fix(onboard): keep tier-default Brave on reuse in the fresh-selection branch

[harjothkhara]

Summary

Re-onboarding a Balanced-tier sandbox and choosing reuse pruned the brave preset and narrowed api.search.brave.com egress whenever web search was declined, then failed finalization with an OpenClaw runtime identity error. #6856 fixed this exact preservation contract for #6844, but only threaded the recorded policy tier into the resume branch of the shared policy-preset selection function — a fresh-selection branch that reuse can also reach (non-interactive env overrides, or a sandbox whose prior policy step never finalized) still pruned tier-default presets as if they were ordinary web-search leftovers. This threads the recorded tier into that branch's three affected prune sites too.

Related Issue

Fixes #10404

Changes

• src/lib/onboard/policy-selection.ts: setupPoliciesWithSelectionInner's fresh-selection branch has five pruneUnavailablePresets call sites. Three passed no tierName and are fixed here: the preservation prune (feeds both the non-interactive carry-forward and the interactive pre-checked set), the NEMOCLAW_POLICY_MODE=skip retention prune, and the non-interactive env-preset prune. Two are deliberately left alone: the suggestion-list prune (#6856 intentionally kept fresh-onboard suggestions conservative — unrelated to this reuse contract), and the final interactive prune, which already passes preserveExplicitWebSearch and never reaches the tier-blind fallback this bug depends on. recordedTierName is hoisted above the first affected call site so it's available there. The recorded tier is used rather than a freshly resolved one so a genuinely fresh onboard keeps its existing conservative suggestion behavior: with no recorded tier the value is null, and null still fails safe (prunes) — verified by mutation: widening this to the resolved tier breaks the pre-existing null-recorded-tier regression test for #6844.
• test/runtime/policy/policy-tiers-onboard.test.ts: 7 new tests covering the repro (interactive and non-interactive fresh-selection branches with a recorded Balanced tier), both reuse-seeding-bypass triggers (NEMOCLAW_POLICY_MODE=skip, NEMOCLAW_POLICY_PRESETS in suggested mode), and three boundary cases that must still prune (a recorded Restricted tier, tavily — not a Balanced default, and webSearchSupported: false). Retitled the pre-existing #6844 fresh-branch test to "...with no recorded tier" — its assertions are unchanged, but its title read as a contradiction of the new recorded-tier tests sitting next to it once both exist.

Why the reported failure hits the fresh branch, not the already-guarded resume branch. The issue's repro steps narrate an interactive reuse, which for a normally-completed prior onboard would route through the resume branch #6856 already fixed. But the issue's own log shows "Applying policy presets: npm, pypi, huggingface, brew, openclaw-pricing" with no "Preserving previously-applied presets" note — that message format matches only the fresh-selection branch's non-interactive log line (the resume branch logs "Reapplying"). So the reported failure is consistent with an automated non-interactive validation run (the issue carries NV QA/UAT labels) that hit a reuse-seeding bypass, not with the narrated interactive steps taking a still-broken resume branch.

A related, out-of-scope observation, disclosed rather than folded in: the same tier-blind gap exists in the sandbox rebuild target-preset filter (src/lib/actions/sandbox/rebuild-backup-phase.ts:91-94, also calling isStaleBuiltinWebSearchPolicyPreset with no tierName, despite the caller one level up already having sandboxEntry.policyTier available). Same predicate, different command (nemoclaw sandbox rebuild, not onboard reuse), pre-dating this fix. Not fixed here since it's a separate entry point this issue doesn't report against; flagging for a maintainer or a follow-up issue.

A first correction, made after the automated PR Review Advisor's first pass:

• Code/Reduction: the interactive and non-interactive fresh-selection regression tests differed only in nonInteractive. Merged them into one it.each case over both values, matching this file's existing parameterized-test convention.
• Documentation: docs/reference/network-policies.mdx said NemoClaw "removes stale web search presets during resume reconciliation... when you switch providers or disable web search" with no qualification — now incomplete for a reused sandbox with a recorded Balanced or Open tier. Qualified the statement: a tier-default preset (brave — confirmed against nemoclaw-blueprint/policies/tiers.yaml that only brave, never tavily, is a literal tier preset default) now survives reuse instead of being pruned as a leftover, and named the cases that still prune (tavily is never a tier default; Restricted has no web-search default).

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: implemented against an independent root-cause investigation, then independently adversarially reviewed by a second agent with no prior context on this PR; that review's findings (evidentiary clarity on which branch the reported failure hit, a miscounted call-site claim, two test titles overstating what they exercise, and the disclosed rebuild-backup-phase.ts sibling gap) are all addressed above. A maintainer pass is still expected before merge; this checkbox records contributor-side review completion, not a waiver of maintainer review.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

DGX Station Hardware Evidence

Not applicable — this PR does not change scripts/prepare-dgx-station-host.sh. (The issue was reproduced in automated release validation on WSL x86, Ubuntu 24 GPU, and DGX Station, but this fix targets shared onboard/policy-preset logic common to all of them, not a DGX-specific path.)

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result: npx vitest run --project integration test/runtime/policy/policy-tiers-onboard.test.ts — 100 tests passed (7 new for [Linux][Onboard] Brave Balanced-tier preset is removed on re-onboard reuse when web search is disabled #10404, 4 of which were confirmed RED against unmodified origin/main and each new/changed production line was independently confirmed load-bearing by per-line mutation). npx vitest run --project cli src/lib/onboard/policy-resume-selection.test.ts — 19 tests passed, confirming no regression in the sibling resume branch #6856 already guards. npm run typecheck:cli and npm run checks:repository both clean.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — 0 errors; the 2 warnings reported (missing FERN_TOKEN for a redirects check, and a pre-existing brand accent-color contrast note) are unrelated to this content change and reproduce identically with the doc edit reverted.
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: harjoth harjoth.khara@gmail.com

Summary by CodeRabbit

• Bug Fixes

  • Improved web-search policy handling during setup and resume.
  • Preserves Brave for recorded Balanced or Open tiers, even when web search is disabled.
  • Removes Brave for Restricted tiers and unsupported configurations.
  • Removes Tavily whenever web search is declined.
  • Keeps tier-appropriate settings across interactive, non-interactive, skipped, and suggested setup flows.

• Tests

  • Added regression coverage for web-search preset preservation and removal scenarios.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: cb59c23f-2962-48d2-a1c4-4940030010ff

📥 Commits

Reviewing files that changed from the base of the PR and between d0d5120 and 08955e9.

📒 Files selected for processing (3)

• docs/reference/network-policies.mdx
• src/lib/onboard/policy-selection.ts
• test/runtime/policy/policy-tiers-onboard.test.ts

🚧 Files skipped from review as they are similar to previous changes (3)

• docs/reference/network-policies.mdx
• src/lib/onboard/policy-selection.ts
• test/runtime/policy/policy-tiers-onboard.test.ts

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The change preserves tier-provided brave presets for recorded Balanced or Open tiers when web search is disabled. It removes unsupported brave and always removes tavily. Onboarding flows now pass recorded tier context to preset pruning.

Changes

Policy tier preset handling

Layer / File(s)	Summary
Recorded-tier pruning src/lib/onboard/policy-selection.ts	Policy selection resolves the explicit or persisted tier and uses it when pruning retained and selected presets across onboarding flows.
Web-search preset validation test/runtime/policy/policy-tiers-onboard.test.ts, docs/reference/network-policies.mdx	Tests and documentation cover Brave and Tavily behavior across policy tiers, web-search support, skip mode, suggested mode, interactive selection, and non-interactive selection.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 08955

This change preserves tier-default policy presets during sandbox reuse while retaining existing pruning behavior for non-default cases; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preserving tier-default Brave during onboarding reuse in the fresh-selection branch.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[harjothkhara]

Rebased onto origin/main (this was conflicting) and revalidated at 08955e9:

• test/runtime/policy/policy-tiers-onboard.test.ts — 100 passed
• test/onboarding/onboard-preset-diff.test.ts — 28 passed
• src/lib/onboard/policy-resume-selection.test.ts — 22 passed
• npm run typecheck:cli and npm run checks:repository — clean

The conflict was mechanical: main wrapped the NEMOCLAW_POLICY_MODE=skip retention call in mergeRequiredSetupPolicyPresets(...). I kept that structure and re-applied the tierName argument to the inner pruneUnavailablePresets.

#10457 also fixes #10404 and is broader — it covers the rebuild-backup-phase.ts gap I flagged in the description. Maintainers should pick one; I am not closing this.

One difference is worth a deliberate call, because it is not just scope. This PR passes the recorded tier (options.tierName ?? getRecordedPolicyTier(...)) to the three prune sites; #10457 passes the freshly resolved tierName. The two differ only when no tier is recorded, which is why #10457 flips two existing #2177 assertions in onboard-preset-diff.test.ts from "brave removed" to "brave kept" — that harness stubs no getRecordedPolicyTier. Both fix the reported repro, where a real sandbox has a recorded Balanced tier.

[github-actions]

PR Review Advisor finished for commit 08955e9. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

All previous runs

[prekshivyas]

Maintainer decision: superseded by #10457. We are selecting #10457 because it covers both the existing-sandbox reuse path and the rebuild path, includes the field-regression coverage needed for #10404, and is being qualified against the current runtime-identity baseline. The #10457 implementation is independent; no code or tests were transferred from this PR. Thank you for the focused investigation and fix.