fix(e2e): repair Hermes GPU fallback coverage

[sandl99]

Summary

Repair the Hermes managed-image GPU fallback E2E path after a focused rerun reproduced the failure on a different GPU runner. The live cell now exercises the supported pre-create rejection boundary while production cleanup remains fail-closed after managed state exists.

Related Issue

Addresses the Hermes GPU fallback failure in #10155.

Draft pending #10113.

Changes

• Make the Hermes GPU fallback fixture reject the native --gpu create before build or sandbox progress, then delegate one compatibility create and GPU proof. This keeps the managed-runner consumer executable without fabricating a post-create NVML failure that cannot be cleaned up by exact identity.
• Prove stable sandbox and labeled-container absence without mutable-name deletion before the compatibility retry. A same-name sandbox blocks the retry, and focused cleanup tests protect both outcomes.
• Reuse the exact managed image digest when the pre-create rejection leaves no native runtime snapshot. The managed-bootstrap routing test protects this compatibility launch contract.
• Propagate the exact managed cleanup handoff for native create and readiness failures, which blocks compatibility retry instead of deleting by mutable sandbox name. Remove the unreachable cleanup-completion receipt state and its two receipt-only tests.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: The cleanup identity boundary remains fail-closed; tests reject mutable-name deletion and block a same-name replacement.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the latest PR commit — command/result or justification: focused CLI fallback and cleanup tests, 83 passed; focused Hermes E2E-support tests, 17 passed; the normal hooks passed on b3108fd15338e9d4b681a6cef9d987d11f2c23a0.
• Focused live E2E passed for b3108fd15338e9d4b681a6cef9d987d11f2c23a0 in trusted run 33138120657: native, fallback, and compatibility-only passed. The dispatch receipt binds PR fix(e2e): repair Hermes GPU fallback coverage #10398, NVIDIA/NemoClaw, base and workflow SHA 4e0e663a9a4cf6bac8df8972ea23dfc26ce3c309, and workflow attempt 1.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: San Dang sdang@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Improved GPU sandbox fallback when native GPU creation is rejected before startup progress.
  • Compatibility launches now use the correct managed image while preserving startup commands and policy.
  • Prevented destructive cleanup while the original sandbox may still exist.
  • Standardized fallback handling and NVIDIA capability verification after native GPU failures.

• Tests

  • Expanded coverage for safe cleanup, image selection, fallback behavior, and concurrent GPU creation failures.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[cv]

@sandl99 is https://github.com/NVIDIA/NemoClaw/actions/runs/33135982202/attempts/1#summary-98736002680 something to worry about?

[github-actions]

PR Review Advisor finished for commit b3108fd. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

All previous runs

[sandl99]

@cv Thanks for flagging this. Yes, the earlier Advisor run found an unreachable nativeCleanupReceipt authorization branch and two tests that could only create that state synthetically.

I removed the receipt type, authorization branch, and receipt-only tests in commit b3108fd. The existing fail-closed cleanup handoff remains covered. This repair removes 103 lines and adds 2. The complete PR is net -153 lines.

Evidence for b3108fd:

• Focused CLI tests: 83 passed.
• E2E-support tests: 17 passed.
• The trusted live E2E run, attempt 1, passed the native, fallback, and compatibility-only scenarios.
• Required checks pass. The final Advisor review reports no findings. CodeRabbit reports no actionable comments. GitHub reports APPROVED and CLEAN.

@cv, please merge PR #10398.