test(rebuild): align stale recovery fixture with OpenShell 0.0.101 by apurvvkumaria · Pull Request #8678 · NVIDIA/NemoClaw

apurvvkumaria · 2026-08-10T04:05:39Z

Summary

Align the stale gateway recovery test fixture with the supported OpenShell 0.0.101 release so the test remains hermetic. The test now fails explicitly if rebuild enters OpenShell upgrade, repair, or installation instead of exercising stale-state recovery.

Related Issue

Fixes #8674

Changes

Use one named OpenShell 0.0.101 fixture constant for the CLI, gateway, and sandbox stubs.
Retain the credential-rewrite and MCP L7 feature signals required by the OpenShell feature gate.
Assert that rebuild does not enter an OpenShell upgrade, repair, or install path before checking the complete [Ubuntu 24.04][Sandbox] stale sandbox recovery removes registry entry before rebuild can recover #4497 stale-recovery contract.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification:
Docs updated for user-facing behavior changes
Docs not applicable — justification: This changes one test fixture and its assertions; production behavior and user-facing output are unchanged, and the existing sandbox recovery guide already documents continuing creation when the recorded gateway reports the source sandbox as absent.
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

Documentation writer subagent reviewed the completed changes
Result: no-docs-needed
Evidence: test/gateway-state-reconcile-2276.test.ts is the only changed path; the change corrects test-fixture identity and adds hermetic-path assertions without changing production behavior. docs/manage-sandboxes/recover-rebuild-sandboxes.mdx already documents the preserved recovery behavior.
Agent: Codex Desktop

DGX Station Hardware Evidence

Tested on DGX Station
Tested commit:
Station profile/scenario:
Result:
Supporting evidence:

Verification

PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project integration test/gateway-state-reconcile-2276.test.ts test/rebuild-stale-recovery.test.ts test/rebuild-credential-preflight.test.ts test/install-openshell-version-check.test.ts test/install-openshell-version-pin.test.ts passed 12/12 assigned integration tests; npx vitest run --project installer-integration test/install-openshell-version-check.test.ts test/install-openshell-version-pin.test.ts passed 44 tests with 1 existing skip; npm run typecheck:cli passed; npx prek run --from-ref main --to-ref HEAD passed.
Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Not applicable; this changes a single self-contained integration fixture, and the targeted integration and installer lanes cover its boundary.
Quality Gates section completed with required justifications or waivers
No secrets, API keys, or credentials committed
npm run docs builds without warnings (doc changes only)
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

Tests
- Updated test fixtures to use OpenShell version 0.0.101.
- Expanded rebuild recovery coverage to verify that rebuilds do not trigger unnecessary upgrades, repairs, or installations.

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

coderabbitai · 2026-08-10T04:06:05Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7eaff4a8-5454-4f88-8cd3-d0475173fe74

📥 Commits

Reviewing files that changed from the base of the PR and between 5003bce and 43e46a9.

📒 Files selected for processing (1)

test/gateway-state-reconcile-2276.test.ts

📝 Walkthrough

Walkthrough

The stale-recovery integration fixture now reports OpenShell 0.0.101 across CLI and component stubs. The rebuild test also asserts that stale-sandbox recovery does not invoke OpenShell upgrade, repair, or installation paths.

Changes

Rebuild recovery fixture

Layer / File(s)	Summary
Fixture version and recovery assertions `test/gateway-state-reconcile-2276.test.ts`	The test uses a shared `0.0.101` OpenShell version for CLI, gateway, and sandbox stubs. Rebuild assertions verify that upgrade, repair, and installation flows are not entered.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

NVIDIA/NemoClaw#8660: Updates rebuild recovery tests to use OpenShell 0.0.101 and assert that upgrade paths are skipped.
NVIDIA/NemoClaw#8675: Overlaps directly on the same fixture and rebuild recovery assertions.
NVIDIA/NemoClaw#8523: Updates the same OpenShell test fixtures from 0.0.99 to 0.0.101.

Suggested labels: area: sandbox, bug-fix

Suggested reviewers: cv, senthilr-nv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the rebuild test and its alignment with the OpenShell 0.0.101 fixture.
Linked Issues check	✅ Passed	The changes satisfy `#8674` by updating the fixture, blocking upgrade paths, and preserving stale-gateway recovery coverage.
Out of Scope Changes check	✅ Passed	The changes are limited to the targeted rebuild recovery test fixture and its assertions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/fix-8674-stale-recovery-fixture-openshell-101

_{Comment @coderabbitai help to get the list of available commands.}

github-code-quality · 2026-08-10T04:06:47Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 43e46a9 in the codex/fix-8674-stale... branch remains at 96%, unchanged from commit 5003bce in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 43e46a9 in the codex/fix-8674-stale... branch remains at 81%, unchanged from commit 1a8e6bd in the main branch.

