test(e2e): assert Ollama recovery outcomes - #11013
Conversation
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> # Conflicts: # ci/e2e-assertion-budget.json
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review. 📝 WalkthroughWalkthroughThe GPU recovery test removes two stale Ollama output assertions, retains execution and model-state checks, updates its description, and aligns assertion-budget metrics. ChangesGPU E2E assertion alignment
Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to GPU recovery testing now relies on successful recovery execution and model-state outcomes rather than obsolete Ollama output text. No current merge-blocking risk is established. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall line coverage in commit 5bed9e7 in the TypeScript / code-coverage/cliThe overall line coverage in commit 5bed9e7 in the Show a line coverage summary of the most impacted files.
Updated |
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
|
PR Review Advisor finished for commit |
<!-- markdownlint-disable MD041 --> ## Outcome `nemoclaw <sandbox> mcp status <server> --tools` now exits nonzero when live MCP initialization or tool discovery is unsuccessful, while preserving ordinary status and bounded failure context. Successful discovery remains exit zero. ## Reason #10944 requires connection and authentication failures to be verification failures. Previously, a discovery runtime could exit zero with `ok: false` and the NemoClaw command would still report success. ### Related issues Refs #10944 Part of #10942 ## Changes - Adds a versioned discovery result contract with the sandbox runtime exit status, failed stage, and bounded failure class. The `--tools` status consumer needs this distinction because the existing Boolean result could not separate runtime, connection, authentication, protocol, and tool-operation failures; focused host/runtime tests protect the contract. - Maps refusal, DNS, TLS, timeout, HTTP 401/403, protocol, and tool-operation failures to credential-safe results. Existing best-effort session cleanup remains in place, with deterministic interruption, cleanup, and redaction coverage. - Makes only explicit `mcp status <server> --tools` verification fail the NemoClaw process on an unsuccessful result. Ordinary MCP status and list behavior remain unchanged, and the owning documentation describes the exit and recovery contract. - Extends the existing MCP bridge live target to record the exact candidate, NemoClaw, OpenShell, Hermes, host and sandbox operating systems, and container runtime for Hermes, then prove both successful authenticated discovery and denied authentication in the existing OpenClaw exact-PR lane and Hermes shard. The fixture credential is restored in `finally`; no new target, workflow, or retry behavior is added. - Rejects incomplete but parseable live status JSON before retry or diagnostic creation, so invalid evidence produces the existing labeled validation failure. - Updates the managed-image runtime probe, reviewed bundle digest, publication contract tests, and the exact E2E assertion census for protocol version 2. - Completes exact managed-image protocol-shape checks, clarifies runtime-emitted and bridge-level `commandStatus` values, and uses stage-neutral redacted request details, and refreshes the owning Dockerfile instruction digest. - Normalizes the SDK's typed `RequestTimeout` error at the standalone runtime boundary. Arbitrary endpoint error text containing timeout-like words remains a redacted tool-operation failure instead of being misclassified as a local connection timeout. - Restores exact live assertions for successful discovery and denied authentication, including result status, tool count and names, truncation, failed stage, failure class, and runtime command status. - Preserves the documented trust boundary for endpoint-supplied MCP tool names. This PR does not add tool-name redaction or a new security contract. ## Verification - `npm run validate:pr` — passed for candidate `fa636a6f1b820503070a91f4fb51fcc7b0c486ee` against canonical base `b0d4650c6cc506c2a07ddf4c909035378a0626c7` in a fresh native ARM64 Node 22.23.1 container without contributor-host credentials, using checksum-verified Hadolint 2.14.0 and the base-pinned Markdownlint 0.22.0 hook. - `npx vitest run --project cli src/lib/actions/sandbox/mcp-tool-discovery-runtime.test.ts` — 33 tests passed; a direct Node import also confirmed the shared core no longer requires the nested SDK package. - `npx vitest run --project cli src/lib/actions/sandbox/mcp-bridge-tool-discovery.test.ts src/lib/actions/sandbox/mcp-tool-discovery-runtime.test.ts` — 53 tests passed. - `npx vitest run --project cli src/lib/actions/sandbox/mcp-bridge-status-resolution.test.ts -t '#10944'` — 2 tests passed. - `npx vitest run --project e2e-support test/e2e/support/mcp-bridge-tool-discovery.test.ts` — 51 tests passed, including incomplete and malformed output without retry or artifact writes. - `npx vitest run --project integration test/mcp/mcp-tool-discovery-image-contract.test.ts test/inference/managed/managed-image-publication-workflow.test.ts --testTimeout=30000` — 55 tests passed. - `npx vitest run --project integration test/networking/dashboard-remote-bind-lifecycle.test.ts` — 27 tests passed. - `npx vitest run --project integration test/repository/vitest-watch-triggers.test.ts` — 73 tests passed. - `npm --prefix tools/mcp-tool-discovery-runtime test`, `npm --prefix tools/mcp-tool-discovery-runtime run typecheck`, and `npm --prefix tools/mcp-tool-discovery-runtime run bundle:reviewed:check` — passed. - `npm run e2e:assertions:check`, `npm run test-size:check`, `npm run source-shape:check`, `npm run test:e2e-phases:check`, `npm run checks:repository`, and `npm run typecheck:cli` — passed. - `npm run docs` — passed with no errors and the five existing warnings. - [`mcp-bridge` exact-PR run 33945212794](https://github.com/NVIDIA/NemoClaw/actions/runs/33945212794) exercised candidate `a5a552e274322201ff4336db64ae2228707e790d`. OpenClaw and Deep Agents Code passed, and the Hermes lane passed the new authenticated discovery, denied HTTP 401 classification, version capture, credential restoration, artifact credential scan, and cleanup assertions. Later candidates integrate the current base and apply deterministic review corrections to the redacted detail wording and managed-image protocol probe. The live network interaction, failure classification, cleanup, credential restoration, and scenario remain unchanged. - That run later failed in the unchanged Hermes restart-without-host-secret lifecycle. The same failure independently occurred in unrelated PR #11013 on the same base while its MCP bridge owner paths were unchanged. All 11 registered cleanup operations passed, the artifact credential scan passed, and no resource or credential cleanup remains. - The existing maintainer-dispatched `mcp-bridge` matrix supplied the Hermes evidence. This change does not add a second automatic PR lane or redesign CI. - The diff contains no secrets, API keys, or credentials. ## Review notes - Sensitive paths in `NVIDIA/NemoClaw` are `.github/workflows/managed-images.yaml`, `agents/hermes/Dockerfile`, `agents/langchain-deepagents-code/Dockerfile`, `src/lib/onboard/dockerfile-remote-dashboard-bind-contract.ts`, and `tools/mcp-tool-discovery-runtime/**`. - CodeRabbit reviewed the implementation through `e69b1ee`; `532e269` addressed its last valid finding, and all seven review threads are resolved. The complete PR Review Advisor rerun for `5bb7463` succeeded with all nine specialist artifacts. Candidate `6d9ffcdb` addressed the two maintainer findings and integrated canonical main. Candidate `62710c6` exposed that the first package-boundary repair still left the SDK adapter inside root CLI type-checking. Candidate `fa636a6` moves typed SDK timeout normalization into the standalone entrypoint, keeps the shared core package-neutral, and passes root type-checking. Exact-head automated evaluation has restarted. - This review context does not claim approval or a CI waiver. --- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * MCP tool discovery now reports protocol version 2 results with command status, failure stage, failure classification, and sanitized diagnostics. * Discovery failures return a nonzero command status while preserving server status information. * Added MCP denied-tool updates with replacement, clearing, journaling, rollback, and recovery handling. * Discovery responses now enforce a complete, consistent result shape. * **Bug Fixes** * Improved handling of unavailable runtimes, invalid credentials, startup failures, and interrupted responses. * MCP policy status now surfaces drifted or interrupted updates. * **Documentation** * Updated MCP command and sandbox documentation for discovery status, denied-tool management, and recovery behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Outcome
The Ollama recovery E2E test now verifies the daemon restart, the unloaded model state, a successful agent turn, and the reloaded model state. It no longer requires a stale progress sentence that the product does not emit.
Reason
The recovery flow still proves its behavior through stable state and outcome assertions, but the obsolete prose assertion caused the live test to fail after successful recovery.
Related issues
Fixes #10973
Changes
Checking Ollama model readiness after daemon restart.Verification
npx vitest run --project e2e-support test/e2e/support/gpu-e2e-helpers.test.ts— 37 tests passed.npx tsx scripts/checks/e2e-mock-parity.mts --base origin/main --head HEAD— passed.npm run e2e:assertions:check— passed with 1,887 direct expect calls across 86 test files.npm run test:e2e-phases:check— passed with 132 tests across 88 files.npx vitest run --project integration test/automation/pull-requests/growth-guardrails.test.ts— 45 tests passed.Review notes
This change uses the existing GPU E2E flow and its mapped support test. It does not add a test harness. The removed text was incidental progress output; the retained assertions cover the recovery behavior. This change does not alter a security boundary or user-visible behavior, so no documentation change is needed.
Signed-off-by: Apurv Kumaria akumaria@nvidia.com
Summary by CodeRabbit