feat(blueprint): add Okta runtime identity reference - #7265
Merged
Conversation
Signed-off-by: Alex Fournier <afournier@nvidia.com>
Signed-off-by: Alex Fournier <afournier@nvidia.com>
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe blueprint schema and runner add optional runtime identity support. Apply prepares and attaches providers, plans expose non-secret identity metadata, receipts support status and rollback, and validation rejects unsafe profiles, credentials, and destinations. An Okta provider profile, documentation, and lifecycle tests cover the feature. ChangesRuntime identity support
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant actionApply
participant runtimeIdentity
participant OpenShell
participant sandbox
actionApply->>runtimeIdentity: prepare runtime identity
runtimeIdentity->>OpenShell: validate and import profile
runtimeIdentity->>OpenShell: configure OAuth refresh and rotate credential
actionApply->>OpenShell: attach provider
OpenShell->>sandbox: provide access-token placeholder
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
12 tasks
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 7ea7370 in the Show a code coverage summary of the most impacted files.
TypeScript / code-coverage/cliThe overall coverage in commit 7ea7370 in the Show a code coverage summary of the most impacted files.
Updated |
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-7265.docs.buildwithfern.com/nemoclaw |
Contributor
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: 1 optional E2E recommendation
This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
Signed-off-by: Alex Fournier <afournier@nvidia.com>
afourniernv
changed the title
afourniernv
marked this pull request as ready for review
July 20, 2026 20:30
Contributor
Author
|
Manual live-validation note This PR's current direct-blueprint path was smoke-tested against the existing Okta test tenant. The test covered:
The verifier observed the gateway-resolved credential at the boundary; the sandbox was not given raw OAuth material. Temporary sandbox, provider, gateway registration, verifier, and tunnel resources were removed after the test. No tenant configuration, OAuth values, or secret-bearing output is committed or included in this comment. This is manual acceptance evidence, not CI coverage. It does not validate OBO, Entra, Azure infrastructure, revocation, or production tenant readiness. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
docs/reference/architecture.mdx (1)
279-294: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winConsider documenting rollback's provider-detach behavior.
This section covers apply-time behavior (import, create, configure, rotate, attach) but doesn't mention that
actionRollbackdetaches the runtime provider from the sandbox whenidentity.provider_nameis present in the persisted plan (runner.tslines 1260-1273). A brief sentence here would round out the lifecycle description for operators.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/architecture.mdx` around lines 279 - 294, Add a brief lifecycle sentence to this architecture section documenting that rollback detaches the runtime provider from the sandbox when identity.provider_name is present in the persisted plan. Reference the existing actionRollback behavior without expanding the surrounding apply or middleware guidance.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/reference/architecture.mdx`:
- Around line 256-272: Align the profile copy instruction with the example
configuration so the file referenced by identity.okta.profile_path exists during
import. Either use provider-profiles/acme-okta-runtime.yaml consistently or
explicitly instruct readers to rename the copied okta-runtime-v1.yaml file to
that tenant-specific filename.
In `@nemoclaw/src/blueprint/runner-identity.test.ts`:
- Around line 19-41: Remove all five new conditional statements from
runner-identity.test.ts to satisfy the growth guardrail while preserving
coverage. Move the reusable node:fs mock setup out of the test file into shared
test utilities, replace the explicit throws near the refreshCall and merged
assertions with expect(...).toBeDefined() followed by non-null assertions, and
refactor the exec mock dispatch into a keyed Map or Record using args.join(" ")
with a default response instead of the if branch.
In `@nemoclaw/src/blueprint/runner.ts`:
- Around line 269-301: Update isRuntimeIdentityConfig to require client_id_env,
refresh_token_env, and optional client_secret_env to be pairwise distinct while
preserving the existing format and optional-field validation. Reject
configurations where any two provided identity environment names are equal
before configureRuntimeIdentity can construct colliding refreshEnv entries.
- Around line 391-404: Update the components.identity validation in isBlueprint
to require an okta property whenever identity is present, matching the schema’s
required identity.okta contract. Preserve the existing plain-object and
allowed-key checks, then validate identity.okta with isRuntimeIdentityConfig.
