NanoClaw makes signed images earn the merge verdict

nanocoai/nanoclaw PR #3243 is the inspected primary source: “verify-agent-image: arming auto-merge is not a verdict.” The related records below were inspected as supporting context rather than independent confirmation.

The facts

- nanocoai/nanoclaw PR #3243 was created 2026-08-13T22:07:12Z and was open at inspection; its title is “verify-agent-image: arming auto-merge is not a verdict.” - nanocoai/nanoclaw PR #3241 was created 2026-08-13T21:20:10Z and was closed at inspection; its title is “ci: let a verified signature be the approving review.” - nanocoai/nanoclaw PR #3236 was created 2026-08-13T14:38:26Z and was closed at inspection; its title is “versions: repin the agent image to hardened-2026-08-13.” - The repository reported 30509 stars, 879 open issues, default branch main, and last push 2026-08-13T22:07:10Z. - The latest tagged-release baseline checked was v2.2.0 published 2026-08-13T20:43:27Z.

What changed

nanocoai/nanoclaw PR #3243 reports: Enable auto-merge is the last step in the job, and without continue-on-error its failure decides the job's conclusion. It fails on a draft pull request, whenever allow_auto_merge is off, and on any transient API error — none of which say anything about the image. Now that verify is a required status check, that is a self-inflicted block. And approve-agent-image triggers only on this workflow concluding success, so one flaky call here silently breaks the approval chain behind it *while looking like a signature problem*. Found by a live-fire test.** A draft pin bump verified its signature correctly: and the job went red anyway, blocking the PR and preventing the approver from ever running. A red job here must mean the image failed a check.

nanocoai/nanoclaw PR #3241 reports: Turns the publisher signature into the approving review on a pin bump, so the last human step is gated on something non-forgeable rather than on a click nobody can independently check. Off by default.** Without AGENT_IMAGE_AUTO_APPROVE=true it reports what it would have approved and stops. Merging this changes nothing until you arm it. Why it is a separate workflow verify-agent-image runs on pull_request, so GitHub takes **its workflow file from the pull request's own merge ref**. A PR can rewrite what that job does — including making it succeed. Its conclusion is an attacker-influenced value, and on a public repo with ~13k forks that is not theoretical. Under workflow_run, GitHub takes the file from the **default branch**. This workflow is not editable by the PR it is judging. That is the only thing that makes a machine approval safe here — and it is the same reasoning nanoco-recipes already applies to its fixer: Under workflow_run, GitHub takes the workflow file from the default branch — so Job B's audits are not editable by anything Job A produces. Two rules that follow It never executes pull-request code.** No checkout. The diff

nanocoai/nanoclaw PR #3236 reports: Repins the agent image to hardened-2026-08-13. This one carries our own content, not just a base refresh The previous two bumps shared an ai.echo.image.upstream.digest, so they were the same NanoClaw content on newer hardened layers. This one is different — the upstream digest moved: That digest is docker.io/nanoco/nanoclaw:agent-alpha, which **we** republished on 2026-08-09. Echo rebuilt from it on 08-13. So what is new here originated on our side; Echo's contribution is the same hardening applied to newer input. All eight layers changed, which is what a full rebuild looks like, while the total moved by **+43,925 bytes (+0.007%)** — consistent with a small content delta rather than a different image. Verified before pinning | | | |---|---| | Multi-arch OCI index | linux/amd64 + linux/arm64 | | dev.nanoclaw.image-source | hardened, both children | | dev.nanoclaw.agent-runner-lock-sha256 | 5f49954570dd… — exact match with main | | User / entrypoint | node / tini -- /app/entrypoint.sh | | Layer structure | 8 layers, largest 27%, top three 67% — unchanged | Both architectures were built 7 seconds apart, so they come from one build run. The lock label is the check that matters

Why it matters

Automation that confuses “eligible to merge” with “signature verified” can bless an image before provenance is established. The review and digest must refer to the exact artifact that ships. The operator test is whether visible state, retained state and authority still describe the same event after retries, switching or restart.

Current

The primary record was open when captured on 2026-08-14. The tagged-release baseline was v2.2.0 published 2026-08-13T20:43:27Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/nanocoai/nanoclaw/pull/3243. Supporting records are https://github.com/nanocoai/nanoclaw/pull/3241 and https://github.com/nanocoai/nanoclaw/pull/3236. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Bind signature evidence, approving review and image digest into one immutable receipt, then make auto-merge consume only that receipt. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.