feat(onboard): persist managed bootstrap transactions by ericksoa · Pull Request #8041 · NVIDIA/NemoClaw

ericksoa · 2026-08-01T04:29:00Z

Summary

Persist managed-bootstrap mutation authority and image-owned shared-state commit receipts so restart does not erase the facts needed to prove, resume, or clean up one exact attempt. This slice remains inert: it does not advertise or activate buildless support.

Related Issue

Part of #7744.

Changes

Replace process-local Docker transaction and terminal state with private, versioned, atomically written journal records and exact commit/finalization receipts.
Record provider, sandbox, plan, profile, immutable image, original and replacement runtime identities, rollback target, preparation receipt, and completion receipt.
Keep durable journals identity-addressable in this slice; unfinished-record enumeration and production phase reconciliation are introduced together by the following recovery slice.
Atomically convert image-owned shared-state backups into an identity-bound durable commit receipt, reject post-commit rollback, and clear the receipt only after external cleanup is proven.
Preserve legacy null-identity commit and rollback CLI forms while adding explicit identity-bound status, commit, rollback, and receipt-cleanup forms.
Cover OpenClaw, Hermes, and DCode persistence, restart reconstruction, interrupted receipt compaction, exact cleanup, and ownership-reuse defenses.
Cover recreated-adapter rollback after committed terminal finalization and reject same-timestamp phase mutations, closing the two valid Nemotron coverage warnings.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification:
Docs updated for user-facing behavior changes
Docs not applicable — justification:
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Exact-tree reconstruction review verified durable identity authority, image-owned receipt semantics, provider neutrality, production dormancy, and the two advisor-requested regression cases. Exact-head public advisors remain part of the qualification wave.
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: reviewed-npm-audit is being handled on the separate fix(security): close managed runtime audit gaps #8156/ci(security): allow reviewed lock transitions #8157 security stream and is explicitly waived as a blocker for this stack. Its consequential same-repository E2E / PR Gate blockage is waived with it; the manual gate override is fork-only and cannot dispatch for this maintainer branch.

Documentation Writer Review

Documentation writer subagent reviewed the completed changes
Result: docs-updated
Evidence: The final reconstruction preserves the reviewed src/lib/onboard/managed-bootstrap/README.md semantics from prior exact head a3571b2fb794a6bf082f05146fb24096d448548e: provider-neutral/MXC dormancy, pre-/post-cutover distinctions, durable identity-addressed journals, finalization records, the image-owned commit receipt, and the following recovery boundary. The restack changes no documentation behavior.
Agent: Codex Desktop

DGX Station Hardware Evidence

Tested on DGX Station
Tested commit:
Station profile/scenario:
Result:
Supporting evidence:

Verification

Merged parent: feat(onboard): bind managed create to runtime providers #8040 produced main commit 35f59704af0b917e1453ea2ebdc7ce817a36fd1c.
Exact public head: 3aa4ba69335c37ec36721cec48f7b58cea9b8e6d.
Review scope: 11 paths, +1,743/-120.
Stable patch ID: 76f455f1e0d0a6d9977b5fa65dd61357742bff09.
Binary diff SHA-256: 27b3d940a6af0a1b610eb5b676d0decc763f7dc9700c5d32853475c0bd7875a4.
Advisor test anchor: signed+DCO commit 0623bd054e12fa149635c60efa38a3281efc2050, direct child of the prior public head.
Clean reconstruction: signed+DCO commit 79fd30710d194b619fe579d3daa201fec10a38e5, direct child of merged feat(onboard): bind managed create to runtime providers #8040 main with exact tree 7fd1887c4ec0051ae5250a66252ddf17ca7b9e66.
Append-only graft: signed+DCO commit 3aa4ba69335c37ec36721cec48f7b58cea9b8e6d, first parent the preserved public head a3571b2fb794a6bf082f05146fb24096d448548e, second parent the clean reconstruction, and the identical clean tree. No remote history was rewritten.
Durable refs: backup/podman-stack/pr8041-tests-0623bd05, backup/podman-stack/pr8041-clean-79fd3071, backup/podman-stack/pr8041-graft-3aa4ba69, and hold/podman-stack/pr8043-base-3aa4ba693.
Focused validation passed 7 files and 148 tests, including both advisor-requested cases. CLI build, source and CLI typechecks, and Biome passed.
Later main movement d756d15d867cdf91a90cad81971a8a29febe3002 is the separate audit-transition PR ci(security): allow reviewed lock transitions #8157. Its four changed paths do not overlap this 11-path slice, so no restack or retest is warranted solely for that movement.
Every new commit is SSH-signed and carries Aaron's DCO trailer.
Production provider bootstrap remains unsupported; no user-visible buildless or Podman activation is added.

Stack

Base: merged PR3.11 feat(onboard): bind managed create to runtime providers #8040.
This slice: PR3.12A feat(onboard): persist managed bootstrap transactions #8041, branch feat/managed-bootstrap-durable-transactions, exact head 3aa4ba69335c37ec36721cec48f7b58cea9b8e6d.
Next: PR3.12B fix(onboard): reconcile managed bootstrap after restart #8043; its source remains protected and its new base is hold/podman-stack/pr8043-base-3aa4ba693.
Buildless and Podman support remain disabled until the complete all-agent, multiarch, GPU/local-inference, recovery, installer, and protected-E2E activation gates in [Epic] Support native Podman with buildless managed onboarding #7744 pass.

Signed-off-by: Aaron Erickson aerickson@nvidia.com

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Preserve the exact reviewed tree while moving the stacked base to merged PR3.3. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Preserve the exact reviewed tree while moving the stacked base to restacked PR3.4a. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Preserve the exact reviewed tree while moving the stacked base to restacked PR3.4b. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Carry the reviewed PR3.4b slice unchanged onto the CodeRabbit feedback fix for PR3.4a. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Carry the reviewed PR3.5 slice unchanged onto the CodeRabbit feedback restack through PR3.4b. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Carry the reviewed PR3.4b slice unchanged onto the serialized PR3.4a transaction contract. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Carry the reviewed PR3.5 slice unchanged onto the serialized PR3.4a transaction contract. The review patch remains unchanged through PR3.4b. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Restack PR3.4b without changing its review patch. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Restack PR3.5 without changing its review patch. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Preserve the reviewed append-only PR head while making the current main reconstruction and the managed-bootstrap helper environment repair explicit ancestry. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Preserve the reviewed PR source head while making the final transactional-bootstrap handoff and exact clean provider-create reconstruction explicit ancestry. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Preserve the reviewed PR source head. Record the exact post-merge reconstruction as explicit ancestry. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Bind Docker transaction and finalization authority to exact runtime identities. Persist image-owned shared-state commit receipts for later lifecycle reconciliation. Harden durable receipt recovery and order-independent authority comparisons. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Preserve the current public PR source head and record the exact post-#8040 test-contract reconstruction as explicit ancestry. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

ericksoa · 2026-08-03T19:24:28Z

@coderabbitai review

coderabbitai · 2026-08-03T19:24:36Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

