Skip to content

test(e2e): add inference adapter fixture (Refs #5745) - #6672

Merged
cv merged 28 commits into
NVIDIA:mainfrom
deepujain:test/5745-e2e-inference-adapter
Jul 15, 2026
Merged

test(e2e): add inference adapter fixture (Refs #5745)#6672
cv merged 28 commits into
NVIDIA:mainfrom
deepujain:test/5745-e2e-inference-adapter

Conversation

@deepujain

@deepujain deepujain commented Jul 11, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds a shared Vitest E2E inference adapter so live scenarios can choose between:

  • hermetic mock OpenAI-compatible inference
  • internal NVIDIA hosted-compatible inference
  • public NVIDIA Endpoints

This is a focused pilot for #5745. It converts the Hermes live E2E path to the adapter without migrating every E2E scenario in one PR.

Changes

  • Added test/e2e/fixtures/inference-adapter.ts with mock, internal-nvidia, and public-nvidia modes.
  • Wired the adapter into the shared test/e2e/fixtures/e2e-test.ts fixture graph.
  • Converted test/e2e/live/hermes-e2e.test.ts to use the adapter for provider env, model probe, direct chat, redaction values, and route assertions.
  • Added adapter support tests for default mock mode, hosted-compatible staging, public nvapi- validation, and unknown-mode rejection.
  • Added inference_mode to the consolidated E2E workflow with mock as the default.

Testing

Local verification

  • npm run checks - passed.
  • npm run typecheck - passed.
  • npm run build:cli - passed.
  • npm run source-shape:check - passed.
  • npm run test-conditionals:scan - passed.
  • Focused E2E support coverage - 50 tests passed, including 9 inference-adapter tests.
  • Pre-commit and pre-push hooks - passed.

Exact-head CI and E2E (9fc648e1e20fcc7496b8ca9723e52fa93ac113f4)

  • PR CI - passed, including all 8 CLI shards.
  • Self-hosted PR CI - passed, including amd64/arm64 image builds and all sandbox runtime jobs.
  • PR Review Advisor - GPT-5.6 Terra and Nemotron both completed at 0 blockers, 0 warnings, 0 suggestions.
  • CodeRabbit - completed with no unresolved threads.
  • Exact-head E2E batch - cloud-onboard, security-posture, hermes-dashboard, hermes-e2e, inference-routing, network-policy, and optional cloud-inference passed. The first credential-sanitization attempt hit an external release-fetch socket hang up before OpenShell installation.
  • Focused credential-sanitization rerun - passed on the same exact head.

Refs #5745

Signed-off-by: Deepak Jain deepujain@gmail.com

Summary by CodeRabbit

  • New Features

    • Added selectable end-to-end inference modes: mock, internal NVIDIA, and public NVIDIA.
    • Added mode-specific model probing and chat validation for Hermes end-to-end tests.
    • Added automatic inference configuration, credential handling, and resource cleanup.
  • Bug Fixes

    • Improved validation for unsupported inference modes and untrusted endpoints.
    • Strengthened protection of NVIDIA credentials during workflow runs.
    • Added checks confirming sandbox network restrictions remain enforced.
  • Tests

    • Added coverage for inference routing, environment isolation, timeouts, API errors, and workflow configuration.

@copy-pr-bot

copy-pr-bot Bot commented Jul 11, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@coderabbitai

coderabbitai Bot commented Jul 11, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

The E2E workflow now selects an inference mode and exposes it to tests. A shared adapter supports mock, internal NVIDIA, and public NVIDIA inference, while Hermes uses it for setup, probing, sandbox validation, and chat requests.

Changes

E2E inference routing

Layer / File(s) Summary
Inference adapter contracts and implementations
test/e2e/fixtures/inference-adapter.ts
Adds mode contracts, mock/internal/public NVIDIA adapters, credential handling, model probing, chat requests, cleanup, and factory selection.
Workflow configuration and fixture lifecycle
.github/workflows/e2e.yaml, test/e2e/fixtures/e2e-test.ts
Adds the selectable workflow input, matrix propagation and validation, guarded API-key exposure, and a lifecycle-managed inference fixture.
Hermes test adapter integration
test/e2e/live/hermes-e2e.test.ts
Routes Hermes environment setup, probing, provider assertions, sandbox egress validation, direct chat, retries, and local inference payloads through the adapter.
Adapter and workflow validation
test/e2e/support/inference-adapter.test.ts, test/e2e/support/*workflow*.test.ts, tools/e2e/workflow-boundary.mts, test/e2e/fixtures/fake-openai-compatible.ts, test/e2e/lib/fake-openai-compatible-api.mts, test/e2e/mock-parity.json
Tests adapter modes, routing, credential isolation, timeouts, failures, workflow boundaries, matrix propagation, fake-server environment capture, and live/fast test parity.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant E2EWorkflow
  participant HermesE2ETest
  participant E2EInferenceAdapter
  participant ProviderClient
  E2EWorkflow->>HermesE2ETest: set inference mode
  HermesE2ETest->>E2EInferenceAdapter: create adapter fixture
  E2EInferenceAdapter->>ProviderClient: probe models
  ProviderClient-->>E2EInferenceAdapter: model response
  HermesE2ETest->>E2EInferenceAdapter: directChat request
  E2EInferenceAdapter->>ProviderClient: chat/completions request
  ProviderClient-->>E2EInferenceAdapter: chat response
  HermesE2ETest->>E2EInferenceAdapter: close()
Loading

Possibly related PRs

Suggested labels: feature, area: inference, provider: nvidia

Suggested reviewers: cjagwani, cv, jyaunches

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately reflects the main addition of a shared E2E inference adapter fixture, even though the PR also updates related workflow and test wiring.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@deepujain
deepujain force-pushed the test/5745-e2e-inference-adapter branch from 372f83c to d91ce3e Compare July 11, 2026 05:09

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/fixtures/inference-adapter.ts`:
- Around line 138-149: Update the env method to preserve the internal inference
API selection: use "openai-completions" for mock mode, but use
hosted.env.NEMOCLAW_PREFERRED_API for internal-nvidia mode, consistent with
requireHostedInferenceConfig. Apply the same change to the corresponding second
environment construction block.
- Around line 218-222: Ensure the fake server is always closed when artifact
persistence fails: update close() to wrap requests collection and writeJson in
try/finally, calling fake.close() in the finally block. Also wrap post-start
setup in the relevant setup function around fake initialization,
requests/artifact persistence, and adapter creation so failures after the server
starts close fake before propagating.
- Around line 174-177: Ensure the fetch-based model probing branches reject
unsuccessful HTTP responses before parsing or returning JSON. Update the
relevant logic in the inference adapter, including the branch around the
model-list request and the additional fetch branches around the other endpoint
requests, to check response.ok and throw an error for 4xx/5xx responses so retry
behavior is preserved.

In `@test/e2e/live/hermes-e2e.test.ts`:
- Line 290: Replace the broad truthiness assertion on
inference.probeModels("phase-1-inference-models") with an assertion that the
resolved response contains the expected inference.model property, validating the
Phase 1 contract through the public probeModels boundary.

In `@test/e2e/support/inference-adapter.test.ts`:
- Around line 23-31: Remove the new conditional from the secrets() test helper
to satisfy the Codebase Growth Guardrails check. Preserve missing-secret failure
behavior using a nullish-coalescing throw expression, or relocate secrets() to a
shared non-test fixtures module so the test-file scan does not count it.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7e969733-7b6a-4154-bed8-997b4d994b4c

📥 Commits

Reviewing files that changed from the base of the PR and between e4d2e91 and 372f83c.

📒 Files selected for processing (5)
  • .github/workflows/e2e.yaml
  • test/e2e/fixtures/e2e-test.ts
  • test/e2e/fixtures/inference-adapter.ts
  • test/e2e/live/hermes-e2e.test.ts
  • test/e2e/support/inference-adapter.test.ts

Comment thread test/e2e/fixtures/inference-adapter.ts Outdated
Comment thread test/e2e/fixtures/inference-adapter.ts Outdated
Comment thread test/e2e/fixtures/inference-adapter.ts
Comment thread test/e2e/live/hermes-e2e.test.ts Outdated
Comment thread test/e2e/support/inference-adapter.test.ts
@deepujain

Copy link
Copy Markdown
Contributor Author

Tightened the inference adapter contracts: hosted mode now preserves the preferred API, mock fetches fail on non-2xx responses, fake servers close on artifact errors, and the Hermes probe checks the selected model. Focused e2e-support test, source-shape, and lint/checks pass.

@prekshivyas prekshivyas self-assigned this Jul 12, 2026
@prekshivyas
prekshivyas force-pushed the test/5745-e2e-inference-adapter branch from f410bee to 4ca4aa2 Compare July 12, 2026 07:00

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (3)
test/e2e/fixtures/inference-adapter.ts (3)

22-22: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

E2E_INFERENCE_MODE_VALUES duplicates the E2EInferenceMode union.

The literal strings in E2E_INFERENCE_MODE_VALUES must be kept manually in sync with the E2EInferenceMode type. Deriving one from the other removes the drift risk if a mode is ever added/renamed.

♻️ Proposed refactor
-export type E2EInferenceMode = "mock" | "internal-nvidia" | "public-nvidia";
+export const E2E_INFERENCE_MODE_VALUES = ["mock", "internal-nvidia", "public-nvidia"] as const;
+export type E2EInferenceMode = (typeof E2E_INFERENCE_MODE_VALUES)[number];

And remove the duplicate declaration near Line 341.

Also applies to: 341-345

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/fixtures/inference-adapter.ts` at line 22, Derive
E2E_INFERENCE_MODE_VALUES from the E2EInferenceMode type so the allowed mode
literals have a single source of truth. Remove the duplicate manually maintained
declaration near the later configuration block, while preserving the existing
runtime values and type usage.

105-120: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Long positional-string constructor is error-prone.

OpenAiCompatibleInferenceAdapter's constructor takes 10 positional parameters, several of the same type (model, endpointUrl, requestEndpointUrl, apiKey, preferredApi are all string). The previously-fixed preferredApi/apiKey mixup (per past review) is exactly the class of bug this shape invites. An options object would make call sites self-documenting and harder to misorder.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/fixtures/inference-adapter.ts` around lines 105 - 120, Refactor
OpenAiCompatibleInferenceAdapter to accept a single named options object instead
of positional constructor parameters, including model, endpointUrl,
requestEndpointUrl, apiKey, preferredApi, providerClient, artifacts, fake, and
mode. Update every constructor call site to use the corresponding property
names, preserving the existing assignments and contractLabel behavior while
eliminating any risk of swapping same-typed values.

99-279: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Duplicated provider-client request logic across the two adapter classes.

probeModels/directChat in OpenAiCompatibleInferenceAdapter (Lines 142-156, 169-184) and PublicNvidiaInferenceAdapter (Lines 241-254, 261-274) build nearly identical requestJson calls, differing only in the endpoint source (requestEndpointUrl vs endpointUrl) and artifact defaults. Extracting a shared helper (e.g. requestViaProvider(providerClient, url, opts)) would reduce duplication and the risk of the two paths drifting (e.g., only one gaining a header/timeout change).

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/fixtures/inference-adapter.ts` around lines 99 - 279, The
provider-client request construction is duplicated between
OpenAiCompatibleInferenceAdapter and PublicNvidiaInferenceAdapter. Extract a
shared helper for the common requestJson setup, parameterized by providerClient,
endpoint URL, artifact name, request body, and any adapter-specific values, then
reuse it from both probeModels and directChat while preserving their current
endpoints, headers, timeouts, and artifact defaults.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/fixtures/inference-adapter.ts`:
- Line 158: Update the raw fetch fallbacks in probeModels(), directChat(), and
the additional fetch paths around the referenced model/request handling to
enforce the same explicit timeout behavior as the providerClient branches. Use
the existing timeout configuration and abort mechanism rather than leaving fetch
requests unbounded, while preserving their current request and response
handling.

---

Nitpick comments:
In `@test/e2e/fixtures/inference-adapter.ts`:
- Line 22: Derive E2E_INFERENCE_MODE_VALUES from the E2EInferenceMode type so
the allowed mode literals have a single source of truth. Remove the duplicate
manually maintained declaration near the later configuration block, while
preserving the existing runtime values and type usage.
- Around line 105-120: Refactor OpenAiCompatibleInferenceAdapter to accept a
single named options object instead of positional constructor parameters,
including model, endpointUrl, requestEndpointUrl, apiKey, preferredApi,
providerClient, artifacts, fake, and mode. Update every constructor call site to
use the corresponding property names, preserving the existing assignments and
contractLabel behavior while eliminating any risk of swapping same-typed values.
- Around line 99-279: The provider-client request construction is duplicated
between OpenAiCompatibleInferenceAdapter and PublicNvidiaInferenceAdapter.
Extract a shared helper for the common requestJson setup, parameterized by
providerClient, endpoint URL, artifact name, request body, and any
adapter-specific values, then reuse it from both probeModels and directChat
while preserving their current endpoints, headers, timeouts, and artifact
defaults.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 62a7c85d-0061-4ba2-b87d-f1b7e85fba9b

📥 Commits

Reviewing files that changed from the base of the PR and between f410bee and 4ca4aa2.

📒 Files selected for processing (5)
  • .github/workflows/e2e.yaml
  • test/e2e/fixtures/e2e-test.ts
  • test/e2e/fixtures/inference-adapter.ts
  • test/e2e/live/hermes-e2e.test.ts
  • test/e2e/support/inference-adapter.test.ts
🚧 Files skipped from review as they are similar to previous changes (4)
  • test/e2e/fixtures/e2e-test.ts
  • .github/workflows/e2e.yaml
  • test/e2e/support/inference-adapter.test.ts
  • test/e2e/live/hermes-e2e.test.ts

Comment thread test/e2e/fixtures/inference-adapter.ts Outdated
@github-actions

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All requested tests passed

Run: 29183585756
Workflow ref: tmp/e2e/pr-6672-4ca4aa29
Requested targets: (default — all supported)
Requested test IDs: cloud-onboard,hermes-e2e
Summary: 2 passed, 0 failed, 0 cancelled, 0 skipped, 0 unknown

Test Result
cloud-onboard ✅ success
hermes-e2e ✅ success

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@prekshivyas

prekshivyas commented Jul 12, 2026

Copy link
Copy Markdown
Collaborator

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: No advisor follow-up required beyond maintainer review.
Findings: 0 required · 0 warnings · 0 optional suggestions
Since last review: 0 prior items resolved · 0 still apply · 0 new items found

Workflow run details

This is an automated review. Required findings need action before merge. Warnings and optional suggestions do not require a response or follow-up. A human maintainer makes the final merge decision.

@prekshivyas

prekshivyas commented Jul 12, 2026

Copy link
Copy Markdown
Collaborator

PR Review Advisor (Nemotron Ultra) — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: No advisor follow-up required beyond maintainer review.
Findings: 0 required · 0 warnings · 0 optional suggestions
Since last review: 0 prior items resolved · 0 still apply · 0 new items found

Workflow run details

This is an automated review. Required findings need action before merge. Warnings and optional suggestions do not require a response or follow-up. A human maintainer makes the final merge decision.

@deepujain
deepujain force-pushed the test/5745-e2e-inference-adapter branch from 4a13cfb to 38fb5c1 Compare July 12, 2026 16:45
@deepujain

Copy link
Copy Markdown
Contributor Author

Pushed a follow-up for the adapter cleanup: mode literals now have one source, compatible adapter construction uses named options, and provider-client calls share one helper. Focused e2e-support tests, typecheck, source-shape, and lint/checks pass; refreshed PR checks are green.

deepujain and others added 8 commits July 12, 2026 22:23
Refs NVIDIA#5745

Signed-off-by: Deepak Jain <deepujain@gmail.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Deepak Jain <deepujain@gmail.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Deepak Jain <deepujain@gmail.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Deepak Jain <deepujain@gmail.com>
Signed-off-by: Deepak Jain <deepujain@gmail.com>
Signed-off-by: Deepak Jain <deepujain@gmail.com>
Signed-off-by: Deepak Jain <deepujain@gmail.com>
Signed-off-by: Deepak Jain <deepujain@gmail.com>
Signed-off-by: Deepak Jain <deepujain@gmail.com>
@deepujain
deepujain force-pushed the test/5745-e2e-inference-adapter branch from b7884e2 to 129ffb1 Compare July 12, 2026 16:55
@prekshivyas

Copy link
Copy Markdown
Collaborator

/ok to test be24cdf

@coderabbitai

coderabbitai Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@prekshivyas

Copy link
Copy Markdown
Collaborator

/ok to test d137277

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@prekshivyas

Copy link
Copy Markdown
Collaborator

Exact-head re-review request for d137277fae315beb3f6034fbf80505a6a2fda080 (base 7b1382924d29097e96aeecf34505c2e247d12c8d).

Both requested P1s are addressed: mock Hermes receives no NVIDIA credential and launches its child with a minimal environment plus sentinel-secret coverage; route identity now parses state and compares the exact expected provider/model. The fixture also proves intended inference.local traffic succeeds while unrelated egress is explicitly denied. Full check:diff and focused adapter/workflow tests pass. Exact-head CI is green, canonical GPT Advisor is 0/0/0, CodeRabbit is green, and all review threads are resolved.

The remaining machine gate is the expected fork safety exception for credential-bearing E2E. Gate run 29305639898 is queued at e2e-no-secret-exception for this exact head/base. @cjagwani, please re-review the addressed findings. @cv @ericksoa, please approve that environment deployment or use the typed resolve-fork fallback after reviewing this revision.

@prekshivyas

Copy link
Copy Markdown
Collaborator

New exact head after the main-only merge: fb8452c273dd265bd5a3c73a4e48544d6697b937 on base 4f64b0ac19d321c6a85c88799c5675e33c3c1a7e. Standard CI is green, canonical GPT Advisor is 0/0/0, CodeRabbit is green, and no review threads remain. The Nemotron red is an Advisor protocol failure and is being rerun.

The remaining policy gate requires a maintainer fork exception for this exact revision: controller run 29308380469. @cv @ericksoa, please approve the protected environment or run the resolve-fork fallback with this head/base. @cjagwani, the feature diff is unchanged by the main merge; please complete the requested re-review.

@cv
cv dismissed cjagwani’s stale review July 14, 2026 15:36

Review outdated

@cv cv added v0.0.84 and removed v0.0.83 labels Jul 14, 2026
@cv cv unassigned cjagwani Jul 14, 2026
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
@prekshivyas

Copy link
Copy Markdown
Collaborator

/ok to test 9fc648e

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@github-actions

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some tests failed

Run: 29364133952
Workflow ref: tmp/e2e/pr-6672-9fc648e1
Requested targets: (default — all supported)
Requested test IDs: cloud-onboard,credential-sanitization,security-posture,hermes-dashboard,hermes-e2e,inference-routing,network-policy,cloud-inference
Summary: 7 passed, 1 failed, 0 cancelled, 0 skipped, 0 unknown

Test Result
cloud-inference ✅ success
cloud-onboard ✅ success
credential-sanitization ❌ failure
hermes-dashboard ✅ success
hermes-e2e ✅ success
inference-routing ✅ success
network-policy ✅ success
security-posture ✅ success

Failed tests: credential-sanitization. Check run artifacts for logs.

@github-actions

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All requested tests passed

Run: 29364476037
Workflow ref: tmp/e2e/pr-6672-9fc648e1
Requested targets: (default — all supported)
Requested test IDs: credential-sanitization
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped, 0 unknown

Test Result
credential-sanitization ✅ success

@prekshivyas

prekshivyas commented Jul 14, 2026

Copy link
Copy Markdown
Collaborator

Exact-head completion summary for 9fc648e1e20fcc7496b8ca9723e52fa93ac113f4 on base c181e9e2bc4d4e9d9b0e32bd985e0beff5f75dd8:

  • Both cjagwani P1s are addressed. Mock Hermes receives an empty NVIDIA_INFERENCE_API_KEY, uses a generated per-run compatible key, and launches the fake child with a minimal environment covered by a sentinel regression.
  • Exact route identity is proven through supported nemoclaw inference get --json: the artifact reports provider=compatible-endpoint and model=nvidia/nvidia/nemotron-3-ultra, both compared exactly. Direct and inference.local chats passed.
  • Standard CI, self-hosted CI, macOS, WSL, security scans, DCO, commit lint, and growth guard are green.
  • GPT-5.6 Terra and Nemotron advisors are both 0 blockers / 0 warnings / 0 suggestions. CodeRabbit is green with no unresolved threads.
  • Exact-head E2E batch: 7 selected targets passed; the initial credential-sanitization attempt stopped during installation on an external release-fetch socket hang up.
  • Focused exact-head retry: credential-sanitization passed. Therefore every required advisor target plus optional cloud-inference has passing exact-head evidence.

The temporary trusted dispatch branch was deleted after completion. The only remaining red gate is the fork-policy exception: controller run 29364378789 is waiting for the protected environment reviewer. @cv, please approve the credentialed-E2E skip for this exact head/base. @cjagwani, please complete the requested re-review; no unresolved review threads remain.

@ericksoa, the typed approve-fork-e2e-skip manual fallback can also record this exact head/base using the successful retry run as evidence_url if the protected deployment cannot be approved directly.

@prekshivyas prekshivyas left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed current head 9fc648e1. The credential boundary and exact route-identity fixes are sound; focused/local checks, standard and self-hosted CI, both advisors, CodeRabbit, and all advisor-selected exact-head E2E targets are clean (credential-sanitization passed on focused retry after the first attempt hit an external socket reset). LGTM pending the protected fork-policy gate approval.

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

# Conflicts:
#	test/e2e/support/e2e-workflow.test.ts
#	tools/e2e/workflow-boundary.mts
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
@prekshivyas

Copy link
Copy Markdown
Collaborator

@cv Please approve the protected credentialed-E2E skip for fork PR #6672 at exact head 9c230cab300348bc8f75a8672786bcca466edbe3: https://github.com/NVIDIA/NemoClaw/actions/runs/29430874084

The trusted controller selected cloud-onboard, credential-sanitization, security-posture, hermes-dashboard, hermes-e2e, inference-routing, network-policy. Standard CI, both PR Advisor lanes, CodeRabbit, macOS, and WSL are green; this head only merges current main and resolves the test-matrix conflict additively. The previously approved head passed the selected live coverage.

@cv
cv merged commit 53445b9 into NVIDIA:main Jul 15, 2026
41 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance integration: hermes Hermes integration behavior

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants