fix(e2e): refresh Pi qualification receipts

[sandl99]

Outcome

Pi candidate qualification binds onboarding and live qualification to the checked-in Linux AMD64 and Linux ARM64 receipts. The live gate now derives the Pi image input set from the canonical Dockerfile parser and refuses a receipt when any Dockerfile or direct COPY source differs from the published source revision.

The exact PR candidate images build and validate on both platforms. The latest exact-commit Pi E2E run exercised the restored parity gate successfully on both platforms, but did not qualify the candidate because NVIDIA hosted inference returned Service temporarily overloaded through all bounded attempts.

Reason

Manual Pi qualification previously reached Ready but the managed image rejected the Pi completion receipt because the checked-in image runtime bundle retained the older agent allowlist. Updating TypeScript alone was insufficient because the Pi Dockerfile copies the generated bundle. Later reduction work also removed the live source-parity binding; this PR restores that binding without restoring the deleted redundant repository checker.

Relates to #10155. Product scope was established by merged PR #10059. The Pi bootstrap prerequisite from #10503 is merged.

Changes

• Keep Pi on NVIDIA hosted inference and reject host-local inference before setup.
• Bind live qualification to the exact receipt and the derived Pi Dockerfile source set.
• Record imageSourceParity: true only after git diff --quiet succeeds for both Dockerfiles and all direct COPY sources.
• Preserve OpenShell's canonical Pi filesystem and encoded-slash policy readback.
• Accept Pi bootstrap completion receipts through the canonical managed-startup agent predicate.
• Remove the redundant standalone Pi candidate-artifact checker and redundant test coverage.

Verification

• Latest PR commit: 66f09fa8fb1a2b3714de38bdaafda63c17f9b33f (GitHub Verified); parity restoration commit: b069b75ce01b6e6c32f932152beae808caef34f4 (GitHub Verified and DCO signed).
• Full trusted local PR validation passed at the latest PR commit, including repository checks, source-shape and growth gates, secret scan, formatting, lint, commit-message checks, and CLI type-checking.
• Both receipt files hash to the two values published in CANDIDATE_QUALIFICATION_RECEIPT_DIGESTS.pi, and the production receipt reader returns the correct platform and digest-pinned reference for each.
• Exact-commit PR CI, managed images, and PR Review Advisor completed successfully. No required PR check is pending or failing.
• Trusted Pi E2E run 33383096063, correlation bddb5e11-17d5-4079-8d33-73bcc9ecae21, is bound to candidate 66f09fa8fb1a2b3714de38bdaafda63c17f9b33f and workflow/base 9b8c0511ad5eb2d537cf17ba21e65c3c88008b88.
  • AMD64: receipt validation, source parity, onboarding, and the headless read succeeded; hosted inference overload then exhausted the bounded attempts during the interactive task, which remained open until the terminal bound expired.
  • ARM64: receipt validation, source parity, and onboarding succeeded; hosted inference overload exhausted all bounded attempts during the headless task.
  • Both platform cleanups succeeded, unhandledErrors is zero, and artifact scans found no NVIDIA API key value.

Review notes

• No user-facing documentation, new test file, new coverage, or added assertion.
• Effective diff: 15 files, 163 additions, 1597 deletions.
• The receipt-to-authority P2 is test-only and intentionally unchanged by maintainer decision.
• The model-dependent event-oracle finding is excluded from this revision by maintainer decision.
• The latest Pi E2E run is not a passing qualification; a maintainer must decide whether to wait for provider recovery and run a new exact-commit qualification.

---

Signed-off-by: San Dang sdang@nvidia.com

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-10390.docs.buildwithfern.com/nemoclaw

[cjagwani]

Exact-head review at af4887f: four blockers remain in unchanged Pi qualification code. The event oracle accepts extra assistant messages when the final reply matches; the Pi artifact suite and live git-diff gate are unapproved source-shape owners; and removing the opaque-input watch mapping lets Pi policy, receipt, manifest, Dockerfile, authority, lockfile, or start-script edits skip their owning validator. Inline comments are on the unchanged a4325fb code. Exact-head verification passed build, CLI typecheck, 43 CLI tests, 152 integration tests, 6 E2E-support tests, source-shape scanner execution, and diff hygiene. Both receipts remain byte-identical to successful publication run 33355262414. All nine exact-head Advisor specialists completed; Test Design independently confirms the artifact source-shape blocker. DCO is green and the new merge commit is Verified; required CI and image gates are still running. Nine-category security verdict: secrets PASS; input validation FAIL because the qualification oracle can false-pass; authentication and authorization PASS; dependencies PASS; error handling and logging PASS; cryptography and data protection PASS; configuration PASS; security testing FAIL; holistic posture FAIL until these four validation blockers are resolved.

[cjagwani]

Exact-head review at db06808: the event-order oracle and the two earlier test/live source-shape owners are resolved, but two blockers remain in their replacement repository check. It reimplements the canonical managed-image contract parser and parses candidate-authority.ts syntax instead of consuming the exported authority, and the resulting shipped-representation check still has no reviewed source-shape exception. Exact-head verification passed the CLI build during npm ci, CLI typecheck, 21 focused CLI tests, 70 integration tests, 6 E2E-support tests, the Pi artifact check, the source-shape scanner, and diff hygiene. The scanner reported zero source-shape cases, confirming this repository check currently sits outside that reviewed accounting. All nine exact-head Advisor specialists completed; Test Design, Design/Architecture, Dependency Use, and Code Reduction independently confirm these ownership blockers. CodeRabbit is green, DCO is green, the new commit is Verified, and all required CI and image gates are green. Nine-category security verdict: secrets PASS; input validation FAIL because release validation can drift from candidate activation; authentication and authorization PASS; dependencies WARNING because the check adds a redundant TypeScript AST dependency; error handling and logging PASS; cryptography and data protection PASS; configuration PASS; security testing FAIL; holistic posture FAIL until the two validation-ownership blockers are resolved.

[cjagwani]

Requesting changes on exact head d28c127. The previous duplicate-parser and source-shape blockers are resolved by deleting the redundant checker. One current-head P1 remains.

• Pi qualification no longer binds an accepted receipt to the commit under review. Both checked-in receipts identify source revision 6339fca, while this head is d28c127. The live target validates only the repository and records CLI/image revisions separately, so trusted stale receipt bytes can keep authorizing an older image after reviewed policy, startup, or image-source changes. Require fail-closed equality to the expected PR/head SHA before onboarding, carry one bound revision into evidence, and cover a digest-valid stale-revision receipt.

Accepted scope remains #10155 / #10059. All nine Advisor specialists completed; Trust reported this blocker. CodeRabbit has no new actionable feedback. DCO is green and all commits are GitHub Verified. Visible CI is green except one direct startup pass still pending.

Exact-head local evidence: CLI typecheck; 21 CLI, 70 integration, and 6 E2E-support tests; repository checks; source-shape scan; and diff hygiene all passed.

Nine-category security verdict: secrets PASS; input validation FAIL; authentication/authorization FAIL; dependencies PASS; error handling/logging PASS; cryptography/data PASS; configuration PASS; security testing FAIL; holistic review FAIL.

[cjagwani]

[P1] Bind qualification to the reviewed commit

Severity: P1. Impact: both accepted receipts currently name 6339fca while this head is d28c127; this check validates only the repository and later reports the two revisions separately, so a stale image remains qualified after current policy, startup, or image-source changes. Smallest safe fix: before any candidate onboarding, fail closed unless receipt.contract.source.revision equals the expected PR/head SHA, then emit that single bound value. Regression: a digest-valid receipt with a different source revision must fail before onboarding.

Out date

[github-actions]

PR Review Advisor finished for commit 66f09fa. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

All previous runs

[sandl99]

Maintainer handoff — latest PR commit 66f09fa8

Blocker 1 is restored by b069b75ce0: both live Pi jobs ran git diff --quiet from receipt source revision 6339fcae1c239a84925715328fc0dff045b8f310 across .dockerignore, both Pi Dockerfiles, and their 22 derived direct COPY sources. The command returned exit code 0 on AMD64 and ARM64, so the source-parity fix is present and working.

Required PR checks and exact-commit managed-image publication are passing. Managed images: https://github.com/NVIDIA/NemoClaw/actions/runs/33381304749

The requested exact-commit Pi qualification was dispatched with public-nvidia:

• Run: https://github.com/NVIDIA/NemoClaw/actions/runs/33383096063
• Correlation: bddb5e11-17d5-4079-8d33-73bcc9ecae21
• Candidate: 66f09fa8fb1a2b3714de38bdaafda63c17f9b33f
• Trusted workflow/base: 9b8c0511ad5eb2d537cf17ba21e65c3c88008b88
• Selectors: pi-agent-qualification-amd64,pi-agent-qualification-arm64

Result: not passing because NVIDIA hosted inference returned Service temporarily overloaded on both platforms after the successful parity/onboarding phases.

• AMD64 completed the headless read, then all bounded inference attempts for the interactive task hit overload; the terminal reached its five-minute bound.
• ARM64 hit overload on every bounded attempt of the headless read.
• Cleanup passed on both platforms; no retained sandbox or gateway resource was recorded.
• Both evidence manifests are bound to the exact candidate/workflow/run, report zero unhandled errors, and contain zero nvapi-* matches.

Per maintainer direction, no receipt-authority assertion and no event-oracle change were added. Do not treat run 33383096063 as qualification evidence. The next maintainer decision is whether to wait for provider recovery and authorize a new exact-commit focused qualification; repository policy does not permit disguising this result with a broad failed-job rerun.

outdate

[hunglp6d]

Reviewed at 66f09fa8fb1a2b3714de38bdaafda63c17f9b33f.

Checked

• b069b75ce0 restores the source-parity gate in test/e2e/live/pi-agent-qualification.test.ts:322 with imageSourceParity: true back in evidence, and it passed live on both platforms in run 33383096063 — both failures there land at later phases.
• agents/pi/policy-additions.yaml: /app lands under read_only, not read_write. Dropping allow_encoded_slash: false is behavior-neutral — OpenShell declares it #[serde(default, skip_serializing_if = "std::ops::Not::not")], documented "Defaults to false (strict)", and already omits it when serializing.
• Both receipt files hash to the two values in CANDIDATE_QUALIFICATION_RECEIPT_DIGESTS at this head.
• Required CI at this head is green.

Open, suggested as follow-up

• Nothing binds the checked-in receipts to CANDIDATE_QUALIFICATION_RECEIPT_DIGESTS in src/lib/agent/candidate-authority.ts since the checker was deleted, and every surviving consumer mocks the constant. Digests agree today. One assertion in an existing CLI test comparing both receipt file hashes to acceptedCandidateReceiptDigests("pi") would close it.

Not covered here

• One event-oracle finding is excluded by maintainer decision as test-only.
• Exact-head Pi qualification is red: run 33383096063 failed ARM64 with Pi task must start exactly one tool, observed 0, and AMD64 on the interactive task with expect(result.timedOut).toBe(false). The AMD64 mode has not appeared on this branch today, and run 33376135736 cleared that step at d28c127068618456d295ec78fcd5aca94e18314b. Worth a rerun, and its own diagnosis if the AMD64 timeout repeats.