Skip to content

test(e2e): cover v0.0.55 gateway upgrades - #6397

Merged
jyaunches merged 8 commits into
mainfrom
codex/e2e-v055-upgrade-signed
Jul 8, 2026
Merged

test(e2e): cover v0.0.55 gateway upgrades#6397
jyaunches merged 8 commits into
mainfrom
codex/e2e-v055-upgrade-signed

Conversation

@jyaunches

@jyaunches jyaunches commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Summary

Related Issue

Follow-up coverage for #6114 and NVBug 6401602.

Type of Change

  • Test and CI coverage
  • Product code change
  • Documentation only

Quality Gates

  • Tests added or updated for changed behavior
  • Existing live E2E implementation reused to avoid duplicate upgrade logic
  • Sensitive upgrade and recovery path covered by a real installer, gateway, sandbox, process, and workspace-survival boundary
  • No secrets, API keys, or credentials committed

Verification

  • focused e2e-support Vitest tests: 7 passed
  • local e2e-live target: 3 passed, Linux live case skipped on macOS as designed
  • workflow inventory validation passed
  • actionlint passed after ignoring pre-existing custom runner label warnings
  • npm run check:diff passed
  • targeted live upgrade matrix: v0.0.36 and v0.0.55 both passed (run 28873726294)

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

  • Bug Fixes
    • Improved live end-to-end upgrade test reliability by handling varying legacy installer layouts during OpenClaw injection.
    • Made legacy upgrade tag/head verification more robust with dereferenced-tag-first resolution and fallback.
    • Refreshed upgrade assertions and expanded the upgrade payload with dynamic legacy reference/version and sandbox/base image details.
  • Chores
    • Updated the end-to-end upgrade workflow to run across two legacy fixture variants, with clearer per-variant job naming and variant-specific artifact labeling.

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
@coderabbitai

coderabbitai Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

The openshell-gateway-upgrade E2E workflow now runs for two legacy fixture versions with per-variant environment inputs and artifact names. The live upgrade test also adjusts fixture patching and target payload data to use dynamic legacy version values.

Changes

Legacy matrix and test payload updates

Layer / File(s) Summary
Workflow matrix and run metadata
.github/workflows/e2e.yaml
The job runs across two legacy fixture entries, injects legacy version env vars, updates the run comment, and names uploaded artifacts per legacy variant.
Legacy fixture patching and target payload
test/e2e/live/openshell-gateway-upgrade.test.ts
The old installer fixture patcher changes how it inserts the historical OpenClaw injection, the wrapper script inlines resolved legacy values, and the live-upgrade target payload and boundary assertion use dynamic legacy version values.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

  • NVIDIA/NemoClaw#4041: Both PRs modify the openshell-gateway-upgrade E2E old installer path to handle legacy OpenClaw and sandbox base image version values.

Suggested labels: area: ci, area: e2e, integration: openclaw, chore

Suggested reviewers: ericksoa

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: adding end-to-end coverage for v0.0.55 gateway upgrades.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/e2e-v055-upgrade-signed

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the codex/e2e-v055-upgra... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main codex/e2e-v055-upgra... fcc6007 +/-
nemoclaw/src/se...cret-scanner.ts 100%
nemoclaw/src/commands/slash.ts 100%
nemoclaw/src/li...bprocess-env.ts 100%
nemoclaw/src/bl...eprint/state.ts 98%
nemoclaw/src/onboard/config.ts 98%
nemoclaw/src/bl...int/snapshot.ts 97%
nemoclaw/src/bl...print/runner.ts 95%
nemoclaw/src/co...ration-state.ts 94%
nemoclaw/src/bl...ate-networks.ts 94%
nemoclaw/src/index.ts 94%

TypeScript / code-coverage/cli

The overall coverage in the codex/e2e-v055-upgra... branch is 76%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main codex/e2e-v055-upgra... fcc6007 +/-
src/lib/onboard/preflight.ts 82%
src/lib/state/o...oard-session.ts 82%
src/lib/actions...all/run-plan.ts 81%
src/lib/actions...licy-channel.ts 79%
src/lib/actions...box/snapshot.ts 79%
src/lib/state/sandbox.ts 75%
src/lib/onboard...er-gpu-patch.ts 69%
src/lib/policy/index.ts 65%
src/lib/shields/index.ts 60%
src/lib/onboard.ts 28%

Updated July 08, 2026 17:33 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Advisor Recommendation

Required E2E: openshell-gateway-upgrade, cloud-onboard
Optional E2E: None

Dispatch hint: openshell-gateway-upgrade

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

  • openshell-gateway-upgrade (high): Required because the PR changes the existing live OpenShell gateway upgrade workflow and test implementation. This job is the affected E2E boundary for old installer to current installer upgrade, Docker/OpenShell gateway lifecycle, and survivor sandbox restoration.
  • cloud-onboard (high): Changed onboard, trace timing, scorecard, or E2E workflow code can affect cloud onboard wall-clock behavior and should refresh the trusted cloud-onboard trace timing signal.

Optional E2E

  • None.

New E2E recommendations

  • None.

Dispatch hint

  • Workflow: .github/workflows/e2e.yaml
  • jobs input: openshell-gateway-upgrade

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Recommendation

Required E2E targets: openshell-gateway-upgrade
Optional E2E targets: None

Dispatch required E2E targets:

  • gh workflow run e2e.yaml --ref <pr-head-ref> --field jobs=openshell-gateway-upgrade

Workflow run

Full E2E target advisor summary

E2E Target Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E targets

  • openshell-gateway-upgrade: Focused free-standing E2E job wired for changed live test test/e2e/live/openshell-gateway-upgrade.test.ts.
    • Dispatch: gh workflow run e2e.yaml --ref <pr-head-ref> --field jobs=openshell-gateway-upgrade

Optional E2E targets

  • None.

Relevant changed files

  • .github/workflows/e2e.yaml
  • test/e2e/live/openshell-gateway-upgrade-helpers.ts
  • test/e2e/live/openshell-gateway-upgrade.test.ts
  • test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some jobs failed

Run: 28872636484
Workflow ref: codex/e2e-v055-upgrade-signed
Requested targets: (default — all supported)
Requested jobs: openshell-gateway-upgrade
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped

Job Result
openshell-gateway-upgrade ❌ failure

Failed jobs: openshell-gateway-upgrade. Check run artifacts for logs.

jyaunches added 2 commits July 7, 2026 10:12
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: Add or justify PRA-T1 and any related test follow-ups.
Open items: 0 required · 0 warnings · 0 suggestions · 3 test follow-ups
Top item: No actionable code findings

Action checklist

  • PRA-T1 Add or justify test follow-up: Runtime validation
  • PRA-T2 Add or justify test follow-up: Runtime validation
  • PRA-T3 Add or justify test follow-up: Runtime validation
Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

  • PRA-T1 Runtime validation — Hermetically exercise createOldDockerWrapper rewriting docker pull ghcr.io/nvidia/nemoclaw/sandbox-base:latest to the pinned digest ref.. The changed behavior crosses GitHub Actions, installer download/execution, Docker image selection, OpenShell gateway lifecycle, and sandbox restore boundaries. The PR updates the live E2E path that exercises those boundaries, and the support tests cover static workflow/validation behavior.
  • PRA-T2 Runtime validation — Hermetically exercise createOldDockerWrapper rewriting docker build OPENCLAW_VERSION and BASE_IMAGE build args to the validated legacy fixture values.. The changed behavior crosses GitHub Actions, installer download/execution, Docker image selection, OpenShell gateway lifecycle, and sandbox restore boundaries. The PR updates the live E2E path that exercises those boundaries, and the support tests cover static workflow/validation behavior.
  • PRA-T3 Runtime validation — Use the live OpenShell gateway upgrade test as the runtime validation for the matrix entries because it is the shortest existing behavior-specific path that covers installer execution, gateway upgrade, survivor process, and workspace restore.. The changed behavior crosses GitHub Actions, installer download/execution, Docker image selection, OpenShell gateway lifecycle, and sandbox restore boundaries. The PR updates the live E2E path that exercises those boundaries, and the support tests cover static workflow/validation behavior.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some jobs failed

Run: 28872946003
Workflow ref: codex/e2e-v055-upgrade-signed
Requested targets: (default — all supported)
Requested jobs: openshell-gateway-upgrade
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped

Job Result
openshell-gateway-upgrade ❌ failure

Failed jobs: openshell-gateway-upgrade. Check run artifacts for logs.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
test/e2e/live/openshell-gateway-upgrade.test.ts (1)

163-175: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Ambiguous multi-ARG fallback produces a misleading error.

When arg_markers has more than one entry (e.g. a multi-stage Dockerfile re-declaring ARG OPENCLAW_VERSION= per stage), the code silently falls through to the MIN_VER gate branch. If that gate marker is also absent (likely for an ARG-based fixture like the new v0.0.55 shape), the resulting error "old OpenClaw version gate not found" doesn't reflect the real cause (ambiguous ARG count vs. a genuinely missing gate), which will confuse whoever debugs a future CI failure here.

♻️ Suggested clarification
     if injection not in text:
         arg_markers = [
             line for line in text.splitlines(keepends=True)
             if line.startswith("ARG OPENCLAW_VERSION=")
         ]
         if len(arg_markers) == 1:
             marker = arg_markers[0]
             text = text.replace(marker, marker + "\n" + injection, 1)
+        elif len(arg_markers) > 1:
+            raise SystemExit(f"{path}: multiple 'ARG OPENCLAW_VERSION=' lines found, expected exactly one")
         else:
             marker = "RUN set -eu; \\\n    MIN_VER=$(grep -m 1 'min_openclaw_version'"
             if marker not in text:
                 raise SystemExit(f"{path}: old OpenClaw version gate not found")
             text = text.replace(marker, injection + marker, 1)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/live/openshell-gateway-upgrade.test.ts` around lines 163 - 175, The
fallback in the Dockerfile injection logic is too ambiguous: in the branch that
handles OpenClaw version markers, a multi-entry arg_markers case currently falls
through to the MIN_VER gate path and can raise a misleading “old OpenClaw
version gate not found” error. Update the logic around the injection handling so
it distinguishes between a single ARG match, multiple ARG matches, and a missing
MIN_VER gate, and make the error message in the relevant test helper or fixture
code explicitly report the real condition using the arg_markers and marker
checks.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/e2e/live/openshell-gateway-upgrade.test.ts`:
- Around line 163-175: The fallback in the Dockerfile injection logic is too
ambiguous: in the branch that handles OpenClaw version markers, a multi-entry
arg_markers case currently falls through to the MIN_VER gate path and can raise
a misleading “old OpenClaw version gate not found” error. Update the logic
around the injection handling so it distinguishes between a single ARG match,
multiple ARG matches, and a missing MIN_VER gate, and make the error message in
the relevant test helper or fixture code explicitly report the real condition
using the arg_markers and marker checks.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: dd7d3ced-ddcc-4e59-b651-23648030ef7a

📥 Commits

Reviewing files that changed from the base of the PR and between 5681d65 and 5a3f9b7.

