[Ubuntu 24.04][Security] corporate CA accepted during onboard but missing from managed runtime

[mercl-lau]

Warning

Regression: the runtime corporate CA merge was reported working in v0.0.81; it is absent in v0.0.102. Related public issue: #6210.

Description

NemoClaw accepts a restricted corporate CA certificate during onboarding and reports the sandbox Ready, but the managed corporate CA material and merged runtime trust bundle are absent inside the sandbox. Applications therefore cannot use the configured corporate trust anchor through the managed runtime contract.

Platform scope: Reproduced on Ubuntu 24.04 only; other platforms not tested.

Environment

Device:        Ubuntu 24.04 server
OS:            Ubuntu 24.04.4 LTS (Linux 6.8.0-124-generic)
Architecture:  x86_64
Node.js:       v22.23.1
npm:           10.9.8
Docker:        Docker Engine 29.5.3
OpenShell CLI: openshell 0.0.85
NemoClaw:      nemoclaw v0.0.102
OpenClaw:      2026.7.1

Steps to Reproduce

1. Prepare a valid CA certificate at /var/tmp/corporate-ca.crt and set its mode to 0600.

2. Run:

   NEMOCLAW_CORPORATE_CA_BUNDLE=/var/tmp/corporate-ca.crt NEMOCLAW_PROVIDER=ollama NEMOCLAW_MODEL=qwen3.5:9b nemoclaw onboard --agent openclaw --name ca-merge-check --non-interactive --fresh --yes --yes-i-accept-third-party-software

3. Confirm nemoclaw ca-merge-check status reports the sandbox Ready.

4. Run:

   nemoclaw ca-merge-check exec -- sh -c 'test -f /usr/local/share/nemoclaw/corporate-ca.pem; echo CORPORATE_CA_EXIT:$?; test -f /run/nemoclaw/managed-startup-ca-bundle.pem; echo MERGED_CA_EXIT:$?; printf "SSL_CERT_FILE=%s\n" "$SSL_CERT_FILE"'

Expected Result

Onboarding installs the validated corporate CA as root-owned, read-only managed material, creates a merged OpenShell and corporate CA bundle, and points SSL_CERT_FILE and the other managed CA environment variables at that merged bundle.

Actual Result

Onboarding exits successfully and the sandbox reaches Ready, but both managed CA files are absent. Both file checks exit 1, so the configured corporate CA is not available through the documented runtime trust contract.

Logs

$ nemoclaw ca-merge-check status
Sandbox: ca-merge-check
Phase: Ready

$ nemoclaw ca-merge-check exec -- sh -c 'test -f /usr/local/share/nemoclaw/corporate-ca.pem; echo CORPORATE_CA_EXIT:$?; test -f /run/nemoclaw/managed-startup-ca-bundle.pem; echo MERGED_CA_EXIT:$?'
CORPORATE_CA_EXIT:1
MERGED_CA_EXIT:1