATOR_OS:-}" == windows ]]; then
+  # Run from the Windows front end: the coordinators are Windows programs,
+  # registered from Windows, not looked for inside this distro.
+  echo 'NOTE: register your coordinators from Windows PowerShell: nomarmy connect claude (or codex, cursor)'
+else
+  if [[ "$WITH_CLAUDE" == 1 ]]; then
+    if command -v claude >/dev/null 2>&1; then node "$ROOT/bin/nomarmy.mjs" connect claude; else echo 'NOTE: Claude Code not found; worker stack installed. Install Claude Code then run: nomarmy connect claude'; fi
+  fi
+  if command -v codex >/dev/null 2>&1; then node "$ROOT/bin/nomarmy.mjs" connect codex; else echo 'NOTE: Codex not found; run: nomarmy connect codex (after installing Codex)'; fi
 fi
-if command -v codex >/dev/null 2>&1; then node "$ROOT/bin/nomarmy.mjs" connect codex; else echo 'NOTE: Codex not found; run: nomarmy connect codex (after installing Codex)'; fi
 "$ROOT/scripts/verify-install.sh" "$NOMARMY_PROFILE"
 if nomarmy_is_cloud && [[ "${NOMARMY_ORCHESTRATOR_RUNTIME:-}" == "claude-code" ]]; then
   echo
@@ -127,3 +138,12 @@ if [[ "$(nomarmy_execution_mode)" == hosted ]]; then
 else
   echo "==> Install complete. Run: ./e2e.sh --profile $NOMARMY_PROFILE"
 fi
+# Record only a completed, verified installation.
+node --input-type=module - "$ROOT/package.json" "$NOMARMY_INSTALL_ROOT" "$NOMARMY_PROFILE" "$(nomarmy_execution_mode)" <<'JS'
+import fs from 'node:fs';
+import path from 'node:path';
+const [pkg, root, profile, execution] = process.argv.slice(2);
+const { version } = JSON.parse(fs.readFileSync(pkg, 'utf8'));
+fs.mkdirSync(root, { recursive: true });
+fs.writeFileSync(path.join(root, 'install.json'), JSON.stringify({ profile, execution, installedAt: new Date().toISOString(), version }, null, 2) + '\n');
+JS