📒 Files selected for processing (1)
  • test/e2e/live/openshell-gateway-upgrade.test.ts

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some jobs failed

Run: 28873234163
Workflow ref: codex/e2e-v055-upgrade-signed
Requested targets: (default — all supported)
Requested jobs: openshell-gateway-upgrade
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped

Job Result
openshell-gateway-upgrade ❌ failure

Failed jobs: openshell-gateway-upgrade. Check run artifacts for logs.

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor (Nemotron Ultra) — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: Add or justify PRA-T1 and any related test follow-ups.
Open items: 0 required · 0 warnings · 4 suggestions · 8 test follow-ups
Since last review: 0 prior items resolved · 0 still apply · 0 new items found

Action checklist

  • PRA-T1 Add or justify test follow-up: Runtime validation
  • PRA-T2 Add or justify test follow-up: Runtime validation
  • PRA-T3 Add or justify test follow-up: Runtime validation
  • PRA-T4 Add or justify test follow-up: Runtime validation
  • PRA-T5 Add or justify test follow-up: Runtime validation
  • PRA-T6 Add or justify test follow-up: Add negative-path unit tests for patchOldInstallerFixture adapter
  • PRA-T7 Add or justify test follow-up: Add boundary validation tests for validateLegacyGatewayUpgradeFixture
  • PRA-T8 Add or justify test follow-up: Add explicit negative test for downloaded installer SHA256 mismatch
  • PRA-1 In-scope improvement: Add negative-path unit tests for patchOldInstallerFixture adapter in test/e2e/live/openshell-gateway-upgrade.test.ts:163
  • PRA-2 In-scope improvement: Add boundary validation tests for validateLegacyGatewayUpgradeFixture in test/e2e/live/openshell-gateway-upgrade-helpers.ts:37
  • PRA-3 In-scope improvement: Add explicit negative test for downloaded installer SHA256 mismatch in test/e2e/live/openshell-gateway-upgrade.test.ts:117
  • PRA-4 In-scope improvement: Add explicit negative test for git source HEAD commit mismatch in test/e2e/live/openshell-gateway-upgrade.test.ts:135

Findings index

ID Severity Category Location Required action
PRA-1 Improvement tests test/e2e/live/openshell-gateway-upgrade.test.ts:163 Add a describe block in openshell-gateway-upgrade-helpers.test.ts (new file or existing) with cases: missing needle throws, multiple ARG lines throws, hook already present is idempotent, injection produces expected Dockerfile content.
PRA-2 Improvement tests test/e2e/live/openshell-gateway-upgrade-helpers.ts:37 Extend the existing 'rejects mutable or injectable historical fixture inputs before use' test with additional expect(() => validate(...)).toThrow() cases for: commit SHA length 39, SHA256 length 63, version format '2026.5' (missing patch), version format '26.5.22' (short year), sandboxBaseImageRef with @sha256: but wrong digest length.
PRA-3 Improvement tests test/e2e/live/openshell-gateway-upgrade.test.ts:117 Add a focused test (could be in helpers test file) that mocks a download with wrong hash and asserts the failure message contains 'must match its pinned SHA-256'.
PRA-4 Improvement tests test/e2e/live/openshell-gateway-upgrade.test.ts:135 Add a test that simulates a HEAD mismatch (e.g., by setting OLD_NEMOCLAW_COMMIT to a different known SHA) and asserts the failure message indicates source HEAD mismatch.
Review findings by urgency: 0 required fixes, 0 items to resolve/justify, 4 in-scope improvements

⚠️ Resolve or justify before merge

Investigate these in the current review; either fix them, explain why they are not applicable, or document the accepted risk.

  • None.

💡 In-scope improvements

These are lower-risk, not throwaway. Prefer fixing them in this PR when they are local to changed code; defer only with rationale or a linked follow-up.

PRA-1 Improvement — Add negative-path unit tests for patchOldInstallerFixture adapter

  • Location: test/e2e/live/openshell-gateway-upgrade.test.ts:163
  • Category: tests
  • Problem: The patchOldInstallerFixture function contains complex string-replacement logic with multiple branches (missing needle, multiple ARG OPENCLAW_VERSION lines, hook already present). Currently only exercised indirectly via the live E2E test. A focused unit test would catch regressions in the adapter itself without requiring a full sandbox run.
  • Impact: If the historical installer structure changes (e.g., new release with different Dockerfile layout), the adapter could silently fail or inject incorrectly, leading to flaky upgrade tests or false positives.
  • Suggested action: Add a describe block in openshell-gateway-upgrade-helpers.test.ts (new file or existing) with cases: missing needle throws, multiple ARG lines throws, hook already present is idempotent, injection produces expected Dockerfile content.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Run `npx vitest run test/e2e/live/openshell-gateway-upgrade-helpers.test.ts` after adding tests; verify all branches covered via coverage report.
  • Missing regression test: Unit tests for patchOldInstallerFixture covering: (1) missing legacy_script needle throws, (2) multiple ARG OPENCLAW_VERSION lines throws, (3) hook already present no-ops, (4) injection produces expected RUN rm -rf ... npm install openclaw@<version> sequence.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Function at lines 163-232 in openshell-gateway-upgrade.test.ts; comment acknowledges 'frozen release installers are the source of truth' and adapter is scoped to v0.0.36/v0.0.55 lanes.

