Compatibility

This compatibility page is generated from canonical repo-owned source material in JaddaHelpifyr/jhf-openclaw-env.

Compatibility Sources

• docs/OSS_INVENTORY.md
• docs/STACK_RUNTIME_CONTRACT.md
• docs/OPENCLAW_RUNTIME_VERSION_FLOOR.md

Derived from Stack OSS Runtime Materialization

---

title: Stack OSS Runtime Materialization description: Stack OSS Runtime Materialization documentation for jhf-openclaw-env. doc_class: canonical wiki_publish_policy: full source_repo: JaddaHelpifyr/jhf-openclaw-env source_path: docs/OSS_INVENTORY.md status: active

Stack OSS Runtime Materialization

This document defines the canonical runtime inventory and drift-verifier lane for env-owned OSS versions on <internal-runtime-redacted>.

Every inventory component carries license, license_class, and license_evidence_url. Until component-specific legal evidence is reviewed, the only valid posture is NOASSERTION with unknown_blocked; inventory discovery never infers or approves a third-party license.

A component can leave that posture only with a component-specific license_evidence_url and an allow-listed, applicable fabric_policy_decision_ref. The current decision allow-list is helpifyr-fabric#1540 (runtime-reference/distribution model) and helpifyr-fabric#1541 (managed-hosting/service channel); adding another decision is a separately reviewed Fabric-policy change, never an inventory-only edit.

Scope

The current repo-owned discoverability slice for Fabric consumer scans is tracked in jhf-openclaw-env#1426.

Issue references: jhf-openclaw-env#1426, jhf-openclaw-env#209, jhf-openclaw-env#214, jhf-openclaw-env#251, jhf-openclaw-env#313, follow-up refresh jhf-openclaw-env#1528

License-metadata follow-through: jhf-openclaw-env#2569, parent jhf-beam#617, and legal umbrella helpifyr-fabric#1543.

Env-owned/runtime-owned in this repository:

• Docker Engine
• Docker Compose
• containerd
• runc
• adguard (adguard/adguardhome:v0.107.74)
• caddy (caddy:2.8.4)
• portainer (portainer/portainer-ce:2.39.1)
• MinIO scanner truth token (minio:2025.9.7)
• Valkey (valkey/valkey:7.2.11-alpine)

Ingress/platform upgrade consumers enforced by this repository:

• wikijs-proxy-nginx (Fabric platform ingress family, validated through machine-readable readback/compatibility contracts and fail-closed verifiers)

Canonical upgrade/materialization mirrors for the OpenClaw runtime pin:

• primary runtime pin: deploy/compose/jhf-openclaw-env.stack.yml
• secondary/runtime-shadow pin: deploy/compose/jhf-openclaw-env-wave9-secondary-73.stack.yml
• scanner truth mirror: deploy/compose/compose.oss-version-truth.yml
• operator canary path: scripts/host_openclaw_gateway_canary.sh

Canonical contracts:

• config/contracts/openclaw_stack_oss_runtime_materialization.v1.json (config/contracts/openclaw_stack_oss_runtime_materialization.v1.json)
• config/contracts/openclaw_fabric_tool_oss_directory_runtime.v1.json (config/contracts/openclaw_fabric_tool_oss_directory_runtime.v1.json)
• maintenance/oss-inventory.json (maintenance/oss-inventory.json)
• maintenance/oss-version-truth.json (maintenance/oss-version-truth.json)
• maintenance/openclaw-2026.6.8-<internal-runtime-redacted> (maintenance/openclaw-2026.6.8-<internal-runtime-redacted>)
• maintenance/oss-upgrade-governance.json (maintenance/oss-upgrade-governance.json)
• maintenance/oss-upgrade-readback-policy.json (maintenance/oss-upgrade-readback-policy.json)

Canonical machine-readable source paths for Fabric consumer scans:

• config/contracts/openclaw_stack_oss_runtime_materialization.v1.json
• config/contracts/openclaw_fabric_tool_oss_directory_runtime.v1.json
• maintenance/oss-inventory.json
• maintenance/oss-version-truth.json
• maintenance/openclaw-2026.6.8-<internal-runtime-redacted>
• maintenance/oss-upgrade-governance.json
• maintenance/oss-upgrade-readback-policy.json

Canonical verifiers:

• scripts/verify_stack_oss_runtime_materialization.py (scripts/verify_stack_oss_runtime_materialization.py)
• scripts/verify_fabric_tool_oss_directory_runtime.py (scripts/verify_fabric_tool_oss_directory_runtime.py)
• scripts/verify_oss_inventory_version_truth.py (scripts/verify_oss_inventory_version_truth.py)
• scripts/verify_oss_upgrade_fail_closed.py (scripts/verify_oss_upgrade_fail_closed.py)
• scripts/verify_openclaw_2026_6_8_<internal-runtime-redacted>_prep.py (scripts/verify_openclaw_2026_6_8_<internal-runtime-redacted>_prep.py)

Fabric upstream contract references consumed by this owner repo:

• helpifyr-fabric/contracts/platform/platform_version_truth.json
• helpifyr-fabric/contracts/platform/platform_projection_catalog.json
• helpifyr-fabric/contracts/platform/platform_oss_upgrade_governance_v1.json
• helpifyr-fabric/contracts/platform/platform_oss_upgrade_compatibility_matrix_v1.json
• helpifyr-fabric/contracts/platform/platform_oss_upgrade_evidence_contract_v1.json
• helpifyr-fabric/contracts/platform/helpifyr_stack_module_identity_v1.json
• helpifyr-fabric/contracts/platform/stack_tool_oss_inventory_directory.json

Acceptance Contract

Repo and live runtime are healthy when all are true:

• env-owned compose truth stays pinned (no latest/unknown) in:
  • deploy/compose/compose.oss-version-truth.yml
  • deploy/compose/jhf-openclaw-env.stack.yml
• docs truth in:
  • docs/STACK_RUNTIME_CONTRACT.md (docs/STACK_RUNTIME_CONTRACT.md)
  • docs/ENV_BASELINE.md (docs/ENV_BASELINE.md) matches the contract.
• live host readback confirms:
  • host runtime versions match contract
  • env-owned containers use pinned images
  • env-owned compose labels materialize from canonical compose/workdir paths.

Floating tags for non-env projects are recorded as observations and must not be misclassified as env-owned drift.

For upgrade-readiness and inventory-truth release gates, this repository provides a strict fail-closed mode that also fails when tracked non-env floating tags are still present.

For the Beam/Fabric directory followthrough lane, live runtime health also requires that GET /api/v1/platform/tool-oss-inventory-directory keeps the owner-followthrough classifier fields (owner_followthrough_count, owner_followthrough_issue_refs, workspace_observation_gap_count) present while the current canonical readback for jhf-openclaw-env remains fully ready:

• summary_status=ready
• blocked_tool_count=0
• consumer_contract_gap_count=0
• the jhf-openclaw-env entry stays status=ready and blocking_scope=ready

That preserves Beam's ability to distinguish future owner followthrough from repo-owned consumer drift without forcing this repo to keep reporting an already-resolved blocked posture.

Upgrade Materialization Path

The env-owned upgrade path is only considered reproducible when the same version truth is mirrored across all owner surfaces:

1. update the primary runtime pin in deploy/compose/jhf-openclaw-env.stack.yml
2. update the secondary/runtime-shadow pin in deploy/compose/jhf-openclaw-env-wave9-secondary-73.stack.yml
3. keep scanner truth aligned in deploy/compose/compose.oss-version-truth.yml
4. keep the operator canary default aligned in scripts/host_openclaw_gateway_canary.sh
5. rerun repo verifier, then live verifier, then post-push live verifier

This prevents “docs say upgraded, host is upgraded, but secondary/canary truth still points at an old image” drift.

Candidate-Only <internal-runtime-redacted> Pin Prep

Issue reference: jhf-openclaw-env#973

The current env-owned rollout truth is pinned to ghcr.io/openclaw/openclaw:2026.6.8. The file maintenance/openclaw-2026.6.8-<internal-runtime-redacted> (maintenance/openclaw-2026.6.8-<internal-runtime-redacted>) is a candidate-only preparation artifact for the later <internal-runtime-redacted> move to ghcr.io/openclaw/openclaw:2026.6.8.

It must stay fail-closed:

• <internal-runtime-redacted>_executed=false
• <internal-runtime-redacted>_ready_now=false
• human go-live gate remains mandatory
• no claim that 2026.6.8 is already the live <internal-runtime-redacted> image

Prep verification:

• python scripts/verify_openclaw_2026_6_8_<internal-runtime-redacted>_prep.py
• python scripts/verify_openclaw_2026_6_8_<internal-runtime-redacted>_prep.py --live-via-ssh <internal-runtime-redacted><internal-runtime-redacted>

Verify Path

Repo checks:

• python scripts/verify_oss_inventory_version_truth.py
• python scripts/verify_oss_upgrade_fail_closed.py --validate-only
• python scripts/verify_stack_oss_runtime_materialization.py
• python scripts/verify_fabric_tool_oss_directory_runtime.py --mode repo
• python infrastructure/validate_environment_contracts.py
• python infrastructure/validate_module_features_registry.py

Live verify:

• python scripts/verify_stack_oss_runtime_materialization.py --live-via-ssh <internal-runtime-redacted><internal-runtime-redacted> --output runtime/evidence/issue209.stack_oss_runtime_materialization.live.json

