feat(openshell): upgrade managed runtime to v0.0.99 - #8523
feat(openshell): upgrade managed runtime to v0.0.99#8523apurvvkumaria wants to merge 21 commits into
Conversation
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe PR upgrades NemoClaw’s OpenShell integration from 0.0.85 to 0.0.99. It updates pinned artifacts, credential manifests, compatibility rules, inference parsing, sandbox-name limits, E2E provenance, fixtures, and migration evidence. ChangesOpenShell release identity and artifact pins
Credential boundary manifest
Gateway and MCP compatibility contracts
Migration review and acceptance evidence
Estimated code review effort: 3 (Moderate) | ~30 minutes Possibly related issues
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
|
🌿 Preview your docs: https://nvidia-preview-pr-8523.docs.buildwithfern.com/nemoclaw |
PR Review Advisor — InformationalAdvisor assessment: Informational / low confidence Model lanes
Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests. E2E guidanceAdvisory only. A maintainer can dispatch the default E2E suite against this exact revision. Recommended E2E: This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/openshell-0.0.99-migration-review.test.ts`:
- Around line 38-41: The migration review test currently counts commit-like
tokens and checks string presence instead of validating evidence structure.
Replace the commitLedger token-count assertion with parsing of each range row,
asserting declared counts and unique commit IDs, and validate every archive,
extracted-binary, supervisor, source-commit, and manifest identity against
independent expected values tied to the 0.0.99 manifest. Update the runtime-gate
checks to assert observable behavior and artifact associations rather than
source-text occurrence.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 1c11c0a1-b81b-4f83-8022-93cd63bfa75d
📒 Files selected for processing (51)
.github/workflows/e2e.yamlagents/hermes/Dockerfileagents/hermes/mcp-config-transaction.pydocs/deployment/set-up-mcp-bridge.mdxdocs/manage-sandboxes/add-mcp-server.mdxdocs/reference/commands.mdxdocs/reference/configure-runtime-identity.mdxdocs/reference/troubleshoot-mcp-servers.mdxdocs/reference/troubleshooting.mdxdocs/security/best-practices.mdxdocs/security/openshell-0.0.99-migration-review.mdnemoclaw-blueprint/blueprint.yamlscripts/brev-launchable-ci-cpu.shscripts/install-openshell.shscripts/update-hermes-agent.shsrc/lib/actions/sandbox/mcp-bridge-input-validation.test.tssrc/lib/actions/sandbox/mcp-bridge-validation.tssrc/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.99.jsonsrc/lib/onboard/docker-driver-gateway-runtime.test.tssrc/lib/onboard/docker-driver-gateway-runtime.tssrc/lib/onboard/docker-gpu-patch-types.tssrc/lib/onboard/openshell-feature-gate.test.tssrc/lib/onboard/openshell-feature-gate.tssrc/lib/onboard/openshell-install.test.tssrc/lib/onboard/openshell-install.tssrc/lib/onboard/openshell-version.tstest/brev-launchable-ci-cpu-checksum.test.tstest/candidate-compat.test.tstest/deepagents-mcp-legacy-lifecycle.test.tstest/e2e/live/network-policy.test.tstest/e2e/live/openclaw-plugin-runtime-exdev.test.tstest/e2e/live/openshell-gateway-auth-source-contract-helpers.tstest/e2e/live/openshell-gateway-auth-source-contract.test.tstest/e2e/live/openshell-gateway-upgrade.test.tstest/fixtures/openshell-v0.0.99test/hermes-doctor-config-hash.test.tstest/hermes-final-image-layout.test.tstest/hermes-mcp-credential-boundary-manifest.test.tstest/install-openshell-version-check.test.tstest/mcp-add-crash-consistency.test.tstest/mcp-destroy-lifecycle.test.tstest/mcp-openshell-workflow.test.tstest/mcp-policy-key-ownership.test.tstest/mcp-restart-policy-order.test.tstest/openshell-0.0.99-migration-review.test.tstest/openshell-channel-workflow.test.tstest/pr-workflow-contract.test.tstest/sandbox-provisioning.test.tstest/sandbox-rlimit-hooks.test.tstest/update-hermes-agent-script.test.tstools/e2e/mcp-workflow-boundary.mts
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
|
@apurvvkumaria — I revalidated this review at head Product scope: PASS — #8497 authorizes the OpenShell v0.0.99 qualification and pin update. GitHub merge state: BLOCKED — GitHub reports the PR mergeable, but it is behind the current base and required Blocking checklist
I am holding approval until these items and the required GitHub gate are clear. |
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
…e' into codex/8497-openshell-v099-upgrade
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
…e' into codex/8497-openshell-v099-upgrade
|
Addressed all blockers from the maintainer review in verified commit
Fresh GitHub CI and exact all-agent managed startup are running on |
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/actions/sandbox/mcp-bridge-url-validation.ts`:
- Around line 224-227: Update the DNS-pinning validation and its explanatory
comment near the OpenShell connection flow to require
proxy_connect_by_hostname=false; reject or fail validation when the setting is
enabled, so the allowed_ips guarantee only applies when OpenShell connects using
its pinned SocketAddr list.
In `@test/runner.test.ts`:
- Around line 368-370: Extend the validateName boundary tests around the
existing 19-character case to assert that the first invalid length, 20
characters, throws the same “sandbox name too long (max 19 chars)” error. Keep
the existing valid 19-character and oversized-input assertions unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 319fa606-10d0-4b11-a7cc-d8a16414b59e
📒 Files selected for processing (20)
agents/hermes/mcp-config-transaction.pyci/source-shape-test-budget.jsondocs/deployment/set-up-mcp-bridge.mdxdocs/reference/commands.mdxdocs/reference/troubleshooting.mdxdocs/security/openshell-0.0.99-migration-review.mdnemoclaw/src/shared/openshell-policy-boundary.ctsnemoclaw/src/shared/sandbox-name.ctssrc/lib/actions/sandbox/mcp-bridge-url-validation.tssrc/lib/deploy/index.test.tssrc/lib/onboard/forward-start.tstest/e2e/support/mcp-bridge-sandbox.test.tstest/installer-hash-check.test.tstest/onboard-sandbox-name.test.tstest/openshell-0.0.85-migration-review.test.tstest/openshell-0.0.99-migration-review.test.tstest/repro-5978-policy-denial-hint.test.tstest/runner.test.tstest/update-hermes-agent-script.test.tstools/e2e/cli-artifact-workflow-boundary.mts
🚧 Files skipped from review as they are similar to previous changes (5)
- docs/security/openshell-0.0.99-migration-review.md
- agents/hermes/mcp-config-transaction.py
- docs/reference/commands.mdx
- test/update-hermes-agent-script.test.ts
- docs/reference/troubleshooting.mdx
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
|
Follow-up exact-activation blocker addressed in verified commits |
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
cv
left a comment
cv
left a comment
There was a problem hiding this comment.
The OpenShell migration has unresolved contract failures. Require proxy_connect_by_hostname = false before claiming MCP DNS pinning; otherwise a corporate proxy can resolve the hostname again and bypass allowed_ips through split-horizon DNS or rebinding. Update the gateway-auth contract to use the reviewed v0.0.99 supervisor digest so mTLS and cross-sandbox JWT denial qualify the selected trust boundary. Shorten and validate the gateway-upgrade E2E sandbox name under the new 19-character limit, and add the first-invalid 20-character name test. Resolve the current threads, fix the 13 failing checks, refresh onto current main, and rerun exact all-agent activation and the complete migration evidence.
|
Pushed the complete follow-up blocker set at exact head
Validation: focused activation/bootstrap suites pass, the previously failing CLI set passes 153/153, the integration set passes 80 with one intentional skip, package contracts pass 9/9, |
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
|
Follow-up CI blocker fixed in verified commit |
cv
left a comment
cv
left a comment
There was a problem hiding this comment.
Please review this PR description and diff for comms and documentation guidelines in WRITING.md and linked artifacts
Keep integration-test fixture names within OpenShell v0.0.99's 19-character sandbox-name limit. Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
3 participants
Summary
Upgrade NemoClaw's consumed OpenShell runtime from v0.0.85 to v0.0.99 now that the release manifests are trusted by #8499. The change pins the exact v0.0.99 artifacts across install, blueprint, managed-agent, Brev, and E2E paths while documenting and testing the migration's credential, MCP, lifecycle, and network-policy boundaries.
Related Issue
Part of #8497.
Changes
Type of Change
Quality Gates
docs/security/openshell-0.0.99-migration-review.mdandsrc/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.99.json; repository-owned maintainer review routing remains authoritative.Documentation Writer Review
docs-updateddocs/deployment/set-up-mcp-bridge.mdx,docs/manage-sandboxes/add-mcp-server.mdx,docs/reference/commands.mdx,docs/reference/configure-runtime-identity.mdx,docs/reference/troubleshoot-mcp-servers.mdx,docs/reference/troubleshooting.mdx,docs/security/best-practices.mdx,docs/security/openshell-0.0.99-migration-review.mdDGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run validate:prpassed after refreshingorigin/mainwhen hooks were skipped or unavailablenpm run build:cli,npm run source-shape:check, andnpm run test:titles:checkpassed.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result:npm testwas attempted locally but the heavily loaded host produced widespread unrelated loopback/timing failures across untouched suites; changed-area suites pass in isolation and fresh PR CI is required.npm run docsbuilds without warnings (doc changes only) — command passed with 0 errors and 2 Fern warnings, so this remains unchecked.Signed-off-by: Apurv Kumaria akumaria@nvidia.com
Summary by CodeRabbit
New Features
Bug Fixes
Documentation
Tests