NanoClaw
NanoClaw offers a digest-pinned hardened agent image without replacing local builds
NanoClaw added an optional prebuilt agent image pinned by digest for amd64 and arm64, with provenance labels and lockfile compatibility checks. Local builds remain the default; update-audit and smoke-test work documents how clean merges and green TypeScript can still leave runtime bytes wrong.
nanocoai/nanoclaw PR #3150 is the inspected primary source: “setup: fetch a hardened agent image instead of building it.” The two related records below were inspected as supporting context, not treated as independent confirmation.
The facts
- nanocoai/nanoclaw PR #3150 was created 2026-07-29T16:11:25Z and was closed at inspection; its title is “setup: fetch a hardened agent image instead of building it.” - nanocoai/nanoclaw PR #1136 was created 2026-03-16T12:36:08Z and was closed at inspection; its title is “feat(update-nanoclaw): add auto-merge audit and container smoke test.” - nanocoai/nanoclaw PR #3146 was created 2026-07-28T08:00:51Z and was open at inspection; its title is “scripts: repair two dev scripts that rotted against the current architecture.” - The repository reported 30391 stars, 857 open issues, default branch main, and last push 2026-07-29T18:21:14Z. - The latest tagged-release baseline checked was v2.1.17 published 2026-06-17T14:51:14Z.
What changed
nanocoai/nanoclaw PR #3150 reports: Adds a second way to get the agent container image: **fetch a prebuilt, hardened one from the NanoClaw registry** instead of building it locally. Building stays the default, stays the only path that needs no account, and is unchanged. The image is built by **[Echo]**, who rebuild the sandbox's contents — Chromium, Node, Bun, pnpm, git and the rest — from scratch with only the essentials, and patch what remains. Isolation already keeps a misbehaving agent away from the host; this is the other half, and the reason it exists:
nanocoai/nanoclaw PR #1136 reports: What Adds two safety steps to the /update-nanoclaw skill that catch silent code drops during upstream merges. Why Git auto-merge can delete code without producing conflict markers when upstream restructures a file that our side didn't modify. This was discovered the hard way — a secrets injection loop and createSanitizeBashHook both vanished silently after a merge. TypeScript compiled clean, tests passed, but runtime was broken. Related issue: #1135 Changes Step 4.5 — Auto-merge audit** After merging, diffs three critical files against the pre-merge backup tag to catch silently deleted code:
nanocoai/nanoclaw PR #3146 reports: Two dev scripts had drifted from the architecture around them. Both are the same shape: a script that predates a migration the rest of the tree completed, and that nothing runs often enough to have caught it. scripts/test-v2-host.ts Dies before it can spawn a container: It creates its agent group with createAgentGroup alone, but container runtime config lives in its own table now and the spawn path requires a row — materializeContainerJson throws rather than inventing defaults. Every real creation path pairs the two calls (group-init, ncl groups create, init-first-agent,
Why it matters
Agent containers execute browsers, shells and downloaded tools, so the base image is part of the trust boundary. A hardened artifact is useful only if operators can verify architecture, source, dependency lock and what later layers changed. This is an operator boundary: persisted state, execution ownership and visible controls must describe the same event. A workaround that broadens access, deletes state or hides the symptom would trade a visible defect for an unmeasured one.
Current
The primary record was closed when captured on 2026-07-30. The release baseline was v2.1.17 published 2026-06-17T14:51:14Z. Current repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts row were checked. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/nanocoai/nanoclaw/pull/3150. Supporting records are https://github.com/nanocoai/nanoclaw/pull/1136 and https://github.com/nanocoai/nanoclaw/pull/3146. Their source bodies, timestamps and states were captured in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Issue closure would not by itself prove a deployed fix. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Keep the registry path optional, verify attestations rather than labels alone, and report added tool layers as outside the publisher’s scan. A digest proves identity, not quality. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.