test(e2e): select messaging and Shields runtime proofs

[cjagwani]

Outcome

Messaging and Shields runtime changes now select their focused branch E2E proof lanes. Production changes that leave the live test files untouched can no longer fall through to only the generic risk plan.

Reason

PR #10480 protects fast-test parity when a live E2E test changes, but recent regressions in #10153 and #10155 came from production runtime changes. The live test files did not change, so that guard could not select the missing messaging and Shields proof.

Related issues

Relates to #10153
Relates to #10155

Changes

• Map shared messaging runtime inputs to channel lifecycle, provider, Hermes Discord, and OpenClaw pairing proofs.
• Map Hermes and OpenClaw startup inputs to their agent-specific messaging and Shields proofs.
• Map shared Shields runtime inputs to both Hermes and OpenClaw Shields proofs.
• Bump the deterministic risk-plan version and add risk-plan plus rendered-workflow regression coverage.

The existing trusted risk planner is the current PR workflow consumer. Extending that source ownership directly is necessary because a live-test parity rule cannot observe production-only changes.

Verification

• npm run build:cli — passed
• npm run typecheck:cli — passed after rebasing onto current main
• npx vitest run --project integration test/automation/pull-requests/pr-risk-plan.test.ts --testTimeout 60000 — 154 passed after rebasing onto current main
• npx vitest run --project e2e-support test/e2e/support/workflow-plan.test.ts --testTimeout 60000 — 88 passed after rebasing onto current main
• git diff --check — passed
• Documentation writer review — no user-facing documentation change needed
• GitHub commit verification — commit is Verified with a valid signature
• Secret review — the diff contains no secrets, API keys, or credentials

Review notes

This changes the trusted E2E selection control plane, not production runtime behavior. Regression tests verify both the selected risk jobs and their resolved workflow lanes.

The default 5-second test timeout was too short for several subprocess-based workflow-plan cases under local machine load. Re-running the same full file with a 60-second timeout passed all 88 tests; required CI remains the merge gate.

---

Signed-off-by: Charan Jagwani cjagwani@nvidia.com

Summary by CodeRabbit

• Tests

  • Expanded automated coverage for messaging runtime, Hermes startup, OpenClaw pairing, and Shields runtime scenarios.
  • Added validation for managed-policy and shared runtime guard behavior.
  • Improved workflow checks to select the appropriate messaging and inference test lanes while excluding unrelated jobs.

• Chores

  • Updated risk-based test planning to recognize new messaging, startup, and Shields changes and select matching verification jobs.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit b8f6227 in the codex/e2e-source-own... branch remains at 96%, unchanged from commit b105a59 in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit b8f6227 in the codex/e2e-source-own... branch remains at 83%, unchanged from commit b105a59 in the main branch.

Show a line coverage summary of the most impacted files.

File	main b105a59	codex/e2e-source-own... b8f6227	+/-
src/lib/actions...sor-relaunch.ts	94%	75%	-19%
src/lib/actions...ary-recovery.ts	97%	92%	-5%
src/lib/actions...eway-restart.ts	98%	97%	-1%
src/lib/onboard...uild-context.ts	74%	74%	0%
src/lib/actions...ess-recovery.ts	85%	85%	0%
src/lib/inferen...board-probes.ts	82%	82%	0%
src/lib/sandbox...rce-identity.ts	82%	82%	0%
src/lib/securit...ot-sanitizer.ts	94%	94%	0%

---

_{Updated August 28, 2026 06:26 UTC}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5d1bac2b-d0e4-4658-b44b-8b8854e1a732

📥 Commits

Reviewing files that changed from the base of the PR and between b105a59 and b8f6227.

📒 Files selected for processing (3)

• test/automation/pull-requests/pr-risk-plan.test.ts
• test/e2e/support/workflow-plan.test.ts
• tools/advisors/risk-plan.mts

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The risk plan now maps messaging, Hermes, OpenClaw, and Shields runtime changes to focused E2E jobs. Tests validate job selection, managed-policy expectations, runtime proofs, and the updated plan version.

Changes

Runtime risk-plan selection

Layer / File(s)	Summary
Runtime job inventories and expectations tools/advisors/risk-plan.mts, test/automation/pull-requests/pr-risk-plan.test.ts	Adds runtime file inventories, E2E job groups, expected selections, and risk-plan version 20.
Focused matching and required-job selection tools/advisors/risk-plan.mts	Matches messaging, startup, and Shields runtime changes, then selects their required jobs with matched files.
Risk-plan and workflow validation test/automation/pull-requests/pr-risk-plan.test.ts, test/e2e/support/workflow-plan.test.ts	Adds coverage for messaging, OpenClaw, Hermes, and Shields job selection and excludes the aggregate channels-stop-start job where required.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to b8f62

This localized change updates E2E risk-plan selection and adds regression coverage; no actionable merge-blocking risk remains after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant ChangedFiles
  participant RiskPlanMatcher
  participant RuntimeChecks
  participant RequiredJobSelection
  participant WorkflowPlanner
  ChangedFiles->>RiskPlanMatcher: provide changed runtime files
  RiskPlanMatcher->>RuntimeChecks: submit focused matches
  RuntimeChecks->>RequiredJobSelection: return relevant categories
  RequiredJobSelection->>WorkflowPlanner: provide selected E2E jobs and matched files

Loading

Suggested reviewers: cv

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: selecting messaging and Shields runtime proof lanes in the E2E risk planner.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/e2e-source-ownership

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor finished for commit b8f6227. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

All previous runs