PRA-2 Improvement — Add boundary validation tests for validateLegacyGatewayUpgradeFixture

  • Location: test/e2e/live/openshell-gateway-upgrade-helpers.ts:37
  • Category: tests
  • Problem: The validation function rejects malformed inputs but only the happy path and injection cases are tested. Boundary cases (39-char commit SHA, 63-char SHA256, malformed version formats) are not explicitly covered.
  • Impact: Edge-case format violations could slip through if regex patterns have off-by-one errors, potentially allowing a malformed fixture to reach the test logic.
  • Suggested action: Extend the existing 'rejects mutable or injectable historical fixture inputs before use' test with additional expect(() => validate(...)).toThrow() cases for: commit SHA length 39, SHA256 length 63, version format '2026.5' (missing patch), version format '26.5.22' (short year), sandboxBaseImageRef with @sha256: but wrong digest length.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Run `npx vitest run test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts` and verify new cases pass.
  • Missing regression test: Boundary validation cases for each regex in validateLegacyGatewayUpgradeFixture: commit SHA (39/41 chars), SHA256 (63/65 chars), openclawVersion (YYYY.M, YY.M.D, YYYY.M.D.extra), sandboxBaseImageRef (digest length 63/65, missing @sha256:, wrong algorithm).
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Validation function at lines 12-52 in openshell-gateway-upgrade-helpers.ts; test at line 37 in workflow-boundary.test.ts covers injection but not format boundaries.

PRA-3 Improvement — Add explicit negative test for downloaded installer SHA256 mismatch

  • Location: test/e2e/live/openshell-gateway-upgrade.test.ts:117
  • Category: tests
  • Problem: The live test verifies the downloaded installer SHA256 matches the pinned value via expect(...).toBe(OLD_INSTALLER_SHA256), but there is no test that a mismatched hash causes a clean test failure (rather than a confusing downstream error).
  • Impact: If GitHub raw content delivery is corrupted or the pinned hash drifts, the test would fail at the expect() but the error message would not clearly indicate 'installer integrity check failed'.
  • Suggested action: Add a focused test (could be in helpers test file) that mocks a download with wrong hash and asserts the failure message contains 'must match its pinned SHA-256'.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Search for 'must match its pinned SHA-256' in test output after adding test.
  • Missing regression test: Test that a deliberately corrupted installer download (wrong SHA256) produces a clear assertion failure at the integrity check step, not a later Docker/build error.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Lines 117-122 in openshell-gateway-upgrade.test.ts: download → sha256 → expect(...).toBe(OLD_INSTALLER_SHA256).

PRA-4 Improvement — Add explicit negative test for git source HEAD commit mismatch

  • Location: test/e2e/live/openshell-gateway-upgrade.test.ts:135
  • Category: tests
  • Problem: The live test verifies the cloned source HEAD matches the expected commit SHA, but no test exercises the mismatch case to confirm clear failure.
  • Impact: If a tag is moved (force-pushed) or the wrong commit is checked out, the test would fail at expect(actualSourceHead).toBe(OLD_NEMOCLAW_COMMIT) but without a dedicated test the failure mode is unverified.
  • Suggested action: Add a test that simulates a HEAD mismatch (e.g., by setting OLD_NEMOCLAW_COMMIT to a different known SHA) and asserts the failure message indicates source HEAD mismatch.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Run test with overridden OLD_NEMOCLAW_COMMIT and verify failure at 'read old source head' step.
  • Missing regression test: Test that git rev-parse HEAD != expected commit produces a clear assertion failure with context about tag/commit drift.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Lines 135-140 in openshell-gateway-upgrade.test.ts: git rev-parse --verify HEAD compared to OLD_NEMOCLAW_COMMIT.
Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

  • PRA-T1 Runtime validation — patchOldInstallerFixture: missing legacy_script needle throws. Runtime/sandbox/infrastructure paths need behavioral runtime validation; live E2E test covers happy path for both matrix entries. Negative-path unit tests for adapter logic (patchOldInstallerFixture, validateLegacyGatewayUpgradeFixture boundaries) would increase confidence without requiring full sandbox runs.
  • PRA-T2 Runtime validation — patchOldInstallerFixture: multiple ARG OPENCLAW_VERSION lines throws. Runtime/sandbox/infrastructure paths need behavioral runtime validation; live E2E test covers happy path for both matrix entries. Negative-path unit tests for adapter logic (patchOldInstallerFixture, validateLegacyGatewayUpgradeFixture boundaries) would increase confidence without requiring full sandbox runs.
  • PRA-T3 Runtime validation — patchOldInstallerFixture: hook already present is idempotent. Runtime/sandbox/infrastructure paths need behavioral runtime validation; live E2E test covers happy path for both matrix entries. Negative-path unit tests for adapter logic (patchOldInstallerFixture, validateLegacyGatewayUpgradeFixture boundaries) would increase confidence without requiring full sandbox runs.
  • PRA-T4 Runtime validation — patchOldInstallerFixture: injection produces expected RUN rm -rf ... npm install openclaw@<version> sequence. Runtime/sandbox/infrastructure paths need behavioral runtime validation; live E2E test covers happy path for both matrix entries. Negative-path unit tests for adapter logic (patchOldInstallerFixture, validateLegacyGatewayUpgradeFixture boundaries) would increase confidence without requiring full sandbox runs.
  • PRA-T5 Runtime validation — validateLegacyGatewayUpgradeFixture: rejects 39-char commit SHA. Runtime/sandbox/infrastructure paths need behavioral runtime validation; live E2E test covers happy path for both matrix entries. Negative-path unit tests for adapter logic (patchOldInstallerFixture, validateLegacyGatewayUpgradeFixture boundaries) would increase confidence without requiring full sandbox runs.
  • PRA-T6 Add negative-path unit tests for patchOldInstallerFixture adapter — Add a describe block in openshell-gateway-upgrade-helpers.test.ts (new file or existing) with cases: missing needle throws, multiple ARG lines throws, hook already present is idempotent, injection produces expected Dockerfile content.
  • PRA-T7 Add boundary validation tests for validateLegacyGatewayUpgradeFixture — Extend the existing 'rejects mutable or injectable historical fixture inputs before use' test with additional expect(() => validate(...)).toThrow() cases for: commit SHA length 39, SHA256 length 63, version format '2026.5' (missing patch), version format '26.5.22' (short year), sandboxBaseImageRef with @sha256: but wrong digest length.
  • PRA-T8 Add explicit negative test for downloaded installer SHA256 mismatch — Add a focused test (could be in helpers test file) that mocks a download with wrong hash and asserts the failure message contains 'must match its pinned SHA-256'.
Since last review details

Current findings, using the urgency labels above:

PRA-1 Improvement — Add negative-path unit tests for patchOldInstallerFixture adapter

  • Location: test/e2e/live/openshell-gateway-upgrade.test.ts:163
  • Category: tests
  • Problem: The patchOldInstallerFixture function contains complex string-replacement logic with multiple branches (missing needle, multiple ARG OPENCLAW_VERSION lines, hook already present). Currently only exercised indirectly via the live E2E test. A focused unit test would catch regressions in the adapter itself without requiring a full sandbox run.
  • Impact: If the historical installer structure changes (e.g., new release with different Dockerfile layout), the adapter could silently fail or inject incorrectly, leading to flaky upgrade tests or false positives.
  • Suggested action: Add a describe block in openshell-gateway-upgrade-helpers.test.ts (new file or existing) with cases: missing needle throws, multiple ARG lines throws, hook already present is idempotent, injection produces expected Dockerfile content.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Run `npx vitest run test/e2e/live/openshell-gateway-upgrade-helpers.test.ts` after adding tests; verify all branches covered via coverage report.
  • Missing regression test: Unit tests for patchOldInstallerFixture covering: (1) missing legacy_script needle throws, (2) multiple ARG OPENCLAW_VERSION lines throws, (3) hook already present no-ops, (4) injection produces expected RUN rm -rf ... npm install openclaw@<version> sequence.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Function at lines 163-232 in openshell-gateway-upgrade.test.ts; comment acknowledges 'frozen release installers are the source of truth' and adapter is scoped to v0.0.36/v0.0.55 lanes.

PRA-2 Improvement — Add boundary validation tests for validateLegacyGatewayUpgradeFixture

  • Location: test/e2e/live/openshell-gateway-upgrade-helpers.ts:37
  • Category: tests
  • Problem: The validation function rejects malformed inputs but only the happy path and injection cases are tested. Boundary cases (39-char commit SHA, 63-char SHA256, malformed version formats) are not explicitly covered.
  • Impact: Edge-case format violations could slip through if regex patterns have off-by-one errors, potentially allowing a malformed fixture to reach the test logic.
  • Suggested action: Extend the existing 'rejects mutable or injectable historical fixture inputs before use' test with additional expect(() => validate(...)).toThrow() cases for: commit SHA length 39, SHA256 length 63, version format '2026.5' (missing patch), version format '26.5.22' (short year), sandboxBaseImageRef with @sha256: but wrong digest length.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Run `npx vitest run test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts` and verify new cases pass.
  • Missing regression test: Boundary validation cases for each regex in validateLegacyGatewayUpgradeFixture: commit SHA (39/41 chars), SHA256 (63/65 chars), openclawVersion (YYYY.M, YY.M.D, YYYY.M.D.extra), sandboxBaseImageRef (digest length 63/65, missing @sha256:, wrong algorithm).
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Validation function at lines 12-52 in openshell-gateway-upgrade-helpers.ts; test at line 37 in workflow-boundary.test.ts covers injection but not format boundaries.

PRA-3 Improvement — Add explicit negative test for downloaded installer SHA256 mismatch

  • Location: test/e2e/live/openshell-gateway-upgrade.test.ts:117
  • Category: tests
  • Problem: The live test verifies the downloaded installer SHA256 matches the pinned value via expect(...).toBe(OLD_INSTALLER_SHA256), but there is no test that a mismatched hash causes a clean test failure (rather than a confusing downstream error).
  • Impact: If GitHub raw content delivery is corrupted or the pinned hash drifts, the test would fail at the expect() but the error message would not clearly indicate 'installer integrity check failed'.
  • Suggested action: Add a focused test (could be in helpers test file) that mocks a download with wrong hash and asserts the failure message contains 'must match its pinned SHA-256'.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Search for 'must match its pinned SHA-256' in test output after adding test.
  • Missing regression test: Test that a deliberately corrupted installer download (wrong SHA256) produces a clear assertion failure at the integrity check step, not a later Docker/build error.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Lines 117-122 in openshell-gateway-upgrade.test.ts: download → sha256 → expect(...).toBe(OLD_INSTALLER_SHA256).

PRA-4 Improvement — Add explicit negative test for git source HEAD commit mismatch

  • Location: test/e2e/live/openshell-gateway-upgrade.test.ts:135
  • Category: tests
  • Problem: The live test verifies the cloned source HEAD matches the expected commit SHA, but no test exercises the mismatch case to confirm clear failure.
  • Impact: If a tag is moved (force-pushed) or the wrong commit is checked out, the test would fail at expect(actualSourceHead).toBe(OLD_NEMOCLAW_COMMIT) but without a dedicated test the failure mode is unverified.
  • Suggested action: Add a test that simulates a HEAD mismatch (e.g., by setting OLD_NEMOCLAW_COMMIT to a different known SHA) and asserts the failure message indicates source HEAD mismatch.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Run test with overridden OLD_NEMOCLAW_COMMIT and verify failure at 'read old source head' step.
  • Missing regression test: Test that git rev-parse HEAD != expected commit produces a clear assertion failure with context about tag/commit drift.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Lines 135-140 in openshell-gateway-upgrade.test.ts: git rev-parse --verify HEAD compared to OLD_NEMOCLAW_COMMIT.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All requested jobs passed

Run: 28873726294
Workflow ref: codex/e2e-v055-upgrade-signed
Requested targets: (default — all supported)
Requested jobs: openshell-gateway-upgrade
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
openshell-gateway-upgrade ✅ success

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>

@cv cv left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maintainer review: the two-row live run is valuable, but exact head is not approval-ready because the source/evidence assertions can prove the wrong thing. In openshell-gateway-upgrade.test.ts, a missing /home/cvillela/.nemoclaw/source/.git yields empty stdout with status 0, and git ls-remote also returns status 0 with empty stdout for an unknown tag; the current trim-to-trim comparison therefore accepts empty === empty. Please require both actual and expected values to match a full 40-hex commit SHA before comparing them. Also make the v0.0.55 base-image evidence truthful: the artifact records digest 104151ff... while the build log used 10433a8... and the wrapper log is empty. Pass the recognized NEMOCLAW_SANDBOX_BASE_IMAGE_REF into the legacy payload or record/assert the actual resolved digest. Then rerun jobs=openshell-gateway-upgrade at the new exact head and obtain an exact-head merge_as_is advisor result.

@wscurran wscurran added v0.0.77 and removed v0.0.76 labels Jul 7, 2026
@wscurran wscurran added area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery chore Build, CI, dependency, or tooling maintenance labels Jul 7, 2026
@cjagwani cjagwani self-assigned this Jul 8, 2026
@ericksoa ericksoa removed the v0.0.77 label Jul 8, 2026
@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All requested jobs passed

Run: 28956561506
Workflow ref: codex/e2e-v055-upgrade-signed
Requested targets: (default — all supported)
Requested jobs: openshell-gateway-upgrade
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
openshell-gateway-upgrade ✅ success

Validate fixture overrides before any test side effects.

Fetch each historical installer by an exact commit and pinned SHA-256 so the evidence fails closed.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cjagwani cjagwani added v0.0.79 and removed v0.0.78 labels Jul 8, 2026
Exercise every historical fixture validation boundary.

Make the base-image digest explicit in each workflow matrix row.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ⚠️ Run cancelled — no signal

Run: 28961551072
Workflow ref: codex/e2e-v055-upgrade-signed
Requested targets: (default — all supported)
Requested jobs: openshell-gateway-upgrade
Summary: 0 passed, 0 failed, 1 cancelled, 0 skipped

Job Result
openshell-gateway-upgrade ⚠️ cancelled

@cv

cv commented Jul 8, 2026

Copy link
Copy Markdown
Collaborator

Maintainer disposition for exact head fcc60076408b6fe6746f6d92094eafd4306d880a:

  • PRA-2 is resolved by the frozen release source. The peeled v0.0.55 commit 95d483fe2b6569d68e59493c60f19df09a068e8f contains test/e2e/test-openshell-gateway-upgrade.sh:57, whose default NEMOCLAW_OLD_SANDBOX_BASE_IMAGE_REF is the exact ghcr.io/nvidia/nemoclaw/sandbox-base@sha256:104151ffadc2ff0b6c815e3c95c2783ced61aee0d0f83fc327cc02be9b7e14e6 value now made explicit in the v0.0.55 matrix row. The identical value is therefore historically grounded, not assumed. The v0.0.36 row preserves the pre-existing lane's established fixture pin.
  • PRA-1 is resolved by the source-boundary comment above patchOldInstallerFixture: frozen release installers cannot be changed, the adapter fails closed on unexpected layouts, the two real historical rows are the regression boundary, and the adapter retires with those lanes.
  • PRA-3 is intentionally retained. These environment fallbacks are test dependency-injection points for local replay; CI now supplies every historical value explicitly, and the pure validator rejects malformed overrides before side effects.

Focused support and workflow-contract tests pass, all commits are GitHub-Verified, and the exact-head two-row live run is in progress.

@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All requested jobs passed

Run: 28962268680
Workflow ref: codex/e2e-v055-upgrade-signed
Requested targets: (default — all supported)
Requested jobs: openshell-gateway-upgrade
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
openshell-gateway-upgrade ✅ success

@cv cv left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Exact-head approval for fcc60076408b6fe6746f6d92094eafd4306d880a.

The prior source-head and base-image-evidence concerns are resolved. Historical fixture inputs now fail closed before side effects; v0.0.36 and v0.0.55 installers are pinned by verified commit and SHA-256; the sandbox-base digest is explicit per matrix row; and focused tests cover every validation boundary.

Verification: all 41 PR checks are green, all 8 commits are GitHub-Verified with DCO, CodeRabbit has no unresolved major/critical findings, both review advisors say merge_as_is, and exact-head live run 28962268680 passed both OpenShell gateway upgrade rows (v0.0.36 and v0.0.55).

@jyaunches
jyaunches merged commit 27f1280 into main Jul 8, 2026
120 checks passed
@jyaunches
jyaunches deleted the codex/e2e-v055-upgrade-signed branch July 8, 2026 23:46
@jyaunches jyaunches mentioned this pull request Jul 9, 2026
21 tasks
cv pushed a commit that referenced this pull request Jul 9, 2026
<!-- markdownlint-disable MD041 -->
## Summary
Adds the pre-tag v0.0.79 release notes entry to
`docs/about/release-notes.mdx` so the release plan can be generated
after docs merge.
The entry summarizes the merged v0.0.79 release train across inference,
diagnostics, runtime hardening, policies, onboarding recovery, and
release validation.

## Changes
- Added the v0.0.79 release notes section with linked follow-up
documentation for OpenRouter onboarding, managed vLLM changes,
completion and logging, Deep Agents runtime limits, policy updates,
onboarding recovery, and release validation.
- Source summary:
- #6461 -> `docs/about/release-notes.mdx`: Documents OpenRouter
onboarding support and links to inference/provider references.
- #6271 and #6272 -> `docs/about/release-notes.mdx`: Documents shell
completion and structured logging highlights.
- #6465, #6539, #6570, and #6528 -> `docs/about/release-notes.mdx`:
Documents status route-drift, orphaned sandbox, gateway cleanup, and DGX
Spark express-install diagnostics.
- #6523, #6551, #6484, #6488, #6324, and #6542 ->
`docs/about/release-notes.mdx`: Documents managed vLLM, Qwen3.6 tool
parser, compaction, and timeout/readiness improvements.
- #6559, #6538, #6560, #6568, #6552, #6567, and #6587 ->
`docs/about/release-notes.mdx`: Documents runtime, credential, proxy,
PID namespace, TOML, and provider-state hardening.
- #6541, #5415, #6246, #6496, and #6573 ->
`docs/about/release-notes.mdx`: Documents GitHub policy, Gmail policy,
MCP allowlist, WhatsApp, and messaging-variant updates.
- #6253, #6572, #6444, #6536, and #5860 ->
`docs/about/release-notes.mdx`: Documents onboarding resume and
create-step recovery improvements.
- #6508, #6527, #5506, #6588, #6446, #6447, #6582, #6296, #6367, #6397,
and #6505 -> `docs/about/release-notes.mdx`: Documents docs,
release-risk, and E2E validation updates.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [x] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates
<!-- Check exactly one tests line and one docs line. Check other lines
when applicable. Add every requested justification or approval
reference. -->
- [ ] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [x] Tests not applicable — justification: Release-note prose only.
- [x] Docs updated for user-facing behavior changes
- [ ] Docs not applicable — justification:
- [ ] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification
<!-- Check each applicable item only when supported by the requested
evidence. Run targeted tests once per relevant change set and rerun
after later edits or hook autofixes that can affect the tested behavior.
Do not rerun hook-covered checks. -->
- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — command/result or justification: Tests
not applicable, release-note prose only.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

Docs validation note: `npm run docs:check-agent-variants && npm run
docs:check-routes && git diff --check` passed. Full `npm run docs` is
currently blocked before Fern validation because the pinned
`fern-api@5.65.2` package is unavailable from npm (`ETARGET No matching
version found`).

---
<!-- DCO sign-off is required in this PR description, and every commit
must appear as Verified in GitHub. Run: git config user.name && git
config user.email -->
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Added release notes for v0.0.79 with a new summary of recent
improvements, including onboarding and inference options, operator/CLI
diagnostics, sandbox recovery hardening, runtime limits, network policy
behavior, and release validation updates.
  * Added updated references and links for the latest release.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
## Summary

- run the existing live OpenShell gateway upgrade test as a two-case
matrix
- retain the v0.0.36 legacy fixture
- add the exact v0.0.55 / OpenShell 0.0.44 / OpenClaw 2026.5.22 source
shape from NVIDIA#6114
- publish version-specific artifacts and record the selected legacy
versions in test metadata

## Related Issue

Follow-up coverage for NVIDIA#6114 and NVBug 6401602.

## Type of Change

- [x] Test and CI coverage
- [ ] Product code change
- [ ] Documentation only

## Quality Gates

- [x] Tests added or updated for changed behavior
- [x] Existing live E2E implementation reused to avoid duplicate upgrade
logic
- [x] Sensitive upgrade and recovery path covered by a real installer,
gateway, sandbox, process, and workspace-survival boundary
- [x] No secrets, API keys, or credentials committed

## Verification

- focused e2e-support Vitest tests: 7 passed
- local e2e-live target: 3 passed, Linux live case skipped on macOS as
designed
- workflow inventory validation passed
- actionlint passed after ignoring pre-existing custom runner label
warnings
- npm run check:diff passed
- targeted live upgrade matrix: v0.0.36 and v0.0.55 both passed ([run
28873726294](https://github.com/NVIDIA/NemoClaw/actions/runs/28873726294))

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved live end-to-end upgrade test reliability by handling varying
legacy installer layouts during OpenClaw injection.
* Made legacy upgrade tag/head verification more robust with
dereferenced-tag-first resolution and fallback.
* Refreshed upgrade assertions and expanded the upgrade payload with
dynamic legacy reference/version and sandbox/base image details.
* **Chores**
* Updated the end-to-end upgrade workflow to run across two legacy
fixture variants, with clearer per-variant job naming and
variant-specific artifact labeling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Co-authored-by: Carlos Villela <cvillela@nvidia.com>
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
<!-- markdownlint-disable MD041 -->
## Summary
Adds the pre-tag v0.0.79 release notes entry to
`docs/about/release-notes.mdx` so the release plan can be generated
after docs merge.
The entry summarizes the merged v0.0.79 release train across inference,
diagnostics, runtime hardening, policies, onboarding recovery, and
release validation.

## Changes
- Added the v0.0.79 release notes section with linked follow-up
documentation for OpenRouter onboarding, managed vLLM changes,
completion and logging, Deep Agents runtime limits, policy updates,
onboarding recovery, and release validation.
- Source summary:
- NVIDIA#6461 -> `docs/about/release-notes.mdx`: Documents OpenRouter
onboarding support and links to inference/provider references.
- NVIDIA#6271 and NVIDIA#6272 -> `docs/about/release-notes.mdx`: Documents shell
completion and structured logging highlights.
- NVIDIA#6465, NVIDIA#6539, NVIDIA#6570, and NVIDIA#6528 -> `docs/about/release-notes.mdx`:
Documents status route-drift, orphaned sandbox, gateway cleanup, and DGX
Spark express-install diagnostics.
- NVIDIA#6523, NVIDIA#6551, NVIDIA#6484, NVIDIA#6488, NVIDIA#6324, and NVIDIA#6542 ->
`docs/about/release-notes.mdx`: Documents managed vLLM, Qwen3.6 tool
parser, compaction, and timeout/readiness improvements.
- NVIDIA#6559, NVIDIA#6538, NVIDIA#6560, NVIDIA#6568, NVIDIA#6552, NVIDIA#6567, and NVIDIA#6587 ->
`docs/about/release-notes.mdx`: Documents runtime, credential, proxy,
PID namespace, TOML, and provider-state hardening.
- NVIDIA#6541, NVIDIA#5415, NVIDIA#6246, NVIDIA#6496, and NVIDIA#6573 ->
`docs/about/release-notes.mdx`: Documents GitHub policy, Gmail policy,
MCP allowlist, WhatsApp, and messaging-variant updates.
- NVIDIA#6253, NVIDIA#6572, NVIDIA#6444, NVIDIA#6536, and NVIDIA#5860 ->
`docs/about/release-notes.mdx`: Documents onboarding resume and
create-step recovery improvements.
- NVIDIA#6508, NVIDIA#6527, NVIDIA#5506, NVIDIA#6588, NVIDIA#6446, NVIDIA#6447, NVIDIA#6582, NVIDIA#6296, NVIDIA#6367, NVIDIA#6397,
and NVIDIA#6505 -> `docs/about/release-notes.mdx`: Documents docs,
release-risk, and E2E validation updates.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [x] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates
<!-- Check exactly one tests line and one docs line. Check other lines
when applicable. Add every requested justification or approval
reference. -->
- [ ] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [x] Tests not applicable — justification: Release-note prose only.
- [x] Docs updated for user-facing behavior changes
- [ ] Docs not applicable — justification:
- [ ] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification
<!-- Check each applicable item only when supported by the requested
evidence. Run targeted tests once per relevant change set and rerun
after later edits or hook autofixes that can affect the tested behavior.
Do not rerun hook-covered checks. -->
- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — command/result or justification: Tests
not applicable, release-note prose only.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

Docs validation note: `npm run docs:check-agent-variants && npm run
docs:check-routes && git diff --check` passed. Full `npm run docs` is
currently blocked before Fern validation because the pinned
`fern-api@5.65.2` package is unavailable from npm (`ETARGET No matching
version found`).

---
<!-- DCO sign-off is required in this PR description, and every commit
must appear as Verified in GitHub. Run: git config user.name && git
config user.email -->
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Added release notes for v0.0.79 with a new summary of recent
improvements, including onboarding and inference options, operator/CLI
diagnostics, sandbox recovery hardening, runtime limits, network policy
behavior, and release validation updates.
  * Added updated references and links for the latest release.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery chore Build, CI, dependency, or tooling maintenance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants