fix(e2e): route gateway guard through hosted inference

[cv]

Summary

Routes the free-standing gateway-guard-recovery Vitest E2E job through the same hosted-compatible inference mode as the other OpenClaw live Vitest jobs. The targeted rerun after #5887 showed the job still selected the public NVIDIA provider and failed early because the CI secret is not nvapi-*.

Changes

• Adds NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1 to the gateway-guard-recovery job environment in .github/workflows/e2e-vitest-scenarios.yaml.
• Adds a workflow boundary test to keep that job on the hosted-compatible route.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: CI/E2E workflow routing only.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-review; change passes only the CI mode flag, not credentials, and keeps the secret on the existing step-level boundary.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
• Git hooks passed during commit and push, or npx prek run --from-ref main --to-ref HEAD passes
• Targeted tests pass for changed behavior
• Full npm test passes (broad runtime changes only)
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

Targeted verification:

npm test -- --run test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts
npm run build:cli
npm run typecheck:cli

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Tests

  • Added an end-to-end workflow check to ensure the relevant Vitest scenario job includes the expected runtime settings.

• Chores

  • Updated the workflow configuration for the recovery scenario to run with hosted inference enabled alongside the existing scenario flags.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6ec661ae-01d1-46be-98af-6f4bc1988f54

📥 Commits

Reviewing files that changed from the base of the PR and between 59d8eb9 and ad86cba.

📒 Files selected for processing (2)

• .github/workflows/e2e-vitest-scenarios.yaml
• test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts

---

📝 Walkthrough

Walkthrough

The gateway-guard-recovery job in the e2e Vitest workflow now sets NEMOCLAW_E2E_USE_HOSTED_INFERENCE: "1". A new support test reads the workflow YAML and checks that hosted-inference and scenario-run flags are both "1".

Changes

Hosted inference workflow flag

Layer / File(s)	Summary
Workflow env flag and validation .github/workflows/e2e-vitest-scenarios.yaml, test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts	gateway-guard-recovery gains NEMOCLAW_E2E_USE_HOSTED_INFERENCE: "1", and the workflow boundary test verifies that flag alongside NEMOCLAW_RUN_E2E_SCENARIOS: "1" in the same job.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• NVIDIA/NemoClaw#5776: Updates the same gateway-guard-recovery workflow job to run with NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1.
• NVIDIA/NemoClaw#5805: Adds validation around the same workflow env flags for gateway-guard-recovery in e2e-vitest-scenarios.yaml.
• NVIDIA/NemoClaw#5698: Wires gateway-guard-recovery to hosted inference through the shared e2e workflow export path.

Suggested labels

area: ci, area: e2e, bug-fix

Suggested reviewers

• jyaunches

Poem

A rabbit hopped through YAML light,
And pinned one flag to make things right.
The guard said “1,” the tests agreed,
With hosted hops for every need.
🐰 Thump-thump, the workflow’s bright.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: routing the gateway guard E2E job through hosted inference.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/gateway-guard-hosted-inference

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the fix/gateway-guard-ho... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	fix/gateway-guard-ho... ad86cba	+/-
nemoclaw/src/se...cret-scanner.ts	—	100%	—
nemoclaw/src/commands/slash.ts	—	100%	—
nemoclaw/src/li...bprocess-env.ts	—	100%	—
nemoclaw/src/bl...eprint/state.ts	—	98%	—
nemoclaw/src/onboard/config.ts	—	98%	—
nemoclaw/src/bl...int/snapshot.ts	—	97%	—
nemoclaw/src/bl...print/runner.ts	—	95%	—
nemoclaw/src/co...ration-state.ts	—	94%	—
nemoclaw/src/bl...ate-networks.ts	—	94%	—
nemoclaw/src/index.ts	—	94%	—

TypeScript / code-coverage/cli

The overall coverage in the fix/gateway-guard-ho... branch is 47%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	fix/gateway-guard-ho... ad86cba	+/-
src/lib/state/o...oard-session.ts	—	91%	—
src/lib/sandbox/config.ts	—	76%	—
src/lib/actions...dbox/rebuild.ts	—	73%	—
src/lib/onboard/preflight.ts	—	62%	—
src/lib/shields/index.ts	—	62%	—
src/lib/actions...licy-channel.ts	—	60%	—
src/lib/state/sandbox.ts	—	56%	—
src/lib/policy/index.ts	—	48%	—
src/lib/onboard...er-gpu-patch.ts	—	47%	—
src/lib/onboard.ts	—	19%	—

---

_{Updated June 27, 2026 01:57 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

E2E Advisor Recommendation

Required E2E: gateway-guard-recovery
Optional E2E: None

Dispatch hint: gateway-guard-recovery

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• gateway-guard-recovery (high): This is the directly modified live E2E job. It should run to verify that the hosted-compatible inference environment change still allows the gateway guard recovery scenario to onboard, exercise recovery, and collect artifacts correctly.

Optional E2E

• None.

New E2E recommendations

• None.

Dispatch hint

• Workflow: .github/workflows/e2e-vitest-scenarios.yaml
• jobs input: gateway-guard-recovery

[github-actions]

Vitest E2E Scenario Recommendation

Required Vitest E2E scenarios: gateway-guard-recovery
Optional Vitest E2E scenarios: None

Dispatch required Vitest E2E scenarios:

• gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=gateway-guard-recovery

Workflow run

Full Vitest E2E advisor summary

Vitest E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required Vitest E2E scenarios

• gateway-guard-recovery: The PR changes the workflow environment for the free-standing gateway guard recovery Vitest job and adds a support test covering that workflow contract, so run the discrete live Vitest job that exercises test/e2e-scenario/live/gateway-guard-recovery.test.ts.
  • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=gateway-guard-recovery

Optional Vitest E2E scenarios

• None.

Relevant changed files

• .github/workflows/e2e-vitest-scenarios.yaml
• test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts

[github-actions]

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: Add or justify PRA-T1 and any related test follow-ups.
Open items: 0 required · 0 warnings · 0 suggestions · 2 test follow-ups

Action checklist

• PRA-T1 Add or justify test follow-up: Runtime validation
• PRA-T2 Add or justify test follow-up: Runtime validation

Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

• PRA-T1 Runtime validation — Run or identify targeted live validation for `gateway-guard-recovery` showing that `NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1` causes onboarding to stage `COMPATIBLE_API_KEY` and the hosted endpoint/model env for the existing `NVIDIA_INFERENCE_API_KEY` secret.. Static workflow-boundary coverage is appropriate for the one-line workflow env contract, but the touched surface is a live sandbox/inference workflow path where runtime validation provides additional confidence that the env reaches onboarding and avoids the default provider route.
• PRA-T2 Runtime validation — Run or identify targeted live validation for `gateway-guard-recovery` showing the job no longer reaches the default NVIDIA-provider credential-prefix failure path when the CI secret is routed through the hosted-compatible mode.. Static workflow-boundary coverage is appropriate for the one-line workflow env contract, but the touched surface is a live sandbox/inference workflow path where runtime validation provides additional confidence that the env reaches onboarding and avoids the default provider route.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

[github-actions]

PR Review Advisor (Nemotron Ultra) — Changes requested

Merge posture: Do not merge yet
Primary next action: Resolve or justify PRA-1: Workflow-boundary validation for gateway-guard-recovery only checks basic structure, not hosted inference flag or step-level secret handling.
Open items: 0 required · 2 warnings · 1 suggestion · 3 test follow-ups
Since last review: 0 prior items resolved · 0 still apply · 0 new items found

Action checklist

• PRA-1 Resolve or justify: Workflow-boundary validation for gateway-guard-recovery only checks basic structure, not hosted inference flag or step-level secret handling in .github/workflows/e2e-vitest-scenarios.yaml:4312
• PRA-2 Resolve or justify: New test verifies job-level env but not step-level NVIDIA_INFERENCE_API_KEY secret reference in test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts:645
• PRA-T1 Add or justify test follow-up: Runtime validation
• PRA-T2 Add or justify test follow-up: Runtime validation
• PRA-T3 Add or justify test follow-up: New test verifies job-level env but not step-level NVIDIA_INFERENCE_API_KEY secret reference
• PRA-3 In-scope improvement: Consider adding dedicated validateGatewayGuardRecoveryVitestJob for defense-in-depth in tools/e2e-scenarios/workflow-boundary.mts:7759

Findings index

ID	Severity	Category	Location	Required action
PRA-1	Resolve/justify	security	.github/workflows/e2e-vitest-scenarios.yaml:4312	Add validateGatewayGuardRecoveryVitestJob function in tools/e2e-scenarios/workflow-boundary.mts mirroring validateChannelsAddRemoveVitestJob pattern, and call it from validateFreeStandingInventoryBoundary.
PRA-2	Resolve/justify	tests	test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts:645	Extend the test to also assert the test step's env block contains NVIDIA_INFERENCE_API_KEY referencing the secret.
PRA-3	Improvement	workflow	tools/e2e-scenarios/workflow-boundary.mts:7759	Implement validateGatewayGuardRecoveryVitestJob following validateChannelsAddRemoveVitestJob pattern, and register it in validateFreeStandingInventoryBoundary. This is a current-PR action since it's local to the changed workflow job.

Review findings by urgency: 0 required fixes, 2 items to resolve/justify, 1 in-scope improvement

⚠️ Resolve or justify before merge

Investigate these in the current review; either fix them, explain why they are not applicable, or document the accepted risk.

PRA-1 Resolve/justify — Workflow-boundary validation for gateway-guard-recovery only checks basic structure, not hosted inference flag or step-level secret handling

• Location: .github/workflows/e2e-vitest-scenarios.yaml:4312
• Category: security
• Problem: The gateway-guard-recovery job is validated only by validateFreeStandingJobSelector (needs/if condition). Unlike channels-add-remove-vitest or openclaw-tui-chat-correlation-vitest, it lacks a dedicated validator that checks NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1, step-level NVIDIA_INFERENCE_API_KEY secret reference, OPENSHELL_GATEWAY=nemoclaw, Docker Hub auth absence, and pinned action SHAs.
• Impact: A regression removing the hosted inference flag or step-level secret reference would not be caught at workflow parse time, only at test runtime.
• Recommended action: Add validateGatewayGuardRecoveryVitestJob function in tools/e2e-scenarios/workflow-boundary.mts mirroring validateChannelsAddRemoveVitestJob pattern, and call it from validateFreeStandingInventoryBoundary.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Search for 'validateFreeStandingJobSelector(errors, jobs, "gateway-guard-recovery");' in workflow-boundary.mts line 7759. Compare with validateChannelsAddRemoveVitestJob which has comprehensive env/step/secret checks.
• Missing regression test: Dedicated workflow-boundary validator function that fails CI if hosted inference flag or step-level secret reference is missing from gateway-guard-recovery job.
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Search for 'validateFreeStandingJobSelector(errors, jobs, "gateway-guard-recovery");' in workflow-boundary.mts line 7759. Compare with validateChannelsAddRemoveVitestJob which has comprehensive env/step/secret checks.
• Evidence: workflow-boundary.mts:7759 calls validateFreeStandingJobSelector for gateway-guard-recovery; validateChannelsAddRemoveVitestJob at line 5728 checks job env, step env for secrets, Docker Hub auth step, pinned actions, checkout persist-credentials=false

PRA-2 Resolve/justify — New test verifies job-level env but not step-level NVIDIA_INFERENCE_API_KEY secret reference

• Location: test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts:645
• Category: tests
• Problem: The test 'keeps gateway guard recovery on the hosted-compatible CI inference route' checks job.env for NEMOCLAW_E2E_USE_HOSTED_INFERENCE and NEMOCLAW_RUN_E2E_SCENARIOS but does not verify the 'Run Vitest gateway-guard-recovery scenario' step has NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}. Hosted-inference.test.ts (lines 197-202) verifies both levels.
• Impact: If the step-level secret reference is accidentally removed, the test would still pass but the workflow would fail at runtime with missing credentials.
• Recommended action: Extend the test to also assert the test step's env block contains NVIDIA_INFERENCE_API_KEY referencing the secret.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Read test at line 645 and compare with hosted-inference.test.ts lines 197-202 which verify both job-level env and step-level secret references via readWorkflow() and step inspection.
• Missing regression test: Assertion in e2e-scenarios-workflow.test.ts that the 'Run Vitest gateway-guard-recovery scenario' step has env.NVIDIA_INFERENCE_API_KEY === '${{ secrets.NVIDIA_INFERENCE_API_KEY }}'.
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Read test at line 645 and compare with hosted-inference.test.ts lines 197-202 which verify both job-level env and step-level secret references via readWorkflow() and step inspection.
• Evidence: e2e-scenarios-workflow.test.ts:645-652 checks job.env only; hosted-inference.test.ts:197-202 pattern verifies step-level secret reference; tunnel-lifecycle-workflow-boundary.test.ts:101 verifies step-level NVIDIA_INFERENCE_API_KEY secret reference

💡 In-scope improvements

These are lower-risk, not throwaway. Prefer fixing them in this PR when they are local to changed code; defer only with rationale or a linked follow-up.

PRA-3 Improvement — Consider adding dedicated validateGatewayGuardRecoveryVitestJob for defense-in-depth

• Location: tools/e2e-scenarios/workflow-boundary.mts:7759
• Category: workflow
• Problem: The gateway-guard-recovery job is a free-standing live test using hosted inference and secrets. It currently only gets basic validation. Adding a dedicated validator would match the pattern used for other live free-standing jobs and catch regressions earlier.
• Impact: Current validation gap means workflow structure drift (missing flag, wrong secret ref, missing OPENSHELL_GATEWAY) would only surface at test runtime, not at workflow lint time.
• Suggested action: Implement validateGatewayGuardRecoveryVitestJob following validateChannelsAddRemoveVitestJob pattern, and register it in validateFreeStandingInventoryBoundary. This is a current-PR action since it's local to the changed workflow job.
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Look at validateChannelsAddRemoveVitestJob (workflow-boundary.mts ~5830) for pattern: checks job env, step env for secrets, Docker Hub auth step, pinned actions, checkout persist-credentials=false.
• Missing regression test: New validator function that emits errors if gateway-guard-recovery job lacks NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1, step-level NVIDIA_INFERENCE_API_KEY secret, OPENSHELL_GATEWAY=nemoclaw, or has unexpected secrets in non-test steps.
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: workflow-boundary.mts:7759 only calls validateFreeStandingJobSelector for gateway-guard-recovery; validateChannelsAddRemoveVitestJob at line 5728 provides comprehensive validation pattern

Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

• PRA-T1 Runtime validation — Extend e2e-scenarios-workflow.test.ts test to verify step-level NVIDIA_INFERENCE_API_KEY secret reference in 'Run Vitest gateway-guard-recovery scenario' step. Workflow/secret boundary changes need behavioral runtime validation; static test covers job-level env but not step-level secret reference.
• PRA-T2 Runtime validation — Add validateGatewayGuardRecoveryVitestJob in workflow-boundary.mts checking hosted inference flag, step-level secret, OPENSHELL_GATEWAY, Docker Hub auth absence, pinned actions. Workflow/secret boundary changes need behavioral runtime validation; static test covers job-level env but not step-level secret reference.
• PRA-T3 New test verifies job-level env but not step-level NVIDIA_INFERENCE_API_KEY secret reference — Extend the test to also assert the test step's env block contains NVIDIA_INFERENCE_API_KEY referencing the secret.

Since last review details

Current findings, using the urgency labels above:

PRA-1 Resolve/justify — Workflow-boundary validation for gateway-guard-recovery only checks basic structure, not hosted inference flag or step-level secret handling

• Location: .github/workflows/e2e-vitest-scenarios.yaml:4312
• Category: security
• Problem: The gateway-guard-recovery job is validated only by validateFreeStandingJobSelector (needs/if condition). Unlike channels-add-remove-vitest or openclaw-tui-chat-correlation-vitest, it lacks a dedicated validator that checks NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1, step-level NVIDIA_INFERENCE_API_KEY secret reference, OPENSHELL_GATEWAY=nemoclaw, Docker Hub auth absence, and pinned action SHAs.
• Impact: A regression removing the hosted inference flag or step-level secret reference would not be caught at workflow parse time, only at test runtime.
• Recommended action: Add validateGatewayGuardRecoveryVitestJob function in tools/e2e-scenarios/workflow-boundary.mts mirroring validateChannelsAddRemoveVitestJob pattern, and call it from validateFreeStandingInventoryBoundary.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Search for 'validateFreeStandingJobSelector(errors, jobs, "gateway-guard-recovery");' in workflow-boundary.mts line 7759. Compare with validateChannelsAddRemoveVitestJob which has comprehensive env/step/secret checks.
• Missing regression test: Dedicated workflow-boundary validator function that fails CI if hosted inference flag or step-level secret reference is missing from gateway-guard-recovery job.
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Search for 'validateFreeStandingJobSelector(errors, jobs, "gateway-guard-recovery");' in workflow-boundary.mts line 7759. Compare with validateChannelsAddRemoveVitestJob which has comprehensive env/step/secret checks.
• Evidence: workflow-boundary.mts:7759 calls validateFreeStandingJobSelector for gateway-guard-recovery; validateChannelsAddRemoveVitestJob at line 5728 checks job env, step env for secrets, Docker Hub auth step, pinned actions, checkout persist-credentials=false

PRA-2 Resolve/justify — New test verifies job-level env but not step-level NVIDIA_INFERENCE_API_KEY secret reference

• Location: test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts:645
• Category: tests
• Problem: The test 'keeps gateway guard recovery on the hosted-compatible CI inference route' checks job.env for NEMOCLAW_E2E_USE_HOSTED_INFERENCE and NEMOCLAW_RUN_E2E_SCENARIOS but does not verify the 'Run Vitest gateway-guard-recovery scenario' step has NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}. Hosted-inference.test.ts (lines 197-202) verifies both levels.
• Impact: If the step-level secret reference is accidentally removed, the test would still pass but the workflow would fail at runtime with missing credentials.
• Recommended action: Extend the test to also assert the test step's env block contains NVIDIA_INFERENCE_API_KEY referencing the secret.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Read test at line 645 and compare with hosted-inference.test.ts lines 197-202 which verify both job-level env and step-level secret references via readWorkflow() and step inspection.
• Missing regression test: Assertion in e2e-scenarios-workflow.test.ts that the 'Run Vitest gateway-guard-recovery scenario' step has env.NVIDIA_INFERENCE_API_KEY === '${{ secrets.NVIDIA_INFERENCE_API_KEY }}'.
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Read test at line 645 and compare with hosted-inference.test.ts lines 197-202 which verify both job-level env and step-level secret references via readWorkflow() and step inspection.
• Evidence: e2e-scenarios-workflow.test.ts:645-652 checks job.env only; hosted-inference.test.ts:197-202 pattern verifies step-level secret reference; tunnel-lifecycle-workflow-boundary.test.ts:101 verifies step-level NVIDIA_INFERENCE_API_KEY secret reference

PRA-3 Improvement — Consider adding dedicated validateGatewayGuardRecoveryVitestJob for defense-in-depth

• Location: tools/e2e-scenarios/workflow-boundary.mts:7759
• Category: workflow
• Problem: The gateway-guard-recovery job is a free-standing live test using hosted inference and secrets. It currently only gets basic validation. Adding a dedicated validator would match the pattern used for other live free-standing jobs and catch regressions earlier.
• Impact: Current validation gap means workflow structure drift (missing flag, wrong secret ref, missing OPENSHELL_GATEWAY) would only surface at test runtime, not at workflow lint time.
• Suggested action: Implement validateGatewayGuardRecoveryVitestJob following validateChannelsAddRemoveVitestJob pattern, and register it in validateFreeStandingInventoryBoundary. This is a current-PR action since it's local to the changed workflow job.
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Look at validateChannelsAddRemoveVitestJob (workflow-boundary.mts ~5830) for pattern: checks job env, step env for secrets, Docker Hub auth step, pinned actions, checkout persist-credentials=false.
• Missing regression test: New validator function that emits errors if gateway-guard-recovery job lacks NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1, step-level NVIDIA_INFERENCE_API_KEY secret, OPENSHELL_GATEWAY=nemoclaw, or has unexpected secrets in non-test steps.
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: workflow-boundary.mts:7759 only calls validateFreeStandingJobSelector for gateway-guard-recovery; validateChannelsAddRemoveVitestJob at line 5728 provides comprehensive validation pattern

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

[cv]

Superseded by the clean replacement branch in #5889; force-push is disabled on PR branches.