merge(main): resolve E2E workflow conflicts

Author: cv

.github/workflows/e2e.yaml

@@ -2497,6 +2497,9 @@ jobs:
       CANDIDATE_SHA: ${{ inputs.checkout_sha || github.sha }}
       E2E_JOB: "1"
       INSTANCE_NAME: nclaw-e2e-${{ github.run_id }}-${{ github.run_attempt }}
+      E2E_AGENT_RUNTIME: "openclaw"
+      E2E_OBSERVABLE_OUTCOME: "Exact staging image boots and completes the full E2E scenario"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Brev Launchable Docker host; NVIDIA hosted inference"
     steps:
       - name: Checkout trusted Launchable lane
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -3020,6 +3023,9 @@ jobs:
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "openshell-gateway-auth-contract"
+      E2E_AGENT_RUNTIME: "none"
+      E2E_OBSERVABLE_OUTCOME: "Gateway mTLS and sandbox JWT authentication boundaries hold"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu Docker host; no inference endpoint"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/openshell-gateway-auth-contract
       NEMOCLAW_RUN_LIVE_E2E: "1"
       NEMOCLAW_NON_INTERACTIVE: "1"
@@ -3098,9 +3104,21 @@ jobs:
       fail-fast: false
       matrix:
         agent: [openclaw, hermes, deepagents]
+        include:
+          - agent: openclaw
+            agent_runtime: openclaw
+            coverage_variant: openclaw
+          - agent: hermes
+            agent_runtime: hermes
+            coverage_variant: hermes
+          - agent: deepagents
+            agent_runtime: langchain-deepagents-code
+            coverage_variant: deepagents
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "mcp-bridge"
+      E2E_OBSERVABLE_OUTCOME: "Stable OpenShell MCP bridge reaches tools and inference"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu Docker host; local compatible inference and MCP endpoint"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/mcp-bridge/${{ matrix.agent }}
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
       NEMOCLAW_E2E_SHARD: ${{ matrix.agent }}
@@ -3425,6 +3443,9 @@ jobs:
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "openshell-credential-generation-window"
+      E2E_AGENT_RUNTIME: "openclaw"
+      E2E_OBSERVABLE_OUTCOME: "Credential expiry rotation detach and rebuild preserve the intended access window"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu Docker host; local compatible inference and MCP endpoint"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/openshell-credential-generation-window
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
       NEMOCLAW_OPENSHELL_CHANNEL: stable
@@ -3583,9 +3604,21 @@ jobs:
       fail-fast: false
       matrix:
         agent: [openclaw, hermes, deepagents]
+        include:
+          - agent: openclaw
+            agent_runtime: openclaw
+            coverage_variant: openclaw
+          - agent: hermes
+            agent_runtime: hermes
+            coverage_variant: hermes
+          - agent: deepagents
+            agent_runtime: langchain-deepagents-code
+            coverage_variant: deepagents
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "mcp-bridge-dev"
+      E2E_OBSERVABLE_OUTCOME: "Development OpenShell MCP bridge reaches tools and inference"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu Docker host; local compatible inference and MCP endpoint"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/mcp-bridge-dev/${{ matrix.agent }}
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
       NEMOCLAW_E2E_SHARD: ${{ matrix.agent }}
@@ -3784,13 +3817,19 @@ jobs:
           - platform: linux/amd64
             runner: ubuntu-24.04
             shard: linux-amd64
+            environment_or_inference_endpoint: "AMD64 Ubuntu; exact managed image startup"
+            coverage_variant: linux-amd64
           - platform: linux/arm64
             runner: ubuntu-24.04-arm
             shard: linux-arm64
+            environment_or_inference_endpoint: "Arm64 Ubuntu; exact managed image startup"
+            coverage_variant: linux-arm64
     env:
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/managed-image-multiarch-startup/${{ matrix.shard }}
       E2E_JOB: "1"
       E2E_TARGET_ID: "managed-image-multiarch-startup"
+      E2E_AGENT_RUNTIME: "openclaw + hermes + langchain-deepagents-code"
+      E2E_OBSERVABLE_OUTCOME: "Exact managed images start directly on the native architecture"
       RELEASE_E2E_ACTIVATION_PATH: ci/protected-managed-image-multiarch-activation-v1.json
       NEMOCLAW_E2E_EXPECTED_SHA: ${{ inputs.checkout_sha }}
       NEMOCLAW_PROTECTED_MANAGED_IMAGE_HEAD_SHA: ${{ inputs.checkout_sha || github.sha }}
@@ -4214,6 +4253,10 @@ jobs:
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/llama-cpp-dgx-spark-qualification
       E2E_JOB: "1"
       E2E_TARGET_ID: "llama-cpp-dgx-spark-qualification"
+      E2E_AGENT_RUNTIME: "unresolved"
+      E2E_OBSERVABLE_OUTCOME: "Exact NemoClaw-built llama.cpp image produces protected DGX Spark evidence"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "NVIDIA DGX Spark GB10; local llama.cpp inference"
+      E2E_UNRESOLVED_REASON: "The protected plan can enable or skip its OpenClaw subqualification"
       NEMOCLAW_E2E_EXPECTED_SHA: ${{ inputs.checkout_sha }}
       NEMOCLAW_E2E_SHARD: linux-arm64-gpu-dgx-spark-gb10
       NEMOCLAW_LLAMA_CPP_QUALIFICATION_BASE_SHA: ${{ inputs.base_sha || github.event.before || github.sha }}
@@ -4405,6 +4448,9 @@ jobs:
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/managed-image-protected-runtime
       E2E_JOB: "1"
       E2E_TARGET_ID: "managed-image-protected-runtime"
+      E2E_AGENT_RUNTIME: "openclaw + hermes + langchain-deepagents-code"
+      E2E_OBSERVABLE_OUTCOME: "Protected GPU runtime supports Ollama vLLM NIM rollback and cleanup"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "NVIDIA GPU runner; local and hosted inference services"
       E2E_WORKLOAD_SOURCE: "managed-image"
       RELEASE_E2E_ACTIVATION_PATH: ci/protected-managed-image-runtime-activation-v1.json
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
@@ -4683,6 +4729,9 @@ jobs:
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "hermes-e2e"
+      E2E_AGENT_RUNTIME: "hermes"
+      E2E_OBSERVABLE_OUTCOME: "Install onboarding health inference lifecycle dashboard and security succeed"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu; mock or NVIDIA hosted inference"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/hermes-e2e
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
       NEMOCLAW_RUN_LIVE_E2E: "1"
@@ -4773,13 +4822,21 @@ jobs:
         include:
           - scenario: native
             sandbox_name: e2e-hgpu-native
+            observable_outcome: "Native GPU startup reaches the stable Ready route"
+            coverage_variant: native
           - scenario: fallback
             sandbox_name: e2e-hgpu-fallback
+            observable_outcome: "Fallback GPU startup reaches the stable Ready route"
+            coverage_variant: fallback
           - scenario: compatibility-only
             sandbox_name: e2e-hgpu-compat
+            observable_outcome: "Compatibility-only GPU startup reaches the stable Ready route"
+            coverage_variant: compatibility-only
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "hermes-gpu-startup"
+      E2E_AGENT_RUNTIME: "hermes"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "NVIDIA GPU runner; local GPU inference"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/hermes-gpu-startup/${{ matrix.scenario }}
       E2E_HERMES_GPU_STARTUP_SCENARIO: ${{ matrix.scenario }}
       NEMOCLAW_E2E_SHARD: ${{ matrix.scenario }}
@@ -5081,6 +5138,9 @@ jobs:
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "cloud-onboard"
+      E2E_AGENT_RUNTIME: "openclaw"
+      E2E_OBSERVABLE_OUTCOME: "Public install onboarding hosted inference and security checks succeed"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu; NVIDIA hosted inference"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/cloud-onboard
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
       NEMOCLAW_RUN_LIVE_E2E: "1"
@@ -5203,6 +5263,9 @@ jobs:
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "messaging-providers"
+      E2E_AGENT_RUNTIME: "openclaw"
+      E2E_OBSERVABLE_OUTCOME: "Provider configuration redaction and optional real sends succeed"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu; NVIDIA hosted inference and messaging providers"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/messaging-providers
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
       NEMOCLAW_RUN_LIVE_E2E: "1"
@@ -5268,6 +5331,9 @@ jobs:
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "openclaw-plugin-runtime-exdev-release"
+      E2E_AGENT_RUNTIME: "openclaw"
+      E2E_OBSERVABLE_OUTCOME: "Release baseline plugin runtime survives the EXDEV boundary"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu; release baseline package; no inference endpoint"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/openclaw-plugin-runtime-exdev-release
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
       NEMOCLAW_RUN_LIVE_E2E: "1"
@@ -5340,6 +5406,9 @@ jobs:
     env:
       E2E_JOB: "1"
       E2E_TARGET_ID: "openclaw-plugin-runtime-exdev"
+      E2E_AGENT_RUNTIME: "openclaw"
+      E2E_OBSERVABLE_OUTCOME: "Current plugin lifecycle rebuild and dependencies survive the EXDEV boundary"
+      E2E_ENVIRONMENT_OR_INFERENCE_ENDPOINT: "Ubuntu; current package; no inference endpoint"
       E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/openclaw-plugin-runtime-exdev
       NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
       NEMOCLAW_RUN_LIVE_E2E: "1"

