feat(installer): prepare DGX Station host prerequisites

[ericksoa]

Summary

DGX Station express install now probes the validated host prerequisites before generic Docker setup, reuses exact matches, and installs missing pinned packages without additional choices.
When package preparation requires the validated reboot boundary, rerunning the same installer command resumes the accepted Station recipe without another prompt.
This automation does not change DGX Station's Deferred support status.

Related Issue

Related to #6951; this does not close the physical DGX Station end-to-end validation gate.

Changes

• Add a DGX Station GB300 host-preparation helper derived from the internal golden path, with exact driver, Docker, Buildx, and NVIDIA Container Toolkit pins.
• Probe platform, package, workload, service, Docker GPU, CDI, driver, and ECC state before mutation; refuse automatic upgrade or downgrade of mismatched installed prerequisites.
• Verify repository keys, simulate APT with no removals, back up Docker runtime configuration before changing it, and use a digest-pinned ARM64 acceptance image.
• Persist only the selected Station model in a symlink-safe, owner-only, single-line resume marker when exit status 10 requires a reboot, then clear it after successful installation.
• Install the exact NVIDIA Container Toolkit package set, enable and verify the durable CDI refresh lifecycle, use NVIDIA's transient CDI generation fallback without bypassing administrator overrides, and exercise real CDI/--gpus all launches.
• Add installer behavior coverage for reuse, missing-package installation, mismatch refusal, probe-first CDI setup, workload safety, reboot/resume, and malformed resume state.
• Document the automated prerequisites, reboot contract, and remaining Deferred support boundary.

Parallel Download Analysis

The current cold path is ordered as Station consent -> host preparation/reboot -> Node, NemoClaw, and OpenShell setup -> vLLM image pull -> model-storage re-probe -> model download -> vLLM launch. The package-manager, DKMS, reboot, and Docker-runtime mutation portion must remain serialized.

A digest-pinned image-only prefetch is viable, but DMI detection or the read-only host check is too early. The safe lower bound is after the user accepts Station express install, the effective Ultra/DeepSeek model is fixed, and Station host preparation returns complete on the final post-reboot run. Before that boundary, Docker may be absent, upgraded, restarted, or using a host state that preparation will reject.

Download or mutation	Parallelization decision
APT repository fetches	APT already queues downloads per repository host by default; keep one serialized APT/dpkg transaction and preserve administrator APT policy.
Driver, DKMS, Toolkit, CDI, Docker/runtime changes	Keep serial. These can restart or replace the daemon and invalidate an in-flight image pull.
OpenShell's independent pinned archives	Can be fetched concurrently, then checksum/archive validation and installation must remain serial. This is a smaller follow-up optimization.
Pinned vLLM image (10.67 GB)	Recommended first optimization: prefetch after host preparation is complete and overlap it with remaining installer/gateway work.
Ultra model snapshot (352.38 GB)	Keep after the image. The downloader is hf download inside that exact image with --pull=never; another downloader would add a new trust/configuration path.
vLLM launch and sandbox route setup	Keep serial; healthy vLLM is the inference-route gate.

The image is 2.94% of the cold image-plus-model transfer bytes, but hiding it can still remove its full latency from the critical path: approximately 14.2 minutes at 100 Mbps, 2.8 minutes at 500 Mbps, or 1.4 minutes at 1 Gbps before registry unpack/finalization overhead. The gain is bounded by the amount of independent setup work and shrinks when downloads saturate the same link.

The coherent implementation is an ephemeral prefetch task on the existing onboarding lifecycle: idle -> skipped|pulling -> ready|failed|cancelled -> joined. Start it after Station host readiness and canonical profile resolution, then join it before the managed-vLLM provider branch starts the model download. Reuse the existing TypeScript runtime-profile resolver, digest assertion, local-Docker context, storage probes, Docker environment, and pull watchdog; do not duplicate the digest in install.sh. The exact Docker digest is the resume truth, so no PID is persisted. Signal cleanup must cancel and await the worker without pruning shared Docker content.

Eligibility must be fail-closed: local/default Docker context, conclusive storage probes, no foreign managed-vLLM container, and sufficient capacity for both stores when they share a filesystem. The current conservative guards imply approximately 32.8 GiB for the image store plus 331.2 GiB for the Ultra model cache, or about 364 GiB combined. The canonical foreground path must still inspect the exact digest and re-probe model storage after the prefetch.

Acceptance coverage for a future implementation must prove no speculative pull before consent, on non-Station hosts, on exit 10/pending reboot, or after host-prep failure; exact Ultra versus DeepSeek digest selection; cache-hit no-op; one owner and one join; join-before-model ordering; canonical retry after worker failure; signal cleanup; second-run cache reuse; and physical Station cold-cache timing.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Author security review covered exact package/key/image pins, APT no-removal simulation, fail-closed mismatches, idle-host guards, Docker config backup, symlink rejection, owner-only resume state, and secret scanning. Maintainer review is still required.
• Non-success, skipped, or missing CI check accepted by maintainer — E2E / PR Gate; maintainer waiver accepts only the two exact-head Hermes hosted-runner shutdowns with no assertion; follow-up Trusted PR E2E gate cannot retry a completed exact-diff check #7052 tracks safe exact-diff retry recovery.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run test/install-station-host-preparation.test.ts --project installer-integration --testTimeout=15000: 41 passed
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — npm test: 17,505 passed, 186 skipped, and 10 unrelated local failures across existing macOS locale, corporate-DNS SSRF, and 5-15 second timing-sensitive tests; no failing test touches this change
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — command passed; Fern reported 2 existing warnings
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Aaron Erickson aerickson@nvidia.com

Summary by CodeRabbit

• New Features
  • Added guided DGX Station host preparation for Ubuntu 24.04 ARM64 with strict pinned prerequisites, safe “check/apply/verify” style flow, and GPU acceptance verification.
  • Improved DGX Station express-install so your chosen model selection persists across the required reboot and resumes automatically.
• Documentation
  • Expanded DGX Station prerequisites and quickstart with exact version checks, “status-10” reboot/resume behavior, and clarified “Deferred” end-to-end validation expectations.
• Tests
  • Added and expanded integration coverage for host preparation, pinned mismatch handling, resume-state persistence/security, and CDI refresh behavior.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

DGX Station express installation now prepares pinned host prerequisites, validates NVIDIA runtime support, persists and resumes setup across reboot status 10, and adds integration coverage and documentation for the flow.

Changes

DGX Station express installation

Layer / File(s)	Summary
Host checks and package contracts scripts/prepare-dgx-station-host.sh	Adds platform, safety, package-version, repository, and boot-state checks for pinned Station prerequisites.
Host installation and runtime verification scripts/prepare-dgx-station-host.sh	Installs exact prerequisites, configures Docker/CDI support, validates GPU access, and implements check/apply/verify modes.
Installer orchestration and reboot resume scripts/install.sh	Runs Station preparation before generic bootstrap, persists the selected model on status 10, resumes without prompting, and clears state after completion.
Installer integration validation test/install-station-host-preparation.test.ts, test/install-express-prompt.test.ts, scripts/checks/vitest-project-overlap.ts, vitest.config.ts	Adds coverage for preparation, runtime behavior, safety gates, reboot persistence, resume validation, installer ordering, documentation alignment, and Vitest project assignment.
Express-install documentation docs/get-started/prerequisites.mdx, docs/get-started/quickstart.mdx	Documents Station prerequisites, pinned package behavior, status 10 reboot/resume handling, and Deferred support status.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant Installer
  participant HostPreparation
  participant DGXStation
  User->>Installer: Start express install
  Installer->>HostPreparation: Prepare Station host
  HostPreparation->>DGXStation: Check and install pinned prerequisites
  DGXStation-->>HostPreparation: Reboot required
  HostPreparation-->>Installer: Exit status 10 and persist model
  User->>Installer: Rerun after reboot
  Installer->>HostPreparation: Resume Station preparation
  HostPreparation->>DGXStation: Verify Docker, CDI, and GPU
  DGXStation-->>Installer: Host ready

