test(security): verify Jaeger header remediation

[apurvvkumaria]

Summary

Adds a real-artifact regression for the reviewed OpenClaw diagnostics remediation, proving malformed Jaeger trace and baggage headers cannot terminate the process. Product-scope verdict: #7337 requires this regression and owns removal after an upstream-safe SDK graph; this PR does not create a supported integration or recipe. GitHub merge status is separate: this task stops after exact-base CI and E2E pass but before human approval, so GitHub can report BLOCKED or REVIEW_REQUIRED without a product-scope rejection.

Related Issue

Related to #7337. This PR delivers the independently reviewable regression portion; it does not close the issue because removing the archive remediation still depends on a reviewed upstream OpenClaw diagnostics release.

Changes

• Add an opt-in child-process probe that materializes the integrity-pinned diagnostics archive, applies the production remediation, installs it with lifecycle scripts disabled, and resolves Jaeger through the SDK Node consumer.
• Cover malformed uber-trace-id and uberctx-* values plus valid trace and baggage controls.
• Run the probe in the trusted main-only real-distribution job and enforce that workflow boundary in the dependency-review contract test.
• Record the regression evidence and mark the diagnostics remediation branch for removal under Replace Jaeger archive patch with upstream OpenTelemetry SDK upgrade #7337 only after a reviewed upstream release is safe.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: No user-visible behavior changes; the internal dependency-review evidence documents the regression contract.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Pending independent human review; no waiver requested.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: not applicable
• Station profile/scenario: not applicable
• Result: not applicable
• Supporting evidence: not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable — the merge commit passed commit-msg and normal pre-push; the canonical upstream/main...HEAD diff passed the equivalent pre-commit and pre-push checks.
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 10/10 dependency-review contract tests passed with the opt-in test skipped by default; NEMOCLAW_REAL_OPENCLAW_JAEGER_HARNESS=1 npx --no-install vitest run --project integration test/openclaw-diagnostics-jaeger-runtime.test.ts --silent=false --reporter=default passed 1/1 against the reviewed registry artifact.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — not applicable because the new opt-in harness has focused real-artifact coverage and the repository diff checks passed.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — passed with 0 errors and 2 existing Fern warnings.
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com
Signed-off-by: Senthil Ravichandran senthilr@nvidia.com

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a conditional Jaeger runtime harness for reviewed OpenClaw diagnostics packages, runs it in the real distribution CI job, validates its workflow and documentation contracts, and records remediation tracking details.

Changes

Jaeger diagnostics verification

Layer / File(s)	Summary
Runtime Jaeger probe test/openclaw-diagnostics-jaeger-runtime.test.ts	Builds and installs a reviewed diagnostics archive, then verifies Jaeger trace and baggage handling through an embedded Node.js probe.
CI and dependency-review contracts .github/workflows/main.yaml, test/openclaw-dependency-review.test.ts	Runs the gated harness in CI and asserts that the workflow and dependency-review note reference the expected test and environment variable.
Review documentation and remediation tracking docs/security/openclaw-2026.7.1-dependency-review.md, scripts/lib/openclaw-npm-remediation.mts	Documents the Jaeger probe assertions and records the Issue 7337 removal condition.Estimated code review effort: 3 (Moderate)

Sequence Diagram(s)

sequenceDiagram
  participant CI
  participant Vitest
  participant ReviewedArchive
  participant NodeProbe
  participant JaegerPropagator
  CI->>Vitest: run gated Jaeger runtime test
  Vitest->>ReviewedArchive: pack, remediate, and install reviewed archive
  Vitest->>NodeProbe: execute embedded ESM probe
  NodeProbe->>JaegerPropagator: process trace and baggage headers
  JaegerPropagator-->>NodeProbe: preserve valid values and ignore malformed values
  NodeProbe-->>Vitest: return JSON assertions

Loading

Possibly related PRs

• NVIDIA/NemoClaw#7280: Both changes modify the OpenClaw remediation map and reviewed-archive remediation flow.

Suggested labels: dependencies, area: docs

Suggested reviewers: jyaunches, cv, prekshivyas

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: adding Jaeger header remediation verification tests.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/7337-jaeger-upstream

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

1 optional E2E recommendation

• diagnostics

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit b18b303 in the codex/7337-jaeger-up... branch remains at 96%, unchanged from commit c6f46d4 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit b18b303 in the codex/7337-jaeger-up... branch remains at 80%, unchanged from commit c6f46d4 in the main branch.

Show a code coverage summary of the most impacted files.

File	main c6f46d4	codex/7337-jaeger-up... b18b303	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/platform.ts	89%	84%	-5%
src/lib/shields/index.ts	72%	71%	-1%
src/lib/actions...all/run-plan.ts	84%	84%	0%
src/lib/messagi...nnels/policy.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	87%	87%	0%
src/lib/onboard...ndbox-create.ts	83%	91%	+8%
src/lib/onboard...-desktop-gpu.ts	77%	89%	+12%
src/lib/onboard...-create-plan.ts	75%	88%	+13%
src/lib/onboard...ndbox-create.ts	33%	83%	+50%

---

_{Updated July 22, 2026 17:23 UTC}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-7339.docs.buildwithfern.com/nemoclaw