fix(rebuild): persist replacement lifecycle proof

[senthilr-nv]

Summary

Sandbox registration discarded the lifecycle proof after a same-name rebuild. This change persists that proof so cleanup can verify the replacement identity and remove the obsolete owned image.

Changes

• Persist lifecycleGeneration and lifecycleLiveIdentityFingerprint in registerSandbox.
• Add a regression test that registers a sandbox, reloads the registry from disk, and verifies both fields.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This internal registry fix restores the documented rebuild cleanup behavior without changing a user-visible contract.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Maintainer security review passed on 411b06be; the change preserves the existing fail-closed replacement identity checks.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: The existing v0.0.100 release entry already describes transactional replacement and lifecycle cleanup. This change restores that behavior across the registry save-and-reload boundary.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: The six-file lifecycle suite passed 113 tests across registration, registry reload, recreate journals, handler cleanup, and provider image removal.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Senthil Ravichandran senthilr@nvidia.com

[coderabbitai]

📝 Walkthrough

Walkthrough

The sandbox registry now persists lifecycle generation and live-identity fingerprint fields during registration. A round-trip test verifies that both fields survive registry reload.

Changes

Sandbox lifecycle persistence

Layer / File(s)	Summary
Registry persistence and round-trip validation src/lib/state/registry.ts, src/lib/state/registry-normalization.test.ts	registerSandbox persists lifecycle proof fields. The test verifies both fields after registry reload.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7990: Extends the sandbox registration path for workload receipts.
• NVIDIA/NemoClaw#8039: Updates lifecycle identity persistence for same-name replacement cleanup.

Suggested labels: area: sandbox, bug-fix

Suggested reviewers: cv, laitingsheng

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: persisting replacement lifecycle proof to fix rebuild cleanup.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-rebuild-lifecycle-proof-persistence

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 411b06b in the codex/fix-rebuild-li... branch remains at 96%, unchanged from commit a77b44e in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 411b06b in the codex/fix-rebuild-li... branch remains at 81%, unchanged from commit 9bc461f in the main branch.

Show a code coverage summary of the most impacted files.

File	main 9bc461f	codex/fix-rebuild-li... 411b06b	+/-
src/lib/messagi...flict-status.ts	100%	84%	-16%
src/lib/onboard...age/contract.ts	95%	85%	-10%
src/lib/messagi...ort-conflict.ts	92%	83%	-9%
src/lib/messagi...tatus-health.ts	100%	91%	-9%
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/messagi.../ilink-login.ts	96%	89%	-7%
src/lib/trace.ts	94%	90%	-4%
src/lib/credentials/store.ts	62%	61%	-1%
src/lib/onboard...lers/sandbox.ts	96%	97%	+1%
src/lib/state/r...try/workload.ts	88%	98%	+10%

---

_{Updated August 01, 2026 05:49 UTC}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / low confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: PR review advisor failed: PR review advisor SDK execution failed: session: omitted required tool result(s): pr_review_security_trust_context; security-trust-analysis omitted required analysis; turn: security-trust-analysis: omitted required tool result(s): pr_review_security_trust_context; security-trust-analysis omitted required analysis

Model lanes

• GPT-5.6 Terra (primary): Failed
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions

Second-opinion E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: onboard-repair, onboard-resume

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.