refactor(onboard): revalidate provider effect receipts

[cv]

Summary

Stack 5 of 5; depends on #7718. Make provider-effect recovery receipts describe the current provider set and require that set to remain live before onboarding skips replay or creates the sandbox.

Related Issue

Refs #7702

Changes

• Match each receipt to the current provider name, provider type, and credential-key binding.
• Replace obsolete, disabled, and orphaned provider bindings with the current normalized provider ledger.
• Save a checkpoint after each provider-effect group completes and propagate the returned immutable session.
• Verify newly registered bindings while holding the gateway mutation lock.
• Revalidate the complete current provider ledger inside the sandbox-creation lock.
• Document the recovery contract and add regression coverage for changed selections, incomplete or duplicate bindings, disabled and orphaned state, crash recovery, and provider mutation before sandbox creation.

Type of Change

• Code change with doc updates

Quality Gates

• Tests added or updated for changed behavior
• Docs updated for user-facing behavior changes
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: PASS for commit 409e206b6820c70189623ffbfed54ff93283313d; no waiver required.

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: docs/security/credential-storage.mdx; src/lib/onboard/lifecycle-contracts.md; test titles and comments in the six changed onboarding source and test files.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Result: Not applicable; this PR does not change scripts/prepare-dgx-station-host.sh.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — GitHub test shards for commit 409e206b6820c70189623ffbfed54ff93283313d are still running.
• Applicable broad gate passed — GitHub CI is still running. The trusted npm audit currently reports the repository's newly published brace-expansion advisory; the repository-owned remediation is being handled separately and will not be waived.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — awaiting the applicable GitHub checks for the current commit.
• Doc pages follow the style guide (doc changes only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: fb3af580-cf76-4315-9017-c9e4ca598763

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/onboard-fsm-lifecycle-receipts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 409e206 in the codex/onboard-fsm-li... branch remains at 96%, unchanged from commit c63e7eb in the codex/onboard-fsm-de... branch.

---

_{Updated August 03, 2026 19:02 UTC}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / low confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: PR review advisor skipped: OpenShell inference configuration failed or the advisor credential is unavailable

Model lanes

• GPT-5.6 Terra (primary): Skipped
• Nemotron 3 Ultra (second opinion): Skipped

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, onboard-repair, onboard-resume

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cjagwani]

Draft-stack babysitting status for exact head 90202e1 (plain comment; no Changes Requested review): the direct #7718 base is aligned, but the stack inherits the stale #7715 to #7716 boundary. Draft CI is absent, credential/provider sensitive-path review remains pending, and maintainer edits are disabled. I will review and gate the final stack head after all dependencies are refreshed and have been quiet for one hour.

[cv]

Sensitive-path security review — PASS

Reviewed commit 409e206b6820c70189623ffbfed54ff93283313d against base commit 4a80f24133a644ac7c782868002fb2e43d40fb9a.

• Secrets: PASS. Checkpoints record provider names, types, and credential environment-variable names, not credential values. Tests reject raw-token persistence.
• Input validation and injection: PASS. Empty or duplicate bindings fail closed. Replay requires the current provider set, type, credential-key binding, and live gateway identity to match.
• Authentication and authorization: PASS. Provider matching remains gateway-scoped and requires the exact provider identity.
• Dependencies and supply chain: PASS. This change adds no dependency or artifact update.
• Error handling and logging: PASS. Failures name providers without exposing credentials, and missing live state prevents receipt recording and sandbox creation.
• Data protection and cryptography: PASS. Session persistence retains its restricted temporary-file mode and atomic rename. No cryptographic behavior changes.
• Configuration and environment handling: PASS. Required bindings derive from the active plan and current provider profile. Disabled and orphaned bindings are removed from the checkpoint.
• Security tests: PASS. Coverage includes changed selections, ordering, duplicate and incomplete bindings, disabled and orphaned state, immutable persistence, crash recovery, missing live bindings, and a mutation before sandbox creation.
• Race conditions and system safety: PASS. Registration and immediate verification run under the gateway mutation lock. The normalized session is propagated, and the current provider ledger is revalidated inside the sandbox-creation lock.

No security findings or waiver are required for this commit.