## Summary Bind managed sandbox creation to the pluggable runtime-provider bundle without activating buildless support in production. The candidate Docker surface owns create lifecycle and routing, while central onboarding accepts the same contract from an MXC-style provider and keeps every current production bundle bootstrap-unsupported. This slice also makes the existing Docker compatibility path retain rollback authority through readiness, GPU-proof, and applicable local-inference gates. A failed late rollback is propagated and reported instead of being treated as success. ## Related Issue Part of #7744. ## Changes - Add one provider-neutral managed-create contract covering create lifecycle, routing, runtime patches, authority storage, and runtime snapshots. - Add an inert Docker candidate surface that composes the transactional bootstrap adapter; central orchestration does not select Docker, Podman, or MXC by switch. - Carry identity-bound held startup through OpenClaw, Hermes, and DCode launch construction without putting encoded profiles in sandbox argv. - Make GPU creation and host-local inference use the provider transaction, including exact rollback before fallback/failure and commit only after applicable readiness and inference gates. - Preserve the pre-patch container through late qualification, propagate `rolledBack: false`, and emit manual-cleanup guidance only when exact rollback does not complete. - Protect the abstraction with registry, MXC-style provider, all-agent launch, GPU lifecycle, local-inference, rollback-failure, and compatibility-path tests. - Update inference, commands, troubleshooting, and internal architecture documentation to match the exact rollback behavior. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Exact-tree local review covers provider neutrality, immutable rollback authority, all-agent held startup, late rollback outcome propagation, GPU/local-inference commit gates, and production dormancy. Public exact-head advisors and protected E2E remain required before merge. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: Clean candidate `7ed953c7d0934b4c8781b125a4ce57757591781d` and append-only graft `48526666b6b975d6e6173f7f2bc7a76ab0f46361` share exact tree `048dc1f0dd8e0dbbe8de6511bbac75b18828dc61`. Independent exact-diff review covered provider neutrality, the MXC-style path, production dormancy, rollback wording, and the four changed documentation files. Final signed+DCO qualification child `34b43764dd37885b88d1b931861cdf6de92b508b` changes only the stale local-NIM docs contract assertion, so every reviewed documentation blob remains unchanged; the exact assertion now passes 23/23. - Agent: Codex Desktop   ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - Exact base/head: `c63e7eb5ec07448e26a6cd8617a24601216bec35` / `34b43764dd37885b88d1b931861cdf6de92b508b`. - Review budget: 30 paths, `+1,842/-313`. - Stable patch ID: `dad9c0a58cb8b696a0a29c787ff116a0438190b0`. - Binary diff SHA-256: `91d6f4f300ace2ce4f7110e397b09f9f153a936bf1cde28140219f857e2c4f2e`. - Clean exact-base reconstruction: signed+DCO commit `7ed953c7d0934b4c8781b125a4ce57757591781d`, direct child of merged #8128 main `c63e7eb5ec07448e26a6cd8617a24601216bec35`; graft tree equality is exact at `048dc1f0dd8e0dbbe8de6511bbac75b18828dc61`. Final test-only qualification child `34b43764dd37885b88d1b931861cdf6de92b508b` has tree `cc3b68897023975c70225ddde2559a3d44357e5d`. - Append-only ancestry: signed+DCO graft `48526666b6b975d6e6173f7f2bc7a76ab0f46361` has preserved prior live head `c14be060337d19318be9324e883cf4ddf5040d72` as first parent and clean reconstruction `7ed953c7d0934b4c8781b125a4ce57757591781d` as second parent. Signed+DCO child `34b43764dd37885b88d1b931861cdf6de92b508b` is a normal fast-forward. No remote history is rewritten. - Durable refs: `backup/podman-stack/pr8040-live-head-c14be0603`, `backup/podman-stack/pr8040-clean-7ed953c7d`, `backup/podman-stack/pr8040-graft-48526666b`, `backup/podman-stack/pr8040-final-34b43764d`, and `hold/podman-stack/pr8041-base-34b43764d`. - Exact c63-based focused behavior suite passed 164/164: 141 CLI tests and 23 integration tests. The hardened central-source boundary passed 8/8. Final docs contract test passed 23/23 after updating its stale local-NIM wording assertion. - CLI/plugin builds, all three typecheck surfaces, Biome, repository architecture, source-shape, test-size, conditional scan, documentation preparation and route checks, diff checks, gitleaks, markdownlint, and the complete commit-time pre-commit suite passed. - Documentation validation passed across OpenClaw, Hermes, and DCode variants. - Production provider construction still returns unsupported bootstrap/recovery surfaces; no selectable runtime or buildless activation is added. ## Risk Plan - Primary risk: central orchestration acquiring a runtime-specific branch, or committing compatibility-path changes before late readiness/GPU/inference qualification and losing exact rollback authority. - Containment: one injected provider bundle owns managed create; MXC-style tests forbid Docker-specific central routing; commit is deferred through applicable gates; unsuccessful exact rollback is propagated and reported. - Regression risk: the compatibility path changes failure/recovery timing. Focused lifecycle and local-inference tests cover successful commit, pre-commit failure, exact rollback, rollback failure, and manual-cleanup reporting. - Rollback: the managed-create candidate remains unregistered; the compatibility-path change can be reverted independently if qualification exposes a regression. ## Stack - Base: merged PR3.10B2 #8128 at main commit `c63e7eb5ec07448e26a6cd8617a24601216bec35`. - This slice: PR3.11 #8040, branch `feat/managed-bootstrap-provider-create`, exact head `34b43764dd37885b88d1b931861cdf6de92b508b`. - Next: PR3.12A #8041 on protected handoff `hold/podman-stack/pr8041-base-34b43764d`. - Buildless and Podman support remain disabled until the complete all-agent, multiarch, GPU/local-inference, recovery, installer, and protected-E2E activation gates in #7744 pass. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>  ## Summary by CodeRabbit * **New Features** * Added managed startup and provider-driven sandbox creation support. * Added Docker GPU onboarding with native and compatibility routing. * Added durable sandbox identity resolution for OpenShell environments. * **Bug Fixes** * GPU verification now completes before changes are finalized. * Failed readiness, GPU, or inference checks attempt rollback and report recovery issues. * Improved diagnostics and error propagation during sandbox recreation. * **Documentation** * Expanded GPU rollback, diagnostics, cleanup, and local NVIDIA NIM guidance.  --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Preserve the published #8041 ancestry while attaching the exact clean reconstruction to main after #8040 merged. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

## Summary Reconcile every durable managed-bootstrap transaction before a new sandbox create begins, using the provider lifecycle boundary so restart recovery remains driver-neutral and pluggable. This slice remains inert: it does not advertise or activate buildless support. ## Related Issue Part of #7744. ## Changes - Add a driver-neutral recovery receipt contract and lifecycle hook with normalized, frozen, provider-owned results. - Reconstruct Docker recovery authority from versioned journals for OpenClaw, Hermes, and DCode. - Roll back staged, cutover, and rollback-authorized attempts using exact runtime and launch-spec identity. - Resume shared-state-committed attempts through exact backup cleanup, receipt retirement, and terminal finalization. - Persist terminal finalization before active-journal removal and compact retained journals idempotently after interruption. - Enumerate unfinished records only together with the production recovery consumer; ignore journal, decision, and finalized crash temp sidecars while rejecting alien entries fail-closed. - Use the canonical durable-receipt comparator during recovery compaction so reordered receipt fields remain equivalent without masking semantic changes. - Reconcile unfinished work before sandbox create without adding Docker or Podman switches to central orchestration. - Scope canonical schema 1/2 journals to their immutable provider, sandbox, and full runtime IDs without inventing the missing agent or trusting a possibly stale decision phase. - Render exact recovery guidance at the public create boundary, preserve legacy authority, and document the inert pre-activation drain/retirement contract tracked by #7744. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Exact-tree reconstruction review covered owner-retained rollback cleanup, durable finalization ordering, all-agent recovery, crash-sidecar handling, canonical receipt comparison, provider neutrality, and inert activation. Exact-head public advisors remain part of the qualification wave. - [x] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: npm-advisory failures and their consequential same-repository `E2E / PR Gate` blockage are handled on a separate security stream and explicitly waived as blockers for this stack. ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `src/lib/onboard/managed-bootstrap/README.md` preserves the identity-addressed/finality and driver-neutral ownership model, and adds the exact legacy journal drain contract: immutable-ID inspection, no mutable-name deletion, no inferred agent, preserved journal/sidecars, scoped unrelated-sandbox progress, and #7744 retirement gating before activation. - Agent: Codex Desktop   ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - Merged base: #8041 produced main commit `03fbf5ebf1dfc09506c5fefb1debe4b8766fde57`. - Exact public head: `aca6e3d1787b4b9d5952c86e290300fb48fea683`; exact tree: `9b727abe92e634f006e55798f2a3fc78f02f14fa`. - Review scope from the merged base: 16 paths, `+2816/-172`. - Stable patch ID: `49f44db7a412c74cc1e67ab03f41ea1bf28a5c9c`. - Binary diff SHA-256: `0fef658b79f052247f9dbb0d0ec4e9ff31eec8fedbcde1592b6d5659963cb4ba`. - The append-only history preserves the prior public graft `f3d39891bab25bec0092de9a1f001fb62b1cdd6c`, then adds signed+DCO review children `2d1c54276ac5bba78fc950eddb86106edef35d99`, `fd260f2e0fd7da6aa667f149e9c9edfd4d6283a3`, `456fd86e3f45c030651a67ca0afe14be53ee4d7e`, and `aca6e3d1787b4b9d5952c86e290300fb48fea683`; no remote history was rewritten. - Durable refs: `backup/podman-stack/pr8043-feedback-2d1c5427`, `backup/podman-stack/pr8043-feedback-fd260f2e`, `backup/podman-stack/pr8043-feedback-456fd86e`, `backup/podman-stack/pr8043-feedback-aca6e3d1`, and `hold/podman-stack/pr8045-base-aca6e3d1`; all earlier source/reconstruction refs remain intact. - The recovery cleanup passed 184 focused all-agent/provider/recovery tests, CLI build, CLI typecheck, Biome, pre-commit, pre-push, repository/source-shape/test-size checks, and diff checks. The legacy-recovery child passed 105 focused journal/recovery/provider/flow tests, CLI typecheck, Biome, pre-commit and pre-push hooks, repository/source-shape/test-size checks, and diff checks. The final evidence-hardening child passed 43 focused recovery/flow tests, CLI typecheck, Biome, signed commit hooks, and pre-push hooks. - Review feedback now covers legacy-record fail-closed behavior, exact owner-retention authority, terminal ordering/idempotence, per-record bounded failure isolation, shared receipt retirement, canonical agent validation, shared finalization persistence, non-zero Docker removal recovery, exact legacy sandbox scoping, decision-sidecar phase uncertainty, guided public-boundary recovery, zero durable writes during legacy recovery, and secret-redacted provider detail. - Production provider bootstrap remains unsupported; no user-visible buildless or Podman activation is added. ## Stack - Base: merged PR3.12A #8041, main commit `03fbf5ebf1dfc09506c5fefb1debe4b8766fde57`. - This slice: PR3.12B #8043, exact public head `aca6e3d1787b4b9d5952c86e290300fb48fea683`, targeting `main`. - Next: #8045 targets `hold/podman-stack/pr8045-base-aca6e3d1` while its exact patch is recascaded append-only after this merge. - Buildless and Podman support remain disabled until the complete all-agent, multiarch, GPU/local-inference, recovery, installer, and protected-E2E activation gates in #7744 pass. --- Signed-off-by: Aaron Erickson <aerickson@nvidia.com>  ## Summary by CodeRabbit * **New Features** * Added automatic recovery for unfinished managed bootstrap transactions after interruption or restart. * Added durable rollback, cleanup, and reconciliation for partially completed Docker operations. * Added lifecycle recovery checks before creating new sandboxes. * Sandbox creation now stops for relevant recovery failures and warns about unrelated issues. * Added support for recovering legacy state with stronger identity validation and diagnostics. * **Bug Fixes** * Improved recovery ordering, journal cleanup, state reconciliation, and handling of uncertain Docker operation results. * Added clearer, bounded recovery reports and failure guidance.  --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

ericksoa added 30 commits July 30, 2026 14:50

feat(onboard): add managed startup profile schema

38329e8

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

docs(onboard): clarify startup profile transport encoding

7f3859a

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

fix(onboard): harden managed startup profile

32561a9

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): sync PR3.2 with current main

087a9a5

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

fix(onboard): close startup profile contract gaps

e1845dd

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): sync PR3.2 with current main

244e3e6

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): sync PR3.2 with current main

2403316

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): sync PR3.2 with current main

ea5bd8a

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

feat(onboard): construct managed startup profiles

357081a

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

feat(onboard): map and coordinate startup profiles

25d32e0

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

feat(onboard): apply startup profiles in managed images

094d177

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

feat(onboard): add managed shared-state transactions

06f67e5

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): restack PR3.3 on merged PR3.2

2a048ae

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): restack PR3.4a on PR3.3

498e521

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): restack PR3.4b on PR3.4a

3206926

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): restack PR3.5 on PR3.4b

f3081cc

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

test(onboard): keep managed startup tests branchless

6da5eb2

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): carry PR3.4b guardrail fix into PR3.5

51126c4

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): restack PR3.4a after PR3.3 merge

bb7a260

Preserve the exact reviewed tree while moving the stacked base to merged PR3.3. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): restack PR3.4b after PR3.3 merge

fafdbd1

Preserve the exact reviewed tree while moving the stacked base to restacked PR3.4a. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): restack PR3.5 after PR3.3 merge

0edd158

Preserve the exact reviewed tree while moving the stacked base to restacked PR3.4b. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

test(onboard): cover managed startup fixture CLI

b14013f

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

feat(onboard): apply startup profiles in managed images

46fbe19

Carry the reviewed PR3.4b slice unchanged onto the CodeRabbit feedback fix for PR3.4a. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

feat(onboard): add managed shared-state transactions

b2027a9

Carry the reviewed PR3.5 slice unchanged onto the CodeRabbit feedback restack through PR3.4b. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

fix(onboard): serialize managed startup transactions

c95bdf7

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

feat(onboard): apply startup profiles in managed images

3f3bdbb

Carry the reviewed PR3.4b slice unchanged onto the serialized PR3.4a transaction contract. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

feat(onboard): add managed shared-state transactions

8ff8094

Carry the reviewed PR3.5 slice unchanged onto the serialized PR3.4a transaction contract. The review patch remains unchanged through PR3.4b. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

test(onboard): keep transaction races branchless

7d1668b

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): inherit PR3.4a guardrail fix

540494c

Restack PR3.4b without changing its review patch. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): inherit PR3.4b restack

1463687

Restack PR3.5 without changing its review patch. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

ericksoa added 11 commits August 3, 2026 07:38

test(onboard): guard Docker agent argument lookup

633e0dc

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

feat(onboard): add Docker managed bootstrap lifecycle

908c2dc

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

refactor(stack): restack Docker bootstrap on current main

503fdd8

Preserve the reviewed append-only PR head while making the current main reconstruction and the managed-bootstrap helper environment repair explicit ancestry. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

test(onboard): linearize helper environment assertions

2062283

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

feat(onboard): bind managed create to runtime providers

52e7144

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

refactor(stack): restack provider create on corrected bootstrap

c14be06

Preserve the reviewed PR source head while making the final transactional-bootstrap handoff and exact clean provider-create reconstruction explicit ancestry. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

feat(onboard): bind managed create to runtime providers

7ed953c

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

refactor(stack): restack provider create on merged bootstrap

4852666

Preserve the reviewed PR source head. Record the exact post-merge reconstruction as explicit ancestry. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

test(docs): cover local NIM post-ready wording

34b4376

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

merge(stack): restack durable bootstrap finalization

ec88369

Preserve the current public PR source head and record the exact post-#8040 test-contract reconstruction as explicit ancestry. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

ericksoa changed the base branch from hold/podman-stack/pr8041-base-8c120019 to hold/podman-stack/pr8041-base-34b43764d August 3, 2026 18:42

ericksoa added 2 commits August 3, 2026 12:11

refactor(onboard): defer bootstrap recovery enumeration

bab428d

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

docs(onboard): bind recovery enumeration to its consumer

a3571b2

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

ericksoa added 2 commits August 3, 2026 12:48

feat(onboard): persist managed bootstrap finalization

79fd307

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

merge(stack): restack durable bootstrap on merged create

3aa4ba6

Preserve the published #8041 ancestry while attaching the exact clean reconstruction to main after #8040 merged. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

ericksoa changed the base branch from hold/podman-stack/pr8041-base-34b43764d to main August 3, 2026 19:55

ericksoa mentioned this pull request Aug 3, 2026

fix(onboard): reconcile managed bootstrap after restart #8043

Merged

14 tasks

ericksoa merged commit 03fbf5e into main Aug 3, 2026
79 of 107 checks passed

ericksoa deleted the feat/managed-bootstrap-durable-transactions branch August 3, 2026 20:08

coderabbitai Bot mentioned this pull request Aug 3, 2026

feat(onboard): add managed bootstrap image runtime #8045

Merged

23 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(onboard): persist managed bootstrap transactions - #8041

feat(onboard): persist managed bootstrap transactions#8041
ericksoa merged 228 commits into
mainfrom
feat/managed-bootstrap-durable-transactions

ericksoa commented Aug 1, 2026 •

edited

Loading

Uh oh!

ericksoa commented Aug 3, 2026

Uh oh!

coderabbitai Bot commented Aug 3, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

ericksoa commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Type of Change

Quality Gates

Documentation Writer Review

DGX Station Hardware Evidence

Verification

Stack

Uh oh!

ericksoa commented Aug 3, 2026

Uh oh!

coderabbitai Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ericksoa commented Aug 1, 2026 •

edited

Loading

coderabbitai Bot commented Aug 3, 2026 •

edited

Loading