Fix installer runtime compatibility, tool bindings, and readiness

.env.example

@@ -1038,3 +1038,8 @@ EQUINIX_SERVICENOW_PASSWORD=
 # FASTMCP_DOCKET_URL=redis://localhost:6379/0
 # FASTMCP_TASKS_ENCRYPTION_KEY=<Fernet key for context snapshots>
 # Arguments/results also require backend access controls; see docs/MCP-TASKS.md.
+
+# Installer-managed launch bindings (normally written automatically by install.sh).
+# Paths only; credentials remain in the runtime .env. Explicit process env takes precedence.
+# NETCLAW_RUNTIME_ROOT=/absolute/path/to/runtime-home/python-runtimes
+# NETCLAW_RUNTIME_ENV=/absolute/path/to/runtime-home/.env

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 NetClaw source releases use `1.x.y`. Feature specs increment the minor version and reset the patch; fixes, documentation and maintenance increment the patch. Every release records its numbered specs. Component and mobile distribution versions are independent.
 
+## [1.6.2] - 2026-10-10
+
+Spec [147-installer-followups](specs/147-installer-followups/spec.md). See [release notes](docs/releases/1.6.2.md).
+
 ## [1.6.1] - 2026-10-09
 
 - Import filled checkout dotenv settings before runtime onboarding while preserving existing runtime credentials; add a previewable repair command.

README.md

@@ -1510,7 +1510,7 @@ NetClaw's WebEx support is **bidirectional**:
 ### Prerequisites
 
 - A **Cisco WebEx account** (free or paid)
-- **Node.js 18+** and **OpenClaw 2026.3.x** (already installed if you ran `install.sh`)
+- **Node.js 24.16+ (24.x) or 26.1+** and a compatible **OpenClaw** (already installed if you ran `install.sh`)
 - **ngrok** (free tier works) — only required for local/development setups where the gateway is not publicly reachable
 
 ### Step 1: Create a WebEx Bot
@@ -2752,7 +2752,7 @@ netclaw/
 The installer is an interactive TUI (pure bash — works over SSH, degrades gracefully without a TTY). Install logic lives in `scripts/lib/` (`common.sh` helpers, `tui.sh` interface, `catalog.sh` component catalog + profiles, `install-steps.sh` one install function per component).
 
 1. **Pick your components** — choose an install profile (Recommended, Cisco, Multivendor, Cloud, Security, Labs, Observability, Minimal, Everything) or hand-pick from all 72 components in a categorized multi-select checklist. Re-running the installer preselects what you already have.
-2. **Checks prerequisites** — Node.js >= 18, Python 3, pip3, git, npx — offers to run the install commands for anything missing (apt/dnf/yum/pacman/apk/brew), and handles PEP 668 externally-managed Pythons so pip installs work on modern distros
+2. **Checks prerequisites** — runtime-specific Node compatibility, Python/component bounds, npm, git and selected uv/Go/Docker/native tools before mutation. Python dependencies use isolated environments; system package protections remain enabled.
 3. **Installs OpenClaw** — `npm install -g openclaw@latest`
 4. **Imports filled `.env` settings, then runs OpenClaw onboard** — preserves existing runtime values; configures AI provider, gateway, channels and daemon service; stops on wizard failure, then verifies the gateway service actually started (systemd unit / LaunchAgent / port probe) and offers a retry with diagnostics if it didn't
 5. **Installs the selected MCP servers** — each component clones/pip-installs/pulls exactly what it needs (`./scripts/install.sh --list` shows every component and what it provides)
@@ -2793,7 +2793,7 @@ The `%ENV{NETCLAW_PASSWORD}` syntax pulls credentials from environment variables
 
 ## Prerequisites
 
-- Node.js >= 18 (>= 22 recommended for OpenClaw)
+- OpenClaw: Node.js **>=24.16.0 <25 or >=26.1.0**; Node 26 is recommended. Use a Node version manager if your distro ships an older release. Hermes keeps a separate Node floor for its Node-based components. See [installer readiness](docs/INSTALLER-READINESS.md).
 - Python 3.x with pip3
 - git
 - Network devices accessible via SSH (for pyATS)

SOUL.md

@@ -740,6 +740,14 @@ Every session starts with a GAIT branch and ends with a GAIT log. This is not op
 
 If you forget GAIT, the session has no record. That is unacceptable in a production network.
 
+### First-use readiness
+
+Read the installer readiness report before claiming a selected integration works.
+Artifact presence, MCP discovery, endpoint access and a successful agent tool call
+are different evidence. If a tool is unavailable, say so and name the failing stage;
+never fill missing device or lab data with plausible values. Native registrations
+retain the same production approval rules as skills. See [installer readiness](docs/INSTALLER-READINESS.md).
+
 ### Gathering State
 
 Before answering any question about the network, **always gather real data first**. Never guess. Use the pyats-network skill to run show commands. Genie parsers return structured JSON for 100+ IOS-XE commands.

TOOLS.md

@@ -1000,3 +1000,12 @@ Build passes; 358/359 HUD tests pass (remaining known 127.0.0.2 Mac fixture).
 Qwen3-TTS Base via MLX Audio is the researched own-voice candidate, not installed
 or benchmarked. Keep future recordings in ~/.openclaw/pal/voices, not the public
 asset directory. Research/license sources are in spec144/research.md.
+
+## Installer access and readiness (spec 147)
+
+The twelve reported skill-only components now have native registrations (thirteen
+servers because Draw.io and RFC are separate). `config/installer-access.json` and
+`scripts/component-launch.py` bind both native access and recognized MCP_CALL skill
+commands to the installed interpreter/source/transport. No new write permission is
+granted. `logs/install/run-*/readiness.json` separates artifacts, registration,
+discovery and unverified endpoint/agent operations. See [operator guidance](docs/INSTALLER-READINESS.md).

