test(e2e): reproduce Hermes shields cycle regression - #6398
Merged
Conversation
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
Contributor
📝 WalkthroughWalkthroughAdds a new ChangesHermes shields-config E2E test and CI wiring
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Test as hermes-shields-config.test.ts
participant FakeServer as fake OpenAI-compatible server
participant Sandbox as Hermes sandbox
participant Gateway as gateway
Test->>FakeServer: start server
Test->>Sandbox: install and onboard Hermes
Test->>Sandbox: verify Phase: Ready
Test->>Sandbox: capture initial config hash
loop two shields cycles
Test->>Sandbox: run shields down
Sandbox-->>Test: DOWN state
Test->>Sandbox: run shields up
Sandbox-->>Test: UP state
end
Test->>Sandbox: re-read config hash and verify unchanged
Test->>Gateway: destroy sandbox and gateway
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
E2E Target RecommendationRequired E2E targets: Dispatch required E2E targets:
Full E2E target advisor summaryE2E Target AdvisorBase: Required E2E targets
Optional E2E targets
Relevant changed files
|
Contributor
Author
|
@coderabbitai review |
Contributor
✅ Action performedReview finished.
|
Contributor
PR Review Advisor — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 1 item to resolve/justify, 0 in-scope improvements
|
Contributor
E2E Target Results — ❌ Some jobs failedRun: 28874332234
|
Contributor
PR Review Advisor (Nemotron Ultra) — BlockedMerge posture: Do not merge until addressed Action checklist
Findings index
🚨 Required before mergeAddress these before merging unless a maintainer explicitly overrides the advisor with rationale.
|
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Contributor
E2E Target Results — ✅ All requested jobs passedRun: 28874424031
|
Contributor
E2E Target Results — ❌ Some jobs failedRun: 28874817718
|
Contributor
Author
|
Validation update:
Expected next state: keep this PR draft/blocked on #6384, then rerun |
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Contributor
Author
|
Automated-review follow-up (latest SHA
Please treat the requested drift/negative-path additions as deferred scope for maintainer review; they are not needed to prove the specific #6381 lifecycle regression. |
Contributor
Author
|
@coderabbitai review |
Contributor
✅ Action performedReview finished.
|
13 tasks
jyaunches
marked this pull request as ready for review
July 7, 2026 15:24
Closed
27 tasks
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Adds a CPU-only live E2E that reproduces the fresh Hermes shields lifecycle regression from NVIDIA#6381. The test onboards a new non-root Hermes sandbox, runs shields down/up twice, and preserves the failure as a dedicated E2E lane until NVIDIA#6384 lands. ## Related Issue Relates to NVIDIA#6381. Depends on NVIDIA#6384. ## Changes - Add a fresh Hermes onboard and two-cycle shields down/up live regression test. - Assert the mutable and locked ownership/mode contracts after each transition. - Add a dedicated `hermes-shields-config` workflow job that requires no GPU or hosted inference secret. - Extend the E2E artifact workflow boundary for the new job. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check exactly one tests line and one docs line. Check other lines when applicable. Add every requested justification or approval reference. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: test and CI coverage only; no user-facing behavior changes - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each applicable item only when supported by the requested evidence. Run targeted tests once per relevant change set and rerun after later edits or hook autofixes that can affect the tested behavior. Do not rerun hook-covered checks. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [ ] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: E2E workflow support tests passed (24/24), and the live target collects successfully; the live run is intentionally expected to reproduce NVIDIA#6381 on current `main` - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a new Hermes live end-to-end check that runs repeated shields cycles in a fresh non-root sandbox. * Updated PR reporting so the new live job is included in the results summary. * **Bug Fixes** * Updated E2E artifact upload workflow boundary validations to match the current number of expected E2E execution jobs and default callers. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
wscurran
added
area: ci
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a CPU-only live E2E that reproduces the fresh Hermes shields lifecycle regression from #6381. The test onboards a new non-root Hermes sandbox, runs shields down/up twice, and preserves the failure as a dedicated E2E lane until #6384 lands.
Related Issue
Relates to #6381.
Depends on #6384.
Changes
hermes-shields-configworkflow job that requires no GPU or hosted inference secret.Type of Change
Quality Gates
Verification
Verifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablemainnpm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result:npm run docsbuilds without warnings (doc changes only)Signed-off-by: Julie Yaunches jyaunches@nvidia.com
Summary by CodeRabbit