Skip to content

test(e2e): enforce phase-aware onboard budgets#6732

Merged
cv merged 14 commits into
NVIDIA:mainfrom
HOYALIM:codex/issue-6660-phase-budget
Jul 13, 2026
Merged

test(e2e): enforce phase-aware onboard budgets#6732
cv merged 14 commits into
NVIDIA:mainfrom
HOYALIM:codex/issue-6660-phase-budget

Conversation

@HOYALIM

@HOYALIM HOYALIM commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

Summary

Replace the opaque full-E2E wall-clock assertion with a calibrated, phase-aware cold-onboard performance gate. The gate measures the actual onboard-root and first-turn boundaries, validates all trace evidence against the summarized root, and retains the existing functional, silence, and BuildKit assertions.

Related Issue

Closes #6660.

Changes

  • Require budgets for root-start to first-turn completion, root-end to first-turn completion, and all five stable onboarding phases.
  • Bind the accepted root and phases to one trace and validate parentage, status, timestamps, containment, duration consistency, uniqueness, and phase order.
  • Emit a versioned artifact with exact millisecond measurements, configured budgets, and violations.
  • Trace the gateway phase for healthy reuse and failure paths as well as normal startup.
  • Record five independent exact-head calibration samples and deterministically derive each budget using nearest-rank p95 plus max(5s, 10%) headroom, rounded up to one second.

Calibration Evidence

Measurement head: 4544d07c8bfd500c3b64a74380ef5cd0e62089f5

Verification

  • 151 focused Vitest cases across gateway tracing, performance evidence, calibration, and config schemas
  • npm run check:diff (includes config validation, source-shape, test-size, typecheck, commit lint, and security/lint hooks)
  • Exact-head regular CI: run 29289285415
  • Exact-head PR Advisor: run 29289282834 (canonical ledger: 0 actionable findings)
  • Exact-head trusted E2E selectors cloud-onboard, credential-sanitization, security-posture, full-e2e, onboard-repair, and onboard-resume: run 29289301062
  • CodeRabbit status green; no unresolved review threads

Signed-off-by: Ho Lim subhoya@gmail.com

Summary by CodeRabbit

  • New Features
    • Added configurable full cold-path onboarding performance budgets, including root-start/root-end completion budgets and required per-phase limits (with sandbox included).
    • E2E cold onboarding now loads the full performance budget from checked calibration data and reports structured pass/fail results with detailed timing violations.
  • Bug Fixes
    • Strengthened JSON schema and runtime validation to require the full cold-path budget shape, enforce root budget ordering, and reject unknown/malformed or negative values.
  • Tests
    • Expanded E2E/fixtures to model per-phase timing windows, validate calibration-derived budget invariants, and add trace/assertion coverage for onboarding phase behavior.

Copilot AI review requested due to automatic review settings July 12, 2026 23:10
@copy-pr-bot

copy-pr-bot Bot commented Jul 12, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@coderabbitai

coderabbitai Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Cold onboarding performance validation now uses calibrated root and phase-specific budgets. Trace parsing records ordered onboarding phases, evaluation reports violations, and the full-E2E test persists detailed measurements before asserting the result.

Changes

Cold onboard performance budgets

Layer / File(s) Summary
Budget schema and calibration contract
ci/full-e2e-cold-path-calibration.json, ci/onboard-performance-budget.json, schemas/onboard-config.schema.json, scripts/validate-configs.ts, test/onboard-performance-config-schema.test.ts, test/validate-config-schemas.test.ts, ci/source-shape-test-budget.json
Defines strict full-E2E root and phase budgets, records calibration samples and derived thresholds, and enables $data-based AJV validation.
Phase trace evaluation
test/e2e/fixtures/onboard-performance.ts, test/e2e/support/onboard-performance.test.ts
Extracts required ordered onboarding phase durations, validates budget shapes, evaluates root and phase limits, and tests malformed traces and violations.
Full-E2E budget enforcement
test/e2e/live/full-e2e.test.ts
Loads the configured budget, evaluates cold onboarding performance, writes a v2 metrics artifact, and asserts that the evaluation passes.
Gateway phase tracing
src/lib/onboard/machine/handlers/gateway.ts, src/lib/onboard/machine/handlers/gateway.test.ts
Scopes gateway handling under the gateway phase trace and verifies emitted span status and attributes for healthy gateway reuse and recovery failure.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

  • NVIDIA/NemoClaw#4598: Also modifies handleGatewayState while changing related gateway control flow.

Suggested labels: area: performance

Suggested reviewers: ericksoa, cv, laitingsheng

Sequence Diagram(s)

sequenceDiagram
  participant FullE2ETest
  participant BudgetFile
  participant OnboardTrace
  participant PerformanceFixtures
  FullE2ETest->>BudgetFile: Load fullE2E cold-path budget
  FullE2ETest->>OnboardTrace: Capture root and phase spans
  FullE2ETest->>PerformanceFixtures: Evaluate root and phase timings
  PerformanceFixtures-->>FullE2ETest: Return passed and violations
  FullE2ETest->>FullE2ETest: Record metrics and assert performance
Loading
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed The PR matches #6660 by replacing the wall-clock gate with phase-aware calibrated budgets while preserving the required functional assertions.
Out of Scope Changes check ✅ Passed The additional schema, tracing, and test updates support the same onboarding performance-budget work and do not appear unrelated.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: enforcing phase-aware onboard performance budgets in e2e tests.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

E2E Advisor Recommendation

Required E2E: cloud-onboard, full-e2e
Optional E2E: None

Dispatch hint: cloud-onboard,full-e2e

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: target/main
Head: HEAD
Confidence: high

Required E2E

  • cloud-onboard: Required validation floor from the deterministic risk plan: verify the public installer and hosted onboarding flow on a clean runner.
  • full-e2e: The PR changes the live full-E2E cold-path budget, trace-phase evidence requirements, and pass/fail enforcement for install, sandbox onboarding, and first hosted assistant response.

Optional E2E

  • None.

New E2E recommendations

  • None.

Dispatch hint

  • Workflow: .github/workflows/e2e.yaml
  • jobs input: cloud-onboard,full-e2e

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
schemas/onboard-config.schema.json (1)

8-16: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Add fullE2eColdPath to the root required list. readColdOnboardPerformanceBudget() throws when the key is missing, but schemas/onboard-config.schema.json currently allows ci/onboard-performance-budget.json to omit it, so the failure is deferred until the live full-e2e run.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@schemas/onboard-config.schema.json` around lines 8 - 16, Add fullE2eColdPath
to the root required list in schemas/onboard-config.schema.json so
configurations validated by the schema must include the key before
readColdOnboardPerformanceBudget() processes them.
🧹 Nitpick comments (1)
test/e2e/live/full-e2e.test.ts (1)

194-222: 🚀 Performance & Scalability | 🔵 Trivial

Consider validating the cold-path budget before the expensive onboarding run.

readFullE2eColdPathBudget() is only invoked here, after input.install and the first agent turn have already completed on the hosted runner. If ci/onboard-performance-budget.json is malformed, the failure surfaces only after the full (expensive, credential-gated) cold-onboard cycle finishes. This is largely mitigated by the separate schema/unit tests catching malformed configs earlier in CI, but hoisting the budget read to the start of the test would fail fast and avoid burning a live cold-onboard run on a config typo that slipped past those checks.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/live/full-e2e.test.ts` around lines 194 - 222, Move the
readFullE2eColdPathBudget() call to the beginning of the cold-path test, before
input.install and the first agent turn execute, and reuse that budget for
evaluateColdOnboardPerformance and the artifact output. Preserve the existing
budget validation and reporting behavior while ensuring malformed configuration
fails before the expensive onboarding run.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@schemas/onboard-config.schema.json`:
- Around line 8-16: Add fullE2eColdPath to the root required list in
schemas/onboard-config.schema.json so configurations validated by the schema
must include the key before readColdOnboardPerformanceBudget() processes them.

---

Nitpick comments:
In `@test/e2e/live/full-e2e.test.ts`:
- Around line 194-222: Move the readFullE2eColdPathBudget() call to the
beginning of the cold-path test, before input.install and the first agent turn
execute, and reuse that budget for evaluateColdOnboardPerformance and the
artifact output. Preserve the existing budget validation and reporting behavior
while ensuring malformed configuration fails before the expensive onboarding
run.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 06251a19-8860-41c8-9971-c468b8a78da6

📥 Commits

Reviewing files that changed from the base of the PR and between 13bece6 and 6101706.

📒 Files selected for processing (6)
  • ci/onboard-performance-budget.json
  • schemas/onboard-config.schema.json
  • test/e2e/fixtures/onboard-performance.ts
  • test/e2e/live/full-e2e.test.ts
  • test/e2e/support/onboard-performance.test.ts
  • test/validate-config-schemas.test.ts

@wscurran wscurran added area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure area: onboarding Onboarding FSM, provider setup, sandbox launch, or first-run flow chore Build, CI, dependency, or tooling maintenance labels Jul 12, 2026
@wscurran

Copy link
Copy Markdown
Contributor

✨ Thanks for the test infrastructure work, @HOYALIM. Phase-aware onboard budgets will give us much clearer signal on where regressions occur. Ready for maintainer review.


Related open issues:

@cv cv added the v0.0.82 Release target label Jul 13, 2026
Signed-off-by: Ho Lim <subhoya@gmail.com>
@HOYALIM
HOYALIM force-pushed the codex/issue-6660-phase-budget branch from 6101706 to db03d61 Compare July 13, 2026 06:39

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
test/e2e/live/full-e2e.test.ts (1)

142-155: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Load the budget before the expensive turn, not after.

readFullE2eColdPathBudget() is only called at line 194, after the network-bound execShell first-agent-turn call (lines 179-191, bounded by FIRST_TURN_TIMEOUT_MS) has already completed. If ci/onboard-performance-budget.json is missing or invalid, the test still pays for that round trip before discovering the config error. Since the budget read/validation is cheap and independent of the timed cold-onboard window, hoist it to the top of assertColdOnboardPerformance (or even before readAndDeleteTraceWindow) to fail fast on bad config.

♻️ Proposed reordering
 ): Promise<void> {
+  const budget = readFullE2eColdPathBudget();
   const traceWindow = readAndDeleteTraceWindow(input.traceFile, input.traceDirectory);
   ...
   const totalMs = Date.now() - traceWindow.startedAtMs;
   const totalSecs = Math.ceil(totalMs / 1_000);
-  const budget = readFullE2eColdPathBudget();
   const performance = evaluateColdOnboardPerformance(traceWindow, totalMs, budget);

Also applies to: 192-195

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/live/full-e2e.test.ts` around lines 142 - 155, Move the
readFullE2eColdPathBudget() call to the beginning of
assertColdOnboardPerformance, before readAndDeleteTraceWindow and the
network-bound execShell first-agent-turn operation. Preserve the existing budget
validation and later use, ensuring missing or invalid configuration fails before
the timed cold-onboard work starts.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/e2e/live/full-e2e.test.ts`:
- Around line 142-155: Move the readFullE2eColdPathBudget() call to the
beginning of assertColdOnboardPerformance, before readAndDeleteTraceWindow and
the network-bound execShell first-agent-turn operation. Preserve the existing
budget validation and later use, ensuring missing or invalid configuration fails
before the timed cold-onboard work starts.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 86af9247-7a1a-4100-a18a-d657020107f6

📥 Commits

Reviewing files that changed from the base of the PR and between 6101706 and db03d61.

📒 Files selected for processing (6)
  • ci/onboard-performance-budget.json
  • schemas/onboard-config.schema.json
  • test/e2e/fixtures/onboard-performance.ts
  • test/e2e/live/full-e2e.test.ts
  • test/e2e/support/onboard-performance.test.ts
  • test/validate-config-schemas.test.ts
🚧 Files skipped from review as they are similar to previous changes (5)
  • schemas/onboard-config.schema.json
  • test/e2e/support/onboard-performance.test.ts
  • ci/onboard-performance-budget.json
  • test/validate-config-schemas.test.ts
  • test/e2e/fixtures/onboard-performance.ts

@cjagwani cjagwani left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed exact head db03d61. Exact-head live runs alone will not make this approval-ready:

  1. Schema/runtime mismatch: schemas/onboard-config.schema.json:8-16 does not require fullE2eColdPath, and test/validate-config-schemas.test.ts:284-298 explicitly accepts its absence. Runtime unconditionally requires it and also enforces postOnboardBudgetMs <= totalBudgetMs (onboard-performance.ts:63-96), while schema accepts both invalid states. Align schema and runtime, including the cross-field constraint.

