fix(installer): allow idle PackageKit on Station

[senthilr-nv]

Summary

Generic Ubuntu Station preparation currently rejects Ubuntu's resident packagekitd process even when it is idle. This change lets the idle daemon coexist while preventing PackageKit from racing NemoClaw's repository and package transaction.

Related Issue

Fixes #7240

Changes

• Exclude the resident packagekitd process from the generic-Ubuntu process-only preflight gate while retaining every APT/dpkg process and lock check.
• Before repository mutation, place a runtime-only mask on packagekit.service, query PackageKit's own transaction list, and fail closed on active or malformed transaction state.
• Ask an idle daemon to exit through SuggestDaemonQuit, verify it is inactive, and hold the runtime mask through the complete repository/package critical section.
• Restore only the runtime mask and prior active state changed by NemoClaw, including through the global exit trap.
• Cover idle exclusion and restoration, an active lock-free transaction, and activity appearing after the initial preflight inspection.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: the runtime-only PackageKit boundary is automatic, restores prior service state, and adds no command, option, persistent configuration, operator step, or support-boundary change.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: maintainer review requested on this PR.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — vitest run --project installer-integration test/install-station-package-state.test.ts test/install-station-package-transaction.test.ts test/install-station-host-preparation.test.ts (86 passed)
• Applicable broad gate passed — focused Station package-safety fix; broad gate deferred to CI.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

Physical Validation

Fresh generic-Ubuntu Station reboot/resume and full E2E evidence will be attached from the reprovisioned pmgb300ws-0042 qualification run.

---

Signed-off-by: Senthil Ravichandran senthilr@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Improved package-manager readiness and safety on Ubuntu hosts by handling PackageKit activity during package operations, preventing concurrent transactions while allowing safe residual idle activity.
  • Continued fail-closed detection of PackageKit activity on non-Ubuntu host profiles and when PackageKit holds an APT lock.
  • Added more robust cleanup to restore PackageKit state after interruptions.
• Tests
  • Expanded PackageKit-specific test coverage for Ubuntu and non-Ubuntu host profiles, including correct quiesce/restore behavior and lock/transaction rejection scenarios.

[coderabbitai]

📝 Walkthrough

Walkthrough

PackageKit handling now distinguishes idle daemons from active package work, quiesces and restores PackageKit around generic Ubuntu package installation, and restores runtime state during cleanup. Dedicated tests cover transaction, lock, ordering, and host-profile behavior.

Changes

PackageKit transaction handling

Layer / File(s)	Summary
Profile-specific PackageKit detection scripts/prepare-dgx-station-host.sh, test/install-station-package-state.test.ts	Generic Ubuntu allows idle packagekitd while retaining APT/dpkg lock checks; other profiles continue treating it as active.
PackageKit transaction boundary scripts/prepare-dgx-station-host.sh	PackageKit is runtime-masked and drained before installation, restored afterward, and included in EXIT cleanup for interrupted runs.
PackageKit boundary validation test/install-station-package-state.test.ts	Tests simulate PackageKit service and transaction states, verifying call ordering, mutation prevention, lock rejection, and profile-specific behavior.

Estimated code review effort: 4 (Complex) | ~45 minutes

Suggested reviewers: apurvvkumaria, ericksoa

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The code and tests cover idle PackageKit, lock handling, and blocking active package-manager processes, but the required fresh Station E2E run is not confirmed here.	Provide evidence from the PR or CI that a fresh generic Ubuntu Station reaches the reboot/resume boundary and completes end-to-end after the fix.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The diff stays focused on PackageKit handling and targeted tests for Station preparation, with no unrelated changes visible in the summary.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: allowing idle PackageKit on Station.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cjagwani]

Blocking on exact head 368665d31e511604c9bb91ac8b18a8d2115fa065.

The generic-Ubuntu branch at scripts/prepare-dgx-station-host.sh:827-842 removes packagekitd from the process gate and infers idleness only from four APT/dpkg locks. That is not a safe idle predicate: PackageKit 1.2.8 only takes the APT cache lock for install/install-files/remove/update roles, while active RepoEnable/RepoRemove transactions can rewrite source-list files without any of these tracked locks. Such a lock-free transaction can pass this gate and race NemoClaw's repository setup, metadata refresh, simulation, or source selection.

Please make active PackageKit state fail closed (or keep PackageKit quiesced across the full repository/package critical section with trap-safe restoration), and add regressions for an active lock-free transaction plus the after-inspection/critical-section transition.

The linked issue #7240 also requires a fresh physical generic-Ubuntu Station run through reboot/resume and completed E2E. The current gate says no E2E checks were selected and no physical-run evidence or maintainer waiver is recorded, so that acceptance criterion remains open.

[senthilr-nv]

@cjagwani Addressed the blocking PackageKit finding in signed commit a92d8d910.

• A runtime-only systemd mask is established before PackageKit transaction inspection and remains in place through the complete repository/APT critical section.
• GetTransactionList now fails closed on active or malformed lock-free transaction state.
• An idle daemon exits through SuggestDaemonQuit; preparation does not mutate repositories until systemd reports it inactive.
• The global exit trap removes only NemoClaw's runtime mask and restores the prior active service state.
• Regressions cover an active lock-free transaction and activity appearing after the initial preflight inspection; no package mutation is reached in either failure case.

Focused verification: 86 tests passed across Station package state, package transaction, and host preparation. All normal pre-commit, commit-message, and pre-push hooks passed.

The fresh generic-Ubuntu physical reboot/resume E2E criterion remains explicit and will be attached from the reprovisioned pmgb300ws-0042 run.

The code blocker is addressed by verified head a92d8d9: PackageKit is runtime-masked before transaction inspection, active or malformed lock-free transaction state fails closed, the daemon must become inactive before repository/package mutation, and cleanup restores the run-owned mask/state. Physical Station E2E is waived per maintainer direction. Dismissing this prior exact-head changes-requested review; current-main refresh and pending CI remain ordinary gates.