test(e2e): restore onboard rebuild lifecycle parity

[jyaunches]

Summary

Restore issue #5800 parity package P0-B for merged onboard/rebuild/lifecycle bash-suite deltas only.

Related Issues

Refs #5800
Refs #5098
Refs #5225
Refs #5487
Refs #5410
Refs #5760

Scope gate

• Package: P0-B — Onboard/rebuild/lifecycle parity
• Included PRs all merged and touched test/e2e: yes — fix(sandbox): resolve gateway from persisted sandbox entry #5225, fix(onboard): auto-detect resume from an in_progress session #5487, refactor(messaging): clean up provider credential hashes from SandboxEntry (registry) #5410, fix(e2e): stabilize hosted inference and messaging rebuild #5760
• Out of scope: unmerged/non-bash PRs; shell lane retirement / PR test(e2e): retire legacy shell lanes #5756 cleanup

Parity map

ID	Source PR	Contract	Inference classification	Vitest assertion / waiver	Status
B1	#5225	Persisted sandbox-entry gateway resolution is used by lifecycle commands.	none	Existing src/lib/actions/sandbox/sandbox-gateway-routing.test.ts, src/lib/onboard/gateway-binding.test.ts, src/lib/onboard/sandbox-registration.test.ts	covered
B2	#5225	Onboard repair/double-onboard failures include captured onboard output diagnostics.	none	Existing live test/e2e-scenario/live/onboard-repair.test.ts, test/e2e-scenario/live/double-onboard.test.ts; diagnostics are bash-runner-only verbosity and not a durable Vitest assertion.	waived
B3	#5487	Plain nemoclaw onboard auto-detects an in_progress session and resumes without --resume; --fresh suppresses auto-resume.	hosted-compatible capable	test/e2e-scenario/live/onboard-resume.test.ts Phase 3.5 mutates the completed session to in_progress, asserts (resume mode) + cached skips, then asserts --fresh fails at injected preflight without resume banner.	covered
B4	#5410	Rebuild resumes messaging from messaging.plan rather than legacy providerCredentialHashes; stale top-level provider hash state is not used.	none	test/e2e-scenario/live/rebuild-hermes.test.ts curated registry omits providerCredentialHashes; src/lib/onboard/machine/handlers/sandbox.test.ts refreshes registry-plan credential hashes from env on rebuild resume.	covered
B5	#5410	Empty/staged rebuild messaging plan is preserved and token-backed channels are not rediscovered.	none	Existing src/lib/actions/sandbox/rebuild-messaging-stage.test.ts and src/lib/onboard/machine/handlers/sandbox.test.ts.	covered
B6	#5760	Hosted-inference/messaging rebuild and live answer assertions tolerate model whitespace around integer 42.	hosted-compatible capable	Existing test/helpers/e2e-answer-assertions.test.ts, consumed by agent-turn-latency, full-e2e, launchable-smoke, and sandbox-operations live Vitests.	covered
B7	#5760	Stabilized hosted inference and messaging rebuild remain validated by live full/sandbox/launchable/rebuild targets.	hosted-compatible capable	Existing live targets remain unchanged; local live execution blocked by Docker daemon unavailable. Selective workflow required after PR opens.	follow-up

Inference mode support

• Default mode for touched live targets: hosted-compatible capable for onboard-resume/rebuild-hermes/full/sandbox/launchable answer paths; none for unit/process registry and gateway routing tests.
• Real inference support preserved: yes for existing hosted-compatible live targets; no new inference adapter seam added here.
• Modes validated in this PR: local unit/process Vitests only; live hosted-compatible validation needs GitHub runner/secrets because local Docker daemon is unavailable.
• If not validated with real inference: local NEMOCLAW_RUN_E2E_SCENARIOS=1 npx vitest run --project e2e-scenarios-live test/e2e-scenario/live/onboard-resume.test.ts test/e2e-scenario/live/rebuild-hermes.test.ts failed at prereq Docker daemon check before scenario assertions.

