fix(inference): preserve onboard endpoint provenance - #7242
Conversation
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
ericksoa
added
area: security
ericksoa
added
area: security
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe change records inference endpoint provenance as ChangesInference endpoint provenance
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant OnboardFlow
participant ProviderInference
participant SetupInference
participant Registry
OnboardFlow->>ProviderInference: pass endpointSource
ProviderInference->>SetupInference: pass endpointSource and onboardEndpointUrl
SetupInference->>Registry: reserve route with endpointSource
sequenceDiagram
participant InferenceSet
participant FinalizeInferenceSetRoute
participant SSRFValidator
participant Registry
InferenceSet->>FinalizeInferenceSetRoute: provide recorded onboard endpoint
alt exact canonical onboard match
FinalizeInferenceSetRoute->>Registry: record endpointSource onboard
else other or missing provenance
FinalizeInferenceSetRoute->>SSRFValidator: normalize and validate endpoint
SSRFValidator->>Registry: record endpointSource inference-set
end
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
🌿 Preview your docs: https://nvidia-preview-pr-7242.docs.buildwithfern.com/nemoclaw |
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 55d82a5 in the TypeScript / code-coverage/cliThe overall coverage in commit 55d82a5 in the Show a code coverage summary of the most impacted files.
Updated |
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/lib/onboard/setup-inference.ts (1)
324-328: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftPreserve the original endpoint provenance during recreation.
createSetupInferenceis also used bytest/onboard-remote-recreate-credential-reuse.test.ts, where the recorded source distinguishes onboarding routes frominference-setroutes. Hard-coding"onboard"here can upgrade aninference-setor legacy route during recreation; later endpoint changes may then incorrectly receive the onboarding-only SSRF/DNS-pinning bypass.Thread the recorded source through the setup options and persist it here, using
"onboard"only for fresh onboarding. Add a recreation regression test for aninference-setroute.As per path instructions,
src/**migrations must trace fresh, resumed, retry, rebuild, persisted-state, and test paths while retaining one authoritative path.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/setup-inference.ts` around lines 324 - 328, Update createSetupInference to carry the recorded endpoint source through setup options and persist it in the updateSandbox payload, defaulting to onboarding only for fresh onboarding. Preserve the source across fresh, resumed, retry, rebuild, persisted-state, and test paths through one authoritative flow. Add a regression test covering recreation of an inference-set route and preventing it from being converted to onboard.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/reference/commands.mdx`:
- Around line 2948-2949: Update the same-provider model change guidance to
explicitly instruct users to pass the accepted URL via --endpoint-url, and state
that it must exactly match the canonical endpoint URL identified by the target
sandbox registry rather than merely being an equivalent URL.
In `@src/lib/onboard/machine/handlers/provider-inference.ts`:
- Line 358: Preserve trusted endpoint provenance during resume inference: in
src/lib/onboard/machine/handlers/provider-inference.ts lines 358-358, initialize
endpointSource from the persisted or authoritative route instead of null; in
src/lib/onboard/machine/core-flow-phases.ts lines 132-132, pass that provenance
into the provider-inference phase as well as the sandbox phase so refreshed
inference retains onboardEndpointUrl.
In `@src/lib/onboard/machine/handlers/sandbox.ts`:
- Around line 351-356: Preserve endpoint provenance across non-authoritative
resume/recreate flows: update endpointSourceForCreateIntent in sandbox.ts to
default to "onboard" only for fresh onboarding, otherwise retain the existing or
recovered source, including null/unknown values. In onboard.ts, replace the
hardcoded "onboard" argument in the ordinary resume/recreate path with the
persisted or recovered provenance; apply the corresponding change at
src/lib/onboard/machine/handlers/sandbox.ts:351-356 and
src/lib/onboard.ts:4431-4432.
---
Outside diff comments:
In `@src/lib/onboard/setup-inference.ts`:
- Around line 324-328: Update createSetupInference to carry the recorded
endpoint source through setup options and persist it in the updateSandbox
payload, defaulting to onboarding only for fresh onboarding. Preserve the source
across fresh, resumed, retry, rebuild, persisted-state, and test paths through
one authoritative flow. Add a regression test covering recreation of an
inference-set route and preventing it from being converted to onboard.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ca0237ac-094f-44d9-9c5f-615d9d464fc4
📒 Files selected for processing (33)
docs/inference/custom-endpoint-security.mdxdocs/inference/switch-models.mdxdocs/reference/commands.mdxsrc/lib/actions/inference-set-gateway-route-containment.test.tssrc/lib/actions/inference-set-provider-alias.test.tssrc/lib/actions/inference-set-route-containment.tssrc/lib/actions/inference-set.tssrc/lib/actions/sandbox/rebuild-gpu-opt-out.test.tssrc/lib/actions/sandbox/rebuild-gpu-opt-out.tssrc/lib/actions/sandbox/rebuild-resume-preflight.tssrc/lib/inference/selection.test.tssrc/lib/inference/selection.tssrc/lib/onboard.tssrc/lib/onboard/machine/core-flow-phases.tssrc/lib/onboard/machine/handlers/provider-inference.tssrc/lib/onboard/machine/handlers/sandbox-dcode-selection.test.tssrc/lib/onboard/machine/handlers/sandbox-tool-disclosure.test.tssrc/lib/onboard/machine/handlers/sandbox.test.tssrc/lib/onboard/machine/handlers/sandbox.tssrc/lib/onboard/provider-recovery.tssrc/lib/onboard/rebuild-route-handoff.test.tssrc/lib/onboard/rebuild-route-handoff.tssrc/lib/onboard/sandbox-registration.test.tssrc/lib/onboard/sandbox-registration.tssrc/lib/onboard/setup-inference-route-containment.test.tssrc/lib/onboard/setup-inference.tssrc/lib/onboard/setup-nim-flow.tssrc/lib/onboard/types.tssrc/lib/state/registry.tstest/onboard-inference-failure-paths.test.tstest/onboard-inference-gateway-scope.test.tstest/onboard-inference-reconciliation.test.tstest/onboard-remote-recreate-credential-reuse.test.ts
PR Review Advisor — InformationalAdvisor assessment: Informational / high confidence Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. Since last review: 0 prior items resolved · 0 still apply · 0 new items found E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: 3 optional E2E recommendations
This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
|
Addressed all CodeRabbit findings in
Validation: 22 focused/changed test files (339 tests), typecheck, all-files prek, and commit/push hooks passed. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/onboard/machine/core-flow-phases.ts`:
- Around line 69-79: Update endpointSourceForPhase in
src/lib/onboard/machine/core-flow-phases.ts:69-79 to carry the persisted
canonical endpoint with its source and return "onboard" only when that endpoint
exactly matches the current provider endpoint. In
src/lib/onboard/machine/handlers/provider-inference.ts:638-641 and :832-833,
assign onboardEndpointUrl only after this exact-match validation in both resume
and non-resume setup flows.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 07655b29-ba75-4e37-b736-da5b001de037
📒 Files selected for processing (18)
docs/reference/commands.mdxsrc/lib/actions/sandbox/rebuild-preflight-target-phase.test.tssrc/lib/actions/sandbox/rebuild-resume-config.test.tssrc/lib/actions/sandbox/rebuild-target-staging.test.tssrc/lib/onboard.tssrc/lib/onboard/machine/core-flow-phases.tssrc/lib/onboard/machine/handlers/provider-inference-route-containment.test.tssrc/lib/onboard/machine/handlers/provider-inference.tssrc/lib/onboard/machine/handlers/sandbox-dcode-selection.test.tssrc/lib/onboard/machine/handlers/sandbox-tool-disclosure.test.tssrc/lib/onboard/machine/handlers/sandbox.test.tssrc/lib/onboard/machine/handlers/sandbox.tssrc/lib/onboard/provider-recovery.test.tssrc/lib/onboard/setup-inference-route-containment.test.tssrc/lib/onboard/setup-inference.tssrc/lib/onboard/setup-nim-flow.test.tssrc/lib/onboard/setup-nim-flow.tstest/onboard-remote-recreate-credential-reuse.test.ts
🚧 Files skipped from review as they are similar to previous changes (4)
- src/lib/onboard/machine/handlers/sandbox.test.ts
- src/lib/onboard/setup-inference.ts
- test/onboard-remote-recreate-credential-reuse.test.ts
- docs/reference/commands.mdx
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
|
PRA-1 addressed in |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/lib/onboard/machine/handlers/provider-inference.ts (1)
558-558: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winPersist
endpointSourcewith provider selection.
endpointSourceis updated locally here, but the subsequentrecordStepComplete("provider_selection")persistsendpointUrlwithout it. If inference then fails, resume reloadsnullprovenance and no longer recognizes the previously validated onboarding endpoint. PersistendpointSourcein that session update and add an interrupted-selection/resume regression test.Proposed fix
provider, model, endpointUrl, + endpointSource, credentialEnv,As per path instructions, resume behavior must converge on the same authoritative path as a fresh run.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/machine/handlers/provider-inference.ts` at line 558, Update the provider-selection persistence flow in the inference handler so recordStepComplete("provider_selection") stores the locally resolved endpointSource alongside endpointUrl. Add an interrupted-selection/resume regression test verifying provenance survives reload and resume follows the same authoritative endpoint-validation path as a fresh run.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@src/lib/onboard/machine/handlers/provider-inference.ts`:
- Line 558: Update the provider-selection persistence flow in the inference
handler so recordStepComplete("provider_selection") stores the locally resolved
endpointSource alongside endpointUrl. Add an interrupted-selection/resume
regression test verifying provenance survives reload and resume follows the same
authoritative endpoint-validation path as a fresh run.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ad9cf0d2-5765-4e23-b6c0-f721469a368e
📒 Files selected for processing (3)
src/lib/onboard/machine/handlers/provider-inference-route-containment.test.tssrc/lib/onboard/machine/handlers/provider-inference.test.tssrc/lib/onboard/machine/handlers/provider-inference.ts
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/lib/onboard/machine/core-flow-phases.test.ts (1)
436-492: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winSolid exact-match provenance coverage; consider also asserting
result.context.onboardEndpointUrl.The test correctly verifies
setupInference's receivedendpointSource/onboardEndpointUrlandresult.context.endpointSourcefor both matching and mismatched registry entries, but doesn't assertresult.context.onboardEndpointUrl, even thoughmergeProviderModelSelectedContextcarries that field through too (core-flow-phases.ts L171). Adding it would fully confirm the merge, not just the inference-options side.✅ Proposed addition
expect(result.context.endpointSource).toBe(expectedSource); + expect(result.context.onboardEndpointUrl).toBe( + expectTrustedUrl ? "https://persisted.example.test/v1" : null, + ); });🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/machine/core-flow-phases.test.ts` around lines 436 - 492, Extend the parameterized test around providerPhase.run to also assert result.context.onboardEndpointUrl. Expect the persisted endpoint URL for the matching case and no onboardEndpointUrl property for the mismatched case, confirming mergeProviderModelSelectedContext preserves the same exact-match provenance behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/lib/onboard/machine/core-flow-phases.test.ts`:
- Around line 436-492: Extend the parameterized test around providerPhase.run to
also assert result.context.onboardEndpointUrl. Expect the persisted endpoint URL
for the matching case and no onboardEndpointUrl property for the mismatched
case, confirming mergeProviderModelSelectedContext preserves the same
exact-match provenance behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 47f6683f-2927-4935-91f9-17e77b3d2de5
📒 Files selected for processing (6)
src/lib/onboard.tssrc/lib/onboard/machine/core-flow-phases.test.tssrc/lib/onboard/machine/core-flow-phases.tssrc/lib/onboard/machine/flow-context.tssrc/lib/onboard/machine/handlers/provider-inference-route-containment.test.tssrc/lib/onboard/machine/handlers/provider-inference.ts
🚧 Files skipped from review as they are similar to previous changes (2)
- src/lib/onboard.ts
- src/lib/onboard/machine/handlers/provider-inference.ts
|
Exact-head security follow-up on One non-blocking contract warning remains: an interrupted provider-selection step records The branch is now behind current |
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
|
Addressed Charan’s follow-up in
Validation: 23 changed test files / 368 tests; focused provenance and live-slice set 72/72; CLI build; JS and CLI typechecks; conditional/source-shape and test-size budgets; commit and push hooks. Fresh exact-head CI is running now. |
<!-- markdownlint-disable MD041 --> ## Summary Add the canonical dated changelog entry for NemoClaw `v0.0.89` before the release plan captures the tag commit. The entry summarizes the user-visible Station preparation, inference, recovery, policy-disclosure, and CLI-containment changes merged since `v0.0.88`. ## Changes - Add `docs/changelog/2026-07-20.mdx` with the exact `## v0.0.89` release heading, parser-safe SPDX comment, summary, and detailed bullets. - Link each shipped theme to the most specific published OpenClaw documentation routes. - Keep internal E2E, advisory-registry, and review-workflow refactors out of the user-facing release summary. Source summary: - #7214, #7241, #7237, #7223, #7204, #7202, #7183, and #7090 -> `docs/changelog/2026-07-20.mdx`: Summarize qualified DGX Station identity, package-state, PackageKit, DKMS, and reboot-handoff fixes. - #7242, #7221, #7186, #7164, and #6874 -> `docs/changelog/2026-07-20.mdx`: Summarize inference endpoint provenance, provider attachment, managed vLLM cleanup and progress, and Ollama selection guidance. - #7225, #7216, #7192, #7136, #7096, and #6910 -> `docs/changelog/2026-07-20.mdx`: Summarize sandbox readiness, recovery guidance, rebuilt model routing, durable Hermes state, and gateway restart behavior. - #7187 -> `docs/changelog/2026-07-20.mdx`: Summarize complete effective messaging-preset egress disclosure before policy mutation. - #7218, #7165, and #7184 -> `docs/changelog/2026-07-20.mdx`: Summarize structured output containment, terminal-safe route display, and Hermes forward cleanup. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: This PR adds release-history prose only; the focused changelog contract test validates its required structure and routes. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `mise exec node@22.23.1 -- npx vitest run test/changelog-docs.test.ts` (6 passed). - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — not applicable to this doc-only release entry. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — `mise exec node@22.23.1 -- npm run docs` completed with 0 errors and 2 existing site-wide warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) — the native changelog entry uses the required parser-safe MDX SPDX comment and does not use frontmatter. --- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Expanded DGX Station installation support for qualified GB300 and OTA-upgraded environments. * Preserved selected inference providers, endpoints, model pins, and tuning settings during sandbox creation and rebuilds. * Improved sandbox recovery by validating availability and stability before restarting services. * Added clearer policy output showing the complete effective messaging egress configuration. * **Bug Fixes** * Hardened status and inference route displays by sanitizing terminal control characters. * Improved Hermes uninstall behavior by stopping detached dashboard forwarding. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
<!-- markdownlint-disable MD041 --> ## Summary Add the canonical `## v0.0.90` entry to `docs/changelog/2026-07-20.mdx` before the release tag is planned. The update also corrects the documented custom-image migration window so the compatibility fallback that first ships in v0.0.90 remains available until v0.0.91. ## Changes - Add the v0.0.90 summary and detailed release bullets for managed-image routing, provider-reset recovery, WhatsApp health reporting, and DGX Station guidance. - Keep the newest release first in the shared dated changelog and use root-absolute links to the canonical OpenClaw routes. - Correct `docs/reference/commands.mdx` to state that the legacy image route selector remains supported through v0.0.90 and is removed in v0.0.91. - Release source summary: - [#7264](#7264) -> `docs/resources/prompt-assets/dgx-station.md`, `docs/changelog/2026-07-20.mdx`: Record the versioned Station installer path, Nemotron 3 Ultra 550B default, and explicit DeepSeek override. - [#7261](#7261) -> `docs/get-started/dgx-station-preparation.mdx`, `docs/manage-sandboxes/recover-rebuild-sandboxes.mdx`, `docs/changelog/2026-07-20.mdx`: Include the OpenIB, legacy recovery, and Additional Setup documentation follow-ups. - [#7232](#7232) -> `docs/changelog/2026-07-20.mdx`: Document provider-reset recovery for wrapped OpenShell attachment diagnostics. - [#7189](#7189) -> `docs/reference/commands.mdx`, `docs/changelog/2026-07-20.mdx`: Document the managed-image route-selector rename and correct its one-release migration window. - [#7015](#7015) -> `docs/changelog/2026-07-20.mdx`: Document corrected OpenClaw WhatsApp health reporting. - No additional user-facing page update is needed for [#7193](#7193), [#7110](#7110), [#6783](#6783), or [#7263](#7263) because they change contributor governance, internal CI or release automation, or editorial style without changing supported user behavior. - [#7242](#7242) and [#7225](#7225) are already ancestors of and documented in v0.0.89, so this entry does not duplicate them despite their stale v0.0.90 labels. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: `test/changelog-docs.test.ts` validates the dated changelog heading, SPDX form, version order, and published links. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: Not applicable; this PR does not change `scripts/prepare-dgx-station-host.sh` or runtime behavior. - Station profile/scenario: Not applicable. - Result: Not applicable. - Supporting evidence: Not applicable. ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npx vitest run test/changelog-docs.test.ts` (6 passed). - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: Not run; this is a focused documentation-only change. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — passed with 0 errors and two unrelated baseline warnings for unauthenticated redirect checks and the existing light-mode contrast ratio. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Added release notes for v0.0.90 covering inference routing, credential reset behavior, WhatsApp status detection, and DGX Station coding-agent guidance. - Updated custom Dockerfile guidance to document continued support for the legacy provider argument through v0.0.90. - Clarified that legacy declarations must be renamed to `NEMOCLAW_INFERENCE_PROVIDER_ID` before v0.0.91. - Added and refreshed related documentation links. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
4 participants
Summary
Preserves the trust origin of custom inference endpoints so an exact endpoint accepted during onboarding can be re-applied after its DNS changes to an internal address. Endpoints created by
inference set, legacy records without provenance, and mismatched URLs remain on the full SSRF/DNS-pinning path.Related Issue
Fixes #6321.
Changes
onboardversusinference-setendpoint provenance in sandbox registry routes and fail closed when the source is absent or invalid.Type of Change
Quality Gates
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablenpx vitest runon 15 affected files: 213 passednpm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes —npm testwas attempted on the exact base; the long macOS integration run reproduced unrelated timing/environment failures before being stopped, while all affected tests pass independentlynpm run docsbuilds without warnings (doc changes only)AI Disclosure
Signed-off-by: Aaron Erickson aerickson@nvidia.com
Summary by CodeRabbit