test(installer): harden readiness ID output coverage

[jyaunches]

Summary

PR #8634 merged the production readiness-ID sanitization, the required gateway-management fixture, and the current base-image publisher paths. This PR is therefore narrowed to the remaining independent value: package-contract evidence that installer diagnostics reject unstable IDs and deduplicate valid IDs across both output routes.

Changes

• Exercise duplicate valid finding and capability IDs.
• Exercise newline-injected, oversized, and pattern-invalid IDs.
• Assert each valid ID appears once in the admission summary and once in its fallback diagnostic, while every rejected ID remains absent from installer output.

Type of Change

• Code change (test hardening)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Docs not applicable — justification: the final diff changes one package-contract test and does not alter commands, output labels, valid IDs, configuration, defaults, lifecycle behavior, schemas, or support claims.
• Sensitive paths changed (final diff contains no production security, policy, credential, preflight, onboarding, inference, runner, sandbox, or messaging code)
• Sensitive-path review completed — the final test-only diff was reviewed at commit 47df4d057; no production security surface changes, and all nine security categories have no findings. The new negative evidence specifically covers input sanitization, output-injection resistance, deduplication, and fallback-path composition.
• Non-success, skipped, or missing CI check accepted by maintainer

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: the final diff adds regression assertions for the existing stable-ID and bounded-diagnostic contract. No production or documentation file differs from main.
• Agent: Codex Desktop

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• npm exec -- vitest run --project package-contract test/package-contract/installer-host-preflight.test.ts — 3/3 passed, including malformed and duplicate-ID paths.
• npm exec -- vitest run --project e2e-support test/e2e/support/base-image-publication.test.ts — 39/39 passed after merging current main.
• npm exec -- vitest run --project cli src/lib/onboard/setup-nim-ollama.test.ts src/lib/onboard/setup-nim-flow.test.ts — 49/49 passed for the merged base behavior.
• Installer integration evidence — 97/99 passed in the parallel full run; the two unrelated 5-second timing cases then passed 2/2 when rerun alone with one worker.
• npm run validate:pr — passed all pre-commit, commit-message, and pre-push checks for the byte-identical final tree; the latest signed merge also passed commit and pre-push hooks.
• No secrets, API keys, or credentials committed

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The installer host preflight now reuses normalized admission and capability IDs for diagnostics and readiness details. Tests cover ID filtering and update expected base-image workflow paths.

Changes

Installer preflight diagnostics and validation

Layer / File(s)	Summary
Normalized diagnostics and contract validation scripts/install.sh, test/package-contract/installer-host-preflight.test.ts	The preflight normalizes admission and capability IDs once and reuses them for diagnostics and readiness details. The fixture adds a successful loadGatewayManagementDeclaration stub. The diagnostics test covers duplicate, malformed, oversized, and invalid IDs.
Base-image workflow path expectations test/e2e/support/base-image-publication.test.ts	The expected workflow paths include the credentials pattern and remove obsolete managed-image E2E paths.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NVIDIA/NemoClaw#8768: Both changes modify host preflight ID normalization and reporting.
• NVIDIA/NemoClaw#8748: Both changes update installer host-preflight diagnostics and contract tests.
• NVIDIA/NemoClaw#8775: Both changes remove obsolete managed-image workflow path expectations.

Suggested labels: area: onboarding, area: ci, bug-fix

Suggested reviewers: cv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the installer readiness ID hardening and its test coverage, which are central to the pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/installer-readiness-integration-repair

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 47df4d0 in the codex/installer-read... branch remains at 96%, unchanged from commit d357554 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 47df4d0 in the codex/installer-read... branch remains at 82%, unchanged from commit d357554 in the main branch.

Show a code coverage summary of the most impacted files.

File	main d357554	codex/installer-read... 47df4d0	+/-
src/lib/actions...ocker-health.ts	78%	61%	-17%
src/lib/actions...er-lifecycle.ts	94%	85%	-9%
src/lib/actions...ence-gateway.ts	91%	82%	-9%
src/lib/actions...aged-profile.ts	88%	84%	-4%
src/lib/onboard...-transaction.ts	94%	94%	0%
src/lib/adapter...ateway-drift.ts	60%	61%	+1%
src/lib/agent/defs.ts	94%	95%	+1%
src/lib/state/g...way-registry.ts	97%	98%	+1%
src/lib/adapter...shell/client.ts	88%	90%	+2%
src/lib/inferen...ollama/proxy.ts	33%	36%	+3%

---

_{Updated August 11, 2026 06:47 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

1 semantic terminology decision

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• justified — stable at test/package-contract/installer-host-preflight.test.ts:155: Retain “stable” because the test data establishes its contrast with rejected readiness IDs.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

🧹 Nitpick comments (1)

test/package-contract/installer-host-preflight.test.ts (1)

161-188: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Cover duplicate IDs.

This test verifies filtering, but it does not verify deduplication. A regression that removes the Set-based deduplication would still pass because every input ID is unique. Add duplicate valid finding and capability IDs, then assert that each summary and fallback diagnostic appears exactly once.

As per path instructions, test the observable installer output. The PR objective includes ID deduplication.

Suggested coverage

         findingIds: [
           "host.test.unknown",
+          "host.test.unknown",
           "unsafe\ninjected-finding",
@@
         capabilityIds: [
           "host.test.required-capability",
+          "host.test.required-capability",
           "unsafe\ninjected-capability",
@@
-    expect(output).toMatch(/Admission finding IDs: host\.test\.unknown/);
+    expect(output.match(/Admission finding IDs: host\.test\.unknown/g) ?? []).toHaveLength(1);

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/package-contract/installer-host-preflight.test.ts` around lines 161 -
188, Update the preflight test around the existing findingIds and capabilityIds
fixtures to include duplicate valid IDs. Assert the observable installer output
contains each duplicated ID’s admission summary, readiness summary, and fallback
diagnostic exactly once, while preserving the existing filtering assertions for
unsafe, oversized, and invalid IDs.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/package-contract/installer-host-preflight.test.ts`:
- Around line 161-188: Update the preflight test around the existing findingIds
and capabilityIds fixtures to include duplicate valid IDs. Assert the observable
installer output contains each duplicated ID’s admission summary, readiness
summary, and fallback diagnostic exactly once, while preserving the existing
filtering assertions for unsafe, oversized, and invalid IDs.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d823ede6-17ef-441b-bd5f-464f0497cb1c

📥 Commits

Reviewing files that changed from the base of the PR and between 452fb46 and 2eac8fb.

📒 Files selected for processing (1)

• test/package-contract/installer-host-preflight.test.ts

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.