Skip to content

2026 05 27 0hlj - #7075

Closed
maggiezha wants to merge 25 commits into
NVIDIA:mainfrom
maggiezha:2026-05-27-0hlj
Closed

2026 05 27 0hlj#7075
maggiezha wants to merge 25 commits into
NVIDIA:mainfrom
maggiezha:2026-05-27-0hlj

Conversation

@maggiezha

@maggiezha maggiezha commented Jul 17, 2026

Copy link
Copy Markdown

Summary

Related Issue

Changes

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification:
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

  • PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification:
  • Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Your Name your-email@example.com

Summary by CodeRabbit

  • New Features

    • Added independent CPU and GPU Kubernetes Helm deployments with autoscaling, monitoring, load testing, and recovery tools.
    • Added support for Nemotron Ultra through NVIDIA Inference Hub.
    • Added Tavily Web Search configuration, onboarding, policy, and verification support.
    • Added credentials:init-secrets for securely storing local API keys.
  • Documentation

    • Added comprehensive CPU, GPU, HPA, monitoring, deployment, credential, and Tavily setup guides.
  • Bug Fixes

    • Improved NVIDIA credential validation and endpoint selection for Build and Inference Hub keys.

maggiezha and others added 25 commits May 27, 2026 23:53
Split NVIDIA Build (nvapi-*) and Inference Hub (sk-*) env vars, load keys from
~/.nemoclaw/secrets.env, route Ultra via inference-api, and fix Tavily on rebuild resume.
Keep Tavily/Telegram support alongside upstream Brave egress verification and provider profile registration.
Removed unnecessary details about Dual NVIDIA keys and Secrets file while retaining key features for clarity.
Updated the README.fork.md to include new information and images.
Set toolSearch false for Ultra and document web_search usage so Tavily runs instead of failing tool_search_code.
Introduce the nemoclaw-cpu Helm chart with metrics-server-based autoscaling,
install/recover/reset/load-test scripts, and documentation for running
Inference Hub agents on MicroK8s (min 1, max 7 replicas per 8 vCPU).
Added an image and recovery instructions to README.
Introduce nemoclaw-gpu (Ollama + agent, DCGM gpu_utilization_percent HPA) with load-test and ops scripts tuned for 4× L40S. Split deploy guides into README-gpu/README-cpu and refresh the CPU chart helpers.
Removed 'GPU' from the title of the deployment README.
Updated images in README-gpu.md to include width and height attributes for better display.
Updated image syntax and added additional screenshots in the README for GPU deployment.
Updated README for GPU deployment with HPA details.
Signed-off-by: maggiezha <42832776+maggiezha@users.noreply.github.com>
Added port 9000 for the CPU deployment section.
Removed the third port entry from the table.
Signed-off-by: maggiezha <42832776+maggiezha@users.noreply.github.com>
Signed-off-by: maggiezha <42832776+maggiezha@users.noreply.github.com>
@copy-pr-bot

copy-pr-bot Bot commented Jul 17, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@coderabbitai

coderabbitai Bot commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 40dec7e1-fea0-4510-88a9-a66890412071

📥 Commits

Reviewing files that changed from the base of the PR and between 44de877 and 6c80048.

