fix(rebuild): preserve external policy authority by apurvvkumaria · Pull Request #10116 · NVIDIA/NemoClaw

apurvvkumaria · 2026-08-24T15:41:57Z

Summary

Sandbox rebuild now binds one recorded OpenShell policy authority through preflight, delete, recreate, restore, and recovery. A changed or externally managed policy stops NemoClaw policy mutation and success publication.

Related Issue

Part of #9833

Changes

Qualify rebuild policy requirements before destructive work.
Revalidate policy authority before sandbox, policy, credential, messaging, MCP, and registry mutations.
Preserve authority receipts through interrupted rebuild recovery and compensation.
Cover managed, external, drift, restart, and post-delete failure paths.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification:
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
Targeted behavior tests pass for the current change set, or tests are marked not applicable above — focused rebuild authority and recovery tests passed
Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
Quality Gates section completed with required justifications or waivers
No secrets, API keys, or credentials committed
npm run docs builds without warnings (doc changes only)
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

New Features
- Added policy-authority verification throughout sandbox rebuilds, including support for externally managed policies.
- Added managed MCP policy validation and recovery safeguards.
- Added recovery handling for replacement sandbox configuration locks and policy artifacts.
- Added clearer provider-change diagnostics when onboarding or refresh operations fail.
Bug Fixes
- Prevented rebuilds from publishing success when policy authority changes or validation fails.
- Improved rollback, deletion, and restoration behavior after partial failures.
- Improved handling of missing, stale, or ambiguous sandbox states.

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

coderabbitai · 2026-08-24T15:42:05Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Changes

Policy authority lifecycle

Layer / File(s)	Summary
Authority qualification and policy requirements `src/lib/actions/sandbox/policy-authority/*`, `src/lib/agent/definition-types.ts`	Policy authority inspection, persistence, validation, and managed MCP policy requirement generation were added.
Rebuild mutation controls `src/lib/actions/sandbox/rebuild-.ts`, `src/lib/actions/sandbox/mcp-bridge.ts`	Rebuild phases now validate policy authority around mutations, propagate refusal errors, and compensate partial MCP teardown.
External policy recovery `src/lib/shields/index.ts`, `src/lib/actions/sandbox/rebuild-shields*.ts`	External recovery artifacts, replacement lock rebinding, authority-specific Shields handling, and transactional artifact retirement were added.
Validation and integration updates `src/lib/actions/sandbox/.test.ts`, `src/lib/onboard/`, `test/helpers/`, `test/runtime/`, `ci/source-architecture-budget.json`	Tests, fixtures, onboarding diagnostics, harnesses, and architecture budgets were updated for the new authority contracts.

Estimated code review effort: 5 (Critical) | ~120 minutes

Merge Risk: 🟠 High · up to 102d1

This change makes rebuilds preserve and revalidate external policy authority, but the current head still contains paths that can bypass those checks, accept legacy external targets, or leave a live unregistered sandbox after rollback; several affected tests also do not typecheck or load, and required validation gates are incomplete. These correctness, cleanup, and merge-readiness issues make the PR high risk and not ready to merge until fixed or explicitly accepted.

Sequence Diagram(s)

sequenceDiagram
  participant RebuildPipeline
  participant PolicyAuthority
  participant MCPBridge
  participant Shields
  RebuildPipeline->>PolicyAuthority: qualify and record authority
  RebuildPipeline->>MCPBridge: prepare and restore with validator
  MCPBridge->>PolicyAuthority: validate before and after mutations
  RebuildPipeline->>Shields: persist or rebind recovery state
  Shields->>PolicyAuthority: validate authority-bound recovery

Possibly related PRs

NVIDIA/NemoClaw#9899: Both changes modify MCP rebuild and externally managed policy flows.
NVIDIA/NemoClaw#10115: Both changes modify policy-authority handling and rebuild revalidation.

Suggested reviewers: ericksoa

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 21.25% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 80 functions across 73 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preserving external policy authority during sandbox rebuilds.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/9833-rebuild-authority

_{Comment @coderabbitai help to get the list of available commands.}

github-code-quality · 2026-08-24T15:43:01Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit 450887f in the codex/9833-rebuild-a... branch remains at 96%, unchanged from commit 83fd95b in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit 450887f in the codex/9833-rebuild-a... branch is 84%. The line coverage in commit 83fd95b in the main branch is 83%.

Show a line coverage summary of the most impacted files.

File	`main` 83fd95b	`codex/9833-rebuild-a...` 450887f	+/-
`src/lib/actions...estroy-phase.ts`	93%	88%	-5%
`src/lib/actions...e-validation.ts`	88%	84%	-4%
`src/lib/agent/base-image.ts`	87%	84%	-3%
`src/lib/shields/index.ts`	83%	84%	+1%
`src/lib/actions...ild-pipeline.ts`	90%	95%	+5%
`src/lib/inferen...anaged-state.ts`	83%	93%	+10%
`src/lib/sandbox...uild-context.ts`	78%	93%	+15%
`src/lib/actions...requirements.ts`	0%	69%	+69%
`src/lib/actions...rity/rebuild.ts`	0%	95%	+95%
`src/lib/actions...ty/preflight.ts`	0%	97%	+97%

_{Updated August 28, 2026 07:37 UTC}

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

… into codex/9833-rebuild-authority Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

  revalidatePolicyRequirements?(operation: string): void;
 }

+function policyAuthorityCheckedRunner(


## Outcome Hermes GPU creation retains NemoClaw policy authority when OpenShell applies the reviewed GPU baseline enrichment or changes the policy during the same verified create transaction. Completed sandboxes, external policy mutations, and arbitrary filesystem additions remain unable to refresh a receipt. ## Reason The fallback and compatibility-only Hermes GPU jobs reached the exact sandbox, then rejected policy ownership. The compatibility route did not recognize the reviewed GPU enrichment. A later product-owned container transition could also advance the policy identity after the first receipt was recorded. The broader seven-job report contains three distinct root causes. This PR claims only the product-owned GPU receipt-transition cause. PR #10398 owns a different fallback cleanup failure. PRs #10116 and #10119 own external-policy preservation. ### Related issues Part of #9833. Relates to #10155. ## Changes - Recognize the reviewed native and compatibility GPU enrichment shapes while preserving route-specific `/proc` requirements. - Refresh a managed receipt only through the in-progress verified create transaction after exact identity and stable policy verification pass again. - Update the durable pending checkpoint with compare-and-set against the prior checkpoint before later effects continue. - Reject receipt refresh for completed sandbox mutations, routes without GPU injection, and arbitrary added filesystem paths. - Preserve the Hermes portable native-policy verifier on the renamed shared enrichment predicate. ## Verification - `npx vitest run --project cli src/lib/onboard/sandbox-create/policy-creation-receipt.test.ts` — 29 tests passed. - Focused CLI suites for receipt verification, orchestration, GPU identity gates, GPU create, policy mutation authority, and registry transitions — 9 files and 288 tests passed. - `tsc -p tsconfig.cli.json` — passed. - `tsx scripts/checks/run.mts` — repository checks passed. - File-local formatting, Oxlint, whitespace, and ignored-file hooks — passed. - `git diff --check` — passed. - The diff contains no secrets, API keys, or credentials. ## Review notes E2E root cause: `sandbox create / GPU policy receipt verification / reviewed compatibility enrichment and verified create transition rejected` Source run: https://github.com/NVIDIA/NemoClaw/actions/runs/33111985611 (run 33111985611, attempt 1) Failed jobs: - Hermes GPU fallback: https://github.com/NVIDIA/NemoClaw/actions/runs/33111985611/job/98657665722 - Hermes GPU compatibility-only: https://github.com/NVIDIA/NemoClaw/actions/runs/33111985611/job/98657665787 Signatures: - The live base policy does not match the policy supplied by the create transaction. - The creation receipt no longer matches the live sandbox policy before the runtime patch. Scope: one root cause. Security boundary: refresh requires the active verified create boundary, exact sandbox lifecycle identity, stable sandbox-scoped policy, an allowlisted GPU enrichment, and checkpoint compare-and-set. External mutations and completed-sandbox policy drift remain denied. Independent sensitive-path review remains required. --- Signed-off-by: Aaron Erickson <aerickson@nvidia.com>  ## Summary by CodeRabbit - **Bug Fixes** - Improved GPU policy validation across native and compatibility routes, including supported proxy-only access. - Strengthened post-creation checks for sandbox identity, reservations, checkpoints, and policy consistency. - Prevented unexpected policy registration changes during active sandbox creation. - Ensured mismatched managed policy registrations are rejected with clearer error handling. - **Tests** - Expanded coverage for GPU enrichment, proxy-only access, and policy registration revalidation. - Added coverage confirming mismatched managed registrations are rejected rather than refreshed.  --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

…to HEAD

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

…to HEAD

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

github-actions · 2026-08-28T06:29:52Z

PR Review Advisor finished for commit 7744ddd. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

All previous runs

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

cjagwani · 2026-08-29T02:10:04Z

Closing because the accepted product decision in #10514 supersedes the persisted policy-authority design implemented here. OpenShell is now the sole durable policy source; NemoClaw must not retain or replay a second authority record across rebuilds. #10515 implements that semantic cutover while preserving immutable sandbox identity, provider identity, credential targeting, and fail-closed destructive-operation checks. Any still-relevant tests or recovery fixes from this branch should be reassessed against #10515 rather than carrying the superseded authority model forward. Thank you for the substantial work on this path.

apurvvkumaria and others added 20 commits August 23, 2026 17:49

fix(policy): enforce external policy authority

dfa9376

test(policy): model managed authority preflight

ad1c8f7

merge: sync main

2b18b39

fix(policy): fail closed on empty authority

58d9477

fix(policy): guard blueprint and Shields mutations

864145b

test(blueprint): model policy authority preflight

eae0cc1

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

fix(policy): retain incomplete blueprint transitions

192c23f

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

test(blueprint): keep policy mutations visible

b06fe62

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

test(policy): cover authority refusal states

915db84

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

fix(shields): report external policy recovery

c7bd1f0

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

fix(policy): reconcile interrupted mutations

5078283

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

test(blueprint): cover policy reconciliation refusals

548f8fd

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

Merge branch 'main' into codex/9833-policy-authority-foundation

1246705

Merge branch 'main' into codex/9833-policy-authority-foundation

e4f9bcd

Merge branch 'main' into codex/9833-policy-authority-foundation

6976407

fix(onboard): respect external policy authority

3ecd24b

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

fix(onboard): close policy authority lifecycle gaps

9fa334a

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

Merge branch 'main' into codex/9833-policy-authority-foundation

c7743a5

fix(rebuild): preserve external policy authority

f71fbf7

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

Merge branch 'main' into codex/9833-policy-authority-foundation

2729d14

wscurran added area: policy Network policy, egress rules, presets, or sandbox policy area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery bug-fix PR fixes a bug or regression labels Aug 24, 2026

apurvvkumaria added 5 commits August 24, 2026 09:51

fix(policy): close authority review gaps

6f71bdb

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

merge: update onboarding authority base

61646cc

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

Merge remote-tracking branch 'origin/codex/9833-onboarding-authority'…

fadf3ef

… into codex/9833-rebuild-authority Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

test(e2e): retain blueprint policy call evidence

6cf16bb

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

test(rebuild): qualify policy authority fixtures

adcb438

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

cjagwani added 4 commits August 27, 2026 15:08

test(e2e): bind rebuild fixture policy ownership

6e2ad4b

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

merge: update rebuild authority from current main

99168b0

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

merge: sync E2E host command fix

45683b3

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

fix(e2e): retain PATH for host commands

f33a64c

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

github-advanced-security Bot found potential problems Aug 27, 2026

View reviewed changes

Comment thread src/lib/onboard/credential-provider-registration.ts

revalidatePolicyRequirements?(operation: string): void;

}

function policyAuthorityCheckedRunner(

merge: resolve conflicts with main

0aa109c

cjagwani added 4 commits August 27, 2026 18:10

test(e2e): preserve old runtime during rebuild setup

b929197

test(e2e): scope legacy image patch to Docker build

3c3f748

test(e2e): enable legacy image prebuild

a4411d3

test(e2e): preserve OpenShell companion identity

cb15ad3

github-actions Bot added v0.0.116 Release target and removed v0.0.115 labels Aug 28, 2026

cjagwani and others added 9 commits August 27, 2026 21:00

test(e2e): use explicit legacy rebuild context

4749b5c

Merge remote-tracking branch 'origin/main' into HEAD

7e9f806

Merge branch 'main' into codex/9833-rebuild-authority

1be532a

Merge remote-tracking branch 'origin/codex/9833-rebuild-authority' in…

73aebca

…to HEAD

test: cover MCP rebuild refusal compensation

5714c42

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

test(e2e): keep rebuild fixture on current base

7188538

Merge remote-tracking branch 'origin/main' into HEAD

15b792c

Merge remote-tracking branch 'origin/codex/9833-rebuild-authority' in…

7744ddd

…to HEAD

fix: preserve rebuild policy authority failures

8ddd9e8

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

cv and others added 5 commits August 27, 2026 23:30

merge: sync concurrent PR updates

76cdb13

merge: resolve conflicts with main

db7e43d

ci: retrigger PR review advisor

8015468

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

ci: retrigger PR review advisor

450887f

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

merge: resolve conflicts with main

aeb8bec

cjagwani closed this Aug 29, 2026

Navigation Menu

Uh oh!

fix(rebuild): preserve external policy authority - #10116

fix(rebuild): preserve external policy authority#10116
apurvvkumaria wants to merge 98 commits into
mainfrom
codex/9833-rebuild-authority

apurvvkumaria commented Aug 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 24, 2026 •

edited

Loading

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

github-code-quality Bot commented Aug 24, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

cjagwani commented Aug 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

apurvvkumaria commented Aug 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Type of Change

Quality Gates

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

github-code-quality Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

cjagwani commented Aug 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

apurvvkumaria commented Aug 24, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 24, 2026 •

edited

Loading

github-code-quality Bot commented Aug 24, 2026 •

edited

Loading