fix(ci): restore architecture limits and isolate package fixtures

[cv]

Summary

Repair repository gates on current main. The source architecture limits match the values measured in the current PR commit, the onboarding lifecycle contract states the validated ordering, and package-contract tests use isolated fixtures so npm cannot rebuild dist while another worker reads it.

Changes

• Set the src/lib/state/registry.ts, src/lib/onboard.ts, and src/lib/onboard source architecture limits to their measured values: 98, 219, and 307.
• State that resume registry removal and repair-and-recreate occur only after complete intent validation.
• Remove the generic resume-provider-shim.ts file-role comment.
• Use one temporary package fixture helper for the three tests that inspect root package output. Each fixture removes package scripts and copies only the files required by that contract.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior — the package-contract tests now prevent npm's local-directory prepare from rewriting the repository build during parallel execution. Repository architecture checks enforce the three limits, and the sandbox-create-intent tests cover intent validation before repair or removal. GitHub Actions is the validation authority.
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: this does not change a command, configuration, output, default, or supported behavior. src/lib/onboard/lifecycle-contracts.md is internal architecture documentation.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: independent review of 2ad33be96c805eb77dedff0473dd20d5fdf981ae against 3a39ff352f98c4630ab8e18b83f4ec43ac56a2cc passed all nine security categories. The change does not alter runtime, trust-boundary, dependency, credential, or policy behavior.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: src/lib/onboard/lifecycle-contracts.md states the ordering accurately; the redundant source comment was removed; the package fixture explanation follows the writing guide; and no user-facing documentation page needs an update.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable — pre-commit and commit-msg passed for both commits, and pre-push passed for 2ad33be96c805eb77dedff0473dd20d5fdf981ae. The initial linked-worktree push lacked generated dist files; GitHub Actions validates the full PR diff.
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — pending GitHub Actions for the current PR commit.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — pending the GitHub Actions code matrix for the current PR commit.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Documentation

  • Clarified onboarding recovery guidance so registry cleanup and recreation occur only after complete intent validation.

• Bug Fixes

  • Improved package creation and validation coverage for distributed package contents, including build artifacts and schemas.

• Chores

  • Updated internal architecture quality thresholds.
  • No changes to exported functionality or end-user behavior.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 9c1f7857-aa94-4b80-8ee5-e060bae79297

📥 Commits

Reviewing files that changed from the base of the PR and between edf3652 and 2ad33be.

📒 Files selected for processing (4)

• test/package-contract/helpers/package-fixture.ts
• test/package-contract/managed-image-registry-transport.test.ts
• test/package-contract/managed-inference-catalog.test.ts
• test/package-contract/openshell-policy-boundary.test.ts

---

📝 Walkthrough

Walkthrough

The change lowers three architecture budget thresholds, clarifies onboarding lifecycle ordering, and adds a shared temporary package-fixture helper for package-contract tests.

Changes

Onboarding architecture and lifecycle contracts

Layer / File(s)	Summary
Architecture and lifecycle contracts ci/source-architecture-budget.json, src/lib/onboard/lifecycle-contracts.md	The fanIn, fanOut, and maxRootFiles limits are reduced. The lifecycle documentation requires complete intent validation before resume registry removal and repair-and-recreate.

Package-contract test fixtures

Layer / File(s)	Summary
Shared fixture creation and test integration test/package-contract/helpers/package-fixture.ts, test/package-contract/*	A shared helper creates temporary package fixtures. Package-contract tests pack selected fixture contents and remove the fixtures during cleanup.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NVIDIA/NemoClaw#8073: Updates related onboarding lifecycle documentation and package/onboarding test infrastructure.

Suggested labels: chore

Suggested reviewers: aasthajh

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes to onboarding composition budgets and the lifecycle contract.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-8265-refresh-drift

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit edf3652 in the codex/fix-8265-refre... branch remains at 96%, unchanged from commit 3a39ff3 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit edf3652 in the codex/fix-8265-refre... branch remains at 81%, unchanged from commit 89e17bf in the main branch.

Show a code coverage summary of the most impacted files.

File	main 89e17bf	codex/fix-8265-refre... edf3652	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/shields/index.ts	74%	73%	-1%
src/lib/onboard.ts	31%	31%	0%
src/lib/inferen...ving/catalog.ts	88%	88%	0%
src/lib/inferen...f-cache-plan.ts	0%	78%	+78%
src/lib/onboard...ization-deps.ts	0%	83%	+83%
src/lib/inferen...ache-receipt.ts	0%	97%	+97%
src/lib/onboard...e-port-reuse.ts	0%	100%	+100%
src/lib/onboard...-composition.ts	0%	100%	+100%
src/lib/onboard...-composition.ts	0%	100%	+100%

---

_{Updated August 05, 2026 08:57 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, onboard-repair, onboard-resume

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cv]

Post-merge follow-up required on current main a82887e:

test/package-contract/openshell-policy-boundary.test.ts now builds an isolated fixture with dist and schemas, but dist/lib/policy/merge.js requires ../../../nemoclaw/dist/shared/openshell-policy-boundary.cjs. The fixture must also copy nemoclaw/dist/shared.

This reproduces locally and in required build/typecheck on both #8313 and #8324 as MODULE_NOT_FOUND. It is a shared test-fixture regression, not a failure introduced by either destroy-flow PR.