fix(advisor): validate E2E collections by prekshivyas · Pull Request #8020 · NVIDIA/NemoClaw

prekshivyas · 2026-07-31T17:24:56Z

Summary

Harden the PR Review Advisor publisher against malformed E2E collections and selector types outside the canonical inventory.
This is the post-merge follow-up to the final CodeRabbit findings on #8017.

Related Issue

Follow-up to #8017 and #8016.

Changes

Treat coverage and target collections as untrusted input and require arrays before iteration.
Require target selector types to exist in the canonical E2E inventory before tuple validation.
Add focused positive and negative tests for malformed collections and allowed or excluded selector types.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification:
Docs updated for user-facing behavior changes
Docs not applicable — justification: This validation hardening preserves the trusted selector allowlisting contract documented by ci(advisor): preserve E2E lane disagreements #8017 and does not change valid output or UI text.
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

Documentation writer subagent reviewed the completed changes
Result: docs-not-needed
Evidence: Existing tools/pr-review-advisor/README.md documents publisher-side coverage-ID and selector-tuple allowlisting; focused integration tests passed 78/78; CLI type-check, Biome, and git diff --check passed.
Agent: Codex Desktop

DGX Station Hardware Evidence

Tested on DGX Station
Tested commit: Not applicable.
Station profile/scenario: Not applicable.
Result: Not applicable; this change does not modify scripts/prepare-dgx-station-host.sh.
Supporting evidence: Not applicable.

Verification

PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run --project integration test/pr-review-advisor-comment-cli.test.ts test/pr-risk-plan.test.ts passed 78 tests.
Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Not applicable; focused advisor tests cover the validation boundary.
Quality Gates section completed with required justifications or waivers
No secrets, API keys, or credentials committed
npm run docs builds without warnings (doc changes only)
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Prekshi Vyas prekshiv@nvidia.com

Summary by CodeRabbit

Bug Fixes
- Improved handling of malformed coverage data to prevent invalid entries from appearing in review comments.
- Restricted displayed job selectors to trusted, supported values and excluded workflow selectors.
- Added validation for selector types and input collections before processing.

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

coderabbitai · 2026-07-31T17:25:19Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c44f1b1e-3ab6-48ed-b303-b1d356faa040

📥 Commits

Reviewing files that changed from the base of the PR and between 60b33ab and 9a8fd47.

📒 Files selected for processing (2)

test/pr-review-advisor-comment-cli.test.ts
tools/pr-review-advisor/comment.mts

📝 Walkthrough

Walkthrough

The PR hardens E2E coverage and target selector validation. It ignores malformed collections, rejects untrusted selector types, and verifies that only trusted job selectors appear in recommendations.

Changes

Trusted E2E validation

Layer / File(s)	Summary
Selector validation and coverage filtering `tools/pr-review-advisor/comment.mts`, `test/pr-review-advisor-comment-cli.test.ts`	`trustedCoverageIds` now handles unknown and non-array inputs safely. `trustedTargetIds` accepts only entries with allowed string selector types. Tests cover malformed collections, trusted job selectors, and excluded workflow selectors.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

NVIDIA/NemoClaw#8017: Extends the same validation and test paths for malformed and untrusted E2E selector handling.
NVIDIA/NemoClaw#7931: Modifies E2E coverage normalization and trusted selector expectations.
NVIDIA/NemoClaw#6826: Introduces related control-plane E2E job-selector flows.

Suggested labels: area: e2e, bug-fix

Suggested reviewers: cv, ericksoa

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: validating malformed E2E collections and selector types.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/advisor-e2e-input-hardening

_{Comment @coderabbitai help to get the list of available commands.}

github-code-quality · 2026-07-31T17:25:54Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 9a8fd47 in the codex/advisor-e2e-in... branch remains at 96%, unchanged from commit 106b505 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 9a8fd47 in the codex/advisor-e2e-in... branch remains at 81%, unchanged from commit 60b33ab in the main branch.

_{Updated July 31, 2026 17:36 UTC}

github-actions · 2026-07-31T17:30:56Z

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Second-opinion E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

## Summary Adds the canonical dated changelog entry for `v0.0.100` so the maintainer release plan can verify the pre-tag documentation prerequisite. The entry summarizes the user-facing changes merged since `v0.0.99` and links to the relevant guides. ## Changes - Add `docs/changelog/2026-07-31.mdx` with the exact `## v0.0.100` heading. - Cover restored OpenClaw pairing, transactional replacement, Deep Agents Code, onboarding recovery, lifecycle cleanup, Hermes builds, host provenance, documentation, and trusted E2E evidence. - Distinguish active Docker and Kubernetes runtime-bundle enforcement from the still-inactive managed shared-state transaction foundation. ## Source Coverage The release entry maps the doc-impacting merged PRs in the `v0.0.99..main` release range to `docs/changelog/2026-07-31.mdx`: #8021, #8024, #7973, #8028, #7947, #7788, #7884, #8023, #7969, #8020, #7989, #8000, #7907, #7942, #7567, #8013, #7955, #8017, #8014, #8015, #7629, #7644, #7821, #7971, and #7991. PR #7974 was reviewed after the final rebase and excluded because it changes internal maintainer-skill attribution policy and tests only; it does not change a user-facing product or documentation surface. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: the changelog contract test validates the dated entry, version heading, SPDX form, and route constraints. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `docs/changelog/2026-07-31.mdx`; exact-head review passed for `6093f44f`; writing rules and documentation style reviewed; `npx vitest run test/changelog-docs.test.ts` passed 6/6; `npm run docs` passed with zero Fern errors and two generic Fern upgrade notices. - Agent: Codex Desktop   ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: Not applicable; no DGX Station host script changed. - Station profile/scenario: Not applicable. - Result: Not applicable. - Supporting evidence: Not applicable. ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: `npx vitest run test/changelog-docs.test.ts` passed 6/6 at `6093f44f`. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: Not applicable to a dated prose-only release entry. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — validation passed with zero errors; Fern emitted two generic upgrade notices. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) — the changelog entry has the required parser-safe MDX SPDX header; dated changelog entries intentionally do not use page frontmatter. --- Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>  ## Summary by CodeRabbit * **Documentation** * Added release notes for v0.0.100. * Documented improvements to restore pairing, sandbox replacement, onboarding recovery, lifecycle cleanup, runtime handling, build support, host readiness, and end-to-end validation.  Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>

fix(advisor): validate E2E collections

9a8fd47

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

prekshivyas self-assigned this Jul 31, 2026

cv approved these changes Jul 31, 2026

View reviewed changes

cv merged commit aa187e1 into main Jul 31, 2026
91 of 94 checks passed

cv deleted the codex/advisor-e2e-input-hardening branch July 31, 2026 18:18

github-actions Bot added the v0.0.100 label Jul 31, 2026

senthilr-nv mentioned this pull request Aug 1, 2026

docs: add v0.0.100 release entry #8030

Merged

23 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(advisor): validate E2E collections - #8020

fix(advisor): validate E2E collections#8020
cv merged 1 commit into
mainfrom
codex/advisor-e2e-input-hardening

prekshivyas commented Jul 31, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 31, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-code-quality Bot commented Jul 31, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 31, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

prekshivyas commented Jul 31, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Type of Change

Quality Gates

Documentation Writer Review

DGX Station Hardware Evidence

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-code-quality Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

github-actions Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — No blocking findings reported

Model lanes

E2E guidance

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

prekshivyas commented Jul 31, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 31, 2026 •

edited

Loading

github-code-quality Bot commented Jul 31, 2026 •

edited

Loading

github-actions Bot commented Jul 31, 2026 •

edited

Loading