fix(onboard): isolate N1x rebuild intent

Signed-off-by: San Dang <sdang@nvidia.com>

Author: sandl99

src/lib/onboard/authoritative-rebuild-target.test.ts

@@ -47,6 +47,14 @@ describe("authoritative rebuild runtime preflight options", () => {
       noGpu: false,
       allowDeferredN1xManagedVllm: true,
     });
+
+    const { allowDeferredN1xManagedVllm: _recordedIntent, ...withoutRecordedIntent } = options;
+    expect(authoritativeRebuildRuntimePreflightOptions(withoutRecordedIntent)).toEqual({
+      sandboxGpu: "enable",
+      sandboxGpuDevice: "nvidia.com/gpu=all",
+      noGpu: false,
+      allowDeferredN1xManagedVllm: false,
+    });
   });
 });
 

src/lib/onboard/authoritative-rebuild-target.ts

@@ -36,15 +36,14 @@ export type AuthoritativeRebuildPreflightOptions = Pick<
 /** Project only the target-bound GPU and N1x intent into runtime preflight. */
 export function authoritativeRebuildRuntimePreflightOptions(
   opts: AuthoritativeRebuildPreflightOptions,
-): Pick<
-  OnboardOptions,
-  "sandboxGpu" | "sandboxGpuDevice" | "noGpu" | "allowDeferredN1xManagedVllm"
-> {
+): Pick<OnboardOptions, "sandboxGpu" | "sandboxGpuDevice" | "noGpu"> & {
+  allowDeferredN1xManagedVllm: boolean;
+} {
   return {
     sandboxGpu: opts.sandboxGpu,
     sandboxGpuDevice: opts.sandboxGpuDevice,
     noGpu: opts.noGpu,
-    allowDeferredN1xManagedVllm: opts.allowDeferredN1xManagedVllm,
+    allowDeferredN1xManagedVllm: opts.allowDeferredN1xManagedVllm === true,
   };
 }
 

src/lib/onboard/fatal-runtime-preflight.test.ts

@@ -91,7 +91,7 @@ afterEach(() => {
 });
 
 describe("report-backed runtime readiness (#7411)", () => {
-  it("requires explicit managed-vLLM intent for the Deferred N1x readiness exception (#8574)", () => {
+  it("requires explicit managed-vLLM intent and lets rebuild reject ambient intent (#9292)", () => {
     const readiness: SystemReadinessReport = {
       schemaVersion: "1.1.0",
       status: "incompatible",
@@ -152,6 +152,14 @@ describe("report-backed runtime readiness (#7411)", () => {
         exitProcess: exit as never,
       }),
     ).toBe(readiness);
+
+    expect(() =>
+      assertOnboardSystemReadiness(readiness, hostWithRuntime("docker"), {
+        explicitlyOptedOutGpuPassthrough: false,
+        allowDeferredN1xManagedVllm: false,
+        exitProcess: exit as never,
+      }),
+    ).toThrow("exit");
   });
 
   it("rejects ambiguous gateway ownership before the caller can run effects", () => {

src/lib/onboard/fatal-runtime-preflight.ts

@@ -44,8 +44,10 @@ import { MANAGED_VLLM_PROVIDER_KEY } from "./vllm-menu";
 
 export type FatalRuntimePreflightOptions = Pick<
   OnboardOptions,
-  "sandboxGpu" | "sandboxGpuDevice" | "gpu" | "noGpu" | "allowDeferredN1xManagedVllm"
+  "sandboxGpu" | "sandboxGpuDevice" | "gpu" | "noGpu"
 > & {
+  /** Explicit false prevents ambient provider intent from crossing a rebuild boundary. */
+  allowDeferredN1xManagedVllm?: boolean;
   optedOutGpuPassthrough?: boolean;
 };
 
@@ -155,7 +157,7 @@ export function assertOnboardSystemReadiness(
     allowStorageRemediation: options.allowStorageRemediation === true,
     allowPortableHostPreparation: options.allowPortableHostPreparation,
     allowDeferredN1xManagedVllm:
-      options.allowDeferredN1xManagedVllm === true ||
+      options.allowDeferredN1xManagedVllm ??
       process.env.NEMOCLAW_PROVIDER === MANAGED_VLLM_PROVIDER_KEY,
   });
   if (admission.admitted) return readinessReport;