  2. Diagnostics are numerically false: independently rounding both sides upward at onboard-performance.ts:170-187 reports 1501ms > 1500ms as '2s exceeds 2s' and the test codifies it. Report milliseconds or enough precision.

  3. The interval label is false: full-e2e.test.ts:179-195 starts totalMs at the onboard root during installer step 3, excluding steps 1-2, while lines 245-248 call it '[1/8]-to-first-response'. The post-onboard component also includes installer finalization before the turn. Rename/measure the actual boundaries.

  4. #6660 calibration is unproven. The new 185s sandbox cap is simply 205s-20s with no multi-sample current-main sandbox-phase distribution, percentile, or runner-variance evidence; sandbox+post consumes the full total while ignoring other phases, so this is not the documented decomposition. Supply durable current-main phase calibration and derive the thresholds from it.

Also bind accepted phase spans to the one root: validate trace ID/parentage/status/timestamps/root containment and duration consistency. The current scope+name lookup accepts foreign, failed, out-of-window phases. Parse/validate the budget before starting the costly cloud flow. After fixes and adversarial tests, run exact-head cloud-onboard, full-e2e, and Advisor.

@cjagwani cjagwani self-assigned this Jul 13, 2026
- Require fullE2eColdPath in onboard-config schema; update schema tests
- Report violations in milliseconds to avoid rounded-equal strings like '2s exceeds 2s'
- Fix interval label from [1/8]-to-first-response to onboard-root-to-first-response
- Read budget before expensive cloud operations so bad config fails fast
- Reduce sandbox cap from 185s to 180s to leave headroom for other phases
- Document 180s as provisional pending cold-path CI phase measurements

Fixes cjagwani blockers 1-4 from PR NVIDIA#6732 review.
Collapsed the two-test block for the fullE2eColdPath schema requirement
into a single it() to stay within the 1500-line default budget limit.
@prekshivyas

Copy link
Copy Markdown
Collaborator

/ok to test 2d0c3f9

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🧹 Nitpick comments (1)
test/e2e/live/full-e2e.test.ts (1)

200-234: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Local performance variable shadows the global performance object.

const performance = evaluateColdOnboardPerformance(...) shadows Node's built-in perf_hooks.performance global for the rest of the function. It's harmless today since Date.now() is used for timing elsewhere in this scope, but it's a footgun if someone later reaches for performance.now() inside this function and instead silently gets the evaluation result object.

♻️ Suggested rename
-  const performance = evaluateColdOnboardPerformance(
+  const performanceEvaluation = evaluateColdOnboardPerformance(
     traceWindow,
     firstTurnCompletedAtMs,
     input.budget,
   );
   const rootStartToFirstTurnCompletionSecs = Math.ceil(
-    performance.rootStartToFirstTurnCompletionMs / 1_000,
+    performanceEvaluation.rootStartToFirstTurnCompletionMs / 1_000,
   );

(and update the remaining performance.* references at lines 222, 225, 232-234, 258-260 accordingly)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/live/full-e2e.test.ts` around lines 200 - 234, Rename the local
result from evaluateColdOnboardPerformance in the current test function to avoid
shadowing the global performance object, and update all references to its
rootStartToFirstTurnCompletionMs, rootEndToFirstTurnCompletionMs, passed, and
violations properties accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/onboard/machine/handlers/gateway.test.ts`:
- Around line 126-150: Update the test around TRACE_FILE_ENV to save its
existing process.env value before overriding it, then restore that saved value
in the finally block instead of always deleting the variable. Preserve deletion
only when no prior value existed, and keep the existing resetTraceForTests
cleanup.

In `@test/e2e/fixtures/onboard-performance.ts`:
- Around line 178-186: Filter spans by summaryTraceId before collecting roots or
enforcing uniqueness in the span-processing loop. Update the logic around
ONBOARD_ROOT_SPAN and ONBOARD_PHASE_NAME_SET so only records belonging to the
summarized trace can be added to roots or phases; preserve the existing
duplicate validation for that trace.

In `@test/onboard-performance-config-schema.test.ts`:
- Around line 26-45: Update the CalibrationSample model and calibration
assertions to record each sample’s commit SHA, rather than relying only on the
global measurementHeadSha. Capture the SHA when creating each sample and verify
every sample matches the expected exact-head SHA, including the related
assertions around the sample validation flow.
- Line 200: Update the assertion for sample.measurementsMs.phases in the
onboarding performance config schema test to compare phase keys without
requiring insertion order, such as by comparing order-independent key
collections. Preserve validation that the expected phase names are present while
removing representation-order dependence.

---

Nitpick comments:
In `@test/e2e/live/full-e2e.test.ts`:
- Around line 200-234: Rename the local result from
evaluateColdOnboardPerformance in the current test function to avoid shadowing
the global performance object, and update all references to its
rootStartToFirstTurnCompletionMs, rootEndToFirstTurnCompletionMs, passed, and
violations properties accordingly.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0b4ad74a-0968-4342-86a2-6998f93ddc3d

📥 Commits

Reviewing files that changed from the base of the PR and between d3d503d and 0a1c773.

📒 Files selected for processing (11)
  • ci/full-e2e-cold-path-calibration.json
  • ci/onboard-performance-budget.json
  • schemas/onboard-config.schema.json
  • scripts/validate-configs.ts
  • src/lib/onboard/machine/handlers/gateway.test.ts
  • src/lib/onboard/machine/handlers/gateway.ts
  • test/e2e/fixtures/onboard-performance.ts
  • test/e2e/live/full-e2e.test.ts
  • test/e2e/support/onboard-performance.test.ts
  • test/onboard-performance-config-schema.test.ts
  • test/validate-config-schemas.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • test/e2e/support/onboard-performance.test.ts

Comment thread src/lib/onboard/machine/handlers/gateway.test.ts Outdated
Comment thread test/e2e/fixtures/onboard-performance.ts
Comment thread test/onboard-performance-config-schema.test.ts
Comment thread test/onboard-performance-config-schema.test.ts Outdated
@prekshivyas

Copy link
Copy Markdown
Collaborator

/ok to test ab66cf0

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 13, 2026

Copy link
Copy Markdown
Contributor
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/support/onboard-performance.test.ts`:
- Around line 1-12: Add the `@module-tag` e2e/credential-free marker at the top of
the onboard-performance test module, before the existing imports, so the test is
classified as credential-free.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d364b55a-d2a2-4003-bf50-2b005abd93cd

📥 Commits

Reviewing files that changed from the base of the PR and between d3d503d and ab66cf0.

📒 Files selected for processing (12)
  • ci/full-e2e-cold-path-calibration.json
  • ci/onboard-performance-budget.json
  • ci/source-shape-test-budget.json
  • schemas/onboard-config.schema.json
  • scripts/validate-configs.ts
  • src/lib/onboard/machine/handlers/gateway.test.ts
  • src/lib/onboard/machine/handlers/gateway.ts
  • test/e2e/fixtures/onboard-performance.ts
  • test/e2e/live/full-e2e.test.ts
  • test/e2e/support/onboard-performance.test.ts
  • test/onboard-performance-config-schema.test.ts
  • test/validate-config-schemas.test.ts
🚧 Files skipped from review as they are similar to previous changes (7)
  • ci/full-e2e-cold-path-calibration.json
  • test/onboard-performance-config-schema.test.ts
  • src/lib/onboard/machine/handlers/gateway.ts
  • schemas/onboard-config.schema.json
  • ci/onboard-performance-budget.json
  • test/validate-config-schemas.test.ts
  • test/e2e/fixtures/onboard-performance.ts

@copy-pr-bot

copy-pr-bot Bot commented Jul 13, 2026

Copy link
Copy Markdown

/ok to test b32673a5d3abf9c050da37648d2a1b8b2b485fc4

@prekshivyas, there was an error processing your request: E2

See the following link for more information: https://docs.gha-runners.nvidia.com/cpr/e/2/

@prekshivyas

Copy link
Copy Markdown
Collaborator

/ok to test b32673a

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/support/onboard-performance.test.ts`:
- Around line 1-12: Add the `@module-tag` e2e/credential-free marker at the top of
the onboard-performance test module, before the existing imports, so the test is
classified as credential-free.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d364b55a-d2a2-4003-bf50-2b005abd93cd

📥 Commits

Reviewing files that changed from the base of the PR and between d3d503d and ab66cf0.

📒 Files selected for processing (12)
  • ci/full-e2e-cold-path-calibration.json
  • ci/onboard-performance-budget.json
  • ci/source-shape-test-budget.json
  • schemas/onboard-config.schema.json
  • scripts/validate-configs.ts
  • src/lib/onboard/machine/handlers/gateway.test.ts
  • src/lib/onboard/machine/handlers/gateway.ts
  • test/e2e/fixtures/onboard-performance.ts
  • test/e2e/live/full-e2e.test.ts
  • test/e2e/support/onboard-performance.test.ts
  • test/onboard-performance-config-schema.test.ts
  • test/validate-config-schemas.test.ts
🚧 Files skipped from review as they are similar to previous changes (7)
  • ci/full-e2e-cold-path-calibration.json
  • test/onboard-performance-config-schema.test.ts
  • src/lib/onboard/machine/handlers/gateway.ts
  • schemas/onboard-config.schema.json
  • ci/onboard-performance-budget.json
  • test/validate-config-schemas.test.ts
  • test/e2e/fixtures/onboard-performance.ts
🛑 Comments failed to post (1)
test/e2e/support/onboard-performance.test.ts (1)

1-12: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
sed -n '1,15p' test/e2e/support/onboard-performance.test.ts

Repository: NVIDIA/NemoClaw

Length of output: 743


🏁 Script executed:

sed -n '1,120p' test/e2e/support/onboard-performance.test.ts && printf '\n--- SEARCH ---\n' && rg -n "`@module-tag`|credential-free" test/e2e/support/onboard-performance.test.ts

Repository: NVIDIA/NemoClaw

Length of output: 4271


Add the credential-free module tag
test/e2e/support/onboard-performance.test.ts should include @module-tag e2e/credential-free at the top so it’s treated as a credential-free E2E test.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/support/onboard-performance.test.ts` around lines 1 - 12, Add the
`@module-tag` e2e/credential-free marker at the top of the onboard-performance
test module, before the existing imports, so the test is classified as
credential-free.

Source: Path instructions

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
@prekshivyas
prekshivyas force-pushed the codex/issue-6660-phase-budget branch from b32673a to e5944ab Compare July 13, 2026 22:03
@prekshivyas

Copy link
Copy Markdown
Collaborator

/ok to test e5944ab

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 13, 2026

Copy link
Copy Markdown
Contributor
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@github-actions

github-actions Bot commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — Informational

Advisor assessment: Informational / low confidence
Primary next action: No advisor follow-up required beyond maintainer review.
Findings: 0 blockers · 0 warnings · 0 optional suggestions
Status: No actionable findings remain in the canonical review ledger.

E2E guidance

Advisory only: coverage and selector recommendations are non-authoritative. E2E / PR Gate independently computes and dispatches trusted jobs without consuming this output.

Recommended coverage: cloud-onboard, credential-sanitization, security-posture, full-e2e, onboard-repair, onboard-resume
Recommended selectors: cloud-onboard, credential-sanitization, security-posture, full-e2e, onboard-repair, onboard-resume

  • cloud-onboard — Selected from the trusted checked-in E2E coverage inventory.

  • credential-sanitization — Selected from the trusted checked-in E2E coverage inventory.

  • security-posture — Selected from the trusted checked-in E2E coverage inventory.

  • full-e2e — Selected from the trusted checked-in E2E coverage inventory.

  • onboard-repair — Selected from the trusted checked-in E2E coverage inventory.

  • onboard-resume — Selected from the trusted checked-in E2E coverage inventory.

  • cloud-onboard — Selected as a trusted checked-in E2E job.

  • credential-sanitization — Selected as a trusted checked-in E2E job.

  • security-posture — Selected as a trusted checked-in E2E job.

  • full-e2e — Selected as a trusted checked-in E2E job.

  • onboard-repair — Selected as a trusted checked-in E2E job.

  • onboard-resume — Selected as a trusted checked-in E2E job.

1 optional coverage item · 1 optional selector · 0 new-test recommendations
  • Optional coverage gateway-guard-recovery — Selected from the trusted checked-in E2E coverage inventory.
  • Optional selector gateway-guard-recovery — Selected as a trusted checked-in E2E job.

