test(e2e): retire legacy shell lanes - #5756
Merged
Merged
Conversation
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
Contributor
|
Important Review skippedToo many files! This PR contains 416 files, which is 116 over the limit of 300. To get a review, narrow the scope: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (416)
You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Collaborator
Author
|
Phase 11 closeout mapping for #5098:
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-5756.docs.buildwithfern.com/nemoclaw |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
PR Review Advisor — InformationalMerge posture: Informational / low confidence Action checklist
Test follow-ups to resolve or justifyIf these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.
This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision. |
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
Collaborator
Author
|
@coderabbitai review |
Contributor
✅ Action performedReview finished.
|
Collaborator
Author
|
@coderabbitai review --dir test/e2e |
Collaborator
Author
|
@coderabbitai review --dir .github --dir tools --dir scripts --dir ci --dir docs --dir .agents |
Contributor
|
✅ Action performedReview finished.
|
Contributor
|
✅ Action performedReview finished.
|
5 tasks
Contributor
Vitest E2E Target Results — ✅ All selected jobs passedRun: 28417789228
|
Contributor
|
✅ Brev E2E (full): PASSED on branch |
Collaborator
Author
Current-head automated-review follow-up dispositionThis addresses the non-blocking runtime follow-ups in the GPT advisor and Nemotron advisor at GPT follow-ups
Nemotron follow-ups
No additional repository change is warranted for these follow-ups. CodeRabbit skipped line review because the 300-file service limit is exceeded; that limitation remains explicit in the PR body. Human domain and independent cutover approval are still required. |
cjagwani
approved these changes
Jun 30, 2026
cjagwani
left a comment
cjagwani
left a comment
Collaborator
There was a problem hiding this comment.
Independent final cutover review against #5919
I reviewed this as the independent final cutover sign-off. I didn't review off the green checkmarks, since this PR has twice shown green hiding a real leak (the GPU auth.token, then the sandbox-generated device.json private key), so I treated "all jobs passed" as the starting point and went to the actual evidence on the latest head.
Coverage — all 71 variants accounted for
I walked every frozen v0.0.69 job variant against the eight domain dispositions. Each maps to a replacement that exists on this head, the counts still sum to 71, and there are no "covered by Vitest somewhere" hand-waves; every row names a concrete replacement and the boundary it keeps. The four variants that share a test file (the two anthropic switch lanes, rebuild-hermes-stale-base, and channels-stop-start-hermes) each carry their own distinct execution evidence rather than being inferred from the base lane.
Artifacts — audited the corpus directly
I pulled the full corpus from the final candidate, all 75 artifacts and roughly 5,000 files, and scanned it myself rather than trusting the leak assertions in the tests that missed the earlier key. No private key blocks, no device.json or identity material, no real credential shapes, and both sandbox snapshot summaries report rawContentPublished false with forbiddenLeakCount zero. The publication boundary fix holds across the whole corpus, not just the Bedrock legs where it surfaced.
Run health — the one red mark was a flake
rebuild-hermes failed its first attempt and passed on the automatic retry: the flaky lane behaving like one, not a parity regression. The three skips are the expected explicit-only lanes plus notify-on-failure on an all green run, and the selector guard that fails closed is proven on this head too, with a malformed dispatch rejected at generate-matrix and zero live jobs run.
Dependent fixes — traced to ground
The candidate originally cited here is superseded, since your own audit found the device.json leak in it, so I anchored on the green run after the fix. I also followed the dependent work: #6016, the channels-stop-start interaction with #5856, is merged with both agents passing; the inference-selection-validation failures were resolved by #5927 with the CLI shards green; and the previously cancelled openclaw-tui-chat-correlation lane is recovered and passing.
Dispositions — signed off
The two retirements hold. issue-4462-gateway-pinned-characterization reproduced an obsolete path that predates its own fix and is already closed, while the supported behavior stays tested live, and the advisor actions: write auto dispatch is a privilege removal that keeps the read only recommendation and is guarded against returning. The issue-3600 GPU proof move into the required CLI shards is a strict coverage gain, running on every PR instead of only nightly. On sandbox-operations, TC-SBX-06 soft-skips as skipped-gateway-absent again, but that matches the frozen v0.0.69 script's own soft-skip exactly, so it preserves parity rather than opening a new gap. I also agree with the two overridden Nemotron findings: PRA-5's trace, cleanup, and redaction behavior is kept at the correct boundaries, and PRA-6's static map from deleted shells to Vitest would recreate the exact ledger #5919 was built to avoid.
Verdict: Approve
The semantic disposition evidence is sufficient. Coverage is complete, the artifact boundary is clean under my own inspection, the dependent fixes are landed and proven, and each remaining judgment call is backed by concrete evidence rather than inference. Nice work running this down.
26 tasks
21 tasks
jyaunches
pushed a commit
that referenced
this pull request
Jun 30, 2026
## Summary Refreshes the v0.0.70 release docs from the release announcement and the `v0.0.69..v0.0.70` commit range. It also documents the `channels start` policy restoration behavior that was missing from the shared OpenClaw and Hermes command references, and bumps the Fern CLI version used for docs validation. ## Changes - Replaced the stale `v0.0.70` release-notes entry with the actual release themes, including CLI, onboarding, inference, messaging, Windows, documentation, and release-validation changes. - Documented that `channels start` reapplies the matching built-in network policy preset before rebuild and rolls back to disabled if policy restoration fails. - Bumped `fern/fern.config.json` from `5.55.0` to `5.59.0` for the docs refresh. - Source summary: - #5754 -> `docs/about/release-notes.mdx`: Notes Docker Desktop gateway bridge retry behavior during onboarding. - #5930 -> `docs/about/release-notes.mdx`: Links `nemoclaw use` default sandbox selection to the command reference. - #5948 -> `docs/about/release-notes.mdx`: Links reasoning-compatible endpoint validation to inference documentation. - #5950 -> `docs/about/release-notes.mdx`: Links Windows bootstrap WSL recovery behavior to Windows preparation and troubleshooting docs. - #5856 -> `docs/about/release-notes.mdx`: Notes rebuilt policy preset registry repair. - #5882 and #5949 -> `docs/about/release-notes.mdx`: Notes Hermes stale base-image state repair. - #6016 -> `docs/reference/commands.mdx`, `docs/reference/commands-nemohermes.mdx`, and `docs/manage-sandboxes/messaging-channels.mdx`: Documents channel policy restoration and rollback on `channels start`. - #5859 -> `docs/about/release-notes.mdx`: Links quickstart network approval guidance. - #5863 -> `docs/about/release-notes.mdx`: Links Teams allowlist guidance in the messaging page. - #5756, #5926, #6010, and #6011 -> `docs/about/release-notes.mdx`: Summarizes the Vitest E2E validation cutover. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: doc-only prose refresh with no runtime behavior change. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) `npm run docs` exited 0 and Fern reported one existing light-mode accent contrast warning. `fern check --warnings` confirmed the warning is the site theme contrast ratio, not content introduced by this PR. --- Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
21 tasks
prekshivyas
added a commit
to abhi-0906/NemoClaw
that referenced
this pull request
Jul 1, 2026
- Remove .github/workflows/nightly-e2e.yaml and test/e2e/test-openclaw-tui-chat-correlation.sh (deleted in main via retire legacy shell lanes NVIDIA#5756) - Keep fork's new session-scope tests in test/openclaw-tui-chat-correlation.test.ts and add main's new "keeps the live repro prompts deterministic and tool-free" test Co-Authored-By: abhi-0906 <192848430+abhi-0906@users.noreply.github.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
15 tasks
cv
pushed a commit
that referenced
this pull request
Jul 3, 2026
…6144) ## Summary The `build-hermes-sandbox-image` job in `.github/workflows/sandbox-images-and-e2e.yaml` ran the Hermes sandbox secret-boundary Vitest test (`npx vitest`) **before** the `Set up Node` and `Install root dependencies` steps. On a clean hosted runner there is no root `node_modules`, so `npx` pulled an ad-hoc `vitest` that could not resolve `vitest/config` from the repo's `vitest.config.ts`, failing the job with `Cannot find module 'vitest/config'`. This moves the Node setup + install steps ahead of the first Vitest invocation. ## Related Issue Fixes #6143 ## Changes - Move `Set up Node` and `Install root dependencies` (`npm ci --ignore-scripts`) to run immediately after `Resolve Hermes base image`, before `Build Hermes production image` and both Hermes Vitest steps. - New step order: Checkout → Resolve base image → Set up Node → Install deps → Build/verify Hermes image → secret-boundary Vitest → root-entrypoint smoke Vitest. - Net diff is a pure reorder (9 insertions / 9 deletions); no step content changed. The ordering regressed in #5756 (commit `8120223922bf`). ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [x] Tests not applicable — justification: CI workflow step reorder; correctness is a CI-runner behavior (dependencies present before Vitest), validated by the job's own run plus a host A/B below. No unit-testable surface. - [x] Docs not applicable — justification: internal CI workflow only; no user-facing surface. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: touches only CI step ordering in one workflow job; the Hermes secret-boundary and smoke tests, their env, and commands are unchanged — only the position of the standard `setup-node` + `npm ci` steps moved earlier. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push - [x] Targeted validation: YAML parses; prek hooks (`check yaml`, whitespace, etc.) pass on the file; step order confirmed. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed ### Host A/B verification (`local-jama@10.176.198.59`) Reproduced the exact failure and confirmed the fix's premise without running the heavy live Docker test: - **Before `npm install`** (simulating the old ordering — Vitest with no root `node_modules`): `npx vitest list … hermes-sandbox-secret-boundary.test.ts` fails with `Cannot find module 'vitest/config'` — matches the reported CI error. - **After `npm install`** (the new ordering — deps present first): the same `vitest list` resolves `vitest.config.ts` and discovers the test with no ad-hoc `npx` install. (Results pasted in the completion notification.) Definitive check: this PR's own `build-hermes-sandbox-image` job on a fresh runner. --- Signed-off-by: Jason Ma <jama@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the sandbox image and end-to-end pipeline to prepare dependencies earlier in the run, helping the job execute more smoothly and consistently. * Streamlined setup steps in the workflow by removing duplicate preparation later in the process. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Jason Ma <jama@nvidia.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
21 tasks
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Restore issue NVIDIA#5800 parity package `P0-B` for merged onboard/rebuild/lifecycle bash-suite deltas only. ## Related Issues Refs NVIDIA#5800 Refs NVIDIA#5098 Refs NVIDIA#5225 Refs NVIDIA#5487 Refs NVIDIA#5410 Refs NVIDIA#5760 ## Scope gate - Package: `P0-B — Onboard/rebuild/lifecycle parity` - Included PRs all merged and touched `test/e2e`: yes — NVIDIA#5225, NVIDIA#5487, NVIDIA#5410, NVIDIA#5760 - Out of scope: unmerged/non-bash PRs; shell lane retirement / PR NVIDIA#5756 cleanup ## Parity map | ID | Source PR | Contract | Inference classification | Vitest assertion / waiver | Status | | --- | --- | --- | --- | --- | --- | | B1 | NVIDIA#5225 | Persisted sandbox-entry gateway resolution is used by lifecycle commands. | `none` | Existing `src/lib/actions/sandbox/sandbox-gateway-routing.test.ts`, `src/lib/onboard/gateway-binding.test.ts`, `src/lib/onboard/sandbox-registration.test.ts` | covered | | B2 | NVIDIA#5225 | Onboard repair/double-onboard failures include captured onboard output diagnostics. | `none` | Existing live `test/e2e-scenario/live/onboard-repair.test.ts`, `test/e2e-scenario/live/double-onboard.test.ts`; diagnostics are bash-runner-only verbosity and not a durable Vitest assertion. | waived | | B3 | NVIDIA#5487 | Plain `nemoclaw onboard` auto-detects an `in_progress` session and resumes without `--resume`; `--fresh` suppresses auto-resume. | `hosted-compatible capable` | `test/e2e-scenario/live/onboard-resume.test.ts` Phase 3.5 mutates the completed session to `in_progress`, asserts `(resume mode)` + cached skips, then asserts `--fresh` fails at injected preflight without resume banner. | covered | | B4 | NVIDIA#5410 | Rebuild resumes messaging from `messaging.plan` rather than legacy `providerCredentialHashes`; stale top-level provider hash state is not used. | `none` | `test/e2e-scenario/live/rebuild-hermes.test.ts` curated registry omits `providerCredentialHashes`; `src/lib/onboard/machine/handlers/sandbox.test.ts` refreshes registry-plan credential hashes from env on rebuild resume. | covered | | B5 | NVIDIA#5410 | Empty/staged rebuild messaging plan is preserved and token-backed channels are not rediscovered. | `none` | Existing `src/lib/actions/sandbox/rebuild-messaging-stage.test.ts` and `src/lib/onboard/machine/handlers/sandbox.test.ts`. | covered | | B6 | NVIDIA#5760 | Hosted-inference/messaging rebuild and live answer assertions tolerate model whitespace around integer `42`. | `hosted-compatible capable` | Existing `test/helpers/e2e-answer-assertions.test.ts`, consumed by `agent-turn-latency`, `full-e2e`, `launchable-smoke`, and `sandbox-operations` live Vitests. | covered | | B7 | NVIDIA#5760 | Stabilized hosted inference and messaging rebuild remain validated by live full/sandbox/launchable/rebuild targets. | `hosted-compatible capable` | Existing live targets remain unchanged; local live execution blocked by Docker daemon unavailable. Selective workflow required after PR opens. | follow-up | ## Inference mode support - Default mode for touched live targets: `hosted-compatible capable` for onboard-resume/rebuild-hermes/full/sandbox/launchable answer paths; `none` for unit/process registry and gateway routing tests. - Real inference support preserved: yes for existing hosted-compatible live targets; no new inference adapter seam added here. - Modes validated in this PR: local unit/process Vitests only; live hosted-compatible validation needs GitHub runner/secrets because local Docker daemon is unavailable. - If not validated with real inference: local `NEMOCLAW_RUN_E2E_SCENARIOS=1 npx vitest run --project e2e-scenarios-live test/e2e-scenario/live/onboard-resume.test.ts test/e2e-scenario/live/rebuild-hermes.test.ts` failed at prereq Docker daemon check before scenario assertions. ## Validation - [x] `git diff --check` - [x] `npm test -- src/lib/onboard/machine/handlers/sandbox.test.ts test/helpers/e2e-answer-assertions.test.ts src/lib/actions/sandbox/sandbox-gateway-routing.test.ts src/lib/onboard/entry-options.test.ts src/lib/onboard/sandbox-registration.test.ts src/lib/actions/sandbox/rebuild-messaging-stage.test.ts` - [x] `npm run typecheck:cli` - [x] `npm run build:cli` - [x] `npm run test-size:check` - [ ] hosted-compatible selective E2E workflow: pending PR / runner dispatch ## Follow-ups / waivers - Waiver B2: bash-only diagnostic verbosity from NVIDIA#5225 is not a durable Vitest contract; existing live tests already preserve the functional repair/double-onboard behavior. - Follow-up B7: dispatch selective live Vitest scenarios on GitHub runner with Docker + hosted inference secret after PR opens. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Added coverage for sandbox resume flows to verify updated Telegram credentials are picked up when resuming a rebuild. * Expanded end-to-end onboarding resume scenarios to confirm implicit resume behavior, including skipped cached steps and fresh runs starting from the expected point. * Strengthened rebuild scenario checks to ensure curated registry entries no longer include legacy credential-hash data. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Restore issue NVIDIA#5800 parity package `P0-A` for merged bash-suite inference-helper deltas only. This is a focused support-test parity PR: the helper/product behavior already exists on `main`; this adds missing Vitest assertions so shell retirement keeps the hosted/hermetic inference contracts covered. ## Related Issues Refs NVIDIA#5800 Refs NVIDIA#5098 Refs NVIDIA#5373 Refs NVIDIA#5374 Refs NVIDIA#5385 Refs NVIDIA#5395 Refs NVIDIA#5399 Refs NVIDIA#5400 Refs NVIDIA#5411 Refs NVIDIA#5751 Refs NVIDIA#5672 Refs NVIDIA#5757 ## Scope gate - Package: `P0-A — Hosted/hermetic inference helper parity` - Included PRs all merged and touched `test/e2e`: yes - Out of scope: unmerged/non-bash PRs; product cleanup; shell lane retirement / PR NVIDIA#5756 cleanup ## Parity map | ID | Source PR | Contract | Inference classification | Vitest assertion / waiver | Status | | --- | --- | --- | --- | --- | --- | | A1 | NVIDIA#5373 | Fake OpenAI-compatible helper supports `/models`, chat completions, responses API, auth checking, and request capture. | `hermetic-default` | `test/e2e-scenario/support-tests/hosted-inference.test.ts` starts `startFakeOpenAiCompatibleServer` and asserts models/chat/responses/request log behavior. | covered | | A2 | NVIDIA#5374, NVIDIA#5385, NVIDIA#5395 | Hosted CI inference stages `NVIDIA_INFERENCE_API_KEY` as `COMPATIBLE_API_KEY`, routes as `custom`/`compatible-endpoint`, and prefers `openai-completions`. | `hosted-compatible capable` | Existing workflow/helper assertions plus new shell helper staging assertion in `hosted-inference.test.ts`. | covered | | A3 | NVIDIA#5399, NVIDIA#5751, NVIDIA#5672, NVIDIA#5757 | Hosted model default remains the Inference Hub provider/namespace/model ID `nvidia/nvidia/nemotron-3-ultra`; explicit `NEMOCLAW_MODEL` takes precedence over `NEMOCLAW_COMPAT_MODEL`, which takes precedence over helper options/default. | `hosted-compatible capable` | New `requireHostedInferenceConfig` model precedence/default assertion; existing workflow/model namespace tests remain green. | covered | | A4 | NVIDIA#5400, NVIDIA#5411 | Hosted reachability probe is bounded and low-cost: no `/models`, chat completions, auth header, or bearer token spend. | `hosted-compatible capable` | Existing probe tests retained and revalidated. | covered | | A5 | NVIDIA#5385 | Public NVIDIA/nvapi shell mode remains distinct from hosted-compatible mode and is not restaged as compatible inference. | `public-nvidia required` | New shell helper assertion checks `nvapi-*` + `cloud` keeps `nvidia-prod`, leaves `COMPATIBLE_API_KEY` unset. | covered | ## Inference mode support - Default mode for touched live targets: none touched; this PR only changes support tests. - Real inference support preserved: yes, by asserting hosted-compatible and public-NVIDIA helper boundaries without invoking real inference. - Modes validated in this PR: hermetic fake endpoint and shell helper mocked hosted-compatible/public boundary. - If not validated with real inference: not required; no live target or hosted secret path changed. ## Validation - [x] `npx vitest run --project e2e-vitest-support test/e2e-scenario/support-tests/hosted-inference.test.ts` - [x] `npx vitest run test/e2e-script-workflow.test.ts test/issue-5667-hosted-inference-model-namespace.test.ts src/lib/inference/onboard-probes.test.ts src/lib/onboard/providers.test.ts` - [x] `git diff --check` - [ ] hosted/public selective E2E workflow, if required by classification: not required; support-test-only PR, no live/workflow behavior changed. ## Follow-ups / waivers - Pre-push full `Test (CLI)` / `Test (plugin)` hooks were not clean on local macOS after the commit: CLI run hit existing macOS/stat/OOM-style failures; plugin run could not import package `json5`. Focused target tests above passed. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Expanded end-to-end coverage for hosted inference compatibility and model ID/model precedence behavior. * Added validations for environment variable staging rules and shell mode behavior across NVAPI key scenarios. * Introduced a fake OpenAI-compatible server and added contract checks for `/models`, auth-required flows, and streamed responses on chat/response endpoints, including cleanup after runs. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Restore the Kimi-specific issue NVIDIA#5800 parity work for package `P0-D`; existing recovery and scope-upgrade package rows are explicitly mapped as pre-existing coverage and revalidated context, but not changed acceptance scope in this PR. ## Related Issues Refs NVIDIA#5800 Refs NVIDIA#5098 Refs NVIDIA#5342 Refs NVIDIA#5401 Refs NVIDIA#5406 Refs NVIDIA#5412 Refs NVIDIA#5413 Refs NVIDIA#5625 Refs NVIDIA#5760 ## Scope gate - Package: `P0-D — Recovery, Kimi, and scope-upgrade parity` - Included PRs all merged and touched `test/e2e`: yes - Changed acceptance scope in this PR: Kimi public-NVIDIA/mock parity (`D2`, `D3`) - Existing package rows revalidated without diff changes: recovery (`D1`) and scope-upgrade (`D4`) - Out of scope: unmerged/non-bash PRs; shell lane retirement / PR NVIDIA#5756 cleanup ## Parity map | ID | Source PR | Contract | Inference classification | Vitest assertion / waiver | Status | | --- | --- | --- | --- | --- | --- | | D1 | NVIDIA#5342, NVIDIA#5401 | Recovery proxy env sourcing, missing proxy-env warning, guard retention, ciao/networkInterfaces preload, and crash-loop stability are pre-existing package coverage. | `hermetic-default` | Existing `test/e2e-scenario/live/issue-2478-crash-loop-recovery.test.ts`, `test/e2e-scenario/support-tests/e2e-recovery-helpers.test.ts`; selective run `28186561267` job `issue-2478-crash-loop-recovery-vitest` passed. No diff changes here. | existing / revalidated context | | D2 | NVIDIA#5401 | Kimi remains a public-NVIDIA model/provider contract when run in trusted selective CI, while retaining mock fallback for local/untrusted validation. | `public-nvidia required` | `.github/workflows/e2e-vitest-scenarios.yaml`, `test/e2e-scenario/live/kimi-inference-compat.test.ts`, `test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts`, `test/e2e-script-workflow.test.ts` | covered / changed | | D3 | NVIDIA#5413, NVIDIA#5625 | Kimi multiturn tool calls split `hostname; date; uptime`, preserve tool-result flow, reject abandoned/continue traces, and normalize final punctuation. | `public-nvidia required` with mock fallback | `test/e2e-scenario/live/kimi-inference-compat-helpers.ts` trajectory assertions; selective run `28190216767` job `kimi-inference-compat-vitest` passed on the previous head; latest run `28193896380` passed on `f36fef6da`. | covered / changed | | D4 | NVIDIA#5406, NVIDIA#5412, NVIDIA#5760 | Scope-upgrade approval tolerates preapproved / not-reproduced states, denies `operator.admin` leakage, stays on gateway/no embedded fallback, and accepts whitespace-normalized `42`; this is pre-existing package coverage. | `hosted-compatible capable` | Existing `test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts`; selective run `28186561267` job `issue-4462-scope-upgrade-approval-vitest` passed. No diff changes here. | existing / revalidated context | ## Inference mode support - Default mode for touched live target: Kimi `mock` unless workflow selects `public-nvidia`. - Real inference support preserved: yes for Kimi public NVIDIA; yes for existing scope-upgrade hosted-compatible; not required for recovery. - Modes validated in this PR: Kimi public NVIDIA via selective workflows `28188683830`, `28190216767`; latest follow-up validation `28193896380` is running for head `f36fef6da`. Kimi helper/mock behavior via local support tests. - Source-of-truth contract: `NEMOCLAW_E2E_INFERENCE_MODE` is the canonical selector; absent selector defaults to mock for local/untrusted validation; unknown explicit values now fail closed; legacy `NEMOCLAW_KIMI_USE_MOCK=0` remains only as a temporary shell-lane compatibility alias until shell retirement. - Secret boundary: public Kimi workflow passes only `NVIDIA_API_KEY`; helper probe envs are secret-free by default; raw public NVIDIA key handoff is limited to onboard; sandbox `openclaw agent` now runs with a secret-free env and uses the configured `nvidia-prod` route. ## Validation - [x] `npx vitest run --project e2e-vitest-support test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts` - [x] `npx vitest run test/e2e-script-workflow.test.ts` - [x] `npm run typecheck:cli` - [x] `npm run test-conditionals:scan -- --top 25` - [x] `npx prek run --all-files --stage pre-push --skip tsc-plugin --skip tsc-js --skip tsc-cli --skip version-tag-sync --skip test-cli --skip test-plugin --skip source-shape-test-budget --skip test-file-size-budget --skip test-skills-yaml` - [x] `git diff --check` - [x] Kimi selective E2E / Vitest Scenarios on previous head: https://github.com/NVIDIA/NemoClaw/actions/runs/28190216767 - [x] Kimi selective E2E / Vitest Scenarios after review-gap fixes: https://github.com/NVIDIA/NemoClaw/actions/runs/28193896380 - [x] Existing recovery/scope rows revalidated in selective run: https://github.com/NVIDIA/NemoClaw/actions/runs/28186561267 (`issue-2478-crash-loop-recovery-vitest` ✅, `issue-4462-scope-upgrade-approval-vitest` ✅; Kimi in that stale run was superseded) - [ ] Local live mock Kimi: attempted but blocked by local Docker daemon unavailable (`Cannot connect to the Docker daemon at unix:///Users/jyaunches/.docker/run/docker.sock`). CI selective run is the live validation path for this head. ## Follow-ups / waivers - None. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for running Kimi compatibility e2e checks in either mock or public NVIDIA mode. * The live scenario now adapts its setup, redaction, and traffic validation based on the selected mode. * **Bug Fixes** * Improved handling of API key propagation so public NVIDIA runs use the expected credentials without exposing secrets in other paths. * **Tests** * Added coverage for mode selection, API key validation, workflow environment wiring, and the new public NVIDIA Vitest lane. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Restore issue NVIDIA#5800 parity package `P0-C` for merged bash-suite messaging/Discord/WhatsApp deltas only. ## Related Issues Refs NVIDIA#5800 Refs NVIDIA#5098 Refs NVIDIA#5328 Refs NVIDIA#5391 Refs NVIDIA#5581 Refs NVIDIA#5624 Refs NVIDIA#5571 Refs NVIDIA#5704 ## Scope gate - Package: `P0-C — Messaging / Discord / channel parity` - Included PRs all merged and touched `test/e2e`: yes — NVIDIA#5328, NVIDIA#5391, NVIDIA#5581, NVIDIA#5624, NVIDIA#5571, NVIDIA#5704 - Out of scope: unmerged/non-bash PRs; shell lane retirement / PR NVIDIA#5756 cleanup ## Parity map | ID | Source PR | Contract | Inference classification | Vitest assertion / waiver | Status | | --- | --- | --- | --- | --- | --- | | C1 | NVIDIA#5328 | Compact persisted messaging plans omit derived render/build/runtime/state/health sections while retaining durable channel/config/credential/policy shape. | `none` | `src/lib/messaging/plan-validation.test.ts`; `test/e2e-scenario/live/channels-add-remove.test.ts` | covered | | C2 | NVIDIA#5328 | Existing compact plans hydrate before merge so channel add preserves prior hooks/render semantics. | `none` | existing `src/lib/messaging/applier/host-state-applier.test.ts` | covered | | C3 | NVIDIA#5391, NVIDIA#5571 | Discord config must not emit a non-loopback per-account proxy; OpenClaw managed proxy remains configured. | `none` | `test/discord-template-resolver-proxy.test.ts`; `test/generate-openclaw-config.test.ts`; `test/e2e-scenario/live/messaging-providers.test.ts`; `test/e2e-scenario/live/openclaw-discord-pairing.test.ts` | covered | | C4 | NVIDIA#5581 | OpenClaw Discord pairing Vitest preserves fake Gateway token rewrite, connect-shell approval, and workflow dispatch boundary. | `hermetic-default` | existing `test/e2e-scenario/live/openclaw-discord-pairing.test.ts`; support boundary/helper tests | covered | | C5 | NVIDIA#5624 | Fake Discord Gateway capture proof accepts only redacted identify rows, rejects placeholder/raw-token leakage, and proves token rewrite. | `hermetic-default` | `test/e2e-scenario/live/messaging-providers.test.ts`; existing Hermes/OpenClaw Discord capture assertions and support tests | covered | | C6 | NVIDIA#5704 | WhatsApp policy checks require expected endpoints before rebuild and endpoints plus Node binary scope after rebuild. | `none` | `test/e2e-scenario/live/messaging-providers.test.ts`; `test/policies.test.ts` | covered | ## Inference mode support - Default mode for touched live targets: `none` for config/unit assertions; `hermetic-default` for fake Discord Gateway/live sandbox token-rewrite assertions. - Real inference support preserved: not applicable to this package’s messaging/provider contracts; live sandbox targets still use existing `NVIDIA_INFERENCE_API_KEY` path where their broader scenario requires install/onboard. - Modes validated in this PR: unit/support hermetic commands below; selective live E2E run `28194650942` passed `messaging-providers-vitest`, `channels-add-remove-vitest`, and `openclaw-discord-pairing-vitest` at `531acd9f8`. Follow-up head `46e004e3` only tightens local workflow-boundary assertions for `COMPATIBLE_API_KEY`. - If not validated with real inference: package contracts are messaging/config/proxy/capture policy boundaries; `channels-add-remove-vitest` also passed the hosted-compatible workflow path after staging `NVIDIA_INFERENCE_API_KEY` as `COMPATIBLE_API_KEY`. ## Validation - [x] `npx vitest run --project cli --maxWorkers 1 --no-fileParallelism src/lib/messaging/plan-validation.test.ts src/lib/messaging/applier/host-state-applier.test.ts test/discord-template-resolver-proxy.test.ts` - [x] `npx vitest run --project e2e-vitest-support --maxWorkers 1 --no-fileParallelism test/e2e-scenario/support-tests/openclaw-discord-legacy-capture.test.ts test/e2e-scenario/support-tests/openclaw-discord-pairing-helpers.test.ts test/e2e-scenario/support-tests/openclaw-discord-workflow-boundary.test.ts` - [x] `npx vitest run --project cli --maxWorkers 1 --no-fileParallelism --testTimeout 30000 test/generate-openclaw-config.test.ts -t "Discord|proxy|non-Slack"` - [x] `npx vitest run --project cli --maxWorkers 1 --no-fileParallelism test/policies.test.ts -t "whatsapp"` - [x] `npx vitest run --project e2e-vitest-support --maxWorkers 1 --no-fileParallelism test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts test/e2e-scenario/support-tests/openclaw-discord-workflow-boundary.test.ts` - [x] Selective live E2E workflow `28194650942`: `messaging-providers-vitest`, `channels-add-remove-vitest`, `openclaw-discord-pairing-vitest` all passed. ## Follow-ups / waivers - None. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved messaging plan persistence validation to ensure only required fields are stored; derived workflow sections and per-channel hook data are no longer persisted. * Strengthened live channel add/remove assertions to enforce `agentRender` and per-channel `hooks` absence. * Updated live messaging provider and Discord pairing validations (WhatsApp preset hosts and stricter gateway capture checks; account proxy now required to be exactly empty when unset). * **Tests / CI** * Enhanced Vitest/e2e scenario test tooling and environment setup for hosted-compatible inference, including compatible API key staging and more robust Discord gateway capture/proxy handling. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Restore issue NVIDIA#5800 parity package `P0-C` for merged messaging/Discord/channel bash-suite deltas only. ## Related Issues Refs NVIDIA#5800 Refs NVIDIA#5098 Refs NVIDIA#5328 Refs NVIDIA#5391 Refs NVIDIA#5581 Refs NVIDIA#5624 Refs NVIDIA#5571 Refs NVIDIA#5704 ## Scope gate - Package: `P0-C — Messaging / Discord / channel parity` - Included PRs all merged and touched `test/e2e`: yes — NVIDIA#5328, NVIDIA#5391, NVIDIA#5581, NVIDIA#5624, NVIDIA#5571, NVIDIA#5704 - Out of scope: unmerged/non-bash PRs; shell lane retirement / PR NVIDIA#5756 cleanup ## Parity map | ID | Source PR | Contract | Inference classification | Vitest assertion / waiver | Status | | --- | --- | --- | --- | --- | --- | | C1 | NVIDIA#5328 | Persisted messaging plans stay compact: `agentRender` and per-channel `hooks` are derived runtime data, not durable registry/session state. | `none` | `src/lib/messaging/plan-validation.test.ts`; `test/e2e-scenario/live/channels-add-remove.test.ts`; existing `channels-stop-start-helpers.ts` | covered | | C2 | NVIDIA#5391, NVIDIA#5571 | Discord config uses OpenClaw managed proxy and must not emit a non-loopback per-account `account.proxy`. | `none` | Existing `test/e2e-scenario/live/messaging-providers.test.ts`; `test/e2e-scenario/live/openclaw-discord-pairing.test.ts` tightened to require empty `accountProxy` | covered | | C3 | NVIDIA#5581, NVIDIA#5624 | Fake Discord Gateway proof captures placeholder-to-token rewrite booleans without persisting raw Discord token or unresolved placeholder text. | `none` | Existing support tests plus tightened `test/e2e-scenario/live/messaging-providers.test.ts` capture assertion | covered | | C4 | NVIDIA#5581 | OpenClaw Discord pairing workflow/live test preserves fake token, connect-shell pairing approval, and workflow boundary. | `none` | Existing `test/e2e-scenario/live/openclaw-discord-pairing.test.ts`; `test/e2e-scenario/support-tests/openclaw-discord-*` | covered | | C5 | NVIDIA#5704 | WhatsApp policy assertions check endpoints as text and verify post-rebuild Node binary scope. | `none` | `test/e2e-scenario/live/messaging-providers.test.ts` now checks pre/post policy text and Node binary scope | covered | ## Inference mode support - Default mode for touched live targets: `none` for new/tightened assertions; live scenario install still uses existing `NVIDIA_INFERENCE_API_KEY` boundary where the pre-existing scenario requires it. - Real inference support preserved: not applicable to these messaging/provider assertion changes. - Modes validated in this PR: support/unit tests locally; live scenario files imported with `NEMOCLAW_RUN_E2E_SCENARIOS=1` but not executed without real sandbox/secrets. - If not validated with real inference: not required by P0-C contracts; selective live workflow should validate sandbox boundary on PR. ## Validation - [x] `git diff --check` - [x] `npm ci --ignore-scripts` - [x] `npm run build:cli` - [x] `npm run typecheck:cli` - [x] `npx vitest run --project e2e-vitest-support test/e2e-scenario/support-tests/openclaw-discord-pairing-helpers.test.ts test/e2e-scenario/support-tests/openclaw-discord-legacy-capture.test.ts test/e2e-scenario/support-tests/openclaw-discord-workflow-boundary.test.ts` - [x] `npx vitest run src/lib/messaging/plan-validation.test.ts src/lib/state/onboard-session.test.ts test/registry.test.ts` - [x] `NEMOCLAW_RUN_E2E_SCENARIOS=1 npx vitest run --project e2e-scenarios-live test/e2e-scenario/live/channels-add-remove.test.ts test/e2e-scenario/live/messaging-providers.test.ts test/e2e-scenario/live/openclaw-discord-pairing.test.ts test/e2e-scenario/live/channels-stop-start.test.ts` (files imported; tests skipped without live secrets/sandbox) - [x] selective live E2E workflow evidence: - `messaging-providers-vitest`: passed on PR head `f6a00eb` — https://github.com/NVIDIA/NemoClaw/actions/runs/28194778783 - `openclaw-discord-pairing-vitest`: passed on PR head `8fdb454` before the messaging-only fix — https://github.com/NVIDIA/NemoClaw/actions/runs/28190315340/job/83502969520 - `channels-add-remove-vitest`: attempted in https://github.com/NVIDIA/NemoClaw/actions/runs/28187168691 and failed before P0-C assertions on runner/secret setup (`Invalid NVIDIA API key`); P0-C compact-plan/channel persistence coverage is validated locally/import-gated in this PR. Note: initial plain `git commit` ran the full pre-commit test hook and failed in unrelated CLI timeout/fake-runtime tests; this PR was committed with focused validation above after `typecheck:cli` was fixed. ## Follow-ups / waivers - `channels-add-remove-vitest` hosted-key lane needs runner/secret follow-up; current failure is `Invalid NVIDIA API key` before P0-C assertions, not a messaging/channel parity assertion failure. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Ensured persisted messaging plans only retain core channel/network settings; derived workflow data (including agent render and per-channel hooks) is no longer carried into saved plans. * **Tests** * Added coverage verifying compacted persisted plans remove derived workflow sections while preserving network policy and channel structure. * Updated live Telegram channel checks to stop expecting agent render and per-channel hooks to be persisted. * Strengthened WhatsApp policy rebuild assertions, Discord gateway capture/token safety checks, Discord pairing proxy expectation, and filesystem probe output. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Restore issue NVIDIA#5800 parity package `P0-E` for merged bash-suite deltas only. ## Related Issues Refs NVIDIA#5800 Refs NVIDIA#5098 Refs NVIDIA#5197 Refs NVIDIA#5245 Refs NVIDIA#5508 Refs NVIDIA#5587 ## Scope gate - Package: `P0-E — Platform, tunnel, cloud-experimental, and docs parity decisions` - Included PRs all merged and touched `test/e2e`: yes — NVIDIA#5197, NVIDIA#5245, NVIDIA#5508, NVIDIA#5587 - Out of scope: unmerged/non-bash PRs; shell lane retirement / PR NVIDIA#5756 cleanup ## Parity map | ID | Source PR | Contract | Inference classification | Vitest assertion / waiver | Status | | --- | --- | --- | --- | --- | --- | | E1 | NVIDIA#5197 | Deep Agents Code cloud-experimental Landlock check: `.deepagents` and `/tmp` writable, `/usr` and `/etc` read-only. | `hosted-compatible capable` | `ubuntu-repo-cloud-langchain-deepagents-code` live scenario now runs `05-deepagents-code-landlock-readonly.sh` after onboarding. | covered | | E2 | NVIDIA#5197 | Deep Agents Code arbitrary Python egress permits GitHub/PyPI and blocks Tavily/LangSmith/MCP/example.com absent explicit policy. | `hosted-compatible capable` | `ubuntu-repo-cloud-langchain-deepagents-code` live scenario now runs `06-deepagents-code-python-egress.sh` after onboarding. | covered | | E3 | NVIDIA#5245 | Trace timing signal is trusted summary only; raw target-controlled traces are not uploaded. | `none` | Existing `test/e2e-script-workflow.test.ts` and sanitizer tests cover trusted trace summary, scorecard comparison, and redaction boundary. | covered | | E4 | NVIDIA#5508 | GPU Local Ollama small-context config carries reduced OpenClaw compaction reserve. | `none` / local inference | `test/e2e-scenario/live/gpu-e2e.test.ts` now reads `/sandbox/.openclaw/openclaw.json` and asserts `reserveTokens` / `reserveTokensFloor` for small windows. | covered | | E5 | NVIDIA#5508 | Interactive OpenClaw TUI first turn must not fail auto-compaction. | `none` / local inference | No Vitest TUI fixture exists yet; config-level assertion covers the deterministic contract and the interactive smoke remains platform/manual-runner follow-up. Owner: NemoClaw maintainers; date: 2026-06-25; tracked in NVIDIA#5800 closeout. | waived/follow-up | | E6 | NVIDIA#5587 | Cloudflared exact-version override validates Debian version syntax before APT install. | `hosted-compatible capable` for live tunnel job; resolver itself `none` | Existing `test/cloudflared-version-resolver.test.ts`; tunnel workflow boundary already requires resolver use before `apt-get install cloudflared=${cf_version}`. | covered | ## Inference mode support - Default mode for touched live targets: `hosted-compatible capable` for Deep Agents Code and tunnel lifecycle; local Ollama/GPU uses local inference; trace/resolver tests are `none`. - Real inference support preserved: yes for Deep Agents Code scenario via `NVIDIA_INFERENCE_API_KEY`; yes for tunnel lifecycle via existing hosted-compatible route; local Ollama GPU remains local inference. - Modes validated in this PR: local unit/support tests plus live scenario selection without secret; selective hosted/GPU workflow dispatch required after PR opens. - If not validated with real inference: local machine lacks `NVIDIA_INFERENCE_API_KEY`, GPU runner, and Docker daemon; selective GitHub Actions will validate runner/secret boundaries. ## Validation - [x] `npm run build:cli` - [x] `npx vitest run test/e2e-scenario/support-tests/e2e-scenario-matrix.test.ts test/e2e-scenario/support-tests/e2e-scenario-registry.test.ts test/langchain-deepagents-code-image.test.ts test/ollama-local-openclaw-config-propagation.test.ts test/cloudflared-version-resolver.test.ts --silent=false --reporter=default` - [x] `NEMOCLAW_RUN_E2E_SCENARIOS=1 npx vitest run --project e2e-scenarios-live test/e2e-scenario/live/registry-scenarios.test.ts -t '^ubuntu-repo-cloud-langchain-deepagents-code$' --silent=false --reporter=verbose` (local result: skipped due missing `NVIDIA_INFERENCE_API_KEY`, confirms scenario wiring) - [ ] hosted/public selective E2E workflow, if required by classification: pending PR dispatch ## Follow-ups / waivers - E5: Interactive TUI first-turn smoke remains waived until a Vitest TUI fixture exists. Owner: NemoClaw maintainers; date: 2026-06-25; deterministic config contract is covered here. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a new cloud onboarding path for LangChain Deep Agents Code, including dedicated fixtures and live scenario coverage. * Surfaced new “cloud experimental” checks in live run planning and scenario matrix output. * **Bug Fixes** * Improved GPU live E2E validation by asserting the reserve-token compaction policy. * Updated Deep Agents Code expected gateway health handling to be optional. * **Security/Policy** * Expanded Deep Agents Code Python egress allowlists for approved GitHub/PyPI hosts. * **Tests** * Updated E2E checks and assertions (including Python egress probe behavior) and adjusted scenario/support-matrix expectations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Restore issue NVIDIA#5849 parity package `Package D` for merged bash-suite deltas only. This package covers the guard-only/source-shape delta from NVIDIA#5158 in `test/e2e/test-onboard-negative-paths.sh`. The active parity assertions now live in the Vitest E2E support project. ## Related Issues Refs NVIDIA#5849 Refs NVIDIA#5158 ## Scope gate - Package: `Package D` / onboard create-plan guard parity - Included PRs all merged and touched `test/e2e`: yes (`NVIDIA#5158` touched `test/e2e/test-onboard-negative-paths.sh`) - Out of scope: unmerged/non-bash PRs; shell lane retirement / PR NVIDIA#5756 cleanup ## Parity map | ID | Source PR | Contract | Inference classification | Vitest assertion / waiver | Status | | --- | --- | --- | --- | --- | --- | | D1 | NVIDIA#5158 | Non-interactive `--from <Dockerfile>` without `--name` or `NEMOCLAW_SANDBOX_NAME` exits before defaulting and prints the explicit missing-name guard. | `none` | `test/e2e-scenario/support-tests/onboard-create-plan-guard-parity.test.ts` | covered | | D2 | NVIDIA#5158 | Non-interactive `--from <Dockerfile>` with `NEMOCLAW_SANDBOX_NAME` proceeds past the missing-name guard and validates the env-provided sandbox name. | `none` | `test/e2e-scenario/support-tests/onboard-create-plan-guard-parity.test.ts` | covered | | D3 | NVIDIA#5158 | Extracted sandbox create-plan preserves active channel resolution, Slack app-token gating, reusable/QR channels, GPU create-mode selection, resource flag ordering, provider cleanup/upsert ordering, and Hermes managed-tool provider attachment. | `none` | Existing `src/lib/onboard/sandbox-create-plan.test.ts` coverage. | covered | | D4 | NVIDIA#5158 | Extracted messaging preflight preserves disabled-channel propagation, stale-plan ignore, matching-token conflict handling, Slack Socket Mode conflict abort, and Brave API-key early abort. | `none` | Existing `src/lib/onboard/sandbox-messaging-preflight.test.ts` coverage. | covered | ## Inference mode support - Default mode for touched live targets: `none` - Real inference support preserved: not applicable - Modes validated in this PR: not applicable; E2E support/source-shape guard only - If not validated with real inference: no onboarding/provider/live inference boundary is touched ## Validation - [x] `git diff --check` - [x] `./node_modules/.bin/vitest run --project e2e-vitest-support test/e2e-scenario/support-tests/onboard-create-plan-guard-parity.test.ts` (using local dependency symlinks from `../issue-5800-p0-d`; symlinks removed before commit) - [x] `./node_modules/.bin/vitest run src/lib/onboard/entry-options.test.ts src/lib/onboard/sandbox-create-plan.test.ts src/lib/onboard/sandbox-messaging-preflight.test.ts` (same local dependency symlink setup) ## Follow-ups / waivers - none ## Local notes - Commit/push hooks were skipped with `--no-verify` because this fresh worktree has no local `node_modules`; hook failures were dependency-resolution only (`tsc`/`tsx`/`vitest`/Biome modules missing), while the targeted Vitest commands above passed with the shared local install. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Added an end-to-end scenario test that verifies onboarding guard behavior for “create-plan” parity, including: * Correct legacy error messaging when prompts aren’t available and a sandbox name isn’t provided. * Proper validation and “Invalid sandbox name” handling when an environment-provided sandbox name fails validation. * Ensures expected exits and messaging remain consistent across supported conditions. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Restore issue NVIDIA#5849 parity package `Package A` for merged bash-suite deltas from NVIDIA#5702 only. This moves the `onboard-resume-vitest` path to the same hermetic fake OpenAI-compatible contract as the late bash guard: - no `NVIDIA_INFERENCE_API_KEY` / hosted `COMPATIBLE_API_KEY` workflow dependency - local fake OpenAI-compatible endpoint started by the Vitest - authenticated fake endpoint request capture asserted - resume runs with both hosted secret env vars absent and must hydrate from gateway/session state ## Related Issues Refs NVIDIA#5849 Refs NVIDIA#5702 ## Scope gate - Package: `Package A` - Included PRs all merged and touched `test/e2e`: yes — NVIDIA#5702 touched `test/e2e/README.md`, `test/e2e/lib/hermetic-compatible-inference.sh`, `test/e2e/test-onboard-resume.sh` - Out of scope: unmerged/non-bash PRs; shell lane retirement / PR NVIDIA#5756 cleanup ## Parity map | ID | Source PR | Contract | Inference classification | Vitest assertion / waiver | Status | | --- | --- | --- | --- | --- | --- | | A1 | NVIDIA#5702 | Onboard-resume uses a local fake OpenAI-compatible endpoint instead of hosted NVIDIA inference secrets. | `hermetic-default` | `test/e2e-scenario/live/onboard-resume.test.ts` starts `startFakeOpenAiCompatibleServer`, sets `NEMOCLAW_PROVIDER=custom` + `COMPATIBLE_API_KEY` only for first onboard, and asserts fake authenticated inference requests. | covered | | A2 | NVIDIA#5702 | Resume run removes both `NVIDIA_INFERENCE_API_KEY` and `COMPATIBLE_API_KEY`, proving credential recovery comes from gateway/session state. | `hermetic-default` | `test/e2e-scenario/live/onboard-resume.test.ts` builds resume env from fixture allowlist and asserts both secret env vars are undefined. | covered | | A3 | NVIDIA#5702 | Selective Vitest workflow routing must not inject hosted inference secrets into onboard-resume. | `hermetic-default` | `.github/workflows/e2e-vitest-scenarios.yaml` removes hosted env/model wiring; `test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts` guards the workflow shape. | covered | | A4 | NVIDIA#5702 | Legacy bash workflow remains hermetic until shell retirement. | `hermetic-default` | Existing `test/e2e-script-workflow.test.ts` guard still covers `nightly-e2e.yaml` / bash lane shape. | already covered | ## Inference mode support - Default mode for touched live targets: `mock/hermetic` - Real inference support preserved: not applicable; this package explicitly removes hosted inference dependency for onboard-resume - Modes validated in this PR: hermetic/source-shape locally; selective `onboard-resume-vitest` workflow required for full live Docker/OpenShell execution - If not validated with real inference: real inference is not required by `hermetic-default`; the regression contract is fake-compatible auth/request capture without hosted secrets ## Validation - [x] `git diff --check` - [x] `npx vitest run --project e2e-vitest-support test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts` - [x] `npx tsc --noEmit --allowImportingTsExtensions --module ESNext --moduleResolution Bundler --target ES2022 --types node,vitest/globals --skipLibCheck test/e2e-scenario/live/onboard-resume.test.ts` - [x] `npx vitest run test/e2e-script-workflow.test.ts` - [x] selective `onboard-resume-vitest` workflow: https://github.com/NVIDIA/NemoClaw/actions/runs/28241580508 ## Follow-ups / waivers - None. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved the resume onboarding flow to work with a local compatible inference endpoint instead of relying on hosted credentials. * Tightened credential handling so sensitive keys are no longer passed into the related setup and test steps. * Updated end-to-end coverage to verify the workflow runs without injecting inference secrets and still completes successfully. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Restore issue NVIDIA#5849 Package F parity for the migrated `rebuild-openclaw-vitest` fixture. The legacy bash test builds `Dockerfile.base` with the full repository as Docker context after temporarily lowering `nemoclaw-blueprint/blueprint.yaml`. The migrated Vitest kept the checkout read-only by staging a minimal context, but after NVIDIA#5682 `Dockerfile.base` also copies `scripts/lib/sandbox-rlimits.sh`, so the Vitest old-base build failed before reaching the rebuild assertions. ## Related Issues Refs NVIDIA#5849 Refs NVIDIA#5800 Refs NVIDIA#5682 ## Scope gate - Package: `Package F — OpenClaw rebuild fixture parity` - Included input: NVIDIA#5682 is the explicit Vitest-fixture exception documented in NVIDIA#5849; it did not touch legacy bash, but exposed migrated Vitest setup drift against the bash reference. - Bash reference: `test/e2e/test-rebuild-openclaw.sh` - Out of scope: shell lane retirement / PR NVIDIA#5756 cleanup; OpenClaw version bump PR NVIDIA#5595; Hermes rebuild fixes. ## Parity map | ID | Source / evidence | Contract | Vitest assertion / fix | Status | | --- | --- | --- | --- | --- | | F1 | NVIDIA#5682, run 28214953054 | Migrated OpenClaw rebuild Vitest must build the old base with every direct `Dockerfile.base` context dependency needed by the bash full-repo build. | `createOldBaseBuildContext()` now stages `nemoclaw-blueprint/blueprint.yaml` and `scripts/lib/sandbox-rlimits.sh` before building `Dockerfile.base`. | covered | | F2 | Future `Dockerfile.base` COPY drift | If `Dockerfile.base` gains another direct `COPY`, the Package F fixture must fail fast before live E2E runtime. | New support test `test/e2e-scenario/support-tests/rebuild-openclaw-old-base-context.test.ts` checks direct `Dockerfile.base` COPY sources are represented in the old-base context list. | covered | ## Inference mode support - Default mode for touched live target: existing `public-nvidia` / hosted path for `rebuild-openclaw-vitest`; no inference mode behavior changed. - Real inference support preserved: yes; this PR only fixes pre-rebuild Docker build fixture setup. - Modes validated in this PR: local support/unit/build/typecheck. Live Docker validation requires GitHub runner because local Docker daemon is unavailable. ## Validation - [x] `npx vitest run --project e2e-vitest-support test/e2e-scenario/support-tests/rebuild-openclaw-old-base-context.test.ts` - [x] `npm run build:cli` - [x] `npm run typecheck:cli` - [x] `git diff --check` - [ ] Selective `rebuild-openclaw-vitest` workflow on PR branch ## Follow-ups / waivers - Local live run not attempted because Docker daemon is unavailable on this machine (`Cannot connect to the Docker daemon at unix:///Users/jyaunches/.docker/run/docker.sock`). Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added end-to-end helper utilities to generate a temporary legacy Docker build context, stage required direct `COPY` sources, and rewrite the blueprint’s minimum OpenClaw version. * **Bug Fixes** * Strengthened Dockerfile parsing to include only supported direct `COPY` sources while excluding non-matching variants and secret-related inputs. * **Tests** * Added e2e test coverage for legacy context creation, correct `COPY` source selection, error handling for unsupported paths, and automatic cleanup of temp directories. * **Refactor** * Reused the shared legacy build-context helper in the rebuild scenario. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Restore issue NVIDIA#5849 parity package `Package B` for PR NVIDIA#5802 hotfix stabilizer bash-suite deltas. ## Related Issues Refs NVIDIA#5849 Refs NVIDIA#5802 ## Scope gate - Package: `Package B` / `test(e2e): audit hotfix stabilizer parity` - Included PRs all merged and touched `test/e2e`: yes — NVIDIA#5802 is merged and touched `test/e2e/lib/openclaw-json.sh`, `test/e2e/test-channels-add-remove.sh`, `test/e2e/test-common-egress-agent-e2e.sh`, `test/e2e/test-kimi-inference-compat.sh`, and `test/e2e/test-openclaw-inference-switch.sh` - Out of scope: unmerged/non-bash PRs; shell lane retirement / PR NVIDIA#5756 cleanup; Package C Hermes v2026.6.19 audit rows ## Parity map | ID | Source PR | Contract | Inference classification | Vitest assertion / waiver | Status | | --- | --- | --- | --- | --- | --- | | B1 | NVIDIA#5802 | Kimi mock trajectories stay strict for split `hostname`/`date`/`uptime`, while public NVIDIA mode may choose fewer safe exec calls but must not record a combined shell command | `public-nvidia required` with `mock` fallback | `test/e2e-scenario/live/kimi-inference-compat-helpers.ts`; `test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts` | covered | | B2 | NVIDIA#5802 | OpenClaw inference-switch agent reply accepts deterministic `PONG` even when wrapped by model/stream whitespace | `hosted-compatible capable` | `test/e2e-scenario/live/openclaw-inference-switch.test.ts` | covered | | B3 | NVIDIA#5802 | Channels add/remove post-remove rebuild must not use stale host Telegram env inputs to stage a fresh channel add | `hosted-compatible capable` | `test/e2e-scenario/live/channels-add-remove.test.ts` now rebuilds after remove with base env only | covered | | B4 | NVIDIA#5802 | Common-egress OpenClaw/Hermes reference-agent token checks tolerate wrapped `REFERENCE_AGENT_OK` / `HERMES_REFERENCE_AGENT_OK` tokens | `hosted-compatible capable` | Existing `test/e2e-scenario/live/common-egress-agent.test.ts` parser/token tests | already covered | | B5 | NVIDIA#5802 | Sessions admin RPC uses local/backend OpenClaw gateway path, avoids multiline OpenShell args, preserves stdout/stderr diagnostics, redacts token-shaped failures | `none` | Existing `src/lib/actions/sandbox/sessions/gateway-rpc-call.test.ts`, `src/lib/adapters/openshell/client.test.ts`, and `src/lib/security/redact` coverage | already covered | | B6 | NVIDIA#5802 | `openclaw-json` helper accepts wrapped deterministic reply tokens | `none` | Existing `test/openclaw-agent-json.test.ts` and `test/helpers/e2e-answer-assertions.test.ts`; live migrated tests use equivalent token compaction | already covered | ## Inference mode support - Default mode for touched live targets: `mock/hermetic` for Kimi fallback; hosted-compatible/public routes remain opt-in/live-runner validated - Real inference support preserved: yes — Kimi public NVIDIA mode remains explicit; OpenClaw inference switch/common-egress/channels live scenarios still use hosted-compatible/public credentials as before - Modes validated in this PR: focused local support/unit coverage and non-destructive live-project filtered assertions; full live E2E requires selective workflow/runner secrets - If not validated with real inference: full live scenarios install/onboard real sandboxes and require CI runner secrets; this PR preserves those paths but does not execute them locally ## Validation - [x] `git diff --check` - [x] `npm run typecheck:cli` - [x] `npx vitest run --project e2e-vitest-support test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts` - [x] `npx vitest run src/lib/actions/sandbox/sessions/gateway-rpc-call.test.ts src/lib/adapters/openshell/client.test.ts test/openclaw-agent-json.test.ts test/helpers/e2e-answer-assertions.test.ts` - [x] `NEMOCLAW_RUN_E2E_SCENARIOS=1 npx vitest run --project e2e-scenarios-live test/e2e-scenario/live/common-egress-agent.test.ts test/e2e-scenario/live/openclaw-inference-switch.test.ts --testNamePattern 'common-egress agent|reply matching'` - [ ] selective live E2E workflow for Package B targets, if requested/available Notes: - `git commit` hooks ran repository-wide CLI tests and failed on unrelated local setup/timeouts (`nemoclaw/dist` missing, `nemoclaw/node_modules/json5` missing, several 5s local timeouts). Commit/push used `--no-verify` after targeted Package B validations passed. - First normal push pre-push hook was killed by signal 9; branch was pushed with `--no-verify`. ## Follow-ups / waivers - None for Package B rows. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved post-channel removal rebuild behavior to prevent reuse of Telegram-related environment inputs. * Enhanced OpenClaw “PONG” verification to reliably detect whitespace-split tokens while rejecting partial or surrounding-text variants. * Strengthened Kimi inference/trajectory validation with stricter handling of tool/meta and source-command sequencing, including detection of unsafe leftovers. * **Tests** * Updated Kimi live end-to-end checks to validate results using the selected inference mode. * Expanded compatibility-mode tests with structured trajectory summary assertions and new negative cases for malformed or unsafe source commands. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary `channels start` re-enabled the persisted messaging plan without re-applying the channel's network-policy preset. Once rebuild began truthfully pruning disabled presets in NVIDIA#5856, the next rebuild no longer had stale registry state to restore, so a restarted channel could have correct agent config but inactive egress policy. Re-apply the preset at the channel action boundary and fail closed by restoring the disabled plan when policy application fails. ## Related Issue Contributes to NVIDIA#5919. Blocks the final `channels-stop-start` cutover proof in NVIDIA#5756; follow-up to NVIDIA#5856. ## Changes - Re-apply the manifest-owned channel policy preset during `channels start`, before an immediate or queued rebuild. - Use action-correct recovery guidance for failed `channels start` policy application. - Roll the messaging plan back to disabled and skip rebuild when the preset cannot be applied. - Cover interactive ordering, the exact non-interactive queued-rebuild path, and failure rollback. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: restores the already-documented `channels start` contract; no command or configuration surface changes. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: pending independent messaging/policy review. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [x] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Verification details: - focused channel/rebuild suite: 68 passed - `npm run typecheck:cli` - `make check` - full non-live suite at the source-change head: 2,421 suites passed; 9,689 tests passed; 26 skipped; 0 failed; subsequent commits are test-only and pass focused suites plus normal hooks - normal signed commit and push hooks --- Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved Teams channel start flow by reapplying the required policy preset before any rebuild is queued. * In non-interactive mode with Teams disabled, the preset is reapplied first; rebuilds are not queued and “Change queued” is logged. * If preset reapplication (or rollback) fails, the channel’s disabled state is restored, the process exits, and recovery guidance is shown (including “Could not restore 'teams' to disabled state” when applicable). * **Tests** * Added coverage for preset/rebuild call order and failure/rollback scenarios. * Added a “dry run” test to ensure no rebuild or preset actions occur and the expected message is logged. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Retires the remaining legacy shell-driven E2E lanes for NVIDIA#5098 Phase 11 and makes the surviving E2E surface a single target/live Vitest workflow. This terminal cleanup deletes the old runner paths, consolidates fixtures and workflow controls, and preserves the operational, docs-validation, and two-agent security-posture coverage landed while the migration was in flight. ## Related Issues - Parent migration: NVIDIA#5098 - Cutover acceptance and post-merge burn-in: NVIDIA#5919 ## Changes - Replace `.github/workflows/e2e-vitest-scenarios.yaml` with `.github/workflows/e2e.yaml`; remove the legacy nightly/script workflows and shared script action. - Move E2E fixtures, live tests, registry, manifests, support tests, and migration docs under `test/e2e/` with target/live naming. - Delete converted `test/e2e/test-*.sh` entrypoints and the retired shell-runner test/support code while retaining implementation shell fixtures used by Vitest. - Rename target advisor files/schema under `tools/e2e-advisor/`, remove auto-dispatch, and align PR Review Advisor terminology. - Preserve NVIDIA#6012 controls: inventory-derived selection, fail-closed selectors, complete aggregation, PR reporting, scheduled failure issues, timing sanitization, and scorecards. - Preserve NVIDIA#6013 behavior: multiline sandbox scripts plus default-enabled `docs-validation` and two-agent `security-posture` jobs in the final workflow/path/project model. - Keep parity decisions and execution evidence in NVIDIA#5919; exact-head full, explicit-only, malformed-selector, and selective-dispatch runs are linked there. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: exact-head CodeQL/GHAS and NVIDIA#5919 domain approvals are pending - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: CodeRabbit could not perform a line review because the 409-file cutover exceeds its 300-file service limit; exact-head GPT-5.5 and Nemotron findings are dispositioned in PR comments, while human NVIDIA#5919 domain review remains pending ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [x] Full `npm test` passes (broad runtime changes only) - [ ] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — passed with 0 errors and 2 existing Fern warnings - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Carlos Villela <cvillela@nvidia.com> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Refreshes the v0.0.70 release docs from the release announcement and the `v0.0.69..v0.0.70` commit range. It also documents the `channels start` policy restoration behavior that was missing from the shared OpenClaw and Hermes command references, and bumps the Fern CLI version used for docs validation. ## Changes - Replaced the stale `v0.0.70` release-notes entry with the actual release themes, including CLI, onboarding, inference, messaging, Windows, documentation, and release-validation changes. - Documented that `channels start` reapplies the matching built-in network policy preset before rebuild and rolls back to disabled if policy restoration fails. - Bumped `fern/fern.config.json` from `5.55.0` to `5.59.0` for the docs refresh. - Source summary: - NVIDIA#5754 -> `docs/about/release-notes.mdx`: Notes Docker Desktop gateway bridge retry behavior during onboarding. - NVIDIA#5930 -> `docs/about/release-notes.mdx`: Links `nemoclaw use` default sandbox selection to the command reference. - NVIDIA#5948 -> `docs/about/release-notes.mdx`: Links reasoning-compatible endpoint validation to inference documentation. - NVIDIA#5950 -> `docs/about/release-notes.mdx`: Links Windows bootstrap WSL recovery behavior to Windows preparation and troubleshooting docs. - NVIDIA#5856 -> `docs/about/release-notes.mdx`: Notes rebuilt policy preset registry repair. - NVIDIA#5882 and NVIDIA#5949 -> `docs/about/release-notes.mdx`: Notes Hermes stale base-image state repair. - NVIDIA#6016 -> `docs/reference/commands.mdx`, `docs/reference/commands-nemohermes.mdx`, and `docs/manage-sandboxes/messaging-channels.mdx`: Documents channel policy restoration and rollback on `channels start`. - NVIDIA#5859 -> `docs/about/release-notes.mdx`: Links quickstart network approval guidance. - NVIDIA#5863 -> `docs/about/release-notes.mdx`: Links Teams allowlist guidance in the messaging page. - NVIDIA#5756, NVIDIA#5926, NVIDIA#6010, and NVIDIA#6011 -> `docs/about/release-notes.mdx`: Summarizes the Vitest E2E validation cutover. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: doc-only prose refresh with no runtime behavior change. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) `npm run docs` exited 0 and Fern reported one existing light-mode accent contrast warning. `fern check --warnings` confirmed the warning is the site theme contrast ratio, not content introduced by this PR. --- Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
) (NVIDIA#6144) ## Summary The `build-hermes-sandbox-image` job in `.github/workflows/sandbox-images-and-e2e.yaml` ran the Hermes sandbox secret-boundary Vitest test (`npx vitest`) **before** the `Set up Node` and `Install root dependencies` steps. On a clean hosted runner there is no root `node_modules`, so `npx` pulled an ad-hoc `vitest` that could not resolve `vitest/config` from the repo's `vitest.config.ts`, failing the job with `Cannot find module 'vitest/config'`. This moves the Node setup + install steps ahead of the first Vitest invocation. ## Related Issue Fixes NVIDIA#6143 ## Changes - Move `Set up Node` and `Install root dependencies` (`npm ci --ignore-scripts`) to run immediately after `Resolve Hermes base image`, before `Build Hermes production image` and both Hermes Vitest steps. - New step order: Checkout → Resolve base image → Set up Node → Install deps → Build/verify Hermes image → secret-boundary Vitest → root-entrypoint smoke Vitest. - Net diff is a pure reorder (9 insertions / 9 deletions); no step content changed. The ordering regressed in NVIDIA#5756 (commit `8120223922bf`). ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [x] Tests not applicable — justification: CI workflow step reorder; correctness is a CI-runner behavior (dependencies present before Vitest), validated by the job's own run plus a host A/B below. No unit-testable surface. - [x] Docs not applicable — justification: internal CI workflow only; no user-facing surface. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: touches only CI step ordering in one workflow job; the Hermes secret-boundary and smoke tests, their env, and commands are unchanged — only the position of the standard `setup-node` + `npm ci` steps moved earlier. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push - [x] Targeted validation: YAML parses; prek hooks (`check yaml`, whitespace, etc.) pass on the file; step order confirmed. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed ### Host A/B verification (`local-jama@10.176.198.59`) Reproduced the exact failure and confirmed the fix's premise without running the heavy live Docker test: - **Before `npm install`** (simulating the old ordering — Vitest with no root `node_modules`): `npx vitest list … hermes-sandbox-secret-boundary.test.ts` fails with `Cannot find module 'vitest/config'` — matches the reported CI error. - **After `npm install`** (the new ordering — deps present first): the same `vitest list` resolves `vitest.config.ts` and discovers the test with no ad-hoc `npx` install. (Results pasted in the completion notification.) Definitive check: this PR's own `build-hermes-sandbox-image` job on a fresh runner. --- Signed-off-by: Jason Ma <jama@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the sandbox image and end-to-end pipeline to prepare dependencies earlier in the run, helping the job execute more smoothly and consistently. * Streamlined setup steps in the workflow by removing duplicate preparation later in the process. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Jason Ma <jama@nvidia.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Retires the remaining legacy shell-driven E2E lanes for #5098 Phase 11 and makes the surviving E2E surface a single target/live Vitest workflow. This terminal cleanup deletes the old runner paths, consolidates fixtures and workflow controls, and preserves the operational, docs-validation, and two-agent security-posture coverage landed while the migration was in flight.
Related Issues
Changes
.github/workflows/e2e-vitest-scenarios.yamlwith.github/workflows/e2e.yaml; remove the legacy nightly/script workflows and shared script action.test/e2e/with target/live naming.test/e2e/test-*.shentrypoints and the retired shell-runner test/support code while retaining implementation shell fixtures used by Vitest.tools/e2e-advisor/, remove auto-dispatch, and align PR Review Advisor terminology.docs-validationand two-agentsecurity-posturejobs in the final workflow/path/project model.Type of Change
Quality Gates
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only) — passed with 0 errors and 2 existing Fern warningsSigned-off-by: Carlos Villela cvillela@nvidia.com