test(inference): cover receipt authority rejection

[cv]

Summary

Adds regression coverage for two receipt-authority rejection paths introduced by #8422.
The tests confirm that invalid authority data stops processing before engine, journal, or receipt-publication mutation.
Production behavior does not change.

Changes

• Reject a malformed receipt-writer target digest before any container-engine call or journal record.
• Reject a canonical receipt whose model generation differs from durable create authority.
• Confirm that the create journal remains in the started phase after the receipt mismatch.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This test-only change adds coverage for existing receipt-authority rejection behavior. It changes no production or user-visible surface.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Independent nine-category security review found no findings for PR commit 4d70daff0b638a881ef105672e958307791d391d against base SHA 2f297843b8fddad80b046eaf34f2987bdd922711. The test-only diff verifies that malformed receipt-writer authority and a receipt whose model generation differs from durable create authority are rejected before engine, journal, or receipt-publication mutation. It changes no production code, credential handling, policy, dependency, or runtime configuration.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: No waiver is recorded.

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Independent review of PR commit 4d70daff0b638a881ef105672e958307791d391d against base SHA 2f297843b8fddad80b046eaf34f2987bdd922711 covered the complete effective diff. The two additions are negative source tests for existing receipt-writer and create-journal authority controls. They change no user-facing command, configuration, API, workflow, default, error, or supported behavior. Both test titles follow WRITING.md and place issue references in final suffixes.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable; scripts/prepare-dgx-station-host.sh does not change.
• Station profile/scenario: Not applicable.
• Result: Not applicable.
• Supporting evidence: Not applicable.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub — GitHub reports all four commits as Verified.
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable — commitlint, the generated-artifact age check, CLI TypeScript checking, and package-version synchronization passed through normal hooks.
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — GitHub Actions is running for PR commit 4d70daff0. No standalone local test suite ran.
• Applicable broad gate passed — not applicable; this change adds two focused source tests and no production or test-harness behavior.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — not applicable; no documentation file changed.
• Doc pages follow the style guide (doc changes only) — not applicable.
• New doc pages include SPDX header and frontmatter (new pages only) — not applicable.

Sensitive-Path Security Review

Independent review found no security finding for PR commit 4d70daff0b638a881ef105672e958307791d391d against base SHA 2f297843b8fddad80b046eaf34f2987bdd922711.

1. Secrets and credentials: PASS. No credential material or credential handling changed.
2. Input validation and data sanitization: PASS. Tests cover a malformed digest and a durable-authority mismatch.
3. Authentication and authorization: PASS. Publication-authority rejection gains coverage; runtime logic does not change.
4. Dependencies and third-party libraries: PASS. No dependency changed.
5. Error handling and logging: PASS. Tests assert existing non-secret errors.
6. Cryptography and data protection: PASS. The tests exercise existing SHA-256 validation only.
7. Configuration and security headers: PASS. No configuration changed.
8. Security testing: PASS. Two forbidden-input paths now require rejection before mutation.
9. System security: PASS. Tests cover the boundary before engine, journal, and receipt-publication mutation.

Required checks and independent maintainer approval remain separate merge requirements.

GitHub Actions

GitHub Actions is authoritative for PR commit 4d70daff0b638a881ef105672e958307791d391d against base SHA 2f297843b8fddad80b046eaf34f2987bdd922711.
Required checks started after the branch update.
No check waiver is recorded.

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

[coderabbitai]

📝 Walkthrough

Walkthrough

Added regression tests for malformed receipt-writer authority and mismatched model generation. The tests verify rejection before Docker interaction, receipt publication, or journal mutation.

Changes

Receipt validation tests

Layer / File(s)	Summary
Receipt and journal validation regressions src/lib/onboard/runtime-provider/docker-llama-cpp-managed-lifecycle.test.ts, src/lib/onboard/runtime-provider/host-local-create-journal.test.ts	Tests reject malformed receipt-writer authority and mismatched model generation. They verify that Docker and journal state remain unchanged, or that the transaction remains in the started phase.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NVIDIA/NemoClaw#8073: Covers journal-bound provenance and mutation ordering in onboarding flows.
• NVIDIA/NemoClaw#8261: Introduces related receipt-authority and model-generation validation flows.
• NVIDIA/NemoClaw#8399: Covers related managed local-runtime receipt and lifecycle handling.

Suggested labels: area: security

Suggested reviewers: apurvvkumaria, ericksoa

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the added inference tests for receipt-authority rejection.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/test-receipt-authority-rejection

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 8d1b404 in the codex/test-receipt-a... branch remains at 96%, unchanged from commit be34105 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 8d1b404 in the codex/test-receipt-a... branch remains at 82%, unchanged from commit be34105 in the main branch.

Show a code coverage summary of the most impacted files.

File	main be34105	codex/test-receipt-a... 8d1b404	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/platform.ts	89%	84%	-5%
src/lib/inferen...er-discovery.ts	88%	87%	-1%
src/lib/actions...air-approval.ts	90%	89%	-1%
src/lib/onboard...eate-journal.ts	89%	89%	0%
src/lib/onboard...ed-lifecycle.ts	87%	87%	0%
src/lib/core/immutable.ts	97%	97%	0%
src/lib/messagi...nnels/policy.ts	100%	100%	0%
src/lib/messagi...flow-planner.ts	93%	93%	0%
src/lib/onboard...shboard-port.ts	90%	96%	+6%

---

_{Updated August 06, 2026 07:46 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions differ; normalized E2E selections differ; severity counts match.

1 additional E2E selection from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

• managed-image-protected-runtime: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

2 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• established — receipt writer at src/lib/onboard/runtime-provider/docker-llama-cpp-managed-lifecycle.test.ts:1011: Retain the established term.
• established — create authority at src/lib/onboard/runtime-provider/host-local-create-journal.test.ts:168: Retain the established term.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite against this exact revision.

Recommended E2E: cloud-onboard

1 optional E2E recommendation

• llama-cpp-dgx-spark-qualification

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.