---
Nitpick comments:
In `@docs/reference/architecture.mdx`:
- Around line 279-294: Add a brief lifecycle sentence to this architecture
section documenting that rollback detaches the runtime provider from the sandbox
when identity.provider_name is present in the persisted plan. Reference the
existing actionRollback behavior without expanding the surrounding apply or
middleware guidance.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: bd07e62c-c772-4be7-ac32-af37252e1d10
📒 Files selected for processing (5)
docs/reference/architecture.mdxnemoclaw-blueprint/provider-profiles/okta-runtime-v1.yamlnemoclaw/src/blueprint/runner-identity.test.tsnemoclaw/src/blueprint/runner.tsschemas/blueprint.schema.json
wscurran
added
area: architecture
Signed-off-by: Alex Fournier <afournier@nvidia.com>
Contributor
|
Thanks for putting a concrete implementation behind this. I do want NemoClaw to support this capability, and using OpenShell Providers v2 for credential custody, refresh, and injection—with middleware remaining a separate pre-credential policy boundary—feels like the right foundation. Before we settle on I had imagined runtime identity as an optional sandbox capability managed through a command—something like A few questions I’d value your thoughts on:
I don’t think this slice needs to include Entra, browser OAuth, OBO, or production middleware. Would you be open to making the provider-neutral seam plus Okta as its first conformance implementation the boundary of this work? Alternatively, could this PR retain the Okta profile and reference evidence while the generic command/lifecycle lands separately? I’m interested in how you’re thinking about that split; the underlying capability and security direction look valuable. |
23 tasks
cv
added a commit
that referenced
this pull request
Jul 26, 2026
<!-- markdownlint-disable MD041 --> ## Summary Reject malformed blueprint sandbox names and provider identifiers consistently in the schema and runtime before state is written or OpenShell is invoked. Preserve the existing provider identifier contract, and render rejected values as bounded terminal-safe previews so hostile blueprint text cannot inject terminal or CI annotations. ## Changes - Add `nemoclaw/src/shared/sandbox-name.cts` as the canonical runtime boundary for sandbox names, provider identifiers, and safe rejection previews. The current requirement spans the plugin runner, snapshot flow, and root CLI; a copied validator is insufficient because existing copies had diverged. Shared-module and source-mode alias tests protect the contract. - Enforce sandbox names as 1–63 lowercase letters, numbers, or internal hyphens, starting with a letter and ending with a letter or number. - Preserve the existing provider identifier rule: 1–128 letters, numbers, dots, underscores, or hyphens, starting with a letter. - Apply runtime validation before apply state creation, rollback commands or completion markers, and snapshot OpenShell calls. - Add hostile-input, boundary, schema-parity, apply, rollback, snapshot, build, and alias coverage. Split the new schema cases into a focused file to keep the enforced test-file size budget green. - Document both supported blueprint naming constraints in `docs/reference/architecture.mdx`. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Independent exact-head review at `f2020df63` passed the product-scope gate and all nine security categories with no findings. It confirmed schema/runtime/provider parity, bounded terminal-safe diagnostics, and validation before apply, rollback, and snapshot side effects, including line-feed, carriage-return, Unicode line-separator, and non-ASCII rejection probes. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `docs/reference/architecture.mdx` now documents the exact sandbox and provider constraints and the validation-before-OpenShell boundary. Exact-head review confirmed the table matches the schema and runtime validators; `npm run docs` passed with 0 errors and 2 known baseline warnings. - Agent: Codex Desktop <!-- docs-review-head-sha: f2020df --> <!-- docs-review-agents-blob-sha: be20a09 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - [x] PR description includes a `Signed-off-by:` line and every published commit appears as Verified in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, and exact-head `npm run check:diff` passed on Node 22.23.1 - [x] Targeted behavior tests pass for the current change set — full plugin project: 24 files and 610 tests; focused CLI/schema/alias contracts: 4 files and 136 tests; all 48 checked-in configs pass schema validation; CLI and plugin/test type checks pass - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: `npm test` was attempted on Node 22.23.1 with the SSH signing socket. The aggregate did not terminate because two unchanged workers remained idle. All 20 observed failures reproduce on exact `main` `d4a859a` with identical test names and counts: 3 DGX Station installer cases and 17 host/symlink-sensitive config-guard cases. Fresh PR CI is required as the authoritative broad gate. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [x] `npm run docs` builds without errors (two known baseline warnings) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Additional exact-head evidence: - `npm run validate:configs`: all 48 config files passed. - `npm run test:projects:check`: project membership remained exact after the alias composition; the final diff gate also passed repository and test-size checks. - The one `vitest.config.ts` conflict composes current main's live-E2E phase aliases with the shared validator aliases; 121 schema/alias tests and the canonical diff gate passed afterward. - The cross-issue sweep found no contradiction or supersession blocker. Merge #7238 before #7265 so #7265 can reuse this shared provider validator. --- Signed-off-by: 1PoPTRoN <vrxn.arp1traj@gmail.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Added stricter validation for sandbox and provider names, including format and length requirements. - Invalid names are rejected before sandbox, provider, snapshot, or rollback commands run. - Improved validation errors with safe, readable previews that prevent control characters or excessively long values from appearing directly. - **Documentation** - Documented naming requirements for blueprint sandbox and inference provider identifiers. - **Tests** - Expanded coverage for valid, invalid, boundary, rollback, and command-safety scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (3)
nemoclaw/src/blueprint/runtime-identity.ts (1)
476-500: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
compensateRuntimeIdentityApplyandremoveRuntimeIdentityare byte-identical.Keep both names for call-site clarity, but have one delegate to the other so the ownership rules live in a single place.
♻️ Proposed refactor
export async function removeRuntimeIdentity( receipt: RuntimeIdentityReceipt, sandboxName: string, deps: RuntimeIdentityDeps, ): Promise<void> { - if (receipt.attachment_created) { - await detachRuntimeIdentity(receipt, sandboxName, deps); - } - if (receipt.provider_created) { - await deleteCreatedProvider(receipt, deps); - } + await compensateRuntimeIdentityApply(receipt, sandboxName, deps); }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@nemoclaw/src/blueprint/runtime-identity.ts` around lines 476 - 500, Make compensateRuntimeIdentityApply delegate to removeRuntimeIdentity, preserving both exported names for call-site clarity while centralizing the existing attachment and provider cleanup logic in removeRuntimeIdentity. Keep the current cleanup ordering and receipt checks unchanged.nemoclaw/src/blueprint/runtime-identity.test.ts (1)
240-244: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueDead response key.
responses.set("provider profile import --file", [])never matches a real command key (the import command always includes the resolved path) and can be dropped.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@nemoclaw/src/blueprint/runtime-identity.test.ts` around lines 240 - 244, Remove the unused responses.set entry for the incomplete “provider profile import --file” command in the “accepts an already imported profile” test, while retaining the path-specific response setup that matches the actual import command.nemoclaw/src/blueprint/runner.ts (1)
1062-1064: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winSandbox compensation is gated on identity being configured.
if (!runtimeIdentityConfig) throw errorskips the stop/remove path entirely, so an apply failure on a blueprint withoutcomponents.identitystill leaves the sandbox that this apply created. Either gate the two cleanups independently (identity compensation on the receipt, sandbox cleanup onsandboxCreatedByApply) or note in the code why identity-less applies intentionally keep the sandbox.♻️ Proposed refactor
} catch (error) { - if (!runtimeIdentityConfig) throw error; - const cleanupFailures: string[] = [];🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@nemoclaw/src/blueprint/runner.ts` around lines 1062 - 1064, Update the apply failure handler around the catch block to decouple sandbox cleanup from the runtimeIdentityConfig check: run identity compensation only when runtimeIdentityConfig exists, but still stop and remove the sandbox when sandboxCreatedByApply is true. Preserve rethrowing the original error after both applicable cleanup paths complete.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@nemoclaw/src/blueprint/runner-identity.test.ts`:
- Around line 304-345: Update the test around actionStatus and actionRollback so
the status portion is independently awaited and asserts that the returned status
payload includes the validated ownership receipt from plan.json. Keep rollback
assertions focused on detach, delete, and the rolled_back marker, or split the
status verification into a separate test.
In `@nemoclaw/src/blueprint/runner.ts`:
- Around line 1065-1092: Persist the successful runtime identity receipt
immediately after prepareRuntimeIdentity/attachRuntimeIdentity complete, before
subsequent sandbox or plan mutations, so compensation failures leave recoverable
state. Update the apply flow around runtimeIdentityReceipt and the success-path
plan.json write, and ensure actionRollback can consume the persisted receipt
without changing normal successful cleanup behavior.
- Around line 529-539: Update the subprocess result handling around the execa
invocation to fail closed when result.exitCode is undefined, rather than
coercing it to 0. Ensure prepareRuntimeIdentity treats signal-terminated or
failed-to-spawn provider commands as unsuccessful and does not persist a receipt
for them, while preserving normal exit-code handling.
- Around line 266-276: Update isPolicyMiddlewares so uniqueness is enforced only
for explicitly provided entry.order values; do not coalesce omitted orders to 0,
allowing multiple order-less middlewares. Mirror this validation in
schemas/blueprint.schema.json so schema validation and isBlueprint apply the
same order uniqueness behavior.
In `@nemoclaw/src/blueprint/runtime-identity.test.ts`:
- Around line 279-281: Fix the assertions in the runtime identity tests around
commandKey calls, including both affected locations, because negated toContain
with expect.stringContaining does not validate substring absence. Assert against
the joined or filtered command-key list so each test fails when any “refresh
configure” command is present.
---
Nitpick comments:
In `@nemoclaw/src/blueprint/runner.ts`:
- Around line 1062-1064: Update the apply failure handler around the catch block
to decouple sandbox cleanup from the runtimeIdentityConfig check: run identity
compensation only when runtimeIdentityConfig exists, but still stop and remove
the sandbox when sandboxCreatedByApply is true. Preserve rethrowing the original
error after both applicable cleanup paths complete.
In `@nemoclaw/src/blueprint/runtime-identity.test.ts`:
- Around line 240-244: Remove the unused responses.set entry for the incomplete
“provider profile import --file” command in the “accepts an already imported
profile” test, while retaining the path-specific response setup that matches the
actual import command.
In `@nemoclaw/src/blueprint/runtime-identity.ts`:
- Around line 476-500: Make compensateRuntimeIdentityApply delegate to
removeRuntimeIdentity, preserving both exported names for call-site clarity
while centralizing the existing attachment and provider cleanup logic in
removeRuntimeIdentity. Keep the current cleanup ordering and receipt checks
unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a0f75c2d-2e9a-45ce-8079-14f131067d3e
📒 Files selected for processing (7)
docs/reference/architecture.mdxnemoclaw-blueprint/provider-profiles/okta-runtime-v1.yamlnemoclaw/src/blueprint/runner-identity.test.tsnemoclaw/src/blueprint/runner.tsnemoclaw/src/blueprint/runtime-identity.test.tsnemoclaw/src/blueprint/runtime-identity.tsschemas/blueprint.schema.json
🚧 Files skipped from review as they are similar to previous changes (2)
- docs/reference/architecture.mdx
- nemoclaw-blueprint/provider-profiles/okta-runtime-v1.yaml
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
ericksoa
approved these changes
Jul 28, 2026
ericksoa
left a comment
ericksoa
left a comment
Contributor
There was a problem hiding this comment.
Approved on exact head 7ea7370 after exact-head CI, CodeQL/security checks, both PR Review Advisor lanes, the complete protected E2E matrix, and raw TC-INF-12 OAuth refresh/rotation/protected-resource/rollback evidence passed.
23 tasks
cv
pushed a commit
that referenced
this pull request
Jul 28, 2026
<!-- markdownlint-disable MD041 --> ## Summary Add the canonical dated changelog entry for NemoClaw v0.0.97 before the release plan captures `origin/main`. The entry groups the user-visible and maintainer-facing changes since v0.0.96 while preserving the Deferred dual-Station status, experimental runtime-identity boundary, and pending physical IGX validation. ## Changes - Add `docs/changelog/2026-07-28.mdx` with the parser-safe MDX SPDX comment and exact `## v0.0.97` heading. - Summarize the 43 merged PRs in the release range, omitting internal-only changes from the public entry and linking each grouped change to its most specific published documentation. - Keep the experimental Okta reference explicitly opt-in and outside normal onboarding, keep the two-Station path Deferred, and state that physical IGX Orin validation remains pending. ### Source summary - [#7440](#7440), [#7443](#7443), and [#7445](#7445) -> `docs/changelog/2026-07-28.mdx`: Document read-only host readiness reports and fail-closed platform qualification. - [#7030](#7030) -> `docs/changelog/2026-07-28.mdx`: Document the Deferred trusted two-Station vLLM evaluation. - [#7265](#7265) -> `docs/changelog/2026-07-28.mdx`: Document the bounded experimental direct-runner Okta runtime-identity reference. - [#7711](#7711) and [#7648](#7648) -> `docs/changelog/2026-07-28.mdx`: Document compatible-endpoint reasoning effort and retired NVIDIA Build model paths. - [#7746](#7746), [#7763](#7763), and [#7681](#7681) -> `docs/changelog/2026-07-28.mdx`: Document safe compatible-provider creation, replacement refusal, and narrow OpenShell bridge URL handling. - [#7641](#7641), [#7690](#7690), [#7631](#7631), and [#7710](#7710) -> `docs/changelog/2026-07-28.mdx`: Document paused-container recovery, recreation journaling, pre-mutation uninstall checks, and source-checkout OpenShell selection. - [#7624](#7624) and [#7762](#7762) -> `docs/changelog/2026-07-28.mdx`: Document Jetson release diagnostics and bounded render-device group propagation. - [#7639](#7639), [#7760](#7760), [#7721](#7721), and [#7761](#7761) -> `docs/changelog/2026-07-28.mdx`: Document Telegram, MCP media-type, Hermes image-mode, and locked-restart fixes. - [#7653](#7653) and [#7680](#7680) -> `docs/changelog/2026-07-28.mdx`: Document Deep Agents policy tasks and the bounded Claude Code OAuth path. - [#7679](#7679) -> `docs/changelog/2026-07-28.mdx`: Document the checksum-bound libssh2 and Python HTMLParser backports. - [#7655](#7655), [#7651](#7651), [#7664](#7664), [#7666](#7666), [#7670](#7670), [#7719](#7719), and [#7741](#7741) -> `docs/changelog/2026-07-28.mdx`: Document exact candidate E2E evidence, Launchable selection, diagnostic consolidation, and trusted WSL validation. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: `test/changelog-docs.test.ts` validates the dated changelog contract, MDX header, heading uniqueness, and release-entry structure. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: The committed `docs/changelog/2026-07-28.mdx` blob exactly matches the reviewed file. Completeness, factual accuracy, link shape, parser-safe MDX header, one-sentence-per-line style, `.docs-skip` compliance, and bounded product claims passed. - Agent: Codex Desktop documentation writer subagent <!-- docs-review-head-sha: da6aa27 --> <!-- docs-review-agents-blob-sha: be20a09 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: Not applicable; this PR changes only the dated changelog. - Station profile/scenario: Not applicable. - Result: Not applicable. - Supporting evidence: Not applicable. ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npx vitest run test/changelog-docs.test.ts` passed 6/6. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — not applicable to this doc-only release entry. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — completed with 0 errors and 2 pre-existing Fern warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) — native changelog entries use the required parser-safe MDX SPDX comment and intentionally have no frontmatter. --- Signed-off-by: Charan Jagwani <cjagwani@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added improved host readiness reporting and Jetson onboarding guidance. * Added controls for reasoning effort with compatible endpoints and enhanced managed MCP discovery. * Improved Deep Agents task publication and preset support. * **Bug Fixes** * Hardened provider switching, sandbox recovery, uninstall behavior, and Telegram connectivity. * Improved container image integrity checks, media-type handling, and checksum validation. * Enhanced vLLM evaluation behavior and release diagnostics. * **Documentation** * Added the NemoClaw v0.0.97 changelog. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
ericksoa
added a commit
that referenced
this pull request
Jul 30, 2026
<!-- markdownlint-disable MD041 --> ## Summary Add Microsoft Entra ID as the second pluggable, data-only runtime identity implementation after the Okta reference from #7265. Entra delegated credentials can now refresh through the trusted Entra issuer and reach only the reviewed Microsoft Graph `/v1.0/me` resource path. ## Related Issue Part of #6871 ## Changes - Add the `entra-runtime-v1` provider profile with app-supplied delegated refresh material, `User.Read`/`offline_access` guidance, and no bootstrap application or OBO flow. - Register Entra through the provider-neutral runtime-identity trust-policy seam. A profile alone is intentionally insufficient to grant credential trust: the reviewed implementation separately constrains the token issuer to `login.microsoftonline.com` and credential delivery to `GET graph.microsoft.com/v1.0/me`. - Add positive and negative unit coverage, including rejection when the Graph resource host is substituted as the OAuth token issuer. - Add TC-INF-13, which uses real OpenShell and a public HTTPS fixture to prove the Entra-shaped refresh request, delegated bearer injection into Graph `/me`, denial of `/users`, token rotation, secret-safe evidence, and ownership-aware rollback. - Document Entra tenant setup, refresh-token handling, the operator acceptance check against a real tenant, and the boundary between deterministic PR E2E evidence and tenant acceptance. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: reviewed the fail-closed issuer/resource trust split, credential scoping, negative host/path cases, secret-safe evidence, and rollback behavior; protected TC-INF-13 remains an exact-head merge gate. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `docs/reference/architecture.mdx`; `nemoclaw-blueprint/provider-profiles/entra-runtime-v1.yaml` - Agent: Codex Desktop documentation writer subagent <!-- docs-review-head-sha: b7bb56e --> <!-- docs-review-agents-blob-sha: c052d60 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npm --prefix nemoclaw test -- src/blueprint/runtime-identity.test.ts src/blueprint/runner-identity.test.ts` (129 passed); `npx vitest run --project integration test/blueprint-runtime-identity-lifecycle.test.ts test/blueprint-runtime-identity-schema.test.ts` (8 passed); CLI typecheck passed; live collection lists TC-INF-12 and TC-INF-13. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — protected exact-head CI and TC-INF-13 pending. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added experimental Microsoft Entra runtime identity support, including OAuth refresh flow and Microsoft Graph access control limited to `GET /v1.0/me`. - Introduced a new Entra runtime identity contract profile (`entra-runtime-v1`) with bearer delivery and refresh configuration. - **Documentation** - Updated runtime identity architecture guidance with clearer Entra/Graph verification rules, deterministic conformance coverage, and maintainer acceptance criteria. - **Tests / Reliability** - Updated reviewed trust policy handling to a refined structure with enforced REST `method`/`path`. - Expanded E2E coverage across multiple runtime identity scenarios (TC-INF-12 and TC-INF-13) and strengthened secret-isolation assertions; improved OAuth test server route configurability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an experimental, provider-neutral runtime identity contract for the direct OpenClaw blueprint runner. The bundled Okta profile is the first data-only reference. Activation remains explicit and opt-in. Because pinned OpenShell
0.0.85verifies the original HTTPS hostname but does not pin NemoClaw’s resolved address, production DNS trust is restricted to repository-reviewed identity-platform-controlled suffixes; the Okta reference allows onlyokta.comand its subdomains.Related Issue
Part of #6871. Microsoft Entra, OAuth bootstrap, on-behalf-of exchange, and a production identity middleware remain out of scope.
Changes
components.identity.oktadiscriminator with a provider-neutralcomponents.identitycontract.TC-INF-12runner scenario covering real OAuth refresh, successful apply and attachment, placeholder resolution, L7 bearer injection, rotation, status, rollback, secret redaction, mutation ordering, and ownership receipts.Type of Change
Quality Gates
7ea7370949d24a34664e1750d5ecfa713a536f9b.Documentation Writer Review
docs-updateddocs/reference/architecture.mdx; both exact-trueproviders_v2_enabledchecks; TC-INF-12 OAuth refresh, rotation, protected-resource, secret-safety, and ownership-aware rollback behavior; final supported sandbox rollback probe; exact head7ea7370949d24a34664e1750d5ecfa713a536f9bVerification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailableTC-INF-12passed all ten phases and proved OAuth refresh-token exchange, bearer v1, credential rotation, a different revision-scoped placeholder, bearer v2, secret-safe status, ownership-aware rollback, and preserved-sandbox reuse.30320741780passed all eight test shards, merged coverage, static/build/plugin/audit/install jobs, and required aggregators; exact-head protected E2E run30321523000passed all eight selected matrix entries.Additional Testing
npm run check:diffnpm --prefix nemoclaw run checknpm run test:coverage:pluginnpm run validate:configsnpm run docs:strictnpm run test:e2e-phases:checkNEMOCLAW_RUN_LIVE_E2E=1 npx vitest run --project e2e-live test/e2e/live/inference-routing.test.ts --testNamePattern "TC-INF-12"TC-INF-12uses the real blueprint runner, real OpenShell gateway and sandbox, a standards-shaped OAuth issuer and protected resource behind public DNS and publicly trusted TLS, and real provider refresh, attach, placeholder resolution, L7 bearer injection, rotation, status, rollback, and secret-redaction boundaries.TC-INF-12proves successful OpenShell0.0.85OAuth refresh-token exchange, rotated refresh-token custody, an opaque initial placeholder and a different revision-scoped placeholder after rotation, token presentation to the protected resource, attachment, and cleanup against a deterministic conformance fixture. It does not contact or certify a real Okta tenant; real-tenant acceptance remains separate from deterministic CI.30321523000passedcloud-inference,cloud-onboard,full-e2e,hermes-e2e, bothsecurity-posturevariants,inference-routing, andnetwork-policy.TC-INF-12artifacts contain exactly two valid OAuth refresh exchanges issuing token versions 1 and 2, exactly two authenticated protected-resource requests carrying access-token versions 1 and 2, authenticated inference after attachment, different opaque placeholders across rotation, successful provider removal with preservation of the reused ready sandbox, successful cleanup, and no fixture secret values.Signed-off-by: Alex Fournier afournier@nvidia.com
Summary by CodeRabbit
New Features
Security
Documentation