src/lib/inference/onboard-host-docker-internal.test.ts

@@ -46,42 +46,46 @@ describe("host.docker.internal onboarding inference policy", () => {
     expect(result.message).toMatch(/host\.openshell\.internal:11435/);
   });
 
-  it("recognizes Windows-host Ollama tool calls returned through Docker stdout (#9116)", async () => {
-    const seenCommands: Array<{ command: string; args: readonly string[] }> = [];
-    const containerProbeSpawnSyncImpl = (
-      command: string,
-      args: readonly string[],
-    ): SpawnSyncReturns<string> => {
-      seenCommands.push({ command, args });
-      const body = JSON.stringify({
-        choices: [
-          {
-            message: {
-              tool_calls: [
-                {
-                  id: "call_1",
-                  type: "function",
-                  function: { name: "sessions_send", arguments: '{"message":"hello"}' },
-                },
-              ],
+  it.each([
+    ["required", true],
+    ["optional", false],
+  ] as const)(
+    "recognizes Windows-host Ollama tool calls when strict tool calling is %s (#9116)",
+    async (_label, requireChatCompletionsToolCalling) => {
+      const seenCommands: Array<{ command: string; args: readonly string[] }> = [];
+      const containerProbeSpawnSyncImpl = (
+        command: string,
+        args: readonly string[],
+      ): SpawnSyncReturns<string> => {
+        seenCommands.push({ command, args });
+        const body = JSON.stringify({
+          choices: [
+            {
+              message: {
+                tool_calls: [
+                  {
+                    id: "call_1",
+                    type: "function",
+                    function: { name: "sessions_send", arguments: '{"message":"hello"}' },
+                  },
+                ],
+              },
             },
-          },
-        ],
-      });
-      const writeOutIndex = args.indexOf("-w");
-      const writeOut = args[writeOutIndex + 1];
-      const stdout = `${body}${writeOut.replace("%{http_code}", "200")}`;
-      return {
-        pid: 123,
-        output: [stdout, ""],
-        stdout,
-        stderr: "",
-        status: 0,
-        signal: null,
+          ],
+        });
+        const writeOutIndex = args.indexOf("-w");
+        const writeOut = args[writeOutIndex + 1];
+        const stdout = `${body}${writeOut.replace("%{http_code}", "200")}`;
+        return {
+          pid: 123,
+          output: [stdout, ""],
+          stdout,
+          stderr: "",
+          status: 0,
+          signal: null,
+        };
       };
-    };
 
-    for (const requireChatCompletionsToolCalling of [true, false]) {
       const result = await probeOpenAiLikeEndpointOptimized(
         "http://host.docker.internal:11434/v1",
         "openai/nemotron-mini",
@@ -99,15 +103,15 @@ describe("host.docker.internal onboarding inference policy", () => {
         api: "openai-completions",
         label: "Chat Completions API",
       });
-    }
-    expect(seenCommands).toHaveLength(2);
-    seenCommands.forEach(({ command, args }) => {
-      expect(command).toBe("docker");
-      expect(args).toContain("curlimages/curl:8.10.1");
-      expect(args).toContain("http://host.docker.internal:11434/v1/chat/completions");
-      expect(args).not.toContain("--volume");
-    });
-  });
+      expect(seenCommands).toHaveLength(1);
+      seenCommands.forEach(({ command, args }) => {
+        expect(command).toBe("docker");
+        expect(args).toContain("curlimages/curl:8.10.1");
+        expect(args).toContain("http://host.docker.internal:11434/v1/chat/completions");
+        expect(args).not.toContain("--volume");
+      });
+    },
+  );
 
   it.each([
     {

src/lib/onboard/machine/definition.test.ts

@@ -28,6 +28,10 @@ const expectedStateOrder = [
   "failed",
 ];
 
+const progressStateDefinitions = ONBOARD_MACHINE_STATE_DEFINITIONS.flatMap((definition) =>
+  "progress" in definition ? [definition] : [],
+);
+
 describe("onboard machine definition", () => {
   it("is the canonical ordered state catalog", () => {
     expect(ONBOARD_MACHINE_STATE_IDS).toEqual(expectedStateOrder);
@@ -76,16 +80,16 @@ describe("onboard machine definition", () => {
     expect(ONBOARD_SESSION_STEP_TO_MACHINE_STATE).toEqual(mappingFromDefinitions);
   });
 
-  it("keeps progress metadata attached only to state-backed steps", () => {
-    for (const definition of ONBOARD_MACHINE_STATE_DEFINITIONS) {
-      if (!("progress" in definition)) continue;
+  it.each(progressStateDefinitions)(
+    "keeps progress metadata attached to state-backed step $state",
+    (definition) => {
       expect("stepName" in definition).toBe(true);
       expect(definition.progress.total).toBe(8);
       expect(definition.progress.number).toBeGreaterThanOrEqual(1);
       expect(definition.progress.number).toBeLessThanOrEqual(definition.progress.total);
       expect(definition.progress.title).not.toHaveLength(0);
-    }
-  });
+    },
+  );
 
   it("looks up definitions by state", () => {
     expect(getOnboardMachineStateDefinition("gateway")).toMatchObject({

src/lib/onboard/machine/progress.test.ts

@@ -10,13 +10,17 @@ import { getOnboardProgressStep, ONBOARD_PROGRESS_STEPS } from "./progress";
 
 vi.mock("../prompt-helpers", () => ({ step: vi.fn() }));
 
+const progressStateDefinitions = ONBOARD_MACHINE_STATE_DEFINITIONS.flatMap((definition) =>
+  "progress" in definition ? [definition] : [],
+);
+
 describe("onboard progress metadata", () => {
-  it("derives state-backed progress labels from machine definitions", () => {
-    for (const definition of ONBOARD_MACHINE_STATE_DEFINITIONS) {
-      if (!("progress" in definition)) continue;
+  it.each(progressStateDefinitions)(
+    "derives the $state progress label from its machine definition",
+    (definition) => {
       expect(ONBOARD_PROGRESS_STEPS[definition.stepName]).toEqual(definition.progress);
-    }
-  });
+    },
+  );
 
   it("preserves the existing eight-step onboarding labels", () => {
     expect(ONBOARD_PROGRESS_STEPS).toEqual({

src/lib/onboard/managed-startup-profile.test.ts

@@ -28,6 +28,9 @@ import {
 } from "./managed-startup/profile";
 
 const CA_SHA256 = "a".repeat(64);
+const HERMES_RESERVED_API_PORTS = [
+  8_642, 8_643, 8_644, 8_645, 8_646, 8_647, 8_648, 8_649, 8_650, 8_651, 8_652, 18_642,
+];
 
 const MESSAGING_PLAN = {
   schemaVersion: 1,
@@ -1138,20 +1141,18 @@ describe("managed startup profile", () => {
     ).toThrow(/reserved API ports 8642-8652 or 18642/);
   });
 
-  it.each(
-    Array.from([HERMES_API_PORT_RANGE_START - 1, HERMES_API_PORT_RANGE_END + 1], (value) => [
-      value,
-    ]),
-  )("rejects port %s outside the reserved Hermes API port range", (port) => {
-    for (let port = HERMES_API_PORT_RANGE_START; port <= HERMES_API_PORT_RANGE_END; port += 1) {
+  it.each(HERMES_RESERVED_API_PORTS)("rejects reserved Hermes API port %s", (port) => {
       expect(() =>
         validateManagedStartupProfile({
           ...HERMES_PROFILE,
           dashboard: { ...HERMES_PROFILE.dashboard, publicPort: port },
         }),
       ).toThrow(/reserved API ports/);
-    }
+  });
 
+  it.each([HERMES_API_PORT_RANGE_START - 1, HERMES_API_PORT_RANGE_END + 1])(
+    "accepts dashboard port %s outside the reserved Hermes API port range",
+    (port) => {
     expect(() =>
       validateManagedStartupProfile({
         ...HERMES_PROFILE,
@@ -1162,7 +1163,8 @@ describe("managed startup profile", () => {
         },
       }),
     ).not.toThrow();
-  });
+    },
+  );
 
   it.each([
     "-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----",