Loading

Possibly related PRs

• NVIDIA/NemoClaw#1870 — Both modify the installer pre-onboarding flow in scripts/install.sh.
• NVIDIA/NemoClaw#6883 — Both modify the DGX Station express-install model-selection flow.
• NVIDIA/NemoClaw#6940 — Both modify Vitest project-overlap classification.

Suggested labels: feature, platform: arm64

Suggested reviewers: cv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding DGX Station host prerequisite preparation to the installer.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/dgx-station-host-prereqs

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the feat/dgx-station-hos... branch remains at 80%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.

File	main 3558a7a	feat/dgx-station-hos... 4078165	+/-
src/lib/state/registry.ts	86%	83%	-3%
src/lib/credentials/store.ts	59%	64%	+5%
src/lib/sandbox...vileged-exec.ts	75%	87%	+12%
src/lib/core/pr...mpt-activity.ts	67%	92%	+25%

---

_{Updated July 16, 2026 21:55 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-6991.docs.buildwithfern.com/nemoclaw

[github-actions]

PR Review Advisor — Blocking findings reported

Advisor assessment: Blockers require maintainer review
Next action: Review the blockers below.
Findings: 1 blocker · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 1 blocker · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 3 warnings · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported 1 fewer blocker, 3 more warnings, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture

3 optional E2E recommendations

• gpu-e2e
• ubuntu-repo-docker-post-reboot-recovery
• spark-install

Blockers

PRA-1 Blocker — Do not execute unvalidated OS metadata in the privileged preparation path

• Location: scripts/prepare-dgx-station-host.sh:269
• Category: security
• Problem: `check_platform()` executes `source /etc/os-release` after `run_apply()` has acquired sudo authentication. The file is only checked for readability, so a writable or redirected os-release can contain shell syntax that runs in the installer process before its privileged host mutations.
• Impact: A local attacker who can alter the sourced OS metadata can execute arbitrary shell commands while an authenticated sudo credential is cached, defeating the newly added installer-to-host trust boundary and enabling privileged host changes.
• Fix: Parse only the required os-release keys without shell evaluation, or first resolve and validate the file as a root-owned regular file not writable by group or other before reading a constrained format.
• Verification: Inspect `check_platform()` and confirm an os-release fixture containing a command substitution or shell command cannot execute it when `--apply` reaches platform validation.
• Test coverage: Add a helper test that supplies unsafe or executable os-release content (including a symlink/writable-file case) and proves preparation rejects it without executing the payload.
• Evidence: `scripts/prepare-dgx-station-host.sh:269` sources `/etc/os-release` after only `[[ -r /etc/os-release ]]`. `run_apply()` acquires sudo at `scripts/prepare-dgx-station-host.sh:881-883` before calling `common_preflight()`, which invokes `check_platform()`. The helper otherwise treats root-owned, non-writable configuration files as a trust boundary in its repository and Docker configuration helpers.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 6

🧹 Nitpick comments (1)

test/install-station-host-preparation.test.ts (1)

228-323: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Exercise the symlink-safe resume-state contract.

The tests cover file mode and malformed content, but not a pre-existing station-express-resume symlink. Add public-boundary tests proving resume loading and persistence reject symlinks without reading or modifying their target.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/install-station-host-preparation.test.ts` around lines 228 - 323, Add
public-boundary tests covering a pre-existing symlink at station-express-resume
for both load_station_express_resume and ensure_station_express_host. Verify
each operation rejects the symlink, does not read its target during resume
loading, and does not modify the target during persistence, while preserving the
existing error/status expectations.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/install.sh`:
- Line 3092: Disclose that DGX Station support remains Deferred and pending
physical end-to-end validation across all four sites: scripts/install.sh lines
3092-3092, docs/get-started/prerequisites.mdx lines 44-49, and
docs/get-started/quickstart.mdx lines 124-125 and 195-197. Add the status before
installation and reboot acceptance in the installer, add a warning in
prerequisites, and qualify both quickstart reboot-and-resume Station flows;
preserve the existing recipe and explicitly state that validation remains open.
- Around line 3146-3150: Update the DGX Station resume path around
load_station_express_resume and activate_express_install to evaluate the
existing NEMOCLAW_PROVIDER override guard before resuming; when an explicit
provider is set, skip this branch so activate_express_install cannot overwrite
it, and remove the later duplicate provider guard.

In `@scripts/prepare-dgx-station-host.sh`:
- Around line 278-289: Update the Docker detection branch around `containers` so
an inactive Docker daemon is not represented as an empty container list.
Preserve the unavailable/unknown state when `systemctl is-active --quiet
docker.service` is false, and ensure the later startup logic around the
workload-safety check cannot auto-start workloads until container state has been
successfully verified.
- Around line 425-433: Update ensure_docker_group so adding Docker membership
via usermod records the host as requiring reboot/resume and returns status 10
instead of reporting success; preserve status 0 when membership is already
active or non-sudo Docker access is verified, matching install.sh’s existing
status handling.
- Around line 368-383: Update the repository setup flow around dpkg -i, Docker
key installation, and Docker source-list creation to preserve existing
configuration before mutation: reuse files that exactly match the expected
content, and reject mismatched existing files or package state instead of
downgrading or overwriting them. Apply the existing package-pin contract and
relevant validation/backup helpers consistently across the CUDA keyring and
Docker repository configuration.

In `@test/install-station-host-preparation.test.ts`:
- Around line 16-29: Add timeout: 15_000 and killSignal: "SIGKILL" to the
spawnSync options in runSourced and both resume-state probe call sites, ensuring
all three synchronous Bash subprocesses are forcibly bounded without changing
their existing environment or commands.

---

Nitpick comments:
In `@test/install-station-host-preparation.test.ts`:
- Around line 228-323: Add public-boundary tests covering a pre-existing symlink
at station-express-resume for both load_station_express_resume and
ensure_station_express_host. Verify each operation rejects the symlink, does not
read its target during resume loading, and does not modify the target during
persistence, while preserving the existing error/status expectations.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a1d595cd-0728-4042-84f6-82efd78d9ff6

📥 Commits

Reviewing files that changed from the base of the PR and between 3bc9620 and 7299bec.

📒 Files selected for processing (8)

• docs/get-started/prerequisites.mdx
• docs/get-started/quickstart.mdx
• scripts/checks/vitest-project-overlap.ts
• scripts/install.sh
• scripts/prepare-dgx-station-host.sh
• test/install-express-prompt.test.ts
• test/install-station-host-preparation.test.ts
• vitest.config.ts

[senthilr-nv]

Reviewed current head 8e5fb909. Two Station correctness blockers remain.

Blocker — the clean-factory DKMS transition is rejected.

The audited CLEAN Ubuntu image starts with dkms=3.0.11-1ubuntu13, while this recipe intentionally selects dkms=1:3.4.0-1ubuntu1 because nvidia-dkms-open requires the newer DKMS. assert_no_package_mismatches() classifies that known starting state as a forbidden mismatch, so run_apply() exits before install_packages() instead of performing the validated upgrade. The "installs only missing packages" test stubs assert_no_package_mismatches(), so it does not exercise the real factory state.

Please allow only the explicit dkms 3.0.11-1ubuntu13 -> 1:3.4.0-1ubuntu1 transition, continue rejecting arbitrary prerequisite mismatches, and add a regression test proving the factory state reaches exit 10 after package preparation.

High — the pre-mutation platform gate accepts non-GB300 DGX Stations.

is_station_product() accepts any product string containing DGX Station, including an older or otherwise unsupported Station without GB300. The GPU-name check for GB300 occurs only in verify_gpu(), after repository, package, driver, service, group, and reboot changes may already have occurred.

Require both Station and GB300 in the initial DMI gate before any sudo mutation, and add negative tests for DGX Station, DGX Station A100, and other non-GB300 Station names while retaining the validated OEM Station GB300 form.

Please address or clarify these in the next revision.

[senthilr-nv]

Security review of current head 8e5fb909:

The SHA-256, GPG-fingerprint, exact-version, and container-digest checks are good. I found no hardcoded secret, shell-injection path, or newly exposed service. Before promoting the pilot helper into the installer, please address or clarify these boundaries.

Major — privileged configuration paths are not fully validated.

install_exact_file_or_reuse() reuses APT key and source files after checking content and symlinks, but it does not require a regular file, root:root ownership, non-writable group/other modes, or safe parent-directory metadata. A writable trust file can change between comparison and sudo apt-get update. Similarly, /etc/docker/daemon.json is passed to root-running nvidia-ctk without rejecting symlinks or unsafe metadata. Require safe type, ownership, mode, link state, and parent directories before use, then install or update atomically.

Medium — the boot marker permits same-user file clobbering.

write_install_boot_marker() writes through a predictable path with cp. A pre-existing marker symlink can overwrite another user-owned file. Give this state the same owner-only, symlink-safe, temporary-file-plus-atomic-rename contract as the Station resume marker.

Major — reboot resume is not bound to an immutable installer revision.

The default install reference is mutable lkg, while station-express-resume records only the selected model. The pre-reboot and post-reboot portions can therefore execute different helper and package contracts. Persist and validate the resolved commit SHA, and resume against that exact commit.

Security contract — Docker-group membership is a persistent root-equivalent grant.

The Station helper automatically runs usermod -aG docker before the generic Docker path presents its root-impact explanation. This was acceptable for the controlled single-user pilot, but the Station express disclosure should state that privilege before consent, and shared or managed systems need an approved alternative or opt-out.

Holistic posture — pilot service exceptions are too broad for a canonical installer.

cloud-init and network-wait failures are accepted by unit name alone. Bind these exceptions to qualified image and failure conditions, or fail closed, so an unrelated provisioning or host-hardening failure is not silently accepted.

These are separate from the existing automated-review comments and the functional clean-factory/GB300 findings. Please address or clarify them in the next revision.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/install-station-host-preparation.test.ts`:
- Around line 425-440: Update the test for prepare_installer_host to stub the
production boundary ensure_station_express_host instead of the indirect
run_station_host_preparation helper. Emit the existing PREPARE_STATION marker
from that stub and keep the assertions verifying it is absent and that
ENSURE_DOCKER precedes ENSURE_BUILD_DEPS.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 8a0ec0ed-eb3f-4836-a733-88b9b7228bf1

📥 Commits

Reviewing files that changed from the base of the PR and between 8e5fb90 and 34ac3fb.

📒 Files selected for processing (3)

• scripts/install.sh
• scripts/prepare-dgx-station-host.sh
• test/install-station-host-preparation.test.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• scripts/install.sh
• scripts/prepare-dgx-station-host.sh

[cv]

Blocking exact head fb2be367c5580158353a7a21ca6893345358119b. This creates a new supported, privileged DGX Station installer surface without an accepted product-scope decision defining ownership, lifecycle, compatibility, security, and physical validation, so the repository product-scope gate is not satisfied. The implementation also still has unresolved host-safety and resume-integrity issues: DKMS/package transition handling and GB300 gating are incomplete; repository/keyring files and resume state are not protected by the required metadata/symlink/TOCTOU contracts; reboot state is mutable; Docker group activation and inactive-daemon/container-state handling can report unsafe success; and service/workload mutation remains too broad. The current CodeRabbit findings about provider override ordering, repository preservation, Docker membership/reboot, inactive daemon state, symlink-safe resume, and bounded subprocess tests are valid. Please obtain the product decision first, then resolve these contracts and provide physical Station E2E evidence before this can target v0.0.85.

[senthilr-nv]

Current head 81c80f35a addresses the remaining host-safety findings and the CDI lifecycle warning:

• Station consent now states that Docker-group membership is root-equivalent and limits automatic preparation to trusted single-user development hosts.
• Failed units block by default; only exact, condition-qualified generic-image states are accepted.
• CDI now uses only the packaged nvidia-cdi-refresh lifecycle. Refresh failure or a missing nvidia.com/gpu=all device prints diagnostics and stops; there is no direct-generation fallback.

Current-head validation: installer integration 233 passed, 2 skipped; ShellCheck/shfmt passed; docs built with 0 errors (2 existing warnings). All ordinary CI, image E2Es, CodeQL, and both review-advisor lanes passed. The trusted gate hit a transient GitHub API 500 before the selected credentialed E2Es could start; its retry confirmed that maintainer authorization is now required for cloud-onboard, credential-sanitization, and security-posture.

Physical clean-host validation was performed on prior head 26eef0914. Host preparation, reboot, post-reboot driver/Docker/CDI/GPU checks, vLLM, the OpenShell route, exact-response smoke, tool-artifact smoke, and zero-ECC checks passed. The first model fetch hit an external unauthenticated Hugging Face 429, so onboarding completed through an authenticated manual resume. This is a recovered E2E pass, not an uninterrupted Express pass; HF retry/auth handling and preservation of Express selections on resume remain follow-up golden-path items.

Please authorize the selected credentialed E2Es and independently rereview current head.

[senthilr-nv]

Exact-head handoff for 01ddd1f7232bbacc508469310746c7496df29666 on current main 24c73341394b84b887fbcfa9ec5028a7e6fadfb8:

• Ordinary CI is green. CLI shard 1 passed on the single rerun after three unrelated pr-review-advisor test timeouts.
• The workload race is fixed: if a workload appears at the final restart boundary, the script restores daemon.json without restarting Docker. Focused installer tests pass 56/56.
• PRA-1 is based on an incorrect premise. NVIDIA Container Toolkit injects the host driver utility when CDI/--gpus all is requested; nvidia-smi need not be baked into the Ubuntu image. The clean GB300 run exercised this exact digest-pinned Ubuntu probe path and logged full nvidia-smi output, docker_gpus_contract=pass_without_configuration_change, driver 610.43.02, ECC 0/0, and STATION_HOST_READY.
• The exact-head trusted plan is dda8b737681fddee9e1eb63bcb4199ea4417dbafacfea91d381b7ca08404484f, selecting cloud-onboard, credential-sanitization, and security-posture. It is waiting for maintainer/admin authorization; the E2E gate failure is that authorization boundary, not a test failure.

The physical Station run remains a recovered prior-head E2E: chat, tool use, and ECC passed after an HF 429 required authenticated resume. @ericksoa, please authorize the selected exact-head jobs. @cv, please independently rereview this exact head after they complete.

[ericksoa]

Maintainer waiver for the exact-head non-success E2E / PR Gate at 40781651e63be3191571717877154cf2b9791b57 (base 3558a7a845d69297894054063c7286c23e7a6b63).

I am accepting only the Hermes security-posture hosted-runner interruption for this PR. Both authorized attempts ended with GitHub’s The runner has received a shutdown signal / The operation was canceled messages and no Vitest assertion: attempt 1, attempt 2. In both attempts, the other selected E2E lanes passed. The same signature has independently occurred on PRs #7036, #7040, #7032, and #6904 across distinct GitHub-hosted runners, while adjacent Hermes runs passed. Ordinary exact-head CI and both review advisors are green.

This waiver is narrow: it does not accept a product/test assertion failure, missing evidence from a completed test, or any future head. Follow-up #7052 tracks safe exact-diff E2E retry recovery; its current draft implementation does not yet classify this runner-loss shape.