fix(onboard): enforce cron inference readiness budget

[senthilr-nv]

Summary

Onboarding now requires inference.local to respond within two seconds before it reports deployment verification success. The previous five-second probe could pass while OpenClaw cron's 2.5-second provider preflight still timed out immediately after fresh sandbox creation.

Changes

• Reduce the existing in-sandbox /v1/models reachability probe from five seconds to two seconds.
• Preserve the existing bounded retries so fresh sandbox routes can settle before onboarding reports success.
• Add a regression test that binds the reachability probe to a budget below the OpenClaw cron timeout.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: The change tightens an internal verification threshold. It changes no command, configuration, output, documented workflow, or supported behavior.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex Desktop completed the nine-category security review on PR fix(onboard): enforce cron inference readiness budget #8046. No findings; the change only reduces an existing bounded reachability deadline and does not alter credentials, authorization, SSRF handling, network policy, or command construction.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: The review confirmed that this internal reachability threshold changes no command, configuration, output, documented workflow, or supported behavior. Changed comments and test titles follow the writing guide and controlled claim ladder.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run --project cli src/lib/verify-deployment.test.ts passed 41/41; scoped Biome checks and npm run typecheck:cli passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Senthil Ravichandran senthilr@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Deployment verification now checks inference-route reachability within two seconds, reducing delays when a route is unavailable.
• Tests
  • Added coverage to ensure the inference-route probe uses the updated timeout.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a778a4c3-029b-4868-8ab8-7efc739e6b52

📥 Commits

Reviewing files that changed from the base of the PR and between dfc789d and 64d5e21.

📒 Files selected for processing (2)

• src/lib/verify-deployment.test.ts
• src/lib/verify-deployment.ts

---

📝 Walkthrough

Walkthrough

The inference-route deployment probe now uses a two-second curl timeout. A regression test verifies the generated sandbox probe script includes --max-time 2.

Changes

Inference probe timeout

Layer / File(s)	Summary
Inference timeout and regression coverage src/lib/verify-deployment.ts, src/lib/verify-deployment.test.ts	The inference-route probe uses a two-second timeout constant. The test verifies the generated curl command includes --max-time 2.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• NVIDIA/NemoClaw#8038: Both changes shorten curl-based inference validation timeouts and add regression coverage, but they modify different probes.

Suggested labels: area: inference, area: onboarding, bug-fix

Suggested reviewers: cv, hoyalim, yimoj

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: enforcing the cron-aligned inference readiness timeout during onboarding deployment verification.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-cron-inference-local-readiness

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 64d5e21 in the codex/fix-cron-infer... branch remains at 96%, unchanged from commit dfc789d in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 64d5e21 in the codex/fix-cron-infer... branch remains at 81%, unchanged from commit 47df762 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 47df762	codex/fix-cron-infer... 64d5e21	+/-
src/lib/agent/defs.ts	86%	85%	-1%
src/lib/shields/index.ts	69%	69%	0%
src/lib/onboard...n-validation.ts	97%	97%	0%
src/lib/onboard...bility-cache.ts	95%	95%	0%
src/lib/verify-deployment.ts	98%	98%	0%
src/lib/sandbox...rce-identity.ts	88%	88%	0%
src/lib/agent/s...store-reader.ts	88%	90%	+2%

---

_{Updated August 01, 2026 07:38 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 1 warning · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 1 more warning, the same number of suggestions.

1 additional E2E selection from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

• ubuntu-repo-cloud-openclaw: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

1 optional E2E recommendation

• cron-preflight-inference-local

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.