ci(e2e): simplify Launchable E2E dispatch

[jyaunches]

Summary

Remove the persistent Launchable readiness gate that prevented one-off Launchable E2E runs. Trusted manual runs can now select only the Launchable job, while pre-tag full runs still bind the default E2E suite and the exact Launchable E2E job to one candidate SHA.

Changes

• Allow jobs=staging-brev-launchable to run one Launchable E2E run from trusted main.
• Keep empty selectors plus include_staging_brev_launchable=true as the full pre-tag evidence contract.
• Remove the readiness variable, readiness failure job, and automatic scheduled Launchable selection.
• Preserve protected-environment approval, trusted-main secret guards, exact candidate evidence, queued concurrency, and cleanup verification.
• Bind release job evidence to its enclosing workflow run and attempt.
• Update the workflow boundary validator, behavior tests, maintainer skills, and E2E operator guidance.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — exact-SHA risk plan and verified E2E evidence: controller https://github.com/NVIDIA/NemoClaw/actions/runs/30362043103; child https://github.com/NVIDIA/NemoClaw/actions/runs/30362113240
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: .agents/skills/nemoclaw-maintainer-e2e/SKILL.md, .agents/skills/nemoclaw-maintainer-cut-release-tag/SKILL.md, .agents/skills/nemoclaw-maintainer-evening/SKILL.md, .agents/skills/nemoclaw-maintainer-policies/references/release-train.md, and test/e2e/README.md
• Agent: Codex Desktop documentation writer subagent

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable
• Result: Not applicable
• Supporting evidence: Not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run --project e2e-support test/e2e/support/e2e-workflow.test.ts passed 45 tests; npx vitest run --project integration test/release-e2e-evidence.test.ts test/maintainer-skills-policy.test.ts test/maintainer-e2e-skill.test.ts test/brev-launchable-e2e.test.ts passed 43 tests.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: J. Yaunches jmyaunch@gmail.com

Summary by CodeRabbit

• New Features
  • Added clearer, manual Launchable-mode dispatch and evidence verification alongside Ordinary and Full modes.
• Bug Fixes
  • Tightened Brev Launchable workflow execution to trusted manual runs on the main branch, and removed readiness-based gating/supported job behavior.
  • Updated release preflight/evidence dispatch to always use Full-mode and improved evidence ledger filtering for matching workflow runs.
• Documentation
  • Refreshed maintainer E2E mode selection and recovery/approval guidance for Launchable and Full flows.
• Tests
  • Updated E2E, workflow-boundary, and evidence tests to match the new Launchable/Full criteria.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The PR removes readiness-variable gating from staging Brev Launchable E2E qualification, adds evidence-driven full-mode release dispatch, updates workflow validation and ledger filtering, and documents separate Ordinary, Launchable, and Full-mode procedures.

Changes

Launchable E2E qualification

Layer / File(s)	Summary
Dispatch contract and workflow gating .github/workflows/e2e.yaml, tools/e2e/workflow-boundary.mts	Launchable qualification is restricted to trusted manual full or explicit selection dispatches, protected secrets use the same guard, and the readiness job is removed.
Release evidence preflight and ledger filtering .agents/skills/nemoclaw-maintainer-cut-release-tag/scripts/release-e2e-evidence.mts, test/release-e2e-evidence.test.ts	Preflight removes brevReady, always models the default suite as full mode with staging Brev Launchable included, and ignores job evidence from other runs or newer attempts.
Boundary validation and tests tools/e2e/workflow-boundary.mts, test/e2e/support/e2e-workflow.test.ts	Validation and tests enforce revised selectors, input documentation, removed readiness behavior, and qualification results.
Maintainer mode and evidence guidance .agents/skills/nemoclaw-maintainer-*/SKILL.md, .agents/nemoclaw-maintainer-policies/references/release-train.md, test/e2e/README.md, test/maintainer-skills-policy.test.ts	Documentation describes evidence-driven full-mode dispatch, mode-specific verification, approval waiting, recovery, and Launchable qualification scope.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Maintainer
  participant ReleasePreflight
  participant E2EWorkflow
  participant LaunchableJob
  Maintainer->>ReleasePreflight: Provide candidate SHA and runner status
  ReleasePreflight-->>Maintainer: Return full-mode dispatch plan
  Maintainer->>E2EWorkflow: Dispatch trusted full or Launchable mode
  E2EWorkflow->>LaunchableJob: Select staging qualification
  LaunchableJob-->>Maintainer: Publish run and job evidence

Loading

Possibly related PRs

• NVIDIA/NemoClaw#7496: Both changes modify staging Brev Launchable dispatch qualification and workflow validation.
• NVIDIA/NemoClaw#7655: Both changes modify release E2E evidence preflight and Brev readiness selection logic.

Suggested labels: area: e2e

Suggested reviewers: cv, aasthajh, afourniernv

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: simplifying Launchable E2E dispatch.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/simplify-launchable-e2e

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 1 warning · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 1 more warning, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, security-posture

1 optional E2E recommendation

• staging-brev-launchable

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

🧹 Nitpick comments (2)

test/e2e/support/e2e-workflow.test.ts (1)

66-103: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Cover the non-empty targets boundary.

The implementation requires both jobs and targets to be empty for full qualification, but this test only exercises a non-empty jobs selector. Add a case with includeStagingBrevLaunchable: true, empty jobs, and non-empty targets, expecting runQualification: false.

As per path instructions, this test should verify the dispatch contract through observable behavior at the public boundary.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/support/e2e-workflow.test.ts` around lines 66 - 103, Add a case to
the evaluateStagingBrevLaunchableDispatch test with includeStagingBrevLaunchable
true, empty jobs, and a non-empty targets selector, asserting runQualification
is false. Keep the assertion at the public evaluateStagingBrevLaunchableDispatch
boundary.

Source: Path instructions

tools/e2e/workflow-boundary.mts (1)

4793-4797: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Keep an explicit regression guard for readiness-job removal.

Removing both the validator call and its drift-test mutation means a future staging-brev-launchable-readiness job could return without failing boundary validation.

• tools/e2e/workflow-boundary.mts#L4793-L4797: reject the forbidden readiness job explicitly.
• test/e2e/support/e2e-workflow.test.ts#L124-L137: restore a mutation and expected validation error proving the superseded path remains removed.

As per path instructions, migration tests must prove the superseded path is unreachable or removed.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/e2e/workflow-boundary.mts` around lines 4793 - 4797, Keep an explicit
regression guard for the removed readiness job: in
tools/e2e/workflow-boundary.mts lines 4793-4797, add validation that rejects
staging-brev-launchable-readiness; in test/e2e/support/e2e-workflow.test.ts
lines 124-137, restore the drift-test mutation and expected validation error
proving that superseded path remains unreachable.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/e2e/support/e2e-workflow.test.ts`:
- Around line 66-103: Add a case to the evaluateStagingBrevLaunchableDispatch
test with includeStagingBrevLaunchable true, empty jobs, and a non-empty targets
selector, asserting runQualification is false. Keep the assertion at the public
evaluateStagingBrevLaunchableDispatch boundary.

In `@tools/e2e/workflow-boundary.mts`:
- Around line 4793-4797: Keep an explicit regression guard for the removed
readiness job: in tools/e2e/workflow-boundary.mts lines 4793-4797, add
validation that rejects staging-brev-launchable-readiness; in
test/e2e/support/e2e-workflow.test.ts lines 124-137, restore the drift-test
mutation and expected validation error proving that superseded path remains
unreachable.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 3254e819-34fd-4a6e-a238-5c5d455701c5

📥 Commits

Reviewing files that changed from the base of the PR and between 0b722a4 and 11a3bbc.

📒 Files selected for processing (6)

• .agents/skills/nemoclaw-maintainer-cut-release-tag/SKILL.md
• .agents/skills/nemoclaw-maintainer-e2e/SKILL.md
• .github/workflows/e2e.yaml
• test/e2e/README.md
• test/e2e/support/e2e-workflow.test.ts
• tools/e2e/workflow-boundary.mts

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit a87d7b0 in the codex/simplify-launc... branch remains at 96%, unchanged from commit 02b59e5 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit a87d7b0 in the codex/simplify-launc... branch remains at 81%, unchanged from commit 02b59e5 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 02b59e5	codex/simplify-launc... a87d7b0	+/-
src/lib/sandbox...rce-identity.ts	88%	88%	0%
src/lib/domain/.../connect-env.ts	89%	97%	+8%

---

_{Updated July 28, 2026 13:05 UTC}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.agents/skills/nemoclaw-maintainer-cut-release-tag/scripts/release-e2e-evidence.mts (1)

448-470: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Bind each job record to the enclosing workflow run.
Match on job.run_id === runId before recording attempts; otherwise a jobsJson payload from another run can be counted as green. Also ignore job attempts newer than the run attempt.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
@.agents/skills/nemoclaw-maintainer-cut-release-tag/scripts/release-e2e-evidence.mts
around lines 448 - 470, Update the job-processing loop around flattenJobs so
each job is recorded only when its run_id matches the enclosing runId, and skip
attempts whose run_attempt is newer than the enclosing run attempt. Apply these
checks before pushing values into attempts, while preserving the existing name
matching and ambiguity handling.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In
@.agents/skills/nemoclaw-maintainer-cut-release-tag/scripts/release-e2e-evidence.mts:
- Around line 448-470: Update the job-processing loop around flattenJobs so each
job is recorded only when its run_id matches the enclosing runId, and skip
attempts whose run_attempt is newer than the enclosing run attempt. Apply these
checks before pushing values into attempts, while preserving the existing name
matching and ambiguity handling.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6121c31c-08d4-44f4-8614-896a1239116c

📥 Commits

Reviewing files that changed from the base of the PR and between 5e3b3f8 and e0effa6.

📒 Files selected for processing (11)

• .agents/skills/nemoclaw-maintainer-cut-release-tag/SKILL.md
• .agents/skills/nemoclaw-maintainer-cut-release-tag/scripts/release-e2e-evidence.mts
• .agents/skills/nemoclaw-maintainer-e2e/SKILL.md
• .agents/skills/nemoclaw-maintainer-evening/SKILL.md
• .agents/skills/nemoclaw-maintainer-policies/references/release-train.md
• .github/workflows/e2e.yaml
• test/e2e/README.md
• test/e2e/support/e2e-workflow.test.ts
• test/maintainer-skills-policy.test.ts
• test/release-e2e-evidence.test.ts
• tools/e2e/workflow-boundary.mts

🚧 Files skipped from review as they are similar to previous changes (4)

• .github/workflows/e2e.yaml
• test/e2e/support/e2e-workflow.test.ts
• .agents/skills/nemoclaw-maintainer-e2e/SKILL.md
• tools/e2e/workflow-boundary.mts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/release-e2e-evidence.test.ts`:
- Line 69: Update the fixture setup in the cross-run test to define a distinct
workflow run ID, use it for run_id, run.id, and workflowRunId, and use attempt
only for run-attempt fields. Preserve the test’s ledger assertions so distinct
contract values verify the observable behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 58ff2ae3-ab41-448c-bfa5-439b4bcc72a5

📥 Commits

Reviewing files that changed from the base of the PR and between e0effa6 and 5dcd936.

📒 Files selected for processing (2)

• .agents/skills/nemoclaw-maintainer-cut-release-tag/scripts/release-e2e-evidence.mts
• test/release-e2e-evidence.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• .agents/skills/nemoclaw-maintainer-cut-release-tag/scripts/release-e2e-evidence.mts