ci(installer): trust Homebrew formula transition

[cjagwani]

Summary

Temporarily authorize exactly the current OpenShell installer template and the reviewed safe Homebrew trust-lifecycle template in base-trusted CI. This prerequisite lets #7555 validate its runtime fix without allowing the mutable pull request to authorize its own installer behavior.

Related Issue

Related to #7451

Changes

• accept the current and corrected future normalized installer-template hashes during the transition
• keep the Brev installer constrained to its single existing trusted hash
• model checksum-verified stable trust plus inherited and automatic dev-trust removal, including failure cleanup
• preserve fail-closed rejection for any other operational installer drift
• model the post-ci(installer): trust Homebrew formula transition #7558 fix(installer): trust verified Homebrew formula #7555 state and prove it rejects the legacy installer template

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: this is a CI-only trust anchor and does not change runtime behavior, supported versions, commands, configuration, or user guidance
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex Desktop reviewed the base-trusted boundary. The successor hash was derived from and revalidated against fix(installer): trust verified Homebrew formula #7555's exact corrected installer; the dependent consumer is named, and negative coverage rejects any transition drift.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: At exact PR SHA 4c6f09d585eada4097f1b42dfc945986ae64470c, this changes only the base-trusted verifier allowlist and fixtures for fix(installer): trust verified Homebrew formula #7555's safe Homebrew trust lifecycle. It does not change installer runtime behavior or a supported user contract. The corrected fix(installer): trust verified Homebrew formula #7555 parser proof, 75/75 installer-hash tests, npm run build:cli, and npm run check:diff passed.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed; npm run build:cli and npm run check:diff also passed on exact head 4c6f09d585eada4097f1b42dfc945986ae64470c
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run test/installer-hash-check.test.ts (75/75 passed); the updated parser also accepted fix(installer): trust verified Homebrew formula #7555's exact corrected installer template.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Charan Jagwani cjagwani@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Updated installer/template verification to accept only templates whose computed hashes match a predefined allowlist, while continuing to reject drifted or unapproved templates with “not base-trusted” guidance.
• Tests
  • Added Homebrew trust-transition fixture coverage for reviewed, drifted, and completed (legacy/current vs future/updated) scenarios.
  • Asserts the approved path reports “All installer hashes are current” and that drifted/unapproved and rejected completed modes fail appropriately.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Trusted template verification now accepts approved SHA-256 allowlists for installer and Brev templates. Tests add Homebrew trust-transition fixtures covering accepted transitions, drift rejection, and completed transition states.

Changes

Trusted template verification

Layer / File(s)	Summary
Allowlist-based template verification scripts/checks/extract-installer-pins.mts	Installer and Brev hashes use allowlists, with verification, failure reporting, and CLI wiring updated accordingly.
Homebrew transition test coverage test/installer-hash-check.test.ts	Adds Homebrew trust-transition fixtures, trusted-parser mutations, and assertions for accepted, rejected, and completed transition states.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7555: Adds related Homebrew formula trust behavior before installation.

Suggested labels: area: security

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the main change: CI now trusts the Homebrew formula transition.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/7451-homebrew-template-anchor

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 4c6f09d in the codex/7451-homebrew-... branch remains at 96%, unchanged from commit 1bfaac9 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 4c6f09d in the codex/7451-homebrew-... branch is 80%. The coverage in commit 1bfaac9 in the main branch is 81%.

Show a code coverage summary of the most impacted files.

File	main 1bfaac9	codex/7451-homebrew-... 4c6f09d	+/-
src/lib/onboard...box-prebuild.ts	92%	73%	-19%
src/lib/actions...ocker-health.ts	82%	65%	-17%
src/lib/actions...confirmation.ts	79%	69%	-10%
src/lib/actions...-add-restart.ts	19%	10%	-9%
src/lib/actions...x/mcp-bridge.ts	43%	36%	-7%
src/lib/actions...lution-probe.ts	93%	88%	-5%
src/lib/actions...e-validation.ts	84%	81%	-3%
src/lib/shields/index.ts	67%	71%	+4%
src/lib/onboard...host-anchors.ts	90%	94%	+4%
src/lib/onboard/docker-cdi.ts	70%	80%	+10%

---

_{Updated July 26, 2026 22:18 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

2 optional E2E recommendations

• openshell-version-pin
• bootstrap-install-smoke

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/installer-hash-check.test.ts`:
- Around line 760-766: Add a focused negative test alongside the accepted
Homebrew trust transition case in the installer hash-check suite. Use the
existing fixture runner and fixture conventions to mutate the brew help trust or
brew trust --formula block, then assert the result exits non-zero and does not
report all installer hashes as current.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e6326672-2808-4838-9b01-5a4bcef26ac6

📥 Commits

Reviewing files that changed from the base of the PR and between 4fdbb79 and 5c8b977.

📒 Files selected for processing (2)

• scripts/checks/extract-installer-pins.mts
• test/installer-hash-check.test.ts

[cjagwani]

The Advisor preauthorization warning is intentionally not applied. Base-trusted CI executes the checker from the base commit while validating mutable PR input, so the reviewed future template must be authorized in a separate prerequisite before the consumer PR can pass. This follows the repository transition pattern: #7558 allows only the exact current and exact #7555 normalized hashes, names #7555 as the dependent consumer, and 07a1575 adds a negative drift fixture. After #7558 merges, #7555 will tighten the allowlist to the single future hash.

[cjagwani]

Addressed PRA-1 in 06f2a95. The trust-anchor comment now names #7555 as the consumer and defines the concrete removal event: after #7558 merges, #7555 must remove the legacy hash and retain only the trust-enabled hash before merging. Executable fixture modes model that completed state, reject the legacy installer, and accept the exact trust-enabled installer. Installer-hash suite: 75/75; source-shape and normal hooks pass.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/installer-hash-check.test.ts`:
- Line 810: Update the test description in the completed trust-transition test
to remove the `(`#7555`)` suffix or replace it with the correct local issue
reference; do not use the dependent pull-request number as an issue suffix.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: db09701b-cdd4-498e-84a4-5ee13baed012

📥 Commits

Reviewing files that changed from the base of the PR and between 07a1575 and 06f2a95.

📒 Files selected for processing (2)

• scripts/checks/extract-installer-pins.mts
• test/installer-hash-check.test.ts

[cv]

Blocking installer trust-boundary defect at this exact head: the workflow still allowlists successor formula SHA-256 5ddf9956…, but the current corrected installer/formula contract uses 24305648faee…; the live parser rejects that current artifact. The cleanup path also deletes the trusted formula before running brew untrust. If untrust then fails, the trust record can survive after the checked file is gone, so a recreated path may inherit trust. Update the successor hash to the reviewed 24305648faee…, require successful untrust before checked deletion, and keep regressions for both the exact accepted hash set and untrust-before-delete ordering. Refresh onto the stable post-#7561 main, then rerun exact-head docs/security review and full CI/E2E before approval; #7555 must remain sequenced after this contract lands.

[cv]

Exact-head product and nine-category security review: PASS. The #7555 successor template hash ee10afaeb5dc1477ca4b35a70a654ed32092399dbb290266f9f138d64484f1e2 was independently recomputed and accepted by the base-trusted parser as inert input. The transition fixture revokes trust before deleting temporary formula files and retains them when revocation fails; drift and legacy-completion paths fail closed. Local evidence: 75/75 focused tests, all reviewed OpenShell 0.0.85 manifests/assets, build/type-check/check:diff, and exact-head no-docs-needed receipt. GitHub evidence: all 53 current checks green including E2E / PR Gate, all 10 commits Verified, advisor merge_as_is with 0 blockers/warnings/suggestions, and no unresolved CodeRabbit threads. #7555 remains strictly sequenced after this prerequisite.