perf(e2e): avoid second Hermes channel rebuild

[apurvvkumaria]

Summary

The Hermes channels-stop-start lane rebuilt once after disabling all channels and then rebuilt the same active configuration again after re-enabling them. This keeps the uniquely valuable disabled-state rebuild, replaces only the second Hermes rebuild with exact queued-state and persisted-plan assertions, and leaves the OpenClaw two-rebuild path unchanged.

In the representative E2E run 30181872151, the removed rebuild took about 2m07s, roughly 20% of the 10m46s Hermes job.

Related Issue

Part of #7144.
Parent epic: #7140.

Changes

• Require every noninteractive channel stop/start command to prove that the rebuild is queued.
• Retain the Hermes rebuild after all channels are disabled and its live absent-config, provider, and inactive-policy assertions.
• After re-enabling Hermes channels, verify the active persisted plan, restored policies, retained providers, and intentionally unchanged running config without launching a second BuildKit rebuild.
• Preserve both live rebuilds for OpenClaw.
• Add a five-channel Hermes lifecycle test that compacts the plan through the real registry persistence boundary between every mutation and proves the fully hydrated rebuild plan is restored.

The persistence-aware test asserts semantic plan/render parity. It intentionally does not claim byte-identical Base64 cache input because compact-plan hydration can change JSON key insertion order.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: internal E2E execution optimization; CLI behavior and documented channel lifecycle are unchanged.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: independent Codex correctness review returned GO with no blocking findings at 324ee020c.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: no documentation paths changed; the optimization is internal to E2E execution and preserves user-facing CLI semantics.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — workflow-planner.test.ts 23/23; E2E workflow boundary 43/43; semantic phase coverage 125 tests across 82 files.
• Applicable broad gate passed — npm run checks, CLI typecheck, plugin source/test typecheck, CLI build, and plugin build passed.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

• Enhancements

  • Channel stop and start actions now clearly indicate that a rebuild is queued before changes take effect.
  • Channel lifecycle handling now preserves credentials and restores runtime configuration consistently across rebuilds.

• Tests

  • Expanded coverage for stopping and restarting multiple channels.
  • Added validation for agent-specific rebuild behavior and lifecycle state restoration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: dc41a15d-d6b6-43a9-af74-5c9fc3ee1003

📥 Commits

Reviewing files that changed from the base of the PR and between 1c86061 and 324ee02.

📒 Files selected for processing (3)

• src/lib/messaging/compiler/workflow-planner.test.ts
• test/e2e/live/channels-stop-start-helpers.ts
• test/e2e/live/channels-stop-start.test.ts

---

📝 Walkthrough

Walkthrough

The changes add compiler coverage for persisted channel stop/start restoration and update live E2E expectations for queued changes, agent-scoped rebuilds, and lifecycle validation.

Changes

Channel lifecycle validation

Layer / File(s)	Summary
Persisted rebuild-plan restoration src/lib/messaging/compiler/workflow-planner.test.ts	Adds hermes coverage that persists compact plans while disabling and re-enabling channels, verifies the fully disabled state, and compares the restored plan with the baseline.
Agent-scoped channel lifecycle assertions test/e2e/live/channels-stop-start-helpers.ts, test/e2e/live/channels-stop-start.test.ts	Updates CLI output and phase descriptions, and makes post-start rebuild and agent-configuration assertions conditional on the selected agent.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: cv, jyaunches

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly captures the main change: optimizing Hermes E2E by skipping the second channel rebuild.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/7144-hermes-single-channel-rebuild

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 324ee02 in the codex/7144-hermes-si... branch remains at 96%, unchanged from commit e5fbc13 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 324ee02 in the codex/7144-hermes-si... branch remains at 80%, unchanged from commit 1c86061 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 1c86061	codex/7144-hermes-si... 324ee02	+/-
src/lib/messagi...nnels/policy.ts	100%	100%	0%
src/lib/messagi...nes/template.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	88%	88%	0%
src/lib/messagi.../persistence.ts	88%	92%	+4%
src/lib/platform.ts	84%	89%	+5%

---

_{Updated July 26, 2026 08:57 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 1 warning · 2 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 1 more warning, 2 more suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture, channels-stop-start

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[apurvvkumaria]

Exact-head status for 324ee020c:

• All primary code, audit, platform, and self-hosted sandbox checks passed.
• CodeRabbit, Nemotron, and Terra reported no actionable findings; there are no review threads.
• Credential-bearing E2E did not run. The controller failed before dispatch because no required-reviewer approval was recorded for the approve-credentialed-e2e-for-internal-pr environment.
• No secrets were exposed and no test assertion failed.

Evidence: controller run 30195580897, pending coordination check.

This needs the repository's authorized environment-review path (or its documented manual control-plane fallback), not a code change or blind workflow rerun.

[apurvvkumaria]

The OpenClaw channels-stop-start failure in run 30197055330 is a deterministic policy mismatch, not runner cancellation. The current image creates /sandbox/.openclaw/extensions/whatsapp/node_modules/openclaw -> /usr/local/lib/nemoclaw/openclaw-runtime/node_modules/openclaw, while backup and Shields trusted only the legacy global package target. #7585 synchronizes both guards to allow only the exact legacy/current image targets and keeps sibling targets and wrong source paths fail-closed, with backup, extraction, transition, and tamper coverage.

Please hold another #7580 E2E dispatch until both #7582 and #7585 merge and #7580 is refreshed. One selected E2E run after that should validate the three previously failing lanes without spending another runner cycle on known prerequisites.