Skip to main content

OSS Inventory

title: Stack OSS Runtime Materialization description: Stack OSS Runtime Materialization documentation for jhf-openclaw-env. doc_class: canonical wiki_publish_policy: full source_repo: JaddaHelpifyr/jhf-openclaw-env source_path: docs/OSS_INVENTORY.md status: active​

Stack OSS Runtime Materialization

This document defines the canonical runtime inventory and drift-verifier lane for env-owned OSS versions on <internal-runtime-redacted>.

Every inventory component carries license, license_class, and license_evidence_url. Until component-specific legal evidence is reviewed, the only valid posture is NOASSERTION with unknown_blocked; inventory discovery never infers or approves a third-party license.

A component can leave that posture only with a component-specific license_evidence_url and an allow-listed, applicable fabric_policy_decision_ref. The current decision allow-list is helpifyr-fabric#1540 (runtime-reference/distribution model) and helpifyr-fabric#1541 (managed-hosting/service channel); adding another decision is a separately reviewed Fabric-policy change, never an inventory-only edit.

Scope​

The current repo-owned discoverability slice for Fabric consumer scans is tracked in jhf-openclaw-env#1426.

Issue references: jhf-openclaw-env#1426, jhf-openclaw-env#209, jhf-openclaw-env#214, jhf-openclaw-env#251, jhf-openclaw-env#313, follow-up refresh jhf-openclaw-env#1528

License-metadata follow-through: jhf-openclaw-env#2569, parent jhf-beam#617, and legal umbrella helpifyr-fabric#1543.

Env-owned/runtime-owned in this repository:

  • Docker Engine
  • Docker Compose
  • containerd
  • runc
  • adguard (adguard/adguardhome:v0.107.74)
  • caddy (caddy:2.8.4)
  • portainer (portainer/portainer-ce:2.39.1)
  • MinIO scanner truth token (minio:2025.9.7)
  • Valkey (valkey/valkey:7.2.11-alpine)

Ingress/platform upgrade consumers enforced by this repository:

  • wikijs-proxy-nginx (Fabric platform ingress family, validated through machine-readable readback/compatibility contracts and fail-closed verifiers)

Canonical upgrade/materialization mirrors for the OpenClaw runtime pin:

  • primary runtime pin: deploy/compose/jhf-openclaw-env.stack.yml
  • secondary/runtime-shadow pin: deploy/compose/jhf-openclaw-env-wave9-secondary-73.stack.yml
  • scanner truth mirror: deploy/compose/compose.oss-version-truth.yml
  • operator canary path: scripts/host_openclaw_gateway_canary.sh

Canonical contracts:

  • config/contracts/openclaw_stack_oss_runtime_materialization.v1.json (config/contracts/openclaw_stack_oss_runtime_materialization.v1.json)
  • config/contracts/openclaw_fabric_tool_oss_directory_runtime.v1.json (config/contracts/openclaw_fabric_tool_oss_directory_runtime.v1.json)
  • maintenance/oss-inventory.json (maintenance/oss-inventory.json)
  • maintenance/oss-version-truth.json (maintenance/oss-version-truth.json)
  • maintenance/openclaw-2026.6.8-<internal-runtime-redacted> (maintenance/openclaw-2026.6.8-&lt;internal-runtime-redacted&gt;)
  • maintenance/oss-upgrade-governance.json (maintenance/oss-upgrade-governance.json)
  • maintenance/oss-upgrade-readback-policy.json (maintenance/oss-upgrade-readback-policy.json)

Canonical machine-readable source paths for Fabric consumer scans:

  • config/contracts/openclaw_stack_oss_runtime_materialization.v1.json
  • config/contracts/openclaw_fabric_tool_oss_directory_runtime.v1.json
  • maintenance/oss-inventory.json
  • maintenance/oss-version-truth.json
  • maintenance/openclaw-2026.6.8-&lt;internal-runtime-redacted&gt;
  • maintenance/oss-upgrade-governance.json
  • maintenance/oss-upgrade-readback-policy.json

Canonical verifiers:

  • scripts/verify_stack_oss_runtime_materialization.py (scripts/verify_stack_oss_runtime_materialization.py)
  • scripts/verify_fabric_tool_oss_directory_runtime.py (scripts/verify_fabric_tool_oss_directory_runtime.py)
  • scripts/verify_oss_inventory_version_truth.py (scripts/verify_oss_inventory_version_truth.py)
  • scripts/verify_oss_upgrade_fail_closed.py (scripts/verify_oss_upgrade_fail_closed.py)
  • scripts/verify_openclaw_2026_6_8_<internal-runtime-redacted>_prep.py (scripts/verify_openclaw_2026_6_8_&lt;internal-runtime-redacted&gt;_prep.py)

Fabric upstream contract references consumed by this owner repo:

  • helpifyr-fabric/contracts/platform/platform_version_truth.json
  • helpifyr-fabric/contracts/platform/platform_projection_catalog.json
  • helpifyr-fabric/contracts/platform/platform_oss_upgrade_governance_v1.json
  • helpifyr-fabric/contracts/platform/platform_oss_upgrade_compatibility_matrix_v1.json
  • helpifyr-fabric/contracts/platform/platform_oss_upgrade_evidence_contract_v1.json
  • helpifyr-fabric/contracts/platform/helpifyr_stack_module_identity_v1.json
  • helpifyr-fabric/contracts/platform/stack_tool_oss_inventory_directory.json

Acceptance Contract​

Repo and live runtime are healthy when all are true:

  • env-owned compose truth stays pinned (no latest/unknown) in:
    • deploy/compose/compose.oss-version-truth.yml
    • deploy/compose/jhf-openclaw-env.stack.yml
  • docs truth in:
    • docs/STACK_RUNTIME_CONTRACT.md (docs/STACK_RUNTIME_CONTRACT.md)
    • docs/ENV_BASELINE.md (docs/ENV_BASELINE.md) matches the contract.
  • live host readback confirms:
    • host runtime versions match contract
    • env-owned containers use pinned images
    • env-owned compose labels materialize from canonical compose/workdir paths.

Floating tags for non-env projects are recorded as observations and must not be misclassified as env-owned drift.

For upgrade-readiness and inventory-truth release gates, this repository provides a strict fail-closed mode that also fails when tracked non-env floating tags are still present.

For the Beam/Fabric directory followthrough lane, live runtime health also requires that GET /api/v1/platform/tool-oss-inventory-directory keeps the owner-followthrough classifier fields (owner_followthrough_count, owner_followthrough_issue_refs, workspace_observation_gap_count) present while the current canonical readback for jhf-openclaw-env remains fully ready:

  • summary_status=ready
  • blocked_tool_count=0
  • consumer_contract_gap_count=0
  • the jhf-openclaw-env entry stays status=ready and blocking_scope=ready

That preserves Beam's ability to distinguish future owner followthrough from repo-owned consumer drift without forcing this repo to keep reporting an already-resolved blocked posture.

Upgrade Materialization Path​

The env-owned upgrade path is only considered reproducible when the same version truth is mirrored across all owner surfaces:

  1. update the primary runtime pin in deploy/compose/jhf-openclaw-env.stack.yml
  2. update the secondary/runtime-shadow pin in deploy/compose/jhf-openclaw-env-wave9-secondary-73.stack.yml
  3. keep scanner truth aligned in deploy/compose/compose.oss-version-truth.yml
  4. keep the operator canary default aligned in scripts/host_openclaw_gateway_canary.sh
  5. rerun repo verifier, then live verifier, then post-push live verifier

This prevents “docs say upgraded, host is upgraded, but secondary/canary truth still points at an old image” drift.

Candidate-Only <internal-runtime-redacted> Pin Prep​

Issue reference: jhf-openclaw-env#973

The current env-owned rollout truth is pinned to ghcr.io/openclaw/openclaw:2026.6.8. The file maintenance/openclaw-2026.6.8-<internal-runtime-redacted> (maintenance/openclaw-2026.6.8-&lt;internal-runtime-redacted&gt;) is a candidate-only preparation artifact for the later <internal-runtime-redacted> move to ghcr.io/openclaw/openclaw:2026.6.8.

It must stay fail-closed:

  • &lt;internal-runtime-redacted&gt;_executed=false
  • &lt;internal-runtime-redacted&gt;_ready_now=false
  • human go-live gate remains mandatory
  • no claim that 2026.6.8 is already the live <internal-runtime-redacted> image

Prep verification:

  • python scripts/verify_openclaw_2026_6_8_&lt;internal-runtime-redacted&gt;_prep.py
  • python scripts/verify_openclaw_2026_6_8_&lt;internal-runtime-redacted&gt;_prep.py --live-via-ssh &lt;internal-runtime-redacted&gt;&lt;internal-runtime-redacted&gt;

Verify Path​

Repo checks:

  • python scripts/verify_oss_inventory_version_truth.py
  • python scripts/verify_oss_upgrade_fail_closed.py --validate-only
  • python scripts/verify_stack_oss_runtime_materialization.py
  • python scripts/verify_fabric_tool_oss_directory_runtime.py --mode repo
  • python infrastructure/validate_environment_contracts.py
  • python infrastructure/validate_module_features_registry.py

Live verify:

  • python scripts/verify_stack_oss_runtime_materialization.py --live-via-ssh &lt;internal-runtime-redacted&gt;&lt;internal-runtime-redacted&gt; --output runtime/evidence/issue209.stack_oss_runtime_materialization.live.json

Strict fail-closed readiness gate (#214):

