Skip to main content

Compatibility

This compatibility page is generated from canonical repo-owned source material in JaddaHelpifyr/jhf-openclaw-env.

Compatibility Sources​

  • docs/OSS_INVENTORY.md
  • docs/STACK_RUNTIME_CONTRACT.md
  • docs/OPENCLAW_RUNTIME_VERSION_FLOOR.md

Derived from Stack OSS Runtime Materialization​

Stack OSS Runtime Materialization

This document defines the canonical runtime inventory and drift-verifier lane for env-owned OSS versions on <internal-runtime-redacted>.

Every inventory component carries license, license_class, and license_evidence_url. Until component-specific legal evidence is reviewed, the only valid posture is NOASSERTION with unknown_blocked; inventory discovery never infers or approves a third-party license.

A component can leave that posture only with a component-specific license_evidence_url and an allow-listed, applicable fabric_policy_decision_ref. The current decision allow-list is helpifyr-fabric#1540 (runtime-reference/distribution model) and helpifyr-fabric#1541 (managed-hosting/service channel); adding another decision is a separately reviewed Fabric-policy change, never an inventory-only edit.

Scope​

The current repo-owned discoverability slice for Fabric consumer scans is tracked in jhf-openclaw-env#1426.

Issue references: jhf-openclaw-env#1426, jhf-openclaw-env#209, jhf-openclaw-env#214, jhf-openclaw-env#251, jhf-openclaw-env#313, follow-up refresh jhf-openclaw-env#1528

License-metadata follow-through: jhf-openclaw-env#2569, parent jhf-beam#617, and legal umbrella helpifyr-fabric#1543.

Env-owned/runtime-owned in this repository:

  • Docker Engine
  • Docker Compose
  • containerd
  • runc
  • adguard (adguard/adguardhome:v0.107.74)
  • caddy (caddy:2.8.4)
  • portainer (portainer/portainer-ce:2.39.1)
  • MinIO scanner truth token (minio:2025.9.7)
  • Valkey (valkey/valkey:7.2.11-alpine)

Ingress/platform upgrade consumers enforced by this repository:

  • wikijs-proxy-nginx (Fabric platform ingress family, validated through machine-readable readback/compatibility contracts and fail-closed verifiers)

Canonical upgrade/materialization mirrors for the OpenClaw runtime pin:

  • primary runtime pin: deploy/compose/jhf-openclaw-env.stack.yml
  • secondary/runtime-shadow pin: deploy/compose/jhf-openclaw-env-wave9-secondary-73.stack.yml
  • scanner truth mirror: deploy/compose/compose.oss-version-truth.yml
  • operator canary path: scripts/host_openclaw_gateway_canary.sh

Canonical contracts:

  • config/contracts/openclaw_stack_oss_runtime_materialization.v1.json (config/contracts/openclaw_stack_oss_runtime_materialization.v1.json)
  • config/contracts/openclaw_fabric_tool_oss_directory_runtime.v1.json (config/contracts/openclaw_fabric_tool_oss_directory_runtime.v1.json)
  • maintenance/oss-inventory.json (maintenance/oss-inventory.json)
  • maintenance/oss-version-truth.json (maintenance/oss-version-truth.json)
  • maintenance/openclaw-2026.6.8-host172-pin-prep.json (maintenance/openclaw-2026.6.8-host172-pin-prep.json)
  • maintenance/oss-upgrade-governance.json (maintenance/oss-upgrade-governance.json)
  • maintenance/oss-upgrade-readback-policy.json (maintenance/oss-upgrade-readback-policy.json)

Canonical machine-readable source paths for Fabric consumer scans:

  • config/contracts/openclaw_stack_oss_runtime_materialization.v1.json
  • config/contracts/openclaw_fabric_tool_oss_directory_runtime.v1.json
  • maintenance/oss-inventory.json
  • maintenance/oss-version-truth.json
  • maintenance/openclaw-2026.6.8-host172-pin-prep.json
  • maintenance/oss-upgrade-governance.json
  • maintenance/oss-upgrade-readback-policy.json

Canonical verifiers:

  • scripts/verify_stack_oss_runtime_materialization.py (scripts/verify_stack_oss_runtime_materialization.py)
  • scripts/verify_fabric_tool_oss_directory_runtime.py (scripts/verify_fabric_tool_oss_directory_runtime.py)
  • scripts/verify_oss_inventory_version_truth.py (scripts/verify_oss_inventory_version_truth.py)
  • scripts/verify_oss_upgrade_fail_closed.py (scripts/verify_oss_upgrade_fail_closed.py)
  • scripts/verify_openclaw_2026_6_8_host172_pin_prep.py (scripts/verify_openclaw_2026_6_8_host172_pin_prep.py)

Fabric upstream contract references consumed by this owner repo:

  • helpifyr-fabric/contracts/platform/platform_version_truth.json
  • helpifyr-fabric/contracts/platform/platform_projection_catalog.json
  • helpifyr-fabric/contracts/platform/platform_oss_upgrade_governance_v1.json
  • helpifyr-fabric/contracts/platform/platform_oss_upgrade_compatibility_matrix_v1.json
  • helpifyr-fabric/contracts/platform/platform_oss_upgrade_evidence_contract_v1.json
  • helpifyr-fabric/contracts/platform/helpifyr_stack_module_identity_v1.json
  • helpifyr-fabric/contracts/platform/stack_tool_oss_inventory_directory.json

Acceptance Contract​

Repo and live runtime are healthy when all are true:

  • env-owned compose truth stays pinned (no latest/unknown) in:
    • deploy/compose/compose.oss-version-truth.yml
    • deploy/compose/jhf-openclaw-env.stack.yml
  • docs truth in:
    • docs/STACK_RUNTIME_CONTRACT.md (docs/STACK_RUNTIME_CONTRACT.md)
    • docs/ENV_BASELINE.md (docs/ENV_BASELINE.md) matches the contract.
  • live host readback confirms:
    • host runtime versions match contract
    • env-owned containers use pinned images
    • env-owned compose labels materialize from canonical compose/workdir paths.

