[devSejung]

What Problem This Solves

PlatformClaw ships duplicate Control UI assets and a full SkillHub JDK in its runtime images. The PR also needs to remain compatible with the current main branch and its security fixes.

Why This Change Was Made

• Install the Control UI once and retain the existing lookup path through a node-owned symlink.
• Build SkillHub with the JDK, then run its single executable JAR with the JRE. Preserve its user, environment, paths, and launch contract.
• Keep managed deployment upgrades and rollback on the selected image while preserving operator-supplied image overrides.
• Integrate main's reviewed dependency security backports and SDK surface instead of introducing separate major-version migrations.
• Preserve configuration JSON Schema behavior across the Zod update, including URI validation and equivalent union schemas. Load a real Zod schema in the isolated channel-config test fixture.

User Impact

Less duplicated runtime content with the existing application paths and SkillHub behavior retained. The original packaging comparison measured 2,027,862,528 to 1,819,996,160 bytes in docker-save output (10.25%); that measurement predates the current main security update, and is not a new release-size measurement.

No configuration keys, defaults, required fields, or operator setup steps are added. The generated metadata's only semantic difference from current main is restoration of six existing Signal URL validators.

Evidence

Validation uses Docker Desktop Linux, Node 24.18.0, pnpm 11.15.1, and an init-backed task container. Production builds use NODE_ENV=production.

• Frozen dependency installation, artifact-verified production security audit, focused security/config/SDK/HTTP regression tests, production and test typechecks, targeted lint, and fresh independent autoreview.
• Canonical Canvas/Discord browser bundles: text rendering, malformed-message rejection, real SDK parent-frame handshake/READY/authorization-response parsing, and zero CSP/page/HTTP errors. External Discord and corporate identity services use no real credentials in this proof.
• Earlier image-specific proof exercised real user-approved ChatGPT device OAuth and the SkillHub publish/scan/review/search/download/install lifecycle. Operator preview state is preserved.
• No real company AD/LDAP/SafeConnect/Knox endpoint, native ARM64 runtime, or packaged upgrade is claimed as live-tested here.

Exact pushed head 7081751f5ccb874e4696b5615a32a37795461959: GitHub CI run 40064039589 completed successfully. All 54 executed jobs passed; path-inapplicable jobs were skipped by the existing workflow. This includes production build artifacts, dependency/security gates, production and test typechecks, lint, configuration/SDK contracts, and all selected Node test shards. The PR is conflict-free against main 4eb0fb51987827dea0b6344635d6a1506b4e51f9.

[github-actions]

Dependency graph guard cleared

This PR no longer has blocked dependency graph changes. A future dependency graph change requires a fresh /allow-dependencies-change comment after the guard blocks that new head SHA.

• Current SHA: 7081751f5ccb874e4696b5615a32a37795461959