fix(onboard): preserve derived N1x rebuild intent

Signed-off-by: San Dang <sdang@nvidia.com>

Author: sandl99

docs/inference/set-up-vllm.mdx

@@ -371,6 +371,22 @@ Accepting the preview prompt sets explicit managed-vLLM intent for the narrow pe
 Declining the prompt or setting only `NEMOCLAW_NO_EXPRESS=1` stops the installer before onboarding; neither path opens interactive provider selection.
 Set `NEMOCLAW_PROVIDER=install-vllm` when you need to bypass the prompt with the same explicit preview intent.
 
+On a host that still meets the N1x identity checks, `rebuild` reuses the recorded route as explicit preview intent only when all of these conditions hold:
+
+- The sandbox registry records provider `vllm-local`.
+- The registry records model `nvidia/Qwen3.6-35B-A3B-NVFP4`.
+- If the registry records `endpointUrl` as `null`, NemoClaw derives `http://host.openshell.internal:8000/v1`; otherwise, `endpointUrl` must equal that URL.
+- The registry records `endpointSource` as `onboard` and `openshellDriver` as `docker`.
+- The replacement keeps the recorded provider and model, then re-derives the canonical local endpoint.
+- `hostLocalInferenceReceipt` is absent or `null`, or contains a canonical vLLM receipt for `host.openshell.internal:8000` and the same model.
+
+NemoClaw v0.0.109 can omit `hostLocalInferenceReceipt` or record it as `null`.
+Matching sandboxes from that release remain eligible only when every condition above passes.
+You do not need to set `NEMOCLAW_PROVIDER` again for a matching rebuild.
+Any unmet condition stops readiness preflight before NemoClaw deletes the existing sandbox.
+A malformed, non-vLLM, or conflicting receipt also stops readiness preflight before deletion.
+This reuse waives only the pending physical-validation finding and does not change the Deferred status.
+
 <Warning title="N1x Express Qualification Pending">
 Physical CUDA and CDI checks passed on one N1x host.
 The full NemoClaw Express E2E test is still pending, so the N1x platform status remains Deferred.

src/lib/actions/sandbox/rebuild-gpu-opt-out.ts

@@ -127,6 +127,8 @@ export type RebuildRecreateOnboardOpts = {
   rebuildRegistryInferenceRoute?: RebuildRouteHandoff;
   rebuildProviderReconfigure?: RebuildProviderReconfigureHandoff;
   providerRecoveryReceipt?: ProviderRecoveryReceipt;
+  /** Recorded managed-vLLM intent admitted only by the N1x readiness exception. */
+  allowDeferredN1xManagedVllm?: true;
   /** Target-scoped authority admitted by the authoritative rebuild preflight. */
   rebuildGatewayAuthority?: CheckpointGatewayAuthority;
   preparedImageRebuild?: PreparedImageRebuildHandoff;

…-managed-workload-context-window.test.ts …light-target-phase-orchestration.test.tssrc/lib/actions/sandbox/rebuild-managed-workload-context-window.test.ts renamed to src/lib/actions/sandbox/rebuild-preflight-target-phase-orchestration.test.ts src/lib/actions/sandbox/rebuild-managed-workload-context-window.test.ts renamed to src/lib/actions/sandbox/rebuild-preflight-target-phase-orchestration.test.ts

@@ -1,10 +1,11 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { describe, expect, it, vi } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const mocks = vi.hoisted(() => ({
   bail: vi.fn(),
+  preflightAuthoritativeOnboardRuntime: vi.fn(async (..._args: unknown[]) => false),
   prepareManagedWorkloadRebuildHandoff: vi.fn(),
   prepareSandboxWorkloadSourceFromRebuildHandoff: vi.fn(),
   prepareRebuildTargetConfig: vi.fn(),
@@ -33,7 +34,7 @@ vi.mock("../../onboard/workload/runtime", () => ({
 vi.mock("./rebuild-target-preflight", async (importOriginal) => ({
   ...(await importOriginal<typeof import("./rebuild-target-preflight")>()),
   hydrateMessagingConfigForRebuild: vi.fn(),
-  preflightAuthoritativeOnboardRuntime: vi.fn(async () => false),
+  preflightAuthoritativeOnboardRuntime: mocks.preflightAuthoritativeOnboardRuntime,
   prepareRebuildRecreateOptions: mocks.prepareRebuildRecreateOptions,
   prepareRebuildTargetConfig: mocks.prepareRebuildTargetConfig,
   stageRebuildHermesDashboardConfig: vi.fn(() => true),
@@ -50,7 +51,64 @@ vi.mock("./rebuild-messaging-conflict-preflight", () => ({
 import { managedRebuildProfileDependencies } from "./agents/managed-workload-rebuild-profile";
 import { prepareRebuildTargetPreflights } from "./rebuild-preflight-target-phase";
 
-describe("managed workload rebuild context-window preflight", () => {
+describe("prepareRebuildTargetPreflights", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.prepareManagedWorkloadRebuildHandoff.mockResolvedValue(null);
+    mocks.preflightAuthoritativeOnboardRuntime.mockResolvedValue(false);
+  });
+
+  async function prepareN1xTarget(endpointSource: "onboard" | "inference-set") {
+    const resumeConfig = {
+      provider: "vllm-local",
+      model: "nvidia/Qwen3.6-35B-A3B-NVFP4",
+      preferredInferenceApi: "openai-completions",
+      pinEndpoint: true,
+      endpointUrl: null,
+      compatibleEndpointReasoning: null,
+      compatibleEndpointReasoningEffort: null,
+      registryInferenceRoute: null,
+    };
+    mocks.prepareRebuildTargetConfig.mockReturnValue({
+      agentDefinition: {},
+      resumeConfig,
+      durableConfig: {
+        toolDisclosure: "progressive",
+        dcodeAutoApprovalMode: "disabled",
+        webSearchConfig: null,
+      },
+      credentialEnv: null,
+      fromDockerfile: false,
+      hermesToolGateways: [],
+    });
+    mocks.prepareRebuildRecreateOptions.mockReturnValue({
+      controlUiPort: 18_789,
+      targetGatewayName: "nemoclaw",
+      toolDisclosure: "progressive",
+      dcodeAutoApprovalMode: "disabled",
+      observabilityEnabled: false,
+    });
+
+    await prepareRebuildTargetPreflights({
+      sandboxName: "my-assistant",
+      sandboxEntry: {
+        name: "my-assistant",
+        agent: "openclaw",
+        gatewayName: "nemoclaw",
+        openshellDriver: "docker",
+        provider: resumeConfig.provider,
+        model: resumeConfig.model,
+        endpointUrl: "http://host.openshell.internal:8000/v1",
+        endpointSource,
+      } as never,
+      rebuildAgent: "openclaw",
+      autoYes: true,
+      log: vi.fn(),
+      bail: mocks.bail as never,
+    });
+    return mocks.preflightAuthoritativeOnboardRuntime.mock.calls[0]?.[2];
+  }
+
   it("resolves the Ollama context window through target preparation", async () => {
     const catalogHandoff = {
       agent: "openclaw",
@@ -123,4 +181,18 @@ describe("managed workload rebuild context-window preflight", () => {
     ).resolves.toBeNull();
     expect(mocks.resolveContextWindowForModel).toHaveBeenCalledWith("ollama-local", "qwen3.5:9b");
   });
+
+  it("passes exact legacy N1x intent into authoritative readiness (#9292)", async () => {
+    const readinessOptions = await prepareN1xTarget("onboard");
+
+    expect(readinessOptions).toEqual(
+      expect.objectContaining({ allowDeferredN1xManagedVllm: true }),
+    );
+  });
+
+  it("withholds N1x intent for a mismatched endpoint source (#9292)", async () => {
+    const readinessOptions = await prepareN1xTarget("inference-set");
+
+    expect(readinessOptions).not.toHaveProperty("allowDeferredN1xManagedVllm");
+  });
 });

src/lib/actions/sandbox/rebuild-preflight-target-phase.test.ts

@@ -3,15 +3,22 @@
 
 import { afterEach, describe, expect, it, vi } from "vitest";
 
+import {
+  hostLocalInferenceReceipt,
+  serializedHostLocalInferenceReceipt,
+  serializedLlamaCppHostLocalInferenceReceipt,
+} from "../../../../test/helpers/host-local-inference-receipt";
 import type {
   ProviderRecoveryReceipt,
   RegistryInferenceRoute,
 } from "../../onboard/rebuild-route-handoff";
+import { serializeHostLocalInferenceReceipt } from "../../onboard/runtime-provider/host-local-inference";
 import type { SandboxBaseImageResolutionMetadata } from "../../sandbox-base-image";
 import {
   pinRebuildTargetGatewayForReadiness,
   runRebuildGatewayRecoveryAfterReadiness,
   stageRebuildBaseImageResolutionHandoff,
+  stageRecordedManagedVllmIntent,
   stageRegistryProviderRecoveryReceipt,
 } from "./rebuild-preflight-target-phase";
 
@@ -121,6 +128,152 @@ describe("stageRegistryProviderRecoveryReceipt", () => {
   });
 });
 
+describe("stageRecordedManagedVllmIntent", () => {
+  const n1xExpressEntry = {
+    provider: "vllm-local",
+    model: "nvidia/Qwen3.6-35B-A3B-NVFP4",
+    endpointUrl: null,
+    endpointSource: "onboard" as const,
+    openshellDriver: "docker",
+  };
+  const n1xExpressSelection = {
+    provider: n1xExpressEntry.provider,
+    model: n1xExpressEntry.model,
+    pinEndpoint: true,
+    endpointUrl: null,
+  };
+
+  it.each([
+    { state: "derived endpoint and absent receipt", sandboxEntry: n1xExpressEntry },
+    {
+      state: "derived endpoint and null receipt",
+      sandboxEntry: { ...n1xExpressEntry, hostLocalInferenceReceipt: null },
+    },
+    {
+      state: "recorded canonical endpoint",
+      sandboxEntry: {
+        ...n1xExpressEntry,
+        endpointUrl: "http://host.openshell.internal:8000/v1",
+      },
+    },
+  ])(
+    "carries the v0.0.109 N1x Express selection with a $state into rebuild readiness (#9292)",
+    ({ sandboxEntry }) => {
+      const recreateOptions: { allowDeferredN1xManagedVllm?: true } = {};
+
+      stageRecordedManagedVllmIntent(recreateOptions, sandboxEntry, n1xExpressSelection);
+
+      expect(recreateOptions.allowDeferredN1xManagedVllm).toBe(true);
+    },
+  );
+
+  it("also accepts a canonical vLLM receipt on the exact N1x Express selection (#9292)", () => {
+    const recreateOptions: { allowDeferredN1xManagedVllm?: true } = {};
+    const genericReceipt = hostLocalInferenceReceipt("docker");
+    const n1xReceipt = serializeHostLocalInferenceReceipt({
+      ...genericReceipt,
+      endpoint: {
+        ...genericReceipt.endpoint,
+        host: "host.openshell.internal",
+      },
+      inference: {
+        protocol: "openai-chat-completions",
+        model: n1xExpressEntry.model,
+        toolCallingRequired: true,
+      },
+    });
+
+    stageRecordedManagedVllmIntent(
+      recreateOptions,
+      { ...n1xExpressEntry, hostLocalInferenceReceipt: n1xReceipt },
+      n1xExpressSelection,
+    );
+
+    expect(recreateOptions.allowDeferredN1xManagedVllm).toBe(true);
+  });
+
+  it.each([
+    {
+      caseName: "different recorded provider",
+      sandboxEntry: { ...n1xExpressEntry, provider: "compatible-endpoint" },
+      rebuildSelection: n1xExpressSelection,
+    },
+    {
+      caseName: "different recorded model",
+      sandboxEntry: { ...n1xExpressEntry, model: "meta-llama/Llama-3.1-8B-Instruct" },
+      rebuildSelection: n1xExpressSelection,
+    },
+    {
+      caseName: "different recorded endpoint",
+      sandboxEntry: { ...n1xExpressEntry, endpointUrl: "http://host.openshell.internal:8001/v1" },
+      rebuildSelection: n1xExpressSelection,
+    },
+    {
+      caseName: "different endpoint source",
+      sandboxEntry: { ...n1xExpressEntry, endpointSource: "inference-set" as const },
+      rebuildSelection: n1xExpressSelection,
+    },
+    {
+      caseName: "different OpenShell driver",
+      sandboxEntry: { ...n1xExpressEntry, openshellDriver: "podman" },
+      rebuildSelection: n1xExpressSelection,
+    },
+    {
+      caseName: "malformed receipt",
+      sandboxEntry: { ...n1xExpressEntry, hostLocalInferenceReceipt: "not-json" },
+      rebuildSelection: n1xExpressSelection,
+    },
+    {
+      caseName: "different host-local service",
+      sandboxEntry: {
+        ...n1xExpressEntry,
+        hostLocalInferenceReceipt: serializedLlamaCppHostLocalInferenceReceipt(),
+      },
+      rebuildSelection: n1xExpressSelection,
+    },
+    {
+      caseName: "conflicting vLLM receipt",
+      sandboxEntry: {
+        ...n1xExpressEntry,
+        hostLocalInferenceReceipt: serializedHostLocalInferenceReceipt(),
+      },
+      rebuildSelection: n1xExpressSelection,
+    },
+    {
+      caseName: "different rebuild provider",
+      sandboxEntry: n1xExpressEntry,
+      rebuildSelection: { ...n1xExpressSelection, provider: "compatible-endpoint" },
+    },
+    {
+      caseName: "different rebuild model",
+      sandboxEntry: n1xExpressEntry,
+      rebuildSelection: { ...n1xExpressSelection, model: "meta-llama/Llama-3.1-8B-Instruct" },
+    },
+    {
+      caseName: "unresolved rebuild endpoint",
+      sandboxEntry: n1xExpressEntry,
+      rebuildSelection: { ...n1xExpressSelection, pinEndpoint: false },
+    },
+    {
+      caseName: "noncanonical rebuild endpoint",
+      sandboxEntry: n1xExpressEntry,
+      rebuildSelection: {
+        ...n1xExpressSelection,
+        endpointUrl: "http://host.openshell.internal:8001/v1",
+      },
+    },
+  ])(
+    "does not infer N1x Express intent from a $caseName (#9292)",
+    ({ sandboxEntry, rebuildSelection }) => {
+      const recreateOptions: { allowDeferredN1xManagedVllm?: true } = {};
+
+      stageRecordedManagedVllmIntent(recreateOptions, sandboxEntry, rebuildSelection);
+
+      expect(recreateOptions).not.toHaveProperty("allowDeferredN1xManagedVllm");
+    },
+  );
+});
+
 describe("stageRebuildBaseImageResolutionHandoff", () => {
   it("binds outer resolver provenance to its immutable local handoff (#7144)", () => {
     const imageId = `sha256:${"a".repeat(64)}`;

src/lib/actions/sandbox/rebuild-preflight-target-phase.ts

@@ -6,6 +6,7 @@ import { CLI_NAME } from "../../cli/branding";
 import type { SandboxMessagingPlan } from "../../messaging";
 import { isSandboxBaseImageRefreshRequested } from "../../onboard/base-image-resolution-flow";
 import type { DcodeAutoApprovalMode } from "../../onboard/dcode-auto-approval";
+import { parseHostLocalInferenceReceipt } from "../../onboard/runtime-provider/host-local-inference";
 import {
   createRebuildProviderReconfigureHandoff,
   mintProviderRecoveryReceipt,
@@ -83,6 +84,64 @@ export function stageRegistryProviderRecoveryReceipt(
   );
 }
 
+const N1X_EXPRESS_PROVIDER = "vllm-local";
+const N1X_EXPRESS_MODEL = "nvidia/Qwen3.6-35B-A3B-NVFP4";
+const N1X_EXPRESS_ENDPOINT_URL = "http://host.openshell.internal:8000/v1";
+
+/** Reuse only the exact N1x Express selection recorded by onboarding. */
+export function stageRecordedManagedVllmIntent(
+  recreateOptions: Pick<RebuildRecreateOnboardOpts, "allowDeferredN1xManagedVllm">,
+  sandboxEntry: Pick<
+    RebuildSandboxEntry,
+    | "provider"
+    | "model"
+    | "endpointUrl"
+    | "endpointSource"
+    | "openshellDriver"
+    | "hostLocalInferenceReceipt"
+  >,
+  rebuildSelection: {
+    provider: string;
+    model: string;
+    pinEndpoint: boolean;
+    endpointUrl: string | null;
+  },
+): void {
+  const recordedEndpointUsesCanonicalLocalRoute =
+    sandboxEntry.endpointUrl === null || sandboxEntry.endpointUrl === N1X_EXPRESS_ENDPOINT_URL;
+  if (
+    sandboxEntry.provider !== N1X_EXPRESS_PROVIDER ||
+    sandboxEntry.model !== N1X_EXPRESS_MODEL ||
+    !recordedEndpointUsesCanonicalLocalRoute ||
+    sandboxEntry.endpointSource !== "onboard" ||
+    sandboxEntry.openshellDriver !== "docker" ||
+    rebuildSelection.provider !== sandboxEntry.provider ||
+    rebuildSelection.model !== sandboxEntry.model ||
+    rebuildSelection.pinEndpoint !== true ||
+    rebuildSelection.endpointUrl !== null
+  ) {
+    return;
+  }
+  const serialized = sandboxEntry.hostLocalInferenceReceipt;
+  if (serialized === undefined || serialized === null) {
+    recreateOptions.allowDeferredN1xManagedVllm = true;
+    return;
+  }
+  try {
+    const receipt = parseHostLocalInferenceReceipt(serialized);
+    if (
+      receipt.service === "vllm" &&
+      receipt.endpoint.host === "host.openshell.internal" &&
+      receipt.endpoint.port === 8000 &&
+      receipt.inference?.model === N1X_EXPRESS_MODEL
+    ) {
+      recreateOptions.allowDeferredN1xManagedVllm = true;
+    }
+  } catch {
+    // Malformed durable state must not grant the narrow N1x readiness exception.
+  }
+}
+
 export interface RebuildPreparedTarget {
   targetConfig: RebuildTargetConfig;
   recreateOptions: RebuildRecreateOnboardOpts;
@@ -233,6 +292,7 @@ export async function prepareRebuildTargetPreflights(args: {
   recreateOptions.observabilityEnabled =
     requestedObservabilityEnabled ?? recreateOptions.observabilityEnabled;
   recreateOptions.observabilityRequestedExplicitly = requestedObservabilityEnabled !== undefined;
+  stageRecordedManagedVllmIntent(recreateOptions, sandboxEntry, resumeConfig);
   if (
     !stageRebuildHermesDashboardConfig(
       rebuildAgent,