📒 Files selected for processing (126)
  • .cursor/skills/nemoclaw-k8s-hpa/SKILL.md
  • .cursor/skills/nemoclaw-k8s-hpa/reference.md
  • .gitignore
  • Dockerfile
  • README.fork.md
  • README.md
  • deploy/README-cpu.md
  • deploy/README-gpu.md
  • deploy/README.md
  • deploy/helm/README.md
  • deploy/helm/nemoclaw-cpu/.helmignore
  • deploy/helm/nemoclaw-cpu/Chart.yaml
  • deploy/helm/nemoclaw-cpu/README.md
  • deploy/helm/nemoclaw-cpu/files/agent-metrics.mjs
  • deploy/helm/nemoclaw-cpu/files/agent-server.mjs
  • deploy/helm/nemoclaw-cpu/files/cpu-spin-worker.mjs
  • deploy/helm/nemoclaw-cpu/files/load-generator.mjs
  • deploy/helm/nemoclaw-cpu/files/questions-sample.txt
  • deploy/helm/nemoclaw-cpu/monitoring/kube-prometheus-microk8s.yaml
  • deploy/helm/nemoclaw-cpu/monitoring/prometheus-adapter-values.yaml
  • deploy/helm/nemoclaw-cpu/observability.md
  • deploy/helm/nemoclaw-cpu/scripts/cluster-recover.sh
  • deploy/helm/nemoclaw-cpu/scripts/hpa-common.sh
  • deploy/helm/nemoclaw-cpu/scripts/hpa-load-test.sh
  • deploy/helm/nemoclaw-cpu/scripts/hpa-reset.sh
  • deploy/helm/nemoclaw-cpu/scripts/install-hpa.sh
  • deploy/helm/nemoclaw-cpu/scripts/install-performance-hpa.sh
  • deploy/helm/nemoclaw-cpu/templates/NOTES.txt
  • deploy/helm/nemoclaw-cpu/templates/_helpers.tpl
  • deploy/helm/nemoclaw-cpu/templates/configmap.yaml
  • deploy/helm/nemoclaw-cpu/templates/deployment.yaml
  • deploy/helm/nemoclaw-cpu/templates/hpa.yaml
  • deploy/helm/nemoclaw-cpu/templates/namespace.yaml
  • deploy/helm/nemoclaw-cpu/templates/secret.yaml
  • deploy/helm/nemoclaw-cpu/templates/service.yaml
  • deploy/helm/nemoclaw-cpu/templates/servicemonitor.yaml
  • deploy/helm/nemoclaw-cpu/values-step2-hpa-performance.yaml
  • deploy/helm/nemoclaw-cpu/values-step2-hpa-saturate.yaml
  • deploy/helm/nemoclaw-cpu/values-step2-hpa.yaml
  • deploy/helm/nemoclaw-cpu/values.yaml
  • deploy/helm/nemoclaw-gpu/.helmignore
  • deploy/helm/nemoclaw-gpu/Chart.yaml
  • deploy/helm/nemoclaw-gpu/README.md
  • deploy/helm/nemoclaw-gpu/files/agent-metrics.mjs
  • deploy/helm/nemoclaw-gpu/files/agent-server.mjs
  • deploy/helm/nemoclaw-gpu/files/load-generator.mjs
  • deploy/helm/nemoclaw-gpu/files/ollama-start.sh
  • deploy/helm/nemoclaw-gpu/files/questions-sample.txt
  • deploy/helm/nemoclaw-gpu/monitoring/dcgm-servicemonitor.yaml
  • deploy/helm/nemoclaw-gpu/monitoring/kube-prometheus-microk8s.yaml
  • deploy/helm/nemoclaw-gpu/monitoring/prometheus-adapter-gpu-values.yaml
  • deploy/helm/nemoclaw-gpu/scripts/cluster-recover.sh
  • deploy/helm/nemoclaw-gpu/scripts/get-agent-pods.sh
  • deploy/helm/nemoclaw-gpu/scripts/get-hpa.sh
  • deploy/helm/nemoclaw-gpu/scripts/hpa-common.sh
  • deploy/helm/nemoclaw-gpu/scripts/hpa-load-test.sh
  • deploy/helm/nemoclaw-gpu/scripts/hpa-reset.sh
  • deploy/helm/nemoclaw-gpu/scripts/hpa-watch.sh
  • deploy/helm/nemoclaw-gpu/scripts/install-hpa.sh
  • deploy/helm/nemoclaw-gpu/templates/NOTES.txt
  • deploy/helm/nemoclaw-gpu/templates/_helpers.tpl
  • deploy/helm/nemoclaw-gpu/templates/configmap.yaml
  • deploy/helm/nemoclaw-gpu/templates/deployment.yaml
  • deploy/helm/nemoclaw-gpu/templates/hpa.yaml
  • deploy/helm/nemoclaw-gpu/templates/namespace.yaml
  • deploy/helm/nemoclaw-gpu/templates/pvc.yaml
  • deploy/helm/nemoclaw-gpu/templates/service.yaml
  • deploy/helm/nemoclaw-gpu/templates/servicemonitor.yaml
  • deploy/helm/nemoclaw-gpu/values-load-test-hpa.yaml
  • deploy/helm/nemoclaw-gpu/values-step2-hpa-latency.yaml
  • deploy/helm/nemoclaw-gpu/values-step2-hpa-performance.yaml
  • deploy/helm/nemoclaw-gpu/values-step2-hpa.yaml
  • deploy/helm/nemoclaw-gpu/values.yaml
  • deploy/scripts/install-both.sh
  • deploy/scripts/status-both.sh
  • deploy/scripts/uninstall-both.sh
  • docs/network-policy/integration-policy-examples.mdx
  • docs/security/credential-storage.mdx
  • nemoclaw-blueprint/blueprint.yaml
  • nemoclaw-blueprint/model-specific-setup/openclaw/nemotron-ultra-managed-inference.json
  • nemoclaw-blueprint/policies/presets/tavily.yaml
  • nemoclaw-blueprint/router/pool-config.yaml
  • nemoclaw/src/index.ts
  • nemoclaw/src/register.test.ts
  • scripts/checks/direct-credential-env.ts
  • scripts/examples/nemotron-ultra-inference.py
  • scripts/generate-openclaw-config.py
  • scripts/setup-tavily-search.sh
  • scripts/test-tavily-flow.sh
  • scripts/verify-tavily-openclaw-config.py
  • secrets.env.example
  • src/commands/credentials/init-secrets.ts
  • src/lib/cli/public-display-defaults.ts
  • src/lib/credentials/command-support.ts
  • src/lib/credentials/secrets-env.test.ts
  • src/lib/credentials/secrets-env.ts
  • src/lib/credentials/store.ts
  • src/lib/inference/config.test.ts
  • src/lib/inference/config.ts
  • src/lib/inference/model-prompts.ts
  • src/lib/inference/provider-models.ts
  • src/lib/inference/web-search.ts
  • src/lib/onboard.ts
  • src/lib/onboard/dashboard.ts
  • src/lib/onboard/dockerfile-patch.ts
  • src/lib/onboard/machine/handlers/finalization.ts
  • src/lib/onboard/machine/handlers/provider-inference.ts
  • src/lib/onboard/machine/handlers/sandbox.ts
  • src/lib/onboard/policy-presets.ts
  • src/lib/onboard/policy-selection.ts
  • src/lib/onboard/providers.test.ts
  • src/lib/onboard/providers.ts
  • src/lib/onboard/summary.test.ts
  • src/lib/onboard/summary.ts
  • src/lib/onboard/web-search-flow.ts
  • src/lib/onboard/web-search-verify.test.ts
  • src/lib/onboard/web-search-verify.ts
  • src/lib/policy/index.ts
  • src/lib/state/onboard-session.ts
  • src/lib/validation.test.ts
  • src/lib/validation.ts
  • test/credentials.test.ts
  • test/generate-openclaw-config.test.ts
  • test/onboard-brave-validation.test.ts
  • test/onboard-policy-suggestions.test.ts
  • test/validate-blueprint.test.ts

