refactor(inference): route provider lifecycle through adapter

[rsliter]

Outcome

NemoClaw inference provider inspection, mutation, and rollback now use the typed OpenShell provider adapter. CLI argv, provider metadata parsing, timeouts, credential environment transfer, and redaction stay inside the CLI adapter.

Reason

Phase 1 of the OpenShell migration requires provider consumers to stop parsing CLI output directly. This is the inference consumer portion of #9806 and builds on the provider adapter foundation in #10149 and onboarding capabilities in #10719.

Related issues

Partial #9806

Depends on #10719

Relates to #9809

Relates to #9813

Changes

• add typed provider revision metadata for inference ownership and settlement decisions
• move provider revision parsing and bounded profile and inventory output handling into the CLI adapter
• route inference provider inspection, create, update, delete, and rollback through the injected adapter
• fail closed before mutation when ownership or revision identity is incomplete
• keep revision metadata private to the typed adapter so legacy onboarding and recovery consumers retain their existing contract
• keep OpenShell inference route selection outside this PR because route transport belongs to Phase 1 slice 6: Route inference configuration through the OpenShell adapter #9809

Verification

• focused CLI tests: 22 files, 311 tests passed
• focused ownership regression tests: 2 files, 24 tests passed
• focused compatibility follow-up: gateway metadata and CLI adapter 2 files, 55 tests passed; credentials 1 file, 11 tests passed; filtered package contract 1 passed and 25 skipped
• focused integration tests: 2 files, 6 tests passed
• npm --prefix nemoclaw run build: passed
• npm run build:cli: passed
• npm run typecheck:cli: passed
• npm run checks:repository: passed at 1,856 files, 5,864 edges, 0 cycles, and 2,621 test candidates
• normal pre-commit, commit-msg, and pre-push hooks: passed
• git diff --check: passed
• GitHub commit verification: Verified
• reviewed the diff for secrets, API keys, and credentials; credential values remain confined to the child process environment

Review notes

This is one independently reviewable inference consumer change, not the completion of #9806. The raw openshell inference set route operation is deliberately unchanged and remains tracked by #9809. Messaging, MCP, recovery, cleanup, and the final consumer disposition remain deferred under #9806 and #9813.

• Documentation writer subagent reviewed the completed changes
• Result: docs-not-needed
• Evidence: Reviewed the complete inference diff from current base 910c4ea1705d5240d4c5415e65cd07b12e8751be through merge commit 3e37598e05be83e52d7397abf873ffe605a3bf87. The issue patch matches reviewed commit 58bedf853bc253dc0cc30e73b4eda14c045789b4. The shared metadata file contains both the approved Phase 1 slice 11: Complete the OpenShell CLI consumer sweep #9813 comment and the reviewed private-revision boundary. No command, option, diagnostic, lifecycle, or other documented user behavior changes.
• Independent validation: focused CLI tests passed, 3 files and 70 tests; npm run typecheck:cli passed; git diff --check passed.
• Blockers: none
• Suggestions: none
• Agent: Codex Desktop documentation writer (docs_review_9806_onboarding)

---

Signed-off-by: Rebecca Sliter 571084+rsliter@users.noreply.github.com

Summary by CodeRabbit

• Bug Fixes
  • Improved inference-set provider setup, updates, and rollback reliability.
  • Added validation to prevent use of incomplete or ambiguous provider information.
  • Improved provider diagnostics and failure messages, including clearer authentication and availability errors.
  • Increased command-output limits to 64 KiB to prevent failures when listing providers or handling profiles.
  • Improved detection of provider changes and stale configuration during setup.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 472f3431-0792-4869-872e-67f47c1a5cfd

📥 Commits

Reviewing files that changed from the base of the PR and between 58bedf8 and 3e37598.

📒 Files selected for processing (1)

• src/lib/onboard/gateway-provider-metadata.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src/lib/onboard/gateway-provider-metadata.ts

Included review availability: Your plan provides up to 12 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

Inference-set provider management now uses an asynchronous OpenShell adapter. Provider metadata includes validated revision information. Diagnostics and mutations await structured adapter results. CLI commands use a 64 KiB output limit.

Changes

OpenShell provider flow

Layer / File(s)	Summary
Provider metadata and adapter contracts src/lib/adapters/openshell/*, src/lib/onboard/gateway-provider-metadata.ts, src/commands/credentials.test.ts, test/package-contract/cli/credentials-cli-command.test.ts, ci/source-architecture-budget.json	Provider metadata now parses validated revision identifiers and resource versions. Provider listing and profile reconciliation use a 64 KiB output limit. Related command expectations and the architecture budget were updated.
Asynchronous provider binding and rollback src/lib/actions/inference-set-provider.ts, src/lib/actions/inference-set-provider.test.ts, src/lib/actions/inference-set-no-auth-compatible.test.ts	Provider inspection, ownership checks, binding preparation, commit, rollback, and post-mutation validation now use OpenShellProviderAdapter asynchronously. Tests cover revision validation, identity drift, authentication failures, and incomplete provider identity.
Inference-set integration and diagnostics src/lib/actions/inference-set.ts, src/lib/actions/inference-set-provider-diagnostics.ts, src/lib/actions/*test.ts, src/lib/actions/inference-set.test-support.ts	Inference-set execution awaits provider operations and failure construction. Diagnostics query providers through the adapter and handle structured success, timeout, command failure, and thrown-error results. Test dependencies expose the adapter.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: ⚪ Minimal · up to 3e375

The change routes inference provider lifecycle operations through the typed adapter while preserving credential handling, redaction, and rollback behavior. No actionable merge-blocking risk remains after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant InferenceSet
  participant ProviderAdapter
  participant OpenShell
  InferenceSet->>ProviderAdapter: inspect provider
  ProviderAdapter->>OpenShell: get provider metadata
  OpenShell-->>ProviderAdapter: return metadata and revision
  InferenceSet->>ProviderAdapter: prepare and commit binding
  ProviderAdapter->>OpenShell: create or update provider
  OpenShell-->>ProviderAdapter: return mutation result
  InferenceSet->>ProviderAdapter: query registered providers on failure
  ProviderAdapter->>OpenShell: list providers
  OpenShell-->>ProviderAdapter: return provider inventory

Loading

Possibly related PRs

• NVIDIA/NemoClaw#10149: Both PRs modify the OpenShell provider adapter and inference-set integration.

Suggested labels: refactor, area: cli, area: providers

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 13.04% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 23 functions across 15 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: routing inference provider lifecycle operations through the OpenShell provider adapter.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/openshell-provider-inference-adapter

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit 3e37598 in the codex/openshell-prov... branch remains at 96%, unchanged from commit 9322588 in the codex/openshell-prov... branch.

TypeScript / code-coverage/cli

The overall line coverage in commit 3e37598 in the codex/openshell-prov... branch remains at 84%, unchanged from commit 341283d in the codex/openshell-prov... branch.

Show a line coverage summary of the most impacted files.

File	codex/openshell-prov... 341283d	codex/openshell-prov... 3e37598	+/-
src/lib/onboard...ostic-parser.ts	93%	0%	-93%
nemoclaw/src/bl...ate-networks.ts	64%	11%	-53%
src/lib/actions...sandbox/logs.ts	95%	80%	-15%
src/lib/onboard...le-lifecycle.ts	81%	75%	-6%
src/lib/sandbox...vileged-exec.ts	75%	89%	+14%
src/lib/onboard...ce-lifecycle.ts	82%	96%	+14%
src/lib/actions...dentials-add.ts	62%	82%	+20%
src/lib/adapter...agnostic-cli.ts	0%	94%	+94%
src/lib/adapter...-adapter-cli.ts	0%	97%	+97%
src/lib/adapter...metadata-cli.ts	0%	100%	+100%

---

_{Updated September 01, 2026 00:59 UTC}

[rsliter]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[rsliter]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[rsliter]

Closing this draft so the inference migration can be rebuilt cleanly on #10895.

Compatibility assessment is bound to these exact commits:

• Replacement foundation refactor(messaging): route provider preparation through adapter #10895: d0f93d66792e7c4198165dd6971e480a20909205
• This PR: 3e37598e05be83e52d7397abf873ffe605a3bf87
• Obsolete refactor(onboard): route provider publication through adapter #10719 base: 910c4ea1705d5240d4c5415e65cd07b12e8751be

This PR is not compatible as written because it still targets the closed #10719 branch and its pre-squash history. I replayed its two unique inference commits onto the exact #10895 head. The core inference consumer changes mostly applied, but the replay conflicted in the shared provider adapter, provider metadata parser, inference diagnostics, test support, and adapter tests.

The contracts also diverged. #10895 uses a common mutation result, while this draft expects state-valued create, update, delete, import, and detach results. This draft additionally introduces provider revision metadata and endpointless-profile behavior that must be reconciled deliberately with the new adapter boundary.

The fresh implementation should:

• branch from the stable refactor(messaging): route provider preparation through adapter #10895 head, or from main after refactor(messaging): route provider preparation through adapter #10895 merges;
• port the inference behavior, not this branch history;
• preserve the accepted inference scope from Phase 1 slice 5: Route providers and credentials through the OpenShell adapter #9806;
• add revision metadata only where inference ownership and settlement decisions consume it;
• adapt inference inspection, mutation, rollback, diagnostics, and tests to the refactor(messaging): route provider preparation through adapter #10895 result contract;
• keep raw openshell inference set route transport outside this slice under Phase 1 slice 6: Route inference configuration through the OpenShell adapter #9809;
• run focused inference and adapter tests, npm run typecheck:cli, npm run validate:pr, and npm run review:local before publication, treating missing review artifacts as unavailable evidence;
• inspect every GitHub Advisor artifact at the stable exact head.

The branch is being preserved as reference material. It should not be merged or cherry-picked wholesale.