Investigation Summary

• The PR #11071 E2E run tested candidate 0ddc3ea52efe8a5d63099b92f43cbe0a43c88a01 through trusted workflow commit 4b254b9bef3e0ba745af4859fc65700742f5317e.
• Protected managed-image GPU and local inference failed while building the OpenClaw protected image.
• The reviewed mcporter audit reported incomplete-report, retried once after one second, and remained incomplete after two attempts.
• The image build then exited 1 before protected runtime inference ran.
• This is not a downstream aggregate failure and is separate from the receipt-identity mismatch fixed by merged fix(ci): bind audit receipt to reviewed npm #11069.

Description

The protected OpenClaw image build requires a complete reviewed npm audit result. The audit service or parser returned an incomplete report on both bounded attempts, so the build correctly failed closed but did not preserve enough classification to decide whether this was registry instability or a deterministic response-shape regression.

Expected: the reviewed audit returns a complete report, or the job records a precise external or parser failure classification.

Actual: both attempts end with reason=incomplete-report, and the protected image is not built.

Acceptance Criteria

• Preserve a redacted diagnostic identifying which required audit response fields were absent or invalid.
• Distinguish a transient registry/audit response from a deterministic parser or npm-version regression.
• Keep the image build fail-closed when a complete audit cannot be established.
• Use a bounded retry policy and report its final classification.
• The protected managed-image GPU and local-inference job reaches runtime qualification on the fixing commit.