ci(e2e): parallelize credential generation window

[apurvvkumaria]

Summary

Run the OpenShell credential-generation window on its own fresh runner instead of serializing it behind the DeepAgents MCP shard. The independent job keeps the reviewed provenance, TLS setup, secret scan, artifact upload, cleanup, and terminal reporting contracts while allowing both live boundaries to execute concurrently.

Related Issue

Refs #7916

Performance Follow-Up

This implementation PR does not close #7916.
The issue baseline from five scheduled runs is a 22m59s combined-job median (22.98 runner-minutes), with component medians of about 9.8 minutes and 11.3 minutes.

The trusted main workflow cannot execute this PR’s new job graph before merge.
Keep #7916 open.
After merge, collect the first five successful scheduled runs, record the after median wall time and the sum of per-runner durations, compare both with the baseline above, and update docs/security/openshell-0.0.85-migration-review.md before closing the issue.

Changes

• Add an independent openshell-credential-generation-window E2E job that follows explicit MCP selections and default full-suite dispatches.
• Remove the credential-window invocation from the DeepAgents MCP shard and make terminal reporting wait for both results.
• Extend MCP and artifact boundary validation to protect runner isolation, reviewed inputs, secret scanning, and upload ordering.
• Document the four-runner scheduling shape and isolated artifact contract.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Pending normal review; the PR includes fail-closed workflow, provenance, credential-scan, and artifact-boundary tests.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: test/e2e/README.md; docs/security/openshell-0.0.85-migration-review.md
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — E2E-support workflow boundary tests (71 passed); npx vitest run --project integration test/cloudflared-update-check-workflow.test.ts (5 passed)
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Not applicable; this is a focused E2E workflow-boundary change.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

• New Features
  • Added a dedicated openshell-credential-generation-window E2E workflow job that runs in parallel with the stable MCP agent matrix and participates in workflow reporting/scorecards.
• Bug Fixes
  • Strengthened E2E workflow boundary validation to prevent proof-sharing violations, enforce evidence handling rules, and require correct terminal needs wiring for the new job.
• Documentation
  • Updated E2E runner routing and OpenShell security migration review notes to reflect the new parallel job behavior.
• Tests
  • Expanded workflow-boundary coverage (including new negative cases) and updated cloudflared pin-count assertions to match the new pin set.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The E2E workflow now runs the OpenShell credential-generation-window proof as an independent fresh-runner job in parallel with MCP bridge testing. Boundary validators, artifact upload contracts, terminal dependencies, tests, pin checks, and documentation were updated accordingly.

Changes

Credential-window parallelization

Layer / File(s)	Summary
Independent credential-window workflow job .github/workflows/e2e.yaml	Adds a dedicated job with pinned setup, TLS generation, OpenShell verification, live proof execution, secret scanning, artifact upload, and cleanup; removes the proof invocation from mcp-bridge and updates PR reporting dependencies.
Workflow boundary and artifact validation tools/e2e/mcp-workflow-boundary.mts, tools/e2e/upload-e2e-artifacts-workflow-boundary.mts, tools/e2e/workflow-boundary.mts, scripts/checks/check-cloudflared-update.sh, test/cloudflared-update-check-workflow.test.ts	Validates the independent job’s setup, provenance, proof command, artifact gating, selector handling, cloudflared pins, and terminal-job dependencies.
Boundary tests and execution documentation test/e2e/support/mcp-workflow-boundary.test.ts, docs/security/openshell-0.0.85-migration-review.md, test/e2e/README.md	Adds rejection tests for merged execution, missing proof/reporting, and missing dependencies, and documents parallel fresh-runner execution and routing.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Workflow
  participant OpenShell
  participant ArtifactScan
  participant PRReport
  Workflow->>OpenShell: Install and verify CLI
  Workflow->>OpenShell: Run credential-window live proof
  Workflow->>ArtifactScan: Scan generated artifacts
  ArtifactScan-->>Workflow: Permit artifact upload
  Workflow->>PRReport: Publish job result

Loading

Suggested labels: area: ci, area: e2e, bug-fix, dependencies, security

Suggested reviewers: prekshivyas, cv

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	Most linked requirements are met, but I could not verify the required before/after wall-time and runner-minute impact record.	Add explicit before/after workflow timing and runner-minute impact documentation, or point to the file that records those metrics.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The workflow, validator, tests, and docs all stay focused on the credential-generation-window parallelization and related contract updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: moving the credential generation window to run in parallel in E2E CI.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/7916-parallel-deepagents-credentials

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit e486cf5 in the codex/7916-parallel-... branch remains at 96%, unchanged from commit 1ce71fa in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit e486cf5 in the codex/7916-parallel-... branch remains at 81%, unchanged from commit 1ce71fa in the main branch.

Show a code coverage summary of the most impacted files.

File	main 1ce71fa	codex/7916-parallel-... e486cf5	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/inferen...ompatibility.ts	95%	94%	-1%
src/lib/sandbox...rce-identity.ts	88%	88%	0%
src/lib/tunnel/services.ts	73%	73%	0%

---

_{Updated July 30, 2026 19:50 UTC}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-7932.docs.buildwithfern.com/nemoclaw

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, security-posture

1 optional E2E recommendation

• mcp-bridge

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

tools/e2e/mcp-workflow-boundary.mts (1)

589-635: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Cloudflared/TLS/install assertions are duplicated from validateJobExecution.

Lines 577-627 repeat the pin, immutability, forbidden-repository, TLS, and installer checks from Lines 315-359 verbatim with only the message prefix changed. Extracting a shared validateOpenShellPrerequisiteSteps(errors, jobName, job) would keep the two lanes from drifting when the pinned cloudflared contract changes.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/e2e/mcp-workflow-boundary.mts` around lines 589 - 635, Extract the
duplicated cloudflared, TLS, and OpenShell installer assertions into a shared
validateOpenShellPrerequisiteSteps(errors, jobName, job) helper. Replace the
repeated checks in both validateJobExecution and the credential-window
validation path with calls to this helper, preserving each lane’s job-specific
message prefix and all existing validation behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/security/openshell-0.0.85-migration-review.md`:
- Around line 559-565: Reformat the changed prose so each sentence starts on its
own line and ends with a period. In the paragraph beginning “The workflow first
ran,” split the sentences after “prefix.” and “unit.” while preserving all
wording and meaning.
- Around line 556-558: Update the migration review wording around the
openshell-credential-generation-window live target to state that it runs in
parallel with the entire stable MCP agent matrix, matching the job’s needs:
[generate-matrix] dependency and the wording in test/e2e/README.md. Remove the
narrower reference to only the Deep Agents case while preserving the claim that
the proof runs once on a fourth fresh runner.

---

Nitpick comments:
In `@tools/e2e/mcp-workflow-boundary.mts`:
- Around line 589-635: Extract the duplicated cloudflared, TLS, and OpenShell
installer assertions into a shared validateOpenShellPrerequisiteSteps(errors,
jobName, job) helper. Replace the repeated checks in both validateJobExecution
and the credential-window validation path with calls to this helper, preserving
each lane’s job-specific message prefix and all existing validation behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7ca92fe1-6f1e-4ba6-a7e5-924301b67e58

📥 Commits

Reviewing files that changed from the base of the PR and between 1ce71fa and 15d0661.

📒 Files selected for processing (7)

• .github/workflows/e2e.yaml
• docs/security/openshell-0.0.85-migration-review.md
• test/e2e/README.md
• test/e2e/support/mcp-workflow-boundary.test.ts
• tools/e2e/mcp-workflow-boundary.mts
• tools/e2e/upload-e2e-artifacts-workflow-boundary.mts
• tools/e2e/workflow-boundary.mts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/cloudflared-update-check-workflow.test.ts`:
- Around line 152-156: Synchronize the cloudflared pin-count contract by
updating the enforcement in check-cloudflared-update.sh to require five
CLOUDFLARED_VERSION and CLOUDFLARED_DEB_SHA256 entries, matching the five-entry
expectations in the test. Keep the version and SHA256 counts consistent across
both validation paths.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: de47e1eb-b17a-4844-886a-48f65a24e69d

📥 Commits

Reviewing files that changed from the base of the PR and between 15d0661 and b330ee4.

📒 Files selected for processing (1)

• test/cloudflared-update-check-workflow.test.ts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/checks/check-cloudflared-update.sh`:
- Around line 51-54: Update the remediation text in print_update_instructions()
to instruct users to set all five CLOUDFLARED_VERSION and CLOUDFLARED_DEB_SHA256
pairs, matching the validator’s five-pin contract.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d4c32ae2-7d05-4b88-b09d-211472e81589

📥 Commits

Reviewing files that changed from the base of the PR and between 1543de5 and 47698b1.

📒 Files selected for processing (2)

• scripts/checks/check-cloudflared-update.sh
• test/cloudflared-update-check-workflow.test.ts

[prekshivyas]

Reviewed exact head e486cf5. Required CI and trusted E2E pass. The independent credential-window job preserves fresh-runner isolation, pinned provenance, secret scanning, artifact handling, cleanup, and terminal reporting dependencies. #7916 remains open for the five-run post-merge performance cohort and runner-minute record.