fix(hermes): remove uv build cache metadata

[senthilr-nv]

Summary

Hermes image builds can leave uv's build-only root cache in the published image even when uv runs with --no-cache. This change removes the cache after the final uv command and makes both image gates reject it.

Changes

• Remove /root/.cache/uv after the final build-time uv command.
• Reject the cache path in the Hermes base-image and final-image gates.
• Verify the cache remains absent in the Hermes live E2E runtime image.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This change removes build-only cache metadata and does not change a user-visible surface.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Maintainer security review passed all nine categories with no findings. The change removes a root-owned build cache and adds no input, dependency, credential, or privilege surface.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: The change removes build-only uv cache metadata from Hermes images and extends internal image tests. It does not change a public API, CLI, configuration, UI, workflow, default, error, or supported runtime behavior. The temporary-cache fixture and changed explanatory text follow repository writing rules. The focused integration run passed 2 files and 61 tests; normal pre-commit and commit-msg hooks passed.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npm run test:e2e-phases:check passed for 116 tests across 73 files; npx vitest run --project integration test/node-tar-dockerfile-contract.test.ts passed 13/13; npx vitest run --project integration test/hermes-dashboard-provisioning.test.ts test/sandbox-provisioning.test.ts passed 2 files/61 tests; Hadolint passed for both changed Dockerfiles.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Senthil Ravichandran senthilr@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Prevented build-only uv cache files from being included in published runtime images.
  • Added safeguards to keep runtime images free of unnecessary build artifacts, including symlinked cache paths.

• Tests

  • Extended runtime image checks to detect leaked uv cache artifacts.
  • Updated provisioning checks to verify cache cleanup during image assembly.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c25c21b5-168f-4a65-8e86-d4e6ef7491f0

📥 Commits

Reviewing files that changed from the base of the PR and between ba536b3 and 798f87d.

📒 Files selected for processing (1)

• test/hermes-dashboard-provisioning.test.ts

---

📝 Walkthrough

Walkthrough

Hermes Docker builds now remove /root/.cache/uv, reject it as a leaked build artifact, and verify cleanup through provisioning and runtime image tests.

Changes

Hermes uv cache handling

Layer / File(s)	Summary
Build cache cleanup and image validation agents/hermes/Dockerfile.base, agents/hermes/Dockerfile	The Dockerfiles remove /root/.cache/uv after the final uv command and reject the path during build-only artifact checks.
Dashboard provisioning cache validation test/sandbox-provisioning.test.ts, test/hermes-dashboard-provisioning.test.ts	Dashboard build fixtures map a UV cache directory and verify that image assembly removes it.
Runtime image cache assertion test/e2e/live/hermes-root-entrypoint-smoke.test.ts	The runtime smoke test checks that /root/.cache/uv is absent and not symlinked.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7908: Both PRs modify Hermes Dockerfile.base and related uv cache checks.
• NVIDIA/NemoClaw#7948: Both PRs update Hermes uv cache cleanup and absence checks.

Suggested labels: area: e2e, area: sandbox

Suggested reviewers: apurvvkumaria, cv, prekshivyas

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: removing Hermes uv build cache metadata.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/remove-hermes-uv-cache-metadata

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 798f87d in the codex/remove-hermes-... branch remains at 96%, unchanged from commit 4767f58 in the main branch.

---

_{Updated July 30, 2026 23:41 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, full-e2e, hermes-e2e, security-posture

1 optional E2E recommendation

• rebuild-hermes-stale-base

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.