Skip to content

perf(test): reduce rebuild and provider-selection process isolation - #6383

Merged
cv merged 7 commits into
mainfrom
codex/perf-rebuild-stale-recovery
Jul 7, 2026
Merged

perf(test): reduce rebuild and provider-selection process isolation#6383
cv merged 7 commits into
mainfrom
codex/perf-rebuild-stale-recovery

Conversation

@cv

@cv cv commented Jul 7, 2026

Copy link
Copy Markdown
Collaborator

Summary

Reduce process isolation in two high-cost integration targets without changing production behavior. Against the final main base, stale rebuild recovery drops from 14.94–15.01 seconds to approximately 3.50 seconds (76.6% faster), while provider selection drops from 17.60–18.07 seconds to 9.95–10.23 seconds (43.4% faster).

Related Issue

Part of #6245.

Changes

  • replace five redundant full-CLI stale-rebuild launches with the existing direct flow harness while retaining one real CLI/HOME rollback contract
  • retain a focused 65ms harness case for successful stale recovery, including backup skip, recreate handoff, and finalization assertions
  • exercise unit-shaped onboarding cases through typed source seams while preserving real-process coverage for module-wiring, environment parsing, and subprocess boundaries
  • batch nine provider credential back/exit scenarios through their real setupNim call sites in one isolated child; full Node boots fall from 50 to 26 with all 66 provider-selection behaviors retained
  • add a real-classifier rebuild contract for both recorded/active gateway mismatch directions instead of injecting the terminal wrong_gateway_active state
  • ratchet the legacy onboard-selection.test.ts size budget from 5,624 to 4,834 lines
  • sync the latest main and correct its stale plugin-entry assertion so the test preserves the intentional omission of acpx

Wrong-Gateway Source-of-Truth Review

  • Invalid state: an empty active-gateway sandbox list is ambiguous when the registry's recorded gateway differs from the currently selected gateway; it must not authorize stale destruction
  • Source boundary: gateway-state.ts#getReconciledSandboxGatewayState and its named-gateway reconciliation path own the classification
  • Source constraint: gateway selection is mutable, so a NotFound response by itself cannot prove the recorded sandbox is stale on its own gateway
  • Regression coverage: rebuild-gateway-drift.test.ts now drives the real classifier for nemoclaw/other-gw and nemoclaw-9000/nemoclaw, then verifies no backup, delete, registry removal, or onboard occurs
  • Removal condition: retain this contract until gateway reconciliation and the rebuild mutation decision become one typed, atomic boundary

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification: test-isolation and regression-coverage changes only; production behavior, CLI output, configuration, defaults, and public APIs are unchanged
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: independent reviews verified the real wrong-gateway reconciliation path, destructive-boundary assertions, provider call-site wiring, environment cleanup, and retained process boundaries; no actionable findings remain
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

  • PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — test/onboard-selection.test.ts passed 66/66 at final head; test/rebuild-stale-recovery.test.ts passed 5/5 in 3.49 seconds wall; rebuild-flow.test.ts plus rebuild-gateway-drift.test.ts passed 85/85; the final main sync's OpenClaw config test plus the unrelated Hermes stress file passed 33/33 with 2 environment skips
  • Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: final-head CI passed all five CLI coverage shards, the merged coverage gate, static/type checks, package lanes, and sandbox smoke tests
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Carlos Villela cvillela@nvidia.com

@cv cv self-assigned this Jul 7, 2026
@coderabbitai

coderabbitai Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

The rebuild flow test harness adds a reconciled sandbox gateway override, stale-recovery tests are rewritten around the harness and a simplified fixture, gateway-drift coverage is expanded, one default plugin-entry expectation changes, and a CI budget entry is updated.

Changes

Rebuild Stale-Recovery Test Refactor

Layer / File(s) Summary
Harness override support
test/helpers/rebuild-flow-test-harness.ts, test/helpers/rebuild-flow-test-support.ts
RebuildFlowOverrides gains an optional reconciledSandboxGatewayState field, and the harness mock returns it when provided, otherwise falling back to the prior staleRecovery-derived default.
Stale-recovery test suite migration
test/rebuild-stale-recovery.test.ts
Imports and installs the rebuild flow test harness hooks, hardcodes createStaleFixture inputs, simplifies the fake openshell script, and replaces spawn-based tests with harness-based assertions plus direct sandboxes.json reads.
Gateway drift guard test
src/lib/actions/sandbox/rebuild-gateway-drift.test.ts
Adds a parameterized test covering a missing sandbox with a different active named gateway, and asserts stale-recovery side effects are skipped while gateway selection still happens.

OpenClaw Default Plugin Entry Expectation

Layer / File(s) Summary
Default plugin entry assertion
test/generate-openclaw-config-plugin-entries.test.ts
Renames the default plugin entries test case and changes the assertion for config.plugins.entries.acpx from a disabled object to undefined.

CI File-Size Budget Update

Layer / File(s) Summary
Budget threshold update
ci/test-file-size-budget.json
Updates the legacy max line budget for test/onboard-selection.test.ts.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

  • NVIDIA/NemoClaw#953: Directly relates to the same reconciled sandbox gateway state logic used by the new harness override and drift test.

Suggested labels: refactor

Suggested reviewers: jyaunches

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: reducing process isolation in test rebuild and provider-selection flows.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/perf-rebuild-stale-recovery

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the codex/perf-rebuild-s... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main codex/perf-rebuild-s... f4bc37a +/-
nemoclaw/src/se...cret-scanner.ts 100%
nemoclaw/src/commands/slash.ts 100%
nemoclaw/src/li...bprocess-env.ts 100%
nemoclaw/src/bl...eprint/state.ts 98%
nemoclaw/src/onboard/config.ts 98%
nemoclaw/src/bl...int/snapshot.ts 97%
nemoclaw/src/bl...print/runner.ts 95%
nemoclaw/src/co...ration-state.ts 94%
nemoclaw/src/bl...ate-networks.ts 94%
nemoclaw/src/index.ts 94%

TypeScript / code-coverage/cli

The overall coverage in the codex/perf-rebuild-s... branch is 75%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main codex/perf-rebuild-s... f4bc37a +/-
src/lib/shields...nsition-lock.ts 85%
src/lib/onboard/preflight.ts 83%
src/lib/actions...all/run-plan.ts 81%
src/lib/state/o...oard-session.ts 80%
src/lib/actions...licy-channel.ts 79%
src/lib/state/sandbox.ts 75%
src/lib/onboard...er-gpu-patch.ts 69%
src/lib/shields/index.ts 68%
src/lib/policy/index.ts 66%
src/lib/onboard.ts 28%

Updated July 07, 2026 08:48 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Advisor Recommendation

Required E2E: None
Optional E2E: None

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

  • None. No E2E is required: this PR is tests-only plus a CI test-size budget update. It does not change runtime code or assets that can affect installer/onboarding behavior, sandbox lifecycle, credentials, security boundaries, network policy, inference routing, deployment, or real assistant user flows.

Optional E2E

  • None.

New E2E recommendations

  • None.

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Recommendation

Required E2E targets: None
Optional E2E targets: None

Workflow run

Full E2E target advisor summary

E2E Target Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E targets

  • None. No E2E target dispatch is required because this PR only changes unit/integration test files outside test/e2e and CI test-size budget metadata; it does not change E2E target registry, workflow wiring, fixtures, live tests, or target-relevant runtime behavior.

Optional E2E targets

  • None.

Relevant changed files

  • None.

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: Add or justify PRA-T1 and any related test follow-ups.
Open items: 0 required · 0 warnings · 0 suggestions · 5 test follow-ups
Since last review: 0 prior items resolved · 4 still apply · 0 new items found

Action checklist

  • PRA-T1 Add or justify test follow-up: Runtime validation
  • PRA-T2 Add or justify test follow-up: Runtime validation
  • PRA-T3 Add or justify test follow-up: Runtime validation
  • PRA-T4 Add or justify test follow-up: Runtime validation
  • PRA-T5 Add or justify test follow-up: Acceptance clause
Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

  • PRA-T1 Runtime validation — Identify targeted runtime validation for test/onboard-selection.test.ts showing the batched credential back/exit child process and in-process credential retry/provider-selection helpers pass without order-dependent env or module-cache state.. Static review found focused coverage and no blocking gaps, but the PR deliberately reduces child-process/module-cache/env isolation in sensitive provider-selection and stale-rebuild tests. Runtime validation evidence is useful because process boundaries are part of the behavior being refactored.
  • PRA-T2 Runtime validation — Identify targeted runtime validation for test/rebuild-stale-recovery.test.ts showing successful stale recovery, wrong-gateway refusal, non-default gateway refusal, and the retained real CLI/HOME rollback contract.. Static review found focused coverage and no blocking gaps, but the PR deliberately reduces child-process/module-cache/env isolation in sensitive provider-selection and stale-rebuild tests. Runtime validation evidence is useful because process boundaries are part of the behavior being refactored.
  • PRA-T3 Runtime validation — Identify targeted runtime validation for src/lib/actions/sandbox/rebuild-gateway-drift.test.ts showing the real wrong-gateway classifier refuses destructive stale recovery for both recorded/default and recorded/per-port gateway mismatch directions.. Static review found focused coverage and no blocking gaps, but the PR deliberately reduces child-process/module-cache/env isolation in sensitive provider-selection and stale-rebuild tests. Runtime validation evidence is useful because process boundaries are part of the behavior being refactored.
  • PRA-T4 Runtime validation — If literal perf(test): reduce test I/O to restore 2–5 minute full-suite runs #6245 acceptance mapping is required, provide the linked issue body/comments or identify the clauses so they can be mapped to the changed provider-selection tests.. Static review found focused coverage and no blocking gaps, but the PR deliberately reduces child-process/module-cache/env isolation in sensitive provider-selection and stale-rebuild tests. Runtime validation evidence is useful because process boundaries are part of the behavior being refactored.
  • PRA-T5 Acceptance clause — Linked issue perf(test): reduce test I/O to restore 2–5 minute full-suite runs #6245 clauses and comments — add test evidence or identify existing coverage. The deterministic validation context reports linkedIssues: []; no literal issue body or issue comments were available to extract. The changed tests cover the visible PR-scope behaviors: provider menu/model selection, credential back/exit/retry paths, non-interactive credential failures, stale rebuild recovery, wrong-gateway refusal, and acpx omission.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor (Nemotron Ultra) — Blocked

Merge posture: Do not merge until addressed
Primary next action: Fix PRA-3: Dead test file: lifecycle-cases.ts exports 15+ security-relevant test cases never executed; then add or justify PRA-T1.
Open items: 3 required · 6 warnings · 4 suggestions · 5 test follow-ups
Since last review: 1 prior item resolved · 8 still apply · 3 new items found

Action checklist

  • PRA-3 Fix: Dead test file: lifecycle-cases.ts exports 15+ security-relevant test cases never executed in test/helpers/rebuild-flow-lifecycle-cases.ts:12
  • PRA-4 Fix: Dead test file: credential-preflight-cases.ts exports 10+ credential preflight edge cases never executed in test/helpers/rebuild-flow-credential-preflight-cases.ts:83
  • PRA-5 Fix: Harness accepts sensitive gateway topology in reconciledSandboxGatewayState override without sanitization in test/helpers/rebuild-flow-test-harness.ts:86
  • PRA-1 Resolve or justify: Source-of-truth review needed: test/helpers/rebuild-flow-lifecycle-cases.ts dead test file
  • PRA-2 Resolve or justify: Source-of-truth review needed: test/helpers/rebuild-flow-credential-preflight-cases.ts dead test file
  • PRA-6 Resolve or justify: Shell string execution surface in test fixtures (writeOpenAiStyleAuthRetryCurl, writeAlwaysOkCurl) in test/onboard-selection.test.ts:470
  • PRA-7 Resolve or justify: Test file monolith growth: 337→426 lines (+89) with repeated setup boilerplate in src/lib/actions/sandbox/rebuild-gateway-drift.test.ts:1
  • PRA-8 Resolve or justify: Batched credential scenarios may mask per-test failures in test/onboard-selection.test.ts:594
  • PRA-9 Resolve or justify: Two parallel harnesses with divergent reconciledSandboxGatewayState types in test/helpers/rebuild-flow-test-harness.ts:107
  • PRA-T1 Add or justify test follow-up: Dead test file: lifecycle-cases.ts exports 15+ security-relevant test cases never executed
  • PRA-T2 Add or justify test follow-up: Dead test file: credential-preflight-cases.ts exports 10+ credential preflight edge cases never executed
  • PRA-T3 Add or justify test follow-up: Retained shell-script integration test could convert to harness
  • PRA-T4 Add or justify test follow-up: test/helpers/rebuild-flow-lifecycle-cases.ts dead test file
  • PRA-T5 Add or justify test follow-up: test/helpers/rebuild-flow-credential-preflight-cases.ts dead test file
  • PRA-10 In-scope improvement: Single-use readRegistry helper could be inlined in test/rebuild-stale-recovery.test.ts:66
  • PRA-11 In-scope improvement: Repeated env var save/restore pattern — extract withEnv helper in test/onboard-selection.test.ts:594
  • PRA-12 In-scope improvement: Repeated prompt mock sequence pattern — extract makePromptSequence helper in test/onboard-selection.test.ts:470
  • PRA-13 In-scope improvement: Retained shell-script integration test could convert to harness in test/rebuild-stale-recovery.test.ts:285

Findings index

ID Severity Category Location Required action
PRA-1 Resolve/justify architecture Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
PRA-2 Resolve/justify architecture Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
PRA-3 Required tests test/helpers/rebuild-flow-lifecycle-cases.ts:12 Either import and call registerRebuildFlowLifecycleTests() in an actual test file (e.g., create test/rebuild-flow-lifecycle.test.ts), or delete the file if superseded by existing harness tests.
PRA-4 Required tests test/helpers/rebuild-flow-credential-preflight-cases.ts:83 Either import and call registerRebuildFlowCredentialPreflightTests() in an actual test file, or delete the file if superseded.
PRA-5 Required security test/helpers/rebuild-flow-test-harness.ts:86 Add a test helper that sanitizes gateway state for logging (e.g., sanitizeGatewayStateForLogging()) and apply it in errorSpy/logSpy assertions. Or restrict the override surface to only the fields tests actually need (state, activeGateway).
PRA-6 Resolve/justify security test/onboard-selection.test.ts:470 Replace fake curl/ollama shell scripts with Node.js child_process mocks or a tiny test HTTP server (e.g., using node:http). At minimum, use template literal escaping discipline and avoid dynamic command construction.
PRA-7 Resolve/justify architecture src/lib/actions/sandbox/rebuild-gateway-drift.test.ts:1 Extract common gateway drift test setup into a helper (e.g., createGatewayDriftHarness()) shared by all tests in this file.
PRA-8 Resolve/justify correctness test/onboard-selection.test.ts:594 Either run each scenario in its own spawnSync (preserving parallelism via Promise.all), or add per-scenario try/catch with independent assertions inside the batch script.
PRA-9 Resolve/justify architecture test/helpers/rebuild-flow-test-harness.ts:107 Align rebuild-flow-harness.ts to import and use SandboxGatewayState from src/lib/actions/sandbox/gateway-state, or consolidate to a single harness if they serve overlapping purposes.
PRA-10 Improvement architecture test/rebuild-stale-recovery.test.ts:66 Inline the JSON.parse(fs.readFileSync(...)) directly at the call site.
PRA-11 Improvement architecture test/onboard-selection.test.ts:594 Consistently use snapshotEnv([...]) from test/helpers/rebuild-flow-test-support.ts (exported via test-harness.ts) or extract a withEnv(key, value, fn) helper.
PRA-12 Improvement architecture test/onboard-selection.test.ts:470 Extract makePromptSequence(answers: string[]) => (msg: string) => answers.shift() || '' helper.
PRA-13 Improvement tests test/rebuild-stale-recovery.test.ts:285 Convert to harness-based test with staleRecovery: true and an onboard override that throws, or document why the real CLI boundary is essential (e.g., tests actual binary entry point, env parsing, HOME discovery).

🚨 Required before merge

Address these before merging unless a maintainer explicitly overrides the advisor with rationale.

PRA-3 Required — Dead test file: lifecycle-cases.ts exports 15+ security-relevant test cases never executed

  • Location: test/helpers/rebuild-flow-lifecycle-cases.ts:12
  • Category: tests
  • Problem: Exports registerRebuildFlowLifecycleTests() with cases for successful stale recovery with MCP, shields relock on failure, agent version enforcement, multi-agent rejection — all dead code creating false coverage confidence.
  • Impact: Security-relevant edge cases (MCP bridge prep, shields relock, agent version checks, multi-agent rejection) are not exercised in CI despite appearing in test inventory. Regressions in these flows would not be caught.
  • Required action: Either import and call registerRebuildFlowLifecycleTests() in an actual test file (e.g., create test/rebuild-flow-lifecycle.test.ts), or delete the file if superseded by existing harness tests.
  • Expected follow-up: Fix before merge or get explicit maintainer override.
  • Verification: Run 'grep -r registerRebuildFlowLifecycleTests test/' — only the export line at line 12 should appear if fixed.
  • Missing regression test: All 15+ test cases in this file are currently unexecuted; they should be running in CI.
  • Done when: The required change is committed and verification passes: Run 'grep -r registerRebuildFlowLifecycleTests test/' — only the export line at line 12 should appear if fixed.
  • Evidence: Static grep confirms zero call sites. File exports function but is never imported. Previous review PRA-4 flagged this as required.

PRA-4 Required — Dead test file: credential-preflight-cases.ts exports 10+ credential preflight edge cases never executed

  • Location: test/helpers/rebuild-flow-credential-preflight-cases.ts:83
  • Category: tests
  • Problem: Exports registerRebuildFlowCredentialPreflightTests() with cases for provider changed during rebuild, credential disappeared at delete edge ([All Platforms][Upgrade] v0.0.55 → v0.0.76 leaves pre-existing sandboxes stuck in Provisioning/Error — user data inaccessible until manual rebuild #6114), indeterminate gateway lookup, delete-edge race conditions — all dead code.
  • Impact: Security-critical credential preflight races (credential loss, provider change, indeterminate lookup) are not exercised in CI. False confidence in rebuild credential validation.
  • Required action: Either import and call registerRebuildFlowCredentialPreflightTests() in an actual test file, or delete the file if superseded.
  • Expected follow-up: Fix before merge or get explicit maintainer override.
  • Verification: Run 'grep -r registerRebuildFlowCredentialPreflightTests test/' — only the export line at line 83 should appear if fixed.
  • Missing regression test: All 10+ test cases in this file are currently unexecuted; they should be running in CI.
  • Done when: The required change is committed and verification passes: Run 'grep -r registerRebuildFlowCredentialPreflightTests test/' — only the export line at line 83 should appear if fixed.
  • Evidence: Static grep confirms zero call sites. File exports function but is never imported. Previous review PRA-5 flagged this as required.

PRA-5 Required — Harness accepts sensitive gateway topology in reconciledSandboxGatewayState override without sanitization

  • Location: test/helpers/rebuild-flow-test-harness.ts:86
  • Category: security
  • Problem: The RebuildFlowOverrides type now includes reconciledSandboxGatewayState?: SandboxGatewayState, allowing tests to inject arbitrary gateway state including activeGateway, output (which may contain gateway status details). No sanitization helper exists to prevent sensitive topology leakage in test logs.
  • Impact: Test overrides can inject sensitive gateway topology (active gateway names, status output). If test logs are captured or printed, this could leak internal gateway state structure.
  • Required action: Add a test helper that sanitizes gateway state for logging (e.g., sanitizeGatewayStateForLogging()) and apply it in errorSpy/logSpy assertions. Or restrict the override surface to only the fields tests actually need (state, activeGateway).
  • Expected follow-up: Fix before merge or get explicit maintainer override.
  • Verification: Inspect test/helpers/rebuild-flow-test-harness.ts line 86 and test/helpers/rebuild-flow-test-support.ts line 57 for the override definition. Check if any test logs harness.errorSpy.mock.calls containing gateway state.
  • Missing regression test: Add a test that verifies gateway state injected via override does not appear verbatim in console.error/console.log output.
  • Done when: The required change is committed and verification passes: Inspect test/helpers/rebuild-flow-test-harness.ts line 86 and test/helpers/rebuild-flow-test-support.ts line 57 for the override definition. Check if any test logs harness.errorSpy.mock.calls containing gateway state.
  • Evidence: PR adds reconciledSandboxGatewayState to RebuildFlowOverrides (test-support.ts:57) and uses it in harness (test-harness.ts:86). Previous review PRA-13 (SEC-2) flagged this.
Review findings by urgency: 3 required fixes, 6 items to resolve/justify, 4 in-scope improvements

⚠️ Resolve or justify before merge

Investigate these in the current review; either fix them, explain why they are not applicable, or document the accepted risk.

PRA-1 Resolve/justify — Source-of-truth review needed: test/helpers/rebuild-flow-lifecycle-cases.ts dead test file

  • Location: not file-specific
  • Category: architecture
  • Problem: The advisor marked localized patch analysis as missing.
  • Impact: A localized workaround can preserve or hide an invalid state when the source boundary is unclear.
  • Recommended action: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
  • Missing regression test: Import and call registerRebuildFlowLifecycleTests() in a real test file (e.g., test/rebuild-flow-lifecycle.test.ts)
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
  • Evidence: grep -r registerRebuildFlowLifecycleTests test/ returns only the export line at line 12.

PRA-2 Resolve/justify — Source-of-truth review needed: test/helpers/rebuild-flow-credential-preflight-cases.ts dead test file

  • Location: not file-specific
  • Category: architecture
  • Problem: The advisor marked localized patch analysis as missing.
  • Impact: A localized workaround can preserve or hide an invalid state when the source boundary is unclear.
  • Recommended action: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
  • Missing regression test: Import and call registerRebuildFlowCredentialPreflightTests() in a real test file
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
  • Evidence: grep -r registerRebuildFlowCredentialPreflightTests test/ returns only the export line at line 83.

PRA-6 Resolve/justify — Shell string execution surface in test fixtures (writeOpenAiStyleAuthRetryCurl, writeAlwaysOkCurl)

  • Location: test/onboard-selection.test.ts:470
  • Category: security
  • Problem: Test fixtures generate bash scripts with template literal interpolation for curl/ollama mocks. While test-controlled, this pattern is a copy-paste hazard and executes shell strings.
  • Impact: Pattern could be misused if copied to production-adjacent code. Shell injection surface in test infrastructure.
  • Recommended action: Replace fake curl/ollama shell scripts with Node.js child_process mocks or a tiny test HTTP server (e.g., using node:http). At minimum, use template literal escaping discipline and avoid dynamic command construction.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Search for writeOpenAiStyleAuthRetryCurl and writeAlwaysOkCurl in test/onboard-selection.test.ts. Verify they only generate static scripts with controlled token values.
  • Missing regression test: N/A — this is a test infrastructure improvement, not a behavior change.
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Search for writeOpenAiStyleAuthRetryCurl and writeAlwaysOkCurl in test/onboard-selection.test.ts. Verify they only generate static scripts with controlled token values.
  • Evidence: Functions at lines 470 and 515 generate bash heredocs with ${goodToken}, ${body}, ${models} interpolation. Previous review PRA-12 (SEC-1) flagged this.

PRA-7 Resolve/justify — Test file monolith growth: 337→426 lines (+89) with repeated setup boilerplate

  • Location: src/lib/actions/sandbox/rebuild-gateway-drift.test.ts:1
  • Category: architecture
  • Problem: Common gateway drift test setup (spies, mocks, registry stubs) repeated across 5 tests. File exceeds 400-line budget threshold.
  • Impact: Maintenance burden increases; bug fixes to common setup must be applied in multiple places. Harder to verify consistent preconditions across tests.
  • Recommended action: Extract common gateway drift test setup into a helper (e.g., createGatewayDriftHarness()) shared by all tests in this file.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Count lines in rebuild-gateway-drift.test.ts. Identify repeated beforeEach blocks and spy initialization.
  • Missing regression test: N/A — refactor should not change test behavior.
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Count lines in rebuild-gateway-drift.test.ts. Identify repeated beforeEach blocks and spy initialization.
  • Evidence: File grew from 337 to 426 lines in this PR. Drift tool flagged as blocker for monolith growth. Previous review PRA-10 warned about this.

PRA-8 Resolve/justify — Batched credential scenarios may mask per-test failures

  • Location: test/onboard-selection.test.ts:594
  • Category: correctness
  • Problem: runCredentialBackScenarioBatch() runs 9 scenarios in one spawnSync child process. If one scenario fails, all 9 appear failed with no per-scenario isolation.
  • Impact: Debugging failed credential-back scenarios becomes harder. Flaky or environment-dependent failures in one scenario cascade to all.
  • Recommended action: Either run each scenario in its own spawnSync (preserving parallelism via Promise.all), or add per-scenario try/catch with independent assertions inside the batch script.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Run vitest run test/onboard-selection.test.ts -t 'credential' and verify each of the 9 scenarios reports pass/fail independently.
  • Missing regression test: Add a test that intentionally breaks one scenario (e.g., wrong prompt pattern) and verifies only that scenario fails.
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Run vitest run test/onboard-selection.test.ts -t 'credential' and verify each of the 9 scenarios reports pass/fail independently.
  • Evidence: runCredentialBackScenarioBatch() at line 594 executes all PROCESS_CREDENTIAL_BACK_SCENARIOS in one Node child. Previous review noted this as a new abstraction layer.

PRA-9 Resolve/justify — Two parallel harnesses with divergent reconciledSandboxGatewayState types

  • Location: test/helpers/rebuild-flow-test-harness.ts:107
  • Category: architecture
  • Problem: test/helpers/rebuild-flow-test-harness.ts and test/helpers/rebuild-flow-harness.ts (referenced in previous review line 107) both define RebuildFlowOverrides with reconciledSandboxGatewayState but may have diverged in type shape or imports.
  • Impact: Type drift risk. Tests using different harnesses may pass incompatible gateway state shapes, causing confusing failures or missed assertions.
  • Recommended action: Align rebuild-flow-harness.ts to import and use SandboxGatewayState from src/lib/actions/sandbox/gateway-state, or consolidate to a single harness if they serve overlapping purposes.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Compare RebuildFlowOverrides.reconciledSandboxGatewayState type in both harness files. Check imports of SandboxGatewayState.
  • Missing regression test: Add a test that imports both harnesses and verifies SandboxGatewayState shape compatibility.
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Compare RebuildFlowOverrides.reconciledSandboxGatewayState type in both harness files. Check imports of SandboxGatewayState.
  • Evidence: Previous review PRA-7 flagged this. Current PR adds reconciledSandboxGatewayState to one harness but doesn't address the other.

💡 In-scope improvements

These are lower-risk, not throwaway. Prefer fixing them in this PR when they are local to changed code; defer only with rationale or a linked follow-up.

PRA-10 Improvement — Single-use readRegistry helper could be inlined

  • Location: test/rebuild-stale-recovery.test.ts:66
  • Category: architecture
  • Problem: readRegistry(fixture) helper at line 66 is called only once (line 319). Inlining eliminates indirection.
  • Impact: Minor — adds one extra function to read for no reuse benefit.
  • Suggested action: Inline the JSON.parse(fs.readFileSync(...)) directly at the call site.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Search for readRegistry calls in rebuild-stale-recovery.test.ts — should be zero after inlining.
  • Missing regression test: N/A — refactor only.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Helper defined at line 66, used once at line 319. Previous review PRA-9 suggested this.

PRA-11 Improvement — Repeated env var save/restore pattern — extract withEnv helper

  • Location: test/onboard-selection.test.ts:594
  • Category: architecture
  • Problem: Pattern of `previousX = process.env.X; process.env.X = Y; try { ... } finally { restoreProcessEnvValue(X, previousX) }` appears at lines 1364, 1940, 3441, 3489, 3600, 3763. snapshotEnv(['X']) pattern already exists in test helpers.
  • Impact: Inconsistent env isolation. Boilerplate increases risk of forgotten restoration.
  • Suggested action: Consistently use snapshotEnv([...]) from test/helpers/rebuild-flow-test-support.ts (exported via test-harness.ts) or extract a withEnv(key, value, fn) helper.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Count occurrences of 'previousCredential = process.env.' and 'restoreProcessEnvValue' in onboard-selection.test.ts.
  • Missing regression test: N/A — refactor only.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: 6+ occurrences of manual env save/restore. Previous review PRA-11 suggested this.

PRA-12 Improvement — Repeated prompt mock sequence pattern — extract makePromptSequence helper

  • Location: test/onboard-selection.test.ts:470
  • Category: architecture
  • Problem: Pattern of `const answers = [...]; prompt: async () => answers.shift() || ''` appears at lines 594, 601, 3751, and similar. Could be a shared helper.
  • Impact: Minor duplication. Consistent helper would reduce copy-paste errors in answer sequences.
  • Suggested action: Extract makePromptSequence(answers: string[]) => (msg: string) => answers.shift() || '' helper.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Search for 'answers.shift()' in onboard-selection.test.ts.
  • Missing regression test: N/A — refactor only.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: At least 4 occurrences of the pattern. Simplification signal at lines 594, 601 flagged as 'wrapper'.

PRA-13 Improvement — Retained shell-script integration test could convert to harness

  • Location: test/rebuild-stale-recovery.test.ts:285
  • Category: tests
  • Problem: The one retained CLI/HOME rollback test (createStaleFixture + runRebuild + readRegistry) uses spawnSync with fake openshell/docker binaries. The harness already supports staleRecovery, reconciledSandboxGatewayState, and onboard overrides.
  • Impact: Maintains two test styles (harness vs CLI) for the same behavior. CLI test is slower and more fragile.
  • Suggested action: Convert to harness-based test with staleRecovery: true and an onboard override that throws, or document why the real CLI boundary is essential (e.g., tests actual binary entry point, env parsing, HOME discovery).
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Compare test coverage: harness test at line 40 vs CLI test at line 285. Check if CLI test asserts anything the harness test doesn't (e.g., imageTag: null on registry preservation).
  • Missing regression test: If converted, ensure harness test also asserts registry.sandboxes[fixture.sandboxName].imageTag === null after failed recreate.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: CLI test at line 285 uses spawnSync with fake binaries. Previous review PRA-6 suggested conversion. PR body justifies retention as 'real CLI/HOME rollback contract'.
Simplification opportunities: 9 possible cuts, net -364 lines possible

These are safe simplification checks only. Do not remove validation, security controls, data-loss prevention, or required tests.

  • PRA-5 shrink (test/helpers/rebuild-flow-test-harness.ts:86): Full SandboxGatewayState object in override
    • Replacement: Typed subset with only state and activeGateway fields, plus sanitizeGatewayStateForLogging helper
    • Net: 15 lines
    • Safety boundary: Must not weaken the gateway reconciliation contract tests that need to inject wrong_gateway_active state
  • PRA-6 native (test/onboard-selection.test.ts:470): Bash script generation via template literals
    • Replacement: Node.js http.createServer() test doubles or vi.fn() mocks for child_process.spawnSync
    • Net: -50 lines
    • Safety boundary: Must preserve real subprocess boundary tests for systemd sudo modes, Docker interactions, Windows host Ollama
  • PRA-7 shrink (src/lib/actions/sandbox/rebuild-gateway-drift.test.ts:1): Repeated beforeEach spy/setup boilerplate (~80 lines)
    • Replacement: createGatewayDriftHarness() factory returning { spies, cleanup, rebuildSandbox }
    • Net: -60 lines
    • Safety boundary: Must not alter the parameterized wrong-gateway test scenarios or their assertions
  • PRA-8 shrink (test/onboard-selection.test.ts:594): Single batch runner with shared answers/state
    • Replacement: Individual runCredentialBackScenario() calls with Promise.all for parallelism, or per-scenario isolation in batch script
    • Net: 20 lines
    • Safety boundary: Must retain the 50→26 Node boot reduction (performance goal)
  • PRA-9 delete (test/helpers/rebuild-flow-test-harness.ts:107): Duplicate harness file if overlapping purpose
    • Replacement: Single canonical harness in test/helpers/rebuild-flow-test-harness.ts
    • Net: -200 lines
    • Safety boundary: Must not lose any unique test capabilities of either harness
  • PRA-10 delete (test/rebuild-stale-recovery.test.ts:66): readRegistry helper function (5 lines)
    • Replacement: JSON.parse(fs.readFileSync(path.join(fixture.nemoclawDir, 'sandboxes.json'), 'utf-8'))
    • Net: -3 lines
    • Safety boundary: None — pure test utility
  • PRA-11 stdlib (test/onboard-selection.test.ts:594): Manual env save/restore boilerplate (~6 occurrences × 4 lines)
    • Replacement: snapshotEnv([key]) or withEnv(key, value, () => { ... })
    • Net: -18 lines
    • Safety boundary: Must preserve exact env isolation semantics (restore on throw, delete if was undefined)
  • PRA-12 shrink (test/onboard-selection.test.ts:470): Inline answers array + shift pattern (~4 occurrences × 3 lines)
    • Replacement: makePromptSequence([...])
    • Net: -8 lines
    • Safety boundary: Must not change prompt call semantics (async, secret option handling)
  • PRA-13 shrink (test/rebuild-stale-recovery.test.ts:285): createStaleFixture, runRebuild, readRegistry, fake openshell/docker binaries (~80 lines)
    • Replacement: createRebuildFlowHarness({ staleRecovery: true, onboard: () => { throw new Error('recreate-stub') } }) with registry assertions
    • Net: -60 lines
    • Safety boundary: Must retain verification that real CLI entry point preserves registry entry with imageTag: null on recreate failure
Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

  • PRA-T1 Dead test file: lifecycle-cases.ts exports 15+ security-relevant test cases never executed — Either import and call registerRebuildFlowLifecycleTests() in an actual test file (e.g., create test/rebuild-flow-lifecycle.test.ts), or delete the file if superseded by existing harness tests.
  • PRA-T2 Dead test file: credential-preflight-cases.ts exports 10+ credential preflight edge cases never executed — Either import and call registerRebuildFlowCredentialPreflightTests() in an actual test file, or delete the file if superseded.
  • PRA-T3 Retained shell-script integration test could convert to harness — Convert to harness-based test with staleRecovery: true and an onboard override that throws, or document why the real CLI boundary is essential (e.g., tests actual binary entry point, env parsing, HOME discovery).
  • PRA-T4 test/helpers/rebuild-flow-lifecycle-cases.ts dead test file — Import and call registerRebuildFlowLifecycleTests() in a real test file (e.g., test/rebuild-flow-lifecycle.test.ts). grep -r registerRebuildFlowLifecycleTests test/ returns only the export line at line 12.
  • PRA-T5 test/helpers/rebuild-flow-credential-preflight-cases.ts dead test file — Import and call registerRebuildFlowCredentialPreflightTests() in a real test file. grep -r registerRebuildFlowCredentialPreflightTests test/ returns only the export line at line 83.
Since last review details

Current findings, using the urgency labels above:

PRA-1 Resolve/justify — Source-of-truth review needed: test/helpers/rebuild-flow-lifecycle-cases.ts dead test file

  • Location: not file-specific
  • Category: architecture
  • Problem: The advisor marked localized patch analysis as missing.
  • Impact: A localized workaround can preserve or hide an invalid state when the source boundary is unclear.
  • Recommended action: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
  • Missing regression test: Import and call registerRebuildFlowLifecycleTests() in a real test file (e.g., test/rebuild-flow-lifecycle.test.ts)
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
  • Evidence: grep -r registerRebuildFlowLifecycleTests test/ returns only the export line at line 12.

PRA-2 Resolve/justify — Source-of-truth review needed: test/helpers/rebuild-flow-credential-preflight-cases.ts dead test file

  • Location: not file-specific
  • Category: architecture
  • Problem: The advisor marked localized patch analysis as missing.
  • Impact: A localized workaround can preserve or hide an invalid state when the source boundary is unclear.
  • Recommended action: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
  • Missing regression test: Import and call registerRebuildFlowCredentialPreflightTests() in a real test file
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
  • Evidence: grep -r registerRebuildFlowCredentialPreflightTests test/ returns only the export line at line 83.

PRA-3 Required — Dead test file: lifecycle-cases.ts exports 15+ security-relevant test cases never executed

  • Location: test/helpers/rebuild-flow-lifecycle-cases.ts:12
  • Category: tests
  • Problem: Exports registerRebuildFlowLifecycleTests() with cases for successful stale recovery with MCP, shields relock on failure, agent version enforcement, multi-agent rejection — all dead code creating false coverage confidence.
  • Impact: Security-relevant edge cases (MCP bridge prep, shields relock, agent version checks, multi-agent rejection) are not exercised in CI despite appearing in test inventory. Regressions in these flows would not be caught.
  • Required action: Either import and call registerRebuildFlowLifecycleTests() in an actual test file (e.g., create test/rebuild-flow-lifecycle.test.ts), or delete the file if superseded by existing harness tests.
  • Expected follow-up: Fix before merge or get explicit maintainer override.
  • Verification: Run 'grep -r registerRebuildFlowLifecycleTests test/' — only the export line at line 12 should appear if fixed.
  • Missing regression test: All 15+ test cases in this file are currently unexecuted; they should be running in CI.
  • Done when: The required change is committed and verification passes: Run 'grep -r registerRebuildFlowLifecycleTests test/' — only the export line at line 12 should appear if fixed.
  • Evidence: Static grep confirms zero call sites. File exports function but is never imported. Previous review PRA-4 flagged this as required.

PRA-4 Required — Dead test file: credential-preflight-cases.ts exports 10+ credential preflight edge cases never executed

  • Location: test/helpers/rebuild-flow-credential-preflight-cases.ts:83
  • Category: tests
  • Problem: Exports registerRebuildFlowCredentialPreflightTests() with cases for provider changed during rebuild, credential disappeared at delete edge ([All Platforms][Upgrade] v0.0.55 → v0.0.76 leaves pre-existing sandboxes stuck in Provisioning/Error — user data inaccessible until manual rebuild #6114), indeterminate gateway lookup, delete-edge race conditions — all dead code.
  • Impact: Security-critical credential preflight races (credential loss, provider change, indeterminate lookup) are not exercised in CI. False confidence in rebuild credential validation.
  • Required action: Either import and call registerRebuildFlowCredentialPreflightTests() in an actual test file, or delete the file if superseded.
  • Expected follow-up: Fix before merge or get explicit maintainer override.
  • Verification: Run 'grep -r registerRebuildFlowCredentialPreflightTests test/' — only the export line at line 83 should appear if fixed.
  • Missing regression test: All 10+ test cases in this file are currently unexecuted; they should be running in CI.
  • Done when: The required change is committed and verification passes: Run 'grep -r registerRebuildFlowCredentialPreflightTests test/' — only the export line at line 83 should appear if fixed.
  • Evidence: Static grep confirms zero call sites. File exports function but is never imported. Previous review PRA-5 flagged this as required.

PRA-5 Required — Harness accepts sensitive gateway topology in reconciledSandboxGatewayState override without sanitization

  • Location: test/helpers/rebuild-flow-test-harness.ts:86
  • Category: security
  • Problem: The RebuildFlowOverrides type now includes reconciledSandboxGatewayState?: SandboxGatewayState, allowing tests to inject arbitrary gateway state including activeGateway, output (which may contain gateway status details). No sanitization helper exists to prevent sensitive topology leakage in test logs.
  • Impact: Test overrides can inject sensitive gateway topology (active gateway names, status output). If test logs are captured or printed, this could leak internal gateway state structure.
  • Required action: Add a test helper that sanitizes gateway state for logging (e.g., sanitizeGatewayStateForLogging()) and apply it in errorSpy/logSpy assertions. Or restrict the override surface to only the fields tests actually need (state, activeGateway).
  • Expected follow-up: Fix before merge or get explicit maintainer override.
  • Verification: Inspect test/helpers/rebuild-flow-test-harness.ts line 86 and test/helpers/rebuild-flow-test-support.ts line 57 for the override definition. Check if any test logs harness.errorSpy.mock.calls containing gateway state.
  • Missing regression test: Add a test that verifies gateway state injected via override does not appear verbatim in console.error/console.log output.
  • Done when: The required change is committed and verification passes: Inspect test/helpers/rebuild-flow-test-harness.ts line 86 and test/helpers/rebuild-flow-test-support.ts line 57 for the override definition. Check if any test logs harness.errorSpy.mock.calls containing gateway state.
  • Evidence: PR adds reconciledSandboxGatewayState to RebuildFlowOverrides (test-support.ts:57) and uses it in harness (test-harness.ts:86). Previous review PRA-13 (SEC-2) flagged this.

PRA-6 Resolve/justify — Shell string execution surface in test fixtures (writeOpenAiStyleAuthRetryCurl, writeAlwaysOkCurl)

  • Location: test/onboard-selection.test.ts:470
  • Category: security
  • Problem: Test fixtures generate bash scripts with template literal interpolation for curl/ollama mocks. While test-controlled, this pattern is a copy-paste hazard and executes shell strings.
  • Impact: Pattern could be misused if copied to production-adjacent code. Shell injection surface in test infrastructure.
  • Recommended action: Replace fake curl/ollama shell scripts with Node.js child_process mocks or a tiny test HTTP server (e.g., using node:http). At minimum, use template literal escaping discipline and avoid dynamic command construction.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Search for writeOpenAiStyleAuthRetryCurl and writeAlwaysOkCurl in test/onboard-selection.test.ts. Verify they only generate static scripts with controlled token values.
  • Missing regression test: N/A — this is a test infrastructure improvement, not a behavior change.
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Search for writeOpenAiStyleAuthRetryCurl and writeAlwaysOkCurl in test/onboard-selection.test.ts. Verify they only generate static scripts with controlled token values.
  • Evidence: Functions at lines 470 and 515 generate bash heredocs with ${goodToken}, ${body}, ${models} interpolation. Previous review PRA-12 (SEC-1) flagged this.

PRA-7 Resolve/justify — Test file monolith growth: 337→426 lines (+89) with repeated setup boilerplate

  • Location: src/lib/actions/sandbox/rebuild-gateway-drift.test.ts:1
  • Category: architecture
  • Problem: Common gateway drift test setup (spies, mocks, registry stubs) repeated across 5 tests. File exceeds 400-line budget threshold.
  • Impact: Maintenance burden increases; bug fixes to common setup must be applied in multiple places. Harder to verify consistent preconditions across tests.
  • Recommended action: Extract common gateway drift test setup into a helper (e.g., createGatewayDriftHarness()) shared by all tests in this file.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Count lines in rebuild-gateway-drift.test.ts. Identify repeated beforeEach blocks and spy initialization.
  • Missing regression test: N/A — refactor should not change test behavior.
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Count lines in rebuild-gateway-drift.test.ts. Identify repeated beforeEach blocks and spy initialization.
  • Evidence: File grew from 337 to 426 lines in this PR. Drift tool flagged as blocker for monolith growth. Previous review PRA-10 warned about this.

PRA-8 Resolve/justify — Batched credential scenarios may mask per-test failures

  • Location: test/onboard-selection.test.ts:594
  • Category: correctness
  • Problem: runCredentialBackScenarioBatch() runs 9 scenarios in one spawnSync child process. If one scenario fails, all 9 appear failed with no per-scenario isolation.
  • Impact: Debugging failed credential-back scenarios becomes harder. Flaky or environment-dependent failures in one scenario cascade to all.
  • Recommended action: Either run each scenario in its own spawnSync (preserving parallelism via Promise.all), or add per-scenario try/catch with independent assertions inside the batch script.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Run vitest run test/onboard-selection.test.ts -t 'credential' and verify each of the 9 scenarios reports pass/fail independently.
  • Missing regression test: Add a test that intentionally breaks one scenario (e.g., wrong prompt pattern) and verifies only that scenario fails.
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Run vitest run test/onboard-selection.test.ts -t 'credential' and verify each of the 9 scenarios reports pass/fail independently.
  • Evidence: runCredentialBackScenarioBatch() at line 594 executes all PROCESS_CREDENTIAL_BACK_SCENARIOS in one Node child. Previous review noted this as a new abstraction layer.

PRA-9 Resolve/justify — Two parallel harnesses with divergent reconciledSandboxGatewayState types

  • Location: test/helpers/rebuild-flow-test-harness.ts:107
  • Category: architecture
  • Problem: test/helpers/rebuild-flow-test-harness.ts and test/helpers/rebuild-flow-harness.ts (referenced in previous review line 107) both define RebuildFlowOverrides with reconciledSandboxGatewayState but may have diverged in type shape or imports.
  • Impact: Type drift risk. Tests using different harnesses may pass incompatible gateway state shapes, causing confusing failures or missed assertions.
  • Recommended action: Align rebuild-flow-harness.ts to import and use SandboxGatewayState from src/lib/actions/sandbox/gateway-state, or consolidate to a single harness if they serve overlapping purposes.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Compare RebuildFlowOverrides.reconciledSandboxGatewayState type in both harness files. Check imports of SandboxGatewayState.
  • Missing regression test: Add a test that imports both harnesses and verifies SandboxGatewayState shape compatibility.
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Compare RebuildFlowOverrides.reconciledSandboxGatewayState type in both harness files. Check imports of SandboxGatewayState.
  • Evidence: Previous review PRA-7 flagged this. Current PR adds reconciledSandboxGatewayState to one harness but doesn't address the other.

PRA-10 Improvement — Single-use readRegistry helper could be inlined

  • Location: test/rebuild-stale-recovery.test.ts:66
  • Category: architecture
  • Problem: readRegistry(fixture) helper at line 66 is called only once (line 319). Inlining eliminates indirection.
  • Impact: Minor — adds one extra function to read for no reuse benefit.
  • Suggested action: Inline the JSON.parse(fs.readFileSync(...)) directly at the call site.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Search for readRegistry calls in rebuild-stale-recovery.test.ts — should be zero after inlining.
  • Missing regression test: N/A — refactor only.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Helper defined at line 66, used once at line 319. Previous review PRA-9 suggested this.

PRA-11 Improvement — Repeated env var save/restore pattern — extract withEnv helper

  • Location: test/onboard-selection.test.ts:594
  • Category: architecture
  • Problem: Pattern of `previousX = process.env.X; process.env.X = Y; try { ... } finally { restoreProcessEnvValue(X, previousX) }` appears at lines 1364, 1940, 3441, 3489, 3600, 3763. snapshotEnv(['X']) pattern already exists in test helpers.
  • Impact: Inconsistent env isolation. Boilerplate increases risk of forgotten restoration.
  • Suggested action: Consistently use snapshotEnv([...]) from test/helpers/rebuild-flow-test-support.ts (exported via test-harness.ts) or extract a withEnv(key, value, fn) helper.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Count occurrences of 'previousCredential = process.env.' and 'restoreProcessEnvValue' in onboard-selection.test.ts.
  • Missing regression test: N/A — refactor only.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: 6+ occurrences of manual env save/restore. Previous review PRA-11 suggested this.

PRA-12 Improvement — Repeated prompt mock sequence pattern — extract makePromptSequence helper

  • Location: test/onboard-selection.test.ts:470
  • Category: architecture
  • Problem: Pattern of `const answers = [...]; prompt: async () => answers.shift() || ''` appears at lines 594, 601, 3751, and similar. Could be a shared helper.
  • Impact: Minor duplication. Consistent helper would reduce copy-paste errors in answer sequences.
  • Suggested action: Extract makePromptSequence(answers: string[]) => (msg: string) => answers.shift() || '' helper.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Search for 'answers.shift()' in onboard-selection.test.ts.
  • Missing regression test: N/A — refactor only.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: At least 4 occurrences of the pattern. Simplification signal at lines 594, 601 flagged as 'wrapper'.

PRA-13 Improvement — Retained shell-script integration test could convert to harness

  • Location: test/rebuild-stale-recovery.test.ts:285
  • Category: tests
  • Problem: The one retained CLI/HOME rollback test (createStaleFixture + runRebuild + readRegistry) uses spawnSync with fake openshell/docker binaries. The harness already supports staleRecovery, reconciledSandboxGatewayState, and onboard overrides.
  • Impact: Maintains two test styles (harness vs CLI) for the same behavior. CLI test is slower and more fragile.
  • Suggested action: Convert to harness-based test with staleRecovery: true and an onboard override that throws, or document why the real CLI boundary is essential (e.g., tests actual binary entry point, env parsing, HOME discovery).
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Compare test coverage: harness test at line 40 vs CLI test at line 285. Check if CLI test asserts anything the harness test doesn't (e.g., imageTag: null on registry preservation).
  • Missing regression test: If converted, ensure harness test also asserts registry.sandboxes[fixture.sandboxName].imageTag === null after failed recreate.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: CLI test at line 285 uses spawnSync with fake binaries. Previous review PRA-6 suggested conversion. PR body justifies retention as 'real CLI/HOME rollback contract'.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

@cv cv added the v0.0.76 label Jul 7, 2026
@cv

cv commented Jul 7, 2026

Copy link
Copy Markdown
Collaborator Author

Maintainer pass note: I cannot submit an independent review on my own PR. One blocker remains: the wrong-gateway stale-recovery tests now inject terminal wrong_gateway_active state, so they no longer exercise the integrated classifier-to-destructive-guard path. Add at least one test using the real getReconciledSandboxGatewayState flow and prove that a detected wrong gateway triggers neither delete nor onboard. The separate Nemotron claim about losing a successful-recovery happy path is not blocking; the old fixture never completed recreation.

@cv cv changed the title perf(test): run stale rebuild recovery in process perf(test): reduce rebuild and provider-selection process isolation Jul 7, 2026
@cv

cv commented Jul 7, 2026

Copy link
Copy Markdown
Collaborator Author

Final-head advisor resolution:

  • PRA-1 fixed: 33c2287c5 adds the focused successful stale-recovery contract. It verifies stale diagnostics, backup/restore skip, absent-sandbox MCP preparation, registry-derived recreate options, successful onboarding/finalization, and no rollback. The target passes 5/5 in 3.50s wall; the new case takes 65ms.
  • PRA-2/PRA-3 are false positives: src/lib/actions/sandbox/rebuild-flow.test.ts imports both registrars at lines 4–5 and invokes them at lines 11 and 13. The CLI Vitest project discovers that src/**/*.test.ts entrypoint. A focused run passed 79/79, visibly including all 9 lifecycle and 19 credential-preflight cases. The advisor searched only under test/, missing the source-side aggregator. Registering them again would duplicate execution; deleting them would remove live coverage. These files are also unchanged from origin/main.
  • PRA-4 retained intentionally: the one remaining process test uniquely covers real bin/nemoclaw.js dispatch, isolated HOME registry persistence, failed inner onboarding, and durable rollback with imageTag: null. The harness cannot faithfully prove that filesystem contract.
  • PRA-5 not introduced here: this PR's changed harness uses the production SandboxGatewayState type. The separate rebuild-flow-harness.ts is unchanged from origin/main; broad harness consolidation is outside this focused performance batch.
  • PRA-6 verified: the final-base provider-selection target retains all 66 cases and passes twice. Real-process boundaries remain for NVIDIA setup/retry wiring, blank custom endpoints, timeout environment parsing, restart-unreachable production behavior, and native-Docker handling. Nine provider credential back/exit scenarios still invoke their real setupNim call sites in one isolated child. Upstream's two Anthropic retry cases remain in test/onboard-selection-anthropic-retry.test.ts. Independent semantic review found no parity gaps.
  • PRA-7/PRA-9: the small registry helper and explicit local try/finally environment ownership are retained for readability and isolation; neither affects runtime or coverage.
  • PRA-8: the gateway-drift file is 426 lines against a 1,500-line default ceiling, so it has substantial headroom; no extraction is needed for this two-case regression.

The GPT-5.5 advisor reports no blocking findings, CodeRabbit reports no actionable comments, all commits are GitHub-verified, and the PR body records the #6245 benchmark and targeted-test evidence.

@cv

cv commented Jul 7, 2026

Copy link
Copy Markdown
Collaborator Author

Final Nemotron re-indexed finding resolution for head 33c2287c5:

  • PRA-3: resolved by 33c2287c5; the advisor itself says “Test is present and passes. No action needed.” The focused target passes 5/5.
  • PRA-1/PRA-4 and PRA-2/PRA-5: non-applicable false positives. The source boundary is src/lib/actions/sandbox/rebuild-flow.test.ts, which imports registerRebuildFlowLifecycleTests and registerRebuildFlowCredentialPreflightTests at lines 4–5 and invokes them at lines 11 and 13. Those helpers are registrars, not independently discovered test files. The CLI project discovers the source-side aggregator and a focused run passed 79/79, including all 9 lifecycle and 19 credential-preflight cases. There is no invalid state or missing call site to repair; registering again would duplicate tests and deleting the helpers would remove active coverage.
  • PRA-6: intentionally retained. The remaining process contract proves real CLI dispatch, isolated HOME registry persistence, inner onboarding failure, and durable imageTag: null rollback; the in-process harness cannot prove that filesystem boundary.
  • PRA-7: the separate loose-typed harness is unchanged from origin/main. This PR's changed harness uses production SandboxGatewayState; no type drift is introduced here.
  • PRA-8: resolved by audit and runtime evidence. Final-base onboard-selection.test.ts retains and passes 66/66 cases twice. The retained process boundaries and nine batched real setupNim call sites are mapped in the preceding advisor-resolution comment and PR body; upstream Anthropic retry coverage remains in its extracted test file.
  • PRA-13: no sensitive data is present. The overrides contain fixed fake test gateway names, the harness does not log the override object, and the asserted active-gateway guidance is intentional user-facing safety output—not a secret or credential.
  • PRA-9–PRA-12: non-blocking style/hygiene suggestions are intentionally not expanding this batch. The 426-line gateway test has 1,074 lines of budget headroom; environment restoration is explicit and scoped with try/finally; retained shell fixtures use controlled constants in isolated temp directories to preserve real process behavior.

GPT-5.5 reports merge-as-is. Runtime follow-ups requested there are already complete: provider selection 66/66 twice, stale recovery 5/5, gateway drift 6/6, and the combined rebuild-flow/gateway set 85/85. CodeRabbit reports no actionable comments.

@cv

cv commented Jul 7, 2026

Copy link
Copy Markdown
Collaborator Author

Final-head advisor resolution for f4bc37a51:

  • GPT-5.5 recommends merge_as_is with no required findings or warnings. CodeRabbit generated no actionable comments.
  • PRA-3 / PRA-4 and PRA-T1 / PRA-T2 / PRA-T4 / PRA-T5 are false positives caused by searching only under test/. src/lib/actions/sandbox/rebuild-flow.test.ts imports both registrars at lines 4–5 and invokes them at lines 11 and 13. The CLI Vitest project discovers src/**/*.test.ts; the focused rebuild-flow and gateway run passed 85/85 before the final base sync, whose only PR-local change was the independent acpx assertion.
  • PRA-5 is not a security boundary. reconciledSandboxGatewayState is an in-memory unit-test override populated only with synthetic literals; it never reads live gateway state or secrets. The harness does not log the injected object. Its console spies capture production-formatted strings, and the changed tests use controlled values such as other-gw and nemoclaw. Keeping the production SandboxGatewayState type is intentional contract coverage; sanitizing a synthetic fixture would not protect production logging.
  • PRA-6 concerns test-owned static fixture values written under a fresh temporary directory. There is no untrusted input, real credential, or production shell surface.
  • PRA-7 adds one parameterized, direct-classifier regression contract for both gateway-mismatch directions. At 426 lines, the file remains far below the repository's 1,500-line source-test ceiling; extracting this single case would make its destructive-boundary assertions harder to audit.
  • PRA-8 preserves individual Vitest cases and assertions. The nine named cases share one real setupNim child boot, return a payload map keyed by scenario name, and each it independently validates its own payload. Only a failure of the shared process contract affects all cases, which is appropriate.
  • PRA-9 points to a separate pre-existing harness unchanged by this PR. The harness changed here improves type fidelity by importing the production SandboxGatewayState; consolidating older test infrastructure is not required for this test-performance change.
  • PRA-10 through PRA-12 are non-behavioral micro-refactors with no demonstrated runtime or correctness benefit. PRA-13 is intentionally retained because it uniquely covers the real CLI entry point, HOME registry discovery/persistence, and durable imageTag: null rollback after recreation fails.
  • Runtime evidence at the final head: onboard-selection 66/66, stale recovery 5/5, OpenClaw config plus Hermes stress 33 passed / 2 environment skips. The Hermes 16 MiB case passed twice locally in about 22.3–22.6 seconds; the prior CI failure ended at 45.127 seconds exactly, matching its child timeout and confirming runner contention.

No additional code change is warranted for these non-binding findings.

@cv
cv merged commit 6451f70 into main Jul 7, 2026
53 of 54 checks passed
@cv
cv deleted the codex/perf-rebuild-stale-recovery branch July 7, 2026 08:59
cv added a commit that referenced this pull request Jul 7, 2026
<!-- markdownlint-disable MD041 -->
## Summary
Run the integration project as a bounded four-worker phase during the
canonical local `npm test`, while keeping CI, coverage, focused
integration, and direct Vitest runs serialized. Isolate two onboarding
fixtures from host-global dashboard ports so the parallel suite remains
deterministic. This is the final cumulative #6245 step after the named
onboarding conversions, representative process-contract work, and
sequenced loader cleanup already merged; the final clean-build Node 22
suite passes in 3:52.03.

## Related Issue
Closes #6245.

## Changes
- Replace the dashboard-exhaustion fixture's real host listeners with a
fake `lsof` while retaining the real CLI, preflight, diagnostic, and
non-zero exit contract.
- Give the restore-intent fixture an explicit existing dashboard forward
so unrelated host port occupancy cannot divert the behavior under test.
- Resolve integration scheduling from npm lifecycle, CI, coverage, and
worker-cap inputs: local `npm test` uses at most four workers in group
1, while every safety-sensitive route stays serial.
- Add a behavior matrix covering local, CI, coverage, focused, direct,
and explicit worker-throttle modes.
- Complete the cumulative #6245 acceptance path after #6276/#6336/#6383
converted the named onboarding hotspots, #6285/#6417 retained
representative process contracts, and #6286/#6299/#6388/#6415 sequenced
loader cleanup after process removal.
- Record the final host-specific timings, hotspot disposition, and
retained process-contract inventory in `test/README.md` as an advisory
acceptance snapshot rather than a permanent CI budget.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [x] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates
<!-- Check exactly one tests line and one docs line. Check other lines
when applicable. Add every requested justification or approval
reference. -->
- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: Test fixtures and local
test-runner scheduling changed; NemoClaw commands, configuration,
runtime behavior, and CI/coverage workflows are unchanged.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: Independent final-diff
review confirmed that the fake `lsof` preserves the real
CLI/preflight/exit contract, the restore-intent assertions remain
intact, and resolved CI/coverage configurations remain serialized.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification
<!-- Check each applicable item only when supported by the requested
evidence. Run targeted tests once per relevant change set and rerun
after later edits or hook autofixes that can affect the tested behavior.
Do not rerun hook-covered checks. -->
- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — command/result or justification: Real
CLI exhaustion contract passed; restore-intent passed with all 11
dashboard ports deliberately occupied; scheduling matrix passed 14/14
through the lifecycle-triggered config; `npm run test:projects:check`
reported 1,327 files disjoint across 8 projects.
- [x] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result: Clean-build Node 22 `npm
test -- --reporter=blob` under the normal `umask 022` passed 1,251 files
and 13,879 tests with 39 skipped, 1 todo, and zero failures in 3:52.03,
down 73% from the issue's 14:19.65 baseline despite a larger suite. The
matching diff-scoped routine pre-commit stage passed in 13.95s. #6270
separately removed full coverage from routine pre-commit while
preserving manual and authoritative CI gates.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
<!-- DCO sign-off is required in this PR description, and every commit
must appear as Verified in GitHub. Run: git config user.name && git
config user.email -->
Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Integration test runs now use adaptive scheduling to speed up local
execution while keeping CI/focused runs serialized.

* **Bug Fixes**
* Improved reliability of onboarding regression coverage by simulating
dashboard port exhaustion in a hermetic way.
* Updated onboarding-related fixtures to better match the intended
readiness/exit behavior.

* **Tests**
* Added coverage for integration scheduling behavior (local caps,
invalid inputs, and CI/coverage scenarios).

* **Documentation**
* Added test-suite documentation with a local performance snapshot and
key test hotspots.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
…VIDIA#6383)

<!-- markdownlint-disable MD041 -->
## Summary
Reduce process isolation in two high-cost integration targets without
changing production behavior. Against the final `main` base, stale
rebuild recovery drops from 14.94–15.01 seconds to approximately 3.50
seconds (76.6% faster), while provider selection drops from 17.60–18.07
seconds to 9.95–10.23 seconds (43.4% faster).

## Related Issue
Part of NVIDIA#6245.

## Changes
- replace five redundant full-CLI stale-rebuild launches with the
existing direct flow harness while retaining one real CLI/HOME rollback
contract
- retain a focused 65ms harness case for successful stale recovery,
including backup skip, recreate handoff, and finalization assertions
- exercise unit-shaped onboarding cases through typed source seams while
preserving real-process coverage for module-wiring, environment parsing,
and subprocess boundaries
- batch nine provider credential back/exit scenarios through their real
`setupNim` call sites in one isolated child; full Node boots fall from
50 to 26 with all 66 provider-selection behaviors retained
- add a real-classifier rebuild contract for both recorded/active
gateway mismatch directions instead of injecting the terminal
`wrong_gateway_active` state
- ratchet the legacy `onboard-selection.test.ts` size budget from 5,624
to 4,834 lines
- sync the latest `main` and correct its stale plugin-entry assertion so
the test preserves the intentional omission of `acpx`

## Wrong-Gateway Source-of-Truth Review
- **Invalid state:** an empty active-gateway sandbox list is ambiguous
when the registry's recorded gateway differs from the currently selected
gateway; it must not authorize stale destruction
- **Source boundary:**
`gateway-state.ts#getReconciledSandboxGatewayState` and its
named-gateway reconciliation path own the classification
- **Source constraint:** gateway selection is mutable, so a `NotFound`
response by itself cannot prove the recorded sandbox is stale on its own
gateway
- **Regression coverage:** `rebuild-gateway-drift.test.ts` now drives
the real classifier for `nemoclaw`/`other-gw` and
`nemoclaw-9000`/`nemoclaw`, then verifies no backup, delete, registry
removal, or onboard occurs
- **Removal condition:** retain this contract until gateway
reconciliation and the rebuild mutation decision become one typed,
atomic boundary

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates
<!-- Check exactly one tests line and one docs line. Check other lines
when applicable. Add every requested justification or approval
reference. -->
- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: test-isolation and
regression-coverage changes only; production behavior, CLI output,
configuration, defaults, and public APIs are unchanged
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: independent reviews
verified the real wrong-gateway reconciliation path,
destructive-boundary assertions, provider call-site wiring, environment
cleanup, and retained process boundaries; no actionable findings remain
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification
<!-- Check each applicable item only when supported by the requested
evidence. Run targeted tests once per relevant change set and rerun
after later edits or hook autofixes that can affect that behavior. Do
not rerun hook-covered checks. -->
- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — `test/onboard-selection.test.ts`
passed 66/66 at final head; `test/rebuild-stale-recovery.test.ts` passed
5/5 in 3.49 seconds wall; `rebuild-flow.test.ts` plus
`rebuild-gateway-drift.test.ts` passed 85/85; the final `main` sync's
OpenClaw config test plus the unrelated Hermes stress file passed 33/33
with 2 environment skips
- [x] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result: [final-head
CI](https://github.com/NVIDIA/NemoClaw/actions/runs/28853151732) passed
all five CLI coverage shards, the merged coverage gate, static/type
checks, package lanes, and sandbox smoke tests
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
<!-- DCO sign-off is required in this PR description, and every commit
must appear as Verified in GitHub. Run: git config user.name && git
config user.email -->
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
<!-- markdownlint-disable MD041 -->
## Summary
Run the integration project as a bounded four-worker phase during the
canonical local `npm test`, while keeping CI, coverage, focused
integration, and direct Vitest runs serialized. Isolate two onboarding
fixtures from host-global dashboard ports so the parallel suite remains
deterministic. This is the final cumulative NVIDIA#6245 step after the named
onboarding conversions, representative process-contract work, and
sequenced loader cleanup already merged; the final clean-build Node 22
suite passes in 3:52.03.

## Related Issue
Closes NVIDIA#6245.

## Changes
- Replace the dashboard-exhaustion fixture's real host listeners with a
fake `lsof` while retaining the real CLI, preflight, diagnostic, and
non-zero exit contract.
- Give the restore-intent fixture an explicit existing dashboard forward
so unrelated host port occupancy cannot divert the behavior under test.
- Resolve integration scheduling from npm lifecycle, CI, coverage, and
worker-cap inputs: local `npm test` uses at most four workers in group
1, while every safety-sensitive route stays serial.
- Add a behavior matrix covering local, CI, coverage, focused, direct,
and explicit worker-throttle modes.
- Complete the cumulative NVIDIA#6245 acceptance path after NVIDIA#6276/NVIDIA#6336/NVIDIA#6383
converted the named onboarding hotspots, NVIDIA#6285/NVIDIA#6417 retained
representative process contracts, and NVIDIA#6286/NVIDIA#6299/NVIDIA#6388/NVIDIA#6415 sequenced
loader cleanup after process removal.
- Record the final host-specific timings, hotspot disposition, and
retained process-contract inventory in `test/README.md` as an advisory
acceptance snapshot rather than a permanent CI budget.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [x] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates
<!-- Check exactly one tests line and one docs line. Check other lines
when applicable. Add every requested justification or approval
reference. -->
- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: Test fixtures and local
test-runner scheduling changed; NemoClaw commands, configuration,
runtime behavior, and CI/coverage workflows are unchanged.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: Independent final-diff
review confirmed that the fake `lsof` preserves the real
CLI/preflight/exit contract, the restore-intent assertions remain
intact, and resolved CI/coverage configurations remain serialized.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification
<!-- Check each applicable item only when supported by the requested
evidence. Run targeted tests once per relevant change set and rerun
after later edits or hook autofixes that can affect the tested behavior.
Do not rerun hook-covered checks. -->
- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — command/result or justification: Real
CLI exhaustion contract passed; restore-intent passed with all 11
dashboard ports deliberately occupied; scheduling matrix passed 14/14
through the lifecycle-triggered config; `npm run test:projects:check`
reported 1,327 files disjoint across 8 projects.
- [x] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result: Clean-build Node 22 `npm
test -- --reporter=blob` under the normal `umask 022` passed 1,251 files
and 13,879 tests with 39 skipped, 1 todo, and zero failures in 3:52.03,
down 73% from the issue's 14:19.65 baseline despite a larger suite. The
matching diff-scoped routine pre-commit stage passed in 13.95s. NVIDIA#6270
separately removed full coverage from routine pre-commit while
preserving manual and authoritative CI gates.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
<!-- DCO sign-off is required in this PR description, and every commit
must appear as Verified in GitHub. Run: git config user.name && git
config user.email -->
Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Integration test runs now use adaptive scheduling to speed up local
execution while keeping CI/focused runs serialized.

* **Bug Fixes**
* Improved reliability of onboarding regression coverage by simulating
dashboard port exhaustion in a hermetic way.
* Updated onboarding-related fixtures to better match the intended
readiness/exit behavior.

* **Tests**
* Added coverage for integration scheduling behavior (local caps,
invalid inputs, and CI/coverage scenarios).

* **Documentation**
* Added test-suite documentation with a local performance snapshot and
key test hotspots.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
@wscurran wscurran added the area: ci CI workflows, checks, release automation, or GitHub Actions label Aug 1, 2026
@wscurran wscurran added the area: e2e End-to-end tests, nightly failures, or validation infrastructure label Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants