test(e2e): require Hermes adapter lifecycle lanes

[cv]

Summary

The risk plan on main does not select mcp-bridge for Hermes CLI adapter changes. PR #8025 therefore cannot run the live E2E coverage required by issue #8011 before this selector lands. This change adds the required jobs and increments the risk-plan version to 12.

Julie Yaunches authored the first commit and the risk-plan wording clarification. Carlos Villela applied the review fixes and authored the compatibility-digest update. GitHub reports all three commits as Verified.

Related Issue

Related to #8011. Unblocks #8025.

Changes

• Select channels-stop-start and mcp-bridge when the Hermes wrapper, adapter manifest, or adapter validator changes.
• Keep all managed-policy and sandbox-boundary jobs selected when the Hermes wrapper changes.
• Add hermes-inference-switch to the Hermes sandbox-boundary jobs.
• Increment the deterministic risk-plan version to 12.
• Assert the complete job list for each adapter and managed-policy path.
• Document the selector and the messaging-channel and managed MCP lifecycle coverage.
• Update the compatibility digest for the version 12 risk-plan output.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This PR changes trusted E2E selection, not a user-visible command or supported behavior. Internal E2E and advisor documentation was updated.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex Desktop reviewed commit 34af730876508d272c1dbd15a3755a35a0815cab against base SHA 4cd4d64fe67143b57707f874afa0b9d269dfeff2, including the functional changes and compatibility-digest correction. All nine categories received PASS, with no findings. Commit cc3f505dc941b3dc3c26578724b413491e014bb9 changes only independently reviewed explanatory wording. Security review.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: test/e2e/README.md and tools/pr-review-advisor/README.md document risk-plan version 12 and the Hermes adapter lifecycle mapping. The documentation writer review at head SHA cc3f505dc covered terminology, structure, voice, test titles, and code-sample presentation. The focused Vitest command passed 87 tests in 2 files, and the repository hooks passed.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable
• Result: This PR does not change scripts/prepare-dgx-station-host.sh.
• Supporting evidence: Not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npm exec -- vitest run test/pr-risk-plan.test.ts test/e2e/support/e2e-cross-runtime-compatibility.test.ts --reporter=dot passed 87 tests in 2 files at commit cc3f505dc.
• Applicable broad gate passed — E2E / PR Gate passed for commit cc3f505dc in run 30824493943.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com
Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Tests

  • Expanded automated validation for Hermes CLI adapters, managed policies, sandbox boundaries, and wrapper workflows.
  • Added checks to preserve provider and model settings during managed inference route changes.
  • Updated compatibility checks and targeted test-selection expectations.

• Chores

  • Updated risk-plan metadata and documentation to reflect the expanded validation coverage.

[cv]

Security review — PASS

Reviewed PR #8107 at commit b058f6effb9c4a3b7813e917eaf9bf609ba9e6cd against base SHA 4cd4d64fe67143b57707f874afa0b9d269dfeff2.

Findings

No findings.

Detailed analysis

1. Secrets and Credentials — PASS: No secret, token, credential value, or credential-handling path changed.
2. Input Validation and Data Sanitization — PASS: Three named adapter paths select jobs. Plan normalization validates job identifiers and requires matched files to be present in GitHub's changed-file list.
3. Authentication and Authorization — PASS: Dispatch authorization is unchanged. The controller still confirms PR, commit, and base identity. Fork E2E still requires maintainer approval.
4. Dependencies and Third-Party Libraries — PASS: No dependency, action, image, or package changed.
5. Error Handling and Logging — PASS: Unsupported versions, malformed plans, changed inputs, unknown jobs, and invalid shard declarations stop dispatch. No sensitive data was added to logs.
6. Cryptography and Data Protection — PASS: The existing SHA-256 plan digest remains in use. Version 12 distinguishes the new selection behavior.
7. Configuration and Security Headers — PASS: No workflow permission, secret exposure, network setting, or runtime security configuration changed.
8. Security Testing — PASS: Source test assertions pin adapter paths, wrapper overlap, managed-policy paths, unrelated Hermes paths, and sandbox-boundary jobs.
9. System Security — PASS: Selection is additive. Trusted controller code rebuilds the plan, allowlists jobs from e2e.yaml, derives matrix shards from that workflow, and rejects missing or mismatched evidence.

Required GitHub checks must pass for commit SHA b058f6effb9c4a3b7813e917eaf9bf609ba9e6cd before merge.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit cc3f505 in the codex/8025-hermes-e2... branch remains at 96%, unchanged from commit b30781c in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit cc3f505 in the codex/8025-hermes-e2... branch remains at 81%, unchanged from commit b30781c in the main branch.

Show a code coverage summary of the most impacted files.

File	main b30781c	codex/8025-hermes-e2... cc3f505	+/-
src/lib/platform.ts	89%	84%	-5%
src/lib/inferen...ompatibility.ts	95%	94%	-1%
src/lib/messagi...nnels/policy.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	88%	88%	0%
src/lib/state/config-io.ts	93%	93%	0%

---

_{Updated August 03, 2026 14:48 UTC}

[coderabbitai]

📝 Walkthrough

Walkthrough

The risk plan now detects Hermes CLI adapter changes, selects channels-stop-start and mcp-bridge, expands sandbox-boundary coverage with hermes-inference-switch, and updates related tests and documentation.

Changes

Hermes risk-plan coverage

Layer / File(s)	Summary
Hermes risk-plan selection and invariants tools/advisors/risk-plan.mts	The risk plan detects Hermes CLI adapter files, selects related E2E jobs, adds the inference-switch sandbox job and invariant, and updates the plan version.
Risk-plan regression coverage test/pr-risk-plan.test.ts, test/e2e/support/e2e-cross-runtime-compatibility.test.ts	Tests cover Hermes adapter, managed-policy, wrapper, sandbox-boundary, fallback, plan-version, and compatibility expectations.
Deterministic mapping documentation test/e2e/README.md, tools/pr-review-advisor/README.md	The README files document Hermes adapter, inference-switch, channel lifecycle, managed MCP mappings, and updated risk-plan versions.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant AdapterFiles as Hermes CLI adapter files
  participant RiskPlan as risk-plan.mts
  participant E2EJobs as Focused E2E jobs
  AdapterFiles->>RiskPlan: changed-file detection
  RiskPlan->>E2EJobs: select channels-stop-start and mcp-bridge

Loading

Possibly related PRs

• NVIDIA/NemoClaw#7866: Adds related mcp-bridge Hermes E2E coverage.
• NVIDIA/NemoClaw#7931: Also modifies Hermes E2E risk-plan selection and expectations.
• NVIDIA/NemoClaw#8088: Modifies Hermes risk-plan mappings and tests.

Suggested labels: area: e2e, area: ci

Suggested reviewers: jyaunches

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: requiring lifecycle coverage for Hermes adapter changes.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/8025-hermes-e2e-prereq

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions differ; normalized E2E selections differ; severity counts match.

5 terminology differences from the second opinion

Advisory only. These are normalized differences from the primary terminology receipt.

• channels-stop-start at tools/advisors/risk-plan.mts:28: selected only by the second-opinion lane as established.
• mcp-bridge at tools/advisors/risk-plan.mts:28: selected only by the second-opinion lane as established.
• hermes-inference-switch at tools/advisors/risk-plan.mts:390: selected only by the second-opinion lane as established.
• Hermes wrapper at test/pr-risk-plan.test.ts:170: selected only by the second-opinion lane as established.
• Hermes CLI adapter at test/pr-risk-plan.test.ts:169: selected only by the second-opinion lane as define.

3 additional E2E selections from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

• channels-stop-start: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• mcp-bridge: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• hermes-inference-switch: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

3 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• established — managed inference route at tools/advisors/risk-plan.mts:393: Retain the established term.
• justified — Hermes CLI adapter at tools/pr-review-advisor/README.md:127: Retain the modifier and bind the term to the listed adapter paths.
• established — Hermes shard at test/e2e/README.md:628: Retain the established term.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cv]

Security review — PASS

Reviewed PR #8107 at 34af730876508d272c1dbd15a3755a35a0815cab against base 4cd4d64fe67143b57707f874afa0b9d269dfeff2, including both commits and the compatibility-digest correction. No findings.

Category	Result	Evidence
Secrets exposure	PASS	No secrets or sensitive values added.
Input validation and injection	PASS	Exact path matching is used; existing job-ID syntax and trusted-inventory validation remain fail closed.
Authentication and authorization	PASS	No permission changes; trusted-controller and fork-approval boundaries are unchanged.
Dependencies	PASS	No dependency, action, image, or lockfile changes.
Error handling and logging	PASS	No new logging or error path; deterministic E2E selection remains fail closed.
Cryptography and data protection	PASS	No protected-data behavior changed; the corrected SHA-256 value was independently reproduced.
Configuration and security headers	PASS	No runtime, network-policy, header, or security-control configuration changed.
Security testing	PASS	Exact adapter-path, wrapper-union, sandbox-floor, version, and compatibility assertions cover the change.
System security	PASS	No SSRF, Dockerfile, network-policy, sandbox, credential-boundary, or host-execution behavior changed.

GitHub reports both commits as verified with reason valid:

• b058f6effb9c4a3b7813e917eaf9bf609ba9e6cd
• 34af730876508d272c1dbd15a3755a35a0815cab

I independently recomputed the compatibility digest as b9f2f00f87b7a18caac504048c72eea224c10621690d2cf66549733487d3d342, matching the assertion. I also confirmed that channels-stop-start, mcp-bridge, and hermes-inference-switch are trusted workflow jobs and that the first two include the documented Hermes lifecycle coverage.

Files reviewed: test/e2e/README.md, test/e2e/support/e2e-cross-runtime-compatibility.test.ts, test/pr-risk-plan.test.ts, tools/advisors/risk-plan.mts, and tools/pr-review-advisor/README.md.