Strict fail-closed readiness gate (#214):

• python scripts/verify_stack_oss_runtime_materialization.py --live-via-ssh <internal-runtime-redacted><internal-runtime-redacted> --fail-on-non-env-floating --output runtime/evidence/issue214.stack_oss_runtime_materialization.strict.live.json

Fail-closed dry-run proofs (#251):

• python scripts/verify_oss_upgrade_fail_closed.py --simulate-missing target_version
• python scripts/verify_oss_upgrade_fail_closed.py --simulate-missing compatibility_verdict
• python scripts/verify_oss_upgrade_fail_closed.py --simulate-missing readback
• python scripts/verify_oss_upgrade_fail_closed.py --simulate-missing latest_only_drift

Upgrade-path canary:

• bash scripts/host_openclaw_gateway_canary.sh ghcr.io/openclaw/openclaw:2026.6.8 openclaw --version

Post-push live verify (same command, new evidence path):

• python scripts/verify_stack_oss_runtime_materialization.py --live-via-ssh <internal-runtime-redacted><internal-runtime-redacted> --output runtime/evidence/issue209.stack_oss_runtime_materialization.postpush.json

Post-push strict fail-closed verify (#214):

• python scripts/verify_stack_oss_runtime_materialization.py --live-via-ssh <internal-runtime-redacted><internal-runtime-redacted> --fail-on-non-env-floating --output runtime/evidence/issue214.stack_oss_runtime_materialization.strict.postpush.json

Fabric directory followthrough live verify (#313):

• python scripts/verify_fabric_tool_oss_directory_runtime.py --output runtime/evidence/issue313.fabric_tool_oss_directory_runtime.live.json

Fabric directory followthrough post-push verify (#313):

• python scripts/verify_fabric_tool_oss_directory_runtime.py --output runtime/evidence/issue313.fabric_tool_oss_directory_runtime.postpush.json

---

License: AGPLv3 Project: https://helpifyr.com

<!-- BEGIN HELPIFYR CANONICAL OSS INVENTORY -->

Canonical repository OSS inventory v2

The machine-readable source of truth is maintenance/oss-inventory.json; the pinned schema and repo-local verifier are schemas/repository-oss-inventory.schema.json and scripts/verify_repository_oss_inventory.py.

• Observed commit: ecb45942fc60db505ca09bbc2f13e6c50ac03af3
• Status: blocked
• Generated: 2026-08-25T11:49:43Z
• Valid until: 2026-09-24T11:49:43Z

Component	Scope	Current truth
adguard/adguardhome:v0.107.74	direct-runtime	v0.107.74
caddy:2.8.4	direct-runtime	2.8.4
portainer/portainer-ce:2.39.1	direct-runtime	2.39.1
minio/minio:2025.9.7	direct-runtime	2025.9.7
valkey/valkey:7.2.11-alpine	direct-runtime	7.2.11-alpine
ghcr.io/openclaw/openclaw:2026.6.8	direct-runtime	2026.6.8
michaelf34/infinity:0.0.77-cpu	direct-runtime	0.0.77-cpu
caddy:2.8.4	direct-runtime	2.8.4
localai/localai@sha256:736fa3f92dc292108b27a4f68d7441ff7b0baf95e7ee11990411d372d454f895	direct-runtime	736fa3f92dc292108b27a4f68d7441ff7b0baf95e7ee11990411d372d454f895
ghcr.io/openclaw/openclaw:2026.6.8	direct-runtime	2026.6.8
python:3.12-slim	direct-runtime	3.12-slim
adguard/adguardhome:v0.107.74	direct-runtime	v0.107.74
caddy:2.8.4	direct-runtime	2.8.4
cloudflare/cloudflared:2026.3.0	direct-runtime	2026.3.0
portainer/portainer-ce:2.39.1	direct-runtime	2.39.1
nimkaru/custom-ffmpeg-api@sha256:647233ae42f8a6b561905889cddd17d89431a35a3dfc1283d04562cd633c0425	direct-runtime	647233ae42f8a6b561905889cddd17d89431a35a3dfc1283d04562cd633c0425
adguard-runtime	direct-runtime	unknown
portainer-runtime	direct-runtime	unknown
wikijs-proxy-nginx	direct-runtime	unknown
legacy-ffmpeg-api	direct-runtime	unknown

Readiness blockers

This inventory is fail-closed with 6 unresolved evidence finding(s). The complete finding IDs, descriptions, owner actions and manifest evidence references are authoritative in maintenance/oss-inventory.json at evidence.unresolved_findings; the repository is not upgrade-ready until those findings are resolved and the inventory is regenerated. Update this inventory in the same change as any dependency, image, base-image, build-tool or deployment-manifest change. Beam remains read/compare/test/prepare only; Deployment remains plan-only until owner approval and rollback gates.