test(e2e): extend legacy gateway network wait

[sandl99]

Summary

The v0.0.36 gateway-upgrade E2E installs its historical stack in parallel with a host firewall probe. The install took 12 minutes 36 seconds in the failing run, but the probe stopped after two minutes, so this change gives both operations the existing 35-minute install budget.

Changes

• Share the gateway-upgrade installer timeout with the parallel Docker network probe.
• Preserve the exact openshell-cluster-nemoclaw network selection for v0.0.36 and the default network selection for newer historical fixtures.
• Extend the workflow-boundary test to cover the network name and wait budget together.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This changes only internal live E2E timing and its support test; no supported user surface changes.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: The change extends only the bounded wait for an exact validated Docker network. Network-name validation, firewall authorization, fail-closed inspection, and cleanup behavior remain unchanged. Existing negative tests still cover unsupported fixtures and firewall setup or cleanup failures.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: The diff changes only live E2E timing and its regression test; it does not change a public command, configuration, output, or supported behavior.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run --project e2e-support test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts passed 10/10; Biome and repository checks passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Not run because the change is confined to one live fixture timing boundary; targeted tests and normal hooks passed.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: San Dang sdang@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Improved gateway upgrade handling for legacy versions by applying the appropriate host firewall configuration and installation wait time.
  • Standardized gateway installation timeout behavior across upgrade scenarios.
  • Added validation for supported and unsupported gateway version references.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 36a950c in the fix/e2e-legacy-netwo... branch remains at 96%, unchanged from commit acf810d in the main branch.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: be9692cb-1168-417c-af6e-515755d516e9

📥 Commits

Reviewing files that changed from the base of the PR and between acf810d and 36a950c.

📒 Files selected for processing (3)

• test/e2e/live/openshell-gateway-upgrade-helpers.ts
• test/e2e/live/openshell-gateway-upgrade.test.ts
• test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts

---

📝 Walkthrough

Walkthrough

The gateway upgrade helpers now provide a shared 35-minute installation timeout and ref-specific host firewall options. Live upgrade execution and workflow-boundary tests use the new helper and validate historical gateway mappings.

Changes

Gateway upgrade firewall handling

Layer / File(s)	Summary
Firewall options contract and fixture validation test/e2e/live/openshell-gateway-upgrade-helpers.ts, test/e2e/support/openshell-gateway-upgrade-workflow-boundary.test.ts	The helper returns the legacy network name and installation wait timeout. Boundary tests verify supported mappings and unsupported references.
Live upgrade integration test/e2e/live/openshell-gateway-upgrade.test.ts	The live test uses the shared installation timeout and passes ref-specific host firewall options instead of legacy Docker network configuration.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NVIDIA/NemoClaw#8523: Updates related gateway upgrade helpers and tests.
• NVIDIA/NemoClaw#8708: Introduces related host-firewall setup and ref-specific options.
• NVIDIA/NemoClaw#8735: Refines the legacy gateway firewall and network helper behavior.

Suggested labels: area: e2e, area: networking

Suggested reviewers: cv, senthilr-nv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the E2E change: extending the legacy gateway network wait.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/e2e-legacy-network-wait

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed after a partial review · low confidence · 0 blockers · 0 warnings · 0 suggestions

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

3 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• established — historical install at test/e2e/live/openshell-gateway-upgrade-helpers.ts:94: Retain historical install for the legacy installation operation.
• justified — install budget at test/e2e/live/openshell-gateway-upgrade-helpers.ts:95: Retain install budget because it names the installer timeout shared with network discovery.
• justified — parallel probe at test/e2e/live/openshell-gateway-upgrade-helpers.ts:95: Retain parallel probe because it distinguishes the concurrent firewall operation from the installer.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite against this exact revision.

Recommended E2E: openshell-gateway-upgrade

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.