NanoClaw
NanoClaw puts source installs behind explicit operator policy
NanoClaw is adding list, plan and apply commands for source capability installs while leaving the feature disabled by default. Companion skill metadata requires explicit invocation, and the OpenCode installer adopts a declared provider contract with conformance checks.
nanocoai/nanoclaw PR #3720 is the inspected primary source: “feat(skills): add opt-in source installation with guarded recovery.” The related records were inspected as supporting context rather than independent confirmation.
The facts
- nanocoai/nanoclaw PR #3720 was created 2026-09-04T22:44:45Z and was open at inspection; its title is “feat(skills): add opt-in source installation with guarded recovery.” - nanocoai/nanoclaw PR #3721 was created 2026-09-04T22:45:24Z and was open at inspection; its title is “fix(skills): require explicit installation and respect operator policy.” - nanocoai/nanoclaw PR #3722 was created 2026-09-04T23:48:25Z and was open at inspection; its title is “refactor(providers): adopt the OpenCode contract in its install skill.” - The repository reported 30701 stars, 1090 open issues, default branch main, and last push 2026-09-04T23:48:01Z. - The latest tagged-release baseline checked was v2.3.0 published 2026-08-24T11:45:32Z.
What changed
nanocoai/nanoclaw PR #3720 reports: Summary Add ncl skills list, plan, and operator-enabled apply for structured capability installation. **Boundary**: source installation is disabled by default, requires an explicitly enabled Git checkout, and cannot be enabled by agent approval. **Recovery**: one checkout lock covers all engine callers and failed-install rollback. Save file contents before mutation; restore dependency manifests and lockfiles before reinstalling. **Setup**: keep tested code as needs-setup when credentials or interactive steps remain. Report those steps to the operator and restart only after applied. **Limit**: rollback covers journaled files, not process crashes, generated build output, or arbitrary command effects. A crash leaves a lock requiring operator inspection. Change kind [x] kind/feature Validation 447 focused tests passed on this branch, including partial copy failures, dependency restoration, lock contention during rollback, policy refusal, approval replay, and pending credentials. Host and engine TypeScript checks passed. Actual headless CLI refused an install with the default policy before mutation. [x] Tests cover the changed behavior User and release impact [x] User-visible change — release note below Security and trust boundaries Agent credentials are refused before approval and again in the child. External and interactive setup remain operator-owned. Deployment policy is rechecked on approval replay and execution. Skill delivery [x] Not a skill AI assistance [x] AI tools or agents helped produce this change [ ] A human has reviewed this PR and stands behind every change
nanocoai/nanoclaw PR #3721 reports: Summary Make capability-install skills explicitly invoked and route installation requests through the guarded CLI. **Instructions**: respect deployment refusals and needs-setup; do not bypass refusal through direct scripts or manual edits. **Metadata**: preserve explicit invocation while disabling implicit selection in Claude Code and Codex. **Dependency**: stacked on #3720 and adds one commit. Change kind [x] kind/hardening Validation 406 focused tests passed with both branches applied. Broader CLI, approvals, and engine regression: 699 tests passed in the sandbox; the five socket tests blocked by the sandbox passed when rerun outside it. Skill validators passed for both edited operational workflows. Conformance checks cover the invocation flags and retain structured install directives. Isolated Git worktrees were used. Metadata and instructions change; no payload files are added or removed. Live provider setup was not exercised. [x] Tests cover the changed behavior User and release impact [x] User-visible change — release note below Security and trust boundaries Invocation metadata reduces implicit loading; it is not an authorization boundary. The CLI enforces operator policy and approval. Skill delivery [x] Skill: apply/remove footprint and fresh-clone verification are described above AI assistance [x] AI tools or agents helped produce this change [ ] A human has reviewed this PR and stands behind every change
nanocoai/nanoclaw PR #3722 reports: Type of Change [ ] **Feature skill** - adds a channel or integration (source code changes + SKILL.md) [ ] **Utility skill** - adds a standalone tool (code files in.claude/skills/ /, no source changes) [ ] **Operational/container skill** - adds a workflow or agent skill (SKILL.md only, no source changes) [ ] **Fix** - bug fix or security fix to source code [x] **Simplification** - reduces or simplifies source code [ ] **Documentation** - docs, README, or CONTRIBUTING changes only Description Move OpenCode's contract adoption out of #3586 so the core and Codex stack can land independently. /add-opencode copies the host/runtime contracts and conformance tests, wires the contract barrels, and requires its declared contract during verification. The removal instructions reverse this footprint. Combined-provider CI then requires every selected provider to declare its contract. Depends on core #3592 and OpenCode payload #3588. Keep this draft until the OpenCode work is ready; merge #3588 before this skill change. No Cursor changes are included. Validation: fresh combined install, refresh, builds, typecheck, provider suites, and contract inventory passed on current main plus the core stack, using payload 8b412b5e9574e9b0fb001b25e89d077e0cd2adc7. The install/removal instructions are unchanged from the previously verified OpenCode contract skill. For Skills [x] SKILL.md contains instructions, not inline code (code goes in separate files) [x] SKILL.md is under 500 lines [x] I tested this skill on a fresh clone
Why it matters
A conversational install request crosses code, dependency, credential and restart boundaries. Approval text is not enough unless execution rechecks operator policy and can restore journaled files. The practical test is whether the system remains bounded and its receipts still describe the action after failure, retry or restart.
Current
The primary record was open when captured on 2026-09-05. The tagged-release baseline was v2.3.0 published 2026-08-24T11:45:32Z. Repository metadata, source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/nanocoai/nanoclaw/pull/3720. Supporting records are https://github.com/nanocoai/nanoclaw/pull/3721 and https://github.com/nanocoai/nanoclaw/pull/3722. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Separate planning from apply, require an enabled checkout and replay-safe approval, preserve manifests before mutation, stop at needs-setup, and never let agent guidance route around a deployment refusal. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.