fix(e2e): harden unit gap evidence reads

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

Author: cv

test/e2e/README.md

@@ -668,6 +668,8 @@ reviews them; redaction reduces exposure but does not prove that a report is
 credential-free. The command exits nonzero when a selected run is unfinished or
 failed-run evidence is unavailable. Do not accept a partial report as the
 weekly ledger.
+Every GitHub read names `NVIDIA/NemoClaw`, so a fork or different checkout remote
+cannot substitute another repository's run data.
 The command also stops when a workflow reaches the 1,000-run collection limit.
 Narrow the selected range and retry so the report cannot omit older runs silently.
 

test/e2e/support/e2e-unit-test-gaps.test.ts

@@ -11,7 +11,12 @@ import {
   normalizeFailureSignature,
   type RunLogEvidence,
 } from "../../../tools/e2e/unit-test-gaps-core.mts";
-import { requireCompleteRunSelection, rollingRange } from "../../../tools/e2e/unit-test-gaps.mts";
+import {
+  failedRunLogArgs,
+  listRunsArgs,
+  requireCompleteRunSelection,
+  rollingRange,
+} from "../../../tools/e2e/unit-test-gaps.mts";
 
 function evidence(overrides: Partial<RunLogEvidence> = {}): RunLogEvidence {
   return {
@@ -69,6 +74,23 @@ describe("weekly E2E unit-test gap analysis", () => {
     );
   });
 
+  it("binds workflow and failed-log reads to the canonical repository", () => {
+    expect(
+      listRunsArgs("e2e.yaml", {
+        from: "2026-08-09T20:00:00.000Z",
+        to: "2026-08-16T20:00:00.000Z",
+      }),
+    ).toEqual(expect.arrayContaining(["--repo", "NVIDIA/NemoClaw", "--workflow", "e2e.yaml"]));
+    expect(failedRunLogArgs(12345678)).toEqual([
+      "run",
+      "view",
+      "12345678",
+      "--repo",
+      "NVIDIA/NemoClaw",
+      "--log-failed",
+    ]);
+  });
+
   it("groups volatile BuildKit references under the missing build-input contract", () => {
     expect(
       normalizeFailureSignature(
@@ -96,6 +118,20 @@ describe("weekly E2E unit-test gap analysis", () => {
     ]);
   });
 
+  it("strips terminal controls after a timestamp and preserves an unprefixed message", () => {
+    expect(
+      extractJobSignatures(
+        [
+          "online\tstep\t2026-08-12T10:00:00.0000000Z \u001b[31mError: colored failure\u001b[0m",
+          "offline\tstep\tError: offline evidence failed",
+        ].join("\n"),
+      ),
+    ).toEqual([
+      { job: "online", signature: "Error: colored failure" },
+      { job: "offline", signature: "Error: offline evidence failed" },
+    ]);
+  });
+
   it("keeps a failed job in the queue when its causal line needs manual review", () => {
     expect(
       extractJobSignatures(

tools/e2e/unit-test-gaps-core.mts

@@ -1,6 +1,8 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+import { stripVTControlCharacters } from "node:util";
+
 type SanitizationModule = typeof import("../../src/lib/readiness/sanitize.ts");
 
 const loadedSanitization = (await import("../../src/lib/readiness/sanitize.ts")) as unknown as {
@@ -56,7 +58,6 @@ export interface UnitGapReport {
   groups: UnitGapGroup[];
 }
 
-const ANSI_PATTERN = /\u001b\[[0-9;]*[A-Za-z]/gu;
 const TIMESTAMP_PATTERN = /^\uFEFF?\d{4}-\d{2}-\d{2}T\S+Z\s+/u;
 const UUID_PATTERN =
   /\b[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\b/giu;
@@ -84,11 +85,9 @@ function stripLogPrefix(line: string): { job: string; message: string } | null {
   const fields = line.split("\t");
   if (fields.length < 3) return null;
   const job = fields[0]!.trim();
-  const message = fields
-    .slice(2)
-    .join("\t")
-    .replace(ANSI_PATTERN, "")
-    .replace(TIMESTAMP_PATTERN, "");
+  const message = stripVTControlCharacters(
+    fields.slice(2).join("\t").replace(TIMESTAMP_PATTERN, ""),
+  );
   return job.length === 0 ? null : { job, message: message.trim() };
 }
 

tools/e2e/unit-test-gaps.mts

@@ -15,6 +15,7 @@ import {
 } from "./unit-test-gaps-core.mts";
 
 const execFileAsync = promisify(execFile);
+const NEMOCLAW_REPOSITORY = "NVIDIA/NemoClaw";
 const DEFAULT_WORKFLOWS = ["e2e.yaml", "portable-profile-e2e.yaml"];
 const MAX_GH_BUFFER_BYTES = 128 * 1024 * 1024;
 const MAX_RUNS_PER_WORKFLOW = 1000;
@@ -140,28 +141,38 @@ export function requireCompleteRunSelection(workflow: string, runCount: number):
   );
 }
 
+export function listRunsArgs(workflow: string, range: { from: string; to: string }): string[] {
+  return [
+    "run",
+    "list",
+    "--repo",
+    NEMOCLAW_REPOSITORY,
+    "--workflow",
+    workflow,
+    "--branch",
+    "main",
+    "--event",
+    "push",
+    "--created",
+    `${range.from}..${range.to}`,
+    "--limit",
+    String(MAX_RUNS_PER_WORKFLOW),
+    "--json",
+    "attempt,conclusion,createdAt,databaseId,event,headBranch,headSha,name,status,url",
+  ];
+}
+
+export function failedRunLogArgs(databaseId: number): string[] {
+  return ["run", "view", String(databaseId), "--repo", NEMOCLAW_REPOSITORY, "--log-failed"];
+}
+
 async function collectRuns(
   workflows: readonly string[],
   range: { from: string; to: string },
 ): Promise<E2ERunRecord[]> {
   const records = await Promise.all(
     workflows.map(async (workflow) => {
-      const output = await gh([
-        "run",
-        "list",
-        "--workflow",
-        workflow,
-        "--branch",
-        "main",
-        "--event",
-        "push",
-        "--created",
-        `${range.from}..${range.to}`,
-        "--limit",
-        String(MAX_RUNS_PER_WORKFLOW),
-        "--json",
-        "attempt,conclusion,createdAt,databaseId,event,headBranch,headSha,name,status,url",
-      ]);
+      const output = await gh(listRunsArgs(workflow, range));
       const parsed = JSON.parse(output) as unknown;
       if (!Array.isArray(parsed)) throw new Error(`GitHub returned malformed runs for ${workflow}`);
       requireCompleteRunSelection(workflow, parsed.length);
@@ -197,7 +208,7 @@ async function collectEvidence(runs: readonly E2ERunRecord[]): Promise<RunLogEvi
   const logs = new Map<number, RunLogEvidence>();
   await parallelMap(failures, DEFAULT_CONCURRENCY, async (run) => {
     try {
-      const log = await gh(["run", "view", String(run.databaseId), "--log-failed"]);
+      const log = await gh(failedRunLogArgs(run.databaseId));
       logs.set(run.databaseId, { log, run });
     } catch (error) {
       logs.set(run.databaseId, {