📝 Walkthrough

Walkthrough

Changes

Kubernetes HPA deployment

Layer / File(s) Summary
CPU and GPU Helm charts
deploy/helm/nemoclaw-cpu/..., deploy/helm/nemoclaw-gpu/...
Adds independent CPU and GPU agent charts with deployments, services, probes, metrics, HPA modes, monitoring configuration, load generators, and operational scripts.
Deployment documentation
deploy/README*.md, deploy/helm/README.md, .cursor/skills/nemoclaw-k8s-hpa/*
Documents installation, architecture, autoscaling behavior, observability, testing, troubleshooting, and recovery workflows.

Onboarding and integrations

Layer / File(s) Summary
Credential storage and NVIDIA routing
src/lib/credentials/*, src/lib/inference/*, src/lib/onboard.ts
Adds local secrets-file staging and initialization, endpoint-specific NVIDIA key validation, and Nemotron Ultra Inference Hub routing.
Tavily web search
src/lib/onboard/web-search-flow.ts, scripts/*tavily*, nemoclaw-blueprint/policies/presets/tavily.yaml
Adds Tavily provider selection, credential validation, policy setup, Docker/OpenClaw configuration, verification, and tests.
Fork and model documentation
README.md, README.fork.md, scripts/examples/nemotron-ultra-inference.py
Adds fork-specific setup instructions and a Nemotron Ultra inference example.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related PRs

Suggested labels: feature, area: onboarding, area: docs, area: security, integration: telegram

Suggested reviewers: cv

Poem

I’m a rabbit watching pods take flight,
CPU and GPUs scale just right.
Tavily searches, secrets stay neat,
Ultra models make inference sweet.
Helm charts hop through every queue—
A carrot-powered rollout, fresh and new!

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
⚔️ Resolve merge conflicts
  • Resolve merge conflict in branch 2026-05-27-0hlj

Comment @coderabbitai help to get the list of available commands.

@maggiezha maggiezha closed this Jul 17, 2026
@github-actions

github-actions Bot commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — Blocking findings reported

Advisor assessment: Blockers require maintainer review
Next action: Review the blockers below.
Findings: 5 blockers · 2 warnings · 0 suggestions

Model lanes

  • GPT-5.6 Terra (primary): Completed · high confidence · 5 blockers · 2 warnings · 0 suggestions
  • Nemotron 3 Ultra (second opinion): Failed after a partial review · low confidence · 0 blockers · 9 warnings · 0 suggestions

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, full-e2e, hermes-e2e, security-posture, inference-routing, network-policy, onboard-repair, onboard-resume, ubuntu-repo-cloud-openclaw

3 optional E2E recommendations
  • brave-search
  • cloud-inference
  • sandbox-rebuild

Blockers

PRA-1 Blocker — Limit recovery cleanup to resources owned by this chart

  • Location: deploy/helm/nemoclaw-cpu/scripts/cluster-recover.sh:25
  • Category: correctness
  • Problem: The CPU and GPU recovery scripts delete every HPA, Job, Pod, Deployment, and ReplicaSet in the namespace. Their NAMESPACE input is configurable, so invoking either chart recovery script in a namespace that also contains other workloads removes those unrelated workloads rather than recovering only the chart resources.
  • Impact: An operator can cause an unintended namespace-wide outage and data-processing interruption while attempting to recover one NemoClaw deployment.
  • Fix: Replace namespace-wide `--all` cleanup in both recovery paths with the chart's stable labels and explicitly named chart resources; do not force-delete or clear finalizers on resources that do not match this release/chart.
  • Verification: Read both recovery scripts' kubectl selectors and compare them with their chart labels in templates/_helpers.tpl; a differently labeled workload in the same namespace is currently selected by the `--all` commands.
  • Test coverage: Add shell-level mocked-kubectl tests (or command-capture tests) for CPU and GPU recovery proving commands select only this release's labeled resources and never use namespace-wide pod/job/deployment/HPA deletion.
  • Evidence: deploy/helm/nemoclaw-cpu/scripts/cluster-recover.sh:25-34 uses `--all` for HPA, Jobs, Pods, and later Deployments/ReplicaSets after accepting NAMESPACE from the environment. deploy/helm/nemoclaw-cpu/scripts/hpa-common.sh clears finalizers and force-deletes all pods in its supplied namespace. The chart defines stable app/release labels in deploy/helm/nemoclaw-cpu/templates/_helpers.tpl, but recovery does not use them for its broad cleanup. deploy/helm/nemoclaw-gpu/scripts/cluster-recover.sh:20-29 uses `--all` for HPA, Jobs, Pods, and later Deployments/ReplicaSets after accepting NAMESPACE from the environment. deploy/helm/nemoclaw-cpu/scripts/cluster-recover.sh:25-34 has the matching CPU behavior. Both charts define stable workload labels in their templates/_helpers.tpl files but recovery uses broad namespace selectors.

PRA-2 Blocker — Replace stale resumed NVIDIA endpoint with the selected model route

  • Location: src/lib/onboard/machine/handlers/provider-inference.ts:174
  • Category: correctness
  • Problem: On a completed provider-selection resume for `nvidia-prod`, the code updates `credentialEnv` from `resolveNvidiaCloudModelRoute(model)` but retains any nonempty persisted `endpointUrl` through `endpointUrl = endpointUrl || nvidiaRoute.apiBaseUrl`. A session persisted with the old Integrate URL and an Ultra model consequently combines an Inference Hub credential with the Integrate endpoint.
  • Impact: Resumed Ultra onboarding can authenticate against the wrong NVIDIA API endpoint and fail or use a route that does not match the model's selected provider contract.
  • Fix: For the repaired `nvidia-prod` resume state, assign `endpointUrl` from `nvidiaRoute.apiBaseUrl` rather than using the stale persisted URL; keep both endpoint and credential derived from the same resolver result.
  • Verification: Trace the completed-session resume branch with provider `nvidia-prod`, model `nvidia/nvidia/llama-3.1-nemotron-ultra-253b-v1`, and a nonempty `https://integrate.api.nvidia.com/v1\` endpoint; the current `||` retains that endpoint.
  • Test coverage: Add a resume-state test seeded with an Ultra model, stale Integrate endpoint, and stale credential env, asserting setup receives `https://inference-api.nvidia.com/v1\` and `NVIDIA_INFERENCE_HUB_API_KEY`.
  • Evidence: src/lib/onboard/machine/handlers/provider-inference.ts:174-177 enters the completed provider-selection resume path and sets `credentialEnv = nvidiaRoute.credentialEnv` while assigning `endpointUrl = endpointUrl || nvidiaRoute.apiBaseUrl`. src/lib/inference/config.ts defines the Ultra route as `https://inference-api.nvidia.com/v1\` with `NVIDIA_INFERENCE_HUB_API_KEY`. README.fork.md:134 describes resume repair as fixing both `credentialEnv` and `endpointUrl` from the selected model.

PRA-3 Blocker — Do not pass the Inference Hub key in Helm arguments

  • Location: deploy/helm/nemoclaw-cpu/scripts/install-hpa.sh:47
  • Category: security
  • Problem: The install path expands `NVIDIA_INFERENCE_HUB_API_KEY` into `helm --set inference.apiKey=...`; reset and load-test paths do the same. Helm stores supplied values in release metadata, and the literal value is also exposed in the local process argument list while Helm runs.
  • Impact: A cluster reader with Helm-release access or a same-host process observer can recover the Inference Hub credential, allowing unauthorized use of the account's inference quota.
  • Fix: Require `inference.existingSecret` (or create an operator-managed Kubernetes Secret through a secret-safe mechanism) and pass only the secret name/key reference to Helm; remove `--set inference.apiKey=...` from all scripts.
  • Verification: Inspect install-hpa.sh:47-57 and the chart secret template: the CLI value populates `.Values.inference.apiKey`, which is rendered into a Secret and retained in Helm release values.
  • Test coverage: Add a command-capture test for install/reset/load scripts that asserts no Helm argv contains `inference.apiKey` or the credential value and that the rendered Deployment uses a configured existing Secret.
  • Evidence: deploy/helm/nemoclaw-cpu/scripts/install-hpa.sh:47-57 supplies `--set inference.apiKey=${NVIDIA_INFERENCE_HUB_API_KEY}`. deploy/helm/nemoclaw-cpu/scripts/hpa-reset.sh and hpa-load-test.sh also supply the same literal Helm value. deploy/helm/nemoclaw-cpu/templates/secret.yaml renders `.Values.inference.apiKey` into Secret stringData when no existing Secret is configured.

PRA-5 Blocker — Pin the GPU inference image to an immutable reviewed digest

  • Location: deploy/helm/nemoclaw-gpu/values.yaml:24
  • Category: security
  • Problem: The GPU chart defaults to `ollama/ollama:latest`, so installs at different times can execute different unreviewed image contents even when the chart revision is unchanged.
  • Impact: A mutable upstream tag can introduce a compromised or incompatible inference container into GPU agent pods without a source-controlled chart change.
  • Fix: Replace `latest` with a reviewed image digest (and retain an explicit version for readability); update the digest only through the chart's reviewed release process.
  • Verification: Inspect values.yaml:24-27 and deployment.yaml image interpolation; the rendered image is `ollama/ollama:latest`.
  • Test coverage: Add a chart policy/lint test that rejects mutable image tags and requires digest-pinned production images for the Ollama and agent containers.
  • Evidence: deploy/helm/nemoclaw-gpu/values.yaml:24-27 sets `repository: ollama/ollama` and `tag: latest`. deploy/helm/nemoclaw-gpu/templates/deployment.yaml interpolates this value directly as the Ollama container image. The chart is a new production deployment boundary and does not otherwise constrain the image by digest.

PRA-6 Blocker — Run chart containers with a restricted non-root security context

  • Location: deploy/helm/nemoclaw-cpu/templates/deployment.yaml:34
  • Category: security
  • Problem: The new CPU and GPU Deployment templates define no pod or container security context. Their default Node and Ollama images therefore run with image-default root identities and retain default privilege-escalation/capability settings.
  • Impact: A compromise of the exposed agent/proxy or inference process gains root inside the pod, increasing the blast radius and making a container-escape vulnerability easier to exploit.
  • Fix: Set a tested non-root `runAsUser`/`runAsGroup`, `runAsNonRoot: true`, `allowPrivilegeEscalation: false`, and drop all Linux capabilities; use read-only root filesystems where the application images permit it, with only required writable mounts.
  • Verification: Inspect CPU deployment.yaml:34-101 and GPU deployment.yaml:39-151: neither pod spec nor either container defines `securityContext`; defaults use Node and Ollama images.
  • Test coverage: Add rendered-chart assertions that each container has non-root execution, no privilege escalation, and all capabilities dropped; include a smoke fixture confirming required writable paths are explicitly mounted.
  • Evidence: deploy/helm/nemoclaw-cpu/templates/deployment.yaml:34-101 contains no `securityContext` at pod or container scope. deploy/helm/nemoclaw-gpu/templates/deployment.yaml:39-151 likewise lacks a pod/container security context for the Ollama and agent containers. deploy/helm/nemoclaw-cpu/values.yaml defaults to node:22-bookworm-slim, while the GPU chart defaults to node and Ollama images, without an enforced non-root override.
2 warnings · 0 suggestions

Warnings

Warnings do not block.

PRA-4 Warning — Probe Tavily egress instead of accepting configuration presence

  • Location: src/lib/onboard/web-search-verify.ts:72
  • Category: security
  • Problem: OpenClaw verification makes an authenticated placeholder-only egress request only for Brave. When `search.provider` is Tavily, it logs that web search is active immediately after parsing configuration, without proving the Tavily credential provider is injected or the sandbox policy permits the route.
  • Impact: Onboarding can report Tavily as active even when the credential rewrite or enforced egress route is broken, leaving the agent with a silently nonfunctional security-bound integration.
  • Recommendation: Add a Tavily-specific in-sandbox probe that uses the OpenShell credential placeholder without putting a literal secret in argv, validates a successful Tavily response, and emits a warning when provider injection or policy enforcement fails.
  • Verification: Follow the `search.provider !== "brave"` branch in web-search-verify.ts:72-84 with a Tavily config; it returns before any sandbox network request.
  • Test coverage: Add tests for Tavily configuration that assert an in-sandbox placeholder-only probe is issued and that failed/non-2xx responses produce the existing verification warning.
  • Evidence: src/lib/onboard/web-search-verify.ts:72-84 logs success for every non-Brave provider after config parsing. The Brave-specific branch below performs a placeholder validation and a real sandbox egress probe. nemoclaw-blueprint/policies/presets/tavily.yaml introduces a distinct enforced egress policy and Tavily credential flow requiring equivalent verification.

PRA-7 Warning — Add rendered-chart regression coverage for the new HPA deployments

  • Location: deploy/helm/nemoclaw-cpu/templates/hpa.yaml:1
  • Category: tests
  • Problem: The PR adds independent CPU and GPU Helm charts plus install/reset/load scripts, but no chart-render or command-capture tests exist under `deploy/`. As a result, name/selector agreement between templates and scripts, HPA overlays, and the never-zero replica invariant can regress without any checked-in test failing.
  • Impact: A future chart or script edit can render an HPA pointing at a different Deployment, select the wrong Service/resource names, or violate the required minimum-replica state, leaving installs or recovery flows broken.
  • Recommendation: Add a focused test that renders each chart with defaults and HPA overlays and asserts Deployment/HPA/Service names/selectors agree, HPA minReplicas is at least one, and script-derived release/namespace names target the rendered resources.
  • Verification: Inspect `deploy/helm`: it contains chart templates and shell scripts but no test files; compare the independently constructed deployment/service names in scripts with Helm helper-generated names.
  • Test coverage: A chart-render/command-capture suite covering CPU and GPU default plus HPA overlays: assert matching resource names and selectors, minReplicas >= 1, and script release/namespace targets match the rendered Deployment, HPA, and Service.
  • Evidence: The static test inventory lists no changed tests under `deploy/`; repository search finds only HPA shell scripts and no Helm test suite. deploy/helm/nemoclaw-cpu/templates/hpa.yaml defines the new minimum-replica HPA contract. CPU and GPU install/reset/load scripts independently derive resource names while templates derive names through Helm helpers.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant