Repository navigation
Merge main (through #101) and #98 into demo - #99
Merged
Merged
Conversation
Remove implicit demo users and resolve Pattern owner subjects. Limit dashboard access to owners and explicit support users. Track owner grants so account changes remove old membership.
Stub local Keycloak subject lookup in quickstart tests. Keep external issuer fixtures independent of host credentials.
Mark owner records as lookup-error when the resolver cannot get a Keycloak service token. Retry the lookup on the next sync. Document the VM restart needed after installer ConfigMap updates.
Keep APF secret examples and remove implicit demo passwords. Make the image mirror contract test select its Linux path on macOS.
Reconcile recorded owner memberships before enabled profiles apply. Run the revocation pass when no profiles remain enabled.
Read the mounted service-account token before each API request so rotation does not stall enrollment or revocation.
…ssues-61-66-tenant-access feat(identity): isolate tenant ownership
…rade/nemoclaw build(nemoclaw): upgrade CLI and sandbox to v0.0.133
OpenClaw 2026.9.x keeps a plugin found on plugins.load.paths disabled
until it is enabled with capability consent, and NemoClaw's restrictive
plugins.allow blocks it outright ("not in allowlist"). Found live on the
personal-assistant sandbox with OpenClaw 2026.9.2: the daily-briefing
bundle and its MCP servers were detected but never loaded.
After pointing OpenClaw at the bundle, run `plugins enable` for the
bundle (its plugin.json name) and each native plugin under plugins/;
this also adds them to an existing plugins.allow. Older releases load
the bundle anyway and may not know --accept-capabilities, so retry
without it. The verify failure now says why the bundle is not loaded.
Co-Authored-By: Claude
…rns-sandbox#98 into demo Brings current main into demo (including validatedpatterns-sandbox#101, the NemoClaw v0.0.133 images with OpenClaw 2026.9.2) and the installer fix from validatedpatterns-sandbox#98 (1c9f80d), so a later main -> demo merge has nothing to redo. Conflict: values-secret.yaml.template. Main (validatedpatterns-sandbox#93) removed the keycloak-users entry (no implicit demo users); kept that, and the demo's Slack and Gmail entries. Co-Authored-By: Claude
Found live on OpenClaw 2026.9.2: the bundle stayed disabled ("not in
allowlist") until `plugins enable` added it to NemoClaw's plugins.allow.
Co-Authored-By: Claude
… off The personal assistant moves to ghcr.io/validatedpatterns-sandbox/ nemoclaw-sandbox:latest, which validatedpatterns-sandbox#101 builds from NemoClaw v0.0.133 with OpenClaw 2026.9.2: that release loads the bundle's plugin.json and mcp.json (2026.7.1 loaded only its skills), and validatedpatterns-sandbox#98 enables it. With the Slack provider attached, OpenClaw treats its own slack chat channel as configured, tries to install @openclaw/slack from npm at gateway startup (egress denied) and does not start; the UI answers 502. Found live. The provider is for the harness's governed reads, so the installer sets channels.slack.enabled false in every sandbox with a Slack provider, instead of allowing npm egress. The demo docs now mark both Tier 1 blockers (T1a, T1c) as resolved and describe the bundle as it is (plugin.json, mcp.json). Co-Authored-By: Claude
sauagarwa
changed the title
sauagarwa
merged commit Oct 13, 2026
db508dd
into
validatedpatterns-sandbox:demo
2 of 5 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge main (through #101) and #98 into demo, and fix the personal assistant on OpenClaw 2026.9.2
This brings current main into
demo, including #101 (NemoClaw v0.0.133 images with OpenClaw 2026.9.2) and the installer fix from #98 (1c9f80d). On top of that, two demo changes get the personal assistant working on the new image with no manual steps.Please merge with "Create a merge commit", not squash or rebase, so main's commits (and
1c9f80dfrom #98) stay the same commits on both branches.Commits
values-secret.yaml.template: main (feat(identity): isolate tenant ownership #93) removed thekeycloak-usersentry (no implicit demo users). I kept that, plus the demo's Slack and Gmail entries.daily-briefingbundle is enabled with capability consent.ghcr.io/validatedpatterns-sandbox/nemoclaw-sandbox:latest(v0.0.133, OpenClaw 2026.9.2). OpenClaw 2026.7.1 loaded the bundle's skills but not its MCP servers.channels.slack.enabled: falsein sandboxes with a Slack provider. With the provider attached, OpenClaw otherwise treats its own Slack chat channel as configured and tries to install@openclaw/slackfrom npm at gateway startup. Egress denies that, the gateway doesn't start, and the UI answers 502. The provider is only for the harness's governed reads, so no npm egress is needed.plugin.json,mcp.json).Checks
ssh-keygen, one NetworkPolicy render); CI covers those.slack-readerandgmail-reader, the apply ends withapply: Done, the UI loads, and the assistant lists both tools. A fresh run from this branch with no manual steps is the next check.Not changed
Tier 2 in the demo docs (the gateway not injecting provider credentials) is untouched. It still needs checking with a real Slack and Gmail call on this image.