nemoclaw-community/examples/recipes/nvidia/pr-review-advisor/review-profiles/nemoclaw.yaml at 15193cfd351867549ca372d8fb3eadc5fe233d37 · maggiezha/nemoclaw-community · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Public worked example of the profile used to review NemoClaw. This evidence
# is pinned to the stated published tag; regenerate it before using it against
# a newer trusted release or default branch.

schema_version: 1
kind: review-advisor-profile
metadata:
  name: NVIDIA NemoClaw
  source_commit: d87acc16b04c065ddc26c294a6c3af6795a43d7b
  source_ref: refs/tags/v0.0.94
repository:
  identity: NVIDIA/NemoClaw
  default_branch: main
review_scope:
  mode: repository
  roots: []
  support_paths: []
required_stages:
  - scope
  - correctness
  - security
  - tests
  - operations
  - reconcile
  - synthesize
components:
  - id: host-cli-and-lifecycle
    paths:
      - "src/**"
      - "scripts/**"
    evidence:
      - source: package.json and src command layout at the pinned trusted commit
  - id: sandbox-agents
    paths:
      - "agents/**"
      - "nemoclaw-blueprint/**"
    evidence:
      - source: agent manifests, Dockerfiles, policies, and shared blueprint at the pinned trusted commit
  - id: automation-and-release
    paths:
      - ".github/**"
      - "package.json"
    evidence:
      - source: workflow and package metadata at the pinned trusted commit
  - id: maintainer-policy
    paths:
      - ".agents/**"
      - "SECURITY.md"
      - "WRITING.md"
    evidence:
      - source: maintainer review, security, and writing policy at the pinned trusted commit
  - id: validation
    paths:
      - "test/**"
      - "tools/e2e/**"
    evidence:
      - source: repository test and E2E layout at the pinned trusted commit
priorities:
  - id: sandbox-trust-boundary
    title: Preserve the host, gateway, sandbox, and agent trust boundaries
    rationale: Changes to policy, credentials, lifecycle, tool exposure, persistence, or publishing can widen authority beyond the reviewed feature.
    evidence:
      - path: SECURITY.md
        oid: 4525724d8a0a0302ac3ff0d28b13e38ac0f07fd9
  - id: exact-head-and-publisher-separation
    title: Bind review evidence and publication to the exact PR head
    rationale: Model-bearing analysis stays read-only; write authority belongs to a separate publisher that rejects stale artifacts.
    evidence:
      - path: .github/workflows/pr-review-advisor.yaml
        oid: 0b6475490610a0a7bc4bbdf14a983045a24c0c6d
      - path: tools/pr-review-advisor/README.md
        oid: 4e5446a77a92e7e39ba9cd173ad4299a51fe1786
  - id: security-review-rubric
    title: Apply the complete NemoClaw security review rubric
    rationale: Security review covers credentials, egress, sandbox boundaries, authorization, dependencies, persistence, workflows, and disclosure—not only obvious secret handling.
    evidence:
      - path: .agents/skills/nemoclaw-maintainer-security-code-review/SKILL.md
        oid: cadc44587f295512694ef023a7b9772ab38b4080
  - id: acceptance-source-of-truth-and-simplification
    title: Bind acceptance to maintainer decisions and challenge unnecessary workarounds
    rationale: Observable outcomes, supported contracts, constraints, and explicit maintainer decisions are binding; proposed designs are context, and local workarounds need current consumers plus a smaller-native-path check.
    evidence:
      - path: tools/pr-review-advisor/analyze.mts
        oid: b646622d8269061a36cbfa800f25582d07097dfe
  - id: deterministic-regression-and-e2e
    title: Ground regression and E2E guidance in trusted repository inventory
    rationale: Validation recommendations must preserve deterministic risk-plan requirements and supported E2E selectors instead of relying on model-authored test names.
    evidence:
      - path: tools/advisors/risk-plan.mts
        oid: 1896381315f919cb55a8a962bf2399af806790e2
      - path: tools/advisors/e2e-recommendations.mts
        oid: 62bde0712f0bc1e5aa73a4f52d55497f2c2fd744
  - id: repository-writing-contract
    title: Keep user-facing behavior and documentation precise
    rationale: Review public claims, defaults, and examples against the implementation and the repository writing contract.
    evidence:
      - path: WRITING.md
        oid: 731a76acb3c081680eb8eae3240f57846ac94be9
  - id: dependency-and-release-contract
    title: Preserve pinned dependency and release behavior
    rationale: Dependency, image, installer, and workflow changes can affect every supported environment and require explicit verification.
    evidence:
      - path: package.json
        oid: 59d9c86aba0b8cdcdae0aed3ae926d4624c63856
test_surfaces:
  - path: "test/**"
    oid: a66b0d9634f0f6d4154b31020b6dbc7e345ac32f
evidence_policy:
  memory_is_hint_only: true
  require_current_code_evidence: true
unresolved_questions:
  - Which live provider and sandbox runtime paths require E2E evidence beyond repository tests?
  - Does the change alter installation, migration, rollback, or release compatibility?
  - Are security-sensitive exceptions explicitly accepted and narrowly scoped?