ci(e2e): record approved Slice 4 assertion exception

[rsliter]

Outcome

Record the approved two-assertion exception for Slice 4 PR #12777 in trusted base policy. Once this prerequisite merges, independent enforcement can evaluate that exact budget transition without accepting policy supplied by the feature branch.

Reason

The independent growth check reads exceptions from main. The candidate-only record in #12777 cannot satisfy that check.

Related issues

Refs #12558. Prerequisite for #12777.

Changes

Add one PR-number-bound entry to ci/e2e-assertion-growth-exceptions.json. No test budget, enforcement code, workflow, product behavior or other exception changes.

The recorded approval authorizes exactly two live assertions for native host-local success and sibling isolation. Main #12608 subsequently removed seven unrelated assertions. This entry preserves that reduction and records the mechanically recalculated transition for signed Slice 4 candidate 3f967908b29892c28f57aa4f6457532f4811c6cb:

• Base budget SHA-256: 53c51c4229d387633165771730f8f1a8373f84e9f3303b2144280027a56e3441.
• Candidate budget SHA-256: 8bdce2cee059bb402f1f504e267f99cc39f1f7bf98928ffe0fb1bc95674dfa80.
• Only inference-routing.test.ts changes relative to current main: [36,51,48,89,15] to [38,53,50,91,15]. Direct assertion points increase from 1959 to 1961; unique points from 3203 to 3205.

A different PR or budget digest cannot use this entry. Remove it after #12777 merges.

Verification

• npx vitest run --project integration test/automation/pull-requests/growth-guardrails.test.ts test/automation/pull-requests/growth-guardrail-parsers.test.ts: 65 tests pass.
• Local pure-check rehearsal: current trusted policy reports eight expected growth violations; the proposed exact exception on the trusted side reports zero. No GitHub status was changed.
• Compared both budget files and their complete structural difference. Only the two approved inference-routing assertions and corresponding aggregate counters increase.
• Normal signed-commit hooks, including growth enforcement and secret scanning, pass. The diff contains no secrets, API keys or credentials.

Review notes

The required upstream APT setup fix from #12837 is integrated through main c518e121d23c616da1b083c44c9eb504fb419ebd. The exception conflict preserves every existing main entry and the unchanged #12777 digests. All 65 focused tests and normal signed-commit hooks pass on merge commit b96598a2037a7e8347f8a8492624ff6c59ecb567; latest-head CI remains required after publication.

This is a workflow-authored transcription and updated disposition of Rebecca Sliter's existing approval, not a new independent review or a passing CI result. Current #12777 growth failures remain failures until trusted policy is available and enforcement passes. This prerequisite requires its own CI and automated review.

Repository-local setup and compilation completed. The contributor doctor reports an unavailable local Docker daemon and a CLI resolving to another installation; neither is used by this policy-only validation. No runtime or CLI exposure was changed.

---

Signed-off-by: Rebecca Sliter 571084+rsliter@users.noreply.github.com

Summary by CodeRabbit

• Tests
  • Updated the automated test-baseline allowance for the approved inference-routing assertions. The allowance applies only when the recorded base and head digests match, and continues to account for the reduction in assertions from the prior baseline. Independent validation continues to use the trusted baseline policy.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: NVIDIA/NemoClaw/.coderabbit.yaml
• Review profile: CHILL
• Plan: Enterprise
• Run ID: a3c95e4d-e756-4f29-9a3d-25f63ed89d25

📥 Commits

Reviewing files that changed from the base of the PR and between cad696f and c55e9ce.

📒 Files selected for processing (1)

• ci/e2e-assertion-growth-exceptions.json

🚧 Files skipped from review as they are similar to previous changes (1)

• ci/e2e-assertion-growth-exceptions.json

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The assertion-growth policy comment documents the two approved assertions for PR #12777 and the recorded budget digests, which include the seven-assertion reduction from PR #12608. The policy file adds base and head budget SHA-256 digests for PR #12777.

Changes

Assertion policy

Layer / File(s)	Summary
Document and record assertion exception ci/e2e-assertion-growth-exceptions.json	The comment documents the approved assertions, the earlier reduction, and that the independent check remains enabled. The exception record adds base and head budget SHA-256 digests for PR #12777.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: apurvvkumaria

Merge Risk: ⚪ Minimal · up to c55e9

This change only records an approved assertion-growth exception for one pull request, bound to specific budget digests. It does not change runtime or CLI behavior, and no actionable merge risk was found.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: recording an approved Slice 4 assertion exception for E2E checks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[rsliter]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit cad696f in the codex/12558-assertio... branch is 97%. The line coverage in commit 63002cd in the main branch is 96%.

Show a line coverage summary of the most impacted files.

File	main 63002cd	codex/12558-assertio... cad696f	+/-
nemoclaw/src/onboard/config.ts	98%	96%	-2%
nemoclaw/src/index.ts	94%	93%	-1%
nemoclaw/src/bl...print/runner.ts	95%	95%	0%
nemoclaw/src/bl...ime-identity.ts	97%	97%	0%
nemoclaw/src/bl...t-management.ts	100%	100%	0%
nemoclaw/src/co.../config-show.ts	100%	100%	0%
nemoclaw/src/commands/slash.ts	100%	100%	0%
nemoclaw/src/on...native-route.ts	0%	100%	+100%

---

_{Updated October 08, 2026 20:00 UTC}

[rsliter]

@coderabbitai full review

Please review the current candidate b96598a2037a7e8347f8a8492624ff6c59ecb567, including the integrated upstream APT setup fix and the unchanged scoped assertion-policy exception.

[coderabbitai]

✅ Action performed

Full review finished.

[github-actions]

PR Review Advisor finished for commit b96598a. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

Request review only when Require no Advisor blockers is green.

All previous runs

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.