  • python scripts/verify_stack_oss_runtime_materialization.py --live-via-ssh &lt;internal-runtime-redacted&gt;&lt;internal-runtime-redacted&gt; --fail-on-non-env-floating --output runtime/evidence/issue214.stack_oss_runtime_materialization.strict.live.json

Fail-closed dry-run proofs (#251):

  • python scripts/verify_oss_upgrade_fail_closed.py --simulate-missing target_version
  • python scripts/verify_oss_upgrade_fail_closed.py --simulate-missing compatibility_verdict
  • python scripts/verify_oss_upgrade_fail_closed.py --simulate-missing readback
  • python scripts/verify_oss_upgrade_fail_closed.py --simulate-missing latest_only_drift

Upgrade-path canary:

  • bash scripts/host_openclaw_gateway_canary.sh ghcr.io/openclaw/openclaw:2026.6.8 openclaw --version

Post-push live verify (same command, new evidence path):

  • python scripts/verify_stack_oss_runtime_materialization.py --live-via-ssh &lt;internal-runtime-redacted&gt;&lt;internal-runtime-redacted&gt; --output runtime/evidence/issue209.stack_oss_runtime_materialization.postpush.json

Post-push strict fail-closed verify (#214):

  • python scripts/verify_stack_oss_runtime_materialization.py --live-via-ssh &lt;internal-runtime-redacted&gt;&lt;internal-runtime-redacted&gt; --fail-on-non-env-floating --output runtime/evidence/issue214.stack_oss_runtime_materialization.strict.postpush.json

Fabric directory followthrough live verify (#313):

  • python scripts/verify_fabric_tool_oss_directory_runtime.py --output runtime/evidence/issue313.fabric_tool_oss_directory_runtime.live.json

Fabric directory followthrough post-push verify (#313):

  • python scripts/verify_fabric_tool_oss_directory_runtime.py --output runtime/evidence/issue313.fabric_tool_oss_directory_runtime.postpush.json

License: AGPLv3 Project: https://helpifyr.com

<!-- BEGIN HELPIFYR CANONICAL OSS INVENTORY -->

Canonical repository OSS inventory v2​

The machine-readable source of truth is maintenance/oss-inventory.json; the pinned schema and repo-local verifier are schemas/repository-oss-inventory.schema.json and scripts/verify_repository_oss_inventory.py.

  • Observed commit: ecb45942fc60db505ca09bbc2f13e6c50ac03af3
  • Status: blocked
  • Generated: 2026-08-25T11:49:43Z
  • Valid until: 2026-09-24T11:49:43Z
ComponentScopeCurrent truth
adguard/adguardhome:v0.107.74direct-runtimev0.107.74
caddy:2.8.4direct-runtime2.8.4
portainer/portainer-ce:2.39.1direct-runtime2.39.1
minio/minio:2025.9.7direct-runtime2025.9.7
valkey/valkey:7.2.11-alpinedirect-runtime7.2.11-alpine
ghcr.io/openclaw/openclaw:2026.6.8direct-runtime2026.6.8
michaelf34/infinity:0.0.77-cpudirect-runtime0.0.77-cpu
caddy:2.8.4direct-runtime2.8.4
localai/localai@sha256:736fa3f92dc292108b27a4f68d7441ff7b0baf95e7ee11990411d372d454f895direct-runtime736fa3f92dc292108b27a4f68d7441ff7b0baf95e7ee11990411d372d454f895
ghcr.io/openclaw/openclaw:2026.6.8direct-runtime2026.6.8
python:3.12-slimdirect-runtime3.12-slim
adguard/adguardhome:v0.107.74direct-runtimev0.107.74
caddy:2.8.4direct-runtime2.8.4
cloudflare/cloudflared:2026.3.0direct-runtime2026.3.0
portainer/portainer-ce:2.39.1direct-runtime2.39.1
nimkaru/custom-ffmpeg-api@sha256:647233ae42f8a6b561905889cddd17d89431a35a3dfc1283d04562cd633c0425direct-runtime647233ae42f8a6b561905889cddd17d89431a35a3dfc1283d04562cd633c0425
adguard-runtimedirect-runtimeunknown
portainer-runtimedirect-runtimeunknown
wikijs-proxy-nginxdirect-runtimeunknown
legacy-ffmpeg-apidirect-runtimeunknown

Readiness blockers​

This inventory is fail-closed with 6 unresolved evidence finding(s). The complete finding IDs, descriptions, owner actions and manifest evidence references are authoritative in maintenance/oss-inventory.json at evidence.unresolved_findings; the repository is not upgrade-ready until those findings are resolved and the inventory is regenerated. Update this inventory in the same change as any dependency, image, base-image, build-tool or deployment-manifest change. Beam remains read/compare/test/prepare only; Deployment remains plan-only until owner approval and rollback gates.