ci(installer): trust shared gateway state resolver - #10580
Merged
Conversation
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review. 📝 WalkthroughWalkthroughThe change adds trusted runtime-template digests for selected OpenShell releases and tests installer acceptance of a supervisor runtime using the shared gateway-state resolver. ChangesSupervisor runtime trust
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to This PR adds a narrowly scoped installer trust identity for a prospective runtime template while preserving the existing trusted identity and fail-closed behavior; no actionable merge-blocking risk remains beyond normal checks and review. Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
Contributor
Contributor
|
PR Review Advisor finished for commit |
apurvvkumaria
approved these changes
Aug 29, 2026
rsliter
added a commit
that referenced
this pull request
Sep 10, 2026
<!-- markdownlint-disable MD041 --> ## Outcome The base-trusted installer parser accepts the exact gateway runtime preparation template needed by #11212. Other operational mutations remain rejected. ## Reason Installer CI executes the parser from the PR base. The platform fix cannot authorize its own runtime-file change, so this independently reviewed prerequisite must land first, following #10580. ### Related issues Unblocks #11212. Refs #11208. ## Changes - Authorize normalized runtime digest `b6e467dd20e1bcb27d26d40ccc56eaef2a0c1321537108884e0941661a840373` in the six release records with supervisor identities. Preserve their image, manifest, binary, and release identities. - Construct the prospective runtime in one shared test fixture. Exercise the real parser with every affected release selected and verify rejection of an altered supervisor registry. - Move existing installer-template fixture setup into its owning helper to keep the test file within its size limit. The production runtime remains unchanged. ## Verification - The new acceptance test failed with the original template mismatch before the allowlist change. - Initial supervisor, installer-hash, and sandbox-build trust suites: 120 tests passed. Final supervisor and installer-hash suites: 112 tests passed, including all six release selections. - Source-shape validation passed without new exceptions. The diff contains no secrets, API keys, or credentials. - `npm run validate:pr` passed for `80cb0e03da5938ce70fda1a2926e879a65bb91c0` against canonical main `5b82037acb402862bb590ef57cb4d4c608e35ce7`. - Both focused installer-trust suites passed again after integrating main: 112 tests. The protected runtime and intended five-file change remain unchanged. The previous `d66fc41` candidate passed [full CI](https://github.com/NVIDIA/NemoClaw/actions/runs/34422070097) and [managed-image validation](https://github.com/NVIDIA/NemoClaw/actions/runs/34422070064). Its activation DNS failure passed on one targeted rerun; retained artifacts showed cleanup succeeded. Current-commit CI and review results are recorded in checks and review comments. - `npm run review:local` could not produce findings: its temporary OpenShell gateway refused the connection during configuration, and temporary-file cleanup reported EACCES. Earlier GitHub Advisor reviews completed successfully. The latest attempt failed before findings because the shared service exhausted its budget; Rebecca explicitly confirmed Advisor is optional and its unavailability does not block this PR. ## Review notes Rebecca Sliter approved this prerequisite and authenticated GitHub CLI publication in the originating task. Local review of the dependent runtime at `9a097650ddbc58111138d27c6fae4e78d035dabc` confirmed one preparation result supplies the gateway environment and TLS path without changing supervisor image or manifest identities. The prospective fixture reconstructs that runtime byte-for-byte before normalization. All nine full [Advisor reports for `d66fc41`](https://github.com/NVIDIA/NemoClaw/actions/runs/34423073564) were reviewed. The optional suggestion to extract the digest into a constant does not correct a demonstrated defect; release-specific authorization remains the established policy owner and six-release tests cover membership. All other reports found no required change. The earlier release-selection test gap and unclear trust comments were repaired. CodeRabbit found no actionable issue. The final base integration addresses the current-main merge gate. The prior candidate passed full CI and exact all-agent activation. Its two MCP discovery runs failed during external tunnel setup before product execution; their unchanged fixtures cleaned up successfully. The transport diagnostic does not establish a transient cause, so no blind retry or speculative product repair was made. Fresh checks will evaluate the refreshed candidate. --- Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com> --------- Co-authored-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outcome
Base-trusted installer CI recognizes the exact prospective supervisor runtime template required by #10550's shared gateway-state resolver migration, without changing runtime behavior.
Reason
The installer hash workflow executes parser code from the pull request base. PR #10550 therefore cannot authorize its own change to
docker-driver-gateway-runtime.ts; the trust anchor must land first as an independently reviewed precursor.Related issues
Changes
Verification
npm run check:installer-hashnpx vitest run test/install/installer-supervisor-manifest-trust.test.ts(15/15)npx vitest run test/automation/pull-requests/growth-guardrails.test.ts test/install/installer-supervisor-manifest-trust.test.ts(47/47)npm run source-shape:check(52 approved contracts, zero invalid exceptions)npm run checks:repositorynpm run build:cliReview notes
abfc1337284d437e71e47945936af7ef0bc6f28ac2495e12fac41894eb24ce3c, recomputed from the exact prospective fix(uninstall): honour gateway state override #10550 runtime bytes after normalizing only the existing supervisor manifest map.Signed-off-by: Prekshi Vyas prekshiv@nvidia.com
Summary by CodeRabbit