feat(dcode): add backend-neutral OTLP observability - #6340
Merged
Conversation
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThis PR adds opt-in observability for Deep Agents Code across onboarding, session persistence, sandbox/rebuild flows, policy selection, runtime startup, and e2e validation, plus a local OTLP preset and updated docs. ChangesDeep Agents Code observability runtime
Estimated code review effort: 5 (Critical) | ~120 minutes Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-6340.docs.buildwithfern.com/nemoclaw |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
E2E Target RecommendationRequired E2E targets: Dispatch required E2E targets:
Full E2E target advisor summaryE2E Target AdvisorBase: Required E2E targets
Optional E2E targets
Relevant changed files
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
E2E Target Results — ✅ All requested jobs passedRun: 28821842176
|
Contributor
PR Review Advisor — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 1 item to resolve/justify, 1 in-scope improvement
|
Contributor
E2E Target Results — ✅ All requested jobs passedRun: 28821842163
|
Contributor
E2E Target Results — ❌ Some jobs failedRun: 28821842089
|
Contributor
PR Review Advisor (Nemotron Ultra) — BlockedMerge posture: Do not merge until addressed Action checklist
Findings index
🚨 Required before mergeAddress these before merging unless a maintainer explicitly overrides the advisor with rationale.
|
Contributor
E2E Target Results — ✅ All requested jobs passedRun: 28821842214
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (3)
src/lib/actions/sandbox/rebuild-recreate-phase.ts (1)
68-256: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winNo dedicated test coverage included for this file's observability propagation.
Unlike the sibling changes in this cohort (
onboard-session.test.ts,resume-config.test.ts,sandbox-registration.test.ts), no test exercisesrunRebuildRecreatePhase's newobservabilityEnabledpropagation into the rebuilt session. As per path instructions, destructive sandbox lifecycle operations should "cover failure, recovery, rebuild, and resume behavior."Do you want me to draft a test asserting the recreated session's
observabilityEnabledmatchesrecreateOptions.observabilityEnabledacross the success andonboardFailedrollback paths?🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/actions/sandbox/rebuild-recreate-phase.ts` around lines 68 - 256, Add dedicated coverage for runRebuildRecreatePhase to verify observabilityEnabled is propagated from recreateOptions.observabilityEnabled into the rebuilt session via onboardSession.updateSession/createSession, and that this value remains correct through both the success path and the onboardFailed recovery path. Use the runRebuildRecreatePhase function and the onboardSession session update logic as anchors when adding the test cases.Source: Path instructions
agents/langchain-deepagents-code/patch-managed-deepagents-code.py (1)
1018-1044: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDuplicate module-install/validate logic; extract a shared helper.
The observability module install/validate block (Lines 1018-1044) is a near-verbatim duplicate of the middleware install/validate block at Lines 1000-1017, differing only by variable names and error text. Extracting a small
_install_managed_module(name, root)-style helper would remove the duplication and keep future modules (there may be more) consistent by construction.♻️ Proposed helper extraction
+def _install_module(module_name: str, root: Path) -> tuple[Path, str]: + source_path = Path(__file__).with_name(module_name) + destination_path = root / module_name + if not source_path.is_file(): + raise RuntimeError(f"NemoClaw source not found for {module_name} at {source_path}") + source = source_path.read_text(encoding="utf-8") + compile(source, str(destination_path), "exec") + if destination_path.exists() or destination_path.is_symlink(): + if ( + not destination_path.is_file() + or destination_path.is_symlink() + or destination_path.read_text(encoding="utf-8") != source + ): + raise RuntimeError( + f"Refusing to overwrite unexpected module at {destination_path}" + ) + return destination_path, source + module_source_path = Path(__file__).with_name(MIDDLEWARE_MODULE) - module_destination_path = root / MIDDLEWARE_MODULE - if not module_source_path.is_file(): - raise RuntimeError( - f"NemoClaw middleware source not found at {module_source_path}" - ) - module_source = module_source_path.read_text(encoding="utf-8") - compile(module_source, str(module_destination_path), "exec") - if module_destination_path.exists() or module_destination_path.is_symlink(): - if ( - not module_destination_path.is_file() - or module_destination_path.is_symlink() - or module_destination_path.read_text(encoding="utf-8") != module_source - ): - raise RuntimeError( - f"Refusing to overwrite unexpected middleware at {module_destination_path}" - ) - - observability_source_path = Path(__file__).with_name(OBSERVABILITY_MODULE) - observability_destination_path = root / OBSERVABILITY_MODULE - if not observability_source_path.is_file(): - raise RuntimeError( - f"NemoClaw observability source not found at {observability_source_path}" - ) - observability_source = observability_source_path.read_text(encoding="utf-8") - compile( - observability_source, - str(observability_destination_path), - "exec", - ) - if ( - observability_destination_path.exists() - or observability_destination_path.is_symlink() - ): - if ( - not observability_destination_path.is_file() - or observability_destination_path.is_symlink() - or observability_destination_path.read_text(encoding="utf-8") - != observability_source - ): - raise RuntimeError( - "Refusing to overwrite unexpected observability module at " - f"{observability_destination_path}" - ) + module_destination_path, module_source = _install_module(MIDDLEWARE_MODULE, root) + observability_destination_path, observability_source = _install_module( + OBSERVABILITY_MODULE, root + )🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/langchain-deepagents-code/patch-managed-deepagents-code.py` around lines 1018 - 1044, The observability module install/validate block duplicates the middleware module logic, so extract the shared flow into a helper such as the existing managed-module install path in patch-managed-deepagents-code.py. Refactor the repeated sequence in the observability handling to call a common helper that takes the module name and destination root, while preserving the current validation and error messages for both modules. Keep the helper reusable for future managed modules so the install/check behavior stays consistent in one place.docs/get-started/quickstart-langchain-deepagents-code.mdx (1)
186-186: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider code-formatting the tier name.
"Restricted" refers to a literal policy tier value (elsewhere referenced in code as
restricted/RESTRICTED_TIER_NAME). Per docs path instructions, literal values should usecodeformatting.As per path instructions ("Use
codeformatting for commands, paths, flags, environment variables, file names, and literal values.").✏️ Suggested tweak
-The Restricted policy tier suppresses the required egress preset even when the opt-in is recorded. +The `restricted` policy tier suppresses the required egress preset even when the opt-in is recorded.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/get-started/quickstart-langchain-deepagents-code.mdx` at line 186, The docs text uses the literal policy tier name without code formatting, so update the mention of the Restricted tier in this section to use inline code styling. Keep the wording the same, but format the literal tier value consistently with the nearby `restricted`/`RESTRICTED_TIER_NAME` references so it matches the docs style guidance.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@agents/langchain-deepagents-code/patch-managed-deepagents-code.py`:
- Around line 494-517: The current use of with_config() in create_cli_agent only
adds new_metadata_only_callback_handler() on top of existing callbacks, so it
does not guarantee metadata-only tracing. Update the create_cli_agent path to
use a stronger isolation point than layering callbacks on the returned agent,
ensuring any compiled-agent or outer-config tracers are excluded when
observability_active is true. Keep the observability and progressive disclosure
handling around _nemoclaw_original_create_cli_agent, but adjust the
post-processing of result so the metadata-only behavior is enforced by the agent
construction path rather than merged configuration.
In `@docs/reference/commands.mdx`:
- Line 203: The quickstart link target in the documentation is wrong because the
current relative path points through a non-existent openclaw segment. Update the
Quickstart with LangChain Deep Agents Code reference in the affected docs
content to use the correct
../../get-started/quickstart-langchain-deepagents-code#export-traces-through-a-local-collector
target, and make sure both occurrences of this link in commands.mdx use the same
corrected path.
In `@nemoclaw-blueprint/policies/presets/observability-otlp-local.yaml`:
- Around line 9-24: Expand the observability-otlp-local preset tests to cover
blocked scenarios as well as the allowed case: add negative-path assertions for
non-POST methods, mismatched paths, and alternate hosts against the
observability-otlp-local network_policies entry so only the intended /v1/traces
POST on host.openshell.internal is permitted. Also add checks that preset
rendering and any related logging paths do not include credentials, tokens, or
other secret-like values, using the observability-otlp-local preset name and its
endpoint/rule shape to locate the relevant assertions.
---
Nitpick comments:
In `@agents/langchain-deepagents-code/patch-managed-deepagents-code.py`:
- Around line 1018-1044: The observability module install/validate block
duplicates the middleware module logic, so extract the shared flow into a helper
such as the existing managed-module install path in
patch-managed-deepagents-code.py. Refactor the repeated sequence in the
observability handling to call a common helper that takes the module name and
destination root, while preserving the current validation and error messages for
both modules. Keep the helper reusable for future managed modules so the
install/check behavior stays consistent in one place.
In `@docs/get-started/quickstart-langchain-deepagents-code.mdx`:
- Line 186: The docs text uses the literal policy tier name without code
formatting, so update the mention of the Restricted tier in this section to use
inline code styling. Keep the wording the same, but format the literal tier
value consistently with the nearby `restricted`/`RESTRICTED_TIER_NAME`
references so it matches the docs style guidance.
In `@src/lib/actions/sandbox/rebuild-recreate-phase.ts`:
- Around line 68-256: Add dedicated coverage for runRebuildRecreatePhase to
verify observabilityEnabled is propagated from
recreateOptions.observabilityEnabled into the rebuilt session via
onboardSession.updateSession/createSession, and that this value remains correct
through both the success path and the onboardFailed recovery path. Use the
runRebuildRecreatePhase function and the onboardSession session update logic as
anchors when adding the test cases.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 66943a62-7453-4941-bdef-4ce0a474f283
⛔ Files ignored due to path filters (1)
agents/langchain-deepagents-code/requirements.lockis excluded by!**/*.lock
📒 Files selected for processing (60)
agents/langchain-deepagents-code/Dockerfileagents/langchain-deepagents-code/dcode-launcher.shagents/langchain-deepagents-code/dependency-review.mdagents/langchain-deepagents-code/nemoclaw_observability.pyagents/langchain-deepagents-code/patch-managed-deepagents-code.pyagents/langchain-deepagents-code/requirements.inagents/langchain-deepagents-code/start.shci/test-file-size-budget.jsondocs/get-started/quickstart-langchain-deepagents-code.mdxdocs/reference/commands-nemohermes.mdxdocs/reference/commands.mdxdocs/reference/enterprise-readiness.mdxdocs/reference/network-policies.mdxnemoclaw-blueprint/policies/presets/observability-otlp-local.yamlsrc/lib/actions/sandbox/rebuild-gpu-opt-out.test.tssrc/lib/actions/sandbox/rebuild-gpu-opt-out.tssrc/lib/actions/sandbox/rebuild-recreate-phase.tssrc/lib/onboard.tssrc/lib/onboard/agent-policy-presets.tssrc/lib/onboard/command-support.tssrc/lib/onboard/command.test.tssrc/lib/onboard/command.tssrc/lib/onboard/machine/handlers/policies.test.tssrc/lib/onboard/machine/handlers/policies.tssrc/lib/onboard/machine/handlers/sandbox-dcode-selection.test.tssrc/lib/onboard/machine/handlers/sandbox-tool-disclosure.test.tssrc/lib/onboard/machine/handlers/sandbox.test.tssrc/lib/onboard/machine/handlers/sandbox.tssrc/lib/onboard/observability-policy-presets.test.tssrc/lib/onboard/observability-policy-presets.tssrc/lib/onboard/policy-presets.tssrc/lib/onboard/policy-resume-selection.test.tssrc/lib/onboard/policy-resume-selection.tssrc/lib/onboard/policy-selection.tssrc/lib/onboard/policy-tier-suppression.tssrc/lib/onboard/resume-config.test.tssrc/lib/onboard/resume-config.tssrc/lib/onboard/runtime-control-flow.test.tssrc/lib/onboard/runtime-control-flow.tssrc/lib/onboard/sandbox-create-launch.test.tssrc/lib/onboard/sandbox-create-launch.tssrc/lib/onboard/sandbox-registration.test.tssrc/lib/onboard/sandbox-registration.tssrc/lib/onboard/session-bootstrap.test.tssrc/lib/onboard/session-bootstrap.tssrc/lib/onboard/session-updates.tssrc/lib/onboard/types.tssrc/lib/state/onboard-session.test.tssrc/lib/state/onboard-session.tssrc/lib/state/registry.tstest/fixtures/deepagents-observability-harness.pytest/langchain-deepagents-code-direct-module-patch.test.tstest/langchain-deepagents-code-image.test.tstest/langchain-deepagents-code-observability.test.tstest/langchain-deepagents-code-progressive-tool-disclosure.test.tstest/langchain-deepagents-code-proxy-launcher.test.tstest/observability-otlp-policy-preset.test.tstest/onboard-policy-suggestions.test.tstest/policies.test.tstest/registry.test.ts
💤 Files with no reviewable changes (1)
- test/policies.test.ts
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
E2E Target Results — ✅ All selected jobs passedRun: 28824072355
|
Collaborator
Author
|
Review follow-up for GPT advisor
Nemotron advisor
CodeRabbit / callback isolationThe graph now receives a directly replaced locked callback manager rather than layering Final evidence: 195/195 focused integration tests, 5/5 focused CLI lifecycle tests, CLI build/type-check, 46/46 config schemas, source-shape/test-size gates, normal pre-commit/commit-msg/pre-push hooks, docs with 0 errors (two existing warnings), both production sandbox-image builds, and the cloud DCode live E2E on runtime head Final-head advisor residuals (
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/observability-otlp-policy-preset.test.ts`:
- Around line 99-119: Update the new test titles in
observability-otlp-policy-preset.test.ts to follow the behavior-oriented naming
rule with a local issue reference suffix. In the it.each block for the denies
cases and the it block for exporter credential/header configuration, append the
required final “(`#1234`)” style suffix to each title so they comply with the test
naming guideline while keeping the existing behavior-focused wording.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: f50b601c-662f-4acf-8986-ec7052c23eb1
📒 Files selected for processing (18)
agents/langchain-deepagents-code/Dockerfileagents/langchain-deepagents-code/dcode-launcher.shagents/langchain-deepagents-code/nemoclaw_observability.pyagents/langchain-deepagents-code/patch-managed-deepagents-code.pyagents/langchain-deepagents-code/validate-observability.pydocs/get-started/quickstart-langchain-deepagents-code.mdxnemoclaw-blueprint/policies/presets/observability-otlp-local.yamlsrc/lib/actions/sandbox/rebuild-recreate-observability.test.tssrc/lib/onboard/machine/handlers/policies-observability.test.tssrc/lib/onboard/policy-preset-reconciliation.tssrc/lib/onboard/policy-selection.tssrc/lib/onboard/sandbox-create-launch-observability.test.tstest/fixtures/deepagents-observability-harness.pytest/langchain-deepagents-code-image.test.tstest/langchain-deepagents-code-observability.test.tstest/langchain-deepagents-code-progressive-tool-disclosure.test.tstest/langchain-deepagents-code-proxy-launcher.test.tstest/observability-otlp-policy-preset.test.ts
✅ Files skipped from review due to trivial changes (1)
- src/lib/onboard/sandbox-create-launch-observability.test.ts
🚧 Files skipped from review as they are similar to previous changes (7)
- test/langchain-deepagents-code-image.test.ts
- nemoclaw-blueprint/policies/presets/observability-otlp-local.yaml
- agents/langchain-deepagents-code/Dockerfile
- test/langchain-deepagents-code-observability.test.ts
- agents/langchain-deepagents-code/dcode-launcher.sh
- docs/get-started/quickstart-langchain-deepagents-code.mdx
- src/lib/onboard/policy-selection.ts
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
E2E Target Results — ✅ All selected jobs passedRun: 28824587990
|
Contributor
E2E Target Results — ❌ Some jobs failedRun: 28897942322
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Collaborator
Author
|
Final-head automated-review follow-up for
Prior detailed disposition: #6340 (comment) |
apurvvkumaria
requested changes
Jul 7, 2026
apurvvkumaria
left a comment
apurvvkumaria
left a comment
Collaborator
There was a problem hiding this comment.
Requesting changes at exact head 9ebf3f29db2a3796b6d19ca160604c59352f1606.
I found the following correctness and security blockers:
-
P1 — Exception redaction can be bypassed.
agents/langchain-deepagents-code/nemoclaw_observability.py:695-717readserror.__traceback__and callserror.with_traceback(...)through subclass dispatch. I reproduced a custom exception replacing the traceback lookup with a secret-bearing error; Relay observed that replacement unredacted and the agent lost the original exception. The restore path also clears an original explicit__cause__throughfrom None. Use base-class dispatch and add hostile-exception/cause-preservation tests. -
P1 — Optional tracing is not fail-open for valid Python values or Relay failures.
nemoclaw_observability.py:125-132,194-199,727-861passes arbitrary-size integers and lone Unicode surrogates into Relay. With the exact pinnednemo-relay==0.4.0,10**1000and"\ud800"tool arguments fail before the handler runs, while a huge-integer result fails after the handler runs and discards the completed result. Generic Relay failures have the same pre-/post-callback behavior because only application-callback errors are suppressed. Normalize values into Relay's JSON domain, then ensure instrumentation failures invoke the handler exactly once or return its saved result. -
P1 — Custom OTLP policy ownership can be misclassified and overwritten.
src/lib/policy/index.ts:1257-1275says it checks one exact live network-policy key, butsrc/lib/policy/gateway-state.ts:64-94requires every key in the custom preset to match. If an unrelated second key drifts—or inspection is temporarily unavailable—the still-exact operator-ownedobservability-otlp-localentry is treated as unowned. Policy selection can then apply the built-in preset, and the merge atsrc/lib/policy/index.ts:536-543,1058overwrites the custom content. Compare only the requested key and treat an unreadable ownership state as an abort, not “unowned.” -
P1 — Recovery guidance drops an explicit observability opt-out.
The MCP safety redirect atsrc/lib/onboard.ts:2656-2663prints a rebuild command without--observability/--no-observability. The failed-rebuild retry atsrc/lib/actions/sandbox/rebuild-recreate-phase.ts:105-126,212-232does the same while failing to preserve explicit provenance. Repro: enabled DCode with managed MCP, request--no-observability, then follow the printed command; rebuild succeeds with observability still enabled. Carry the authoritative intent and render the matching flag in both retry forms. -
P2 — Legacy snapshot clones enable instrumentation without the required policy.
src/lib/actions/sandbox/snapshot.ts:233-304starts and records an observability-enabled clone, butsnapshot.ts:580-584skips all reconciliation when an older snapshot lackspolicyPresets. A balanced DCode clone restores successfully while every trace is denied becauseobservability-otlp-localis absent. Reconcile the managed observability binding independently of historical generic preset metadata. -
P2 — Interrupted Restricted onboarding can resume as Balanced.
The resolved normal-onboarding tier is not persisted during sandbox registration (src/lib/onboard/machine/handlers/sandbox.ts:679-685,src/lib/onboard.ts:3016-3019). If Restricted, observability-enabled onboarding is interrupted after sandbox creation but before policy completion, a later noninteractive resume without the original environment defaults to Balanced atsrc/lib/onboard/policy-selection-prompts.ts:82-96and can add OTLP egress. Persist the resolved tier before the sandbox step becomes resumable.
Verification performed: exact pinned-Relay reproductions for findings 1 and 2, existing privacy/outage/construction/logging harnesses, Python syntax, git diff --check, policy/lifecycle tracing, and a clean synthetic merge with current main.
The visible exact-head checks are green, but the composed DCode/live lifecycle runs requested by the E2E advisor are stale or missing on final head. Please rerun the full required live set after addressing these findings.
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
E2E Target Results — ❌ Some jobs failedRun: 28907036255
|
Collaborator
Author
|
Current-head automated-advisor disposition for ac1b478:
All 40 applicable PR checks pass, all 63 review threads are resolved, the head is GitHub Verified, and the branch is conflict-free. Final-head required live E2E follow-up is still running; I will post its settled evidence with the human-review response. |
Contributor
E2E Target Results — ✅ All selected jobs passedRun: 28907688897
|
Contributor
E2E Target Results — ❌ Some jobs failedRun: 28907262073
|
Contributor
E2E Target Results — ✅ All requested jobs passedRun: 28907786669
|
Contributor
E2E Target Results —
|
| Job | Result |
|---|---|
| cloud-onboard | |
| sandbox-operations | |
| sandbox-rebuild |
apurvvkumaria
approved these changes
Jul 8, 2026
22 tasks
21 tasks
apurvvkumaria
added a commit
that referenced
this pull request
Jul 8, 2026
<!-- markdownlint-disable MD041 --> ## Summary Prepares the user-facing documentation for NemoClaw v0.0.76 and closes the release-prep documentation gate. It adds the release highlights, documents the arm64 Local NIM warning and expanded image cleanup behavior, and fixes agent-specific command headings in generated guides. ## Changes - Add the v0.0.76 release-notes section and move the shared-gateway route containment entry out of the v0.0.74 history where it was incorrectly placed. - Document the advisory Linux arm64 Local NIM manifest warning in the canonical platform matrix and local-inference guidance. - Document that `gc` scans both gateway-built and locally prebuilt sandbox image repositories. - Keep OpenClaw and Hermes session headings out of the generated Deep Agents command guide. - Add a focused variant regression test for the agent-specific session headings. ### Source summary | Merged sources | Documentation coverage | | --- | --- | | [#6414](#6414), [#6418](#6418), [#6416](#6416), [#6344](#6344) | v0.0.76 release notes and the Deep Agents quickstart/inference routes | | [#6340](#6340) | v0.0.76 release notes and existing Deep Agents observability guidance | | [#6338](#6338), [#6378](#6378), [#6297](#6297) | v0.0.76 release notes and existing inference/troubleshooting guidance | | [#6362](#6362) | v0.0.76 release notes and existing lifecycle, command, and credential guidance | | [#6330](#6330), [#6307](#6307), [#6008](#6008) | v0.0.76 release notes and existing security, troubleshooting, and command guidance | | [#6382](#6382) | v0.0.76 release notes and existing MCP/command guidance | | [#6326](#6326), [#5868](#5868), [#5539](#5539) | v0.0.76 release notes, platform matrix, inference options, and local-inference guidance | | [#6396](#6396), [#6390](#6390), [#6007](#6007) | v0.0.76 release notes and existing messaging guidance | | [#5388](#5388), [#6249](#6249), [#6303](#6303), [#6306](#6306) | v0.0.76 release notes and command/lifecycle guidance | ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npx vitest run --project integration test/generate-platform-docs.test.ts test/agent-variant-docs.test.ts test/sync-agent-variant-docs.test.ts` (3 files, 29 tests passed) - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — completed with 0 errors and 2 pre-existing Fern warnings - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added v0.0.76 release notes content, and removed an older conflicting bullet from the surrounding release history. * Expanded Local NVIDIA NIM guidance across inference/provider docs, including an advisory for Linux arm64 DGX Spark/DGX Station hosts when a matching `linux/arm64` image manifest is unavailable. * Updated the command reference for correct session-section rendering and clarified `gc` image cleanup sources. * **Tests** * Added coverage ensuring Deep Agents omits sessions headings while Hermes includes them. * **CI** * Refreshed Local NVIDIA NIM provider notes used in the platform matrix. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Add opt-in, backend-neutral observability for LangChain Deep Agents Code. Root-owned NeMo Relay instrumentation exports bounded model and tool content to a fixed host-local OTLP receiver, while an operator-owned collector holds backend credentials and forwards traces to LangSmith or another OTLP-compatible backend without rebuilding the sandbox. ## Related Issue Follow-up to NVIDIA#5621 Related to NVIDIA#3915 ## Changes - Add DCode-only `--observability` and `--no-observability` controls that are off by default and persist through resume, ready-sandbox drift, recreate, rebuild, snapshot clone, and registry recovery. - Instrument managed model, tool, subagent, and LangGraph execution. Export bounded prompts, model responses, tool arguments, and tool results; keep graph node scopes to bounded names, a static integration label, and status so they do not duplicate raw graph state. - Redact credential-shaped and control-plane fields and omit request headers, model settings, tool schemas, callback metadata, checkpoint and interrupt payloads, and original exception text. Preserve agent results and exact exception identity and traceback in agent execution. - Keep local observability failure diagnostics content-free: caught exception text and tracebacks are not logged, preventing ambient OTEL headers, certificate paths, and client-key paths from leaking through setup, export, callback, or cleanup failures. - Send OTLP/HTTP only to `http://host.openshell.internal:4318/v1/traces`, without custom, exporter, or authentication headers. Ignore ambient exporter configuration and fail open when trace delivery is unavailable. - Manage the exact `observability-otlp-local` policy for DCode, including add/remove reconciliation, managed-Python and endpoint restrictions, ready-state recreation, and suppression on the `restricted` tier. - Pin `nemo-relay[langgraph]==0.4.0` and validate the real Relay integration during image builds. Add a composed live E2E contract covering OpenShell policy enforcement, launcher and direct execution, captured model/tool content, ambient-canary absence, and negative host, path, method, port, and binary cases. - Preserve exact inner command arguments after the documented `sandbox exec --` boundary, and harden the live OTLP capture server to reject unexpected routes or exporter headers and persist only normalized metadata beside bounded protobuf bodies. - Document the complete host-collector workflow for LangSmith, including private bridge binding, host-only credentials, regional and self-hosted endpoints, verification, disabling, troubleshooting, and the trace-content security boundary. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: completed a nine-category security review and an independent final-diff review with no actionable findings. The real `nemo-relay==0.4.0` and `langgraph==1.2.6` validator emitted nine OTLP requests totaling 9,060 protobuf bytes while enforcing unique OTLP attributes and proving content bounds and redaction, callback isolation, zero ambient-exporter canary traffic, and exact result and exception preservation. The composed live contract covers the OpenShell policy and runtime boundary. Arbitrary sandbox Python can still forge OTLP fields, so the host collector must not treat trace attributes as authenticated tenant identity. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: 341/341 CLI feature tests, 123/123 integration and image tests, 44/44 E2E support tests, and 103/103 focused rebuild regression tests passed. The combined post-CI regression slice passed 105/105 after normal hooks. The current-head final-fix slice also passed 183/183 CLI, 22/22 E2E-support, 78/78 observability integration/image, and the policy-read discovery audit. The real Relay validator emitted nine requests totaling 9,060 bytes and enforced unique resource, scope, span, event, and link attributes. The final production-equivalent image build completed at `sha256:11e48de2b7cbefe58e918d1d9fb303ce93229db2079a8a72446871dce39b0d3d`. After merging current `main` and resolving its three rebuild conflicts, 137/137 focused rebuild tests passed locally, along with the CLI build, CLI type-check, and Biome checks. All applicable current-head PR checks passed (2 not-applicable checks were skipped). The composed cloud trace contract passed on attempt 2 in [run 28847969488](https://github.com/NVIDIA/NemoClaw/actions/runs/28847969488), and `network-policy`, `sandbox-rebuild`, `onboard-resume`, and `onboard-repair` passed in [run 28847913562](https://github.com/NVIDIA/NemoClaw/actions/runs/28847913562). The DCode-only shared-check regression passed 12/12 E2E-support tests, and the compacted managed-patch validation passed 34/34 integration tests. After the final two `main` synchronizations, focused post-merge tests passed: snapshot 45/45, sandbox 42/42, registry recovery 50/50, onboard integration 65/65, DCode integration 124/124, E2E support 12/12, and docs variants/routes/commands 26/26, plus CLI type-check, size budgets, local link checking, and `npm run docs` (0 errors; two pre-existing warnings). On final head `9ebf3f29d`, Python compilation, Biome, and 114/114 focused observability, image, and direct-module integration tests passed. The new failure-log regression exposes all three OTEL canaries against the pre-fix source and proves they are absent after the fix. All required final-head CI checks passed; optional self-hosted E2E jobs were still queued for runner capacity when this evidence was recorded. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: under the repository-normal `022` umask, `npm test` completed with 13,560 passing and 36 skipped tests. Its sole failure is the untouched `e2e-migration-source-of-truth` check because `openshell-gateway-upgrade-helpers.ts` has a pre-existing local `shellQuote`; the same failure reproduces on `origin/main`, and no maintainer waiver is claimed here. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — completed with 0 errors and two pre-existing repository warnings - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Additional current-head checks: - `npm run build:cli` - `npm run typecheck:cli` - `npm run validate:configs` (46/46) - `npm run source-shape:check` - `npm run test-size:check` - `npm run docs` (0 errors; two pre-existing warnings) - `git diff --check` --- Signed-off-by: Carlos Villela <cvillela@nvidia.com> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Prepares the user-facing documentation for NemoClaw v0.0.76 and closes the release-prep documentation gate. It adds the release highlights, documents the arm64 Local NIM warning and expanded image cleanup behavior, and fixes agent-specific command headings in generated guides. ## Changes - Add the v0.0.76 release-notes section and move the shared-gateway route containment entry out of the v0.0.74 history where it was incorrectly placed. - Document the advisory Linux arm64 Local NIM manifest warning in the canonical platform matrix and local-inference guidance. - Document that `gc` scans both gateway-built and locally prebuilt sandbox image repositories. - Keep OpenClaw and Hermes session headings out of the generated Deep Agents command guide. - Add a focused variant regression test for the agent-specific session headings. ### Source summary | Merged sources | Documentation coverage | | --- | --- | | [NVIDIA#6414](NVIDIA#6414), [NVIDIA#6418](NVIDIA#6418), [NVIDIA#6416](NVIDIA#6416), [NVIDIA#6344](NVIDIA#6344) | v0.0.76 release notes and the Deep Agents quickstart/inference routes | | [NVIDIA#6340](NVIDIA#6340) | v0.0.76 release notes and existing Deep Agents observability guidance | | [NVIDIA#6338](NVIDIA#6338), [NVIDIA#6378](NVIDIA#6378), [NVIDIA#6297](NVIDIA#6297) | v0.0.76 release notes and existing inference/troubleshooting guidance | | [NVIDIA#6362](NVIDIA#6362) | v0.0.76 release notes and existing lifecycle, command, and credential guidance | | [NVIDIA#6330](NVIDIA#6330), [NVIDIA#6307](NVIDIA#6307), [NVIDIA#6008](NVIDIA#6008) | v0.0.76 release notes and existing security, troubleshooting, and command guidance | | [NVIDIA#6382](NVIDIA#6382) | v0.0.76 release notes and existing MCP/command guidance | | [NVIDIA#6326](NVIDIA#6326), [NVIDIA#5868](NVIDIA#5868), [NVIDIA#5539](NVIDIA#5539) | v0.0.76 release notes, platform matrix, inference options, and local-inference guidance | | [NVIDIA#6396](NVIDIA#6396), [NVIDIA#6390](NVIDIA#6390), [NVIDIA#6007](NVIDIA#6007) | v0.0.76 release notes and existing messaging guidance | | [NVIDIA#5388](NVIDIA#5388), [NVIDIA#6249](NVIDIA#6249), [NVIDIA#6303](NVIDIA#6303), [NVIDIA#6306](NVIDIA#6306) | v0.0.76 release notes and command/lifecycle guidance | ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npx vitest run --project integration test/generate-platform-docs.test.ts test/agent-variant-docs.test.ts test/sync-agent-variant-docs.test.ts` (3 files, 29 tests passed) - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — completed with 0 errors and 2 pre-existing Fern warnings - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added v0.0.76 release notes content, and removed an older conflicting bullet from the surrounding release history. * Expanded Local NVIDIA NIM guidance across inference/provider docs, including an advisory for Linux arm64 DGX Spark/DGX Station hosts when a matching `linux/arm64` image manifest is unavailable. * Updated the command reference for correct session-section rendering and clarified `gc` image cleanup sources. * **Tests** * Added coverage ensuring Deep Agents omits sessions headings while Hermes includes them. * **CI** * Refreshed Local NVIDIA NIM provider notes used in the platform matrix. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add opt-in, backend-neutral observability for LangChain Deep Agents Code. Root-owned NeMo Relay instrumentation exports bounded model and tool content to a fixed host-local OTLP receiver, while an operator-owned collector holds backend credentials and forwards traces to LangSmith or another OTLP-compatible backend without rebuilding the sandbox.
Related Issue
Follow-up to #5621
Related to #3915
Changes
--observabilityand--no-observabilitycontrols that are off by default and persist through resume, ready-sandbox drift, recreate, rebuild, snapshot clone, and registry recovery.http://host.openshell.internal:4318/v1/traces, without custom, exporter, or authentication headers. Ignore ambient exporter configuration and fail open when trace delivery is unavailable.observability-otlp-localpolicy for DCode, including add/remove reconciliation, managed-Python and endpoint restrictions, ready-state recreation, and suppression on therestrictedtier.nemo-relay[langgraph]==0.4.0and validate the real Relay integration during image builds. Add a composed live E2E contract covering OpenShell policy enforcement, launcher and direct execution, captured model/tool content, ambient-canary absence, and negative host, path, method, port, and binary cases.sandbox exec --boundary, and harden the live OTLP capture server to reject unexpected routes or exporter headers and persist only normalized metadata beside bounded protobuf bodies.Type of Change
Quality Gates
nemo-relay==0.4.0andlanggraph==1.2.6validator emitted nine OTLP requests totaling 9,060 protobuf bytes while enforcing unique OTLP attributes and proving content bounds and redaction, callback isolation, zero ambient-exporter canary traffic, and exact result and exception preservation. The composed live contract covers the OpenShell policy and runtime boundary. Arbitrary sandbox Python can still forge OTLP fields, so the host collector must not treat trace attributes as authenticated tenant identity.Verification
Verifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablesha256:11e48de2b7cbefe58e918d1d9fb303ce93229db2079a8a72446871dce39b0d3d. After merging currentmainand resolving its three rebuild conflicts, 137/137 focused rebuild tests passed locally, along with the CLI build, CLI type-check, and Biome checks. All applicable current-head PR checks passed (2 not-applicable checks were skipped). The composed cloud trace contract passed on attempt 2 in run 28847969488, andnetwork-policy,sandbox-rebuild,onboard-resume, andonboard-repairpassed in run 28847913562. The DCode-only shared-check regression passed 12/12 E2E-support tests, and the compacted managed-patch validation passed 34/34 integration tests. After the final twomainsynchronizations, focused post-merge tests passed: snapshot 45/45, sandbox 42/42, registry recovery 50/50, onboard integration 65/65, DCode integration 124/124, E2E support 12/12, and docs variants/routes/commands 26/26, plus CLI type-check, size budgets, local link checking, andnpm run docs(0 errors; two pre-existing warnings). On final head9ebf3f29d, Python compilation, Biome, and 114/114 focused observability, image, and direct-module integration tests passed. The new failure-log regression exposes all three OTEL canaries against the pre-fix source and proves they are absent after the fix. All required final-head CI checks passed; optional self-hosted E2E jobs were still queued for runner capacity when this evidence was recorded.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result: under the repository-normal022umask,npm testcompleted with 13,560 passing and 36 skipped tests. Its sole failure is the untouchede2e-migration-source-of-truthcheck becauseopenshell-gateway-upgrade-helpers.tshas a pre-existing localshellQuote; the same failure reproduces onorigin/main, and no maintainer waiver is claimed here.npm run docsbuilds without warnings (doc changes only) — completed with 0 errors and two pre-existing repository warningsAdditional current-head checks:
npm run build:clinpm run typecheck:clinpm run validate:configs(46/46)npm run source-shape:checknpm run test-size:checknpm run docs(0 errors; two pre-existing warnings)git diff --checkSigned-off-by: Carlos Villela cvillela@nvidia.com