refactor(onboard): make recovery and sandbox entry strict - #7715
Merged
Conversation
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
Contributor
📝 WalkthroughWalkthroughOnboarding flow slices now use prerequisite repairs with lifecycle events instead of state-result compatibility callbacks. Durable machine states are validated before execution, checkpoint data governs sandbox resume matching, and agent-scoped checkpoint state is cleared consistently. ChangesOnboarding repair flow
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant OnboardRuntime
participant FlowSlice
participant runOnboardPrerequisiteRepair
participant StrictRunner
participant RepairEventRecorder
OnboardRuntime->>FlowSlice: durable machine state and flow options
FlowSlice->>runOnboardPrerequisiteRepair: prerequisite phase
runOnboardPrerequisiteRepair->>RepairEventRecorder: repair lifecycle events
runOnboardPrerequisiteRepair-->>FlowSlice: repaired context and transition results
FlowSlice->>StrictRunner: exact entry state and repaired context
StrictRunner-->>OnboardRuntime: updated onboarding result
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
17 tasks
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 8b16478 in the TypeScript / code-coverage/cliThe overall coverage in commit 8b16478 in the Show a code coverage summary of the most impacted files.
Updated |
Contributor
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate. 3 semantic terminology decisionsTerminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.
E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: 1 optional E2E recommendation
This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
wscurran
added
area: onboarding
cv
marked this pull request as ready for review
July 29, 2026 17:45
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (3)
src/lib/onboard/machine/prerequisite-repair.ts (1)
115-122: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winA throwing failure recorder masks the original repair error.
recordRepairEvent("state.repair.failed", …)is awaited before the rethrow, so if the recorder itself rejects (session write at the runtime boundary), the actionable validation error is replaced by the recorder's error. Suppressing the recorder failure preserves diagnostics.♻️ Preserve the original error
} catch (error) { - await options.recordRepairEvent("state.repair.failed", { - state: phase.state, - error: errorMessage(error), - metadata, - }); + await options + .recordRepairEvent("state.repair.failed", { + state: phase.state, + error: errorMessage(error), + metadata, + }) + .catch(() => undefined); throw error; }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/machine/prerequisite-repair.ts` around lines 115 - 122, Update the catch block in the prerequisite repair flow to preserve the original repair error when recordRepairEvent fails: attempt the failure event recording without allowing its rejection to escape, then rethrow the caught error unchanged. Keep the existing event payload and successful recording behavior intact.src/lib/onboard/machine/initial-flow-phases.test.ts (1)
556-559: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winRepair lifecycle asserted by count only in both parameterized resume tests.
toHaveLength(4)passes for any four events (including failure pairs), so neither test pins which prerequisites were repaired per resumed state; sibling tests in the same files already assert exact ordering.
src/lib/onboard/machine/initial-flow-phases.test.ts#L556-L559: replace the length check with the exactstarted/completedsequence forpreflightthengateway.src/lib/onboard/machine/core-flow-phases.test.ts#L810-L810: replace the length check with the exactstarted/completedsequence forprovider_selectionthensandbox.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/machine/initial-flow-phases.test.ts` around lines 556 - 559, Replace the count-only assertions in the parameterized resume tests with exact ordered repair-event assertions. In src/lib/onboard/machine/initial-flow-phases.test.ts lines 556-559, assert started then completed events for preflight followed by gateway; in src/lib/onboard/machine/core-flow-phases.test.ts line 810, assert started then completed events for provider_selection followed by sandbox. Use the existing repair event structure and ordering conventions from sibling tests.Source: Path instructions
src/lib/onboard/machine/initial-flow-phases.ts (1)
16-16: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueRemove the dead
runLiveOnboardFlowSlicepathlive-flow-slice.tsstill backsUnexpectedLiveOnboardFlowSliceStateError, but the runner/recorder helpers in that module have no production callers outside tests. Delete the unused runtime path and tests, or extract the error type if you want to retire the file later.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/machine/initial-flow-phases.ts` at line 16, Remove the dead runLiveOnboardFlowSlice runtime path and its tests, including unused runner/recorder helpers from live-flow-slice.ts. Preserve UnexpectedLiveOnboardFlowSliceStateError by extracting it if still required, and update imports in src/lib/onboard/machine/initial-flow-phases.ts (line 16) and src/lib/onboard/machine/core-flow-phases.ts (line 26) to reference its new location; both sites require direct import updates.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/onboard/agent-resume-state.test.ts`:
- Around line 11-49: Extend the clearAgentScopedResumeState tests with a legacy
session whose checkpoint is absent, while retaining the persisted sandbox-name
marker. After changing agents, assert through observable resume behavior that
the previous sandbox is not reused. Keep the existing checkpoint-present
assertions and cover both persisted-state variants.
In `@src/lib/onboard/agent-resume-state.ts`:
- Around line 40-50: Update the agent-change resume-state handling so legacy
sandbox identity cannot remain trusted when session.checkpoint is absent: clear
session.sandboxPromptProgress.sandboxName and invalidate or otherwise neutralize
session.sandboxName before checkpointSandboxIdentityMatches can fall back to
those fields. Preserve the existing checkpoint reset behavior, and add a
regression test covering an agent change with no checkpoint to verify legacy
identity is not reused.
In `@src/lib/onboard/checkpoint-replay.test.ts`:
- Around line 38-66: Add positive and negative cases to the
checkpointSandboxIdentityMatches test suite for a selected checkpoint identity:
one where the checkpoint sandbox name matches the requested name and one where
it conflicts. Keep the existing unset-identity and no-checkpoint fallback
coverage, and assert only the returned boolean behavior.
In `@src/lib/onboard/lifecycle-contracts.md`:
- Line 153: Clarify the checkpoint contract to match
checkpointSandboxIdentityMatches: legacy session fields are migration-only for
deriveCheckpointFromSession but also serve as a bounded live fallback when
session.checkpoint is absent. Update the relevant statements around the runtime
decision reads and the later repeated reference without changing the
implementation.
In `@src/lib/onboard/machine/handlers/provider-inference.ts`:
- Around line 520-523: Update the provider-inference handler’s checkpoint
predicate around selectedAgentName, sandboxName, and
checkpointSandboxIdentityMatches so it controls sandbox reuse, not just
deps.log(...). Apply the predicate to the resumeReservationName and
reserveSandboxInferenceRoute decision path later in the handler, ensuring unset
or mismatched checkpoints do not reuse sandboxName, and add a test covering the
negative resume case.
---
Nitpick comments:
In `@src/lib/onboard/machine/initial-flow-phases.test.ts`:
- Around line 556-559: Replace the count-only assertions in the parameterized
resume tests with exact ordered repair-event assertions. In
src/lib/onboard/machine/initial-flow-phases.test.ts lines 556-559, assert
started then completed events for preflight followed by gateway; in
src/lib/onboard/machine/core-flow-phases.test.ts line 810, assert started then
completed events for provider_selection followed by sandbox. Use the existing
repair event structure and ordering conventions from sibling tests.
In `@src/lib/onboard/machine/initial-flow-phases.ts`:
- Line 16: Remove the dead runLiveOnboardFlowSlice runtime path and its tests,
including unused runner/recorder helpers from live-flow-slice.ts. Preserve
UnexpectedLiveOnboardFlowSliceStateError by extracting it if still required, and
update imports in src/lib/onboard/machine/initial-flow-phases.ts (line 16) and
src/lib/onboard/machine/core-flow-phases.ts (line 26) to reference its new
location; both sites require direct import updates.
In `@src/lib/onboard/machine/prerequisite-repair.ts`:
- Around line 115-122: Update the catch block in the prerequisite repair flow to
preserve the original repair error when recordRepairEvent fails: attempt the
failure event recording without allowing its rejection to escape, then rethrow
the caught error unchanged. Keep the existing event payload and successful
recording behavior intact.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 70419e17-507e-49a5-9fb7-4284d89f8950
📒 Files selected for processing (14)
src/lib/onboard.tssrc/lib/onboard/agent-resume-state.test.tssrc/lib/onboard/agent-resume-state.tssrc/lib/onboard/checkpoint-replay.test.tssrc/lib/onboard/checkpoint-replay.tssrc/lib/onboard/lifecycle-contracts.mdsrc/lib/onboard/machine/README.mdsrc/lib/onboard/machine/core-flow-phases.test.tssrc/lib/onboard/machine/core-flow-phases.tssrc/lib/onboard/machine/handlers/provider-inference.tssrc/lib/onboard/machine/initial-flow-phases.test.tssrc/lib/onboard/machine/initial-flow-phases.tssrc/lib/onboard/machine/prerequisite-repair.test.tssrc/lib/onboard/machine/prerequisite-repair.ts
Comment on lines
+11
to
+49
| describe("clearAgentScopedResumeState", () => { | ||
| it("invalidates agent-scoped checkpoint decisions and effect receipts", () => { | ||
| const session = createSession({ | ||
| agent: null, | ||
| sandboxName: "my-sandbox", | ||
| sandboxPromptProgress: { | ||
| sandboxName: true, | ||
| webSearch: true, | ||
| messaging: true, | ||
| resourceProfile: true, | ||
| }, | ||
| }); | ||
| session.checkpoint = { | ||
| ...deriveCheckpointFromSession(session), | ||
| sandboxIdentity: decisionSelected({ name: "my-sandbox", agent: "openclaw" }), | ||
| resourceProfile: decisionSelected({ cpu: "4", memory: "8Gi" }), | ||
| effectGroups: { | ||
| sandbox_create: { completedAt: session.updatedAt, fingerprint: "create" }, | ||
| sandbox_register: { completedAt: session.updatedAt, fingerprint: "register" }, | ||
| }, | ||
| bindings: { | ||
| credentialEnvs: ["SLACK_TOKEN"], | ||
| registeredProviders: [ | ||
| { name: "my-sandbox-slack", type: "generic", credentialEnv: "SLACK_TOKEN" }, | ||
| ], | ||
| }, | ||
| }; | ||
|
|
||
| clearAgentScopedResumeState(session, "hermes"); | ||
|
|
||
| expect(session.checkpoint).toMatchObject({ | ||
| sandboxIdentity: { kind: "unset" }, | ||
| webSearch: { kind: "unset" }, | ||
| messaging: { kind: "unset" }, | ||
| effectGroups: {}, | ||
| bindings: { credentialEnvs: [], registeredProviders: [] }, | ||
| }); | ||
| expect(session.checkpoint?.resourceProfile.kind).not.toBe("unset"); | ||
| }); |
Contributor
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
Cover agent changes for legacy sessions.
This test always creates session.checkpoint, so it cannot catch the no-checkpoint path where the legacy sandbox-name marker may remain trusted. Add a behavior-level case with no checkpoint and assert that the previous sandbox is not reusable after changing agents.
As per path instructions, tests should cover observable resume behavior across persisted-state variants.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/lib/onboard/agent-resume-state.test.ts` around lines 11 - 49, Extend the
clearAgentScopedResumeState tests with a legacy session whose checkpoint is
absent, while retaining the persisted sandbox-name marker. After changing
agents, assert through observable resume behavior that the previous sandbox is
not reused. Keep the existing checkpoint-present assertions and cover both
persisted-state variants.
Source: Path instructions
Comment on lines
+40
to
+50
| if (session.checkpoint) { | ||
| session.checkpoint = { | ||
| ...session.checkpoint, | ||
| sandboxIdentity: decisionUnset(), | ||
| webSearch: decisionUnset(), | ||
| messaging: decisionUnset(), | ||
| effectGroups: {}, | ||
| bindings: { credentialEnvs: [], registeredProviders: [] }, | ||
| updatedAt: new Date().toISOString(), | ||
| }; | ||
| } |
Contributor
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Invalidate the legacy sandbox-name marker on agent changes.
When session.checkpoint is absent, this block does nothing, leaving session.sandboxPromptProgress.sandboxName === true and the old session.sandboxName intact. checkpointSandboxIdentityMatches then falls back to those legacy fields, so the old sandbox can still be treated as the new agent’s identity. Reset the legacy name trust marker (or materialize a checkpoint before fallback) and add a no-checkpoint regression test.
As per path instructions, agent-change resume state must converge across persisted session shapes rather than leave a legacy path authoritative.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/lib/onboard/agent-resume-state.ts` around lines 40 - 50, Update the
agent-change resume-state handling so legacy sandbox identity cannot remain
trusted when session.checkpoint is absent: clear
session.sandboxPromptProgress.sandboxName and invalidate or otherwise neutralize
session.sandboxName before checkpointSandboxIdentityMatches can fall back to
those fields. Preserve the existing checkpoint reset behavior, and add a
regression test covering an agent change with no checkpoint to verify legacy
identity is not reused.
Source: Path instructions
Comment on lines
+38
to
+66
| describe("checkpointSandboxIdentityMatches", () => { | ||
| it("uses the checkpoint identity when legacy name progress disagrees", () => { | ||
| expect( | ||
| checkpointSandboxIdentityMatches( | ||
| { | ||
| checkpoint: checkpoint({ sandboxIdentity: decisionUnset() }), | ||
| machine: { state: "sandbox" }, | ||
| sandboxName: "my-sandbox", | ||
| sandboxPromptProgress: { sandboxName: true }, | ||
| }, | ||
| "my-sandbox", | ||
| ), | ||
| ).toBe(false); | ||
| }); | ||
|
|
||
| it("uses legacy name progress only when no checkpoint exists", () => { | ||
| expect( | ||
| checkpointSandboxIdentityMatches( | ||
| { | ||
| checkpoint: null, | ||
| machine: { state: "sandbox" }, | ||
| sandboxName: "my-sandbox", | ||
| sandboxPromptProgress: { sandboxName: true }, | ||
| }, | ||
| "my-sandbox", | ||
| ), | ||
| ).toBe(true); | ||
| }); | ||
| }); |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Exercise selected checkpoint identities.
The suite covers an unset checkpoint identity and the no-checkpoint fallback, but never verifies a selected checkpoint whose name matches or conflicts with the requested sandbox. Add both positive and negative selected-identity cases; otherwise an implementation that always returns false for selected checkpoints would still pass.
As per path instructions, tests should verify observable behavior across the matching branches without locking onto implementation details.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/lib/onboard/checkpoint-replay.test.ts` around lines 38 - 66, Add positive
and negative cases to the checkpointSandboxIdentityMatches test suite for a
selected checkpoint identity: one where the checkpoint sandbox name matches the
requested name and one where it conflicts. Keep the existing unset-identity and
no-checkpoint fallback coverage, and assert only the returned boolean behavior.
Source: Path instructions
| ## Persisted field ownership | ||
|
|
||
| The schema and sanitation authority is `Session` plus `normalizeSession`/`filterSafeUpdates` in `src/lib/state/onboard-session.ts`. `undefined` in an update means “leave unchanged”; accepted `null` means “clear.” On disk, many nullable fields still collapse never selected, explicitly declined, and explicitly cleared into the same `null` representation. `sandboxPromptProgress` records which of the checkpointed sandbox name, web search, messaging, and resource choices completed. The dedicated versioned `checkpoint` field (`src/lib/state/onboard-checkpoint.ts`) resolves the remaining ambiguity for those choices by modelling each as an explicit `unset`/`declined`/`selected` decision (#6228, #6227/#5783); `deriveCheckpointFromSession` reconstructs the same tri-state from legacy sessions using the completion markers. Live decision reads still consult the legacy fields; migrating every consumer onto the checkpoint decisions is a follow-up. | ||
| The schema and sanitation authority is `Session` plus `normalizeSession`/`filterSafeUpdates` in `src/lib/state/onboard-session.ts`. `undefined` in an update means “leave unchanged”; accepted `null` means “clear.” On disk, many nullable fields still collapse never selected, explicitly declined, and explicitly cleared into the same `null` representation. `sandboxPromptProgress` records which of the checkpointed sandbox name, web search, messaging, and resource choices completed. The dedicated versioned `checkpoint` field (`src/lib/state/onboard-checkpoint.ts`) resolves the remaining ambiguity for those choices by modelling each as an explicit `unset`/`declined`/`selected` decision (#6228, #6227/#5783). Live decision reads use the checkpoint when it exists. `deriveCheckpointFromSession` uses legacy fields only to migrate a session that has no checkpoint. |
Contributor
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Clarify the no-checkpoint runtime fallback.
checkpointSandboxIdentityMatches still reads legacy fields at runtime when session.checkpoint is absent (Lines 28-36 of src/lib/onboard/checkpoint-replay.ts), but these lines describe legacy fields as migration-only. Clarify that they are also a bounded live fallback for sessions without checkpoints, or remove that fallback from the implementation.
Also applies to: 209-209
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/lib/onboard/lifecycle-contracts.md` at line 153, Clarify the checkpoint
contract to match checkpointSandboxIdentityMatches: legacy session fields are
migration-only for deriveCheckpointFromSession but also serve as a bounded live
fallback when session.checkpoint is absent. Update the relevant statements
around the runtime decision reads and the later repeated reference without
changing the implementation.
Comment on lines
+520
to
+523
| if ( | ||
| (!selectedAgentName || selectedAgentName === "openclaw") && | ||
| sandboxName && | ||
| session?.sandboxPromptProgress?.sandboxName === true && | ||
| session.sandboxName === sandboxName | ||
| checkpointSandboxIdentityMatches(session, sandboxName) |
Contributor
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Make the checkpoint predicate affect reuse, not only logging.
This condition only guards deps.log(...). The actual resumeReservationName and reserveSandboxInferenceRoute decisions later in this function still consume sandboxName independently (Lines 780-865), so an unset or mismatched checkpoint changes the message but not whether the sandbox name is reused. Feed this predicate into the reservation gate and add a negative resume test.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/lib/onboard/machine/handlers/provider-inference.ts` around lines 520 -
523, Update the provider-inference handler’s checkpoint predicate around
selectedAgentName, sandboxName, and checkpointSandboxIdentityMatches so it
controls sandbox reuse, not just deps.log(...). Apply the predicate to the
resumeReservationName and reserveSandboxInferenceRoute decision path later in
the handler, ensuring unset or mismatched checkpoints do not reuse sandboxName,
and add a test covering the negative resume case.
Collaborator
|
Babysitting status for exact head 8ec0d88 (plain comment; no Changes Requested review from me): the deterministic gate still sees two unresolved major CodeRabbit findings in agent-resume-state.ts and provider-inference.ts, plus stale-base evidence (bc4a0e1 versus current main da1b103). Maintainer edits are disabled. I will re-gate the next quiet revision after those threads are resolved and the branch is refreshed. |
This was referenced Jul 30, 2026
Collaborator
|
Correction to my prior handoff: conflict-free base refreshes are explicitly waived. Please do not merge main solely for base currency; preserving exact-head evidence is preferred unless GitHub reports a real conflict or reviewed behavior requires a change. The substantive blocker or missing evidence described in the earlier handoff remains, but base age by itself is not a blocker. This is a plain coordination comment, not Changes Requested. |
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
22 tasks
24 tasks
senthilr-nv
added a commit
that referenced
this pull request
Aug 4, 2026
<!-- markdownlint-disable MD041 --> ## Summary Adds the canonical dated `v0.0.101` changelog entry that was missing when the release tag was cut. This post-release recovery records the shipped behavior on current `main` without changing or replacing the existing tag. ## Changes - Add `docs/changelog/2026-08-03.mdx` with the exact `## v0.0.101` heading, release summary, detailed behavior changes, support boundaries, and links to durable documentation. - [#7317](#7317) -> `docs/changelog/2026-08-03.mdx`: Records experimental OpenClaw Google Chat support and its restricted credential and webhook boundary. - [#7715](#7715) -> `docs/changelog/2026-08-03.mdx`: Records strict onboarding recovery state and authoritative resume identity. - [#7749](#7749) -> `docs/changelog/2026-08-03.mdx`: Records the provider-neutral policy seam and unchanged runtime support boundary. - [#7817](#7817) -> `docs/changelog/2026-08-03.mdx`: Records preserved Hermes home-channel assignments across rebuilds. - [#7820](#7820) -> `docs/changelog/2026-08-03.mdx`: Records the SSH-session status field correction. - [#7847](#7847) -> `docs/changelog/2026-08-03.mdx`: Records fail-closed credential filtering for migration and rebuild backups. - [#7870](#7870) -> `docs/changelog/2026-08-03.mdx`: Records sandbox-qualified in-sandbox host command hints. - [#7875](#7875) -> `docs/changelog/2026-08-03.mdx`: Records Microsoft Teams stop and start E2E coverage. - [#7885](#7885) -> `docs/changelog/2026-08-03.mdx`: Records Hermes managed gateway detection in status. - [#7889](#7889) -> `docs/changelog/2026-08-03.mdx`: Records policy-authenticated HTTPS Pin Runtime route revocation. - [#7891](#7891) -> `docs/changelog/2026-08-03.mdx`: Records default fallback for negative timeout and polling overrides. - [#7993](#7993) -> `docs/changelog/2026-08-03.mdx`: Records correct sibling detection during uninstall. - [#7995](#7995) -> `docs/changelog/2026-08-03.mdx`: Records absent configuration-hash handling before shields lock. - [#8001](#8001) -> `docs/changelog/2026-08-03.mdx`: Records the dormant atomic managed workload replacement foundation. - [#8029](#8029) -> `docs/changelog/2026-08-03.mdx`: Records repository terminology review in PR Review Advisor. - [#8031](#8031) -> `docs/changelog/2026-08-03.mdx`: Records provider-neutral managed snapshot authority. - [#8032](#8032) -> `docs/changelog/2026-08-03.mdx`: Records immutable managed clone handoff contracts. - [#8034](#8034) -> `docs/changelog/2026-08-03.mdx`: Records the dormant provider-owned clone transaction surface. - [#8035](#8035) -> `docs/changelog/2026-08-03.mdx`: Records the dormant Hermes managed clone broker boundary. - [#8036](#8036) -> `docs/changelog/2026-08-03.mdx`: Records the dormant transactional managed bootstrap boundary. - [#8037](#8037) -> `docs/changelog/2026-08-03.mdx`: Records dormant Docker bootstrap primitives and the unchanged provider support boundary. - [#8070](#8070) -> `docs/changelog/2026-08-03.mdx`: Records consolidated sandbox resource-limit E2E coverage. - [#8071](#8071) -> `docs/changelog/2026-08-03.mdx`: Records escaped and bounded CLI validation diagnostics. - [#8081](#8081) -> `docs/changelog/2026-08-03.mdx`: Records bounded linear snapshot Base64 validation. - [#8085](#8085) -> `docs/changelog/2026-08-03.mdx`: Records commit-bound workflow approval for eligible same-repository maintainers. - [#8088](#8088) -> `docs/changelog/2026-08-03.mdx`: Records Hermes managed-policy E2E selection. - [#8090](#8090) -> `docs/changelog/2026-08-03.mdx`: Records pinned CI search-tool provisioning. - [#8106](#8106) -> `docs/changelog/2026-08-03.mdx`: Records fallback from failed managed OpenShell gateway startup. - [#8107](#8107) -> `docs/changelog/2026-08-03.mdx`: Records Hermes adapter lifecycle E2E selection. - [#8128](#8128) -> `docs/changelog/2026-08-03.mdx`: Records the dormant transactional Docker bootstrap adapter and rollback authority. - [#8140](#8140) -> `docs/changelog/2026-08-03.mdx`: Records Slack conflict scope across independent OpenShell gateways. - [#8147](#8147) -> `docs/changelog/2026-08-03.mdx`: Records completion of durable v0.0.100 documentation audit follow-ups. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: This documentation-only recovery does not change executable behavior. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: Independently reviewed `docs/changelog/2026-08-03.mdx` at commit `0bebe1f568e3dc85cf410aac1dfb8f8830070b85`. Its blob is `82887920f9720eafd75db6b2271c35f7477edb9b`. The entry follows the writing guide, controlled terminology, changelog structure, MDX SPDX format, literal CLI-name rule, and root-absolute route requirements. It accurately records the `v0.0.100...v0.0.101` release range, Announcement #8162, accepted scope boundaries, and shipped security behavior. There are no code samples. Focused changelog tests and the documentation build pass for this commit. - Agent: Codex Desktop independent documentation writer <!-- docs-review-head-sha: 0bebe1f --> <!-- docs-review-agents-blob-sha: 3dd7c24 --> ## Security Review - Result: `PASS` - Reviewed commit: `0bebe1f568e3dc85cf410aac1dfb8f8830070b85` - Base commit: `643a4ab8b5f583d8555192a37927268b26022c51` - Findings: None. - Secrets and credentials: `PASS`. No credential values or secret files are present. - Input validation and data sanitization: `PASS`. No executable input path changes. - Authentication and authorization: `PASS`. No identity or permission logic changes. - Dependencies and third-party libraries: `PASS`. No dependency changes. - Error handling and logging: `PASS`. No runtime path changes; diagnostic-security claims are precise. - Cryptography and data protection: `PASS`. No implementation changes. - Configuration and security controls: `PASS`. No configuration, container, port, or HTTP changes. - Security testing: `PASS`. No coverage is removed; the entry records shipped test and security behavior. - System security: `PASS`. No runtime control changes; dormant and non-activation boundaries are explicit. - Agent: Codex Desktop independent security reviewer ## Verification - [ ] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub — verification is pending after commit `0bebe1f568e3dc85cf410aac1dfb8f8830070b85` is pushed. - [ ] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable — commit hooks passed; pre-push is pending. - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — tests are not applicable to this documentation-only recovery. - [x] Applicable broad gate passed — not applicable to this documentation-only recovery. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, credentials, or private keys are added by this diff. - [ ] `npm run docs` builds without warnings (doc changes only) — GitHub documentation checks are pending. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) — independent documentation review passed. - [x] New doc pages include SPDX header and frontmatter (new pages only) — the native changelog entry uses the required parser-safe MDX SPDX comment and intentionally has no frontmatter. GitHub CI is authoritative. Focused changelog tests and `npm run docs` passed after the merge refresh. --- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added experimental Google Chat support. * Improved runtime and session status visibility. * Added onboarding recovery and persistence safeguards. * Added snapshot validation and dormant managed-workload support. * **Bug Fixes** * Improved backup sanitization, route handling, and gateway reliability. * **Documentation** * Added the v0.0.101 changelog and related updates. * **Tests** * Expanded end-to-end coverage and strengthened trusted CI validation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Senthil Ravichandran <senthilr@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stack 1 of 5. Make initial and core FSM slices enter only their declared states. When durable state is ahead, earlier work runs as an evented prerequisite repair that cannot change durable state.
Related Issue
Refs #7705
Changes
Type of Change
Quality Gates
PR review advisor (Nemotron 3 Ultra)failed after a partial review with 0 findings; the primary advisor and publisher passed with 0 findings. Pending maintainer acceptance.Documentation Writer Review
docs-updatedsrc/lib/onboard/lifecycle-contracts.mdupdated;docs/reference/commands.mdxanddocs/reference/troubleshooting.mdxalready cover the user-facing behavior, so no Fern source changed.DGX Station Hardware Evidence
scripts/prepare-dgx-station-host.sh.Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run validate:prpassed after refreshingorigin/mainwhen hooks were skipped or unavailablenpm run typecheck:cliand the test-conditional growth scan passed.npm run docsbuilds without warnings (doc changes only) — Not applicable; no Fern source changed.Signed-off-by: Carlos Villela cvillela@nvidia.com
Summary by CodeRabbit
Bug Fixes
Improvements
Documentation