Validation

• git diff --check
• npm test -- src/lib/onboard/machine/handlers/sandbox.test.ts test/helpers/e2e-answer-assertions.test.ts src/lib/actions/sandbox/sandbox-gateway-routing.test.ts src/lib/onboard/entry-options.test.ts src/lib/onboard/sandbox-registration.test.ts src/lib/actions/sandbox/rebuild-messaging-stage.test.ts
• npm run typecheck:cli
• npm run build:cli
• npm run test-size:check
• hosted-compatible selective E2E workflow: pending PR / runner dispatch

Follow-ups / waivers

• Waiver B2: bash-only diagnostic verbosity from fix(sandbox): resolve gateway from persisted sandbox entry #5225 is not a durable Vitest contract; existing live tests already preserve the functional repair/double-onboard behavior.
• Follow-up B7: dispatch selective live Vitest scenarios on GitHub runner with Docker + hosted inference secret after PR opens.

Summary by CodeRabbit

• Tests
  • Added coverage for sandbox resume flows to verify updated Telegram credentials are picked up when resuming a rebuild.
  • Expanded end-to-end onboarding resume scenarios to confirm implicit resume behavior, including skipped cached steps and fresh runs starting from the expected point.
  • Strengthened rebuild scenario checks to ensure curated registry entries no longer include legacy credential-hash data.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1459015c-fd0f-43e1-8ed3-c89968aa3409

📥 Commits

Reviewing files that changed from the base of the PR and between 9b25f72 and 4aee2a9.

📒 Files selected for processing (3)

• src/lib/onboard/machine/handlers/sandbox.test.ts
• test/e2e-scenario/live/onboard-resume.test.ts
• test/e2e-scenario/live/rebuild-hermes.test.ts

---

📝 Walkthrough

Walkthrough

Adds test coverage for onboarding resume state handling and rebuild-related registry credential hashes. It also adds an implicit resume scenario, a fresh-mode override check, and an assertion that curated rebuild registry entries do not carry legacy provider credential hashes.

Changes

Onboarding resume and rebuild registry coverage

Layer / File(s)	Summary
Session state helper test/e2e-scenario/live/onboard-resume.test.ts	Adds a helper that rewrites the onboard session JSON to status: "in_progress" with resumable enabled.
Implicit resume phase test/e2e-scenario/live/onboard-resume.test.ts	Adds Phase 3.5 that runs nemoclaw onboard --non-interactive and --fresh --non-interactive against the injected in-progress session state.
Registry credential hashes src/lib/onboard/machine/handlers/sandbox.test.ts, test/e2e-scenario/live/rebuild-hermes.test.ts	Adds a sandbox test that refreshes Telegram credential hashes from TELEGRAM_BOT_TOKEN and an e2e assertion that curated rebuild registry entries omit providerCredentialHashes.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related issues

• Epic: Restore Vitest parity for post-migration bash E2E changes #5800 — Adds onboarding/rebuild resume coverage and sandbox credential-hash behavior that matches the lifecycle parity objective.

Suggested labels

area: onboarding, area: cli, bug-fix, v0.0.68

Suggested reviewers

• cv

Poem

(_/)
(•ㅅ•) I hop through resume trails at dawn,
/ 　 づ old hashes fade, new tokens spawn.
I nudge the session, brisk and neat,
and skip the crumbs of yesterday’s feet.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: restoring onboard/rebuild lifecycle parity in e2e tests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch e2e-parity/p0-b-onboard-rebuild-lifecycle

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the e2e-parity/p0-b-onbo... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	e2e-parity/p0-b-onbo... 6f228fc	+/-
nemoclaw/src/se...cret-scanner.ts	—	100%	—
nemoclaw/src/commands/slash.ts	—	100%	—
nemoclaw/src/li...bprocess-env.ts	—	100%	—
nemoclaw/src/bl...eprint/state.ts	—	98%	—
nemoclaw/src/onboard/config.ts	—	98%	—
nemoclaw/src/bl...int/snapshot.ts	—	97%	—
nemoclaw/src/bl...print/runner.ts	—	95%	—
nemoclaw/src/co...ration-state.ts	—	94%	—
nemoclaw/src/bl...ate-networks.ts	—	94%	—
nemoclaw/src/index.ts	—	94%	—

TypeScript / code-coverage/cli

The overall coverage in the e2e-parity/p0-b-onbo... branch is 47%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	e2e-parity/p0-b-onbo... 6f228fc	+/-
src/lib/state/o...oard-session.ts	—	91%	—
src/lib/inference/local.ts	—	76%	—
src/lib/sandbox/config.ts	—	72%	—
src/lib/actions...dbox/rebuild.ts	—	71%	—
src/lib/onboard/preflight.ts	—	64%	—
src/lib/actions...licy-channel.ts	—	60%	—
src/lib/state/sandbox.ts	—	55%	—
src/lib/onboard...er-gpu-patch.ts	—	50%	—
src/lib/policy/index.ts	—	49%	—
src/lib/onboard.ts	—	19%	—

---

_{Updated June 25, 2026 17:19 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

E2E Advisor Recommendation

Required E2E: None
Optional E2E: onboard-resume-vitest, rebuild-hermes-vitest, rebuild-hermes-stale-base-vitest

Dispatch hint: onboard-resume-vitest,rebuild-hermes-vitest,rebuild-hermes-stale-base-vitest

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• None. No merge-blocking E2E is required because the PR is tests-only and does not change runtime installer/onboarding, sandbox lifecycle, credential, security, network-policy, inference, deployment, or assistant-flow code.

Optional E2E

• onboard-resume-vitest (medium): Validates the changed live onboard-resume scenario, including the new implicit-resume and --fresh suppression assertions.
• rebuild-hermes-vitest (high): Validates the changed Hermes rebuild live scenario in its primary mode, including registry/session messaging credential assertions.
• rebuild-hermes-stale-base-vitest (high): The same modified rebuild-hermes.test.ts file is also exercised by the stale-base rebuild lane; run if you want confidence that the shared assertions work in both modes.

New E2E recommendations

• None.

Dispatch hint

• Workflow: .github/workflows/e2e-vitest-scenarios.yaml
• jobs input: onboard-resume-vitest,rebuild-hermes-vitest,rebuild-hermes-stale-base-vitest

[github-actions]

Vitest E2E Scenario Recommendation

Required Vitest E2E scenarios: onboard-resume-vitest, rebuild-hermes-stale-base-vitest, rebuild-hermes-vitest
Optional Vitest E2E scenarios: None

Dispatch required Vitest E2E scenarios:

• gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=onboard-resume-vitest
• gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=rebuild-hermes-stale-base-vitest
• gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=rebuild-hermes-vitest

Workflow run

Full Vitest E2E advisor summary

Vitest E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required Vitest E2E scenarios

• onboard-resume-vitest: Focused free-standing Vitest job wired for changed live test test/e2e-scenario/live/onboard-resume.test.ts.
  • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=onboard-resume-vitest
• rebuild-hermes-stale-base-vitest: Focused free-standing Vitest job wired for changed live test test/e2e-scenario/live/rebuild-hermes.test.ts.
  • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=rebuild-hermes-stale-base-vitest
• rebuild-hermes-vitest: Focused free-standing Vitest job wired for changed live test test/e2e-scenario/live/rebuild-hermes.test.ts.
  • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=rebuild-hermes-vitest

Optional Vitest E2E scenarios

• None.

Relevant changed files

• src/lib/onboard/machine/handlers/sandbox.test.ts
• test/e2e-scenario/live/onboard-resume.test.ts
• test/e2e-scenario/live/rebuild-hermes.test.ts

[github-actions]

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: Add or justify PRA-T1 and any related test follow-ups.
Open items: 0 required · 0 warnings · 0 suggestions · 5 test follow-ups
Since last review: 0 prior items resolved · 0 still apply · 0 new items found

Action checklist

• PRA-T1 Add or justify test follow-up: Acceptance clause
• PRA-T2 Add or justify test follow-up: Acceptance clause
• PRA-T3 Add or justify test follow-up: Acceptance clause
• PRA-T4 Add or justify test follow-up: Acceptance clause
• PRA-T5 Add or justify test follow-up: Acceptance clause

Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

• PRA-T1 Acceptance clause — Included PRs all merged and touched `test/e2e`: yes — fix(sandbox): resolve gateway from persisted sandbox entry #5225, fix(onboard): auto-detect resume from an in_progress session #5487, refactor(messaging): clean up provider credential hashes from SandboxEntry (registry) #5410, fix(e2e): stabilize hosted inference and messaging rebuild #5760 — add test evidence or identify existing coverage. The current diff directly adds evidence for fix(onboard): auto-detect resume from an in_progress session #5487-style auto-resume/fresh behavior and refactor(messaging): clean up provider credential hashes from SandboxEntry (registry) #5410-style messaging-plan rebuild behavior. Other listed PR coverage is represented by existing tests named in the PR body rather than new changes in this diff; external PR merge state was not evaluated.
• PRA-T2 Acceptance clause — B1 | fix(sandbox): resolve gateway from persisted sandbox entry #5225 | Persisted sandbox-entry gateway resolution is used by lifecycle commands. — add test evidence or identify existing coverage. No current diff touches gateway-resolution lifecycle code. The PR body points to existing tests, but this review focused on changed files and nearby code.
• PRA-T3 Acceptance clause — B2 | fix(sandbox): resolve gateway from persisted sandbox entry #5225 | Onboard repair/double-onboard failures include captured onboard output diagnostics. — add test evidence or identify existing coverage. No current diff adds diagnostic-output assertions. The PR body treats this as a bash-runner-only verbosity waiver; no changed-code acceptance gap was identified.
• PRA-T4 Acceptance clause — B6 | fix(e2e): stabilize hosted inference and messaging rebuild #5760 | Hosted-inference/messaging rebuild and live answer assertions tolerate model whitespace around integer `42`. — add test evidence or identify existing coverage. No current diff touches answer assertion helpers. The PR body references existing helper coverage; this review did not independently execute or evaluate those external live targets.
• PRA-T5 Acceptance clause — B7 | fix(e2e): stabilize hosted inference and messaging rebuild #5760 | Stabilized hosted inference and messaging rebuild remain validated by live full/sandbox/launchable/rebuild targets. — add test evidence or identify existing coverage. The current diff strengthens `rebuild-hermes` live assertions but does not change full/sandbox/launchable targets. External E2E workflow status is intentionally not evaluated in this review.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

[github-actions]

Vitest E2E Scenario Results — ✅ All requested jobs passed

Run: 28186613360
Workflow ref: e2e-parity/p0-b-onboard-rebuild-lifecycle
Requested scenarios: (default — all supported)
Requested jobs: onboard-resume-vitest,rebuild-hermes-vitest
Summary: 2 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
onboard-resume-vitest	✅ success
rebuild-hermes-vitest	✅ success

[jyaunches]

P0-B selective live validation is green: https://github.com/NVIDIA/NemoClaw/actions/runs/28186613360\n\n- onboard-resume-vitest: success\n- rebuild-hermes-vitest: success\n\nRebased/merged branch forward to current main without force-push and re-ran local target checks after updating:\n- npm test -- src/lib/onboard/machine/handlers/sandbox.test.ts test/helpers/e2e-answer-assertions.test.ts src/lib/actions/sandbox/sandbox-gateway-routing.test.ts src/lib/onboard/entry-options.test.ts src/lib/onboard/sandbox-registration.test.ts src/lib/actions/sandbox/rebuild-messaging-stage.test.ts\n- npm run typecheck:cli\n- npm run build:cli

[jyaunches]

Addressing PR Review Advisor test follow-ups for P0-B:\n\n- PRA-T1: Scope gate evidence is in issue #5800 and PR body; #5225, #5487, #5410, and #5760 are merged and touched legacy test/e2e bash files. This PR covers only package P0-B contracts from those merged bash deltas.\n- PRA-T2: #5225 persisted gateway resolution is existing covered behavior in src/lib/actions/sandbox/sandbox-gateway-routing.test.ts, src/lib/onboard/gateway-binding.test.ts, and src/lib/onboard/sandbox-registration.test.ts. Re-tested locally in the target command listed above.\n- PRA-T3: #5225 diagnostic-output additions are waived as bash-runner verbosity, not a durable Vitest behavior contract. Functional repair/double-onboard behavior remains covered by existing live targets.\n- PRA-T4: #5760 whitespace-tolerant integer 42 behavior is existing covered behavior in test/helpers/e2e-answer-assertions.test.ts and consumed by the live tests named in the PR body. Re-tested locally in the target command listed above.\n- PRA-T5: #5760 hosted-compatible rebuild stabilization is validated by the selective live run: https://github.com/NVIDIA/NemoClaw/actions/runs/28186613360 (onboard-resume-vitest and rebuild-hermes-vitest both passed). Full/sandbox/launchable targets are not changed by this PR and are referenced as existing coverage, not required new assertions.\n\nNo additional P0-B code changes are needed from these advisory follow-ups.