merge(main): refresh policy finality base

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>

Author: jyaunches

AGENTS.md

@@ -304,7 +304,7 @@ If the command trace contains no reviewer-request write, report the event as an
 **Adding a network policy preset:**
 
 - Add YAML to `nemoclaw-blueprint/policies/presets/`
-- Follow existing preset structure (see `slack.yaml`, `discord.yaml`)
+- Follow existing preset structure (see `github.yaml`, `brave.yaml`)
 
 **Adding model-specific sandbox compatibility:**
 

src/lib/core/ports.test.ts

@@ -6,9 +6,8 @@ import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import {
   parseGatewayPort,
   parsePort,
-  validateHttpsPinRuntimeAdapterPort,
   validateLlamaCppPortReservation,
-  validateOpenRouterRuntimeAdapterPort,
+  validateRuntimeAdapterPort,
 } from "./ports";
 
 const GATEWAY_VALIDATION_OPTIONS = {
@@ -181,68 +180,54 @@ describe("validateLlamaCppPortReservation", () => {
   });
 });
 
-describe("validateOpenRouterRuntimeAdapterPort", () => {
-  const ENV_KEY = "NEMOCLAW_OPENROUTER_RUNTIME_ADAPTER_PORT";
+describe("validateRuntimeAdapterPort", () => {
+  const ADAPTER_OWNERS = [
+    ["NEMOCLAW_BEDROCK_RUNTIME_ADAPTER_PORT", 11436, "Bedrock Runtime adapter"],
+    ["NEMOCLAW_OPENROUTER_RUNTIME_ADAPTER_PORT", 11437, "OpenRouter Runtime adapter"],
+    ["NEMOCLAW_HTTPS_PIN_RUNTIME_ADAPTER_PORT", 11438, "HTTPS Pin Runtime adapter"],
+  ] as const;
 
-  it("allows the default OpenRouter Runtime adapter port", () => {
-    expect(() =>
-      validateOpenRouterRuntimeAdapterPort(ENV_KEY, 11437, GATEWAY_VALIDATION_OPTIONS),
-    ).not.toThrow();
-  });
-
-  it.each([
+  const SHARED_CONFLICTS = [
     [8080, "NEMOCLAW_GATEWAY_PORT"],
     [8000, "vLLM / NIM inference"],
     [11434, "Ollama inference"],
     [11435, "Ollama auth proxy"],
-    [11436, "Bedrock Runtime adapter"],
-    [11438, "HTTPS Pin Runtime adapter"],
     [18790, "18789-18799"],
-  ])("rejects OpenRouter adapter overlap with %s", (port, expectedMessage) => {
-    expect(() =>
-      validateOpenRouterRuntimeAdapterPort(ENV_KEY, port, GATEWAY_VALIDATION_OPTIONS),
-    ).toThrow(expectedMessage);
-  });
+  ] as const;
 
-  it("rejects OpenRouter adapter overlap with configured service ports", () => {
+  it.each(ADAPTER_OWNERS)("allows the default port owned by %s", (ownerEnvVar, defaultPort) => {
     expect(() =>
-      validateOpenRouterRuntimeAdapterPort(ENV_KEY, 19001, {
-        ...GATEWAY_VALIDATION_OPTIONS,
-        vllmPort: 19001,
-      }),
-    ).toThrow("NEMOCLAW_VLLM_PORT");
-  });
-});
-
-describe("validateHttpsPinRuntimeAdapterPort", () => {
-  const ENV_KEY = "NEMOCLAW_HTTPS_PIN_RUNTIME_ADAPTER_PORT";
-
-  it("allows the default HTTPS Pin Runtime adapter port", () => {
-    expect(() =>
-      validateHttpsPinRuntimeAdapterPort(ENV_KEY, 11438, GATEWAY_VALIDATION_OPTIONS),
+      validateRuntimeAdapterPort(ownerEnvVar, defaultPort, GATEWAY_VALIDATION_OPTIONS),
     ).not.toThrow();
   });
 
-  it.each([
-    [8080, "NEMOCLAW_GATEWAY_PORT"],
-    [8000, "vLLM / NIM inference"],
-    [11434, "Ollama inference"],
-    [11435, "Ollama auth proxy"],
-    [11436, "Bedrock Runtime adapter"],
-    [11437, "OpenRouter Runtime adapter"],
-    [18790, "18789-18799"],
-  ])("rejects HTTPS Pin adapter overlap with %s", (port, expectedMessage) => {
-    expect(() =>
-      validateHttpsPinRuntimeAdapterPort(ENV_KEY, port, GATEWAY_VALIDATION_OPTIONS),
-    ).toThrow(expectedMessage);
+  it.each(
+    ADAPTER_OWNERS.flatMap(([ownerEnvVar, defaultPort]) =>
+      [
+        ...SHARED_CONFLICTS,
+        ...ADAPTER_OWNERS.filter(([, otherPort]) => otherPort !== defaultPort).map(
+          ([, otherPort, otherLabel]) => [otherPort, otherLabel] as const,
+        ),
+      ].map(([port, expectedMessage]) => [ownerEnvVar, port, expectedMessage] as const),
+    ),
+  )("rejects %s on %d because it overlaps %s", (ownerEnvVar, port, expectedMessage) => {
+    expect(() => validateRuntimeAdapterPort(ownerEnvVar, port, GATEWAY_VALIDATION_OPTIONS)).toThrow(
+      expectedMessage,
+    );
   });
 
-  it("rejects HTTPS Pin adapter overlap with configured service ports", () => {
+  it.each(ADAPTER_OWNERS)("rejects %s on a configured non-default service port", (ownerEnvVar) => {
     expect(() =>
-      validateHttpsPinRuntimeAdapterPort(ENV_KEY, 19001, {
+      validateRuntimeAdapterPort(ownerEnvVar, 19001, {
         ...GATEWAY_VALIDATION_OPTIONS,
         vllmPort: 19001,
       }),
     ).toThrow("NEMOCLAW_VLLM_PORT");
   });
+
+  it("validates against the live port configuration when no options are injected", () => {
+    expect(() =>
+      validateRuntimeAdapterPort("NEMOCLAW_BEDROCK_RUNTIME_ADAPTER_PORT", 11434),
+    ).toThrow("Ollama inference");
+  });
 });

src/lib/core/ports.ts

@@ -233,21 +233,6 @@ export function parseGatewayPort(
   return port;
 }
 
-export function validateOpenRouterRuntimeAdapterPort(
-  envVar: string,
-  port: number,
-  options: RuntimeAdapterPortValidationOptions,
-): void {
-  validateServicePort(envVar, port, options, "NEMOCLAW_OPENROUTER_RUNTIME_ADAPTER_PORT");
-}
-
-export function validateHttpsPinRuntimeAdapterPort(
-  envVar: string,
-  port: number,
-  options: RuntimeAdapterPortValidationOptions,
-): void {
-  validateServicePort(envVar, port, options, "NEMOCLAW_HTTPS_PIN_RUNTIME_ADAPTER_PORT");
-}
 /** OpenShell gateway port (default 8080, override via NEMOCLAW_GATEWAY_PORT). */
 export const GATEWAY_PORT = parseGatewayPort("NEMOCLAW_GATEWAY_PORT", DEFAULT_GATEWAY_PORT, {
   dashboardPort: DASHBOARD_PORT,
@@ -261,6 +246,35 @@ export const GATEWAY_PORT = parseGatewayPort("NEMOCLAW_GATEWAY_PORT", DEFAULT_GA
   httpsPinRuntimeAdapterPort: HTTPS_PIN_RUNTIME_ADAPTER_PORT,
 });
 
+/** The live host-port configuration every runtime adapter is validated against. */
+const CURRENT_RUNTIME_PORT_CONFIGURATION: RuntimeAdapterPortValidationOptions = {
+  gatewayPort: GATEWAY_PORT,
+  dashboardPort: DASHBOARD_PORT,
+  dashboardRangeStart: DASHBOARD_PORT_RANGE_START,
+  dashboardRangeEnd: DASHBOARD_PORT_RANGE_END,
+  vllmPort: VLLM_PORT,
+  ollamaPort: OLLAMA_PORT,
+  ollamaProxyPort: OLLAMA_PROXY_PORT,
+  bedrockRuntimeAdapterPort: BEDROCK_RUNTIME_ADAPTER_PORT,
+  openrouterRuntimeAdapterPort: OPENROUTER_RUNTIME_ADAPTER_PORT,
+  httpsPinRuntimeAdapterPort: HTTPS_PIN_RUNTIME_ADAPTER_PORT,
+};
+
+/**
+ * Reject a runtime adapter port that overlaps the dashboard allocation range, a
+ * reserved service default, or another configured service port. `ownerEnvVar`
+ * names the adapter being validated: it is both the variable reported in the
+ * error and the catalog entry excluded from the self-conflict check. Tests
+ * inject `options`; production callers use the live configuration above.
+ */
+export function validateRuntimeAdapterPort(
+  ownerEnvVar: string,
+  port: number,
+  options: RuntimeAdapterPortValidationOptions = CURRENT_RUNTIME_PORT_CONFIGURATION,
+): void {
+  validateServicePort(ownerEnvVar, port, options, ownerEnvVar);
+}
+
 /** Reject every configurable service collision with fixed llama.cpp attachment port 8081. */
 export function validateLlamaCppPortReservation(
   options: RuntimeAdapterPortValidationOptions,
@@ -275,15 +289,4 @@ export function validateLlamaCppPortReservation(
   }
 }
 
-validateLlamaCppPortReservation({
-  gatewayPort: GATEWAY_PORT,
-  dashboardPort: DASHBOARD_PORT,
-  dashboardRangeStart: DASHBOARD_PORT_RANGE_START,
-  dashboardRangeEnd: DASHBOARD_PORT_RANGE_END,
-  vllmPort: VLLM_PORT,
-  ollamaPort: OLLAMA_PORT,
-  ollamaProxyPort: OLLAMA_PROXY_PORT,
-  bedrockRuntimeAdapterPort: BEDROCK_RUNTIME_ADAPTER_PORT,
-  openrouterRuntimeAdapterPort: OPENROUTER_RUNTIME_ADAPTER_PORT,
-  httpsPinRuntimeAdapterPort: HTTPS_PIN_RUNTIME_ADAPTER_PORT,
-});
+validateLlamaCppPortReservation(CURRENT_RUNTIME_PORT_CONFIGURATION);

src/lib/inference/bedrock-runtime-adapter.ts

@@ -7,7 +7,7 @@ import path from "node:path";
 
 import { BedrockRuntimeClient } from "@aws-sdk/client-bedrock-runtime";
 
-import { BEDROCK_RUNTIME_ADAPTER_PORT } from "../core/ports";
+import { BEDROCK_RUNTIME_ADAPTER_PORT, validateRuntimeAdapterPort } from "../core/ports";
 import { compactText, isLoopbackRemoteAddress } from "../core/url-utils";
 import { run, runCapture, SCRIPTS } from "../runner";
 import { buildSubprocessEnv } from "../subprocess-env";
@@ -379,6 +379,7 @@ export async function ensureBedrockRuntimeAdapter(options: {
   token: string;
   region: string;
 }> {
+  validateRuntimeAdapterPort("NEMOCLAW_BEDROCK_RUNTIME_ADAPTER_PORT", BEDROCK_RUNTIME_ADAPTER_PORT);
   const region = resolveBedrockRuntimeRegion(options.classification);
   const endpointUrl = options.classification.endpointUrl;
   const compatibleCredential = options.compatibleCredential || null;

src/lib/inference/https-pin-runtime-adapter.ts

@@ -42,19 +42,7 @@ import http from "node:http";
 import { BlockList, isIP } from "node:net";
 import path from "node:path";
 
-import {
-  BEDROCK_RUNTIME_ADAPTER_PORT,
-  DASHBOARD_PORT,
-  DASHBOARD_PORT_RANGE_END,
-  DASHBOARD_PORT_RANGE_START,
-  GATEWAY_PORT,
-  HTTPS_PIN_RUNTIME_ADAPTER_PORT,
-  OLLAMA_PORT,
-  OLLAMA_PROXY_PORT,
-  OPENROUTER_RUNTIME_ADAPTER_PORT,
-  VLLM_PORT,
-  validateHttpsPinRuntimeAdapterPort,
-} from "../core/ports";
+import { HTTPS_PIN_RUNTIME_ADAPTER_PORT, validateRuntimeAdapterPort } from "../core/ports";
 import { retryUntilAsync } from "../core/retry";
 import { getVersion } from "../core/version";
 import { ROOT, run, runCapture } from "../runner";
@@ -1467,25 +1455,6 @@ async function withAdapterLock<T>(operation: () => Promise<T>): Promise<T> {
   throw new Error("HTTPS Pin Runtime adapter startup is already in progress");
 }
 
-function validateAdapterPortConfiguration(): void {
-  validateHttpsPinRuntimeAdapterPort(
-    "NEMOCLAW_HTTPS_PIN_RUNTIME_ADAPTER_PORT",
-    HTTPS_PIN_RUNTIME_ADAPTER_PORT,
-    {
-      dashboardPort: DASHBOARD_PORT,
-      dashboardRangeStart: DASHBOARD_PORT_RANGE_START,
-      dashboardRangeEnd: DASHBOARD_PORT_RANGE_END,
-      gatewayPort: GATEWAY_PORT,
-      vllmPort: VLLM_PORT,
-      ollamaPort: OLLAMA_PORT,
-      ollamaProxyPort: OLLAMA_PROXY_PORT,
-      bedrockRuntimeAdapterPort: BEDROCK_RUNTIME_ADAPTER_PORT,
-      openrouterRuntimeAdapterPort: OPENROUTER_RUNTIME_ADAPTER_PORT,
-      httpsPinRuntimeAdapterPort: HTTPS_PIN_RUNTIME_ADAPTER_PORT,
-    },
-  );
-}
-
 async function findReusableAdapterControlToken(
   priorToken: string | null,
   allowedSourceCidrs: readonly string[] = ["127.0.0.1/32"],
@@ -1523,7 +1492,10 @@ async function ensureAdapterProcessLocked(options: {
   routeId: string;
   allowedSourceCidrs: string[];
 }): Promise<string> {
-  validateAdapterPortConfiguration();
+  validateRuntimeAdapterPort(
+    "NEMOCLAW_HTTPS_PIN_RUNTIME_ADAPTER_PORT",
+    HTTPS_PIN_RUNTIME_ADAPTER_PORT,
+  );
   const priorToken = readLocalAdapterTextFile(TOKEN_PATH);
   // The authenticated, build-bound health response is stronger identity
   // evidence than a PID file. Reuse the live adapter even if its PID metadata

src/lib/inference/openrouter-runtime-adapter-lifecycle.ts

@@ -5,19 +5,7 @@ import fs from "node:fs";
 import http from "node:http";
 import path from "node:path";
 
-import {
-  BEDROCK_RUNTIME_ADAPTER_PORT,
-  DASHBOARD_PORT,
-  DASHBOARD_PORT_RANGE_END,
-  DASHBOARD_PORT_RANGE_START,
-  GATEWAY_PORT,
-  HTTPS_PIN_RUNTIME_ADAPTER_PORT,
-  OLLAMA_PORT,
-  OLLAMA_PROXY_PORT,
-  OPENROUTER_RUNTIME_ADAPTER_PORT,
-  VLLM_PORT,
-  validateOpenRouterRuntimeAdapterPort,
-} from "../core/ports";
+import { OPENROUTER_RUNTIME_ADAPTER_PORT, validateRuntimeAdapterPort } from "../core/ports";
 import { run, runCapture } from "../runner";
 import { buildSubprocessEnv } from "../subprocess-env";
 import {
@@ -209,25 +197,6 @@ function adapterRoute(): AdapterRoute {
   };
 }
 
-function validateAdapterPortConfiguration(): void {
-  validateOpenRouterRuntimeAdapterPort(
-    "NEMOCLAW_OPENROUTER_RUNTIME_ADAPTER_PORT",
-    OPENROUTER_RUNTIME_ADAPTER_PORT,
-    {
-      dashboardPort: DASHBOARD_PORT,
-      dashboardRangeStart: DASHBOARD_PORT_RANGE_START,
-      dashboardRangeEnd: DASHBOARD_PORT_RANGE_END,
-      gatewayPort: GATEWAY_PORT,
-      vllmPort: VLLM_PORT,
-      ollamaPort: OLLAMA_PORT,
-      ollamaProxyPort: OLLAMA_PROXY_PORT,
-      bedrockRuntimeAdapterPort: BEDROCK_RUNTIME_ADAPTER_PORT,
-      openrouterRuntimeAdapterPort: OPENROUTER_RUNTIME_ADAPTER_PORT,
-      httpsPinRuntimeAdapterPort: HTTPS_PIN_RUNTIME_ADAPTER_PORT,
-    },
-  );
-}
-
 function resolveAuthorizationHash(
   authorizationToken: string | null | undefined,
   priorState: JsonObject | null,
@@ -247,7 +216,10 @@ function resolveAuthorizationHash(
 async function ensureOpenRouterRuntimeAdapterLocked(
   options: EnsureOpenRouterRuntimeAdapterOptions = {},
 ): Promise<AdapterRoute> {
-  validateAdapterPortConfiguration();
+  validateRuntimeAdapterPort(
+    "NEMOCLAW_OPENROUTER_RUNTIME_ADAPTER_PORT",
+    OPENROUTER_RUNTIME_ADAPTER_PORT,
+  );
   const upstreamBaseUrl = OPENROUTER_ENDPOINT_URL;
   const configHash = adapterConfigHash(upstreamBaseUrl);
   const priorState = readLocalAdapterJsonFile(STATE_PATH);