No actionable comments were generated in the recent review. 🎉

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0ce217b8-1510-4809-8445-d470c8fdb08e

Reviewing files that changed from the base of the PR and between 87c7b6c and 6a6406e.

• test/e2e/RETRY_INVENTORY.md

• test/e2e/RETRY_INVENTORY.md

Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review.

Walkthrough

The PR adds managed-image catalog publication for qualifying pull requests, integrates catalog installation into E2E workflows, adds two-pass OpenClaw MCP discovery coverage, and enforces catalog revision consistency during workload preparation, onboarding, and rebuilds.

Changes

Managed-image E2E flow

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: 🟡 Moderate · up to 6a640

The PR changes how same-repository E2E runs select managed-image cohorts and adds required discovery checks, but the current workflow cannot complete those checks because revision validation is invalid and the publication contract count conflicts with the three-agent matrix. These failures can block every affected PR run, so merge should wait for the workflow fixes and policy clearance for the added repository URL.

Sequence Diagram(s)

sequenceDiagram
  participant PullRequest
  participant Workflow
  participant Publisher
  participant Catalog
  participant OpenClaw
  PullRequest->>Workflow: trigger qualifying PR validation
  Workflow->>Publisher: resolve candidate catalog
  Publisher-->>Workflow: write exact catalog
  Workflow->>Catalog: validate revision and agent set
  Workflow->>OpenClaw: run trusted-private MCP discovery
  OpenClaw-->>Workflow: produce diagnostics and evidence

Possibly related PRs

• NVIDIA/NemoClaw#9323: Both PRs modify managed-image catalog resolution and onboarding preparation.

❌ Failed checks (1 warning)

• Create PR with unit tests
• Commit unit tests in branch fix/issue-8746-coherent-mcp-runtime

Comment @coderabbitai help to get the list of available commands.

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 87c7b6c in the fix/issue-8746-coher... branch remains at 96%, unchanged from commit d583fa1 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 87c7b6c in the fix/issue-8746-coher... branch remains at 83%, unchanged from commit d583fa1 in the main branch.

Updated August 18, 2026 19:16 UTC

@coderabbitai review

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: Review the warnings below.
Findings: 0 blockers · 1 warning · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 1 warning · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed after a partial review · low confidence · 0 blockers · 0 warnings · 0 suggestions

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• justified — exact PR managed-image catalog at .github/workflows/e2e.yaml:543: Keep the term. The PR and release contrast makes each modifier necessary.
• established — publication cohort at test/e2e/RETRY_INVENTORY.md:21: Keep the established term and its existing meaning.
• define — trusted-private MCP discovery at .github/workflows/managed-images.yaml:907: Define trusted-private at the first explanatory use as MCP discovery through a configured private endpoint with the existing trust controls.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: managed-image-protected-runtime

Manual-only E2E: cloud-onboard, managed-image-multiarch-startup, security-posture, onboard-repair, onboard-resume, mcp-bridge, cloud-inference, rebuild-openclaw, state-backup-restore
The manual PR workflow does not run these selectors for the commit under review. Run them from reviewed code on main.

Warnings

Warnings do not block.

PRA-1 Warning — Add resolver orchestration coverage for catalog applicability

• Location: tools/e2e/pr-managed-image-publication.mts:300
• Category: tests
• Problem: The new resolver has tests for helper functions, but no test exercises its request sequence and conditional exit. A future change can request publication artifacts for an unchanged PR, or write a catalog before all bound requests complete, without failing the existing tests.
• Impact: A regression in the new trusted planner can select an unnecessary catalog or weaken the intended ordered evidence boundary without a focused test failure.
• Recommendation: Add mocked-request tests for the unchanged-path early return and the managed-path full request sequence with three validated contract archives.
• Verification: Read `test/e2e/support/pr-managed-image-publication.test.ts` and confirm it invokes `resolvePrManagedImageCatalog` for both applicability branches.
• Test coverage: Exercise `resolvePrManagedImageCatalog` with a mocked request function. Assert no workflow-run or artifact request occurs for an unchanged path. Assert the managed path writes the exact catalog only after all expected requests succeed.
• Simplification (shrink): Remove Separate helper-only assertions that duplicate the resolver request-path checks.; use Use two resolver-level mocked-request tests that also assert the existing helper outcomes.. Net: 0 lines.
• Keep: Retain unit coverage for artifact identity and contract validation because those checks enforce the trust boundary.
• Evidence: `tools/e2e/pr-managed-image-publication.mts:300-379` implements the applicability branch and ordered GitHub request sequence. `test/e2e/support/pr-managed-image-publication.test.ts` imports and tests helper functions but has no invocation of `resolvePrManagedImageCatalog`.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

@coderabbitai review

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Addressed the LOC/simplicity blocking review in 7e73f324bf9a6c3fdbe822daf3e67220dbf8b107: both managed activation and the two-pass MCP acceptance now invoke the shared assembleManagedImageCatalog owner through one CLI command. The duplicate jq schemas and redundant revision recheck are removed; contract-count diagnostics derive from SHIPPED_MANAGED_IMAGE_AGENTS.length; and workflow/unit/growth coverage passed locally.

@coderabbitai The outside-diff cloudflared URL finding is not actionable for this PR. This job intentionally matches the repository-approved official Cloudflare release pin already used in .github/workflows/e2e.yaml (three call sites) and .github/workflows/e2e-standard-profile.yaml, with the same exact version, SHA-256 verification, and Debian package name/version/architecture checks; tools/e2e/mcp-workflow-boundary.mts and tools/e2e/standard-profile-workflow-boundary.mts explicitly enforce that source. Replacing only this acceptance job with a different distribution channel would break trusted-workflow parity and expand #8746 into unrelated dependency-distribution infrastructure. Please mark this outside-diff finding resolved.

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '== cloudflared references in workflows and boundary files =='
rg -n -C 5 --fixed-strings 'cloudflared' \
  .github/workflows/e2e.yaml \
  .github/workflows/e2e-standard-profile.yaml \
  .github/workflows/managed-images.yaml \
  tools/e2e/mcp-workflow-boundary.mts \
  tools/e2e/standard-profile-workflow-boundary.mts

echo '== release URL and checksum-related references =='
rg -n -C 3 -i 'github\.com/cloudflare/cloudflared|cloudflare.*release|sha256|dpkg.*cloudflared|cloudflared.*(amd64|version)' \
  .github/workflows/e2e.yaml \
  .github/workflows/e2e-standard-profile.yaml \
  .github/workflows/managed-images.yaml \
  tools/e2e/mcp-workflow-boundary.mts \
  tools/e2e/standard-profile-workflow-boundary.mts

echo '== CodeRabbit review threads on PR 9484 =='
gh api graphql -f query='
query {
  repository(owner: "NVIDIA", name: "NemoClaw") {
    pullRequest(number: 9484) {
      reviewThreads(first: 100) {
        nodes {
          id
          isResolved
          comments(first: 20) {
            nodes {
              author { login }
              body
              path
              line
            }
          }
        }
      }
    }
  }
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
  | select(any(.comments.nodes[]; (.author.login == "coderabbitai" or .author.login == "coderabbitai[bot]") and (.body | test("cloudflared"; "i"))))
  | {id, isResolved, comments}'

Length of output: 125183

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '== PR review comments that reference the Cloudflare package or URL =='
gh api --paginate \
  'repos/NVIDIA/NemoClaw/pulls/9484/comments?per_page=100' \
  --jq '.[] | select((.body | test("cloudflared|cloudflare|releases/download"; "i"))) | {
    id,
    node_id,
    user: .user.login,
    path,
    line,
    in_reply_to_id,
    body
  }'

echo '== unresolved review threads and their comments =='
gh api graphql -f query='
query {
  repository(owner: "NVIDIA", name: "NemoClaw") {
    pullRequest(number: 9484) {
      reviewThreads(first: 100) {
        nodes {
          id
          isResolved
          path
          line
          comments(first: 100) {
            nodes {
              author { login }
              body
            }
          }
        }
      }
    }
  }
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
  | select(.isResolved == false)
  | {id, path, line, comments}'

Length of output: 1208

@ericksoa, confirmed. The acceptance job matches the existing reviewed cloudflared release source and validation controls.

The job uses the same version, SHA-256 value, URL, checksum verification, and Debian package metadata checks as the established E2E workflows. The MCP and standard-profile boundary checks enforce this exact source and reject mutable package repositories.

I found no active GitHub review thread for this finding to resolve. The finding is withdrawn.

You are interacting with an AI system.