fix(images): pass managed target architecture

[jyaunches]

Summary

The managed-image publisher selected linux/arm64 for Hermes but did not pass TARGETARCH, so Hermes's documented Podman fallback forced amd64 and the native arm64 bootstrap ELF failed its architecture check. This change passes the trusted matrix architecture explicitly to both production argument validation and Buildx.

Changes

• Pass validated TARGETARCH=${{ matrix.arch }} through the production managed-image guard.
• Pass the same architecture to the managed-image Buildx invocation.
• Protect the workflow contract with the existing publication test.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: The exact architecture remains constrained to the trusted matrix amd64|arm64; the native ELF Machine assertion remains fail-closed. No credential boundary changes.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable
• Result: Not applicable
• Supporting evidence: Not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project integration test/managed-image-publication-workflow.test.ts passed 34 tests; repository checks passed.
• Applicable broad gate passed — command/result: managed-image workflow will build both architectures on this PR.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

Failure evidence

• Run: https://github.com/NVIDIA/NemoClaw/actions/runs/32665988248
• Failed job: Hermes arm64 managed image
• Stable signature: BuildKit rendered target_arch="amd64" on the arm64 runner; the fail-closed ELF Machine assertion rejected the resulting mismatch.

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Improved managed image builds for both AMD64 and ARM64 architectures.
  • Ensured architecture-specific build settings are consistently validated and applied, helping produce more reliable images across supported platforms.

• Tests

  • Added coverage to verify architecture settings are included during production image publication.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: bcd9317c-05ea-49a0-a70d-5ea121e8564e

📥 Commits

Reviewing files that changed from the base of the PR and between 203a607 and bcb1945.

📒 Files selected for processing (2)

• .github/workflows/managed-images.yaml
• test/managed-image-publication-workflow.test.ts

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

The production managed-image workflow validates each matrix architecture and passes it as TARGETARCH to build-argument validation and Docker image builds. Tests now require the architecture argument.

Changes

Managed image architecture

Layer / File(s)	Summary
Architecture build-argument flow .github/workflows/managed-images.yaml, test/managed-image-publication-workflow.test.ts	The workflow validates amd64 or arm64, passes the matrix architecture as TARGETARCH to validation and Docker builds, and updates the expected build arguments.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to bcb19

This localized workflow change passes the validated target architecture through managed-image validation and builds, preventing the documented arm64 fallback mismatch; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: brandonpelfrey

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: passing the managed target architecture to the image workflow.
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/managed-image-targetarch

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit bcb1945 in the fix/managed-image-ta... branch remains at 96%, unchanged from commit 203a607 in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit bcb1945 in the fix/managed-image-ta... branch remains at 83%, unchanged from commit 203a607 in the main branch.

Show a line coverage summary of the most impacted files.

File	main 203a607	fix/managed-image-ta... bcb1945	+/-
src/lib/platform.ts	98%	96%	-2%
src/lib/state/m...-acquisition.ts	82%	82%	0%
src/lib/messagi...solver-utils.ts	96%	96%	0%
src/lib/onboard...uild-context.ts	74%	74%	0%
src/lib/runner.ts	78%	78%	0%
src/lib/sandbox...rce-identity.ts	82%	82%	0%
src/lib/security/redact-url.ts	98%	100%	+2%

---

_{Updated August 24, 2026 00:29 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Synthesis status: Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: None

Manual-only E2E: managed-image-multiarch-startup
The manual PR workflow does not run these selectors for the commit under review. Run them from reviewed code on main.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.