Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/nightly-e2e.yaml:
- Around line 806-809: The checkout steps using actions/checkout (the steps
named "Checkout" in the openclaw-onboard-security-posture-e2e and
hermes-onboard-security-posture-e2e jobs) do not set persist-credentials and
should be hardened; update each checkout step's with block to include
persist-credentials: false so Git credentials are not persisted into artifacts
on failure, ensuring the key remains alongside the existing ref: ${{
inputs.target_ref || github.ref }} entry.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/lib/security-posture-assertions.sh`:
- Around line 157-160: The check currently treats the case that echoes
"NON_ROOT_PROXY_ENV_OWNER" as acceptable; modify the in-sandbox validation (the
shell snippet executed by security_posture_sandbox_exec that inspects
/tmp/nemoclaw-proxy-env.sh) so that when owner matches "$current_owner" it sets
bad=1 and exits non-zero (i.e., treat NON_ROOT_PROXY_ENV_OWNER as a failure just
like BAD_PROXY_ENV_OWNER). Locate the case block that emits
NON_ROOT_PROXY_ENV_OWNER in the long command string (it references variables f,
meta, mode, owner, current_owner and echoes NON_ROOT_PROXY_ENV_OWNER) and add
bad=1 (and/or an exit non-zero) in that branch so the overall check fails when
the file is not root-owned.

---

Outside diff comments:
In @.github/workflows/nightly-e2e.yaml:
- Around line 797-863: The .coderabbit.yaml is missing path_instructions for the
two new E2E jobs: add entries for the scripts "test/e2e/test-full-e2e.sh" (used
by openclaw-onboard-security-posture-e2e) and "test/e2e/test-hermes-e2e.sh"
(used by hermes-onboard-security-posture-e2e) that instruct reviewers to run the
corresponding security-posture lanes, and update the existing agents/hermes/**
path_instructions recommendation list to include the new
hermes-onboard-security-posture-e2e job name so changes under agents/hermes/**
surface the new lane to reviewers.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/nightly-e2e.yaml:
- Around line 797-802: Add missing path_instructions in .coderabbit.yaml for the
two new E2E jobs and their shared helper: add entries mapping
openclaw-onboard-security-posture-e2e to test/e2e/test-full-e2e.sh and
hermes-onboard-security-posture-e2e to test/e2e/test-hermes-e2e.sh, and also add
test/e2e/lib/security-posture-assertions.sh (since both scripts source it);
ensure the keys match the job names openclaw-onboard-security-posture-e2e and
hermes-onboard-security-posture-e2e and that the path_instructions format
matches existing entries in .coderabbit.yaml.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/hermes-start.test.ts`:
- Around line 155-156: The test in test/hermes-start.test.ts is only checking a
prefix so expect(run.envFileContent).toContain("export SSL_CERT_FILE=") will
pass when the variable is non-empty; change the assertion to verify an empty
assignment exactly by using a line-anchored check (e.g., a multiline regex
match) against the literal "export SSL_CERT_FILE=" on its own line so
run.envFileContent must contain an exact empty assignment; update the assertion
that currently references run.envFileContent and "export SSL_CERT_FILE="
accordingly.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/hermes-start.test.ts`:
- Around line 155-156: The test currently checks only the filename suffix;
instead assert that the exact generated CA path is propagated by using the test
helper's run.caFile value. Replace the loose assertion
(expect(run.envFileContent).toContain("/proxy\\ ca.pem")) with an assertion that
the env content contains the full path from run.caFile (e.g.
expect(run.envFileContent).toContain(run.caFile) or
expect(run.envFileContent).toContain(`export SSL_CERT_FILE=${run.caFile}`)),
keeping references to run, run.envFileContent and run.caFile to locate and
validate the real path.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.coderabbit.yaml:
- Around line 453-500: The shared entrypoint mapping in .coderabbit.yaml is
missing the openclaw-onboard-security-posture-e2e recommendation for source
files that exercise the non-root boot posture (e.g., scripts/nemoclaw-start.sh
and scripts/lib/sandbox-init.sh); add an entry that maps those script paths to
include the openclaw-onboard-security-posture-e2e lane just like the existing
entries for test/e2e/lib/security-posture-assertions.sh,
test/e2e/test-full-e2e.sh, and test/e2e/test-hermes-e2e.sh so reviewers touching
nemoclaw-start.sh or sandbox-init.sh will get the proper E2E recommendation.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/brev-e2e.test.ts`:
- Around line 170-172: The callback parameter for rawInstances.flatMap currently
has an implicit any; explicitly annotate it (e.g., change the callback to
rawInstances.flatMap((instance: unknown) => { ... }) ) so the compiler knows the
element type and the normalizeBrevInstance call receives a properly typed
argument; update any related callbacks in the same expression if present.