test(onboard): preserve runtime fixture isolation by jyaunches · Pull Request #8557 · NVIDIA/NemoClaw

jyaunches · 2026-08-07T12:19:05Z

Summary

cloneSession from #8546 returned the caller-owned session when normalization rejected its serialized copy. This follow-up keeps the serialized copy as the fallback so fixture mutations cannot alter caller-owned top-level or nested state.

Changes

Use the serialized session copy as both the normalization input and fallback.
Add a regression test with an invalid session version. The test proves that normalization rejection still returns independent top-level and nested state.
Record the detection gap: test(onboard): add an in-memory machine runtime fixture #8546 exercised valid sessions only, so normalization always succeeded and did not reach the aliasing fallback.
Close the complete test(onboard): add an in-memory machine runtime fixture #8546 review set. The CodeRabbit isolation finding is fixed. The docstring-coverage warning is advisory because local exports have JSDoc and re-export documentation remains source-owned. The PR Review Advisor reported no findings and failed only because its model request returned HTTP 429.
Inspect the equivalent local clone helpers in test/helpers/onboard-final-flow-phases.ts, src/lib/onboard/resume-machine-repair.test.ts, src/lib/onboard/runtime-boundary-step-result.test.ts, and src/lib/onboard/runtime-boundary.test.ts. Their callers construct valid sessions and do not expose test(onboard): add an in-memory machine runtime fixture #8546's independent-mutation contract, so this PR does not change them.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification:
Docs updated for user-facing behavior changes
Docs not applicable — justification: this changes an internal test fixture and its regression coverage. No CLI, configuration, output, workflow, default, API, policy schema, or supported user behavior changes.
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

Documentation writer subagent reviewed the completed changes
Result: no-docs-needed
Evidence: the completed diff changes only test/helpers/onboard-machine-runtime-fixture.ts and test/helpers/onboard-machine-runtime-fixture.test.ts. The reviewer found no user-visible behavior or documentation impact and approved the test title and existing JSDoc ownership.
Agent: Codex Desktop

DGX Station Hardware Evidence

Tested on DGX Station
Tested commit: Not applicable; scripts/prepare-dgx-station-host.sh does not change.
Station profile/scenario: Not applicable.
Result: Not applicable.
Supporting evidence: Not applicable.

Verification

PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run --project integration test/helpers/onboard-machine-runtime-fixture.test.ts passed 1/1; the eight test(onboard): add an in-memory machine runtime fixture #8546 CLI suites passed 63/63; npm run typecheck:cli passed; npm run test:projects:check reported exact membership for 2,231 candidate files across seven projects.
Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: not applicable. The change updates one fixture fallback and adds one focused test; targeted validation covers every test(onboard): add an in-memory machine runtime fixture #8546 consumer.
Quality Gates section completed with required justifications or waivers
No secrets, API keys, or credentials committed
npm run docs builds without warnings (doc changes only)
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

Bug Fixes
- Improved session cloning so copied sessions remain independent even when normalization fails.
- Prevented changes to a cloned session from affecting the original session.
Tests
- Added regression coverage for cloning invalid-version sessions and nested steps.

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>

coderabbitai · 2026-08-07T12:19:31Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c542674b-8ed9-4e1f-a483-35e7cc2cc2e1

📥 Commits

Reviewing files that changed from the base of the PR and between 0da798a and 64c19cf.

📒 Files selected for processing (2)

test/helpers/onboard-machine-runtime-fixture.test.ts
test/helpers/onboard-machine-runtime-fixture.ts

📝 Walkthrough

Walkthrough

cloneSession now preserves its deep copy when normalization fails. A regression test verifies that mutating the clone does not change the original session or its nested steps.

Changes

Clone session isolation

Layer / File(s)	Summary
Clone fallback and regression coverage `test/helpers/onboard-machine-runtime-fixture.ts`, `test/helpers/onboard-machine-runtime-fixture.test.ts`	`cloneSession` returns the deep-copied session when normalization returns no value. The regression test verifies isolation of the session and nested steps after mutation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

NVIDIA/NemoClaw#8546: Directly modifies and tests the shared cloneSession helper addressed by this change.

Suggested reviewers: aasthajh

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the onboard runtime fixture isolation fix and matches the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/fix-onboard-runtime-clone

_{Comment @coderabbitai help to get the list of available commands.}

github-code-quality · 2026-08-07T12:19:57Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 64c19cf in the codex/fix-onboard-ru... branch remains at 96%, unchanged from commit 0da798a in the main branch.

github-actions · 2026-08-07T12:25:09Z

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Model comparison: normalized findings match; normalized terminology decisions match; normalized E2E selections match; severity counts match.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite against this exact revision.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

## Summary Nine config-generation suites carried a byte-identical BASE_ENV literal, six duplicated the buildTestEnv composition, and four the fake-openclaw stub writer. This is sequential PR 4 of issue #8289: it moves the ordinary valid generation environment, the stub writer, and the environment composition into `test/helpers/openclaw-env-fixture.ts` and migrates the nine suites. Following the isolation follow-up in #8557, the fixture ships with its own regression test proving per-call object independence. ## Related Issue Refs #8289 (sequential PR 4 of 4; PRs 1-3 are #8537, #8546, #8556) ## Changes - Add `test/helpers/openclaw-env-fixture.ts`: `baseOpenClawGenerationEnv()` returning a fresh copy of the ordinary valid environment per call, `ensureFakeOpenClaw(dir)`, and `buildOpenClawTestEnv(dir, baseEnv, overrides)` composing PATH, base entries, overrides, and HOME without mutating its inputs. - Add `test/helpers/openclaw-env-fixture.test.ts`: regression coverage for per-call independence and for composition that leaves base entries and overrides untouched, in the spirit of the #8557 isolation fix. - Migrate the nine suites with the byte-identical environment (`generate-openclaw-config` family, `generate-openclaw-tool-disclosure-config`, `agents-manifest-policy-conformance`, `generate-openclaw-config-plugin-entries`). The four suites whose BASE_ENV carries scenario-specific values (`reasoning-effort`, `security-audit`, `audit-suppressions-real`, `generate-hermes-config`) keep their local variants per the acceptance criteria, and the messaging-plan wrap stays at its call site. - Ratchet the `ci/test-file-size-budget.json` entry for `generate-openclaw-config.test.ts` from 1,941 to its new 1,915-line size, as the size gate requires after shrinking a legacy file. - Scope note: the issue's canonical corporate-CA test asset is deliberately not part of this PR. The inline PEM blocks are per-file scenario material (no two files share one), so canonicalizing them would change tested certificate content; that decision is left to a maintainer and can follow as its own change if wanted. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: test fixtures only; no user-facing surface or documented behavior changes. - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `no-docs-needed` - Evidence: Test-only consolidation of repeated OpenClaw config-generation environments and an exact internal test-size-budget ratchet; no user-facing behavior, CLI, configuration, architecture, or documentation route changes. - Agent: Codex Desktop   ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, and `npm run check:diff` passed after the current-main refresh. - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result: after the current `main` refresh, `npx vitest run --project integration` on the nine migrated suites plus the new fixture test passed (10 files, 178 tests). `npm run typecheck:cli`, `npm run test-size:check`, the normal commit hooks, and pre-push checks passed. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: JulienAu <16043912+JulienAu@users.noreply.github.com>  ## Summary by CodeRabbit * **Tests** * Standardized test environment setup across configuration and policy tests. * Added coverage for isolated fixtures, environment overrides, temporary-directory handling, and executable setup. * Updated the recorded test file size budget to reflect the reduced test footprint.  --------- Signed-off-by: JulienAu <16043912+JulienAu@users.noreply.github.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Co-authored-by: JulienAu <16043912+JulienAu@users.noreply.github.com> Co-authored-by: Apurv Kumaria <akumaria@nvidia.com>

test(onboard): preserve runtime fixture isolation

64c19cf

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>

jyaunches self-assigned this Aug 7, 2026

coderabbitai Bot mentioned this pull request Aug 7, 2026

fix(test): preserve onboarding runtime fixture isolation #8558

Closed

23 tasks

JulienAu mentioned this pull request Aug 7, 2026

test(openclaw): add a config-generation environment fixture #8559

Merged

23 tasks

jyaunches merged commit 61ae0ee into main Aug 7, 2026
64 of 67 checks passed

jyaunches deleted the codex/fix-onboard-runtime-clone branch August 7, 2026 13:46

github-actions Bot added the v0.0.105 label Aug 7, 2026

wscurran added the chore Build, CI, dependency, or tooling maintenance label Aug 25, 2026

Navigation Menu

Uh oh!

test(onboard): preserve runtime fixture isolation - #8557

test(onboard): preserve runtime fixture isolation#8557
jyaunches merged 1 commit into
mainfrom
codex/fix-onboard-runtime-clone

jyaunches commented Aug 7, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 7, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-code-quality Bot commented Aug 7, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

jyaunches commented Aug 7, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Type of Change

Quality Gates

Documentation Writer Review

DGX Station Hardware Evidence

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-code-quality Bot commented Aug 7, 2026

Code Coverage Overview

TypeScript / code-coverage/plugin

Uh oh!

github-actions Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — No blocking findings reported

Model lanes

E2E guidance

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jyaunches commented Aug 7, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 7, 2026 •

edited

Loading

github-actions Bot commented Aug 7, 2026 •

edited

Loading