test(e2e): align gateway recovery startup path

[apurvvkumaria]

Summary

The gateway-guard-recovery E2E rejected the canonical managed startup command introduced by #8047. This change requires /usr/local/bin/nemoclaw-start for the modern container before and after Docker restart, while preserving the separate legacy keepalive compatibility contract.

Failed release-gate job: https://github.com/NVIDIA/NemoClaw/actions/runs/30930457908/job/92070742370

Changes

• Align the fresh-container startup assertion with the managed executable path produced by onboarding.
• Require the restarted modern container to retain that same canonical executable path.
• Leave the legacy short-form recovery assertion and all credential-canary checks unchanged.
• Change no production code or runtime behavior.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: Test-only regression assertion; no user-facing behavior or documentation claim changed.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Independent Codex Desktop security review passed for validated commit 1c1b4531ceea5e25a34a64358d34f583e798dc44. The modern path check is strengthened, the legacy compatibility and credential-exclusion checks remain intact, and no production security boundary changes.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: The test-only change requires the managed startup executable path already defined by the implementation. It does not change commands, output, configuration, defaults, workflows, or supported behavior. The focused source contract passed 17 tests.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable; no DGX Station host-preparation code changed.
• Station profile/scenario: Not applicable.
• Result: Not applicable.
• Supporting evidence: Not applicable.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 33 CLI source-contract tests, 20 recovery integration tests, and 7 E2E-support tests passed. Semantic phase, title, test-size, source-shape, type, formatting, repository, and secret checks passed.
• Applicable broad gate passed — not applicable to a two-assertion E2E contract repair; the affected live target must pass through the PR E2E gate.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

• Tests
  • Updated container startup validation to require the full executable path for both initial and recovered managed containers.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: de5dd445-e965-44b4-aaa7-1fce9784a12e

📥 Commits

Reviewing files that changed from the base of the PR and between 8683777 and 1c1b453.

📒 Files selected for processing (1)

• test/e2e/live/gateway-guard-recovery.test.ts

---

📝 Walkthrough

Walkthrough

The E2E test now requires both initial and recovered managed containers to start with the absolute /usr/local/bin/nemoclaw-start path.

Changes

Gateway guard recovery validation

Layer / File(s)	Summary
Require absolute startup command path test/e2e/live/gateway-guard-recovery.test.ts	The initial and recovered container assertions now require /usr/local/bin/nemoclaw-start instead of accepting an unqualified suffix.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7972: Updated the same test with startup recovery assertions.
• NVIDIA/NemoClaw#7975: Refined the same startup-command assertions.
• NVIDIA/NemoClaw#8146: Covered the absolute startup command in the sandbox recovery flow.

Suggested labels: area: e2e, integration: openclaw

Suggested reviewers: prekshivyas, cv, sandl99

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the updated gateway recovery startup path assertions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-gateway-guard-startup-command

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit c15e37a in the codex/fix-gateway-gu... branch remains at 96%, unchanged from commit 3f7097b in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit c15e37a in the codex/fix-gateway-gu... branch remains at 81%, unchanged from commit 3f7097b in the main branch.

Show a code coverage summary of the most impacted files.

File	main 3f7097b	codex/fix-gateway-gu... c15e37a	+/-
src/lib/sandbox...rce-identity.ts	87%	87%	0%
src/lib/tunnel/services.ts	76%	76%	0%
src/lib/inferen...er-discovery.ts	87%	88%	+1%
src/lib/private-networks.ts	90%	93%	+3%
src/lib/policy/...ne-exclusion.ts	92%	96%	+4%

---

_{Updated August 04, 2026 19:07 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions match; normalized E2E selections match; severity counts match.

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: gateway-guard-recovery

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[senthilr-nv]

I approve reviewing PR #8244 at commit 1c1b453.