test(e2e): reflect graceful gateway tmpfs remount

[ericksoa]

Summary

Correct the exact-main driver-config proof to match OpenShell's graceful gateway lifecycle: shutdown stops the managed Docker sandbox, and startup resumes the same container with volatile tmpfs remounted empty while durable /sandbox state survives. This removes the deterministic false failure that blocked the full tag matrix in run 29607823884, specifically job 87975321452.

Changes

• Expect the post-restart tmpfs marker to be absent while retaining same-container, rendered-config, auth/mount, and durable-state assertions.
• Add a focused source-boundary regression for the graceful restart expectation.
• Update the OpenShell 0.0.85 migration review and its contract test with the same lifecycle semantics.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project e2e-support test/e2e/support/openshell-exact-main-driver-config.test.ts (3 passed); npx vitest run --project integration test/openshell-0.0.85-migration-review.test.ts (9 passed)
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Aaron Erickson aerickson@nvidia.com

Summary by CodeRabbit

• Documentation

  • Clarified stable-release validation requirements for tmpfs mounts, SELinux behavior, gateway restarts, rebuilds, and durable state.
  • Added more detailed recovery and remount verification steps.

• Tests

  • Strengthened end-to-end checks for empty tmpfs remounts after restart.
  • Added validation that durable state, configuration, and container continuity or replacement are verified across lifecycle operations.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7728b949-d843-4893-801e-5bed13371057

📥 Commits

Reviewing files that changed from the base of the PR and between e7e8b67 and 214be06.

📒 Files selected for processing (4)

• docs/security/openshell-0.0.85-migration-review.md
• test/e2e/live/openshell-exact-main-driver-config.ts
• test/e2e/support/openshell-exact-main-driver-config.test.ts
• test/openshell-0.0.85-migration-review.test.ts

---

📝 Walkthrough

Walkthrough

The stable selected-driver proof now requires an empty tmpfs remount after graceful gateway restart and a fresh remount after MCP rebuild. End-to-end and migration-review tests enforce the updated marker, lifecycle, container, configuration, and durable-state expectations.

Changes

Stable tmpfs proof

Layer / File(s)	Summary
Stable release proof contract docs/security/openshell-0.0.85-migration-review.md, test/openshell-0.0.85-migration-review.test.ts	The documented proof and its assertions require an empty restart remount, preserved durable state, and a fresh Docker-container remount after rebuild.
Runtime remount assertions test/e2e/live/openshell-exact-main-driver-config.ts, test/e2e/support/openshell-exact-main-driver-config.test.ts	Restart assertions expect an absent tmpfs marker, snapshot the remounted lifecycle, and verify restart/rebuild durability expectations in the implementation source.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: bug-fix, area: sandbox, area: docs, area: ci

Suggested reviewers: cv, apurvvkumaria

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the main change: updating e2e behavior for a graceful gateway tmpfs remount.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/tag-e2e-gateway-restart

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-7119.docs.buildwithfern.com/nemoclaw

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture

1 optional E2E recommendation

• sandbox-rebuild

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the fix/tag-e2e-gateway-... branch remains at 80%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.

File	main e7e8b67	fix/tag-e2e-gateway-... 214be06	+/-
src/lib/core/pr...mpt-activity.ts	92%	67%	-25%
src/lib/credentials/store.ts	64%	59%	-5%
src/lib/adapter...hell/resolve.ts	100%	100%	0%
src/lib/agent/defs.ts	81%	81%	0%
src/lib/agent/s...store-reader.ts	90%	90%	0%
src/lib/sandbox...rce-identity.ts	91%	91%	0%
src/lib/securit...p-url-target.ts	100%	100%	0%
src/lib/state/config-io.ts	93%	93%	0%
src/lib/state/registry.ts	83%	86%	+3%
src/lib/domain/.../connect-env.ts	89%	97%	+8%

---

_{Updated July 17, 2026 20:11 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}