Skip to content

test(e2e): restore recovery kimi scope parity - #5808

Merged
jyaunches merged 7 commits into
mainfrom
e2e-parity/p0-d-security-boundary
Jun 25, 2026
Merged

test(e2e): restore recovery kimi scope parity#5808
jyaunches merged 7 commits into
mainfrom
e2e-parity/p0-d-security-boundary

Conversation

@jyaunches

@jyaunches jyaunches commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

Summary

Restore the Kimi-specific issue #5800 parity work for package P0-D; existing recovery and scope-upgrade package rows are explicitly mapped as pre-existing coverage and revalidated context, but not changed acceptance scope in this PR.

Related Issues

Refs #5800
Refs #5098
Refs #5342
Refs #5401
Refs #5406
Refs #5412
Refs #5413
Refs #5625
Refs #5760

Scope gate

  • Package: P0-D — Recovery, Kimi, and scope-upgrade parity
  • Included PRs all merged and touched test/e2e: yes
  • Changed acceptance scope in this PR: Kimi public-NVIDIA/mock parity (D2, D3)
  • Existing package rows revalidated without diff changes: recovery (D1) and scope-upgrade (D4)
  • Out of scope: unmerged/non-bash PRs; shell lane retirement / PR test(e2e): retire legacy shell lanes #5756 cleanup

Parity map

ID Source PR Contract Inference classification Vitest assertion / waiver Status
D1 #5342, #5401 Recovery proxy env sourcing, missing proxy-env warning, guard retention, ciao/networkInterfaces preload, and crash-loop stability are pre-existing package coverage. hermetic-default Existing test/e2e-scenario/live/issue-2478-crash-loop-recovery.test.ts, test/e2e-scenario/support-tests/e2e-recovery-helpers.test.ts; selective run 28186561267 job issue-2478-crash-loop-recovery-vitest passed. No diff changes here. existing / revalidated context
D2 #5401 Kimi remains a public-NVIDIA model/provider contract when run in trusted selective CI, while retaining mock fallback for local/untrusted validation. public-nvidia required .github/workflows/e2e-vitest-scenarios.yaml, test/e2e-scenario/live/kimi-inference-compat.test.ts, test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts, test/e2e-script-workflow.test.ts covered / changed
D3 #5413, #5625 Kimi multiturn tool calls split hostname; date; uptime, preserve tool-result flow, reject abandoned/continue traces, and normalize final punctuation. public-nvidia required with mock fallback test/e2e-scenario/live/kimi-inference-compat-helpers.ts trajectory assertions; selective run 28190216767 job kimi-inference-compat-vitest passed on the previous head; latest run 28193896380 passed on f36fef6da. covered / changed
D4 #5406, #5412, #5760 Scope-upgrade approval tolerates preapproved / not-reproduced states, denies operator.admin leakage, stays on gateway/no embedded fallback, and accepts whitespace-normalized 42; this is pre-existing package coverage. hosted-compatible capable Existing test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts; selective run 28186561267 job issue-4462-scope-upgrade-approval-vitest passed. No diff changes here. existing / revalidated context

Inference mode support

  • Default mode for touched live target: Kimi mock unless workflow selects public-nvidia.
  • Real inference support preserved: yes for Kimi public NVIDIA; yes for existing scope-upgrade hosted-compatible; not required for recovery.
  • Modes validated in this PR: Kimi public NVIDIA via selective workflows 28188683830, 28190216767; latest follow-up validation 28193896380 is running for head f36fef6da. Kimi helper/mock behavior via local support tests.
  • Source-of-truth contract: NEMOCLAW_E2E_INFERENCE_MODE is the canonical selector; absent selector defaults to mock for local/untrusted validation; unknown explicit values now fail closed; legacy NEMOCLAW_KIMI_USE_MOCK=0 remains only as a temporary shell-lane compatibility alias until shell retirement.
  • Secret boundary: public Kimi workflow passes only NVIDIA_API_KEY; helper probe envs are secret-free by default; raw public NVIDIA key handoff is limited to onboard; sandbox openclaw agent now runs with a secret-free env and uses the configured nvidia-prod route.

Validation

  • npx vitest run --project e2e-vitest-support test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts
  • npx vitest run test/e2e-script-workflow.test.ts
  • npm run typecheck:cli
  • npm run test-conditionals:scan -- --top 25
  • npx prek run --all-files --stage pre-push --skip tsc-plugin --skip tsc-js --skip tsc-cli --skip version-tag-sync --skip test-cli --skip test-plugin --skip source-shape-test-budget --skip test-file-size-budget --skip test-skills-yaml
  • git diff --check
  • Kimi selective E2E / Vitest Scenarios on previous head: https://github.com/NVIDIA/NemoClaw/actions/runs/28190216767
  • Kimi selective E2E / Vitest Scenarios after review-gap fixes: https://github.com/NVIDIA/NemoClaw/actions/runs/28193896380
  • Existing recovery/scope rows revalidated in selective run: https://github.com/NVIDIA/NemoClaw/actions/runs/28186561267 (issue-2478-crash-loop-recovery-vitest ✅, issue-4462-scope-upgrade-approval-vitest ✅; Kimi in that stale run was superseded)
  • Local live mock Kimi: attempted but blocked by local Docker daemon unavailable (Cannot connect to the Docker daemon at unix:///Users/jyaunches/.docker/run/docker.sock). CI selective run is the live validation path for this head.

Follow-ups / waivers

  • None.

Summary by CodeRabbit

  • New Features

    • Added support for running Kimi compatibility e2e checks in either mock or public NVIDIA mode.
    • The live scenario now adapts its setup, redaction, and traffic validation based on the selected mode.
  • Bug Fixes

    • Improved handling of API key propagation so public NVIDIA runs use the expected credentials without exposing secrets in other paths.
  • Tests

    • Added coverage for mode selection, API key validation, workflow environment wiring, and the new public NVIDIA Vitest lane.

@coderabbitai

coderabbitai Bot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

The PR adds public-nvidia Kimi inference mode handling to the Vitest workflow, live compatibility helpers, and scenario execution, and extends tests for mode selection, API-key validation, and workflow env wiring.

Changes

Kimi inference compatibility mode wiring

Layer / File(s) Summary
Workflow env contract
.github/workflows/e2e-vitest-scenarios.yaml, test/helpers/e2e-workflow-contract.ts, test/e2e-script-workflow.test.ts
kimi-inference-compat-vitest now carries NEMOCLAW_E2E_INFERENCE_MODE, the workflow contract accepts job env, and the workflow test checks the NVIDIA_API_KEY step env.
Mode helpers and env builder
test/e2e-scenario/live/kimi-inference-compat-helpers.ts, test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts
The helper module adds inference-mode resolution, API-key validation, and mode-specific env construction, and the support tests cover env defaults, secret handling, and mode selection.
Upstream orchestration and trajectory execution
test/e2e-scenario/live/kimi-inference-compat-helpers.ts
The helper module adds boundary strings, mock startup and cleanup wiring, onboard env creation, upstream traffic assertions, and the base64-wrapped trajectory script execution.
Live scenario setup
test/e2e-scenario/live/kimi-inference-compat.test.ts
The live Kimi test resolves mode and API key at runtime, writes mode-specific scenario metadata, and passes mode-aware env and redaction into onboarding and sandbox commands.
Live scenario verification
test/e2e-scenario/live/kimi-inference-compat.test.ts
The live Kimi test makes the models route and tool-agent run mode-aware, removes the smoke agent run, and validates upstream traffic through assertKimiUpstreamTraffic.

