fix(snapshot): isolate pairing modes and bound recovery - #8015
Conversation
Signed-off-by: San Dang <sdang@nvidia.com>
Signed-off-by: San Dang <sdang@nvidia.com>
Signed-off-by: San Dang <sdang@nvidia.com>
Signed-off-by: San Dang <sdang@nvidia.com>
Signed-off-by: San Dang <sdang@nvidia.com>
Signed-off-by: San Dang <sdang@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
📝 WalkthroughWalkthroughThe change adds restored-clone pairing support across OpenClaw patching, sandbox approval, gateway warm-up, and pairing retry flows. It adds unavailable-pending receipts and regression coverage for patch upgrades, identity loading, environment flags, and scope upgrades. ChangesRestored-clone pairing
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
|
Security review for exact head Result: PASS — no blocking or non-blocking findings.
Reviewed files:
Validation evidence: exact-head focused tests passed 35/35; the affected-test run passed 224/224 before the diff-preserving rebase; |
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 5be51ee in the TypeScript / code-coverage/cliThe overall coverage in commit 5be51ee in the Show a code coverage summary of the most impacted files.
Updated |
|
Cross-issue sweep progress:
Cross-issue scan — PR #8015No adjacent fixes or contradictions found above the medium confidence floor. Suppressed: 0 unrelated, 0 same-issue duplicates. Comparator note: #8015 strictly supersedes closed #7997 by preserving its six signed commits and adding the bounded recovery. A formal same-issue open-PR score is not applicable because the replacement has no linked primary issue and #7997 is no longer open. |
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: 1 optional E2E recommendation
This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/lib/actions/sandbox/auto-pair-warmup.test.ts (1)
76-88: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valuePrefer the execution-based test over source-text assertions.
This test checks raw string content of
RESTORED_CLONE_WARMUP_SCRIPTwith.toContain(). The test at lines 99-151 already executes this same script and observes the realforce,restored,port, andargvvalues through a fakeopenclawbinary. That execution-based test covers the same claims with an actual observable outcome.Consider removing the source-text assertions or folding the "no
openclaw agent" check into the execution-based test, since the current test can pass even if the script's actual runtime behavior diverges from what the string check implies.Based on path instructions for
**/*.test.{ts,js,mts,mjs,cts,cjs}: "Prefer observable outcomes through the public boundary over source-text, private-shape, or mock-call assertions."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/actions/sandbox/auto-pair-warmup.test.ts` around lines 76 - 88, Replace the raw source-text assertions in the test named “uses a direct write-scope gateway call for restored clones (`#7834`)” with coverage in the existing execution-based test around the fake openclaw binary. Assert the observable restored-clone behavior there, including that the invoked arguments use the sessions.create gateway call and do not invoke openclaw agent; remove the redundant RESTORED_CLONE_WARMUP_SCRIPT string checks.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/lib/actions/sandbox/auto-pair-warmup.test.ts`:
- Around line 76-88: Replace the raw source-text assertions in the test named
“uses a direct write-scope gateway call for restored clones (`#7834`)” with
coverage in the existing execution-based test around the fake openclaw binary.
Assert the observable restored-clone behavior there, including that the invoked
arguments use the sessions.create gateway call and do not invoke openclaw agent;
remove the redundant RESTORED_CLONE_WARMUP_SCRIPT string checks.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a89eaefe-caef-4d59-bb58-3c59812c587f
📒 Files selected for processing (13)
scripts/patch-openclaw-device-self-approval.mtssrc/lib/actions/sandbox/auto-pair-approval-script.test.tssrc/lib/actions/sandbox/auto-pair-approval.test.tssrc/lib/actions/sandbox/auto-pair-approval.tssrc/lib/actions/sandbox/auto-pair-warmup.test.tssrc/lib/actions/sandbox/auto-pair-warmup.tssrc/lib/actions/sandbox/restore-gateway-pairing.test.tssrc/lib/actions/sandbox/restore-gateway-pairing.tstest/e2e/live/issue-4462-scope-upgrade-approval.test.tstest/helpers/openclaw-device-self-approval-patch-harness.tstest/helpers/openclaw-real-device-self-approval-proof.tstest/openclaw-device-self-approval-patch-upgrade.test.tstest/openclaw-device-self-approval-patch.test.ts
|
Security review for head VerdictPASS. The complete 13-file diff has no blocking or non-blocking security findings. This verdict covers the security gate only and does not replace CI, E2E, product-scope, or independent human approval gates. FindingsNo findings. Detailed analysis
Files reviewed
Validation evidence on this exact head: focused CLI tests passed 35/35, focused integration tests passed 66/66, the diff-aware affected set passed 224/224, and canonical-base pre-commit, commit-message, and pre-push checks passed. The pre-commit run included repository checks, E2E semantic phase validation, and gitleaks. |
|
Product-scope gate for head This PR repairs the accepted OpenClaw onboarding and snapshot-restore pairing behavior established by merged PR #7834 and the scope-upgrade defect tracked in #4462. It does not add a command, configuration field, integration, custom image, third-party stack, or other supported surface. Ownership, lifecycle, compatibility, security, and validation remain within the existing OpenClaw pairing and restore support contract. The This product-scope decision is independent of GitHub |
|
Automated-review disposition for head CodeRabbit reported one low-value maintainability nit in Disposition: no source change. The execution-based test already proves the exact The PR Review Advisor reported 0 blockers, 0 warnings, and 0 suggestions. No actionable automated-review finding remains on this head. |
|
Post-merge exact-state audit: the trusted E2E run for PR head The required PR #8015 was merged concurrently as |
wscurran
added
area: cli
<!-- markdownlint-disable MD041 --> ## Summary Adds the canonical dated changelog entry for `v0.0.100` so the maintainer release plan can verify the pre-tag documentation prerequisite. The entry summarizes the user-facing changes merged since `v0.0.99` and links to the relevant guides. ## Changes - Add `docs/changelog/2026-07-31.mdx` with the exact `## v0.0.100` heading. - Cover restored OpenClaw pairing, transactional replacement, Deep Agents Code, onboarding recovery, lifecycle cleanup, Hermes builds, host provenance, documentation, and trusted E2E evidence. - Distinguish active Docker and Kubernetes runtime-bundle enforcement from the still-inactive managed shared-state transaction foundation. ## Source Coverage The release entry maps the doc-impacting merged PRs in the `v0.0.99..main` release range to `docs/changelog/2026-07-31.mdx`: #8021, #8024, #7973, #8028, #7947, #7788, #7884, #8023, #7969, #8020, #7989, #8000, #7907, #7942, #7567, #8013, #7955, #8017, #8014, #8015, #7629, #7644, #7821, #7971, and #7991. PR #7974 was reviewed after the final rebase and excluded because it changes internal maintainer-skill attribution policy and tests only; it does not change a user-facing product or documentation surface. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: the changelog contract test validates the dated entry, version heading, SPDX form, and route constraints. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `docs/changelog/2026-07-31.mdx`; exact-head review passed for `6093f44f`; writing rules and documentation style reviewed; `npx vitest run test/changelog-docs.test.ts` passed 6/6; `npm run docs` passed with zero Fern errors and two generic Fern upgrade notices. - Agent: Codex Desktop <!-- docs-review-head-sha: 6093f44 --> <!-- docs-review-agents-blob-sha: 3dd7c24 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: Not applicable; no DGX Station host script changed. - Station profile/scenario: Not applicable. - Result: Not applicable. - Supporting evidence: Not applicable. ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: `npx vitest run test/changelog-docs.test.ts` passed 6/6 at `6093f44f`. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: Not applicable to a dated prose-only release entry. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — validation passed with zero errors; Fern emitted two generic upgrade notices. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) — the changelog entry has the required parser-safe MDX SPDX header; dated changelog entries intentionally do not use page frontmatter. --- Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added release notes for v0.0.100. * Documented improvements to restore pairing, sandbox replacement, onboarding recovery, lifecycle cleanup, runtime handling, build support, host readiness, and end-to-end validation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
5 participants
Summary
Fresh onboarding and restored snapshots now use separate OpenClaw pairing modes. Fresh onboarding keeps the default generated identity path, while restored clones use descriptor-pinned identity and pairing state plus one narrowly bounded recovery when the first verifier publishes the missing scope-upgrade request.
This replacement carries forward and credits all six signed commits from #7997, then adds the bounded recovery needed to keep the fresh-onboard and restored-clone E2E paths from regressing one another.
Related Issue
Supersedes #7997 and follows up the pairing regression introduced while fixing #7834. The regression is exercised by
issue-4462-scope-upgrade-approvalandsnapshot-e2e.Changes
list-pending-unavailableand an authenticatedscope-upgrade-pendingverification result.Type of Change
Quality Gates
Documentation Writer Review
no-docs-neededDGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run validate:prpassed after refreshingorigin/mainwhen hooks were skipped or unavailablenpm run validate:prpassed on the current head.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result:npm testbuilt successfully and passed 23,255 tests locally, with 113 host-dependent failures on macOS/Node 25; required Linux CI and trusted live E2E are authoritative and pending.npm run docsbuilds without warnings (doc changes only)Signed-off-by: Prekshi Vyas prekshiv@nvidia.com
Summary by CodeRabbit