ci(test): clarify test loop remediation

[cv]

Summary

Clarifies the test-loop growth guardrail as a per-file count ratchet. Failures now direct iteration for one behavior to a named helper outside the test callback and independent rows to it.each or test.each, without changing which loops the scanner detects.

Changes

• Rename scanner, workflow, and evaluator output from table-test candidates to test loops.
• Describe the ratchet as a per-file count check and provide both supported remediation paths.
• Add coverage for named-helper iteration, report terminology, and the exact entrypoint diagnostic.
• Update the trusted workflow step name and bind its exact source hash in the workflow-boundary policy.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This internal contributor CI guardrail does not change a user-facing NemoClaw command, configuration, runtime workflow, or supported product behavior.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: The trusted pull_request_target workflow remains read-only, checks out the base repository, parses pull-request blobs as data, and retains an exact step-source hash verified by the workflow-boundary test.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Reviewed all seven changed CI guardrail, scanner, policy-evaluator, workflow-boundary, and test files. This internal contributor guardrail refinement does not change a user-facing NemoClaw command, configuration, runtime workflow, or supported product behavior.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project integration test/test-loops-scanner.test.ts test/growth-guardrails-test-loops.test.ts test/growth-guardrails-entrypoints.test.ts test/growth-guardrails-workflow-boundary.test.ts (4 files, 36 tests passed)
• Applicable broad gate passed — npm run check completed the structural, formatting, lint, repository, secret, YAML, shell, container, E2E support, workflow, and plugin gates, then failed in CLI/integration coverage on unrelated host-sensitive state (84 tests across 10 files, including a foreign user systemd unit, writable Codex parent directory, DGX Spark detection, and Git-fixture isolation).
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Updated test-loop guardrails and diagnostics to consistently identify increases in test loops.
  • Improved guidance for resolving violations, including using linear callbacks, named helpers, and parameterized tests.
  • Confirmed loops in approved helper contexts and hooks are handled correctly.

• Tests

  • Expanded coverage for loop detection, reporting, exemptions, and workflow enforcement.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 38112783-f872-485e-9e45-3ca2b801b984

📥 Commits

Reviewing files that changed from the base of the PR and between 1feaf2b and 1ca622e.

📒 Files selected for processing (7)

• .github/workflows/codebase-growth-guardrails.yaml
• scripts/growth-guardrails/find-test-loops.mts
• test/growth-guardrails-entrypoints.test.ts
• test/growth-guardrails-test-loops.test.ts
• test/test-loops-scanner.test.ts
• tools/growth-guardrails/test-loops.mts
• tools/growth-guardrails/workflow-boundary.mts

Included review availability: Your plan includes up to 12 reviews per rolling hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request broadens growth-guardrail terminology from table-test candidate loops to test loops. It updates scanner reports, policy diagnostics, workflow validation, and related tests. Scanner tests also cover named helper iteration and report formatting.

Changes

Test-loop guardrail

Layer / File(s)	Summary
Scanner reporting and coverage scripts/growth-guardrails/find-test-loops.mts, test/test-loops-scanner.test.ts	Scanner documentation and reports now use “test loop” terminology. Tests cover named helpers, ignored loop forms, and formatted reports.
Guardrail policy and diagnostics tools/growth-guardrails/test-loops.mts, test/growth-guardrails-entrypoints.test.ts, test/growth-guardrails-test-loops.test.ts	Policy messages and assertions now describe test-loop count increases and recommend named helpers or parameterized tests.
Workflow guardrail wiring .github/workflows/codebase-growth-guardrails.yaml, tools/growth-guardrails/workflow-boundary.mts	The workflow step and approved boundary hash now identify the test-loop-count guardrail.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 1ca62

This change only clarifies an internal test-loop growth guardrail and its remediation guidance; targeted tests pass, and no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• NVIDIA/NemoClaw#9259: Introduced the scanner, guardrail evaluator, workflow step, and tests refined by this change.

Suggested labels: area: ci, chore

Suggested reviewers: senthilr-nv

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: clarifying test-loop remediation in CI.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/refine-test-loop-guardrail

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 1ca622e in the codex/refine-test-lo... branch remains at 96%, unchanged from commit 1feaf2b in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 1ca622e in the codex/refine-test-lo... branch is 82%. The coverage in commit 3e4cd78 in the main branch is 83%.

Show a code coverage summary of the most impacted files.

File	main 3e4cd78	codex/refine-test-lo... 1ca622e	+/-
src/lib/cua/bounded-file.ts	94%	84%	-10%
src/lib/cua/run...ime-manifest.ts	91%	84%	-7%
src/lib/state/o...d-checkpoint.ts	91%	87%	-4%
src/lib/onboard...nt-authority.ts	79%	75%	-4%
src/lib/trace.ts	94%	90%	-4%
src/lib/onboard...press-resume.ts	79%	82%	+3%
src/lib/state/p...l-retirement.ts	86%	89%	+3%
src/lib/onboard...file-builder.ts	90%	95%	+5%
src/lib/onboard...der/snapshot.ts	75%	83%	+8%
src/lib/securit...ntial-filter.ts	72%	88%	+16%

---

_{Updated August 16, 2026 22:50 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed after a partial review · low confidence · 0 blockers · 0 warnings · 0 suggestions

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

3 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• justified — test loop at tools/growth-guardrails/test-loops.mts:4: Use test loop for this scanner result and retain the scanner context to describe its location.
• established — named helper at tools/growth-guardrails/test-loops.mts:129: Retain named helper for the remediation path outside a test callback.
• replace — table-test candidate at test/test-loops-scanner.test.ts:132: Use test loop in explanatory output. Retain table-test candidate only in the negative assertion that verifies its removal.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: None

Manual-only E2E: managed-image-multiarch-startup
The manual PR workflow does not run these selectors for the commit under review. Run them from reviewed code on main.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.