NanoClaw
NanoClaw repins its hardened image without a signature copy
NanoClaw repinned its agent image to a 621 MB hardened base with matching upstream content and lock digests, then documented the migration for local-build users. The copy preserves the OCI digest across two architectures, but signature artifacts were not copied; a separate fix rotates dead sessions when transcripts vanish.
nanocoai/nanoclaw PR #3182 is the inspected primary source: “versions: repin the agent image to hardened-2026-08-02.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- nanocoai/nanoclaw PR #3182 was created 2026-08-03T16:19:24Z and was closed at inspection; its title is “versions: repin the agent image to hardened-2026-08-02.” - nanocoai/nanoclaw PR #3180 was created 2026-08-03T09:46:19Z and was closed at inspection; its title is “fix(update): surface hardened image migration.” - nanocoai/nanoclaw PR #3184 was created 2026-08-03T16:56:49Z and was open at inspection; its title is “fix(claude): rotate on missing transcript instead of resuming into a dead session.” - The repository reported 30422 stars, 865 open issues, default branch main, and last push 2026-08-03T16:22:48Z. - The latest tagged-release baseline checked was v2.1.54 published 2026-08-01T20:46:31Z.
What changed
nanocoai/nanoclaw PR #3182 reports: Repins the agent image to hardened-2026-08-02. Same agent, refreshed base Both builds carry an identical ai.echo.image.upstream.digest of sha256:dce9da56…, so the NanoClaw content going in is byte-for-byte what the current pin was built from. What moved is underneath it — this is a base refresh, not a new agent build, which is what keeps the risk of this bump low. The +1.6% is consistent with that reading, and the layer structure the previous repin was chosen for is intact: | | largest layer | top three | layers | |---|---|---|---| | old | 26% | 67% | 8 | | new | 27% | 67% | 8 | So pull time should be unchanged. A pull is gated by its largest single layer — one layer
nanocoai/nanoclaw PR #3180 reports: Type of Change [ ] **Feature skill** - adds a channel or integration (source code changes + SKILL.md) [ ] **Utility skill** - adds a standalone tool (code files in.claude/skills/ /, no source changes) [x] **Operational/container skill** - adds a workflow or agent skill (SKILL.md only, no source changes) [ ] **Fix** - bug fix or security fix to source code [ ] **Simplification** - reduces or simplifies source code [ ] **Documentation** - docs, README, or CONTRIBUTING changes only Description Existing local-build installs could miss the hardened image option after initial setup. Add a [BREAKING] changelog entry and a complete migration section in the hardened-image guide. /update-nanoclaw now reads linked migration guides and offers their documented fix. Testing pnpm run build host and
nanocoai/nanoclaw PR #3184 reports: Type of Change [x] **Fix** - bug fix or security fix to source code Description Impact:** when a stored continuation's transcript file no longer exists, the next message to that session dies with No conversation found with session ID: — and every later message dies the same way. The batch is acked completed before the error surfaces, so the user's message is lost, not retried. The session is permanently bricked until something else clears the continuation. When:** any time a transcript disappears out from under a stored continuation — external cleanup, a deploy that didn't carry session files over, manual deletion. On the install where this was diagnosed, 22 sessions across 6 agent groups were in this state. Cause:** maybeRotateContinuation treats "transcript not found" (and
Why it matters
A digest pin is stronger than a mutable tag, but it is not a signature. The migration is still operationally meaningful because local-build installs could miss the hardened option and dead continuations could acknowledge a message before losing it. The operator test is whether persisted state, execution authority and the visible user outcome describe the same event after retries, restarts or delegation.
Current
The primary record was closed when captured on 2026-08-04. The release baseline was v2.1.54 published 2026-08-01T20:46:31Z. Repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts row were checked. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/nanocoai/nanoclaw/pull/3182. Supporting records are https://github.com/nanocoai/nanoclaw/pull/3180 and https://github.com/nanocoai/nanoclaw/pull/3184. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Verify the pinned digest on both architectures, publish or copy attestations before automation, and test missing-transcript recovery without claiming a vanished conversation was archived. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.