ci(e2e): select OpenShell 0.0.106 by prekshivyas · Pull Request #9378 · NVIDIA/NemoClaw

prekshivyas · 2026-08-18T00:53:01Z

Summary

The trusted full-E2E workflow qualifies OpenShell 0.0.106 while the supported NemoClaw product pin remains 0.0.101. This prerequisite now uses the product installer plus one declarative qualification identity for the reviewed 0.0.106 CLI, gateway, sandbox, and supervisor runtime.

Changes

Delete the parallel E2E-only installer and keep scripts/install-openshell.sh as the sole installer implementation.
Add the complete reviewed 0.0.106 pin cohort to scripts/install-openshell.sh; the supported default remains 0.0.101.
Define one 0.0.106 qualification record for the version, source commit, archive hashes, binary hashes, and supervisor digest.
Reuse that record for workflow selection, both provenance payloads, dependency checks, and workflow boundary checks.
Use the base-trusted multi-release verifier to check each complete nine-asset cohort independently. Keep the Brev product selector on 0.0.101.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification:
Docs updated for user-facing behavior changes
Docs not applicable — justification: This changes internal E2E qualification only; supported product behavior and the 0.0.101 product pin do not change.
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Nine-category maintainer security review passed for e1166f5c3. Credential variables are removed before installation, candidate-controlled shell generation is absent, workflows invoke one checked-in installer, fixed SHA-256 and OCI digest identities bind 0.0.106, the base verifier checks both cohorts, and product defaults and authorization boundaries are unchanged.
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

Documentation writer subagent reviewed the completed changes
Result: no-docs-needed
Evidence: No documentation paths changed. The change affects internal E2E qualification only; supported product behavior and the OpenShell 0.0.101 product default do not change.
Agent: Codex Desktop

DGX Station Hardware Evidence

Tested on DGX Station
Tested commit:
Station profile/scenario:
Result:
Supporting evidence:

Verification

Signed-off-by: Prekshi Vyas prekshiv@nvidia.com
Signed-off-by: Carlos Villela cvillela@nvidia.com

copy-pr-bot · 2026-08-18T00:53:05Z

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

coderabbitai · 2026-08-18T00:53:14Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5f8cb6fa-c656-4328-a393-13556d24edf3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

github-actions · 2026-08-18T00:59:09Z

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: Review the warnings below.
Findings: 0 blockers · 1 warning · 0 suggestions

Model lanes

GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 1 warning · 0 suggestions
Nemotron 3 Ultra (second opinion): Failed after a partial review · low confidence · 2 blockers · 5 warnings · 0 suggestions

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

3 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

established — qualification identity at tools/e2e/mcp-workflow-boundary.mts:483: Continue to use “qualification identity” for the selected qualification release and its artifact values.
define — product pin at test/dependency-pins-check.test.ts:226: Define “product pin” at its first explanatory use as the supported product version.
justified — exact credential-free OpenShell 0.0.106 install at tools/e2e/openshell-gateway-auth-contract-workflow-boundary.mts:164: Continue to use “credential-free” only when the installation environment removes credential access.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: None

Manual-only E2E: cloud-onboard, managed-image-multiarch-startup, security-posture, cloud-inference
The manual PR workflow does not run these selectors for the commit under review. Run them from reviewed code on main.

3 optional E2E recommendations

openshell-gateway-auth-contract
mcp-bridge
openshell-credential-generation-window

1 warning · 0 suggestions

Warnings

Warnings do not block.

`PRA-1` Warning — Cover qualification installer materialization

Location: tools/e2e/openshell-qualification.mts:75
Category: tests
Problem: The test suite checks that the generated installer parses with Bash, but it does not verify the generated archive-pin and sandbox-version mappings or the failure path for a changed canonical pin owner.
Impact: A future edit can produce a syntactically valid installer that downloads an unverified archive, uses an incorrect sandbox-version mapping, or silently loses the expected transformation.
Recommendation: Add fixture-based tests for materializeOpenShellQualificationInstaller that verify every 0.0.106 archive hash and standalone-sandbox mapping, preserve the canonical 0.0.101 source table, and reject missing or duplicate canonical pin owners.
Verification: Read test/e2e/support/openshell-gateway-auth-contract-workflow-boundary.test.ts and verify that it only runs bash -n on the materialized installer.
Test coverage: A unit test that materializes controlled installer fixtures, asserts each qualification mapping, and asserts that missing and duplicate source pin cases throw.
Evidence: tools/e2e/openshell-qualification.mts:75-105 transforms archive pins and adds a sandbox digest mapping. test/e2e/support/openshell-gateway-auth-contract-workflow-boundary.test.ts:25-54 only checks validateOpenShellQualificationInstaller and bash -n for the materialized installer.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

Prerequisite-PR: NVIDIA#9378 Prerequisite-Commit: fd6f90e Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

jyaunches

Could this migration keep scripts/install-openshell.sh as the one installer? The new tools/e2e/install-openshell-v00106-qualification.sh repeats the existing installer OS and architecture checks, archive validation, download, installation, and version verification in 84 lines. The workflow already used scripts/install-openshell.sh with NEMOCLAW_OPENSHELL_PIN_VERSION. Adding the reviewed 0.0.106 pins to that owner would remove the parallel installer while leaving the default supported pin at 0.0.101.

Please also consider one declarative 0.0.106 identity record for the version, source commit SHA, archive hashes, binary hashes, and supervisor digest. The current diff copies parts of that identity across the new installer, tools/e2e/mcp-workflow-boundary.mts, .github/workflows/e2e.yaml, and tests. expectedOpenShellE2eVersion then adds another hard-coded transition rule. A shared record consumed by installation, provenance generation, and boundary checks would reduce lines of code and make the next version change update one source. It would also let the two nearly identical provenance JSON blocks use one helper.

This is a simplicity and refactoring suggestion. I did not find missing validation in the current path.

jyaunches

LOC Reduction / Codebase Simplicity Review

Why this blocks

tools/e2e/install-openshell-v00106-qualification.sh duplicates the existing installer path in about 84 lines.
The 0.0.106 version, source SHA, archive digest, binary digests, and supervisor digest are repeated across the installer, workflow boundary, workflow, and tests.

Refactor direction

Keep scripts/install-openshell.sh as the one installer and add the reviewed 0.0.106 pins to its existing version owner.
Retain 0.0.101 as the supported default.
Define one declarative 0.0.106 identity record and consume it from installation, provenance generation, and boundary checks.
Reuse one helper for the two provenance JSON blocks.

Expected result

Delete the parallel qualification installer.
Reduce hard-coded transition rules and make the next OpenShell update change one source of truth.

jyaunches

LOC Reduction / Codebase Simplicity Review\n\nRequesting changes because this PR adds a second OpenShell installer and repeats one provenance record across the installer, workflow boundary, workflow, and tests. Reuse �[0;32m[install]�[0m Detected macOS (aarch64)

�[0;32m[install]�[0m Installing OpenShell from release 'v0.0.101'...
�[0;32m[install]�[0m Downloading OpenShell Homebrew formula...
�[0;32m[install]�[0m staging Homebrew formula in tap nvidia/openshell...
�[0;32m[install]�[0m installing OpenShell with Homebrew...
==> Would install 1 formula:
openshell
==> Installing openshell from nvidia/openshell, add the reviewed 0.0.106 pins to its existing version owner while retaining 0.0.101 as the supported default, and generate the version, source SHA, archive digest, binary digests, and supervisor digest from one declarative record. This should remove and the duplicated provenance JSON without weakening qualification.

Superseded by the correctly rendered structured LOC Reduction / Codebase Simplicity Review.

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

copy-pr-bot · 2026-08-18T03:20:57Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

prekshivyas self-assigned this Aug 18, 2026

ci(e2e): select OpenShell 0.0.106

fd6f90e

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

prekshivyas force-pushed the codex/openshell-0106-e2e-selector branch from 9de04aa to fd6f90e Compare August 18, 2026 00:59

prekshivyas added a commit to prekshivyas/NemoClaw that referenced this pull request Aug 18, 2026

merge(openshell): stack E2E selector prerequisite

ae3c299

Prerequisite-PR: NVIDIA#9378 Prerequisite-Commit: fd6f90e Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

prekshivyas mentioned this pull request Aug 18, 2026

chore(deps): update OpenShell to 0.0.106 #9192

Open

23 tasks

jyaunches reviewed Aug 18, 2026

View reviewed changes

jyaunches requested changes Aug 18, 2026

View reviewed changes

jyaunches previously requested changes Aug 18, 2026

View reviewed changes

merge(stack): sync OpenShell trust prerequisite

fce6cca

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

prekshivyas changed the base branch from nemopatch-stack/openshell-0.0.106-pr-9224-9b8d25b8c396 to nemopatch-stack/openshell-0.0.106-pr-9224-44c2636d August 18, 2026 03:22

prekshivyas marked this pull request as ready for review August 18, 2026 05:50

refactor(e2e): share OpenShell qualification identity

6b997b6

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

cv approved these changes Aug 18, 2026

View reviewed changes

prekshivyas and others added 10 commits August 17, 2026 23:47

fix(ci): preserve base-trusted installer table

55f4d5e

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

test: apply qualification test formatting

314ae77

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

fix(ci): use the checked-in OpenShell installer

74b1a26

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

docs(ci): distinguish OpenShell release cohorts

a081e15

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

fix(ci): retain base-trusted installer cohort

0cfa9eb

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

fix(ci): restore checked-in OpenShell installer

3cbcc5c

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

ci: refresh trusted qualification base

76fcafb

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

fix(ci): preserve trusted installer template

1f5fa08

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

ci(e2e): refresh OpenShell qualification checks

a4891e8

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

docs(ci): describe OpenShell release cohorts

e1166f5

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

Navigation Menu

Uh oh!

ci(e2e): select OpenShell 0.0.106 - #9378

ci(e2e): select OpenShell 0.0.106#9378
prekshivyas wants to merge 13 commits into
NVIDIA:nemopatch-stack/openshell-0.0.106-pr-9224-44c2636dfrom
prekshivyas:codex/openshell-0106-e2e-selector

prekshivyas commented Aug 18, 2026 •

edited by cv

Loading

Uh oh!

copy-pr-bot Bot commented Aug 18, 2026

Uh oh!

coderabbitai Bot commented Aug 18, 2026 •

edited

Loading

Review skipped

Uh oh!

github-actions Bot commented Aug 18, 2026 •

edited

Loading

Warnings

`PRA-1` Warning — Cover qualification installer materialization

Uh oh!

jyaunches left a comment

Uh oh!

jyaunches left a comment •

edited

Loading

Uh oh!

jyaunches left a comment

Uh oh!

copy-pr-bot Bot commented Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

prekshivyas commented Aug 18, 2026 • edited by cv Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Type of Change

Quality Gates

Documentation Writer Review

DGX Station Hardware Evidence

Verification

Uh oh!

copy-pr-bot Bot commented Aug 18, 2026

Uh oh!

coderabbitai Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — No blocking findings reported

Model lanes

E2E guidance

Warnings

PRA-1 Warning — Cover qualification installer materialization

Uh oh!

jyaunches left a comment

Choose a reason for hiding this comment

Uh oh!

jyaunches left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

LOC Reduction / Codebase Simplicity Review

Why this blocks

Refactor direction

Expected result

Uh oh!

jyaunches left a comment

Choose a reason for hiding this comment

LOC Reduction / Codebase Simplicity Review\n\nRequesting changes because this PR adds a second OpenShell installer and repeats one provenance record across the installer, workflow boundary, workflow, and tests. Reuse �[0;32m[install]�[0m Detected macOS (aarch64)

Uh oh!

copy-pr-bot Bot commented Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

prekshivyas commented Aug 18, 2026 •

edited by cv

Loading

coderabbitai Bot commented Aug 18, 2026 •

edited

Loading

github-actions Bot commented Aug 18, 2026 •

edited

Loading

`PRA-1` Warning — Cover qualification installer materialization

jyaunches left a comment •

edited

Loading