fix(installer): constrain Station metadata override

[senthilr-nv]

Summary

Restricts --force-station-install to DGX Station GB300 systems whose release metadata is actually unrecognized. Recognized profiles now fail before host mutation, while the remaining forced path also verifies the exact GB300 PCI identity and fails closed if its required prompt becomes unreadable.

Related Issue

Fixes #7138

Changes

• Reject the force flag during outer installer preflight when release classification is generic Ubuntu, stock DGX OS, Colossus BaseOS, or NVIDIA AI Developer Tools.
• Repeat the recognized-profile guard in the Station preparation helper so direct callers cannot enter package or runtime preparation.
• Require the exact NVIDIA GB300 PCI vendor, device, and display-class identity before selecting the forced factory-runtime profile.
• Fail closed when the forced interactive prompt becomes unreadable instead of silently continuing through another install path.
• Add regression coverage for all recognized release states, unchanged unforced generic Ubuntu behavior, mutation boundaries, exact PCI identity, and prompt-read failure.

The PCI and prompt-read changes close the two unaddressed force-path findings reported by the PR Review Advisor on #7132.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: the Station preparation, quickstart, and platform-support pages already document the narrow metadata-only override and mandatory hardware/runtime checks; this fix makes implementation match that contract.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: accepted scope and fail-before-mutation criteria are recorded in bug(installer): --force-station-install can enter generic Ubuntu package mutation #7138; the exact PCI and prompt-read gaps were independently reported in the final PR Review Advisor review on feat(installer): add temporary Station metadata override #7132.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, including shfmt, ShellCheck, repository checks, secret scanning, CLI type-checking, and commitlint
• Targeted behavior tests pass for the current change set — npx vitest run --project installer-integration test/install-express-prompt.test.ts test/install-station-dgx-os.test.ts (128 passed, 1 skipped); npx vitest run --project installer-integration test/install-station-host-preparation.test.ts (55 passed); npx vitest run --project integration test/install-station-platform-identity.test.ts (20 passed)
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Senthil Ravichandran senthilr@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Improved forced DGX Station installation validation for already-supported host configurations.
  • Added clearer errors when required GPU hardware is missing or does not match.
  • Improved non-interactive installation failures when an interactive terminal is required.
  • Prevented system changes when platform identity checks fail.
• Tests
  • Added coverage for supported release profiles, invalid GPU identities, and unreadable installation prompts.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5570ef50-4624-455f-8872-2901d1c3a233

📥 Commits

Reviewing files that changed from the base of the PR and between 7ab2262 and 8736b63.

📒 Files selected for processing (5)

• scripts/install.sh
• scripts/prepare-dgx-station-host.sh
• test/install-express-prompt.test.ts
• test/install-station-dgx-os.test.ts
• test/install-station-platform-identity.test.ts

---

📝 Walkthrough

Walkthrough

The installer and Station preparation helper now reject --force-station-install for recognized release profiles, require the expected GB300 PCI identity for forced validation, and prioritize terminal-required errors when Express prompting cannot read input. Regression tests cover recognized, generic Ubuntu, unsupported, and invalid-hardware states.

Changes

Forced Station validation

Layer / File(s)	Summary
Outer installer validation and Express prompt handling scripts/install.sh, test/install-express-prompt.test.ts	Release classification now rejects recognized profiles during installer preflight, while unreadable Express prompts prioritize the --force-station-install terminal error. Tests make release classification deterministic and cover non-interactive and unreadable-prompt cases.
Station preparation gating scripts/prepare-dgx-station-host.sh, test/install-station-dgx-os.test.ts	Station preparation rejects forced installs on recognized profiles, retains generic Ubuntu behavior without the force flag, and clarifies the GB300 PCI prerequisite for forced factory-runtime validation.
Platform identity rejection test/install-station-platform-identity.test.ts	Forced installation with an incorrect PCI vendor fails with the expected GB300 identity error before unintended mutation.

Estimated code review effort: 2 (Simple) | ~15 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Installer
  participant ReleaseClassifier
  participant StationPreparation
  participant GPUIdentityCheck
  Installer->>ReleaseClassifier: classify Station release
  ReleaseClassifier-->>Installer: release state
  Installer->>StationPreparation: start forced installation
  StationPreparation->>GPUIdentityCheck: verify GB300 PCI identity
  GPUIdentityCheck-->>StationPreparation: validation result
  StationPreparation-->>Installer: reject or continue preparation

Loading

Possibly related PRs

• NVIDIA/NemoClaw#7090: Refactors the GB300 PCI detection used by the forced Station validation flow.
• NVIDIA/NemoClaw#7108: Updates the DGX Station release classification and gating paths used here.
• NVIDIA/NemoClaw#7132: Introduces the related forced Station metadata override behavior extended by this change.

Suggested labels: bug-fix, platform: ubuntu, platform: arm64

Suggested reviewers: ericksoa, jason-ma-nv, miyoungc

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: tightening Station metadata override behavior.
Linked Issues check	✅ Passed	The changes match #7138 by restricting force-station-install to unsupported metadata, guarding preflight and preparation, and adding regression coverage.
Out of Scope Changes check	✅ Passed	No clear out-of-scope changes appear; the extra GB300 identity and prompt-read guards support the stated installer safety objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.