fix(ci): refresh staging QA source for libssh2

[sandl99]

Summary

Refresh the Deep Agents Code staging QA source from af2a73f… to PR #8941's merge commit, ce96811…. The rebuilt staging base now contains the libssh2 nemoclaw2 inventory required by current candidate images, so unrelated PRs such as #8903 no longer inherit this mismatch from main.

Changes

• Pin STAGING_QA_SOURCE_SHA to ce96811ddb418ad01c040521a1fe912b5bcb405e.
• Update the workflow comment and exact integration assertion for the nemoclaw2 contract.
• Root cause: PR fix(security): backport libssh2 public key fixes #8941 advanced the managed-image libssh2 contract, while the staging QA source remained on the earlier nemoclaw1 inventory.
• Detection gap: the source test enforced the recorded SHA but could not establish image compatibility. The staging QA job detected the package mismatch and remains the integration evidence for this repair.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This change only refreshes an internal staging QA source pin and its exact workflow assertion. It changes no CLI, public configuration, API, default, or supported user workflow.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex Desktop reviewed commit 7445324bf across all nine security categories. The full commit SHA remains immutable, checkout credentials remain disabled, permissions remain contents: read, and identity failures still stop the job.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Independent review: PASS — the internal staging comment identifies the exact libssh2 inventory mismatch and the workflow assertion pins the same reviewed source; no supported user-facing behavior changes.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable; scripts/prepare-dgx-station-host.sh is unchanged.
• Result: Not applicable
• Supporting evidence: Not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project integration test/managed-image-publication-workflow.test.ts passed 19 tests.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — not applicable to this focused workflow pin update.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: San Dang sdang@nvidia.com

Summary by CodeRabbit

• Chores

  • Updated the staging quality-assurance workflow to use the latest approved source revision and description.
  • Improved consistency between staging validation settings and the intended candidate configuration.

• Tests

  • Updated workflow validation expectations to reflect the revised staging source revision.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c64ac446-66f2-4d31-8935-0aac254c4edd

📥 Commits

Reviewing files that changed from the base of the PR and between 24eaba1 and 7445324.

📒 Files selected for processing (2)

• .github/workflows/managed-images.yaml
• test/managed-image-publication-workflow.test.ts

---

📝 Walkthrough

Walkthrough

The staging QA workflow now references the libssh2 nemoclaw1 source commit. The managed-image publication test fixture expects the same commit SHA.

Changes

Staging QA source update

Layer / File(s)	Summary
Align staging QA source and test expectation .github/workflows/managed-images.yaml, test/managed-image-publication-workflow.test.ts	The workflow and test fixture now use commit ce96811ddb418ad01c040521a1fe912b5bcb405e.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Mergeability Score: ⚪ Minimal · up to 74453

This localized change refreshes the staging QA source and matching integration assertion without changing public behavior or supported workflows; no actionable merge-blocking risk remains after normal checks.

Suggested labels: v0.0.109

Suggested reviewers: cv, apurvvkumaria

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: refreshing the staging QA source for libssh2 in CI.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/staging-qa-source-libssh2

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 7445324 in the fix/staging-qa-sourc... branch remains at 96%, unchanged from commit 24eaba1 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 7445324 in the fix/staging-qa-sourc... branch remains at 82%, unchanged from commit 24eaba1 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 24eaba1	fix/staging-qa-sourc... 7445324	+/-
src/lib/actions...ocker-health.ts	80%	65%	-15%
src/lib/actions...ence-gateway.ts	91%	82%	-9%
src/lib/onboard...eway-process.ts	90%	90%	0%
src/lib/sandbox...rce-identity.ts	86%	86%	0%
src/lib/sandbox...rsion-scheme.ts	100%	100%	0%
src/lib/adapter...ateway-drift.ts	60%	61%	+1%
src/lib/inferen...ollama/proxy.ts	33%	36%	+3%

---

_{Updated August 13, 2026 07:30 UTC}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / low confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: PR review advisor skipped: OpenShell inference configuration failed or the advisor credential is unavailable

Model lanes

• GPT-5.6 Terra (primary): Skipped
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: None

Manual-only E2E: managed-image-multiarch-startup
The manual PR workflow does not run these selectors for the commit under review. Run them from reviewed code on main.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cv]

The immutable staging source now carries the libssh2 nemoclaw2 inventory, the workflow assertion pins the same reviewed commit, and managed-image staging QA passed on 7445324. The completed advisor reported no findings. No security, correctness, or documentation issue remains.

[prekshivyas]

Approved based on code-diff review. Required GitHub checks must pass before merge.