ci(e2e): restore Anthropic switch variants - #5947
Conversation
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughInference-switch CI jobs for hermes and openclaw now run as hosted and anthropic mode matrices. Shared retry logic moves into a fixture, hermes helpers add mode-aware orchestration, and workflow-boundary validation now checks the updated workflow shape. ChangesInference Switch Mode-Aware Matrix and Shared Retry
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: Dispatch required Vitest E2E scenarios:
Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
PR Review Advisor (Nemotron Ultra) — BlockedMerge posture: Do not merge until addressed Action checklist
Findings index
🚨 Required before mergeAddress these before merging unless a maintainer explicitly overrides the advisor with rationale.
|
PR Review Advisor — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 4 items to resolve/justify, 0 in-scope improvements
|
Vitest E2E Scenario Results — ❌ Some jobs failedRun: 28338428225
|
Vitest E2E Scenario Results —
|
| Job | Result |
|---|---|
| openclaw-inference-switch-vitest |
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Vitest E2E Scenario Results — ✅ All requested jobs passedRun: 28338605942
|
Vitest E2E Scenario Results — ❌ Some jobs failedRun: 28338605200
|
<!-- markdownlint-disable MD041 --> ## Summary Advance the default Hermes final-image base to the newly published post-stale-layout digest and retire the temporary digest-coupled repair that intentionally rejected newer published bases. This restores Hermes onboarding and live E2E builds after the `latest` base moved, while keeping current-state fail-closed layout checks and the older `.hermes-data` compatibility migration. ## Related Issue Unblocks #5947. Follow-up to #5882. ## Changes - Pin the default Hermes base to `sha256:8dad3b989a9ed1e601743310b97be21be5f59f89f7913a47d04f3ec3c40b8ce6`, whose published ARM64 image has neither `/sandbox/.openclaw` nor `/sandbox/.hermes-data`. - Remove the fired `NEMOCLAW_STALE_OPENCLAW_BASE_DIGEST` guard and temporary `/sandbox/.openclaw` repair; replace it with a small fail-closed invariant that rejects retired OpenClaw state rather than maintaining it. - Keep published-image provenance in the resolver: export immutable official GHCR digests and reject candidates containing `.openclaw` or `.hermes-data` state, while preserving local rebuild and caller-selected base refs in the final Dockerfile. - Delete the dedicated stale-layout verifier job, script, helpers, and tests now that their documented removal trigger has fired. - Add a focused final-image layout suite covering OpenClaw-state refusal, the retained `.hermes-data` migration, and symlink refusal; keep immutable published-ref coverage at the resolver boundary and extend live secret-boundary inspection to both retired paths. - Reject nested symlinks before copying retained `.hermes-data` compatibility state so migration cannot preserve links outside the legacy tree. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: internal published-image lifecycle cleanup; CLI behavior, configuration, supported workflows, and the documented Hermes state location are unchanged. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: pending independent review of the Hermes sandbox image boundary. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [ ] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Verification evidence: - Pulled and inspected the published ARM64 `8dad…` image; `/sandbox/.openclaw` and `/sandbox/.hermes-data` are absent. - Built `agents/hermes/Dockerfile` against the exact `8dad…` digest and verified sandbox-user readability, runtime permissions, runtime symlinks, and absence of both stale paths. - Focused integration run passed 61 tests across `hermes-final-image-layout`, `hermes-doctor-config-hash`, `pr-workflow-contract`, and `sandbox-provisioning`. - `npm run build:cli`, `npm run typecheck:cli`, `npm run checks`, and `npm run test:projects:check` passed. - Normal commit and push hooks passed for all commits, including the full CLI test lane, shellcheck, hadolint, repository checks, source-shape and test-size budgets, gitleaks, commitlint, and CLI TypeScript checks. - [Vitest E2E run 28339846140](https://github.com/NVIDIA/NemoClaw/actions/runs/28339846140) passed Hermes install/inference, root entrypoint, and secret-boundary jobs, then exposed that Dockerfile-level registry validation rejected the forced local `:latest` base-cache rebuild. Commit `ce85e762a` moves provenance back to the resolver boundary; [exact-head rerun 28340627350](https://github.com/NVIDIA/NemoClaw/actions/runs/28340627350) passed all four jobs, including stale-base rebuild. - Downloaded exact-head artifacts have no credential-shaped matches; every command result in the rebuild artifact is zero, post-rebuild inference returned `PONG`, backup scanning found no leaks, and all scenario cleanups report no failures. - Required documentation writer assessment, rerun after the fail-closed review fixes, reported no user-facing docs changes needed. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Carlos Villela <cvillela@nvidia.com> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Vitest E2E Scenario Results — ❌ Some jobs failedRun: 28344174367
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Vitest E2E Scenario Results — ❌ Some jobs failedRun: 28344757054
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Vitest E2E Scenario Results — ✅ All requested jobs passedRun: 28345419040
|
|
Advisor disposition at final head
No code change is needed for the remaining advisor items. They are either explicitly justified safety decisions, runtime follow-ups now completed, or pre-existing/out-of-scope observations. |
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/e2e-scenario/fixtures/inference-switch-retry.ts`:
- Around line 22-39: The shared retry logic in runInferenceSetWithRetry is only
using isTransientInferenceSetFailure(), so OpenClaw’s provider-validation
429/quota cases are no longer treated as retryable. Update the retry decision in
runInferenceSetWithRetry to also recognize the NVIDIA Endpoints validation
failure patterns that openclaw-inference-switch.test.ts checks for, by combining
the existing classifier with the provider-validation classifier on the
ShellProbeResult output before deciding to continue retrying or fall back to the
unverified attempt.
In `@test/e2e-scenario/live/hermes-inference-switch-helpers.ts`:
- Around line 132-138: The cleanup step hardcodes the gateway name instead of
using the configured value, which can leave the real gateway registration behind
on non-default runs. Update the `sandbox.openshell` destroy call in
`hermes-inference-switch-helpers.ts` to use the same gateway name source
returned by `env()` / `OPENSHELL_GATEWAY`, matching the value used elsewhere in
this file, so cleanup always targets the active gateway.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: bc27a192-59dc-4448-b5e9-15802f23d6a9
📒 Files selected for processing (10)
.github/workflows/e2e-vitest-scenarios.yamltest/e2e-scenario/fixtures/inference-switch-retry.tstest/e2e-scenario/live/hermes-inference-switch-helpers.tstest/e2e-scenario/live/hermes-inference-switch.test.tstest/e2e-scenario/live/openclaw-inference-switch.test.tstest/e2e-scenario/support-tests/hermes-inference-switch-command-shape.test.tstest/e2e-scenario/support-tests/inference-switch-retry.test.tstest/e2e-scenario/support-tests/inference-switch-workflow-boundary.test.tstools/e2e-scenarios/inference-switch-workflow-boundary.mtstools/e2e-scenarios/workflow-boundary.mts
Vitest E2E Scenario Results — ❌ Some jobs failedRun: 28346584299
|
Vitest E2E Scenario Results — ❌ Some jobs failedRun: 28347337176
|
Vitest E2E Scenario Results — ❌ Some jobs failedRun: 28348162532
|
Vitest E2E Scenario Results — ✅ All requested jobs passedRun: 28382985940
|
Vitest E2E Scenario Results — ✅ All requested jobs passedRun: 28383771048
|
|
Final exact-head investigation and evidence:
Final exact-head run 28383771048 at GitHub-verified head The four #5919 inventory rows remain deliberately unchecked: merge, paired frozen-v0.0.69 execution, and independent semantic review are still required before an Equivalent disposition is final. |
<!-- markdownlint-disable MD041 --> ## Summary Advance the default Hermes final-image base to the newly published post-stale-layout digest and retire the temporary digest-coupled repair that intentionally rejected newer published bases. This restores Hermes onboarding and live E2E builds after the `latest` base moved, while keeping current-state fail-closed layout checks and the older `.hermes-data` compatibility migration. ## Related Issue Unblocks NVIDIA#5947. Follow-up to NVIDIA#5882. ## Changes - Pin the default Hermes base to `sha256:8dad3b989a9ed1e601743310b97be21be5f59f89f7913a47d04f3ec3c40b8ce6`, whose published ARM64 image has neither `/sandbox/.openclaw` nor `/sandbox/.hermes-data`. - Remove the fired `NEMOCLAW_STALE_OPENCLAW_BASE_DIGEST` guard and temporary `/sandbox/.openclaw` repair; replace it with a small fail-closed invariant that rejects retired OpenClaw state rather than maintaining it. - Keep published-image provenance in the resolver: export immutable official GHCR digests and reject candidates containing `.openclaw` or `.hermes-data` state, while preserving local rebuild and caller-selected base refs in the final Dockerfile. - Delete the dedicated stale-layout verifier job, script, helpers, and tests now that their documented removal trigger has fired. - Add a focused final-image layout suite covering OpenClaw-state refusal, the retained `.hermes-data` migration, and symlink refusal; keep immutable published-ref coverage at the resolver boundary and extend live secret-boundary inspection to both retired paths. - Reject nested symlinks before copying retained `.hermes-data` compatibility state so migration cannot preserve links outside the legacy tree. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: internal published-image lifecycle cleanup; CLI behavior, configuration, supported workflows, and the documented Hermes state location are unchanged. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: pending independent review of the Hermes sandbox image boundary. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [ ] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Verification evidence: - Pulled and inspected the published ARM64 `8dad…` image; `/sandbox/.openclaw` and `/sandbox/.hermes-data` are absent. - Built `agents/hermes/Dockerfile` against the exact `8dad…` digest and verified sandbox-user readability, runtime permissions, runtime symlinks, and absence of both stale paths. - Focused integration run passed 61 tests across `hermes-final-image-layout`, `hermes-doctor-config-hash`, `pr-workflow-contract`, and `sandbox-provisioning`. - `npm run build:cli`, `npm run typecheck:cli`, `npm run checks`, and `npm run test:projects:check` passed. - Normal commit and push hooks passed for all commits, including the full CLI test lane, shellcheck, hadolint, repository checks, source-shape and test-size budgets, gitleaks, commitlint, and CLI TypeScript checks. - [Vitest E2E run 28339846140](https://github.com/NVIDIA/NemoClaw/actions/runs/28339846140) passed Hermes install/inference, root entrypoint, and secret-boundary jobs, then exposed that Dockerfile-level registry validation rejected the forced local `:latest` base-cache rebuild. Commit `ce85e762a` moves provenance back to the resolver boundary; [exact-head rerun 28340627350](https://github.com/NVIDIA/NemoClaw/actions/runs/28340627350) passed all four jobs, including stale-base rebuild. - Downloaded exact-head artifacts have no credential-shaped matches; every command result in the rebuild artifact is zero, post-rebuild inference returned `PONG`, backup scanning found no leaks, and all scenario cleanups report no failures. - Required documentation writer assessment, rerun after the fail-closed review fixes, reported no user-facing docs changes needed. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Carlos Villela <cvillela@nvidia.com> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
<!-- markdownlint-disable MD041 --> ## Summary Restores the two v0.0.69 Anthropic inference-switch workflow variants as distinct Vitest matrix executions. The existing OpenClaw and Hermes live tests already implement the compatible Anthropic provider, mock protocol, route/config mutation, `inference.local`, and agent assertions; this PR makes that mode unavoidable in default and selected CI runs. ## Related Issue Refs NVIDIA#5919 ## Changes - run hosted-compatible and Anthropic-compatible legs for both inference-switch jobs with `fail-fast: false` - preserve the old Anthropic provider, API, model, mock, agent, and sandbox-name mode values - separate artifacts by agent and mode so each execution has reviewable evidence - limit Docker credentials to the OpenClaw live-test window and remove them before artifact upload - add a focused workflow-boundary ratchet with mutations for removed modes, hard-coded mode mappings, and credential-cleanup ordering - restore the v0.0.69 Hermes gateway-reset lifecycle boundary before isolated install attempts - share the v0.0.69 inference-switch retry policy across Hermes and OpenClaw: verified attempts first, `--no-verify` only after bounded transient failures, then mandatory live route/config/inference/agent assertions ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: CI execution-mode restoration and test-harness parity; no production CLI, configuration, or user-workflow change. Required docs-writer reassessment after the final fix confirmed no docs changes. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: pending independent human review; CodeQL, CodeRabbit, both PR advisors, the credential scan, and exact live matrix evidence are recorded below. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [ ] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Verification evidence: - `e2e-vitest-support`: 57 files / 417 tests passed with 16 workers. - Focused inference-switch support suite: 14 tests passed, covering workflow mode ratchets, Hermes command/lifecycle wiring, verified transient retries, fallback only after retry exhaustion, no fallback for non-transient failures, and attempt-count validation. - `npm run typecheck`, `npm run typecheck:cli`, Biome on changed TypeScript, and `npm run test:projects:check` passed; Vitest reports 903 files across 8 disjoint projects. - Normal commit and push hooks passed, including the broad CLI coverage/ratchet lane, source-shape and test-size budgets, repository checks, secret scanning, commitlint, and CLI TypeScript checks. - All non-skipped PR checks pass at final head `9bebd96bba7c3748ad61ff60d2690b0cd7df90dc`. - [Exact-head live run 28383771048](https://github.com/NVIDIA/NemoClaw/actions/runs/28383771048) passed all four cells: Hermes hosted, Hermes Anthropic-compatible, OpenClaw hosted, and OpenClaw Anthropic-compatible. - Downloaded artifacts contain four distinct agent/mode roots. Both OpenClaw `scenario-result.json` files report `passed` with route, config, registry/session, `inference.local`, and agent PONG assertions true. Both Hermes modes have zero-exit route, config/hash, `inference.local`, API-chat, and primary destroy results; both chat boundaries returned PONG. - Hermes Anthropic exhausted three transient host-side endpoint-verification attempts, used the bounded `--no-verify` fallback, then passed the independent OpenShell route, Hermes config/hash, registry/session, sandbox `inference.local`, and Hermes API checks. The direct Anthropic probe used the frozen `max_tokens: 32` payload and returned PONG on its first bounded live attempt; the Hermes API boundary also returned PONG. This is the same safety boundary as the frozen v0.0.69 shared shell helper. - Both OpenClaw jobs completed isolated Docker-auth setup, authentication, live test, Docker-auth cleanup, then artifact upload in that order. - All four cleanup reports have zero failures; no command result timed out; the downloaded artifacts contain no NVIDIA/GitHub/Slack/AWS/OpenAI credential-shaped matches. - Required documentation-writer assessment, rerun after the final shared-helper fix, found no user-facing docs changes. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Expanded inference-switch e2e scenarios to run in both hosted and Anthropic-compatible modes, with mode-aware artifact naming/paths. * **Bug Fixes** * Improved e2e reliability by adding shared retry orchestration for inference-switch and Hermes PONG checks, retrying transient failures and applying `--no-verify` only when the retry budget is exhausted. * Refined Hermes and OpenClaw lifecycle orchestration (setup, install, and cleanup) for more consistent sandbox/gateway handling. * **Tests / Validation** * Added end-to-end retry coverage and strengthened workflow boundary validation, including matrix constraints and mode-scoped Docker auth cleanup behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Summary
Restores the two v0.0.69 Anthropic inference-switch workflow variants as distinct Vitest matrix executions. The existing OpenClaw and Hermes live tests already implement the compatible Anthropic provider, mock protocol, route/config mutation,
inference.local, and agent assertions; this PR makes that mode unavoidable in default and selected CI runs.Related Issue
Refs #5919
Changes
fail-fast: false--no-verifyonly after bounded transient failures, then mandatory live route/config/inference/agent assertionsType of Change
Quality Gates
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Verification evidence:
e2e-vitest-support: 57 files / 417 tests passed with 16 workers.npm run typecheck,npm run typecheck:cli, Biome on changed TypeScript, andnpm run test:projects:checkpassed; Vitest reports 903 files across 8 disjoint projects.9bebd96bba7c3748ad61ff60d2690b0cd7df90dc.scenario-result.jsonfiles reportpassedwith route, config, registry/session,inference.local, and agent PONG assertions true. Both Hermes modes have zero-exit route, config/hash,inference.local, API-chat, and primary destroy results; both chat boundaries returned PONG.--no-verifyfallback, then passed the independent OpenShell route, Hermes config/hash, registry/session, sandboxinference.local, and Hermes API checks. The direct Anthropic probe used the frozenmax_tokens: 32payload and returned PONG on its first bounded live attempt; the Hermes API boundary also returned PONG. This is the same safety boundary as the frozen v0.0.69 shared shell helper.Signed-off-by: Carlos Villela cvillela@nvidia.com
Summary by CodeRabbit
New Features
Bug Fixes
--no-verifyonly when the retry budget is exhausted.Tests / Validation