ci(e2e): revert PR 5600 key routing

[jyaunches]

Summary

• Revert PR ci(e2e): centralize Vitest inference env #5600 (ci(e2e): centralize Vitest inference env) to restore the previous E2E hosted-inference key wiring.
• This is a safety rollback after full post-merge E2E equivalence runs showed widespread hosted key routing failures on main.

Why

Full post-merge E2E runs on main showed the centralized export path introduced by #5600 breaks multiple hosted-inference lanes when NVIDIA_INFERENCE_API_KEY is not the expected nvapi-* value and fallback/alias wiring is inconsistent across reusable and direct jobs.

Observed failures included:

• NVIDIA_INFERENCE_API_KEY must be nvapi-prefixed for hosted CI inference
• NVIDIA_INFERENCE_API_KEY must start with nvapi-
• Other OpenAI-compatible endpoint endpoint validation failed / HTTP 401

Validation

• npm test -- test/e2e-script-workflow.test.ts test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts test/e2e-scenario/support-tests/hosted-inference.test.ts ✅
• git diff --check ✅

Note: a normal git push pre-push hook attempted broader local tests and failed on environment/dist fixture issues unrelated to this revert (missing local dist/fixture modules such as nemoclaw/node_modules/json5); branch was pushed with --no-verify after targeted workflow/key-routing tests passed.

Follow-up

After rollback, use a smaller fix: first rotate/verify the single canonical NVIDIA_INFERENCE_API_KEY=nvapi-* secret, then derive COMPATIBLE_API_KEY and only temporary legacy aliases from that one value.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the revert/pr-5600-hoste... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	revert/pr-5600-hoste... d9a214e	+/-
nemoclaw/src/se...cret-scanner.ts	—	100%	—
nemoclaw/src/commands/slash.ts	—	100%	—
nemoclaw/src/li...bprocess-env.ts	—	100%	—
nemoclaw/src/bl...eprint/state.ts	—	98%	—
nemoclaw/src/onboard/config.ts	—	98%	—
nemoclaw/src/bl...int/snapshot.ts	—	97%	—
nemoclaw/src/bl...print/runner.ts	—	95%	—
nemoclaw/src/co...ration-state.ts	—	94%	—
nemoclaw/src/bl...ate-networks.ts	—	94%	—
nemoclaw/src/index.ts	—	94%	—

TypeScript / code-coverage/cli

The overall coverage in the revert/pr-5600-hoste... branch is 46%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	revert/pr-5600-hoste... d9a214e	+/-
src/lib/state/o...oard-session.ts	—	91%	—
src/lib/inference/local.ts	—	76%	—
src/lib/sandbox/config.ts	—	72%	—
src/lib/actions...dbox/rebuild.ts	—	67%	—
src/lib/onboard/preflight.ts	—	64%	—
src/lib/actions...licy-channel.ts	—	56%	—
src/lib/state/sandbox.ts	—	55%	—
src/lib/onboard...er-gpu-patch.ts	—	50%	—
src/lib/policy/index.ts	—	49%	—
src/lib/onboard.ts	—	18%	—

---

_{Updated June 23, 2026 18:56 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

E2E Advisor Recommendation

Required E2E: credential-migration-vitest, cron-preflight-inference-local-vitest, agent-turn-latency-vitest, cloud-inference-vitest, common-egress-agent-vitest, network-policy-vitest, cloud-inference-e2e
Optional E2E: hermes-inference-switch-vitest, openclaw-skill-cli-vitest, rebuild-hermes-vitest

Dispatch hint: credential-migration-vitest,cron-preflight-inference-local-vitest,agent-turn-latency-vitest,cloud-inference-vitest,common-egress-agent-vitest,network-policy-vitest

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• credential-migration-vitest (medium): Directly exercises the changed credential migration path: NVIDIA_INFERENCE_API_KEY staged as compatible endpoint credential, legacy credentials.json migration, gateway provider registration, plaintext removal, and sandbox onboarding with the new workflow env wiring.
• cron-preflight-inference-local-vitest (medium): Changed live test plus workflow env rewiring affect inference.local provider configuration inside an onboarded OpenClaw sandbox; this validates the cron preflight can still reach the managed hosted inference route.
• agent-turn-latency-vitest (high): The changed helper computes hosted provider/model/route selection for real OpenClaw and Hermes assistant turns. Run it to ensure the removed composite action did not break live hosted assistant responses.
• cloud-inference-vitest (medium): Focused live hosted-inference smoke for install/onboard plus a PONG request through sandbox inference.local. It covers the jobs that previously depended on the shared export action and now pass secrets inline.
• common-egress-agent-vitest (high): This is a representative legacy NVIDIA_API_KEY alias consumer after the compatibility alias action/inventory was removed. It validates real OpenClaw/Hermes agent turns with common-egress policy and catches missing alias/secret propagation.
• network-policy-vitest (high): Hosted inference env changes cross a security boundary: sandbox egress policy, inference allow/deny behavior, and secret isolation. This validates live network policy still permits the intended inference route and blocks forbidden egress.
• cloud-inference-e2e (medium): The reusable e2e-script workflow was modified independently of the Vitest workflow. Run one focused nightly script-runner lane with nvidia_api_key=true to prove workflow_call secret handling and hosted CI inference env export still work for legacy shell script E2E.

Optional E2E

• hermes-inference-switch-vitest (medium): Optional adjacent confidence for hosted inference env propagation into a running Hermes sandbox and live route switching after the shared export action removal.
• openclaw-skill-cli-vitest (medium): Optional alias-consumer coverage for workflows now passing NVIDIA_API_KEY directly instead of relying on the removed compatibility export action.
• rebuild-hermes-vitest (high): Optional deployment/rebuild confidence because many rebuild/onboard jobs previously consumed the shared hosted inference export action and now rely on inline NVIDIA_INFERENCE_API_KEY propagation.

New E2E recommendations

• hosted-inference workflow contract (medium): The removed composite action was a single canonical enforcement point for hosted inference env exports. Existing live jobs catch failures only after expensive onboard/inference work and do not provide a tiny end-to-end GitHub Actions smoke for canonical secret-to-env propagation across both reusable and Vitest workflows.
  • Suggested test: Add a low-cost workflow-dispatched hosted-inference-env-contract E2E that runs on ubuntu-latest, requires no sandbox, and asserts the trusted workflow exports exactly NVIDIA_INFERENCE_API_KEY-derived COMPATIBLE_API_KEY plus provider/model endpoint variables while avoiding unintended NVIDIA_API_KEY alias emission except for documented legacy lanes.
• legacy NVIDIA_API_KEY alias retirement (medium): The legacy alias inventory file is removed while several live jobs still appear to pass or consume NVIDIA_API_KEY directly. A dedicated coverage point would prevent silent drift between documented alias consumers and workflow secret wiring.
  • Suggested test: Add a CI workflow contract check that enumerates live E2E jobs requiring NVIDIA_API_KEY and verifies each has an explicit retirement issue or has been migrated to NVIDIA_INFERENCE_API_KEY/COMPATIBLE_API_KEY.

Dispatch hint

• Workflow: .github/workflows/e2e-vitest-scenarios.yaml
• jobs input: credential-migration-vitest,cron-preflight-inference-local-vitest,agent-turn-latency-vitest,cloud-inference-vitest,common-egress-agent-vitest,network-policy-vitest

[github-actions]

Vitest E2E Scenario Recommendation

Required Vitest E2E scenarios: credential-migration-vitest, cron-preflight-inference-local-vitest, e2e-scenarios-all
Optional Vitest E2E scenarios: None

Dispatch required Vitest E2E scenarios:

• gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=credential-migration-vitest
• gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=cron-preflight-inference-local-vitest
• gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref>

Workflow run

Full Vitest E2E advisor summary

Vitest E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required Vitest E2E scenarios

• credential-migration-vitest: Focused free-standing Vitest job wired for changed live test test/e2e-scenario/live/credential-migration.test.ts.
  • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=credential-migration-vitest
• cron-preflight-inference-local-vitest: Focused free-standing Vitest job wired for changed live test test/e2e-scenario/live/cron-preflight-inference-local.test.ts.
  • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=cron-preflight-inference-local-vitest
• e2e-scenarios-all: The PR changes the shared Vitest scenario workflow machinery and hosted-inference environment contract in .github/workflows/e2e-vitest-scenarios.yaml, plus shared fixtures/support tests and multiple live Vitest scenario surfaces. Per policy, shared workflow/fixture changes require the full Vitest E2E scenario fan-out rather than a narrow targeted dispatch.
  • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref>

Optional Vitest E2E scenarios

• None.

Relevant changed files

• .github/actions/export-e2e-hosted-inference/action.yaml
• .github/actions/export-e2e-hosted-inference/export.sh
• .github/workflows/e2e-vitest-scenarios.yaml
• test/e2e-scenario/fixtures/hosted-inference.ts
• test/e2e-scenario/live/agent-turn-latency-helpers.ts
• test/e2e-scenario/live/credential-migration.test.ts
• test/e2e-scenario/live/cron-preflight-inference-local.test.ts
• test/e2e-scenario/live/install-sh-onboard.ts
• test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts
• test/e2e-scenario/support-tests/hosted-inference-workflow-env.test.ts
• test/e2e-scenario/support-tests/hosted-inference.test.ts
• test/e2e-scenario/support-tests/install-sh-onboard.test.ts
• tools/e2e-scenarios/hosted-inference-legacy-alias.mts
• tools/e2e-scenarios/workflow-boundary.mts

[github-actions]

PR Review Advisor — Changes requested

Merge posture: Do not merge yet
Primary next action: Resolve or justify PRA-1: Source-of-truth review needed: Hosted inference key routing rollback and legacy alias handling.
Open items: 0 required · 4 warnings · 0 suggestions · 8 test follow-ups
Top item: Restore single-line validation before writing hosted secrets to GITHUB_ENV

Action checklist

• PRA-1 Resolve or justify: Source-of-truth review needed: Hosted inference key routing rollback and legacy alias handling
• PRA-2 Resolve or justify: Restore single-line validation before writing hosted secrets to GITHUB_ENV in .github/workflows/e2e-script.yaml:235
• PRA-3 Resolve or justify: Document and test the per-lane hosted key source after removing the central alias inventory in .github/workflows/e2e-vitest-scenarios.yaml:878
• PRA-4 Resolve or justify: Shrink the per-job workflow validator added by the rollback in tools/e2e-scenarios/workflow-boundary.mts:7341
• PRA-T1 Add or justify test follow-up: Runtime validation
• PRA-T2 Add or justify test follow-up: Runtime validation
• PRA-T3 Add or justify test follow-up: Runtime validation
• PRA-T4 Add or justify test follow-up: Runtime validation
• PRA-T5 Add or justify test follow-up: Runtime validation
• PRA-T6 Add or justify test follow-up: Acceptance clause
• PRA-T7 Add or justify test follow-up: Acceptance clause
• PRA-T8 Add or justify test follow-up: Acceptance clause

Findings index

ID	Severity	Category	Location	Required action
PRA-1	Resolve/justify	architecture	—	Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
PRA-2	Resolve/justify	security	.github/workflows/e2e-script.yaml:235	Add the same CR/LF rejection before any hosted credential is written to `GITHUB_ENV`, and keep the error before the `printf 'COMPATIBLE_API_KEY=%s\n'` block. If the workflow intentionally no longer enforces `nvapi-*` for all hosted paths, keep that separate from the env-file injection guard.
PRA-3	Resolve/justify	correctness	.github/workflows/e2e-vitest-scenarios.yaml:878	Keep a small checked-in inventory or contract table for the changed lanes that records the intended credential env, provider, endpoint, and temporary alias requirement, and assert the workflow plus helper defaults against it. At minimum, cover the lanes changed here that rely on `NVIDIA_API_KEY` or on `NEMOCLAW_E2E_USE_HOSTED_INFERENCE` inference.
PRA-4	Resolve/justify	architecture	tools/e2e-scenarios/workflow-boundary.mts:7341	Where the rollback needs to keep explicit boundary checks, factor the repeated secret-env, Docker-auth, pinned-action, and artifact checks into small data-driven helpers in this file rather than adding more bespoke validators. Preserve all trust-boundary checks; only shrink repeated structure.

Review findings by urgency: 0 required fixes, 4 items to resolve/justify, 0 in-scope improvements

⚠️ Resolve or justify before merge

Investigate these in the current review; either fix them, explain why they are not applicable, or document the accepted risk.

PRA-1 Resolve/justify — Source-of-truth review needed: Hosted inference key routing rollback and legacy alias handling

• Location: not file-specific
• Category: architecture
• Problem: The advisor marked localized patch analysis as needs_followup.
• Impact: A localized workaround can preserve or hide an invalid state when the source boundary is unclear.
• Recommended action: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
• Missing regression test: Current tests cover general workflow boundaries, but there is no visible replacement test that enumerates each temporary legacy alias consumer and fails when provider/env wiring drifts.
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
• Evidence: `tools/e2e-scenarios/hosted-inference-legacy-alias.mts` is deleted while `.github/workflows/e2e-vitest-scenarios.yaml` continues to pass both `NVIDIA_INFERENCE_API_KEY` and `NVIDIA_API_KEY` in different jobs.

PRA-2 Resolve/justify — Restore single-line validation before writing hosted secrets to GITHUB_ENV

• Location: .github/workflows/e2e-script.yaml:235
• Category: security
• Problem: The deleted composite action rejected CR/LF in `NVIDIA_INFERENCE_API_KEY` before appending derived values to `GITHUB_ENV`; the replacement inline step writes `COMPATIBLE_API_KEY=%s` directly from the secret. If the repository secret is ever misconfigured with a newline, GitHub env-file syntax can create extra environment entries for the subsequent target-ref script step.
• Impact: A malformed or accidentally multiline hosted inference secret could alter the environment of branch-controlled E2E scripts, weakening the workflow trusted-code boundary and making credential handling harder to reason about.
• Recommended action: Add the same CR/LF rejection before any hosted credential is written to `GITHUB_ENV`, and keep the error before the `printf 'COMPATIBLE_API_KEY=%s\n'` block. If the workflow intentionally no longer enforces `nvapi-*` for all hosted paths, keep that separate from the env-file injection guard.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Read `.github/workflows/e2e-script.yaml` around the `Export hosted CI inference environment` step and confirm it rejects `NVIDIA_INFERENCE_API_KEY` containing `\n` or `\r` before line 235 appends to `GITHUB_ENV`.
• Missing regression test: Add a static workflow-contract test that feeds a representative inline export script or inspected workflow body containing a multiline hosted secret case and asserts the script exits before appending `COMPATIBLE_API_KEY` to `GITHUB_ENV`.
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Read `.github/workflows/e2e-script.yaml` around the `Export hosted CI inference environment` step and confirm it rejects `NVIDIA_INFERENCE_API_KEY` containing `\n` or `\r` before line 235 appends to `GITHUB_ENV`.
• Evidence: The removed `.github/actions/export-e2e-hosted-inference/export.sh` loop rejected newline and carriage-return in both credential inputs; the new `.github/workflows/e2e-script.yaml` step only checks that `NVIDIA_INFERENCE_API_KEY` is non-empty, then appends `COMPATIBLE_API_KEY=%s` to `GITHUB_ENV`.

PRA-3 Resolve/justify — Document and test the per-lane hosted key source after removing the central alias inventory

• Location: .github/workflows/e2e-vitest-scenarios.yaml:878
• Category: correctness
• Problem: This rollback deletes `tools/e2e-scenarios/hosted-inference-legacy-alias.mts` and the hosted inference workflow-env tests, then spreads `NVIDIA_INFERENCE_API_KEY`, `NVIDIA_API_KEY`, `COMPATIBLE_API_KEY`, and provider defaults across individual jobs and helpers. For example, `agent-turn-latency-vitest` now passes only `NVIDIA_INFERENCE_API_KEY`, while `agent-turn-latency-helpers.ts` chooses the custom compatible route only when `NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1`; `cron-preflight-inference-local` similarly defaults its provider to `build` unless overridden. Without a replacement source-of-truth, it is hard to tell which lanes intentionally use Build/NVIDIA, compatible endpoint, or legacy `NVIDIA_API_KEY`.
• Impact: Hosted E2E lanes can silently route through the wrong provider or skip live credential coverage, recreating the class of failures this rollback is meant to contain and making future alias removal unsafe.
• Recommended action: Keep a small checked-in inventory or contract table for the changed lanes that records the intended credential env, provider, endpoint, and temporary alias requirement, and assert the workflow plus helper defaults against it. At minimum, cover the lanes changed here that rely on `NVIDIA_API_KEY` or on `NEMOCLAW_E2E_USE_HOSTED_INFERENCE` inference.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Compare `.github/workflows/e2e-vitest-scenarios.yaml` lines around `agent-turn-latency-vitest` and `cron-preflight-inference-local-vitest` with `test/e2e-scenario/live/agent-turn-latency-helpers.ts` and `test/e2e-scenario/live/cron-preflight-inference-local.test.ts` to confirm whether the workflow env selects the intended provider path.
• Missing regression test: Add workflow-boundary assertions named for the behavior: `agent-turn-latency hosted workflow selects the intended provider/model after central export removal`, `cron-preflight hosted workflow selects the intended provider after central export removal`, and `legacy NVIDIA_API_KEY lanes are inventoried and fail if the alias is removed prematurely`.
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Compare `.github/workflows/e2e-vitest-scenarios.yaml` lines around `agent-turn-latency-vitest` and `cron-preflight-inference-local-vitest` with `test/e2e-scenario/live/agent-turn-latency-helpers.ts` and `test/e2e-scenario/live/cron-preflight-inference-local.test.ts` to confirm whether the workflow env selects the intended provider path.
• Evidence: The PR deletes `tools/e2e-scenarios/hosted-inference-legacy-alias.mts`; `.github/workflows/e2e-vitest-scenarios.yaml` now has many direct secret mappings, including `NVIDIA_INFERENCE_API_KEY` at line 878 and `NVIDIA_API_KEY` in other jobs, while helper defaults still make provider decisions from local env.

PRA-4 Resolve/justify — Shrink the per-job workflow validator added by the rollback

• Location: tools/e2e-scenarios/workflow-boundary.mts:7341
• Category: architecture
• Problem: The rollback replaces a centralized hosted inference export surface with a very large per-job workflow-boundary validator file. The file now contains many bespoke `validate*VitestJob` functions and a long dispatcher list, which increases the maintenance surface for every E2E lane that touches secrets or artifacts.
• Impact: Duplicated validator logic can drift from the workflow it is intended to protect, especially for credential env names and provider defaults, and future security fixes may need to be replicated across dozens of validators.
• Recommended action: Where the rollback needs to keep explicit boundary checks, factor the repeated secret-env, Docker-auth, pinned-action, and artifact checks into small data-driven helpers in this file rather than adding more bespoke validators. Preserve all trust-boundary checks; only shrink repeated structure.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Read `tools/e2e-scenarios/workflow-boundary.mts` around the exported `validateE2eVitestScenariosWorkflowBoundary` dispatcher and the repeated `validate*VitestJob` functions to identify duplicated secret and artifact assertions.
• Missing regression test: Keep the existing `keeps the live Vitest scenario workflow manual, pinned, and artifact-safe` support test, and add one negative fixture that proves the shared helper still rejects a job exposing `NVIDIA_INFERENCE_API_KEY` at job scope and a job uploading hidden artifacts.
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Read `tools/e2e-scenarios/workflow-boundary.mts` around the exported `validateE2eVitestScenariosWorkflowBoundary` dispatcher and the repeated `validate*VitestJob` functions to identify duplicated secret and artifact assertions.
• Evidence: `tools/e2e-scenarios/workflow-boundary.mts` now contains a long list of per-job validators and a dispatcher beginning at `validateE2eVitestScenariosWorkflowBoundary`; the PR diff shows this file as the dominant changed surface.

💡 In-scope improvements

These are lower-risk, not throwaway. Prefer fixing them in this PR when they are local to changed code; defer only with rationale or a linked follow-up.

• None.

Simplification opportunities: 1 possible cut

These are safe simplification checks only. Do not remove validation, security controls, data-loss prevention, or required tests.

• PRA-4 shrink (tools/e2e-scenarios/workflow-boundary.mts:7341): Repeated per-job validator boilerplate for secret-env absence, Docker auth env checks, pinned actions, and artifact upload invariants.
  • Replacement: A small table of job expectations plus shared assertion helpers for the repeated workflow-boundary checks.
  • Safety boundary: Do not remove validation for trusted-code boundaries, credential redaction, pinned actions, artifact safety, or dispatch selector restrictions; only consolidate repeated code.

Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

• PRA-T1 Runtime validation — reusable e2e-script hosted export rejects multiline NVIDIA_INFERENCE_API_KEY before writing GITHUB_ENV. The changed surfaces are workflow, secret-routing, installer/onboard, sandbox, and live hosted inference paths. Static tests can catch wiring drift, but they cannot prove the live provider route and credential alias behavior.
• PRA-T2 Runtime validation — reusable e2e-script jobs that previously needed NVIDIA_API_KEY alias either receive it or are proven not to need it. The changed surfaces are workflow, secret-routing, installer/onboard, sandbox, and live hosted inference paths. Static tests can catch wiring drift, but they cannot prove the live provider route and credential alias behavior.
• PRA-T3 Runtime validation — agent-turn-latency direct Vitest routes hosted inference through the intended provider and model after central export removal. The changed surfaces are workflow, secret-routing, installer/onboard, sandbox, and live hosted inference paths. Static tests can catch wiring drift, but they cannot prove the live provider route and credential alias behavior.
• PRA-T4 Runtime validation — cron-preflight direct Vitest onboards against the intended provider after central export removal. The changed surfaces are workflow, secret-routing, installer/onboard, sandbox, and live hosted inference paths. Static tests can catch wiring drift, but they cannot prove the live provider route and credential alias behavior.
• PRA-T5 Runtime validation — credential-migration direct Vitest receives COMPATIBLE_API_KEY/custom endpoint exactly once and redacts the raw hosted key from cleanup artifacts. The changed surfaces are workflow, secret-routing, installer/onboard, sandbox, and live hosted inference paths. Static tests can catch wiring drift, but they cannot prove the live provider route and credential alias behavior.
• PRA-T6 Acceptance clause — Revert PR ci(e2e): centralize Vitest inference env #5600 (`ci(e2e): centralize Vitest inference env`) to restore the previous E2E hosted-inference key wiring. — add test evidence or identify existing coverage. The diff deletes `.github/actions/export-e2e-hosted-inference/*`, removes use of that action from workflow files, and deletes related tests/tools. Because many touched files changed after ci(e2e): centralize Vitest inference env #5600 and there is overlap with active PR fix: address issue #5667 #5672, static review cannot prove every lane is restored to the intended pre-5600 behavior.
• PRA-T7 Acceptance clause — This is a safety rollback after full post-merge E2E equivalence runs showed widespread hosted key routing failures on `main`. — add test evidence or identify existing coverage. The claimed post-merge E2E evidence is PR-provided text only. The code diff is consistent with a rollback of centralized hosted inference env export, but external E2E status is intentionally not evaluated here.
• PRA-T8 Acceptance clause — `NVIDIA_INFERENCE_API_KEY must be nvapi-prefixed for hosted CI inference` — add test evidence or identify existing coverage. The rollback removes the central action check that emitted this error. Several live tests still assert `apiKey.startsWith("nvapi-")`, but the reusable workflow inline export no longer validates the prefix before exposing the secret to the target script environment.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.