ci(e2e): let maintainers authorize internal runs

[jyaunches]

Summary

Internal credential-bearing PR E2E no longer waits for a protected environment limited to two reviewers. Any repository maintainer or administrator can authorize the exact pending plan through the existing trusted run-control-plane workflow dispatch, while fork PRs retain protected-environment approval.

Changes

• Make the existing maintain/admin-validated run-control-plane dispatch the only authorization path for internal control-plane PR changes.
• Remove the internal protected-environment mode, workflow branch, and dedicated tests.
• Keep protected-environment approval for credential-bearing fork revisions and make that workflow job fork-specific.
• Document the exact maintainer dispatch command and retained identity checks.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Maintainer-directed authorization simplification. Focused tests preserve the maintain/admin role check, exact PR/head/base binding, pending coordination identity, deterministic plan selection, contributor rejection, revision-drift rejection, and protected fork approval.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: test/e2e/README.md — reviewed against WRITING.md and the workflow/controller implementation; maintainer authorization and fork approval paths are accurate.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project integration test/pr-e2e-gate-command.test.ts test/pr-e2e-gate-fork-approval.test.ts test/pr-e2e-gate-lifecycle.test.ts test/pr-e2e-gate-retry-history.test.ts test/pr-e2e-gate-workflow.test.ts test/pr-e2e-required.test.ts (6 files, 119 tests passed); npm run typecheck:cli; npm run test:projects:check; npm run source-shape:check; npm run test-size:check; npx markdownlint-cli2 test/e2e/README.md.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

• New Features
  • Added a dedicated approval flow for running credentialed E2E tests on forked pull requests.
  • Internal pull requests now use maintainer/admin authorization through the trusted control-plane workflow.
• Documentation
  • Updated E2E authorization guidance, required permissions, environment settings, and validation steps.
• Bug Fixes
  • Improved authorization-state messaging and handling for retries, restored checks, and superseded revisions.
• Tests
  • Updated coverage for the revised approval modes and workflow behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4f05d061-bd0e-48fe-931a-2fbfb2f2f960

📥 Commits

Reviewing files that changed from the base of the PR and between 5aacf53 and 32747a2.

📒 Files selected for processing (10)

• .github/workflows/pr-e2e-gate.yaml
• test/e2e/README.md
• test/pr-e2e-gate-command.test.ts
• test/pr-e2e-gate-fork-approval.test.ts
• test/pr-e2e-gate-internal-approval.test.ts
• test/pr-e2e-gate-lifecycle.test.ts
• test/pr-e2e-gate-retry-history.test.ts
• test/pr-e2e-gate-workflow.test.ts
• test/pr-e2e-required.test.ts
• tools/e2e/pr-e2e-gate.mts

💤 Files with no reviewable changes (1)

• test/pr-e2e-gate-internal-approval.test.ts

---

📝 Walkthrough

Walkthrough

The PR E2E gate removes internal protected-environment control-plane approval, adopts maintainer/admin dispatch authorization, and narrows protected approval to fork E2E runs. Workflow wiring, controller parsing, tests, and documentation are updated accordingly.

Changes

PR E2E authorization

Layer / File(s)	Summary
Controller authorization contracts and flow tools/e2e/pr-e2e-gate.mts, test/pr-e2e-gate-command.test.ts	Removes start-approved-control-plane, its handler, and dispatch branch; restricts approval outputs to fork approval and updates internal authorization messaging to use maintainer/admin control-plane dispatch.
Fork approval workflow wiring .github/workflows/pr-e2e-gate.yaml, test/pr-e2e-gate-workflow.test.ts	Adds the approve-fork-e2e job and starts it with the fixed start-approved-fork mode and fork-specific environment.
Authorization expectations and documentation test/pr-e2e-gate-*.test.ts, test/e2e/README.md	Updates authorization titles, completion assertions, retry behavior, and documentation for maintainer dispatch authorization and fork-only environment approval.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related issues

• ci: split E2E feedback-loop work into focused PRs #7451 — Covers the same internal/fork authorization workflows, protected environments, and run-control-plane documentation.

Possibly related PRs

• NVIDIA/NemoClaw#6826 — Directly overlaps the controller modes and workflow dispatch changes.
• NVIDIA/NemoClaw#7342 — Directly overlaps the removed internal protected-approval path and related workflow wiring.
• NVIDIA/NemoClaw#7505 — Shares the fork E2E start-approved-fork authorization flow.

Suggested labels: area: ci, area: e2e, area: security

Suggested reviewers: cv, ericksoa, aasthajh

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: maintainers can authorize internal E2E runs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/maintainer-e2e-authorization

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 32747a2 in the codex/maintainer-e2e... branch remains at 96%, unchanged from commit 5aacf53 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 32747a2 in the codex/maintainer-e2e... branch remains at 81%, unchanged from commit 5aacf53 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 5aacf53	codex/maintainer-e2e... 32747a2	+/-
src/lib/onboard...ndbox-create.ts	83%	33%	-50%
src/lib/onboard...-create-plan.ts	88%	75%	-13%
src/lib/onboard...ndbox-create.ts	91%	83%	-8%
src/lib/platform.ts	89%	84%	-5%
src/lib/messagi...nnels/policy.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	88%	88%	0%
src/lib/state/config-io.ts	93%	93%	0%
src/lib/domain/.../connect-env.ts	89%	97%	+8%

---

_{Updated July 29, 2026 13:58 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 1 blocker · 1 warning · 1 suggestion
• Model comparison: normalized findings differ; normalized E2E selections match; Nemotron reported 1 more blocker, 1 more warning, 1 more suggestion.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.