feat(runtime): activate qualified native Podman - #9923
Merged
Conversation
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
Contributor
|
Important Review skippedToo many files! This PR contains 477 files, which is 177 over the limit of 300. To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (477)
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall line coverage in commit bf03efe in the TypeScript / code-coverage/cliThe overall line coverage in commit bf03efe in the Show a line coverage summary of the most impacted files.
Updated |
ericksoa
changed the base branch from
feat/b3-e-buildless-onboarding-9140
to
main
August 21, 2026 20:19
ericksoa
changed the base branch from
main
to
feat/b3-e-buildless-onboarding-9140
August 21, 2026 23:25
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-9923.docs.buildwithfern.com/nemoclaw |
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
…140' into feat/b4-h-podman-activation-9145
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
…140' into feat/b4-h-podman-activation-9145 # Conflicts: # src/lib/onboard/managed-bootstrap/docker-runtime.test.ts
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
…140' into feat/b4-h-podman-activation-9145
…140' into feat/b4-h-podman-activation-9145
…vation-9145 # Conflicts: # .github/workflows/e2e-standard-profile.yaml # .github/workflows/e2e.yaml # src/lib/onboard/docker-gpu-patch-clone.ts # src/lib/onboard/managed-workload/onboard-orchestration.ts # src/lib/onboard/sandbox-create/orchestration.ts # src/lib/onboard/sandbox-create/provider-publication.ts # src/lib/onboard/sandbox-gpu-create-flow.ts # test/e2e/fixtures/availability-env.ts # test/e2e/support/workflow-plan.test.ts # tools/e2e/standard-profile-workflow-boundary.mts # tools/e2e/workflow-boundary.mts # tools/e2e/workflow-plan.mts
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
ericksoa
marked this pull request as ready for review
September 2, 2026 07:39
Contributor
|
PR Review Advisor finished for commit |
4 tasks
rsliter
added a commit
that referenced
this pull request
Sep 2, 2026
…eview candidates (#10898) **Summary:** Treat each pushed commit as a stable review candidate, batch automated feedback before repairs, and merge `main` only when the candidate actually requires it. ## Outcome PR follow-up now treats each pushed commit as one candidate. Contributor and maintainer agents wait for required CI and scheduled automated reviews, batch valid repairs, constrain base integrations, and reject feedback-driven scope expansion before publishing another revision. ## Reason ### Main refreshes This is a cross-team throughput problem, not an individual contributor habit. In the latest 150 PRs merged by the core team from August 27 at 05:43 UTC through September 2 at 19:15 UTC, 2026: - 89 PRs, or 59%, contained at least one explicit merge from `main`. - Those PRs contained 514 explicit `main` refreshes. - The average was 3.4 refreshes per PR and the median was 1. | PR author | PRs | PRs refreshed | `main` refreshes | Average per PR | Median per PR | |---|---:|---:|---:|---:|---:| | `rsliter` | 22 | 19 | 144 | 6.5 | 4 | | `ericksoa` | 9 | 5 | 82 | 9.1 | 1 | | `cjagwani` | 3 | 3 | 7 | 2.3 | 1 | | `cv` | 46 | 14 | 45 | 1.0 | 0 | | `prekshivyas` | 30 | 26 | 118 | 3.9 | 3 | | `jyaunches` | 6 | 3 | 3 | 0.5 | 0.5 | | `senthilr-nv` | 26 | 13 | 32 | 1.2 | 0.5 | | `apurvvkumaria` | 8 | 6 | 83 | 10.4 | 9.5 | The largest examples were #9923 with 57 refreshes, #10150 with 26, #10396 with 22, #10692 with 20, and #10515, #10272, #10275, and #10436 with 19 each. The average understates how bursty these refreshes are. Forty-six PRs had at least one run of consecutive `main` refresh commits. Across the sample, 85 such runs contained 223 refresh commits. Eleven PRs had 16 adjacent refresh pairs no more than five minutes apart. Eighteen had 35 pairs no more than ten minutes apart. Examples show both the repeated integrations and the review work they can invalidate: - While this PR was being prepared, its skills-only candidate hit base-owned `fast-uri` advisories in both sandbox-image builds. Prekshi refreshed it at 20:51 UTC, creating a 2,154-line merge commit and restarting Advisor, CI, CodeQL, CodeRabbit, and E2E on a new head. - On Apurv's #10436, two consecutive refresh commits landed 10 seconds apart. Each mapped to a separate PR Advisor run, and the first run was cancelled when the second head arrived. - On #10618, four refresh commits appeared consecutively. The final two were 2 minutes 20 seconds apart and produced separate Advisor runs; the earlier run was cancelled when the later one began. - On Prekshi's #10692, two consecutive refresh commits were 3 minutes 8 seconds apart, and each produced a separate Advisor run. - On Rebecca's #10150, four refresh commits appeared within 13 minutes 15 seconds. Prekshi authored three and the automation bot authored one, showing that churn on an author's PR is not necessarily initiated by that author. - #10308 contained nine consecutive refresh commits. They were spread across several days, but each still replaced the commit under review. The analysis used complete paginated GitHub GraphQL commit histories. A `main` refresh is a commit with multiple parents whose headline names `main`, `origin/main`, or `upstream/main`. This excludes same-branch merges. It also excludes rebase-based base updates, so it measures explicit main merges rather than every possible base update. Commit timestamps identify integrations, not push times. The examples that claim a review restart were separately matched by refresh SHA to PR Advisor workflow runs. ### Batching feedback The current Advisor expands each `synchronize` event into nine independent specialists and publishes their separate reviews. CodeRabbit reviews the incremental commit range. Acting on the