fix(installer): preserve managed storage remediation

[jyaunches]

Summary

Installer host preflight adopted canonical readiness admission in #8738 but hardcoded storage remediation off. Managed Docker overlayfs/containerd hosts therefore exited before onboarding could build the documented fuse-overlayfs replacement image. This change derives the waiver from canonical gateway lifecycle authority, keeps external, invalid, and non-remediable states blocked, and reports bounded admission IDs when preflight fails.

The first manual PR E2E run then exposed a separate parser mismatch after installer preflight: the generic GPU host reported valid NVIDIA driver 595.84, while the detector required exactly three numeric components. The bounded follow-up accepts two- or three-component NVIDIA versions without changing the minimum, resolver, schema, or supported surface.

Changes

• Allow the installer storage exception only when the canonical gateway-management declaration is valid and absent or explicitly nemoclaw-managed; normal onboarding revalidates that authority before lifecycle effects.
• Print deduplicated finding and capability IDs that satisfy the readiness schema's stable-ID grammar and length limit.
• Cover absent and explicit managed authority, external supervision, invalid authority, non-remediable storage, onboarding continuation, and unsafe diagnostic input in installer integration tests.
• Accept bounded two- or three-component NVIDIA driver versions while retaining numeric comparison, identical multi-GPU inventory, and fail-closed malformed-input behavior.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: this restores the documented managed-only storage remediation path and accepts a valid NVIDIA driver form above the existing documented 580.65.06 minimum. It adds no command, configuration, schema, minimum, or support claim.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: an independent Codex Desktop review of exact head 4d78d7355 on base acda7aa22 passed all nine security categories with no findings. It verified canonical authority parsing and revalidation, managed-only lifecycle effects, fail-closed external/invalid/non-remediable states, sanitized admission IDs, and strict bounded driver parsing.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: docs/get-started/prerequisites.mdx, docs/reference/system-readiness.mdx, and docs/deployment/gateway-lifecycle-authority.mdx already document managed storage remediation and external lifecycle authority. docs/inference/set-up-llama-cpp.mdx already requires NVIDIA driver version 580.65.06 or later; accepting valid two- or three-component versions restores that contract. The generic Linux preset remains explicit-only and experimental.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result:
  • npm exec -- vitest run --project installer-integration test/install-preflight.test.ts --maxWorkers=4 — exact reviewed patch passed 98/99; the unrelated five-second release-tag fixture timed out, then passed alone 1/1. The six changed readiness cases passed, and the byte-identical pre-merge candidate passed 99/99 under the same worker limit.
  • npm exec -- vitest run --project cli src/lib/inference/nim-driver-version.test.ts src/lib/inference/llama-cpp/managed-selection.test.ts src/lib/inference/serving/resolver.test.ts — 49/49 passed.
  • npm exec -- vitest run --project e2e-support test/e2e/support/base-image-publication.test.ts — 39/39 passed after merging upstream repairs fix(ci): complete main-only lifecycle evidence #8771 and test(ci): require lifecycle publisher paths #8772.
  • npm run test:changed — passed; the clean checkout selected no CLI, plugin, or E2E-support source tests and the integrated growth contract passed 4/4.
  • npm run validate:pr — passed all pre-commit, commit-message, and pre-push checks at exact head.
  • The requested npm exec -- vitest run --project integration test/install-preflight.test.ts reports no matching tests because project membership assigns this file to installer-integration; the owning lane is recorded above.
  • Ordinary manual PR E2E run 31444706504 passed six of the seven installer-path jobs at the prior head. llama-cpp-generic-gpu passed installer preflight and exposed the two-component driver parser mismatch fixed here. Exact-head E2E is pending.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: not applicable to these bounded installer-admission and driver-parser changes; targeted installer and CLI suites plus required CI are the applicable evidence.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Installer preflight now limits storage remediation to supported, explicitly managed gateway configurations.
  • Host-admission failures provide validated, deduplicated finding and capability identifiers alongside existing diagnostics.
  • Installer onboarding behavior and failure reporting are now more consistent across gateway lifecycle states.
  • NVIDIA driver detection more reliably handles repeated version output and rejects malformed or contaminated results.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: eae622c0-2c26-4322-bd22-b4818487bee5

📥 Commits

Reviewing files that changed from the base of the PR and between 6a2c2ad and 26d529d.

📒 Files selected for processing (2)

• scripts/install.sh
• src/lib/inference/nim-driver-version.test.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• src/lib/inference/nim-driver-version.test.ts
• scripts/install.sh

---

📝 Walkthrough

Walkthrough

The installer host preflight now gates storage remediation by gateway-management state and sanitizes admission identifiers. Shared test helpers cover these cases. NVIDIA driver-version tests now cover uniform and invalid command output.

Changes

Storage remediation admission

Layer / File(s)	Summary
Installer preflight admission flow scripts/install.sh	The preflight loads gateway-management support, permits storage remediation only for undeclared or NemoClaw-managed gateways, and emits validated, deduplicated finding and capability IDs.
Admission test harness and coverage test/helpers/installer-readiness-stubs.ts, test/install-preflight.test.ts	Shared helpers simulate gateway states, remediation availability, onboarding, and diagnostic sanitization. Tests cover admission outcomes and onboarding behavior.

NVIDIA driver version validation

Layer / File(s)	Summary
Driver inventory validation coverage src/lib/inference/nim-driver-version.test.ts, src/lib/inference/serving/resolver.test.ts	Tests cover duplicate uniform versions, malformed and mixed inventories, ANSI output, command options, and a nonmatching version comparison.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Installer as run_installer_host_preflight
  participant Gateway as gateway-management module
  participant Admission as readiness admission evaluator
  participant Onboarding as onboard session
  Installer->>Gateway: load gateway declaration
  Gateway-->>Installer: return gateway mode
  Installer->>Admission: evaluate storage remediation permission
  Admission-->>Installer: return admission result and IDs
  Installer->>Onboarding: run onboarding when admission passes

Loading

Possibly related PRs

• NVIDIA/NemoClaw#8738: Both changes update installer host-readiness admission in scripts/install.sh.
• NVIDIA/NemoClaw#8748: Both changes modify storage-remediation admission and installer preflight coverage.

Suggested labels: area: install, area: onboarding, bug-fix, platform: container

Suggested reviewers: cv

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main installer change: preserving storage remediation for managed environments.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/installer-managed-storage-remediation

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 4d78d73 in the codex/installer-mana... branch remains at 96%, unchanged from commit acda7aa in the main branch.

---

_{Updated August 11, 2026 02:10 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

3 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• established — gateway lifecycle authority at test/install-preflight.test.ts:1144: Retain gateway lifecycle authority. The controlled word list and existing repository sources use this term consistently.
• justified — admission finding IDs at scripts/install.sh:3104: Retain admission finding IDs. The modifier identifies the bounded readiness-admission output contract.
• justified — NVIDIA driver inventory at src/lib/inference/nim-driver-version.test.ts:12: Retain NVIDIA driver inventory. The modifier identifies the multi-row parser input that the test verifies.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite against this exact revision.

Recommended E2E: cloud-onboard, managed-image-multiarch-startup, inference-routing, network-policy

2 optional E2E recommendations

• llama-cpp-generic-gpu
• vllm-docker-storage

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

🧹 Nitpick comments (1)

src/lib/inference/nim.ts (1)

708-708: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Add a two-component driver-version boundary test.

version-at-least accepts 595.84 and compares missing components as zero. Existing tests do not pass a two-component value through both createHostReadinessReport and resolveManagedInferenceServing; add this public-boundary coverage.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/inference/nim.ts` at line 708, Add public-boundary tests using a
two-component driver version such as 595.84, passing it through both
createHostReadinessReport and resolveManagedInferenceServing. Verify
version-at-least accepts the value and compares its missing component as zero,
while preserving existing behavior for other version formats.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/lib/inference/nim.ts`:
- Line 708: Add public-boundary tests using a two-component driver version such
as 595.84, passing it through both createHostReadinessReport and
resolveManagedInferenceServing. Verify version-at-least accepts the value and
compares its missing component as zero, while preserving existing behavior for
other version formats.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d8bdbe40-ac67-4408-9f2c-f8fe6e55d21f

📥 Commits

Reviewing files that changed from the base of the PR and between e9fa41b and 6a2c2ad.

📒 Files selected for processing (4)

• src/lib/inference/llama-cpp/managed-selection.test.ts
• src/lib/inference/nim-driver-version.test.ts
• src/lib/inference/nim.ts
• src/lib/inference/serving/resolver.test.ts

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.