test(package): copy published plugin artifacts into fixture

[cv]

Summary

The isolated package-contract fixture now includes the nemoclaw/dist artifacts that the compiled CLI imports. This restores the packaged policy validator check on current main without changing production packaging or runtime behavior.

Related Issue

Follow-up to #8310.

Changes

• Copy the published nemoclaw/dist artifacts into the isolated npm pack fixture.
• State that parallel package-contract workers read only the copied package inputs.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This change affects only package-contract fixture inputs and one code comment. It does not change user-visible behavior.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex Desktop reviewed commit cc27d79ef; security review result: PASS for all nine categories.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Package-contract fixture inputs and one code comment changed. No user-visible API, CLI, configuration, workflow, default, or error changed.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: GitHub Actions CI / Pull Request run 30994889620 passed, including package contracts, for commit cc27d79ef.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

[coderabbitai]

📝 Walkthrough

Walkthrough

The package-contract fixture comment now describes copied package inputs for parallel workers. The sandbox-policy packaging test now includes nemoclaw/dist in its fixture package entries.

Changes

Package-contract fixture update

Layer / File(s)	Summary
Update package fixture inputs test/package-contract/helpers/package-fixture.ts, test/package-contract/openshell-policy-boundary.test.ts	The fixture comment describes copied package inputs. The sandbox-policy test package includes nemoclaw/dist alongside dist and schemas.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: aasthajh

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the package test change to copy published plugin artifacts into the fixture.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-package-fixture-inputs

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit cc27d79 in the codex/fix-package-fi... branch remains at 96%, unchanged from commit a82887e in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit cc27d79 in the codex/fix-package-fi... branch remains at 81%, unchanged from commit a82887e in the main branch.

Show a code coverage summary of the most impacted files.

File	main a82887e	codex/fix-package-fi... cc27d79	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/shields/index.ts	74%	73%	-1%
src/lib/onboard...-transaction.ts	94%	94%	0%
src/lib/sandbox...rce-identity.ts	87%	87%	0%
src/lib/state/m...-acquisition.ts	86%	86%	0%
src/lib/tunnel/services.ts	80%	80%	0%
src/lib/inferen...er-discovery.ts	87%	88%	+1%

---

_{Updated August 05, 2026 10:02 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

1 semantic terminology decision

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• established — package inputs at test/package-contract/helpers/package-fixture.ts:21: Keep `package inputs`; it precisely names the copied fixture content.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.