Sequence Diagram(s)

sequenceDiagram
  participant Job as kimi-inference-compat-vitest job
  participant Test as kimi-inference-compat.test.ts
  participant CompatHelpers as kimi-inference-compat-helpers.ts
  participant KimiMock as KimiMock
  participant OpenShell as openshell inference get

  Job->>Test: set NEMOCLAW_E2E_INFERENCE_MODE and NVIDIA_API_KEY
  Test->>CompatHelpers: resolveKimiInferenceMode()
  CompatHelpers-->>Test: mock or public-nvidia
  Test->>CompatHelpers: kimiOnboardEnv(...), env(..., { mode })
  alt mock
    Test->>KimiMock: record upstream requests
    Test->>CompatHelpers: assertKimiUpstreamTraffic({ fake })
    CompatHelpers-->>Test: validate fake.requests
  else public-nvidia
    Test->>CompatHelpers: assertKimiUpstreamTraffic({ host, apiKey })
    CompatHelpers->>OpenShell: openshell inference get
    OpenShell-->>CompatHelpers: route output
    CompatHelpers-->>Test: verify output
  end
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related issues

Possibly related PRs

  • NVIDIA/NemoClaw#5600: Both PRs change Vitest workflow env wiring for NVIDIA API key handling in .github/workflows/e2e-vitest-scenarios.yaml.
  • NVIDIA/NemoClaw#5688: Both PRs touch the same Vitest E2E workflow NVIDIA credential env handling, with overlapping job/step env changes.

Suggested labels

area: ci, area: e2e, bug-fix

Suggested reviewers

  • ericksoa
  • cv

Poem

A rabbit hopped through mock and sky,
With keys that fit just snugly by.
The tests now dance in two neat streams,
One path of bytes, one path of dreams.
🐇✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 7.69% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title is concise and clearly references the main parity work around recovery and Kimi scope alignment.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch e2e-parity/p0-d-security-boundary

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the e2e-parity/p0-d-secu... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main e2e-parity/p0-d-secu... f36fef6 +/-
nemoclaw/src/se...cret-scanner.ts 100%
nemoclaw/src/commands/slash.ts 100%
nemoclaw/src/li...bprocess-env.ts 100%
nemoclaw/src/bl...eprint/state.ts 98%
nemoclaw/src/onboard/config.ts 98%
nemoclaw/src/bl...int/snapshot.ts 97%
nemoclaw/src/bl...print/runner.ts 95%
nemoclaw/src/co...ration-state.ts 94%
nemoclaw/src/bl...ate-networks.ts 94%
nemoclaw/src/index.ts 94%

TypeScript / code-coverage/cli

The overall coverage in the e2e-parity/p0-d-secu... branch is 47%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main e2e-parity/p0-d-secu... f36fef6 +/-
src/lib/state/o...oard-session.ts 91%
src/lib/inference/local.ts 76%
src/lib/sandbox/config.ts 72%
src/lib/actions...dbox/rebuild.ts 71%
src/lib/onboard/preflight.ts 64%
src/lib/actions...licy-channel.ts 60%
src/lib/state/sandbox.ts 55%
src/lib/policy/index.ts 49%
src/lib/onboard...er-gpu-patch.ts 44%
src/lib/onboard.ts 19%

Updated June 25, 2026 19:09 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.

@github-actions

github-actions Bot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

E2E Advisor Recommendation

Required E2E: kimi-inference-compat-vitest
Optional E2E: kimi-inference-compat-e2e

Dispatch hint: kimi-inference-compat-vitest

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

  • kimi-inference-compat-vitest (medium): This is the directly modified live Vitest E2E lane. It must run to validate the new public NVIDIA mode selector, NVIDIA_API_KEY wiring, onboarding-time secret handoff, OpenClaw Kimi plugin/config setup, and managed inference route behavior.

Optional E2E

  • kimi-inference-compat-e2e (medium): Optional legacy-shell parity check because the helper keeps a temporary compatibility alias for the former shell lane and the workflow contract references the legacy Kimi E2E secret boundary. Useful if this PR is intended to preserve old and new lane behavior simultaneously.

New E2E recommendations

  • None.

Dispatch hint

  • Workflow: .github/workflows/e2e-vitest-scenarios.yaml
  • jobs input: kimi-inference-compat-vitest

@github-actions

github-actions Bot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Recommendation

Required Vitest E2E scenarios: kimi-inference-compat-vitest
Optional Vitest E2E scenarios: None

Dispatch required Vitest E2E scenarios:

  • gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=kimi-inference-compat-vitest

Workflow run

Full Vitest E2E advisor summary

Vitest E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required Vitest E2E scenarios

  • kimi-inference-compat-vitest: Focused free-standing Vitest job wired for changed live test test/e2e-scenario/live/kimi-inference-compat.test.ts.
    • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=kimi-inference-compat-vitest

Optional Vitest E2E scenarios

  • None.

Relevant changed files

  • .github/workflows/e2e-vitest-scenarios.yaml
  • test/e2e-scenario/live/kimi-inference-compat-helpers.ts
  • test/e2e-scenario/live/kimi-inference-compat.test.ts
  • test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts
  • test/e2e-script-workflow.test.ts
  • test/helpers/e2e-workflow-contract.ts

@github-actions

github-actions Bot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: Add or justify PRA-T1 and any related test follow-ups.
Open items: 0 required · 0 warnings · 0 suggestions · 3 test follow-ups
Since last review: 6 prior items resolved · 0 still apply · 0 new items found

Action checklist

  • PRA-T1 Add or justify test follow-up: Runtime validation
  • PRA-T2 Add or justify test follow-up: Runtime validation
  • PRA-T3 Add or justify test follow-up: Acceptance clause
Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

  • PRA-T1 Runtime validation — Run or identify targeted runtime validation for `kimi-inference-compat-vitest` with `NEMOCLAW_E2E_INFERENCE_MODE=public-nvidia`: onboard should receive the public NVIDIA key, `openclaw agent` should run with `kimiAgentEnv(mode)`, and route assertion should contain `nvidia-prod` plus `moonshotai/kimi-k2.6`.. The changed code is primarily workflow/sandbox/live-inference behavior. Static and support tests cover selector, secret-boundary, and workflow wiring contracts; behavioral confidence still depends on running the Kimi live Vitest lane in the selected mode, which this review does not execute or evaluate.
  • PRA-T2 Runtime validation — Run or identify targeted runtime validation for the hermetic mock path with no `NEMOCLAW_E2E_INFERENCE_MODE`: the fake Kimi endpoint should receive tool-call and tool-result traffic, and `assertTrajectory()` should prove `hostname; date; uptime` was split into three tool executions.. The changed code is primarily workflow/sandbox/live-inference behavior. Static and support tests cover selector, secret-boundary, and workflow wiring contracts; behavioral confidence still depends on running the Kimi live Vitest lane in the selected mode, which this review does not execute or evaluate.
  • PRA-T3 Acceptance clause — Included PRs all merged and touched `test/e2e`: yes — add test evidence or identify existing coverage. Merge state of referenced PRs is outside this code-review surface; the current diff does touch `test/e2e-scenario` and `test/e2e-script-workflow.test.ts`.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ❌ Some jobs failed

Run: 28186561267
Workflow ref: e2e-parity/p0-d-security-boundary
Requested scenarios: (default — all supported)
Requested jobs: kimi-inference-compat-vitest,issue-2478-crash-loop-recovery-vitest,issue-4462-scope-upgrade-approval-vitest
Summary: 2 passed, 1 failed, 0 cancelled, 0 skipped

Job Result
issue-2478-crash-loop-recovery-vitest ✅ success
issue-4462-scope-upgrade-approval-vitest ✅ success
kimi-inference-compat-vitest ❌ failure

Failed jobs: kimi-inference-compat-vitest. Check run artifacts for logs.

@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ❌ Some jobs failed

Run: 28186903410
Workflow ref: e2e-parity/p0-d-security-boundary
Requested scenarios: (default — all supported)
Requested jobs: kimi-inference-compat-vitest
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped

Job Result
kimi-inference-compat-vitest ❌ failure

Failed jobs: kimi-inference-compat-vitest. Check run artifacts for logs.

@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ✅ All requested jobs passed

Run: 28188326056
Workflow ref: e2e-parity/p0-d-security-boundary
Requested scenarios: (default — all supported)
Requested jobs: kimi-inference-compat-vitest
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
kimi-inference-compat-vitest ✅ success

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e-scenario/live/kimi-inference-compat-helpers.ts`:
- Around line 32-36: The mode resolution in resolveKimiInferenceMode should
honor NEMOCLAW_E2E_INFERENCE_MODE before falling back to the legacy
NEMOCLAW_KIMI_USE_MOCK flag, so an explicit "mock" selection is not overridden
by "0". Update the conditional logic in resolveKimiInferenceMode to recognize
both supported explicit values from NEMOCLAW_E2E_INFERENCE_MODE (including
"mock" and "public-nvidia") and only consult NEMOCLAW_KIMI_USE_MOCK when the
explicit mode is unset or unrecognized.

In `@test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts`:
- Around line 49-55: Add a precedence test for resolveKimiInferenceMode to cover
the explicit-vs-legacy conflict: verify that NEMOCLAW_E2E_INFERENCE_MODE="mock"
wins over a stale NEMOCLAW_KIMI_USE_MOCK="0". Update the existing
kimi-inference-compat-helpers test suite by extending the
resolveKimiInferenceMode cases so the resolver behavior is locked down when both
env vars are present.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 03e1d08e-def2-4cb3-89bd-a987a57b3253

📥 Commits

Reviewing files that changed from the base of the PR and between 9b25f72 and ea74648.

📒 Files selected for processing (6)
  • .github/workflows/e2e-vitest-scenarios.yaml
  • test/e2e-scenario/live/kimi-inference-compat-helpers.ts
  • test/e2e-scenario/live/kimi-inference-compat.test.ts
  • test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts
  • test/e2e-script-workflow.test.ts
  • test/helpers/e2e-workflow-contract.ts

Comment thread test/e2e-scenario/live/kimi-inference-compat-helpers.ts
Comment thread test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts Outdated
@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ✅ All requested jobs passed

Run: 28188683830
Workflow ref: e2e-parity/p0-d-security-boundary
Requested scenarios: (default — all supported)
Requested jobs: kimi-inference-compat-vitest
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
kimi-inference-compat-vitest ✅ success

@jyaunches

Copy link
Copy Markdown
Contributor Author

P0-D loop update: addressed advisor scope concern by narrowing changed acceptance to Kimi D2/D3 and documenting D1/D4 as existing rows revalidated by selective run 28186561267. Latest Kimi selective validation passed in run 28188683830 on head 5d68e8d.

@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ✅ All requested jobs passed

Run: 28190216767
Workflow ref: e2e-parity/p0-d-security-boundary
Requested scenarios: (default — all supported)
Requested jobs: kimi-inference-compat-vitest
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
kimi-inference-compat-vitest ✅ success

@jyaunches

Copy link
Copy Markdown
Contributor Author

P0-D loop update: addressed PR Review Advisor Kimi follow-ups on head f36fef6.

  • Explicit NEMOCLAW_E2E_INFERENCE_MODE now fails closed for unknown values instead of falling back to mock.
  • Documented NEMOCLAW_E2E_INFERENCE_MODE as the canonical selector and NEMOCLAW_KIMI_USE_MOCK=0 as a temporary shell-lane compatibility alias.
  • Sandbox openclaw agent now uses kimiAgentEnv(mode), which is secret-free in public-NVIDIA mode; raw public key remains limited to onboard.
  • Added support-test coverage for invalid mode rejection, temporary legacy alias, and secret-free agent env.

Local validation passed: helper support Vitest, workflow contract Vitest, npm run typecheck:cli, conditional scan, pre-push static hook subset, git diff --check. Local live mock attempted but Docker daemon is unavailable on this host; selective CI validation for kimi-inference-compat-vitest is running: https://github.com/NVIDIA/NemoClaw/actions/runs/28193896380

@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ✅ All requested jobs passed

Run: 28193896380
Workflow ref: e2e-parity/p0-d-security-boundary
Requested scenarios: (default — all supported)
Requested jobs: kimi-inference-compat-vitest
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
kimi-inference-compat-vitest ✅ success

@jyaunches

Copy link
Copy Markdown
Contributor Author

P0-D validation update: selective kimi-inference-compat-vitest passed on latest head f36fef6da in run https://github.com/NVIDIA/NemoClaw/actions/runs/28193896380.

@wscurran wscurran added area: e2e End-to-end tests, nightly failures, or validation infrastructure area: inference Inference routing, serving, model selection, or outputs chore Build, CI, dependency, or tooling maintenance labels Jun 25, 2026
@jyaunches
jyaunches merged commit 0803588 into main Jun 25, 2026
121 checks passed
@jyaunches
jyaunches deleted the e2e-parity/p0-d-security-boundary branch June 25, 2026 19:26
@cv cv added the v0.0.69 label Jun 26, 2026
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
## Summary
Restore the Kimi-specific issue NVIDIA#5800 parity work for package `P0-D`;
existing recovery and scope-upgrade package rows are explicitly mapped
as pre-existing coverage and revalidated context, but not changed
acceptance scope in this PR.

## Related Issues
Refs NVIDIA#5800
Refs NVIDIA#5098
Refs NVIDIA#5342
Refs NVIDIA#5401
Refs NVIDIA#5406
Refs NVIDIA#5412
Refs NVIDIA#5413
Refs NVIDIA#5625
Refs NVIDIA#5760

## Scope gate
- Package: `P0-D — Recovery, Kimi, and scope-upgrade parity`
- Included PRs all merged and touched `test/e2e`: yes
- Changed acceptance scope in this PR: Kimi public-NVIDIA/mock parity
(`D2`, `D3`)
- Existing package rows revalidated without diff changes: recovery
(`D1`) and scope-upgrade (`D4`)
- Out of scope: unmerged/non-bash PRs; shell lane retirement / PR NVIDIA#5756
cleanup

## Parity map
| ID | Source PR | Contract | Inference classification | Vitest
assertion / waiver | Status |
| --- | --- | --- | --- | --- | --- |
| D1 | NVIDIA#5342, NVIDIA#5401 | Recovery proxy env sourcing, missing proxy-env
warning, guard retention, ciao/networkInterfaces preload, and crash-loop
stability are pre-existing package coverage. | `hermetic-default` |
Existing
`test/e2e-scenario/live/issue-2478-crash-loop-recovery.test.ts`,
`test/e2e-scenario/support-tests/e2e-recovery-helpers.test.ts`;
selective run `28186561267` job `issue-2478-crash-loop-recovery-vitest`
passed. No diff changes here. | existing / revalidated context |
| D2 | NVIDIA#5401 | Kimi remains a public-NVIDIA model/provider contract when
run in trusted selective CI, while retaining mock fallback for
local/untrusted validation. | `public-nvidia required` |
`.github/workflows/e2e-vitest-scenarios.yaml`,
`test/e2e-scenario/live/kimi-inference-compat.test.ts`,
`test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts`,
`test/e2e-script-workflow.test.ts` | covered / changed |
| D3 | NVIDIA#5413, NVIDIA#5625 | Kimi multiturn tool calls split `hostname; date;
uptime`, preserve tool-result flow, reject abandoned/continue traces,
and normalize final punctuation. | `public-nvidia required` with mock
fallback | `test/e2e-scenario/live/kimi-inference-compat-helpers.ts`
trajectory assertions; selective run `28190216767` job
`kimi-inference-compat-vitest` passed on the previous head; latest run
`28193896380` passed on `f36fef6da`. | covered / changed |
| D4 | NVIDIA#5406, NVIDIA#5412, NVIDIA#5760 | Scope-upgrade approval tolerates
preapproved / not-reproduced states, denies `operator.admin` leakage,
stays on gateway/no embedded fallback, and accepts whitespace-normalized
`42`; this is pre-existing package coverage. | `hosted-compatible
capable` | Existing
`test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts`;
selective run `28186561267` job
`issue-4462-scope-upgrade-approval-vitest` passed. No diff changes here.
| existing / revalidated context |

