fix(onboard): reuse DNS-pinned endpoint validation

[senthilr-nv]

Summary

Compatible-endpoint onboarding now reuses the successful public DNS-pinned Chat Completions validation result instead of sending the immediate duplicate validation request. The one-shot receipt remains bound to the exact endpoint, model, authentication mode, request requirements, and approved IP address set; operator-trusted private endpoints remain non-cacheable.

Changes

• Carry the existing onboarding capability cache through custom OpenAI-compatible endpoint selection.
• Bind public DNS-pinned validation receipts to a normalized exact IP address set, and reject malformed pins or operator-trusted private capabilities.
• Keep the initial DNS-backed SSRF preflight and pinned validation request unchanged; only the immediate duplicate request is removed.
• Correct the streaming-probe comment to identify the 8-second provider-selection phase contract. The 5-second streaming deadline and all E2E phase budgets remain unchanged.
• Add focused source and integration regression coverage for exact-pin reuse, pin mismatch, invalid pins, private-endpoint refusal, cache propagation, and absence of the duplicate curl request.
• Update the v0.0.100 release entry with the user-visible validation behavior.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex Desktop completed the nine-category security review. No findings; the initial SSRF preflight remains required, the receipt binds the exact approved IP address set, and operator-trusted private capabilities remain non-cacheable.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: docs/changelog/2026-07-31.mdx; terminology, release meaning, source comments, and test titles reviewed; changelog tests and docs build passed.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: 40 CLI tests and 5 integration tests passed; npm run typecheck:cli and scoped Biome checks passed; 6 changelog tests and npm run docs passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Senthil Ravichandran senthilr@nvidia.com

Summary by CodeRabbit

• New Features
  • Faster compatible-endpoint onboarding by reusing successful validation results when endpoint, model, and validated IP addresses match.
  • DNS-pinned endpoints now support safe validation reuse, including equivalent address sets regardless of order or duplicates.
• Bug Fixes
  • Prevented cached validation from being reused when headers, IP addresses, or endpoint trust settings differ.
  • DNS changes now trigger fresh validation, improving endpoint security and reliability.
  • Responses API probing is capped at five seconds during onboarding.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2db26bcb-7ea7-46bd-bc49-3d608bac2abe

📥 Commits

Reviewing files that changed from the base of the PR and between a77b44e and 7ce0379.

📒 Files selected for processing (10)

• docs/changelog/2026-07-31.mdx
• src/lib/inference/probe-http-helpers.ts
• src/lib/onboard/inference-capability-cache.test.ts
• src/lib/onboard/inference-capability-cache.ts
• src/lib/onboard/inference-selection-validation.test.ts
• src/lib/onboard/inference-selection-validation.ts
• src/lib/onboard/setup-nim-selection.test.ts
• src/lib/onboard/setup-nim-selection.ts
• test/helpers/onboard-smoke-verifier-harness.ts
• test/onboard-smoke-verifier.test.ts

---

📝 Walkthrough

Walkthrough

Changes

The onboarding capability cache now normalizes valid pinned IP addresses and includes them in cache keys. Custom endpoint validation records successful public capabilities, while trusted-private endpoints remain separately validated. Selection wiring and smoke verification reuse matching cached capabilities.

Onboarding capability cache

Layer / File(s)	Summary
Normalize pinned capability keys src/lib/onboard/inference-capability-cache.ts, src/lib/onboard/inference-capability-cache.test.ts	Valid pinned addresses are deduplicated, sorted, validated, and included in cache keys. Tests cover equivalent, different, invalid, and header-bearing requests.
Record validated custom endpoints src/lib/onboard/inference-selection-validation.ts, src/lib/onboard/inference-selection-validation.test.ts, src/lib/onboard/setup-nim-selection.ts, src/lib/onboard/setup-nim-selection.test.ts	Custom endpoint validation accepts and forwards the capability cache. Successful public probes record reusable capabilities with endpoint and pinned-address data. Trusted-private capabilities remain separate.
Reuse capabilities during smoke verification test/helpers/onboard-smoke-verifier-harness.ts, test/onboard-smoke-verifier.test.ts, docs/changelog/2026-07-31.mdx, src/lib/inference/probe-http-helpers.ts	Smoke verification forwards pinned addresses and reuses matching cached validation without another request. Changelog and probe comments describe the updated behavior and timing.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Selection
  participant CustomValidator
  participant CapabilityCache
  participant SmokeVerifier
  Selection->>CustomValidator: validate custom endpoint with cache
  CustomValidator->>CapabilityCache: record successful public capability
  SmokeVerifier->>CapabilityCache: request matching endpoint and IP set
  CapabilityCache-->>SmokeVerifier: return cached Chat Completions capability
  SmokeVerifier-->>SmokeVerifier: skip another probe

Loading

Suggested labels: area: inference, area: onboarding, bug-fix, v0.0.100

Suggested reviewers: cv, apurvvkumaria, ericksoa

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: reusing validation for DNS-pinned onboarding endpoints.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/reuse-pinned-chat-capability

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 7ce0379 in the codex/reuse-pinned-c... branch remains at 96%, unchanged from commit 47df762 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 7ce0379 in the codex/reuse-pinned-c... branch remains at 81%, unchanged from commit 9bc461f in the main branch.

Show a code coverage summary of the most impacted files.

File	main 9bc461f	codex/reuse-pinned-c... 7ce0379	+/-
src/lib/messagi...flict-status.ts	100%	84%	-16%
src/lib/onboard...age/contract.ts	95%	85%	-10%
src/lib/messagi...ort-conflict.ts	92%	83%	-9%
src/lib/messagi...tatus-health.ts	100%	91%	-9%
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/messagi.../ilink-login.ts	96%	89%	-7%
src/lib/trace.ts	94%	90%	-4%
src/lib/credentials/store.ts	62%	61%	-1%
src/lib/onboard...lers/sandbox.ts	96%	97%	+1%
src/lib/state/r...try/workload.ts	88%	98%	+10%

---

_{Updated August 01, 2026 06:06 UTC}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-8044.docs.buildwithfern.com/nemoclaw

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

3 additional E2E selections from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

• ubuntu-repo-cloud-openclaw: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• ubuntu-repo-cloud-langchain-deepagents-code: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• messaging-compatible-endpoint: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: inference-routing, network-policy, onboard-repair, onboard-resume, cloud-onboard

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.