chore(onboard): apply pinned Oxfmt formatting - #11492
Merged
Merged
Conversation
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe change reformats one diagnostic slice calculation and one GPU probe error assertion. Runtime behavior and test expectations remain unchanged. ChangesDocker runtime formatting
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
cv
marked this pull request as ready for review
September 10, 2026 23:10
This was referenced Sep 10, 2026
cv
added a commit
that referenced
this pull request
Sep 10, 2026
<!-- markdownlint-disable MD041 --> ## Outcome Configuration export supports the native Linux/Docker OpenClaw route through an attached Ollama daemon and a separate NemoClaw authentication proxy. The document retains distinct observed ports, lifecycle ownership and the verified `qwen3.5:9b` model digest. Incomplete or changing evidence prevents publication. ## Reason Recreating this route requires both listeners and their forwarding relationship. Retained files alone cannot establish the running proxy's destination. ### Related issues Fixes #11435. Part of #10904. The [accepted scope](#11435 (comment)) places this capability in core CLI configuration and the shared export domain, owned by cv. ## Changes - Add an authenticated, bounded `GET /_nemoclaw/proxy-config` read to the existing proxy. The export observer uses its listener, PID and backend origin to verify the active route. Handler tests protect authentication, method rejection and response limits. - Keep token access and read-only observation in the existing proxy owner. Verify process, route and model agreement through the shared export pipeline. Tests protect token custody, retained state, rejected observations and absent publication. - Add a closed Ollama serving branch that distinguishes the external daemon from the managed proxy. Preserve existing hosted v1 documents, managed vLLM behavior, and main's shared OpenClaw/Hermes interface inspection. - Extend the existing GPU qualification with onboarding, separate ports, repeated exports, live model/image agreement, stopped-daemon refusal and terminal cleanup. Its helper maps to the existing GPU target. Reuse schema validation and substantive runtime outcomes to keep the assertion budget below main's baseline. - Reuse the existing adapter fixture owner for passive provider data and the shared refusal assertion for failure category and publication checks. Preserve dashboard and direct-tool observations. ## Verification Candidate `341ca2897c5241441742d2424632b1f53a467094`, tree `d4867a054d80e20dc6f34b0204f7024836095624`, integrates main `dab48f58c094d78c017458f4d72d6f5ca217578c`. - Fresh `npm run build:cli` and five focused config, adapter, document-builder, export-verifier and Hermes-interface suites pass: 526 cases. The unchanged plugin build is reused. - Canonical `npm run validate:pr` returns exit 1 only for the previously recorded missing `startAttachedOllama` progress-owner row in the canonical validator. The candidate contains its reviewed row. All other hooks, the no-growth guard, explicit commitlint and pre-push pass. - Validation used an isolated environment without credentials or network. Both canonical helper overlays and all 43 audited executable identities were retained, with no source drift. The diff contains no real secrets, API keys or credentials. Credential tests use synthetic canaries. Broad validation and managed Ollama qualification remain with GitHub; no local live result is claimed. ## Review notes Independent review of this merge found no actionable issue in the combined schema, shared interface/serving verification, document construction or adapter fixtures. It preserves both parents' assertions and the maintainer's reduced budget. Earlier sensitive-path reviews of NVIDIA/NemoClaw cover `scripts/ollama-auth-proxy.mts`, `src/lib/inference/README.md`, `src/lib/inference/ollama/proxy-observation.ts`, its co-located test, `src/lib/inference/ollama/proxy.ts`, `tools/e2e/check-semantic-phases.mts` and `tools/e2e/target-catalogue.mts`. They address authentication, token custody and cleanup. Their Ollama production behavior is unchanged by this merge. CodeRabbit withdrew the hosted-label reservation after reviewing the existing v1 contract. Fixed qualification ports remain fixture values; export retains valid observed ports. The unused-result finding is addressed. The earlier formatter failure came from main's Docker-bootstrap files and is corrected by merged #11492. Current automated review and GitHub checks remain pending; a paused or skipped review is not claimed as completed. --- Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for externally managed local Ollama inference using the fixed `qwen3.5:9b` model. * Configuration exports now detect and include verified Ollama daemon and proxy serving details. * Added validation for Ollama ports, model identity, runtime topology, credentials, and endpoint configuration. * Added configurable OpenClaw tool disclosure modes. * Added an authenticated proxy configuration endpoint that reports connection metadata without exposing credentials. * **Documentation** * Added guidance for configuring Ollama exports, proxy ownership, authentication, validation, and lifecycle requirements. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com> Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com> Co-authored-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>
cv
added a commit
that referenced
this pull request
Sep 11, 2026
<!-- markdownlint-disable MD041 --> ## Outcome Local hooks select affected repository checks and reuse successful compiler validation when its inputs still match. Publication validation checks formatting without changing the committed candidate. ## Reason A source edit previously started all 19 repository checks. Explicit publication validation repeated compiler work in the subsequent push hook. Shared-boundary builds and the always-run growth gate also repeated work. ## Changes - Add input selectors and per-check timing to the existing repository runner. Include deleted and renamed paths, and invalidate every selector when checker code or shared configuration changes. `checks-runner.test.ts` and `validation-reuse.test.ts` cover selection and failure propagation. - Share compiler results between `validate:pr` and installed push hooks. Reuse requires a clean tree and matching source, commits, dependencies, executables, environment, and required outputs. Missing or stale evidence runs the compiler. Git/npm invocation metadata is normalized before execution and hashing. `validation-reuse.test.ts` covers reuse, invalidation, failed checks, external loaders, ignored source, and build artifacts. File reads verify one open descriptor and reject concurrent changes. The hook entry point accepts only the three compiler checks. Each source is hashed once per fingerprint. Repository checks and Windows npm/npx commands run through Node with literal arguments; command-resolution failures return a failed check. - Derive read-only publication commands from the existing hook configuration. Existing whitespace fixers run on disposable copies; formatters and generators use check mode. This preserves one hook configuration. Unknown or renamed hooks must have their read-only behavior classified before execution. `publication-validation.test.ts` covers all nine fixer conversions, the actual repository configuration handoff, rejected formatting, dirty trees, command failures, and cleanup. - Use TypeScript build mode for the shared policy boundary and separate incremental caches for plugin production/tests. `policy-boundary-build.test.ts` verifies deleted-output recovery and rejection of new type errors. - Keep seven current-diff growth assertions in the always-run gate. Move the 38 parser/diagnostic tests to a separate file in the same integration project. Update contributor and agent guidance in this PR. ## Verification Latest GitHub evaluation for `66c84488d487c3193e59c72ec9bc89384974eec3` is **failing, with jobs still pending**. [PR CI](https://github.com/NVIDIA/NemoClaw/actions/runs/34546936230) tested merge `ff13d6b7305b5d584c6f0d1ba0db25e2cee162b3` with newer main `f6dd9aebc535858cc94d1c72c5df1167b44cb86e`. Static checks, type-checking, and shard 12 fail on missing imports in `src/lib/adapters/config/live-export-source.test.ts`; that file is identical to main, whose [own type-check job reproduces the same four errors](https://github.com/NVIDIA/NemoClaw/actions/runs/34546739879/job/103102263064). Shard 3 also timed out in unchanged onboarding coverage; its four focused tests pass on both the candidate and original implementation base, so that timeout remains unclassified. No CI waiver or manual rerun is claimed. CodeRabbit completed the latest review without actionable code findings. Advisor requires green CI and has not reviewed this repair; CodeQL and remaining checks are still pending. - Focused implementation suite: **130 tests passed** across the repository runner, cache, publication validator, policy build, and both growth-guardrail files. - `npm run validate:pr`: passed on the recorded signed candidate with a clean tree before and after validation. - Merged `main` at `dab48f58c094d78c017458f4d72d6f5ca217578c`, including formatting fix #11492. Pinned Oxfmt checks now pass on both Docker bootstrap files that failed the previous CI run. - Installed Git pre-push hook against a disposable local bare repository: passed; all three compiler receipts retained their input/output hashes and modification times, proving that the installed hook reused them. - `npm run check`: repository-wide pre-commit and plugin coverage passed; the CLI/integration run had 35,354 passing tests and 259 failures in 31 existing files. Replaying those 31 files on unchanged implementation base `aeab35b84c75c968b0b9b4e03f63ed2e6591ae00` reproduced the same 259 failures, with identical failure headers. These are inherited failures in this isolated environment, including unavailable Docker access and checkout-authority constraints. No candidate-only failure was found in that comparison. The broad run preceded the final cache refinements; all focused tests and the publication gate were rerun afterward. - Canonical-base repository runner: all 19 checks passed. Canonical-base compiler commands (`npm run typecheck:cli`, `npm --prefix nemoclaw run typecheck`, and `npx tsc -p jsconfig.json`) passed against the candidate sources. - Local selection sample: all 19 repository checks took **24.2 s**; the nine selected for `src/commands/sandbox/status.ts` took **17.0 s**. The initial compiler-hook run took about **23 s**. The final installed-hook replay reused all three results and took **8.4 s**, including Git transfer. These are local observations, not CI timing guarantees. - The reviewed diff contains no secrets, API keys, or credentials; the hook secret scan passed. <details> <summary>Focused test command</summary> ```sh npx vitest run --project integration \ test/repository/checks-runner.test.ts \ test/repository/validation-reuse.test.ts \ test/repository/publication-validation.test.ts \ test/repository/policy-boundary-build.test.ts \ test/automation/pull-requests/growth-guardrail-parsers.test.ts \ test/automation/pull-requests/growth-guardrails.test.ts ``` </details> ## Review notes Repository: `NVIDIA/NemoClaw`. Candidate: `66c84488d487c3193e59c72ec9bc89384974eec3`. Canonical comparison: `05796cf4e47b717aa80b2d9c603946e0ec5aad0b`. The sensitive paths are `AGENTS.md`, `.pre-commit-config.yaml`, the contributor PR skill, and the six changed files under `scripts/checks/`. Self-review covered the complete diff, input selection, cache invalidation, mutation/failure paths, and the installed-hook boundary. On reviewed head `0f162bc5fc2a26c03ce972579f3a2ce8e7d630c1`, [required CI](https://github.com/NVIDIA/NemoClaw/actions/runs/34543003214) and CodeQL passed. CodeRabbit completed review 5173586863, and all nine [Advisor specialist reviews](https://github.com/NVIDIA/NemoClaw/actions/runs/34544101019) were read. This repair addresses duplicate source hashing, missing conversion coverage, unclassified hooks, Windows command launching, and shared Vitest configuration selection. The new repair and sensitive paths await their next independent review. Maintainer `cv` marked the PR ready on September 10; this update preserves that state. The reviewed head also had two optional [managed-image runtime failures](https://github.com/NVIDIA/NemoClaw/actions/runs/34543003335): MCP discovery pass 2 rejected stored-credential reuse (pass 1 succeeded), and Hermes activation entered sandbox Error before Ready. Runtime and workflow sources are unchanged from the integrated main. Their root causes remain unclassified; there is no demonstrated cause in these validation changes. No manual rerun, runtime repair, CI waiver, or merge approval is claimed. Advisor's command-deadline and broader candidate-execution trust proposals concern inherited behavior; this PR preserves the external trusted-validation gate. Its separate unknown-hook read-only gap is fixed. Local hook-equivalent checks ran in isolation; signing and upload use Git objects on the contributor host. The user requested publication and explicitly selected all five improvements. Because the candidate changes validation code, candidate commands ran in an isolated Linux ARM64 Docker checkout with networking disabled, read-only installed dependencies, and no contributor-host credentials. The canonical runner was mounted separately for its check; canonical manifests supplied the original compiler commands while TypeScript checked candidate source. The canonical validator files are unchanged between the recorded base and the previously inspected `fd98dc2aeb3a37579efbf005a0e2195f7bf20a03`. Validator identity: Node 25.9.0 (`SHA-256 6ddc7eec8c425db60c217241e2c9207eb299a17c227b9494655b18bb5da5a2e1`), installed TypeScript compiler (`1c59e77a54b186ec43fa7f3e0d3c4bb15ca5eb5ba43e96b1d3a267139eddd3e3`), and tsx entry point (`8729ecfb90d9d568939e4190e6f1d3317c946583b7d37a776e0c23a21c021cf8`). Root and plugin lockfiles are unchanged. Local result reuse does not replace the trusted-validation gate, independent review, CI, or publication authorization. --- Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added streamlined pull request validation with clean-worktree checks, read-only formatting verification, generated-file validation, and mutation detection. * Added changed-file-based check selection, timing reports, and safe reuse of successful compiler checks when inputs remain unchanged. * Improved incremental TypeScript checking and platform-safe validation command execution. * **Documentation** * Updated contributor and repository guidance for validation, formatting, compiler-check reuse, and Git hooks. * **Tests** * Expanded coverage for validation, caching, check selection, policy builds, formatting checks, and growth guardrails. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outcome
Apply the repository-pinned Oxfmt formatting to Docker managed-bootstrap code and its test so CI does not need to rewrite those files.
Reason
The formatter hook group modified tracked files in main static-checks job 103080855383, causing the job to fail.
Changes
Verification
npm run validate:prwere skipped at the maintainer's explicit request in the task. CI remains required.8497658d4c0273f017dc9241c729ba3157b1d206Verified.Review notes
Self-reviewed NVIDIA/NemoClaw commit
8497658d4c0273f017dc9241c729ba3157b1d206, including sensitive pathssrc/lib/onboard/managed-bootstrap/docker-runtime.tsandsrc/lib/onboard/managed-bootstrap/docker-runtime.test.ts. The complete diff changes formatting only. No independent pre-publication review exists; both paths await independent review. This PR is a draft.Signed-off-by: Carlos Villela cvillela@nvidia.com
Summary by CodeRabbit