ci(release): automate frozen daily editions

[cjagwani]

Summary

Replace per-release E2E authorization with a frozen daily edition: merge from 8 AM to 4 PM Pacific, record the exact pre-cutoff main candidate, run consolidated E2E and agent review asynchronously, and cut the non-empty edition at 4 AM regardless of E2E state. Non-E2E release controls remain fail-closed, including changelog presence, GitHub-recorded cutoff provenance, ancestry, tag collisions, signing, latest, lkg, carry-forward, and label retirement.

This PR does not remove the existing PR E2E gate; Carlos owns that separate change. It supplies the post-merge review, consolidated overnight run, release automation, and maintainer guidance needed after that gate is removed.

Changes

• Add a credential-free post-merge dispatcher that sends every exact main before...after range to the existing isolated PR Review Advisor. Its concurrency key includes the immutable head SHA so later merges do not cancel earlier review turns.
• Schedule consolidated E2E for 4:17 PM America/Los_Angeles, immediately after edition close, and update the executable workflow boundary to protect that schedule.
• Add a 4:17 PM edition-close workflow. It selects the latest main push run GitHub recorded at or before exactly 4 PM instead of trusting commit timestamps, then creates a three-day plan artifact bound to the source run ID, recorded time, candidate SHA, ancestry, exact changelog heading, version progression, and consistency hash.
• Add a 4:17 AM edition-cut workflow. A canonical scheduled run downloads exactly one successful close artifact, rejects ambiguous provenance, cuts a dedicated-key SSH-signed annotated tag for a non-empty edition without consulting E2E, directly invokes release-latest-tag.yaml, and uploads tagged or no-change handoff evidence.
• Keep manual dispatch non-publishing: it performs signer preflight for a ready edition and records a no-change edition without creating a tag. Local maintainer recovery remains confirmation-bound.
• Upgrade release plan consumers to schema v2, preserve lkg, fail closed when the remote semver sequence or candidate ancestry changes, and remove the obsolete E2E release-evidence ledger and package command.
• Rewrite maintainer cut/evening/E2E/policy guidance around the 4 PM–8 AM frozen window. One assigned agent continuously processes asynchronous exact-SHA review and consolidated E2E findings through the 4 AM tag and 8 AM handoff; a post-cutoff main advance remains next-edition validation rather than frozen-candidate evidence.\n- Retain a fail-closed deterministic PR floor when live E2E gating is removed. The required build-typecheck lane now builds the CLI and plugin, starts the compiled CLI in an isolated home, verifies packed entrypoints, and then runs the full package contracts and typechecks.

Rollout prerequisite

Before enabling the first scheduled cut, configure the release-tag GitHub environment with no human wait, restrict it to main, add NEMOCLAW_RELEASE_TAG_SIGNING_KEY, NEMOCLAW_RELEASE_TAG_SIGNER_NAME, and NEMOCLAW_RELEASE_TAG_SIGNER_EMAIL, and register the corresponding public signing key on the dedicated GitHub release identity. The private key signs only; the job-scoped GITHUB_TOKEN performs the push with declared actions: read and contents: write permissions.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: this changes internal maintainer automation and agent guidance, not a supported CLI, API, configuration, or end-user workflow.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex Desktop ran nemoclaw-maintainer-security-code-review; PASS across workflow authority, permissions, signing-key lifecycle, token scope, artifact provenance, input validation, injection, and secret exposure.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: .agents/skills/nemoclaw-maintainer-cut-release-tag/SKILL.md, .agents/skills/nemoclaw-maintainer-e2e/SKILL.md, .agents/skills/nemoclaw-maintainer-evening/SKILL.md, .agents/skills/nemoclaw-maintainer-morning/SKILL.md, .agents/skills/nemoclaw-maintainer-release-notes/SKILL.md, .agents/skills/nemoclaw-maintainer-policies/references/daily-flow.md, .agents/skills/nemoclaw-maintainer-policies/references/release-train.md, .agents/skills/nemoclaw-skills-guide/SKILL.md, and .agents/skills/nemoclaw-maintainer-day/PR-REVIEW-PRIORITIES.md; no user-facing docs/ page changes are needed.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 24 release integration tests, 42 release workflow/policy/skill tests, and 45 E2E workflow-boundary tests passed.
• Applicable broad gate passed — not applicable; this changes scheduled workflow orchestration and internal maintainer guidance, covered by executable workflow contracts, release integration tests, and normal hooks rather than runtime or coverage behavior.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

Additional verification:

• npm run build:cli && npm run typecheck:cli
• npm run test:projects:check
• npm run test-size:check
• npm run source-shape:check
• git diff --check
• normal hooks: YAML, shfmt, Biome, shellcheck, gitleaks, semantic E2E plans, source-shape budget, skill YAML, commitlint, CLI/JS-config TypeScript, and version sync

---

Signed-off-by: Charan Jagwani cjagwani@nvidia.com

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 15bcbda3-585d-4768-933c-4fc38255fb77

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 41b14f2 in the codex/nightly-releas... branch remains at 96%, unchanged from commit 26bd9f5 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 41b14f2 in the codex/nightly-releas... branch remains at 82%, unchanged from commit 26bd9f5 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 26bd9f5	codex/nightly-releas... 41b14f2	+/-
src/lib/onboard...flight-ports.ts	67%	33%	-34%
src/lib/onboard...box-prebuild.ts	91%	77%	-14%
src/lib/domain/...dbox/destroy.ts	89%	84%	-5%
src/lib/onboard/preflight.ts	80%	79%	-1%
src/lib/shields/index.ts	81%	81%	0%
src/lib/onboard...trap/adapter.ts	68%	69%	+1%
src/lib/onboard...er-gpu-patch.ts	80%	81%	+1%
src/lib/actions...eway-restart.ts	92%	94%	+2%
src/lib/domain/.../connect-env.ts	89%	97%	+8%
src/lib/onboard/docker-cdi.ts	70%	80%	+10%

---

_{Updated August 06, 2026 03:44 UTC}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-8424.docs.buildwithfern.com/nemoclaw

[github-actions]

PR Review Advisor — Blocking findings reported

Advisor assessment: Blockers require maintainer review
Next action: Review the blockers below.
Findings: 1 blocker · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 1 blocker · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

4 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• established — edition at .agents/skills/nemoclaw-maintainer-policies/references/release-train.md:15: Use edition consistently for the cutoff-bounded daily release unit.
• justified — frozen candidate at .agents/skills/nemoclaw-maintainer-cut-release-tag/SKILL.md:28: Retain frozen candidate where the distinction from current main affects tag selection.
• justified — consolidated E2E at .agents/skills/nemoclaw-maintainer-policies/references/release-train.md:16: Retain consolidated E2E where the scheduled run must be distinguished from selective reruns.
• define — release doula at .agents/skills/nemoclaw-maintainer-policies/references/release-train.md:18: Define release doula at first use with its release-handoff responsibility, or replace it with release maintainer.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, managed-image-multiarch-startup, security-posture

Blockers

PRA-1 Blocker — Schedule the edition workflows at the documented Los Angeles times

• Location: .github/workflows/release-edition-close.yaml:10
• Category: correctness
• Problem: The workflows place a `timezone` field beside each GitHub Actions schedule entry. GitHub Actions schedule triggers evaluate cron in UTC and do not use that field. Consequently, the close and E2E jobs run at 16:17 UTC, while the cut job runs at 04:17 UTC, instead of the documented Los Angeles boundaries.
• Impact: The close run can freeze the wrong edition window, and the cut run can select the wrong previous edition date or fail to find its close artifact. This breaks the frozen-candidate release contract.
• Fix: Replace these schedules with a supported UTC schedule strategy that preserves the intended Los Angeles boundaries across the repository's DST policy, and update the workflow-boundary contract accordingly.
• Verification: Read GitHub Actions schedule documentation and inspect the three `on.schedule` entries; confirm their effective UTC fire times for both Pacific standard and daylight time.
• Test coverage: Add focused workflow-contract coverage that verifies the effective close, E2E, and cut schedule policy for both Pacific standard time and daylight-saving time.
• Evidence: .github/workflows/release-edition-close.yaml:10-11 .github/workflows/release-edition-cut.yaml:8-9 .github/workflows/e2e.yaml:10-11 scripts/release-plan.mts:321-349 derives the Los Angeles cutoff from the edition date, but cannot correct an incorrectly timed workflow invocation.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cjagwani]

Superseded by #8479, rebuilt from current main after #8445, #8456, and #8469. The replacement keeps per-main-push E2E and bounded retries, removes the duplicate scheduled-E2E proposal and stale gate-removal rollout, and carries forward the frozen-edition/tag automation plus exact-SHA Advisor artifacts.