docs: clarify retired rcf patch validation

[chengjiew]

Summary

• clarify that scripts/rcf_patch.py is intentionally absent from current blueprints
• replace the stale Patch-4 fail-closed QA expectation with the current mutable-default / shields-up validation path
• add regression coverage so troubleshooting keeps pointing QA at the supported checks

Root Cause

Patch 4 was intentionally deleted by #3500 after NemoClaw moved away from the build-time replaceConfigFile monkey-patch. The issue reproduces because the old QA test plan still expects scripts/rcf_patch.py to exist even though the supported behavior is now the mutable-default config model plus shields-up lockdown.

Closes #3944

Verification

• test ! -f scripts/rcf_patch.py && test ! -f nemoclaw-blueprint/scripts/rcf_patch.py
• ./node_modules/.bin/vitest run test/rcf-patch-removal.test.ts test/repro-2681-group-writable.test.ts test/sandbox-build-context.test.ts
• npm run build:cli
• npm run docs:strict
• bash -n test/e2e/test-shields-config.sh

Signed-off-by: Chengjie Wang chengjiew@nvidia.com

Summary by CodeRabbit

• Documentation

  • Enhanced troubleshooting guide clarifying current sandbox configuration lifecycle, deprecated test behavior, and updated validation instructions for shields/config checks.

• Tests

  • Added automated test to verify removal of the retired patch script from blueprints and repo locations to prevent regressions in setup and validation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b4f5a9cd-eedd-4307-a452-d67f62a8f3fb

📥 Commits

Reviewing files that changed from the base of the PR and between ce3a206 and 223fb22.

📒 Files selected for processing (1)

• test/rcf-patch-removal.test.ts

---

📝 Walkthrough

Walkthrough

Documentation explains that scripts/rcf_patch.py is intentionally absent from current NemoClaw blueprints, clarifies obsolete Patch-4 expectations and config-lockdown timing, and points to shields/config lifecycle tests; a new Vitest test fails if rcf_patch.py exists in the expected blueprint locations.

Changes

rcf_patch.py Removal Documentation and Enforcement

Layer / File(s)	Summary
Troubleshooting documentation for rcf_patch.py retirement docs/reference/troubleshooting.mdx	New troubleshooting subsection states scripts/rcf_patch.py is intentionally absent from current blueprints, notes Patch-4 Dockerfile test expectations no longer apply, explains runtime config mutability and when lockdown occurs, and directs users to shields/config lifecycle tests.
Test enforcement for rcf_patch.py absence test/rcf-patch-removal.test.ts	New Vitest test asserts scripts/rcf_patch.py is not present in top-level scripts/ and nemoclaw-blueprint/scripts/ and fails if either file exists.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested labels

fix

Suggested reviewers

• ericksoa
• cv

Poem

I hopped through docs and tests today,
Searched for a script that's gone away.
No phantom patch in blueprint lair,
Tests will guard what docs declare.
Hooray — the sandbox stays tidy! 🐰

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'docs: clarify retired rcf patch validation' accurately reflects the PR's primary objective of updating documentation to clarify the absence of rcf_patch.py and pointing to current validation mechanisms.
Linked Issues check	✅ Passed	The PR addresses issue #3944 by updating docs to explain rcf_patch.py absence and adding a test (test/rcf-patch-removal.test.ts) that verifies the script's intentional removal, fulfilling the requirement to either restore the patch or update docs/tests.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to resolving issue #3944: documentation clarification about the retired rcf_patch.py script and a regression test to validate its absence.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/3944_rcf-patch-docs

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint skipped: no ESLint configuration detected in root package.json. To enable, add eslint to devDependencies.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4202.docs.buildwithfern.com/nemoclaw

[github-actions]

E2E Advisor Recommendation

Required E2E: None
Optional E2E: None

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• None. No E2E is recommended because this PR only updates troubleshooting documentation and adds a tests-only assertion for removal of a retired helper. It does not modify NemoClaw runtime code, blueprints, installer/onboarding logic, sandbox lifecycle, credentials, security enforcement, network policy, inference routing, deployment, or assistant user flows.

Optional E2E

• None.

New E2E recommendations

• None.

[github-actions]

E2E Scenario Advisor Recommendation

Required scenario E2E: None
Optional scenario E2E: None

Workflow run

Full scenario advisor summary

E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required scenario E2E

• None. No scenario workflow, scenario metadata, scenario runtime, or validation-suite files changed.

Optional scenario E2E

• None.

Relevant changed files

• None.

[github-actions]

PR Review Advisor

Findings: 0 needs attention, 0 worth checking, 0 nice ideas
Since last review: 0 prior items resolved, 0 still apply, 0 new items found

Workflow run details

This is an automated advisory review. A human maintainer must make the final merge decision.

[wscurran]

✨
Related open PRs:

• #3500 fix(dockerfile): drop Patch 4 entirely

---

Related open issues:

• #3944 [Nemoclaw][All Platforms][Sandbox] rcf_patch.py missing in NemoClaw blueprint (cannot exercise replaceConfigFile EACCES fail-close test)