fix(onboard): admit pending OpenClaw pairing observation by senthilr-nv · Pull Request #10062 · NVIDIA/NemoClaw

senthilr-nv · 2026-08-24T05:14:36Z

Summary

OpenClaw ordinary pairing observation now accepts the typed scope-upgrade-pending state that its observer already emits. The real-device proof also compares the Portable repair result with the current pending-upgrade observation instead of a removed variable.

Related to #9211 and #9817.

Changes

Admit the exact scope-upgrade-pending state in the ordinary settlement parser.
Keep Portable repair settlement on its separate fail-closed state parser and reject a non-repair request.
Update the real-device proof to preserve the same-device identity comparison.
Correct the regression expectation for an ordinary non-repair pending upgrade.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification:
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: The parser still requires the bounded final marker, exact keys, a SHA-256 device identity, and one allowlisted state. Portable repair uses its separate parser and still rejects non-repair requests. No scopes, credentials, retries, time budgets, or runtime authority change.
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

DGX Station Hardware Evidence

Tested on DGX Station
Tested commit: not applicable
Station profile/scenario: not applicable
Result: not applicable
Supporting evidence: not applicable

Verification

PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project cli src/lib/actions/sandbox/launch-readiness/openclaw-pairing-qualification.test.ts (40/40); npm run test:changed (32/32 growth checks and 527/527 changed tests); npm run typecheck:cli; npm run checks:repository; CLI/plugin builds and source-map validation
Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
Quality Gates section completed with required justifications or waivers
No secrets, API keys, or credentials committed
npm run docs builds without warnings (doc changes only)
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new doc pages only)

Signed-off-by: Senthil Ravichandran senthilr@nvidia.com

Summary by CodeRabbit

Bug Fixes
- Improved Portable repair validation by matching the device identity hash with the pending upgrade observation, ensuring more accurate device verification.
- Improved settlement status handling for pending scope upgrades, providing more accurate readiness and repair results.

Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>

github-code-quality · 2026-08-24T05:15:15Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit 6158163 in the codex/fix-openclaw-r... branch remains at 96%, unchanged from commit 43b4094 in the main branch.

_{Updated August 24, 2026 05:51 UTC}

coderabbitai · 2026-08-24T05:15:43Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: aee73960-71c8-499b-a065-be835d7e1c61

📥 Commits

Reviewing files that changed from the base of the PR and between ca7f7f6 and 6158163.

📒 Files selected for processing (2)

src/lib/actions/sandbox/launch-readiness/openclaw-pairing-qualification.test.ts
src/lib/actions/sandbox/launch-readiness/openclaw-pairing-qualification.ts

Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Walkthrough

The settlement parser now accepts pending scope-upgrade observations. Related tests expect this state, and the Portable repair assertion uses the pending upgrade device identity hash.

Changes

OpenClaw settlement qualification

Layer / File(s)	Summary
Accept pending scope-upgrade settlements `src/lib/actions/sandbox/launch-readiness/openclaw-pairing-qualification.ts`, `src/lib/actions/sandbox/launch-readiness/openclaw-pairing-qualification.test.ts`	The parser accepts `scope-upgrade-pending`, and the canonical scope-upgrade test expects this state.
Update Portable repair identity assertion `test/helpers/openclaw-real-device-self-approval-proof.ts`	The assertion compares against `pendingUpgradeObservation.deviceIdentitySha256`.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 61581

This localized change admits the intended pending pairing state while preserving fail-closed repair handling and same-device verification; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: jyaunches, sandl99

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: admitting a pending OpenClaw pairing observation.
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/fix-openclaw-real-device-proof

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-24T05:21:27Z

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Synthesis status: Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: None

Manual-only E2E: onboard-repair, onboard-resume
The manual PR workflow does not run these selectors for the commit under review. Run them from reviewed code on main.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

…real-device-proof

Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>

sandl99

Approved latest PR commit 6158163 after code and security review. The settlement parser now admits only the existing scope-upgrade-pending state while preserving exact-key, terminal-output, digest, repair-path, and qualification checks; the real-device proof compares the correct canonical pending observation. Local validation: plugin and CLI builds, CLI type-check, focused pairing qualification tests (40/40), and diff check passed. Security: PASS for secrets and credentials, input validation, authentication and authorization, dependencies, errors and logging, cryptography and data protection, configuration, security testing, and system security. Cross-issue scan found no related fixes or conflicts. CI is not used as an approval gate for this review per maintainer direction.

## Summary Portable OpenClaw onboarding now waits within its existing fixed lifecycle for the canonical CLI device to appear and for approved baseline scopes to persist. Invalid, unrelated, multiple-request, or changed-device state still fails closed, and the controller still runs at most one request producer and one approval. ## Related Issue Related to #9817. ## Changes - Give not-yet-visible or concurrently changing canonical state a typed retryable observation result while retaining terminal rejection for invalid state. - Reuse the accepted 60-second appearance window, 30-second final observation window, one-second polling interval, and existing total settlement cap in the Portable controller. - Require the final strict observation to retain the same device identity, no pending request, and exact baseline scopes. - Add deterministic delayed-appearance and delayed-persistence controller regressions, plus a pinned OpenClaw 2026.7.1 production-controller proof. - Preserve PR #10062 as the separate owner for the ordinary `scope-upgrade-pending` parser and proof baseline. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Issue #9817 and the maintainer decision fix the contract to one canonical CLI identity with exact baseline scopes and no pending request. The change preserves that conjunction, retries only typed absence or state change, and keeps unrelated, multiple, malformed, or changed-identity state terminal. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: local complete changed-test and pinned-runtime lanes reach the separate PR #10062 `scope-upgrade-pending` baseline after this PR's tests pass; no acceptance is claimed here. ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: Not applicable - Station profile/scenario: Not applicable - Result: Not applicable - Supporting evidence: This change does not modify `scripts/prepare-dgx-station-host.sh`. ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 27/27 Portable settlement tests; 2/2 focused observer tests; 29/29 finalization dependency tests; CLI typecheck; repository architecture checks; pinned OpenClaw 2026.7.1 proof crossed the new production Portable-controller phase. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — `npm run test:changed` passed 529/531 tests; the remaining two tests are the separate PR #10062 baseline. The full pinned harness likewise crossed this PR's phase and then stopped at that baseline. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>  ## Summary by CodeRabbit * **Bug Fixes** * Improved pairing readiness checks to tolerate temporary state changes and delayed device availability. * Added bounded retries for transient observation errors during pairing approval and settlement. * Rejects mismatched device identities and reports incomplete status when settlement times out or is declined. * Prevents unrelated pending requests from being mistaken for temporary pairing states. * **Tests** * Expanded coverage for delayed pairing, retries, timeouts, and final settlement validation.  Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>

test(onboard): fix real-device proof identity

ca7f7f6

Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>

senthilr-nv self-assigned this Aug 24, 2026

senthilr-nv requested review from jyaunches and sandl99 August 24, 2026 05:15

This was referenced Aug 24, 2026

test(e2e): fix pairing observation reference #10065

Closed

docs(security): stop labelling the Locked-Down posture as the default #10035

Merged

Merge remote-tracking branch 'upstream/main' into codex/fix-openclaw-…

234e04e

…real-device-proof

github-actions Bot added v0.0.115 and removed v0.0.114 labels Aug 24, 2026

fix(onboard): admit pending pairing observation

6158163

Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>

senthilr-nv changed the title ~~test(onboard): fix OpenClaw real-device proof identity~~ fix(onboard): admit pending OpenClaw pairing observation Aug 24, 2026

sandl99 approved these changes Aug 24, 2026

View reviewed changes

senthilr-nv mentioned this pull request Aug 24, 2026

fix(onboard): wait for Portable pairing convergence #10067

Merged

20 tasks

senthilr-nv merged commit 6a28cae into main Aug 24, 2026
92 of 95 checks passed

senthilr-nv deleted the codex/fix-openclaw-real-device-proof branch August 24, 2026 06:36

Navigation Menu

Uh oh!

fix(onboard): admit pending OpenClaw pairing observation - #10062

fix(onboard): admit pending OpenClaw pairing observation#10062
senthilr-nv merged 3 commits into
mainfrom
codex/fix-openclaw-real-device-proof

senthilr-nv commented Aug 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

github-code-quality Bot commented Aug 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 24, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-actions Bot commented Aug 24, 2026 •

edited

Loading

Uh oh!

sandl99 left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

senthilr-nv commented Aug 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Type of Change

Quality Gates

DGX Station Hardware Evidence

Verification

Summary by CodeRabbit

Uh oh!

github-code-quality Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

Uh oh!

coderabbitai Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-actions Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — No blocking findings reported

E2E guidance

Uh oh!

sandl99 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

senthilr-nv commented Aug 24, 2026 •

edited by coderabbitai Bot

Loading

github-code-quality Bot commented Aug 24, 2026 •

edited

Loading

coderabbitai Bot commented Aug 24, 2026 •

edited

Loading

github-actions Bot commented Aug 24, 2026 •

edited

Loading