feat(runtime): define the native activation candidate contract

[ericksoa]

Summary

• add a canonical, validated runtime-provider activation declaration factory
• drive the dormant native qualification matrix from that same catalog declaration
• map OpenClaw, Hermes, DCode, amd64/arm64, CPU/NVIDIA CDI, Ollama/NIM/vLLM, lifecycle, installer, and protected-E2E obligations through one provider-neutral scope
• reject catalog/qualification drift and retain the MXC-style provider contract test without central provider switches

Stack

• Depends on feat(runtime): add provider activation catalog #8063.
• This remains dormant candidate integration. It does not register Podman, alter runtime selection, wire installer selection, advertise support, or dispatch protected E2E.

Validation

• focused activation and native qualification tests: 16/16 passed
• repository pre-commit checks passed
• Biome and markdown lint passed
• CLI build and typecheck passed on the exact restacked head

Signed-off-by: Aaron Erickson aerickson@nvidia.com

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c9dd5306-7ab6-4a3d-ad74-70e98948b9c3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit b46318c in the feat/native-runtime-... branch remains at 96%, unchanged from commit 5cd29cc in the feat/runtime-provide... branch.

---

_{Updated August 01, 2026 15:35 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Second-opinion E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, security-posture, onboard-repair, onboard-resume

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cv]

Reviewed commit b46318c8e9 in bottom-up stack order. This PR depends on #8063, which is not approval-ready. The candidate contract cannot be accepted before the catalog and qualification contracts settle and pass. Review remains blocked until the parent is reconstructed or repaired, this branch is restacked on the accepted parent commit, and current CI, security, and documentation evidence passes for the resulting commit. No approval is granted for the current branch.

[cv]

Approval is blocked by the stacked parent and failing E2E, coordination, CLI shard, and aggregate checks. The activation declaration remains dormant and has no current production consumer, so it must either land with the accepted consumer that enforces it or be removed until that consumer exists. Restack onto a passing parent and rerun all required checks.