## Inference mode support
- Default mode for touched live target: Kimi `mock` unless workflow
selects `public-nvidia`.
- Real inference support preserved: yes for Kimi public NVIDIA; yes for
existing scope-upgrade hosted-compatible; not required for recovery.
- Modes validated in this PR: Kimi public NVIDIA via selective workflows
`28188683830`, `28190216767`; latest follow-up validation `28193896380`
is running for head `f36fef6da`. Kimi helper/mock behavior via local
support tests.
- Source-of-truth contract: `NEMOCLAW_E2E_INFERENCE_MODE` is the
canonical selector; absent selector defaults to mock for local/untrusted
validation; unknown explicit values now fail closed; legacy
`NEMOCLAW_KIMI_USE_MOCK=0` remains only as a temporary shell-lane
compatibility alias until shell retirement.
- Secret boundary: public Kimi workflow passes only `NVIDIA_API_KEY`;
helper probe envs are secret-free by default; raw public NVIDIA key
handoff is limited to onboard; sandbox `openclaw agent` now runs with a
secret-free env and uses the configured `nvidia-prod` route.

## Validation
- [x] `npx vitest run --project e2e-vitest-support
test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts`
- [x] `npx vitest run test/e2e-script-workflow.test.ts`
- [x] `npm run typecheck:cli`
- [x] `npm run test-conditionals:scan -- --top 25`
- [x] `npx prek run --all-files --stage pre-push --skip tsc-plugin
--skip tsc-js --skip tsc-cli --skip version-tag-sync --skip test-cli
--skip test-plugin --skip source-shape-test-budget --skip
test-file-size-budget --skip test-skills-yaml`
- [x] `git diff --check`
- [x] Kimi selective E2E / Vitest Scenarios on previous head:
https://github.com/NVIDIA/NemoClaw/actions/runs/28190216767
- [x] Kimi selective E2E / Vitest Scenarios after review-gap fixes:
https://github.com/NVIDIA/NemoClaw/actions/runs/28193896380
- [x] Existing recovery/scope rows revalidated in selective run:
https://github.com/NVIDIA/NemoClaw/actions/runs/28186561267
(`issue-2478-crash-loop-recovery-vitest` ✅,
`issue-4462-scope-upgrade-approval-vitest` ✅; Kimi in that stale run was
superseded)
- [ ] Local live mock Kimi: attempted but blocked by local Docker daemon
unavailable (`Cannot connect to the Docker daemon at
unix:///Users/jyaunches/.docker/run/docker.sock`). CI selective run is
the live validation path for this head.

## Follow-ups / waivers
- None.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added support for running Kimi compatibility e2e checks in either mock
or public NVIDIA mode.
* The live scenario now adapts its setup, redaction, and traffic
validation based on the selected mode.

* **Bug Fixes**
* Improved handling of API key propagation so public NVIDIA runs use the
expected credentials without exposing secrets in other paths.

* **Tests**
* Added coverage for mode selection, API key validation, workflow
environment wiring, and the new public NVIDIA Vitest lane.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: e2e End-to-end tests, nightly failures, or validation infrastructure area: inference Inference routing, serving, model selection, or outputs chore Build, CI, dependency, or tooling maintenance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants