test(e2e): keep calibration ancestry durable

[prekshivyas]

Summary

Calibration validation now uses only durable workflow revisions for local Git ancestry. Exact tested revisions remain bound to their run and job receipts, but closing an evidence-source PR no longer breaks unrelated CI when its ref disappears.

Related Issue

Fixes #8022.

Changes

• Preserve exact testedSha, run ID, job ID, and run URL receipt validation and require five distinct tested revisions.
• Keep the restart-safe change ancestor, workflow-head ancestor, unchanged runtime-input boundary, and derived-budget checks.
• Stop resolving PR-only tested commits through the local checkout because GitHub can stop advertising those objects after a PR closes.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This changes only deterministic internal calibration validation and no user-facing command, configuration, workflow, default, or error contract.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Exact-head nine-category security and provenance review passed with no findings: test(e2e): keep calibration ancestry durable #8023 (comment)
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: The changed test comment distinguishes immutable run receipt identity from the durable workflow revision used for local ancestry; no supported product or documentation surface changes.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — fresh worktree reproduced the missing-PR-ref failure before the change; npx vitest run test/onboard-performance-config-schema.test.ts passes 14/14 afterward. Repository, project-membership, source-shape, test-size, Biome, and diff checks pass.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Required PR CI is pending.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Prekshi Vyas prekshiv@nvidia.com

Summary by CodeRabbit

• Tests
  • Expanded startup calibration coverage to verify five distinct tested revisions and their exact run mappings.
  • Improved ancestry validation by checking the workflow’s head revision while preserving verification of the revision actually tested.
  • Added coverage for cases where the tested revision is no longer advertised by the source control provider, improving confidence in calibration results and recorded verification details.

[coderabbitai]

📝 Walkthrough

Walkthrough

The startup calibration schema test now requires five distinct tested SHAs. It validates ancestry through workflowHeadSha while retaining exact testedSha values in run and job receipts.

Changes

Calibration test validation

Layer / File(s)	Summary
Calibration revision and ancestry assertions test/onboard-performance-config-schema.test.ts	The test requires five distinct tested revisions, verifies each run-to-testedSha mapping, and validates ancestry through workflowHeadSha.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested labels: area: e2e

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The test updates address issue #8022 by validating durable ancestry, exact receipt mappings, and distinct tested revisions without local PR-ref reachability.
Out of Scope Changes check	✅ Passed	The changes are limited to calibration schema tests and directly support the linked issue objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: making calibration ancestry validation durable in end-to-end tests.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-calibration-pr-ref-ancestry

---

_{Comment @coderabbitai help to get the list of available commands.}

[prekshivyas]

Exact-head security and provenance review

PASS at a984a48ac1409a7818e17161fac1cace979cf528 against base aa187e19b65acd0f2f7309e65956fd98a2d7d501; no findings.

The change removes only a local ancestry lookup for testedSha values that can be PR-only commits and therefore disappear from advertised Git refs. It retains the restart-safe change-to-workflow-head ancestry check, the workflow-head-to-verified-runtime-input boundary, unchanged runtime-input diff validation, derived-budget arithmetic, exact run/job URLs, distinct run IDs and job IDs, distinct tested revisions, and an explicit immutable run ID-to-tested SHA mapping.

1. Secrets and Credentials — PASS. No credentials, secrets, tokens, or credential handling changed.
2. Input Validation and Data Sanitization — PASS. Exact 40-character SHA validation and exact receipt mappings remain enforced.
3. Authentication and Authorization — PASS. No authentication, authorization, scope, or permission surface changed.
4. Dependencies and Third-Party Libraries — PASS. No dependency or supply-chain input changed.
5. Error Handling and Logging — PASS. A clean checkout no longer crashes on an unadvertised PR object; no internal or sensitive output is added.
6. Cryptography and Data Protection — PASS. No cryptographic or protected-data behavior changed.
7. Configuration and Security Headers — PASS. No runtime, container, endpoint, network, workflow permission, or web-security configuration changed.
8. Security Testing — PASS. A fresh worktree reproduced the missing-ref failure before the change; the calibration suite passes 14/14 afterward. Exact receipt identity is pinned in executable assertions.
9. System Security — PASS. Durable ancestry remains fail-closed, while ephemeral PR revision identity is validated without making repository tests depend on deleted refs or network access. The change does not alter runtime privileges or evidence collection.

File reviewed: test/onboard-performance-config-schema.test.ts.

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Second-opinion E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

1 optional E2E recommendation

• full-e2e

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit a984a48 in the codex/fix-calibratio... branch remains at 96%, unchanged from commit 1e57000 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit a984a48 in the codex/fix-calibratio... branch remains at 81%, unchanged from commit 60b33ab in the main branch.

Show a code coverage summary of the most impacted files.

File	main 60b33ab	codex/fix-calibratio... a984a48	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/actions...ntime-health.ts	91%	85%	-6%
src/lib/state/o...oard-session.ts	91%	91%	0%
src/lib/actions...dbox/connect.ts	77%	77%	0%
src/lib/onboard...ime-boundary.ts	84%	84%	0%
src/lib/actions...ess-recovery.ts	81%	82%	+1%
src/lib/onboard...eway-service.ts	82%	83%	+1%
src/lib/actions...troy-gateway.ts	84%	86%	+2%
src/lib/actions...sor-relaunch.ts	85%	92%	+7%
src/lib/core/ga...eway-address.ts	92%	100%	+8%

---

_{Updated July 31, 2026 18:52 UTC}