feat(blueprint): prepare external target observation - #10310
Closed
apurvvkumaria wants to merge 3 commits into
Closed
feat(blueprint): prepare external target observation#10310apurvvkumaria wants to merge 3 commits into
apurvvkumaria wants to merge 3 commits into
Conversation
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Contributor
|
This repository limits you to 10 open pull requests. Please close or merge an existing PR before opening another one. |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall line coverage in commit 7c0a6fc in the Show a line coverage summary of the most impacted files.
TypeScript / code-coverage/cliThe overall line coverage in commit 7c0a6fc in the Show a line coverage summary of the most impacted files.
Updated |
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (5)
Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review. 📝 WalkthroughWalkthroughThe PR adds validated external OpenShell target plans, immutable observation requests and receipts, sanitized observer failures, adapter guards, shared exports, and expanded boundary and package-contract tests. ChangesOpenShell external observation
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: ⚪ Minimal · up to This PR adds typed, read-only external-target observation and validation without credential reads, authenticated calls, or remote mutations; no actionable merge-blocking risk remains beyond normal checks and review. Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Contributor
PR Review Advisor — Blocking findings reportedAdvisor assessment: Blockers require maintainer review E2E guidanceAdvisory only. A maintainer can dispatch the default E2E suite for the commit under review. Recommended E2E: None Manual-only E2E: Blockers
|
cv
added a commit
that referenced
this pull request
Sep 1, 2026
<!-- markdownlint-disable MD041 --> ## Outcome The Blueprint Runner can validate one explicit externally managed OpenShell target and report the OpenShell `0.0.106` public health result through the official TypeScript SDK. The path uses an explicit HTTPS endpoint, workspace, and CA file without ambient CLI state, credential contents, local gateway lifecycle calls, or mutation. ## Reason Kubernetes Jobs and non-root containers need a bounded first slice of #9872 that can confirm the configured external gateway is reachable. Authenticated identity, inventory, and readiness work requires separate acceptance. ### Related issues Part of #9872 ## Changes - Define shared external-target and observation contracts. Inject the official SDK observer from the root Blueprint Runner entry point. - Validate external lifecycle inputs before effects. Restrict this slice to unauthenticated public health and fixed or redacted bounded diagnostics. - Use one prerequisite validator for external-target plan and status. Reject incomplete version ranges and managed-only fields before output, file access, or observation. - Document the experimental installed command, its OpenShell `0.0.106` boundary, credential-file custody, external traffic, TLS and DNS trust, unsupported capabilities, and recovery. - Package the compiled Blueprint Runner boundary and the pinned optional OpenShell SDK dependency graph. Keep one canonical root-consumed SDK adapter and reject an unconsumed Runner copy in the package contract. - Add the trusted `external-gateway-health` PR workflow selection. Its live commands use the bounded, redacted shell fixture and publish redacted artifacts. - Fail the trusted selection when no test executes. Wait for the owned gateway process to exit after bounded `SIGTERM` and `SIGKILL` cleanup before reporting cleanup success. - Test the installed npm command through a consumer-style offline install. The committed lock supplies the dependency graph without registry metadata lookup or lifecycle scripts. - Record the OpenShell TypeScript SDK `0.0.106` dependency and security review, including the current DNS, transport-lifecycle, licensing, and provenance limits. ## Verification - The current PR revision includes the current base revision, and the worktree is clean. - Large change flag: the current PR changes 43 paths with 2,708 additions and 402 deletions. Most additions are focused boundary, package-contract, workflow, and live-E2E tests; maintainers should keep the review surface visible. - Clean root and plugin builds passed under Node `22.23.1`. - Focused external-target plugin tests passed: 212 tests across five files. - Focused installed-package contracts passed: eight tests across four files, including the Blueprint Runner command, the independent `nemoclaw/lifecycle` export, wrong TLS peers, and the bounded deadline. - Schema, repository, and pull-request workflow contracts passed: 205 tests across four files. - Focused E2E support passed: 52 tests across three files. - Root JavaScript, CLI TypeScript, and plugin TypeScript checks passed. - Repository and source-shape checks passed with no cycles, no candidate source-shape cases, and no invalid exceptions. - `npm run docs` passed the generated agent-variant, published-route, and Fern checks with no errors. - `npm run validate:pr` passed the pre-commit, commit-message, and pre-push gates on the current PR revision. The normal push also passed its pre-push TypeScript checks. - Independent correctness and product-scope reviews found no actionable implementation defect. - Nine-category security review: `WARNING` with no `FAIL`. Accepted residuals are platform DNS without address pinning, no SDK transport close handle, and missing registry attestation or packaged license files before any future Runner image distribution. This slice sends no credential and makes no authenticated or mutating request. - GitHub reports every commit in the PR range as Verified with reason `valid`. - Secret scans and independent reviews found no secrets, API keys, or credentials. <!-- nemoclaw-docs-review:start --> - Documentation review: `docs-updated` - Documentation evidence: npm run docs passed after clarifying plan and status requirements. - Documentation agent: openai/openai/gpt-5.6-sol <!-- docs-review-head-sha: 5897d16 --> <!-- docs-review-agents-blob-sha: dd3528f --> <!-- nemoclaw-docs-review:end --> <!-- nemoclaw-targeted-validation:start --> - Targeted validation: Focused E2E-support tests passed: 2 files and 50 tests. CLI and plugin type checks, repository checks, source-shape checks, and npm run validate:pr passed. <!-- nemoclaw-targeted-validation:end --> <!-- nemoclaw-broad-gate:start --> - Broad gate: passed — npm run validate:pr passed on commit 5897d16. <!-- nemoclaw-broad-gate:end --> Fresh GitHub CI, security scanning, managed-image prerequisites, automated reviews, and trusted `external-gateway-health` E2E are required on the current PR revision before merge. Earlier run evidence is superseded. ## Review notes This is the credential-free public-health slice of #9872, not issue closure. Workspace identity, authenticated inventory and readiness, machine authentication, and every mutation remain out of scope. This PR does not implement or qualify Kubernetes support or support other OpenShell releases. Closed PR #10310 is not a dependency. This PR supplies its own concrete official SDK production consumer. The `nemoclaw/lifecycle` API merged independently through #10703 and requires a caller-injected observer. It does not import, re-export, or qualify this PR's SDK transport, and this PR does not adopt its lifecycle behavior. A separate accepted change can separate gateway-release compatibility policy from the health adapter. Each gateway and SDK combination requires accepted scope, pinned dependency versions, dependency review, deterministic tests, and qualification evidence. Unknown releases must continue to fail closed. The package contract uses NemoClaw's `NEMOCLAW_INSTALLING=1` guard only for the local consumer-link step. It proves the guarded installed-command boundary, not an ordinary unguarded package lifecycle. The locked dependency graph and packed runtime remain covered independently. The SDK uses platform DNS and exposes no transport close handle. This adapter remains limited to trusted infrastructure and a one-shot Blueprint Runner process. Blueprint Runner image publication remains blocked on a software bill of materials, license inventory, provenance evidence, and runtime identity tied to the distributed build. A broad local E2E-support run was intentionally excluded from evidence after concurrent child-process tests exhausted their five-second local budgets. The candidate-owned suites were rerun serially and passed; fresh Ubuntu CI owns the broad current-PR result. --- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> --------- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR prepares the typed, read-only observation boundary for an explicit external OpenShell target. The boundary checks the public release before an opaque credential handoff and then sequences identity, workspace, and inventory observations without using ambient CLI state.
Machine authentication and the exact supported OpenShell release remain undecided. This PR adds no credential read, SDK transport, authenticated call, or remote mutation.
Related Issue
Related to #9872
Changes
allWorkspaces: false.Type of Change
Quality Gates
DGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run validate:prpassed after refreshingorigin/mainwhen hooks were skipped or unavailablenpx vitest run --project plugin nemoclaw/src/shared/openshell-observation-boundary.test.ts --project cli src/lib/adapters/openshell/sandbox-observer-cli.test.ts: 22 tests passed.npm run typecheck:cli: passed.npm --prefix nemoclaw run typecheck: passed.npx vitest run --project package-contract test/package-contract/blueprint-external-target-plan.test.ts: 1 test passed.npm run checks:repository: passed.npm run validate:pr: passed.npm run test:package: 1,230 tests passed. Ten credential-command tests stopped at the installed OpenShell lifecycle-authority check; exactorigin/mainreproduced the same ten failures.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result:npm run docsbuilds without warnings (doc changes only)Signed-off-by: Apurv Kumaria akumaria@nvidia.com
Summary by CodeRabbit
New Features
Bug Fixes