Show a code coverage summary of the most impacted files.

File	`main` 1a8e6bd	`codex/fix-8674-stale...` 43e46a9	+/-
`src/lib/policy/...ateway-state.ts`	73%	56%	-17%
`src/lib/onboard...ate-mutation.ts`	93%	88%	-5%
`src/lib/inference/vllm.ts`	88%	87%	-1%
`src/lib/policy/index.ts`	62%	63%	+1%
`src/lib/inference/local.ts`	80%	81%	+1%
`src/lib/state/m...-acquisition.ts`	80%	82%	+2%
`src/lib/policy/...ne-exclusion.ts`	92%	96%	+4%
`src/lib/onboard/config-sync.ts`	31%	100%	+69%
`src/lib/onboard...enclaw-setup.ts`	17%	100%	+83%
`src/lib/inferen...ocal-network.ts`	0%	95%	+95%

_{Updated August 10, 2026 04:18 UTC}

github-actions · 2026-08-10T04:10:08Z

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Model comparison: normalized findings match; normalized terminology decisions differ; normalized E2E selections differ; severity counts match.

3 additional E2E selections from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

rebuild-hermes-stale-base: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
rebuild-openclaw: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
state-backup-restore: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

1 semantic terminology decision

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

established — repair path at test/gateway-state-reconcile-2276.test.ts:364: Retain `repair path`; repository lifecycle text uses the same term for remediation behavior.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite against this exact revision.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

## Summary Align the Hermes restart-drift regression test with the explicit restart and health evidence added by #8679. This fixes the exact-result assertion that failed after the production behavior merged. ## Related Issue Follow-up to #8679 and #8671. ## Changes - Expect `restarted: true` after the supervisor returns a valid restart marker. - Expect `healthPassed: true` after the recovered Hermes gateway passes its health check. - Preserve the assertions that no post-refusal mutations run and secret-like output remains redacted. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: This changes only an exact test expectation for behavior already merged in #8679; runtime behavior, CLI output, configuration, and recovery guidance are unchanged. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex security review passed with no findings; the test continues to require restart and health evidence, forbid post-refusal mutations, and verify redaction. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `no-docs-needed` - Evidence: The change is assertion-only and does not alter user-facing behavior or existing recovery guidance. - Agent: Codex Desktop   ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: affected CLI suites passed 33/33 under Python 3.14; the #8678 stale-recovery case passed 1/1 on the updated base; CLI type-check passed. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

test(rebuild): align stale recovery fixture with OpenShell 0.0.101

43e46a9

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

apurvvkumaria self-assigned this Aug 10, 2026

coderabbitai Bot mentioned this pull request Aug 10, 2026

ci: stabilize CLI coverage shards #8675

Merged

23 tasks

senthilr-nv mentioned this pull request Aug 10, 2026

fix(inference): restore qualification loopback publish #8672

Merged

23 tasks

apurvvkumaria requested a review from prekshivyas August 10, 2026 04:46

prekshivyas approved these changes Aug 10, 2026

View reviewed changes

apurvvkumaria merged commit 6812957 into main Aug 10, 2026
70 of 71 checks passed

apurvvkumaria deleted the codex/fix-8674-stale-recovery-fixture-openshell-101 branch August 10, 2026 04:47

github-actions Bot added the v0.0.106 label Aug 10, 2026

apurvvkumaria mentioned this pull request Aug 10, 2026

test(hermes): align restart provenance expectation #8680

Merged

23 tasks

wscurran added chore Build, CI, dependency, or tooling maintenance area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery labels Aug 10, 2026

Navigation Menu

Uh oh!

test(rebuild): align stale recovery fixture with OpenShell 0.0.101 - #8678

test(rebuild): align stale recovery fixture with OpenShell 0.0.101#8678
apurvvkumaria merged 1 commit into
mainfrom
codex/fix-8674-stale-recovery-fixture-openshell-101

apurvvkumaria commented Aug 10, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 10, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-code-quality Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

apurvvkumaria commented Aug 10, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Type of Change

Quality Gates

Documentation Writer Review

DGX Station Hardware Evidence

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-code-quality Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — No blocking findings reported

Model lanes

E2E guidance

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

apurvvkumaria commented Aug 10, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 10, 2026 •

edited

Loading

github-code-quality Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading