feat(config): export fixed managed vLLM serving profile

[cv]

Outcome

nemoclaw config export can represent the fixed managed Linux amd64 Lightning vLLM deployment, including its current catalog, model and image identity, required context window and observed host port. Unsupported recipes, missing ownership evidence and runtime drift still prevent export.

Reason

Existing managed serving deployments cannot currently export their desired configuration. This slice adds one bounded recipe while preserving the private runtime credential boundary.

Related issues

Refs #10904. This PR stacks on codex/config-export-brave for its resolved provider-profile reader.

Changes

• Add a strict managed-serving provider representation and preserve the recipe-required context window of 65536.
• Verify retained provenance against the current catalog, bounded Docker observations and the existing private authentication owner before constructing public output.
• Require the exact OpenAI provider attachment and stable source snapshots. Exported YAML omits generated credentials, internal route URLs and private paths.
• Reuse the fixed model command materializer for installation and observation. Runtime drift, authority failures and Docker formatter behavior have focused regression coverage.

Verification

• Focused CLI, SDK and Docker formatter tests: 454 tests across 11 files passed after rebasing onto the completed Brave branch and merged SDK policy implementation.
• npm run build:cli — passed.
• NODE_OPTIONS=--max-old-space-size=5120 npm run typecheck:cli — passed.
• NODE_OPTIONS=--max-old-space-size=5120 npm run validate:pr — passed in an isolated ARM container with canonical dependencies and validators, no contributor-host credentials, and networking disabled; source tree remained clean.
• The diff contains no secrets, API keys or credentials. Test credential canaries are synthetic.

Review notes

This draft depends on the Brave provider-profile reader. Its isolated feature diff is reviewed against that branch; merge the dependency first.

Sensitive paths are src/lib/inference/config.ts and the changed files under src/lib/inference/serving/. The coordinator reviewed the rebased NVIDIA/NemoClaw candidate a6c2ab9 against the preserved implementation and peer-review evidence, including the private credential owner, bounded Docker observation, fixed catalog identity and refusal of stale or foreign resources. No remaining local finding is recorded. The Brave dependency also changes the sensitive tools/e2e/target-catalogue.mts ownership metadata; its local self-review at 58afee35457257226879e3991a2d17eb97884c86 found no remaining issue and is recorded in that PR. Independent PR review is still required; no approval or CI waiver is claimed.

Real qualification on the exact Linux amd64 GPU profile remains required. Local Docker formatter tests use a disposable fake Docker API and do not prove model startup or successful routed inference. The reviewed GPU runner fixture is retained separately while the canonical assertion-growth guard rejects its budget increase.

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4f715346-9351-4808-b424-fd89ad7c939a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit a6c2ab9 in the codex/config-export-... branch remains at 96%, unchanged from commit edfa1e7 in the codex/config-export-... branch.

TypeScript / code-coverage/cli

The overall line coverage in commit a6c2ab9 in the codex/config-export-... branch remains at 83%, unchanged from commit edfa1e7 in the codex/config-export-... branch.

Show a line coverage summary of the most impacted files.

File	codex/config-export-... edfa1e7	codex/config-export-... a6c2ab9	+/-
src/lib/inference/config.ts	100%	99%	-1%
src/lib/onboard...uild-context.ts	75%	75%	0%
src/lib/inferen...lm-selection.ts	87%	87%	0%
src/lib/domain/...xport-source.ts	91%	92%	+1%
src/lib/inferen...al-lifecycle.ts	89%	90%	+1%
src/lib/adapter...xport-source.ts	93%	94%	+1%
src/lib/onboard...ess-identity.ts	90%	94%	+4%
src/lib/domain/...aged-serving.ts	0%	96%	+96%
src/lib/inferen...port-runtime.ts	0%	97%	+97%
src/lib/inferen...ial-contract.ts	0%	100%	+100%

---

_{Updated September 10, 2026 05:20 UTC}

[github-actions]

PR Review Advisor finished for commit a6c2ab9. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

All previous runs