ci(e2e): retire legacy Brev source-install validation

[jyaunches]

Summary

Retires the generic Brev source-install validation lane so Brev qualification uses exact-staging Launchable and platform-neutral coverage runs in unified E2E. Moves dashboard remote-bind coverage into unified E2E with an owned install, onboarding, artifact, and cleanup lifecycle.

Related Issue

Fixes #7490

Changes

• Remove the legacy reusable Brev workflow, nightly caller, Vitest project, remote runner, helpers, tests, and configuration.
• Run dashboard remote-bind on the unified Ubuntu E2E runner with step-scoped inference credentials, redaction, and terminal cleanup.
• Document the disposition of all eight legacy selectors: full uses exact-staging Launchable, six platform-neutral suites use unified E2E, gpu uses the dedicated unified GPU lane, and all is retired.
• Update workflow contracts, project-boundary checks, source-shape budgets, and contributor test documentation for the seven remaining Vitest projects.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This changes internal CI and test ownership, not supported product behavior or configuration. Internal E2E and contributor guidance is updated.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex Desktop reviewed head 465cf5c18 across all nine security categories. PASS with no findings; immutable actions, step-scoped and redacted secrets, explicit dashboard exposure, security-audit assertions, and terminal cleanup are preserved.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: The maintainer authorized merge without CI/CD success for head 465cf5c18. Local npm run check:diff completed every applicable check except repository-checks, which found unrelated stale base debt: src/lib/core/shell-quote.ts fan-in is 26 while its limit is 27. No PR change or follow-up is required for this issue-scoped change.

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: .agents/skills/nemoclaw-maintainer-verify-stale/reference/environment-and-reproducer.md, AGENTS.md, test/e2e/README.md, test/e2e/docs/README.md. No Fern page under docs/ is needed because the change concerns internal E2E ownership.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable; scripts/prepare-dgx-station-host.sh is unchanged.
• Station profile/scenario: Not applicable.
• Result: Not applicable.
• Supporting evidence: Not applicable.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable — the installed pre-commit hook could not tag intentionally deleted files. The fallback passed all applicable checks except the unrelated stale source-architecture limit described above. Commitlint and all pre-push checks passed separately.
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — changed e2e-support: 51 passed; affected integration tests: 99 passed; npm run typecheck:cli, npm run test:projects:check, and npm run source-shape:check passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Not run; maintainer authorized merge without CI/CD completion.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: J. Yaunches jmyaunch@gmail.com
Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

• New Features
  • Added live end-to-end coverage for dashboard remote binding, including connection flow, cleanup tracking, and audit validation.
  • Included dashboard remote-binding results in pull-request E2E reporting.
• Documentation
  • Updated E2E CI workflow documentation with hosted-runner recovery behavior, baked-candidate validation details, and retirement guidance for Brev source-install coverage.
• Testing
  • Added workflow contract safeguards to ensure the dashboard remote-binding job is correctly configured and receives required credentials.
• Chores
  • Retired the previous branch-validation Brev workflow/test lane from CI and related checks.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d55bcdb8-69c7-4669-bb8a-94b2c64bc4ac

📥 Commits

Reviewing files that changed from the base of the PR and between c57cfcc and 465cf5c.

📒 Files selected for processing (4)

• .github/workflows/e2e.yaml
• .github/workflows/regression-e2e.yaml
• ci/source-shape-test-budget.json
• scripts/checks/vitest-project-overlap.mts

---

📝 Walkthrough

Walkthrough

The PR retires generic Brev source-install validation, removes its workflow and Vitest integration, documents replacement coverage, and adds dashboard remote-bind execution and boundary validation to unified E2E.

Changes

E2E coverage consolidation

Layer / File(s)	Summary
Retire legacy Brev validation .github/workflows/e2e-branch-validation.yaml, vitest.config.ts, test/e2e/..., test/*	Removes the generic Brev validation workflow, project gating, related tests, regression coverage, support code, and obsolete project expectations.
Integrate dashboard remote-bind E2E .github/workflows/e2e.yaml, .github/workflows/regression-e2e.yaml, test/e2e/live/dashboard-remote-bind.test.ts, tools/e2e/workflow-boundary.mts, test/e2e/support/e2e-workflow.test.ts	Adds unified dashboard remote-bind execution, environment setup, cleanup, artifact upload, CLI checks, selection changes, and workflow contract validation.
Update coverage documentation and checks test/e2e/README.md, test/e2e/docs/README.md, AGENTS.md, ci/source-shape-test-budget.json, test/runner.test.ts	Documents retired Brev coverage and baked-candidate boundaries, removes obsolete test-shape exceptions, updates testing guidance, and verifies Jetson script executability.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Workflow as e2e.yaml
  participant Test as dashboard-remote-bind.test.ts
  participant CLI as nemoclaw/openshell
  participant Artifacts as upload-e2e-artifacts
  Workflow->>Test: Start dashboard-remote-bind E2E job
  Test->>CLI: Clean sandbox and install prerequisites
  Test->>CLI: Connect and run dashboard binding checks
  Test->>Artifacts: Upload E2E artifacts

Loading

Possibly related issues

• ci: split E2E feedback-loop work into focused PRs #7451 — Covers the broader E2E/Brev CI restructuring split into focused changes.

Possibly related PRs

• NVIDIA/NemoClaw#7651 — Both update E2E workflow boundary validation.
• NVIDIA/NemoClaw#7655 — Both extend validateE2eWorkflow with additional validators.
• NVIDIA/NemoClaw#7719 — Both modify E2E PR reporting workflow contracts.

Suggested reviewers: cv, apurvvkumaria, ericksoa

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	It clearly summarizes the main change: retiring legacy Brev source-install validation.
Linked Issues check	✅ Passed	The legacy Brev source-install lane is removed, dashboard remote-bind is moved to unified E2E, and related runners, tests, config, and docs are updated.
Out of Scope Changes check	✅ Passed	The changes stay focused on retiring or migrating the Brev E2E lane; no unrelated feature work stands out.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Fix failing CI checks

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/issue-7490-brev-retirement

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 465cf5c in the codex/issue-7490-bre... branch remains at 96%, unchanged from commit 2734a4b in the main branch.

---

_{Updated July 29, 2026 15:42 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: Review the warnings below.
Findings: 0 blockers · 1 warning · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 1 warning · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, security-posture, onboard-repair, onboard-resume

1 optional E2E recommendation

• gpu-e2e

1 warning · 0 suggestions

Warnings

Warnings do not block.

PRA-1 Warning — Document the actual credential-sanitization replacement

• Location: test/e2e/README.md:61
• Category: docs
• Problem: The retired Brev coverage table names `credential-sanitization` as a Unified E2E owner, but no supported `e2e.yaml` job has that ID. The checked-in compatibility helper routes this retired selector to a CLI test instead.
• Impact: Operators following the migration map can select a nonexistent E2E job and cannot identify the test that now covers credential sanitization.
• Recommendation: Replace the table row with the retired-selector compatibility disposition and the CLI replacement test, or add the intended supported Unified E2E job if that is the current contract.
• Verification: Compare the table row with `REPLACEMENTS["credential-sanitization"]` in `tools/e2e/retired-selector-compatibility.mts` and the E2E workflow job inventory.
• Test coverage: Add a documentation-contract test that verifies each retired Brev coverage-table owner either exists in the supported E2E inventory or matches the retired-selector replacement map.
• Evidence: test/e2e/README.md:61 lists `credential-sanitization` as Unified E2E with owner `credential-sanitization`. tools/e2e/retired-selector-compatibility.mts:50-57 maps the retired selector to `src/lib/security/credential-filter-secret-patterns.test.ts` in the `cli` project. The checked-in E2E job inventory does not include `credential-sanitization`.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.