Floating tags for non-env projects are recorded as observations and must not be misclassified as env-owned drift.

For upgrade-readiness and inventory-truth release gates, this repository provides a strict fail-closed mode that also fails when tracked non-env floating tags are still present.

For the Beam/Fabric directory followthrough lane, live runtime health also requires that GET /api/v1/platform/tool-oss-inventory-directory keeps the owner-followthrough classifier fields (owner_followthrough_count, owner_followthrough_issue_refs, workspace_observation_gap_count) present while the current canonical readback for jhf-openclaw-env remains fully ready:

  • summary_status=ready
  • blocked_tool_count=0
  • consumer_contract_gap_count=0
  • the jhf-openclaw-env entry stays status=ready and blocking_scope=ready

That preserves Beam's ability to distinguish future owner followthrough from repo-owned consumer drift without forcing this repo to keep reporting an already-resolved blocked posture.

Upgrade Materialization Path​

The env-owned upgrade path is only considered reproducible when the same version truth is mirrored across all owner surfaces:

  1. update the primary runtime pin in deploy/compose/jhf-openclaw-env.stack.yml
  2. update the secondary/runtime-shadow pin in deploy/compose/jhf-openclaw-env-wave9-secondary-73.stack.yml
  3. keep scanner truth aligned in deploy/compose/compose.oss-version-truth.yml
  4. keep the operator canary default aligned in scripts/host_openclaw_gateway_canary.sh
  5. rerun repo verifier, then live verifier, then post-push live verifier

This prevents “docs say upgraded, host is upgraded, but secondary/canary truth still points at an old image” drift.

Candidate-Only Host172 Pin Prep​

Issue reference: jhf-openclaw-env#973

The current env-owned rollout truth is pinned to ghcr.io/openclaw/openclaw:2026.6.8. The file maintenance/openclaw-2026.6.8-host172-pin-prep.json (maintenance/openclaw-2026.6.8-host172-pin-prep.json) is a candidate-only preparation artifact for the later Host172 move to ghcr.io/openclaw/openclaw:2026.6.8.

It must stay fail-closed:

  • host172_rollout_executed=false
  • host172_rollout_ready_now=false
  • human go-live gate remains mandatory
  • no claim that 2026.6.8 is already the live Host172 image

Prep verification:

  • python scripts/verify_openclaw_2026_6_8_host172_pin_prep.py
  • python scripts/verify_openclaw_2026_6_8_host172_pin_prep.py --live-via-ssh <internal-runtime-redacted><internal-runtime-redacted>

Verify Path​

Repo checks:

  • python scripts/verify_oss_inventory_version_truth.py
  • python scripts/verify_oss_upgrade_fail_closed.py --validate-only
  • python scripts/verify_stack_oss_runtime_materialization.py
  • python scripts/verify_fabric_tool_oss_directory_runtime.py --mode repo
  • python infrastructure/validate_environment_contracts.py
  • python infrastructure/validate_module_features_registry.py

Live verify:

  • python scripts/verify_stack_oss_runtime_materialization.py --live-via-ssh <internal-runtime-redacted><internal-runtime-redacted> --output runtime/evidence/issue209.stack_oss_runtime_materialization.live.json

Strict fail-closed readiness gate (#214):

  • python scripts/verify_stack_oss_runtime_materialization.py --live-via-ssh <internal-runtime-redacted><internal-runtime-redacted> --fail-on-non-env-floating --output runtime/evidence/issue214.stack_oss_runtime_materialization.strict.live.json

Fail-closed dry-run proofs (#251):

  • python scripts/verify_oss_upgrade_fail_closed.py --simulate-missing target_version
  • python scripts/verify_oss_upgrade_fail_closed.py --simulate-missing compatibility_verdict
  • python scripts/verify_oss_upgrade_fail_closed.py --simulate-missing readback
  • python scripts/verify_oss_upgrade_fail_closed.py --simulate-missing latest_only_drift

Upgrade-path canary:

  • bash scripts/host_openclaw_gateway_canary.sh ghcr.io/openclaw/openclaw:2026.6.8 openclaw --version

Post-push live verify (same command, new evidence path):

  • python scripts/verify_stack_oss_runtime_materialization.py --live-via-ssh <internal-runtime-redacted><internal-runtime-redacted> --output runtime/evidence/issue209.stack_oss_runtime_materialization.postpush.json

Post-push strict fail-closed verify (#214):

  • python scripts/verify_stack_oss_runtime_materialization.py --live-via-ssh <internal-runtime-redacted><internal-runtime-redacted> --fail-on-non-env-floating --output runtime/evidence/issue214.stack_oss_runtime_materialization.strict.postpush.json

Fabric directory followthrough live verify (#313):

  • python scripts/verify_fabric_tool_oss_directory_runtime.py --output runtime/evidence/issue313.fabric_tool_oss_directory_runtime.live.json

Fabric directory followthrough post-push verify (#313):

  • python scripts/verify_fabric_tool_oss_directory_runtime.py --output runtime/evidence/issue313.fabric_tool_oss_directory_runtime.postpush.json

License: AGPLv3 Project: https://helpifyr.com