Workflow run details

This is an automated, non-authoritative review. Findings are inputs to maintainer adjudication. Warnings and optional suggestions do not require a response or follow-up. A human maintainer makes the final merge decision.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
src/lib/onboard/machine/handlers/gateway.test.ts (1)

103-106: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Ternary-as-statement for side effects risks a no-unused-expressions lint failure.

The restore/delete logic correctly fixes the previously flagged issue (env var is now captured and restored instead of unconditionally deleted). However, using a bare ternary expression as a statement (lines 104-106) is flagged as incorrect by ESLint's no-unused-expressions rule under its default options (allowTernary: false), even when both branches are function calls. If this repo's ESLint config doesn't set allowTernary: true, this pattern will fail lint. An if/else is more idiomatic here and avoids the risk entirely.

♻️ Suggested fix
   } finally {
-    previousTraceFile === undefined
-      ? Reflect.deleteProperty(process.env, TRACE_FILE_ENV)
-      : Reflect.set(process.env, TRACE_FILE_ENV, previousTraceFile);
+    if (previousTraceFile === undefined) {
+      delete process.env[TRACE_FILE_ENV];
+    } else {
+      process.env[TRACE_FILE_ENV] = previousTraceFile;
+    }
     resetTraceForTests();
     fs.rmSync(directory, { recursive: true, force: true });
   }

Based on learnings, this mirrors the previously suggested fix for restoring TRACE_FILE_ENV, which used plain delete/assignment rather than Reflect. Confirm whether no-unused-expressions/allowTernary is configured for this repo before deciding whether to adjust.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard/machine/handlers/gateway.test.ts` around lines 103 - 106,
Replace the bare ternary side-effect statement in the finally cleanup with an
explicit if/else: delete TRACE_FILE_ENV when previousTraceFile is undefined,
otherwise restore it to the captured value. Keep the existing previousTraceFile
handling and environment restoration behavior unchanged.

Source: Learnings

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/lib/onboard/machine/handlers/gateway.test.ts`:
- Around line 103-106: Replace the bare ternary side-effect statement in the
finally cleanup with an explicit if/else: delete TRACE_FILE_ENV when
previousTraceFile is undefined, otherwise restore it to the captured value. Keep
the existing previousTraceFile handling and environment restoration behavior
unchanged.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 25647ca0-4df3-4afb-8d48-3fb721a0d20d

📥 Commits

Reviewing files that changed from the base of the PR and between ab66cf0 and e5944ab.

📒 Files selected for processing (1)
  • src/lib/onboard/machine/handlers/gateway.test.ts

@prekshivyas

Copy link
Copy Markdown
Collaborator

/ok to test 29238dc

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 13, 2026

Copy link
Copy Markdown
Contributor
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@prekshivyas

Copy link
Copy Markdown
Collaborator

@cjagwani Ready for exact-head re-review at 29238dcfeb7837c8c39ab4bddc79f4ef60cc305f.

Every item from the change request is covered:

  1. Schema/runtime alignment: fullE2eColdPath and every phase budget are required in both layers. The schema enforces root-end <= root-start through Ajv $data, with positive and negative regression tests.
  2. Accurate diagnostics: violations now report exact milliseconds; independently rounded seconds are gone.
  3. Honest boundaries: metrics and artifacts use root-start-to-first-turn and root-end-to-first-turn names matching the measured intervals.
  4. Durable calibration: five independent exact-head samples are checked in, and budgets are deterministically recomputed as nearest-rank p95 + max(5s, 10%), rounded up to one second.
  5. Trace integrity: accepted spans must share the selected root's trace, IDs, parentage, OK status, valid timestamps, duration consistency, containment, uniqueness, and phase order; overlap and foreign/failed/out-of-window evidence fail closed.
  6. Early validation: the budget is parsed before the costly cloud flow starts.
  7. Gateway coverage: tracing now covers normal startup, healthy reuse, and failure paths; the failure test asserts one ERROR gateway span with reuse/GPU attributes.

Latest automated-review items were also adjudicated:

  • The Advisor's canonical ledger has 0 actionable findings. Nemotron's raw calibration-removal warning assumes this is temporary; it is the durable source of truth requested by Stabilize full-e2e cold-onboard performance budget #6660 and is recalibrated when runner characteristics change. Its $data threat-model warning is nonblocking because validation only consumes checked-in repo configs, and the cross-field rejection has a negative regression test.
  • CodeRabbit's bare-ternary nit is not applicable: the exact repo lint/check suite passes, while adding a new if to this changed test would fail the repository's test-conditional growth guard.

Exact-head evidence:

  • Regular CI: green
  • PR Advisor: green
  • Trusted E2E, all six requested selectors: green
  • Focused tests: 151 passed; npm run check:diff passed
  • Review threads: 0 unresolved

The remaining E2E / PR Gate failure is the expected fork-secret safeguard, not a test failure. A maintainer/admin can resolve it with resolve-fork, PR 6732, head 29238dcfeb7837c8c39ab4bddc79f4ef60cc305f, base 989eea9ac796537b9a803967ee1aed68dc51dec0, and the trusted E2E run above as evidence.

Please re-review this exact head and clear the prior change request if satisfied.

@prekshivyas
prekshivyas requested a review from cjagwani July 13, 2026 22:28
@cjagwani

Copy link
Copy Markdown
Collaborator

/ok to test

@copy-pr-bot

copy-pr-bot Bot commented Jul 13, 2026

Copy link
Copy Markdown

/ok to test

@cjagwani, there was an error processing your request: E1

See the following link for more information: https://docs.gha-runners.nvidia.com/cpr/e/1/

@cv
cv merged commit 16eaa09 into NVIDIA:main Jul 13, 2026
41 of 42 checks passed
@cv cv mentioned this pull request Jul 13, 2026
21 tasks
cv added a commit that referenced this pull request Jul 14, 2026
## Summary

Replace the SHA-copying E2E no-secret exception workflow with a
repository-native protected-environment approval on the exact `E2E / PR
Gate` run. Maintainers can use GitHub's **Review deployments** button
while the controller preserves the existing exact-diff, role, risk-plan,
and stale-revision checks.

## Changes

- Publish allowlisted exception mode, PR, head SHA, and base SHA outputs
from the trusted coordinator, then wait on `e2e-no-secret-exception`
with `deployment: false` and no secret references or PR-controlled
execution.
- Read the workflow run's approval history, require one approval for
only that environment, derive the reviewer and optional bounded comment
from GitHub, recheck `maintain`/`admin`, and reuse the existing
exact-diff resolver. An absent or unprotected environment fails closed.
- Bind approval to the trusted first workflow attempt, exact workflow
SHA, current PR revision, matching failed check, recomputed risk plan,
and a final live-PR read. Per-PR concurrency cancels stale waiting
approvals.
- Keep the typed `workflow_dispatch` resolver for rollout and rerun
fallback because GitHub approval history is run-scoped rather than
attempt-scoped. The controller exception and workflow contract tests
protect both paths.
- Update the E2E reference and maintainer merge-gate guidance, including
the required repository environment configuration. This addresses the
maintainer friction observed on #6732 without adding a GitHub App.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: No end-user product behavior
changed; maintainer workflow and E2E reference documentation were
updated.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: Adversarial review
covered approval provenance, first-attempt replay prevention,
permissions, unconfigured-environment failure, stale revisions, and
exact check identity; no actionable findings.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification

- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — `npx vitest run --project integration
test/pr-e2e-gate.test.ts test/pr-e2e-gate-lifecycle.test.ts
test/pr-e2e-gate-exceptions.test.ts test/pr-e2e-gate-workflow.test.ts`
(4 files, 88 tests passed)
- [ ] Applicable broad gate passed — not applicable; this focused
workflow/controller change is covered by the targeted suite and normal
hooks.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only) — not
applicable; no `docs/` pages changed.
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added an approval-based “no-secret” workflow step to resolve eligible
E2E gate exceptions.
* Gate completions now include a linked run “details” URL and
standardized exception outputs.
* **Documentation**
* Updated maintainer guidance for protected-environment approval setup
and the typed manual fallback path.
* **Tests**
* Expanded end-to-end coverage for approval validation, strict
trust/scoping checks, concurrency wiring, and improved gate output
assertions (including rerun rejection and safe input handling).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure area: onboarding Onboarding FSM, provider setup, sandbox launch, or first-run flow chore Build, CI, dependency, or tooling maintenance v0.0.82 Release target

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Stabilize full-e2e cold-onboard performance budget

6 participants