VERSION

@@ -1 +1 @@
-1.6.1
+1.6.2

config/installer-access.json

@@ -0,0 +1,162 @@
+{
+  "schema_version": 1,
+  "components": {
+    "pyats": {
+      "servers": [
+        "pyats-mcp"
+      ],
+      "script": "scripts/pyats-stdio.py",
+      "script_env": "PYATS_MCP_SCRIPT",
+      "bridge": true,
+      "required_env": [
+        "PYATS_TESTBED_PATH"
+      ],
+      "expected_tools": [
+        "pyats_list_devices"
+      ]
+    },
+    "netbox": {
+      "servers": [
+        "netbox-mcp"
+      ],
+      "module": "netbox_mcp_server.server",
+      "pythonpath": "mcp-servers/netbox-mcp-server/src",
+      "script": "mcp-servers/netbox-mcp-server/src/netbox_mcp_server/server.py",
+      "script_env": "NETBOX_MCP_SCRIPT",
+      "args": [
+        "--transport",
+        "stdio"
+      ],
+      "required_env": [
+        "NETBOX_URL",
+        "NETBOX_TOKEN"
+      ],
+      "expected_tools": [
+        "netbox_get_objects"
+      ]
+    },
+    "servicenow": {
+      "servers": [
+        "servicenow-mcp"
+      ],
+      "module": "servicenow_mcp.cli",
+      "pythonpath": "mcp-servers/servicenow-mcp/src",
+      "script": "mcp-servers/servicenow-mcp/src/servicenow_mcp/cli.py",
+      "script_env": "SERVICENOW_MCP_SCRIPT",
+      "required_env": [
+        "SERVICENOW_INSTANCE_URL"
+      ],
+      "expected_tools": [
+        "list_tool_packages"
+      ]
+    },
+    "nvd-cve": {
+      "servers": [
+        "nvd-cve-mcp"
+      ],
+      "module": "mcp_nvd.main",
+      "pythonpath": "mcp-servers/mcp-nvd",
+      "script": "mcp-servers/mcp-nvd/mcp_nvd/main.py",
+      "script_env": "NVD_MCP_SCRIPT",
+      "args": [
+        "--transport",
+        "stdio"
+      ],
+      "expected_tools": [
+        "search_cve"
+      ]
+    },
+    "subnet-calc": {
+      "servers": [
+        "subnet-calc-mcp"
+      ],
+      "script": "mcp-servers/subnet-calculator-mcp/servers/subnetcalculator_mcp.py",
+      "script_env": "SUBNET_MCP_SCRIPT",
+      "expected_tools": [
+        "subnet_calculator"
+      ]
+    },
+    "wikipedia": {
+      "servers": [
+        "wikipedia-mcp"
+      ],
+      "script": "mcp-servers/Wikipedia_MCP/main.py",
+      "script_env": "WIKIPEDIA_MCP_SCRIPT",
+      "expected_tools": [
+        "search_pages"
+      ]
+    },
+    "markmap": {
+      "servers": [
+        "markmap-mcp"
+      ],
+      "command": "node",
+      "script": "mcp-servers/markmap_mcp/markmap-mcp/dist/index.js",
+      "script_env": "MARKMAP_MCP_SCRIPT",
+      "expected_tools": [
+        "markmap_generate"
+      ]
+    },
+    "drawio-rfc": {
+      "servers": [
+        "drawio-mcp",
+        "rfc-mcp"
+      ],
+      "variants": {
+        "drawio-mcp": [
+          "npx",
+          "-y",
+          "@drawio/mcp"
+        ],
+        "rfc-mcp": [
+          "npx",
+          "-y",
+          "@mjpitz/mcp-rfc"
+        ]
+      },
+      "expected_tools": []
+    },
+    "packet-buddy": {
+      "servers": [
+        "packet-buddy-mcp"
+      ],
+      "script": "mcp-servers/packet-buddy-mcp/server.py",
+      "script_env": "PACKET_BUDDY_MCP_SCRIPT",
+      "expected_tools": [
+        "list_pcaps"
+      ]
+    },
+    "nmap": {
+      "servers": [
+        "nmap-mcp"
+      ],
+      "script": "mcp-servers/nmap-mcp/server.py",
+      "script_env": "NMAP_MCP_SCRIPT",
+      "cwd": "mcp-servers/nmap-mcp",
+      "expected_tools": []
+    },
+    "gtrace": {
+      "servers": [
+        "gtrace-mcp"
+      ],
+      "command": "gtrace",
+      "command_env": "GTRACE_MCP_BIN",
+      "args": [
+        "mcp"
+      ],
+      "expected_tools": [
+        "traceroute"
+      ]
+    },
+    "tts": {
+      "servers": [
+        "tts-mcp"
+      ],
+      "script": "mcp-servers/tts-mcp/server.py",
+      "script_env": "TTS_MCP_SCRIPT",
+      "expected_tools": [
+        "list_voices"
+      ]
+    }
+  }
+}

config/installer-runtime.json

@@ -0,0 +1,10 @@
+{
+  "openclaw_package": "openclaw@latest",
+  "node_ranges": {
+    "openclaw": [{"min": [24, 16, 0], "max_exclusive": [25, 0, 0]}, {"min": [26, 1, 0]}],
+    "hermes": [{"min": [18, 0, 0]}]
+  },
+  "node_descriptions": {"openclaw": ">=24.16.0 <25 or >=26.1.0", "hermes": ">=18 (Node-based components)"},
+  "checked": "2026-10-10",
+  "source": "https://docs.openclaw.ai/install/node-compatibility"
+}