first finding can therefore create another commit while the remaining specialists and checks are still in flight, producing overlapping or genuinely new feedback. Complete collection makes it possible to deduplicate findings, group them by root cause, and make one repair instead of serial repair loops. ### Stable review candidates Each pushed refresh replaces the commit under review and can retrigger CI, CodeRabbit, and the PR Advisor. Human review and approval evidence can become stale before that fanout settles. A base integration can also import new contracts, fixtures, and generated identities into the candidate, which gives incremental reviewers genuinely new material. Treating one unchanged commit as the candidate keeps every check and finding attached to the same code until the complete evaluation is ready for one repair decision. ## Changes - Define a stable-candidate protocol in the shared PR follow-up contract. It waits for each scheduled Advisor specialist, CodeRabbit, and required CI on one unchanged latest PR commit, then collects each specialist review from its job summary or artifact. - Deduplicate findings and classify each as candidate-owned or inherited, in-scope or new scope, and blocking or advisory before repairs begin. - Permit candidate integration with the base only for a conflict, a required merged dependency, or the final merge gate after other findings settle. - Keep code-changing PRs draft until automated evaluation settles. Reuse `headRefOid` and non-force pushes as an optimistic publication guard instead of adding new shared state. - Stop implementation repairs that add runtime, lifecycle, security, deployment, or supported-interface scope without a new decision. - Carry the original objective, accepted scope, deferred scope, and complete root-cause group into every routed repair. - Fail closed on a failed Advisor specialist or missing artifact until a NemoClaw maintainer chooses a full-workflow rerun or deferral. - Preserve settled remote review evidence while inspecting local repair and validator-created diffs, with `headRefOid` guarding against competing updates. - Apply the same sequencing rules to maintainer approval and salvage workflows. - Add skill eval cases for refreshes during review, incomplete or failed Advisor evidence, repair scope, local publication guards, and premature ready-for-review requests. ## Verification - `bash test/e2e/e2e-cloud-experimental/features/skill/lib/validate_repo_skills.sh`: passed for all 29 repository skills. - Eval JSON parse for all three changed eval files: passed. - Changed-file prek checks: passed Markdown, JSON, secret scanning, and growth guardrails. - Commit hooks: passed pre-commit and commitlint. - `npm run validate:pr`: passed pre-commit, commitlint, and applicable pre-push checks against canonical `main` at `f427b07d0e01b309983239dd97c989234b18c3c1`. - `node --experimental-strip-types tools/pr-review-advisor/render-specialist-matrix.mts`: confirmed nine current Advisor specialists. - Complete Advisor reports were read for every repair candidate from `4b67754e8` through `ca2f47c5e`; valid findings were batched by root cause before each repair. - The final `ca2f47c5e` set had no valid finding. Eight specialists reported none; the code-reduction suggestion was rejected because `TEST-GAPS.md` can change a PR without entering the merge or salvage procedures that retain the proposed prerequisite. - Diff inspection: no secrets, API keys, or credentials. ## Review notes - `npm run review:local` did not reach the diff. The local Advisor sandbox gateway refused its configuration connection, then cleanup reported `EACCES` on its temporary context. This is environmental unavailable evidence, not a review finding. - The generic `skill-creator` quick validator could not start because the host Python environment lacks PyYAML. The repository's dependency-free validator passed all skills. - On `e18ab4253`, both sandbox-image builds failed on advisories against the base-owned `fast-uri@3.1.5` lock. The refresh to `main` brought the existing `3.1.6` remediation; no candidate source change was required. - On `ca2f47c5e`, `test-e2e-sandbox` failed while planning the base-owned `nim-service.local` endpoint because it is private or reserved. The blueprint, rejection code, and E2E script are unchanged from the PR base, so no candidate repair or rerun applies. --- Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Updated pull request workflows to require complete, settled specialist review evidence before review, repair, approval, integration, or publication. - Clarified collection of individual review results and artifacts, including failed or missing evidence as blocking conditions. - Required preservation of the original objective, accepted and deferred scope, dispositions, and root-cause context throughout repairs. - Added safeguards against scope-expanding repairs across runtime, lifecycle, security, deployment, and supported-interface boundaries. - Strengthened commit verification, single-commit publication, base-branch failure handling, and fresh validation after integration. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com> Co-authored-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com> Co-authored-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Starts B4-H native Podman activation on the buildless onboarding cutover in #9323. This first candidate slice replaces the dormant Podman workload profile with the exact immutable managed-image contract already exercised by trusted native qualification. Production registration remains fail-closed until the complete exact-head 24-case aggregate passes.
Related Issue
Closes #9145.
Stacked on #9323.
Changes
Type of Change
Quality Gates
Verification
Signed-off-by: Aaron Erickson aerickson@nvidia.com