fix(ci): select DCode E2E for runtime changes

[prekshivyas]

Summary

Deep Agents Code runtime changes could produce an empty deterministic E2E plan even when the PR Review Advisor selected the existing DCode typed target. Risk-plan v6 now selects that target directly from trusted changed-file paths, so a fork revision cannot pass E2E coordination without entering the protected approval path.

Related Issue

Related to #7463

Changes

• Select ubuntu-repo-cloud-langchain-deepagents-code for non-documentation runtime changes under agents/langchain-deepagents-code/ and for the existing headless-inference live check.
• Keep documentation and ordinary test changes alone at tier 0.
• Advance the deterministic risk-plan version to 6 because selector semantics changed.
• Add an exact regression for fix(dcode): supply the Ultra template argument from the managed resolver #7463's four changed paths and exercise the fork controller path with the managed DCode runtime patch.
• Document the expanded selector boundary and empty-plan prevention in test/e2e/README.md.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Nine-category security review passed exact head ed8eab5ed65f9bd539a0221aadf54a8de6705d91 against base e833bd863f0b06be97bedaf5343188ee19923384 with no findings; target selection remains allowlisted and exact-plan-bound, and the Hermes image is pinned to the trusted published remediation digest.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: test/e2e/README.md accurately documents DCode runtime target selection, explicit protected credentialed-E2E approval for risky fork plans, and empty-plan behavior. The immutable Hermes digest refresh and conflict-free upstream retry-history merge require no additional user documentation. Changed text follows WRITING.md; git diff --check passes.
• Agent: Codex Desktop documentation writer subagent

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: the combined risk-plan, fork-controller, advisor, security-boundary, and typed-target suite passed 166 tests; the affected E2E-support workflow boundary passed 31 tests. After the current-main refresh, four focused integration files passed 125 tests and the final test commit's pre-commit hooks passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Pull-request CI will provide the applicable broad gate.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Prekshi Vyas prekshiv@nvidia.com

Summary by CodeRabbit

• Documentation
  • Updated E2E gate guidance for when Deep Agents Code runtime changes select the typed end-to-end target, including the headless inference requirement and credentialed E2E approval behavior.
• Bug Fixes
  • Refined deterministic PR risk-plan targeting so relevant managed runtime changes select the canonical typed target, while documentation-only or test-only changes no longer do.
• Tests
  • Updated the deterministic risk-plan version assertion and added coverage for canonical Deep Agents typed target selection scenarios.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

Deep Agents Code runtime changes now select typed E2E targets, with risk-plan version 6, updated invariants, tests, and gate documentation. The Hermes Dockerfile also updates its pinned sandbox base-image digest.

Changes

Deep Agents Code risk targeting

Layer / File(s)	Summary
Risk-plan matching and invariants tools/advisors/risk-plan.mts	Risk-plan version 6 and focused E2E matching now include non-documentation runtime files under the Deep Agents Code path and the headless-inference check.
Risk-plan validation and gate documentation test/pr-risk-plan.test.ts, test/e2e/README.md	Tests cover typed-target selection and documentation-only exclusions; E2E guidance documents correlated dispatch and fork approval behavior.

Hermes base image

Layer / File(s)	Summary
Hermes base-image repin agents/hermes/Dockerfile	The default Hermes sandbox base image is pinned to a new digest.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• NVIDIA/NemoClaw issue 7451 — Covers related PR E2E risk-plan target selection and gate documentation.

Possibly related PRs

• NVIDIA/NemoClaw#7582 — Shares the Hermes Dockerfile BASE_IMAGE digest repin.

Suggested labels: area: e2e, integration: hermes

Suggested reviewers: apurvvkumaria

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main CI change: selecting Deep Agents Code E2E for runtime changes.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-advisor-e2e-plan

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit ed8eab5 in the codex/fix-advisor-e2... branch remains at 96%, unchanged from commit b16bcaf in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit ed8eab5 in the codex/fix-advisor-e2... branch is 81%. The coverage in commit b16bcaf in the main branch is 80%.

Show a code coverage summary of the most impacted files.

File	main b16bcaf	codex/fix-advisor-e2... ed8eab5	+/-
src/lib/onboard...eway-service.ts	81%	82%	+1%
src/lib/actions...dbox/destroy.ts	93%	95%	+2%
src/lib/actions...e-validation.ts	81%	84%	+3%
src/lib/onboard...shboard-port.ts	90%	93%	+3%
src/lib/state/o...oint-migrate.ts	92%	96%	+4%
src/lib/actions...lution-probe.ts	88%	93%	+5%
src/lib/actions...x/mcp-bridge.ts	36%	43%	+7%
src/lib/domain/.../connect-env.ts	89%	97%	+8%
src/lib/actions...-add-restart.ts	10%	19%	+9%
src/lib/actions...on-readiness.ts	91%	100%	+9%

---

_{Updated July 26, 2026 19:08 UTC}

[prekshivyas]

Verdict

PASS. I reviewed exact head d38fb3159f36e22d1ecb671205c6681a9844d386 against main. The change conservatively expands the trusted deterministic selector to an existing allowlisted target. It does not accept advisor output as dispatch authority, expose secrets to fork code, or weaken exact plan, SHA, repository, approval, and evidence validation.

Findings

No security findings.

Detailed analysis

1. Secrets and Credentials — PASS. No secret, token, credential, fixture, or credential-handling code changed.
2. Input Validation and Data Sanitization — PASS. The new match uses one exact repository prefix and excludes documentation suffixes. The target ID remains a checked-in constant and is still validated against the trusted typed-target allowlist.
3. Authentication and Authorization — PASS. Authorization logic is unchanged. A newly matched fork revision enters the existing protected approval path instead of receiving a tier-0 success.
4. Dependencies and Third-Party Libraries — PASS. No dependency or package metadata changed.
5. Error Handling and Logging — PASS. No errors, logs, or user-controlled values were added to runtime output.
6. Cryptography and Data Protection — PASS. Plan hashing and exact-SHA binding are unchanged; no cryptographic behavior changed.
7. Configuration and Security Headers — PASS. No service, container, permission, network, or HTTP configuration changed.
8. Security Testing — PASS. The regression covers fix(dcode): supply the Ultra template argument from the managed resolver #7463's exact four-file diff, proves documentation and ordinary tests alone remain tier 0, and exercises the fork controller's protected-approval result for the managed runtime patch.
9. System Security — PASS. The controller still rebuilds the plan independently from GitHub's changed-file list, admits only the existing typed target, and requires bound E2E evidence or the current fork approval outcome. The change removes a fail-open selection gap without adding a race or trust transition.

Files reviewed

• tools/advisors/risk-plan.mts
• test/pr-risk-plan.test.ts
• test/pr-e2e-gate-fork-skip.test.ts
• test/e2e/README.md

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

tools/advisors/risk-plan.mts (1)

125-136: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add regression coverage for the headless and .mdx branches.

The new test covers a runtime-file match and a .md exclusion, but not the exact headless-inference path or .mdx exclusion introduced here. Add behavioral cases asserting both outcomes.

As per path instructions, advisor logic must have focused tests for both detection and false-positive behavior.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/advisors/risk-plan.mts` around lines 125 - 136, Add focused regression
tests for the matching logic that produces matchedFiles: verify
DEEPAGENTS_HEADLESS_INFERENCE_CHECK is detected, and verify files ending in .mdx
under DEEPAGENTS_CODE_RUNTIME_ROOT are excluded. Keep the existing runtime-file
detection and .md exclusion coverage, and assert both detection and
false-positive outcomes.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/README.md`:
- Around line 462-464: Update the fork-revision guidance in the correlated
workflow documentation to apply only when the plan selects credential-bearing
E2E jobs or targets. State that such fork revisions require explicit
credentialed-E2E skip approval, while plans with no selected jobs or targets can
complete without an E2E run.

---

Nitpick comments:
In `@tools/advisors/risk-plan.mts`:
- Around line 125-136: Add focused regression tests for the matching logic that
produces matchedFiles: verify DEEPAGENTS_HEADLESS_INFERENCE_CHECK is detected,
and verify files ending in .mdx under DEEPAGENTS_CODE_RUNTIME_ROOT are excluded.
Keep the existing runtime-file detection and .md exclusion coverage, and assert
both detection and false-positive outcomes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 9cbe04b8-72d5-4cb4-8620-4f9bc11e243a

📥 Commits

Reviewing files that changed from the base of the PR and between 2f6298e and d38fb31.

📒 Files selected for processing (4)

• test/e2e/README.md
• test/pr-e2e-gate-fork-skip.test.ts
• test/pr-risk-plan.test.ts
• tools/advisors/risk-plan.mts

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 1 warning · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 1 more warning, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, full-e2e, hermes-e2e, security-posture

1 optional E2E recommendation

• ubuntu-repo-cloud-langchain-deepagents-code

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[prekshivyas]

Security review for 9dd1c973c61c6dd2959c880489635fe015994107

Result: PASS — no security findings.

1. Secrets and credentials — PASS. No secrets, tokens, credentials, or sensitive values are added or logged.
2. Input validation — PASS. The selector uses the existing exact directory prefix and isRuntimeRelevant predicate; the selected E2E target is a compile-time constant.
3. Authentication and authorization — PASS. Existing protected-environment authorization remains unchanged. The change closes a path that could incorrectly avoid E2E selection.
4. Dependencies and supply chain — PASS. No dependency, action, image, or lockfile changes.
5. Errors and logging — PASS. No new error handling or logging behavior.
6. Cryptography and integrity — PASS. Existing risk-plan hashing and exact-head validation remain unchanged.
7. Configuration and deployment — PASS. No runtime configuration or deployment surface is added.
8. Tests — PASS. Regression coverage uses the exact four-file shape from fix(dcode): supply the Ultra template argument from the managed resolver #7463, confirms Markdown/MDX/test-only exclusions, preserves the existing headless-check selection, and verifies fork PRs enter the authorization path instead of passing with an empty plan.
9. System boundaries — PASS. The trusted controller still rebuilds the plan, enforces the target allowlist, and binds authorization to the exact PR revision.

The follow-up commit narrows selection with the repository's existing runtime-relevance predicate, so test-only and documentation-only changes under the DCode directory do not gain unnecessary credentialed E2E access.

[prekshivyas]

Reviewed exact head 9dd1c973c61c6dd2959c880489635fe015994107 against base 2f6298ee165f4821f635be962fedff5e165701ee.

Verdict: PASS — no findings.

• The deterministic controller now maps runtime-relevant changes under agents/langchain-deepagents-code/ to the existing allowlisted ubuntu-repo-cloud-langchain-deepagents-code target.
• The shared runtime predicate excludes documentation, MDX, ordinary test directories, and *.test.* or *.spec.* files.
• The selector cannot introduce an arbitrary target; dispatch still validates the compile-time target allowlist and exact PR/base SHAs.
• Protected authorization, controller-side plan reconstruction, plan hashing, trusted workflow dispatch, and bound evidence validation remain unchanged.
• Regression coverage includes #7463's exact changed-file set, the existing headless-inference selector, Markdown/MDX/test-only exclusions, and the fork approval path.

All nine sensitive-path security categories pass. Ordinary CI, CodeQL, CodeRabbit, and both PR Advisor lanes are clean. The one unrelated CLI test timeout passed on rerun.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[prekshivyas]

Reviewed exact head 6373d3db4e7985befa1697c98c73d7107faf20d8 against base d4a859a886f36da3ecf953edf6b5121c1ea84842.

Verdict: PASS — no findings. The current-main refresh carries already-merged repository fixes; the only PR-specific delta since the prior security review corrects the fork-controller regression to assert the selected targets: evidence for a target-only plan. The original risk-plan change still narrows matching to one compile-time allowlisted DCode target, excludes docs and ordinary tests, rebuilds the plan in the trusted controller, and preserves protected authorization plus exact head/base binding.

Nine-category result:

1. Secrets and credentials — PASS: no credentials or secret values added; protected fork authorization remains required.
2. Input validation and sanitization — PASS: changed paths are matched by fixed exact/prefix predicates and targets remain compile-time allowlisted.
3. Authentication and authorization — PASS: no authorization bypass; runtime changes now enter the protected approval path.
4. Dependencies — PASS: no PR dependency change.
5. Error handling and logging — PASS: summaries expose only deterministic plan metadata and SHAs.
6. Cryptography and data protection — PASS: no cryptographic change; existing SHA-bound plan hashing remains intact.
7. Configuration and security headers — PASS: no runtime configuration or network exposure change.
8. Security testing — PASS: focused tests cover DCode selection, docs/test exclusions, and the fork protected-approval path; four exact integration files passed 125 tests.
9. System security — PASS: the change strengthens fail-closed E2E coverage and cannot select arbitrary jobs or targets.

Files reviewed: tools/advisors/risk-plan.mts, test/pr-risk-plan.test.ts, test/pr-e2e-gate-fork-approval.test.ts, and test/e2e/README.md.

[prekshivyas]

Exact-head nine-category security review for 13efac6d67a133bb2b4395d14e5c0b6dd534c419 against base d4a859a886f36da3ecf953edf6b5121c1ea84842.

1. Input and data validation — PASS. Runtime path matching is bounded to the declared Deep Agents Code root, excludes documentation and ordinary tests, and emits only the compile-time allowlisted typed target.
2. Authentication and authorization — PASS. Risk selection does not grant credentials; risky fork execution still requires protected exact-revision authorization, and the corrected guide now states that approval authorizes execution rather than a skip.
3. Secrets and sensitive data — PASS. No secret values, new secret sources, or credential logging are introduced. Selected fork code remains behind the trusted controller boundary.
4. Injection and command execution — PASS. The change adds static path classification and an immutable image digest only; it does not interpolate changed paths into shell or generated code.
5. Network and SSRF — PASS. No new endpoint or request path is introduced. The Hermes image reference is digest-bound under the existing NVIDIA GHCR namespace.
6. Filesystem and state boundaries — PASS. No new filesystem mutation, privilege transition, or state recovery behavior is added.
7. Dependencies and supply chain — PASS. The Hermes pin is the immutable digest published by trusted base-image workflow run 30195335992 from current-main dependency remediation; it replaces the stale pre-remediation image instead of using a mutable tag.
8. Concurrency, replay, and exact identity — PASS. Risk plan version 6 changes the plan hash, retains stable unique inputs, and the controller continues to bind PR head, base, target allowlist, plan, and child run.
9. Tests and fail-closed behavior — PASS. Target selection, docs/tests exclusion, target-only authorization summaries, and deterministic plan hashing are covered. Focused selection produced 97 passing tests with one unrelated existing temp-cleanup fixture failure; normal commit and push hooks passed.

Disposition: PASS. No correctness or security findings.

[prekshivyas]

Exact-head nine-category security review for local commit ed8eab5ed65f9bd539a0221aadf54a8de6705d91 against base e833bd863f0b06be97bedaf5343188ee19923384; this commit is the next branch push.

1. Input and data validation — PASS: runtime-path matching is bounded and emits only the compile-time allowlisted DCode target.
2. Authentication and authorization — PASS: selection grants no credentials; protected authorization and exact-head/base/plan binding remain mandatory.
3. Secrets — PASS: no secret source, value, or logging path is added.
4. Injection and execution — PASS: static path classification and an immutable digest are not interpolated into executable code.
5. Network and SSRF — PASS: no endpoint is added; the base image remains digest-bound under NVIDIA GHCR.
6. Filesystem and privilege boundaries — PASS: no new mutation or privilege transition is introduced.
7. Dependencies and supply chain — PASS: the Hermes pin is the immutable digest produced by trusted base-image run 30195335992 from the reviewed remediation.
8. Concurrency and replay — PASS: plan version 6 changes the deterministic hash; exact PR/base/plan/child identity remains enforced. The conflict-free main refresh carries upstream fix(maintainer): accept retryable E2E history #7584 unchanged.
9. Tests and fail-closed behavior — PASS: target selection, docs/tests exclusion, target-only summaries, and plan hashing are covered; the prior exact head passed all ordinary CI and all six selected live E2E matrix jobs.

Disposition: PASS. No correctness or security findings.